@rexvane/piweb 0.3.14 → 0.3.16

package/scripts/managed-niubash-assets.mjs

@@ -0,0 +1,146 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+export const NIUBASH_VERSION = "1.1.4";
+export const NIUBASH_TAG = `v${NIUBASH_VERSION}`;
+export const NIUBASH_DISTRIBUTION_VERSION = `${NIUBASH_VERSION}-piweb.0`;
+export const NIUBASH_REPOSITORY = "https://github.com/unixwin/niubash";
+
+export const MANAGED_NIUBASH_ASSETS = Object.freeze({
+	x64: Object.freeze({
+		arch: "x64",
+		machine: 0x8664,
+		packageName: "@rexvane/piweb-niubash-win32-x64",
+		directory: "piweb-niubash-win32-x64",
+		asset: "niubash-v1.1.4-win-x64.zip",
+		sha256: "9f543634288a316f7ed8e5a76ff794eca402cb21e74b8f8a551daffafde162f5",
+	}),
+	arm64: Object.freeze({
+		arch: "arm64",
+		machine: 0xaa64,
+		packageName: "@rexvane/piweb-niubash-win32-arm64",
+		directory: "piweb-niubash-win32-arm64",
+		asset: "niubash-v1.1.4-win-arm64.zip",
+		sha256: "77e98ba8d7f6be70c35388bcc28bdbc883c06bcaafffbe186a88788ad32ccf00",
+	}),
+});
+
+export const NIUBASH_LICENSES = Object.freeze([
+	Object.freeze({
+		filename: "NIUBASH.txt",
+		url: "https://raw.githubusercontent.com/unixwin/niubash/v1.1.4/LICENSE",
+		sha256: "1290aae99e71239ee3154e7847830e49e7a36c758fa6d659d73fa752dc9f81c8",
+	}),
+	Object.freeze({
+		filename: "RUBASH.txt",
+		url: "https://raw.githubusercontent.com/unixwin/rubash/8b81c7501646/LICENSE",
+		sha256: "e426a75a20633f3088da22aef61a5a44d06f1f884c600f6011d00702c3989079",
+	}),
+	Object.freeze({
+		filename: "WINUXCMD.txt",
+		url: "https://raw.githubusercontent.com/unixwin/WinuxCmd/v1.0.8/LICENSE",
+		sha256: "8ffc4ed56f5e6ab8183a7ece2e3aa6ea4800b0a4e8170d11bd60856f2dd760f3",
+	}),
+]);
+
+export function niubashAssetUrl(asset) {
+	return `${NIUBASH_REPOSITORY}/releases/download/${NIUBASH_TAG}/${asset.asset}`;
+}
+
+export function sha256(data) {
+	return crypto.createHash("sha256").update(data).digest("hex");
+}
+
+export function sha256File(filename) {
+	return sha256(fs.readFileSync(filename));
+}
+
+export function listFiles(root) {
+	const files = [];
+	const visit = (directory, prefix = "") => {
+		for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+			const absolute = path.join(directory, entry.name);
+			if (entry.isDirectory()) visit(absolute, relative);
+			else if (entry.isFile()) files.push(relative);
+			else throw new Error(`managed niubash runtime contains an unsupported entry: ${relative}`);
+		}
+	};
+	visit(root);
+	return files;
+}
+
+export function readPeMachine(filename) {
+	const data = fs.readFileSync(filename);
+	if (data.length < 64 || data[0] !== 0x4d || data[1] !== 0x5a) throw new Error(`${filename} is not a PE executable`);
+	const peOffset = data.readUInt32LE(0x3c);
+	if (peOffset + 6 > data.length || data.toString("ascii", peOffset, peOffset + 4) !== "PE\0\0") {
+		throw new Error(`${filename} has an invalid PE header`);
+	}
+	return data.readUInt16LE(peOffset + 4);
+}
+
+function readJson(filename) {
+	return JSON.parse(fs.readFileSync(filename, "utf8"));
+}
+
+function assertEqual(actual, expected, label) {
+	if (actual !== expected) throw new Error(`${label}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+
+/** Validate a prepared source package or an unpacked npm tarball. */
+export function validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles = true } = {}) {
+	const packageInfo = readJson(path.join(packageRoot, "package.json"));
+	assertEqual(packageInfo.name, asset.packageName, "managed niubash package name");
+	assertEqual(packageInfo.version, NIUBASH_DISTRIBUTION_VERSION, "managed niubash package version");
+	if (!Array.isArray(packageInfo.os) || packageInfo.os.length !== 1 || packageInfo.os[0] !== "win32") {
+		throw new Error(`${asset.packageName} must be restricted to os=win32`);
+	}
+	if (!Array.isArray(packageInfo.cpu) || packageInfo.cpu.length !== 1 || packageInfo.cpu[0] !== asset.arch) {
+		throw new Error(`${asset.packageName} must be restricted to cpu=${asset.arch}`);
+	}
+
+	const runtime = path.join(packageRoot, "runtime");
+	if (!fs.existsSync(path.join(runtime, "niu.exe"))) {
+		throw new Error(`${asset.packageName} has no prepared runtime; run \`node scripts/prepare-niubash-packages.mjs\` before packing/publishing`);
+	}
+	const manifest = readJson(path.join(packageRoot, "runtime-manifest.json"));
+	assertEqual(manifest.schema, 1, "managed niubash manifest schema");
+	assertEqual(manifest.source?.repository, NIUBASH_REPOSITORY, "managed niubash source repository");
+	assertEqual(manifest.source?.tag, NIUBASH_TAG, "managed niubash source tag");
+	assertEqual(manifest.source?.asset, asset.asset, "managed niubash source asset");
+	assertEqual(manifest.source?.sha256, asset.sha256, "managed niubash source SHA-256");
+	if (!manifest.files || typeof manifest.files !== "object" || Array.isArray(manifest.files)) {
+		throw new Error(`${asset.packageName} runtime manifest has no file map`);
+	}
+	const expectedFiles = Object.keys(manifest.files);
+	if (expectedFiles.length < 300) throw new Error(`${asset.packageName} runtime is incomplete (${expectedFiles.length} files)`);
+	for (const relative of expectedFiles) {
+		if (!relative || relative.includes("\\") || path.posix.isAbsolute(relative) || relative.split("/").includes("..")) {
+			throw new Error(`${asset.packageName} runtime manifest contains an unsafe path: ${relative}`);
+		}
+		const filename = path.join(runtime, ...relative.split("/"));
+		const stat = fs.statSync(filename);
+		if (!stat.isFile()) throw new Error(`${asset.packageName} runtime entry is not a file: ${relative}`);
+		assertEqual(sha256File(filename), manifest.files[relative], `${asset.packageName} hash for ${relative}`);
+	}
+	const actualFiles = listFiles(runtime);
+	const extra = actualFiles.filter((file) => !(file in manifest.files));
+	if (!allowExtraRuntimeFiles && extra.length > 0) {
+		throw new Error(
+			`${asset.packageName} runtime has ${extra.length} files not in the signed manifest (niubash self-activates command links on first run). Re-run \`node scripts/prepare-niubash-packages.mjs\` before packing. First extra: ${extra[0]}`,
+		);
+	}
+
+	for (const required of ["niu.exe", "winuxcmd/usr/bin/winuxcmd.exe", "bundles/oh-my-niu/bundle.toml"]) {
+		if (!expectedFiles.includes(required)) throw new Error(`${asset.packageName} is missing ${required}`);
+	}
+	for (const executable of ["niu.exe", "winuxcmd/usr/bin/winuxcmd.exe"]) {
+		assertEqual(readPeMachine(path.join(runtime, ...executable.split("/"))), asset.machine, `${asset.packageName} PE machine for ${executable}`);
+	}
+	for (const license of NIUBASH_LICENSES) {
+		assertEqual(sha256File(path.join(packageRoot, "licenses", license.filename)), license.sha256, `${asset.packageName} license ${license.filename}`);
+	}
+	return { files: expectedFiles.length, runtime };
+}

