@vantaloom/runtime-darwin-arm64 0.12.49 → 0.12.50

package/cli/src/lib/lifecycle.mjs

@@ -0,0 +1,187 @@
+import {
+  existsSync,
+  mkdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs"
+import { spawnSync } from "node:child_process"
+import os from "node:os"
+import path from "node:path"
+import {
+  AUTOSTART_LABEL,
+  WINDOWS_RUN_KEY,
+  WINDOWS_RUN_VALUE,
+} from "./constants.mjs"
+import {
+  binaryName,
+  safeDirectory,
+  defaultPrefix,
+  run,
+  removeKnownPath,
+} from "./platform.mjs"
+import {
+  removeMeshService,
+  killTrayProcess,
+} from "./mesh.mjs"
+
+// ── Runtime login-autostart (no elevation) ──
+// Start the local runtime (api/agent/web/tray) at login/boot using only
+// per-user mechanisms — no UAC/sudo. This is separate from the privileged mesh
+// service: the mesh sidecar autostarts via the OS service manager; this brings
+// up the unprivileged runtime that joins the mesh and serves the local API.
+
+export function enableRuntimeAutostart(prefix) {
+  try {
+    if (process.platform === "win32") {
+      // A .vbs launches the runtime with a hidden window (no console flash); the
+      // HKCU Run key runs it at login without elevation.
+      const launcher = path.join(prefix, "vantaloom.cmd")
+      const vbsPath = path.join(prefix, "autostart.vbs")
+      const vbs = `' Vantaloom runtime autostart (hidden)\r\nCreateObject("WScript.Shell").Run """${launcher}"" start", 0, False\r\n`
+      writeFileSync(vbsPath, vbs)
+      const result = spawnSync(
+        "powershell",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `Set-ItemProperty -Path '${WINDOWS_RUN_KEY}' -Name '${WINDOWS_RUN_VALUE}' -Value 'wscript.exe "${vbsPath}"'`,
+        ],
+        { stdio: "ignore", windowsHide: true }
+      )
+      if (result.error || result.status !== 0) {
+        console.warn("  autostart: could not register login entry (HKCU Run)")
+      } else {
+        console.log("  autostart: enabled (login Run key)")
+      }
+      return
+    }
+    if (process.platform === "darwin") {
+      const launcher = path.join(prefix, "vantaloom")
+      const dir = path.join(os.homedir(), "Library", "LaunchAgents")
+      mkdirSync(dir, { recursive: true })
+      const plistPath = path.join(dir, `${AUTOSTART_LABEL}.plist`)
+      // RunAtLoad only (no KeepAlive): `vantaloom start` spawns detached and exits.
+      const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>${AUTOSTART_LABEL}</string>
+  <key>ProgramArguments</key><array><string>${launcher}</string><string>start</string></array>
+  <key>RunAtLoad</key><true/>
+</dict></plist>
+`
+      writeFileSync(plistPath, plist)
+      spawnSync("launchctl", ["unload", plistPath], { stdio: "ignore", windowsHide: true })
+      spawnSync("launchctl", ["load", "-w", plistPath], { stdio: "ignore", windowsHide: true })
+      console.log("  autostart: enabled (LaunchAgent)")
+      return
+    }
+    // Linux: user systemd unit + linger (no root).
+    const launcher = path.join(prefix, "vantaloom")
+    const dir = path.join(os.homedir(), ".config", "systemd", "user")
+    mkdirSync(dir, { recursive: true })
+    const unit = `[Unit]
+Description=Vantaloom local runtime
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${launcher} start
+ExecStop=${launcher} stop
+
+[Install]
+WantedBy=default.target
+`
+    writeFileSync(path.join(dir, "vantaloom-runtime.service"), unit)
+    spawnSync("loginctl", ["enable-linger"], { stdio: "ignore", windowsHide: true })
+    spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore", windowsHide: true })
+    spawnSync("systemctl", ["--user", "enable", "vantaloom-runtime.service"], { stdio: "ignore", windowsHide: true })
+    console.log("  autostart: enabled (systemd user unit)")
+  } catch (error) {
+    console.warn(`  autostart: could not enable (${error.message})`)
+  }
+}
+
+export function disableRuntimeAutostart() {
+  try {
+    if (process.platform === "win32") {
+      // Remove the Run-key entry; the autostart.vbs lives in the install dir and
+      // is deleted with it.