package/scripts/pick-folder.ps1

@@ -82,6 +82,10 @@ public class PiFolderPicker {
     }
   }
 
+  public static bool ShouldRetryWithoutOwner(int hr, IntPtr hwnd) {
+    return hr == unchecked((int)0x80070578) && hwnd != IntPtr.Zero;
+  }
+
   public static string Pick(string title) {
     try {
       EnableDpiAwareness();
@@ -90,8 +94,13 @@ public class PiFolderPicker {
       dlg.GetOptions(out options);
       dlg.SetOptions(options | FOS_PICKFOLDERS | FOS_FORCEFILESYSTEM);
       if (!string.IsNullOrEmpty(title)) dlg.SetTitle(title);
-      dlg.SetOkButtonLabel(OkLabel);
-      int hr = dlg.Show(GetForegroundWindow());
+      IntPtr hwnd = GetForegroundWindow();
+      int hr = dlg.Show(hwnd);
+      if (hr == unchecked((int)0x800704C7)) return "";
+      // Retry only an invalid owner handle, never a user cancellation or arbitrary failure.
+      if (ShouldRetryWithoutOwner(hr, hwnd)) {
+        hr = dlg.Show(IntPtr.Zero);
+      }
       if (hr != 0) return "";
       IShellItem item;
       dlg.GetResult(out item);

package/scripts/prepare-niubash-packages.mjs

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * Build the Windows-only npm packages from pinned official niubash portable
+ * archives. Nothing is downloaded on macOS/Linux user installs: this runs only
+ * in PiWeb's release workflow (or explicitly by a maintainer).
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+	MANAGED_NIUBASH_ASSETS,
+	NIUBASH_LICENSES,
+	NIUBASH_REPOSITORY,
+	NIUBASH_TAG,
+	listFiles,
+	niubashAssetUrl,
+	sha256,
+	sha256File,
+	validateManagedNiubashPackage,
+} from "./managed-niubash-assets.mjs";
+import { isMainModule } from "./entrypoint.mjs";
+
+const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+async function download(url, expectedSha256) {
+	let lastError;
+	for (let attempt = 1; attempt <= 3; attempt += 1) {
+		try {
+			const response = await fetch(url, {
+				headers: { "user-agent": "PiWeb managed-niubash packager" },
+				signal: AbortSignal.timeout(120_000),
+			});
+			if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText}`);
+			const data = Buffer.from(await response.arrayBuffer());
+			const actual = sha256(data);
+			if (actual !== expectedSha256) throw new Error(`SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
+			return data;
+		} catch (error) {
+			lastError = error;
+			if (attempt < 3) await new Promise((resolve) => setTimeout(resolve, attempt * 1000));
+		}
+	}
+	throw new Error(`failed to download ${url}: ${lastError instanceof Error ? lastError.message : lastError}`);
+}
+
+function extractZip(archive, destination) {
+	fs.mkdirSync(destination, { recursive: true });
+	let result;
+	if (process.platform === "win32") {
+		result = spawnSync("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			"Expand-Archive -LiteralPath $env:PIWEB_NIUBASH_ARCHIVE -DestinationPath $env:PIWEB_NIUBASH_DESTINATION -Force",
+		], {
+			encoding: "utf8",
+			env: { ...process.env, PIWEB_NIUBASH_ARCHIVE: archive, PIWEB_NIUBASH_DESTINATION: destination },
+		});
+	} else {
+		result = spawnSync("unzip", ["-q", "-o", archive, "-d", destination], { encoding: "utf8" });
+		if (result.error?.code === "ENOENT") {
+			result = spawnSync("python3", ["-m", "zipfile", "-e", archive, destination], { encoding: "utf8" });
+		}
+	}
+	if (result.error) throw new Error(`cannot extract ${path.basename(archive)}: ${result.error.message}`);
+	if (result.status !== 0) throw new Error(`cannot extract ${path.basename(archive)}: ${result.stderr || result.stdout}`);
+}
+
+async function replaceDirectory(source, destination) {
+	fs.rmSync(destination, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	for (let attempt = 1; ; attempt += 1) {
+		try {
+			fs.renameSync(source, destination);
+			return;
+		} catch (error) {
+			// Windows：刚写入几百个文件时，Defender/索引器会短暂持有句柄，目录 rename 报 EPERM。
+			// 先退避重试，仍不行就退化成复制（读通常是被允许的）。
+			if (!["EPERM", "EBUSY", "EACCES"].includes(error?.code)) throw error;
+			if (attempt >= 5) {
+				fs.cpSync(source, destination, { recursive: true });
+				fs.rmSync(source, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, attempt * 250));
+		}
+	}
+}
+
+function extractedPortableRoot(destination) {
+	const entries = fs.readdirSync(destination, { withFileTypes: true }).filter((entry) => entry.name !== "__MACOSX");
+	if (entries.length !== 1 || !entries[0].isDirectory()) throw new Error("niubash archive must contain exactly one top-level directory");
+	return path.join(destination, entries[0].name);
+}
+
+async function prepareLicenses(root, packageRoot) {
+	const destination = path.join(packageRoot, "licenses");
+	const staging = path.join(packageRoot, `.licenses-${process.pid}`);
+	fs.rmSync(staging, { recursive: true, force: true });