+      spawnSync(
+        "powershell",
+        ["-NoProfile", "-NonInteractive", "-Command", `Remove-ItemProperty -Path '${WINDOWS_RUN_KEY}' -Name '${WINDOWS_RUN_VALUE}' -ErrorAction SilentlyContinue`],
+        { stdio: "ignore", windowsHide: true }
+      )
+      return
+    }
+    if (process.platform === "darwin") {
+      const plistPath = path.join(os.homedir(), "Library", "LaunchAgents", `${AUTOSTART_LABEL}.plist`)
+      if (existsSync(plistPath)) {
+        spawnSync("launchctl", ["unload", "-w", plistPath], { stdio: "ignore", windowsHide: true })
+        rmSync(plistPath, { force: true })
+      }
+      return
+    }
+    const unit = path.join(os.homedir(), ".config", "systemd", "user", "vantaloom-runtime.service")
+    if (existsSync(unit)) {
+      spawnSync("systemctl", ["--user", "disable", "vantaloom-runtime.service"], { stdio: "ignore", windowsHide: true })
+      rmSync(unit, { force: true })
+      spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore", windowsHide: true })
+    }
+  } catch (error) {
+    console.warn(`  autostart: could not disable (${error.message})`)
+  }
+}
+
+// uninstallRuntime tears down a local install: stop the runtime, remove the
+// privileged mesh service (elevated), then delete the install directory.
+export async function uninstallRuntime(options) {
+  const prefix = safeDirectory(options.prefix ?? defaultPrefix())
+  if (!existsSync(prefix)) {
+    console.log(`Vantaloom is not installed at ${prefix}`)
+    return
+  }
+  console.log(`Uninstalling Vantaloom from ${prefix} ...`)
+
+  // 1. Stop the runtime (api/agent/web/tray). Best-effort.
+  const ctlBin = path.join(prefix, "bin", binaryName("vantaloomctl"))
+  if (existsSync(ctlBin)) {
+    spawnSync(ctlBin, ["stop", "--prefix", prefix], { stdio: "inherit", windowsHide: true })
+  }
+  killTrayProcess(prefix)
+
+  // 2. Remove the privileged mesh service (releases TUN adapter + file locks).
+  removeMeshService(prefix, options)
+
+  // 2b. Remove the login-autostart entry (lives outside the install dir).
+  disableRuntimeAutostart()
+
+  // 3. Delete the install directory.
+  try {
+    const parent = path.dirname(prefix)
+    removeKnownPath(prefix, parent)
+    console.log(`removed ${prefix}`)
+  } catch (error) {
+    console.warn(`  could not remove ${prefix}: ${error.message}`)
+    console.warn("  some files may still be locked; re-run after closing Vantaloom processes.")
+  }
+
+  console.log("Vantaloom uninstalled.")
+  console.log("note: the install dir was left out of PATH edits; remove the bin/ entry from your shell profile if you added it.")