+	fs.mkdirSync(staging, { recursive: true });
+	try {
+		for (const license of NIUBASH_LICENSES) {
+			const source = path.join(root, "third-party", "managed-niubash", "licenses", license.filename);
+			if (sha256File(source) !== license.sha256) throw new Error(`license source failed integrity check: ${license.filename}`);
+			fs.copyFileSync(source, path.join(staging, license.filename));
+		}
+		await replaceDirectory(staging, destination);
+	} finally {
+		fs.rmSync(staging, { recursive: true, force: true });
+	}
+}
+
+async function prepareAsset(root, asset, log) {
+	const packageRoot = path.join(root, "platform-packages", asset.directory);
+	if (!fs.existsSync(path.join(packageRoot, "package.json"))) throw new Error(`missing platform package skeleton: ${packageRoot}`);
+	const temporary = fs.mkdtempSync(path.join(os.tmpdir(), `piweb-niubash-${asset.arch}-`));
+	const archive = path.join(temporary, asset.asset);
+	const extracted = path.join(temporary, "extracted");
+	const staging = path.join(packageRoot, `.runtime-${process.pid}`);
+	try {
+		log(`[piweb] Downloading ${asset.asset} ...`);
+		fs.writeFileSync(archive, await download(niubashAssetUrl(asset), asset.sha256));
+		extractZip(archive, extracted);
+		const source = extractedPortableRoot(extracted);
+		for (const required of ["niu.exe", "winuxcmd", "bundles"]) {
+			if (!fs.existsSync(path.join(source, required))) throw new Error(`${asset.asset} is missing ${required}`);
+		}
+
+		fs.rmSync(staging, { recursive: true, force: true });
+		fs.cpSync(source, staging, { recursive: true });
+		await replaceDirectory(staging, path.join(packageRoot, "runtime"));
+		const runtime = path.join(packageRoot, "runtime");
+
+		const files = {};
+		for (const relative of listFiles(runtime)) files[relative] = sha256File(path.join(runtime, ...relative.split("/")));
+		fs.writeFileSync(path.join(packageRoot, "runtime-manifest.json"), `${JSON.stringify({
+			schema: 1,
+			source: { repository: NIUBASH_REPOSITORY, tag: NIUBASH_TAG, asset: asset.asset, sha256: asset.sha256 },
+			files,
+		}, null, 2)}\n`);
+		await prepareLicenses(root, packageRoot);
+		const checked = validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles: false });
+		log(`[piweb] Prepared ${asset.packageName}: ${checked.files} runtime files.`);
+		return checked;
+	} finally {
+		fs.rmSync(staging, { recursive: true, force: true });
+		fs.rmSync(temporary, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	}
+}
+
+function selectAssets(args) {
+	if (args.length === 0) return Object.values(MANAGED_NIUBASH_ASSETS);
+	if (args.length === 1 && args[0] === "--current") {
+		if (process.platform !== "win32" || !(process.arch in MANAGED_NIUBASH_ASSETS)) {
+			throw new Error(`--current requires Windows x64/ARM64 (got ${process.platform}/${process.arch})`);
+		}
+		return [MANAGED_NIUBASH_ASSETS[process.arch]];
+	}
+	if (args.length === 1 && args[0].startsWith("--arch=")) {
+		const arch = args[0].slice("--arch=".length);
+		const asset = MANAGED_NIUBASH_ASSETS[arch];
+		if (!asset) throw new Error(`unsupported niubash architecture: ${arch}`);
+		return [asset];
+	}
+	throw new Error("Usage: node scripts/prepare-niubash-packages.mjs [--current|--arch=x64|--arch=arm64]");
+}
+
+export async function prepareManagedNiubashPackages(root = DEFAULT_ROOT, { args = [], log = console.log } = {}) {
+	const results = [];
+	for (const asset of selectAssets(args)) results.push(await prepareAsset(root, asset, log));
+	return results;
+}
+
+if (isMainModule(import.meta.url)) {
+	try {
+		await prepareManagedNiubashPackages(DEFAULT_ROOT, { args: process.argv.slice(2) });
+	} catch (error) {
+		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
+		process.exitCode = 1;
+	}
+}