+}
+
+export function runCtl(command, options) {
+  const prefix = safeDirectory(options.prefix ?? defaultPrefix())
+  const ctl = path.join(prefix, "bin", binaryName("vantaloomctl"))
+  if (!existsSync(ctl)) {
+    throw new Error(`missing installed runtime at ${prefix}; run "vantaloom install" first`)
+  }
+
+  const args = [command, "--prefix", prefix]
+  if (options.component) {
+    args.push("--component", options.component)
+  }
+  run(ctl, args)
+}

package/cli/src/lib/mesh.mjs

@@ -0,0 +1,236 @@
+import {
+  existsSync,
+  readFileSync,
+  rmSync,
+} from "node:fs"
+import { spawnSync } from "node:child_process"
+import path from "node:path"
+import { WINDOWS_MESH_BINARIES } from "./constants.mjs"
+import { binaryName, fileSha, psQuote } from "./platform.mjs"
+
+// The privileged-mesh files that must NOT be needlessly overwritten on update:
+// the service binary (vantaloom-mesh) and the EasyTier engine (easytier-core,
+// the Linux setcap target), plus the Windows support DLLs the running service
+// holds open. Leaving an unchanged copy in place keeps the service running and
+// preserves its Linux file capability — so the update needs no elevation.
+export function meshBinarySet(platform) {
+  return platform === "win32"
+    ? WINDOWS_MESH_BINARIES
+    : ["vantaloom-mesh", "easytier-core"]
+}
+
+// meshServiceRunning queries the OS service state via the (unprivileged) mesh
+// `status` command. binDir is where to find the vantaloom-mesh binary to run.
+// NOTE: mirrored in Go at apps/desktop/internal/runtime/
+export function meshServiceRunning(binDir, platform) {
+  const exe = path.join(binDir, binaryName("vantaloom-mesh"))
+  if (!existsSync(exe)) return false
+  const r = spawnSync(exe, ["status"], { encoding: "utf8", windowsHide: true })
+  if (r.error || typeof r.stdout !== "string") return false
+  const out = r.stdout.toLowerCase()
+  if (platform === "win32") return out.includes("running")
+  return r.status === 0 && !out.includes("not loaded") && !out.includes("not installed")
+}
+
+// meshServiceNeedsApply reports whether the privileged service has to be
+// (re)applied: true if the installed mesh binaries are missing/outdated, or if
+// the service isn't currently up.
+export function meshServiceNeedsApply(pkgBin, installBin, platform) {
+  // On Windows compare every lockable mesh file (incl. Packet.dll/WinDivert/wintun)
+  // so a missing or changed support DLL also triggers a (re)apply.
+  const names = platform === "win32"
+    ? WINDOWS_MESH_BINARIES
+    : [binaryName("vantaloom-mesh"), binaryName("easytier-core")]
+  for (const name of names) {
+    const installed = path.join(installBin, name)
+    if (!existsSync(installed)) return true
+    const staged = path.join(pkgBin, name)
+    if (existsSync(staged) && fileSha(staged) !== fileSha(installed)) return true
+  }
+  return !meshServiceRunning(pkgBin, platform)
+}
+
+// meshServiceRunningOrInstalled reports whether the Windows service exists at
+// all (running or stopped), so uninstall only prompts for elevation when there
+// is actually something to remove.
+export function meshServiceRunningOrInstalled(binDir) {
+  const exe = path.join(binDir, "vantaloom-mesh.exe")
+  if (!existsSync(exe)) return false
+  const r = spawnSync(exe, ["status"], { encoding: "utf8", windowsHide: true })
+  if (r.error || typeof r.stdout !== "string") return false
+  return !r.stdout.toLowerCase().includes("not installed")
+}
+
+// ensureMeshService registers (or lock-safely updates) the privileged EasyTier
+// sidecar service on Windows/macOS — the one elevation of the install on those
+// platforms. Linux uses setcap instead (see ensureLinuxMeshCapabilities).
+//
+// To keep the source/dev rebuild loop frictionless it only elevates when the
+// work is actually needed (service missing, or the mesh binaries changed) and,
+// for source installs, defers to a printed one-liner unless --with-mesh is set.
+// NOTE: mirrored in Go at apps/desktop/internal/runtime/
+export function ensureMeshService(packageRoot, prefix, opts) {
+  const platform = process.platform
+  if (platform !== "win32" && platform !== "darwin") return // Linux: setcap path
+  if (opts.skipMesh) return
+
+  const pkgBin = path.join(packageRoot, "bin")
+  const meshExe = path.join(pkgBin, binaryName("vantaloom-mesh"))
+  if (!existsSync(meshExe)) return // sidecar not bundled
+
+  if (!meshServiceNeedsApply(pkgBin, path.join(prefix, "bin"), platform)) {
+    return // installed binaries current and service already managing them
+  }
+
+  if (opts.sourceInstall && !opts.withMesh) {
+    printMeshManualHint(prefix, platform)
+    return
+  }
+
+  if (platform === "win32") {
+    elevateWindowsMeshApply(pkgBin, prefix)
+  } else {
+    elevateDarwinMeshInstall(prefix)
+  }
+}
+
+// elevateWindowsMeshApply runs the lock-safe `apply` elevated (one UAC prompt).
+// It launches from the package copy so it can overwrite the installed binary.
+export function elevateWindowsMeshApply(pkgBin, prefix) {
+  const exe = path.join(pkgBin, "vantaloom-mesh.exe")
+  console.log("  mesh: registering privileged P2P service (UAC prompt) ...")
+  const argList = ["apply", "--pkg-bin", pkgBin, "--install-dir", prefix].map(psQuote).join(",")
+  const ps = `$ErrorActionPreference='Stop'; $p = Start-Process -FilePath ${psQuote(exe)} -ArgumentList ${argList} -Verb RunAs -Wait -PassThru; exit $p.ExitCode`
+  const r = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "inherit", windowsHide: true })
+  if (r.error || r.status !== 0) {
+    const installed = path.join(prefix, "bin", "vantaloom-mesh.exe")
+    console.warn("  mesh: service registration was cancelled or failed; P2P falls back to the Hub relay.")
+    console.warn(`        enable it later (as Administrator):  "${installed}" install --install-dir "${prefix}"`)
+  } else {
+    console.log("  mesh: privileged P2P service active")
+  }
+}
+
+// elevateDarwinMeshInstall registers the LaunchDaemon via sudo (one prompt). The
+// runtime already copied the fresh binary into place; install reloads the daemon.
+export function elevateDarwinMeshInstall(prefix) {
+  const exe = path.join(prefix, "bin", "vantaloom-mesh")
+  console.log("  mesh: registering privileged P2P service (sudo) ...")
+  const r = spawnSync("sudo", [exe, "install", "--install-dir", prefix], { stdio: "inherit", windowsHide: true })
+  if (r.error || r.status !== 0) {
+    console.warn("  mesh: LaunchDaemon registration failed; P2P falls back to the Hub relay.")
+    console.warn(`        enable it later:  sudo "${exe}" install --install-dir "${prefix}"`)
+  } else {
+    console.log("  mesh: privileged P2P service active")
+  }
+}
+
+export function printMeshManualHint(prefix, platform) {
+  console.log("  mesh: P2P service not auto-registered for source installs.")
+  if (platform === "win32") {
+    const exe = path.join(prefix, "bin", "vantaloom-mesh.exe")
+    console.log(`        enable it once (as Administrator):  "${exe}" install --install-dir "${prefix}"`)
+    console.log("        or re-run install/update with --with-mesh")
+  } else {
+    const exe = path.join(prefix, "bin", "vantaloom-mesh")
+    console.log(`        enable it once:  sudo "${exe}" install --install-dir "${prefix}"`)
+    console.log("        or re-run install/update with --with-mesh")
+  }
+}
+
+// ensureLinuxMeshCapabilities grants easytier-core the network capabilities it
+// needs to create a TUN device, so the unprivileged Vantaloom runtime can bring
+// up the EasyTier mesh without running as root. Re-run on every update because
+// replacing the binary clears file capabilities. Non-fatal: if it can't elevate
+// or setcap is missing, mesh just falls back to the Hub relay.