package/scripts/release.mjs

@@ -2,8 +2,7 @@ import fs from "node:fs/promises";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-import { createRequire } from "node:module";
-import { pathToFileURL, fileURLToPath } from "node:url";
+import { fileURLToPath } from "node:url";
 import { assertInstallation, assertLocalPath, readProductionBuild, resolveBuildOutput, RELEASES_DIR, RELEASE_MANIFEST } from "./build-output.mjs";
 import { runCommand } from "./process-runner.mjs";
 import { isMainModule } from "./entrypoint.mjs";
@@ -77,21 +76,6 @@ async function writeReleaseTypeConfig(root, buildDir) {
 	});
 }
 
-/** Run in a fresh process, after install/pull, so cached config/Next modules cannot lie. */
-export async function verifyReleaseConfig(root = process.cwd(), env = process.env) {
-	const installation = assertInstallation(root);
-	const buildDir = resolveBuildOutput(installation, env.PIWEB_BUILD_DIR);
-	if (!buildDir.startsWith(`${RELEASES_DIR}/`)) throw new Error("release requires an isolated build output");
-	const require = createRequire(path.join(installation, "package.json"));
-	const module = await import(pathToFileURL(require.resolve("next/dist/server/config.js")).href);
-	const loadConfig = typeof module.default === "function" ? module.default : module.default.default;
-	const { PHASE_PRODUCTION_BUILD } = require("next/constants");
-	const config = await loadConfig(PHASE_PRODUCTION_BUILD, installation, { silent: true });
-	if (config.distDir !== buildDir || config.typescript?.tsconfigPath !== CONFIG_PATH || config.typescript?.ignoreBuildErrors) {
-		throw new Error("Next config does not honor the isolated release directory/typecheck; refusing to build over the serving output");
-	}
-}
-
 export const PI_PACKAGE = "@earendil-works/pi-coding-agent";
 const PI_AI_PACKAGE = "@earendil-works/pi-ai";
 
@@ -150,7 +134,7 @@ export async function prepareRelease({ root = ROOT, env = process.env, run = run
 		signal?.throwIfAborted();
 		assertInstallation(installation);
 		await writeReleaseTypeConfig(installation, buildDir);
-		await run(process.execPath, [path.join(installation, "scripts", "release.mjs"), "--verify-config"], {
+		await run(process.execPath, [path.join(installation, "scripts", "verify-release-config.mjs")], {
 			cwd: installation, env: childEnv, timeoutMs: 60_000, signal,
 		});
 		await run("npm", ["run", "check"], { cwd: installation, env: childEnv, timeoutMs: 600_000, signal });
@@ -175,19 +159,15 @@ if (isMainModule(import.meta.url)) {
 	process.once("SIGINT", cancel);
 	process.once("SIGTERM", cancel);
 	try {
-		if (process.argv.length === 3 && process.argv[2] === "--verify-config") {
-			await verifyReleaseConfig();
-		} else {
-			const updatePi = process.argv.length === 3 && process.argv[2] === "--update-pi";
-			if (process.argv.length > 2 && !updatePi) throw new Error("Usage: node scripts/release.mjs [--update-pi]");
-			console.log("[piweb] Checking and building an isolated release; the existing server is not restarted.");
-			if (updatePi) console.log("[piweb] Pi dependency update: use a maintenance window with no active sessions; node_modules is shared.");
-			const release = await prepareRelease({
-				signal: controller.signal,
-				prepare: updatePi ? async (context) => { await installPiUpdate(context); } : undefined,
-			});
-			console.log(`[piweb] Release ready: ${release.buildDir} (${release.buildId}). Restart PiWeb manually when idle to use it.`);
-		}
+		const updatePi = process.argv.length === 3 && process.argv[2] === "--update-pi";
+		if (process.argv.length > 2 && !updatePi) throw new Error("Usage: node scripts/release.mjs [--update-pi]");
+		console.log("[piweb] Checking and building an isolated release; the existing server is not restarted.");
+		if (updatePi) console.log("[piweb] Pi dependency update: use a maintenance window with no active sessions; node_modules is shared.");
+		const release = await prepareRelease({
+			signal: controller.signal,
+			prepare: updatePi ? async (context) => { await installPiUpdate(context); } : undefined,
+		});
+		console.log(`[piweb] Release ready: ${release.buildDir} (${release.buildId}). Restart PiWeb manually when idle to use it.`);
 	} catch (error) {
 		console.error(`[piweb] Release failed: ${error instanceof Error ? error.message : error}`);
 		process.exitCode = 1;