+export function ensureLinuxMeshCapabilities(binDir) {
+  if (process.platform !== "linux") {
+    return
+  }
+  const core = path.join(binDir, "easytier-core")
+  if (!existsSync(core)) {
+    console.warn("  mesh: easytier-core not bundled; skipping TUN capability setup")
+    return
+  }
+  const caps = "cap_net_admin,cap_net_bind_service+ep"
+  // If the capability is already present (we kept an unchanged easytier-core in
+  // place above), there's nothing to do — and crucially, no sudo prompt. setcap
+  // only runs when the binary was actually replaced or never had the cap.
+  const have = spawnSync("getcap", [core], { encoding: "utf8", windowsHide: true })
+  if (
+    !have.error &&
+    typeof have.stdout === "string" &&
+    have.stdout.includes("cap_net_admin") &&
+    have.stdout.includes("cap_net_bind_service")
+  ) {
+    return
+  }
+  const isRoot = typeof process.getuid === "function" && process.getuid() === 0
+  console.log(`  mesh: granting TUN capability to easytier-core${isRoot ? "" : " (sudo)"} ...`)
+  const result = isRoot
+    ? spawnSync("setcap", [caps, core], { stdio: "inherit", windowsHide: true })
+    : spawnSync("sudo", ["setcap", caps, core], { stdio: "inherit", windowsHide: true })
+  if (result.error || result.status !== 0) {
+    console.warn(
+      "  mesh: could not set capabilities (P2P will fall back to the Hub relay).\n" +
+      `        enable it manually with:  sudo setcap ${caps} ${core}\n` +
+      "        (needs the 'setcap' tool, e.g. apt install libcap2-bin)"
+    )
+  }
+}
+
+export function removeMeshService(prefix, options) {
+  const platform = process.platform
+  if (platform !== "win32" && platform !== "darwin") return // Linux: nothing registered
+  const exe = path.join(prefix, "bin", binaryName("vantaloom-mesh"))
+  if (!existsSync(exe)) return
+  if (options.skipMesh) return
+
+  if (platform === "win32") {
+    if (!meshServiceRunningOrInstalled(path.join(prefix, "bin"))) return
+    console.log("  mesh: removing privileged P2P service (UAC prompt) ...")
+    const ps = `$ErrorActionPreference='Stop'; $p = Start-Process -FilePath ${psQuote(exe)} -ArgumentList 'uninstall' -Verb RunAs -Wait -PassThru; exit $p.ExitCode`
+    const r = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], { stdio: "inherit", windowsHide: true })
+    if (r.error || r.status !== 0) {
+      console.warn(`  mesh: could not remove service; run manually (as Administrator):  "${exe}" uninstall`)
+    }
+  } else {
+    console.log("  mesh: removing privileged P2P service (sudo) ...")
+    const r = spawnSync("sudo", [exe, "uninstall"], { stdio: "inherit", windowsHide: true })
+    if (r.error || r.status !== 0) {
+      console.warn(`  mesh: could not remove service; run manually:  sudo "${exe}" uninstall`)
+    }
+  }
+}
+
+export function killTrayProcess(prefix) {
+  if (process.platform === "win32") {
+    // Try PID file first (new tray versions write runtime/tray.pid).
+    const pidFile = path.join(prefix, "runtime", "tray.pid")
+    if (existsSync(pidFile)) {
+      const pid = readFileSync(pidFile, "utf8").trim()
+      if (pid) {
+        spawnSync("taskkill", ["/PID", pid, "/F"], { stdio: "ignore", windowsHide: true })
+        try { rmSync(pidFile, { force: true }) } catch {}
+      }
+    }
+    // Fallback: kill by image name if the binary is inside our prefix.
+    const result = spawnSync("tasklist", ["/FI", "IMAGENAME eq vantaloom-tray.exe", "/FO", "CSV", "/NH"], {
+      encoding: "utf8",
+      windowsHide: true,
+    })
+    if (result.stdout) {
+      for (const line of result.stdout.split("\n")) {
+        const match = line.match(/"vantaloom-tray\.exe","(\d+)"/)
+        if (match) {
+          spawnSync("taskkill", ["/PID", match[1], "/F"], { stdio: "ignore", windowsHide: true })
+        }
+      }
+    }
+    // Brief pause to let file handles release.
+    spawnSync("timeout", ["/t", "1", "/nobreak"], { stdio: "ignore", windowsHide: true })
+  } else {
+    // Unix: pkill by name (best-effort).
+    spawnSync("pkill", ["-f", "vantaloom-tray"], { stdio: "ignore", windowsHide: true })
+  }
+}

package/cli/src/lib/package.mjs

@@ -0,0 +1,206 @@
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs"
+import { cp } from "node:fs/promises"
+import os from "node:os"
+import path from "node:path"
+import { cliRoot } from "./constants.mjs"
+import {
+  platformId,
+  parsePlatformId,
+  removeKnownPath,
+  run,
+  runNpm,
+  runPnpm,
+} from "./platform.mjs"
+import {
+  buildGo,
+  copyStaticWeb,
+  copyCliDirectory,
+  writeBuildManifest,
+  writeRuntimePackageMetadata,
+  runtimeConfigFromSource,
+  gitVersion,
+} from "./install.mjs"
+
+export async function buildRuntimePackage(sourceRoot, packageRoot, options) {
+  const version = gitVersion(sourceRoot)
+  const platform = options.target ?? platformId()
+  const buildBin = path.join(packageRoot, "bin")
+  const buildWeb = path.join(packageRoot, "web")
+
+  removeKnownPath(packageRoot, path.dirname(packageRoot))
+  mkdirSync(buildBin, { recursive: true })
+
+  buildGo(sourceRoot, buildBin, "vantaloom-api", platform)
+  buildGo(sourceRoot, buildBin, "vantaloom-agent", platform)
+  buildGo(sourceRoot, buildBin, "vantaloomctl", platform)
+  // Official "Vantaloom 浏览器" extension sidecar. Pure-Go (chromedp/CDP, no
+  // CGO), cross-compiles for every target. Ships dormant: it's only started by
+  // the api when the user installs+enables the browser extension (the heavy
+  // Chromium binary is downloaded on demand, NOT bundled here).
+  buildGo(sourceRoot, buildBin, "vantaloom-browser", platform)
+  // Privileged EasyTier sidecar (runs the mesh node as a service on Windows/macOS).
+  // Pure-Go (no CGO), so it cross-compiles cleanly for every target.
+  buildGo(sourceRoot, buildBin, "vantaloom-mesh", platform)
+  // The Windows system-tray app (vantaloom-tray) was removed — it crash-looped
+  // on some Windows 11 builds and got respawned until OOM. No longer built.
+
+  // Bundle the EasyTier mesh binaries (P2P virtual network) for the target platform.
+  await copyEasyTier(sourceRoot, buildBin, platform)
+
+  if (options.buildWeb) {
+    runPnpm(["--filter", "vantaloom-app", "build"], { cwd: sourceRoot })
+  }
+
+  await copyStaticWeb(sourceRoot, buildWeb)
+  await copyCliDirectory(path.join(packageRoot, "cli"), sourceRoot, runtimeConfigFromSource(sourceRoot))
+  // The Claude Code ACP adapter is NO LONGER bundled into the runtime package
+  // (it bloated every platform tarball by ~50-100MB). Instead the user installs
+  // it on demand from 设置 → CC 引擎 → "下载/安装适配器", which runs the
+  // `install-adapter` CLI command into <installDir>/adapters. Because applyPackage
+  // leaves a missing adapters/ dir untouched on update, the user-installed adapter
+  // survives runtime updates.
+  writeBuildManifest(packageRoot, version, platform)
+
+  return { platform, version }
+}
+
+// bundleAdapter installs the Claude Agent SDK into
+// <packageRoot>/adapters/claude-sdk-bridge/node_modules and copies the bridge source
+// (the thin node sidecar that runs the SDK's query() and pipes its native stream-json
+// to the Go runtime). It also writes the reclaude shim the Go engine points the SDK's
+// pathToClaudeCodeExecutable at. The SDK version is pinned in the bridge's own
+// package.json (single source of truth); native optional deps (e.g. sharp) are
+// selected per TARGET platform.