package/scripts/run-test-file.mjs

@@ -0,0 +1,34 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const [cwd, selected, reportFile] = process.argv.slice(2);
+let runner;
+try {
+  if (!cwd || !selected || !reportFile) throw new Error("expected workspace, test file and report path");
+  const api = await import(pathToFileURL(path.join(cwd, "node_modules/vitest/dist/node.js")).href);
+  const options = { root: cwd, run: true, watch: false, reporters: ["json"], outputFile: reportFile };
+  runner = Number(api.version.split(".")[0]) >= 5
+    ? await api.createVitest(options)
+    : await api.createVitest("test", options);
+  if (typeof runner.globTestSpecifications !== "function" || typeof runner.runTestSpecifications !== "function") {
+    throw new Error("this Vitest version does not support exact test specifications");
+  }
+  const canonical = (file) => process.platform === "win32" ? file.toLowerCase() : file;
+  const target = canonical(await fs.realpath(selected));
+  const specs = await runner.globTestSpecifications();
+  const exact = [];
+  for (const spec of specs) {
+    if (canonical(await fs.realpath(spec.moduleId)) === target) exact.push(spec);
+  }
+  if (!exact.length) throw new Error("selected file is excluded by the workspace Vitest configuration");
+  // Discovery is read-only; only exact specifications are handed to the executor.
+  if (typeof runner.standalone === "function") await runner.standalone();
+  else await runner.init();
+  await runner.runTestSpecifications(exact);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+} finally {
+  await runner?.close();
+}

package/scripts/smoke-managed-niubash.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/** Native smoke test. Run on both windows-latest (x64) and windows-11-arm. */
+import assert from "node:assert/strict";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { createLocalBashOperations } from "@earendil-works/pi-coding-agent";
+import { MANAGED_NIUBASH_ASSETS, validateManagedNiubashPackage } from "./managed-niubash-assets.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+if (process.platform !== "win32" || !(process.arch in MANAGED_NIUBASH_ASSETS)) {
+	throw new Error(`managed niubash smoke test requires Windows x64/ARM64 (got ${process.platform}/${process.arch})`);
+}
+const asset = MANAGED_NIUBASH_ASSETS[process.arch];
+const packageRoot = path.join(root, "platform-packages", asset.directory);
+validateManagedNiubashPackage(packageRoot, asset, { allowExtraRuntimeFiles: false });
+const require = createRequire(path.join(root, "package.json"));
+const runtime = require(path.join(packageRoot, "index.cjs"));
+assert.equal(runtime.packageName, asset.packageName);
+assert.equal(runtime.arch, process.arch);
+
+const version = spawnSync(runtime.shellPath, ["--version"], { encoding: "utf8", windowsHide: true });
+assert.equal(version.status, 0, version.stderr);
+assert.match(version.stdout, /Niubash 1\.1\.4/);
+assert.match(version.stdout, /rubash\s+git 8b81c7501646/);
+assert.match(version.stdout, /winuxcmd WinuxCmd 1\.0\.8/);
+
+const operations = createLocalBashOperations({ shellPath: runtime.shellPath });
+async function execute(command, options = {}) {
+	const chunks = [];
+	const result = await operations.exec(command, process.cwd(), {
+		onData: (data) => chunks.push(data),
+		...options,
+	});
+	return { exitCode: result.exitCode, output: Buffer.concat(chunks).toString("utf8") };
+}
+
+const empty = await execute("");
+assert.equal(empty.exitCode, 0);
+assert.equal(empty.output, "");
+
+const pwd = await execute("pwd");
+assert.equal(pwd.exitCode, 0);
+assert.equal(path.resolve(pwd.output.trim().replaceAll("/", path.sep)).toLowerCase(), path.resolve(process.cwd()).toLowerCase());
+
+const quoted = await execute(`node -e "console.log(JSON.stringify(process.argv.slice(1)))" 'a b' '' 'c"d' 'e\\f'`);
+assert.equal(quoted.exitCode, 0, quoted.output);
+assert.deepEqual(JSON.parse(quoted.output.trim()), ["a b", "", "c\"d", "e\\f"]);
+
+const shellQuotedCwd = process.cwd().replaceAll("'", `'"'"'`);
+const windowsPath = await execute(`cd '${shellQuotedCwd}' && pwd`);
+assert.equal(windowsPath.exitCode, 0, windowsPath.output);
+assert.equal(path.resolve(windowsPath.output.trim().replaceAll("/", path.sep)).toLowerCase(), path.resolve(process.cwd()).toLowerCase());
+
+await assert.rejects(() => execute("sleep 5", { timeout: 0.1 }), /timeout/);
+const controller = new AbortController();
+const aborted = execute("sleep 5", { signal: controller.signal });
+setTimeout(() => controller.abort(), 100);
+await assert.rejects(() => aborted, /aborted/);
+
+console.log(`[piweb] Managed niubash ${process.arch} smoke test passed (${version.stdout.split(/\r?\n/, 1)[0]}).`);

package/scripts/verify-package.mjs

@@ -13,9 +13,15 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { readProductionBuild } from "./build-output.mjs";
 import { isMainModule } from "./entrypoint.mjs";
+import {
+	MANAGED_NIUBASH_ASSETS,
+	NIUBASH_DISTRIBUTION_VERSION,
+	validateManagedNiubashPackage,
+} from "./managed-niubash-assets.mjs";
 
 const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -66,9 +72,56 @@ export function verifyPackedPackage(root, { log = console.log } = {}) {
 	}
 }
 
+/** Pack and inspect one actual OS/CPU package, including every runtime hash and license. */
+export function verifyPackedManagedNiubashPackage(packageRoot, asset, { log = console.log } = {}) {
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), `piweb-niubash-pack-${asset.arch}-`));
+	try {
+		const packed = JSON.parse(runNpm(["pack", "--json", "--pack-destination", tmp], { cwd: packageRoot }));
+		const entry = Array.isArray(packed) ? packed[0] : packed;
+		if (!entry?.filename) throw new Error(`npm pack produced no tarball for ${asset.packageName}`);
+		const files = (entry.files ?? []).map((file) => String(file.path).replaceAll("\\", "/").replace(/^package\//, ""));
+		for (const required of [
+			"package.json", "index.cjs", "runtime-manifest.json", "runtime/niu.exe",
+			"runtime/winuxcmd/usr/bin/winuxcmd.exe", "runtime/bundles/oh-my-niu/bundle.toml",
+			"licenses/NIUBASH.txt", "licenses/RUBASH.txt", "licenses/WINUXCMD.txt",
+		]) {
+			if (!files.includes(required)) throw new Error(`${asset.packageName} tarball is missing ${required}`);
+		}
+		const unpacked = path.join(tmp, "unpacked");
+		fs.mkdirSync(unpacked, { recursive: true });
+		run("tar", ["-xzf", entry.filename, "-C", "unpacked"], { cwd: tmp });
+		const installedRoot = path.join(unpacked, "package");
+		const checked = validateManagedNiubashPackage(installedRoot, asset, { allowExtraRuntimeFiles: false });
+		const require = createRequire(path.join(installedRoot, "package.json"));
+		const exported = require(path.join(installedRoot, "index.cjs"));
+		if (exported.packageName !== asset.packageName || exported.arch !== asset.arch
+			|| exported.shellPath !== path.join(installedRoot, "runtime", "niu.exe")) {
+			throw new Error(`${asset.packageName} has an invalid runtime export`);
+		}
+		const bytes = fs.statSync(path.join(tmp, entry.filename)).size;
+		log(`[piweb] ${entry.filename}: ${checked.files} runtime files, ${(bytes / 1024 / 1024).toFixed(1)} MB.`);
+		return { filename: entry.filename, files, bytes, runtimeFiles: checked.files };
+	} finally {
+		fs.rmSync(tmp, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+	}
+}
+
+export function verifyManagedNiubashPackages(root, { log = console.log } = {}) {
+	const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+	const results = [];
+	for (const asset of Object.values(MANAGED_NIUBASH_ASSETS)) {
+		if (manifest.optionalDependencies?.[asset.packageName] !== NIUBASH_DISTRIBUTION_VERSION) {
+			throw new Error(`PiWeb must use exact optional dependency ${asset.packageName}@${NIUBASH_DISTRIBUTION_VERSION}`);
+		}
+		results.push(verifyPackedManagedNiubashPackage(path.join(root, "platform-packages", asset.directory), asset, { log }));
+	}
+	return results;
+}
+
 if (isMainModule(import.meta.url)) {
 	try {
 		verifyPackedPackage(DEFAULT_ROOT);
+		verifyManagedNiubashPackages(DEFAULT_ROOT);
 	} catch (error) {
 		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
 		process.exitCode = 1;

package/scripts/verify-release-config.mjs

@@ -0,0 +1,24 @@
+import path from "node:path";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { assertInstallation, resolveBuildOutput, RELEASES_DIR } from "./build-output.mjs";
+import { isMainModule } from "./entrypoint.mjs";
+
+/** Run in a fresh process after install/pull so cached Next config cannot be reused. */
+export async function verifyReleaseConfig(root = process.cwd(), env = process.env) {
+	const installation = assertInstallation(root);
+	const buildDir = resolveBuildOutput(installation, env.PIWEB_BUILD_DIR);
+	if (!buildDir.startsWith(`${RELEASES_DIR}/`)) throw new Error("release requires an isolated build output");
+	const requireFromInstall = createRequire(path.join(installation, "package.json"));
+	const module = await import(pathToFileURL(requireFromInstall.resolve("next/dist/server/config.js")).href);
+	const loadConfig = typeof module.default === "function" ? module.default : module.default.default;
+	const { PHASE_PRODUCTION_BUILD } = requireFromInstall("next/constants");
+	const config = await loadConfig(PHASE_PRODUCTION_BUILD, installation, { silent: true });
+	if (config.distDir !== buildDir || config.typescript?.tsconfigPath !== `${RELEASES_DIR}/tsconfig.json` || config.typescript?.ignoreBuildErrors) {
+		throw new Error("Next config does not honor the isolated release directory/typecheck; refusing to build over the serving output");
+	}
+}
+
+if (isMainModule(import.meta.url)) {
+	await verifyReleaseConfig();
+}

package/src/app/api/config/route.ts

@@ -9,7 +9,10 @@ export const dynamic = "force-dynamic";
 export async function GET() {
 	try {
 		const file = path.join(getAgentDir(), "settings.json");
-		const content = await fs.readFile(file, "utf8");
+		const content = await fs.readFile(file, "utf8").catch((error: NodeJS.ErrnoException) => {
+			if (error.code === "ENOENT") return "{}\n";
+			throw error;
+		});
 		return new Response(content, {
 			headers: {
 				"Content-Type": "application/json; charset=utf-8",

package/src/app/api/security/route.ts

@@ -1,17 +1,22 @@
 import { NextResponse } from "next/server";
 import type { ProjectTrust } from "@/lib/security-service";
 import { getSecurity, setProjectTrust } from "@/lib/security-service";
-import { reloadLoader, setProjectTrust as setProjectTrustDecision } from "@/lib/pi";
+import { reloadLoader, resolveProjectTrust, setProjectTrust as setProjectTrustDecision } from "@/lib/pi";
 import { reloadSessionsForCwd } from "@/lib/agent-manager";
 import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
 
 export const dynamic = "force-dynamic";
 
-export async function GET() {
+export async function GET(req: Request) {
 	try {
+		const params = new URL(req.url).searchParams;
+		if (params.has("cwd")) {
+			const cwd = await resolveWorkspacePath(params.get("cwd"));
+			return NextResponse.json({ success: true, data: resolveProjectTrust(cwd) });
+		}
 		return NextResponse.json({ success: true, data: await getSecurity() });
 	} catch (err: any) {
-		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: 500 });
+		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: err instanceof BoundaryError ? 400 : 500 });
 	}
 }