+export async function bundleAdapter(packageRoot, options = {}) {
+  const adaptersRoot = path.join(packageRoot, "adapters")
+  const bridgeDest = path.join(adaptersRoot, "claude-sdk-bridge")
+  const bridgeSrc = path.join(cliRoot, "adapters", "claude-sdk-bridge")
+  const shimPath = path.join(adaptersRoot, "reclaude-shim.mjs")
+  const shimSource = `// Vantaloom reclaude shim: the Claude Agent SDK runs \`node <this>\` as the claude
+// executable, so we re-exec the real reclaude binary (path in VANTALOOM_RECLAUDE_EXE)
+// with the same args + inherited stdio. reclaude's banner goes to stderr, keeping the
+// SDK's stdout protocol clean.
+import { spawn } from "node:child_process";
+const exe = process.env.VANTALOOM_RECLAUDE_EXE;
+if (!exe) {
+  process.stderr.write("[reclaude-shim] VANTALOOM_RECLAUDE_EXE not set\\n");
+  process.exit(127);
+}
+const child = spawn(exe, process.argv.slice(2), { stdio: "inherit", windowsHide: true });
+child.on("exit", (code, signal) => process.exit(code ?? (signal ? 1 : 0)));
+child.on("error", (e) => {
+  process.stderr.write(\`[reclaude-shim] failed to launch reclaude: \${e.message}\\n\`);
+  process.exit(127);
+});
+`
+
+  if (!existsSync(path.join(bridgeSrc, "index.mjs"))) {
+    const msg = `claude-sdk-bridge source missing at ${bridgeSrc}`
+    if (options.skipAdapter) {
+      console.warn(`  warning: skipping SDK bridge bundle (${msg})`)
+      return
+    }
+    throw new Error(msg)
+  }
+
+  // Resolve the SDK's platform-gated native optional deps (e.g. sharp's
+  // @img/sharp-<os>-<cpu>) for the TARGET platform, not the build host — otherwise a
+  // Windows-built bundle would ship the wrong native binary to the mac/linux packages.
+  const { os: targetOs, cpu: targetCpu } = parsePlatformId(options.platform ?? platformId())
+  console.log(`  bundling Claude Agent SDK bridge (os=${targetOs} cpu=${targetCpu}) ...`)
+  const tmp = mkdtempSync(path.join(os.tmpdir(), "vantaloom-sdk-bridge-"))
+  try {
+    // Install the bridge's OWN dependencies (the SDK, version pinned in its
+    // package.json) into a temp prefix from the PUBLIC registry explicitly: the
+    // machine's global .npmrc points at npmmirror, which may not mirror this package.
+    cpSync(path.join(bridgeSrc, "package.json"), path.join(tmp, "package.json"))
+    const npmArgs = [
+      "install",
+      "--prefix",
+      tmp,
+      "--registry",
+      "https://registry.npmjs.org/",
+      "--no-audit",
+      "--no-fund",
+      "--omit=dev",
+      "--os",
+      targetOs,
+      "--cpu",
+      targetCpu,
+    ]
+    if (targetOs === "linux") {
+      npmArgs.push("--libc", "glibc")
+    }
+    runNpm(npmArgs)
+
+    const tmpModules = path.join(tmp, "node_modules")
+    if (!existsSync(tmpModules)) {
+      throw new Error(`SDK install produced no node_modules at ${tmpModules}`)
+    }
+
+    removeKnownPath(adaptersRoot, path.dirname(adaptersRoot))
+    mkdirSync(bridgeDest, { recursive: true })
+    // Bridge source: index.mjs (+ package.json, for reference/version).
+    cpSync(path.join(bridgeSrc, "index.mjs"), path.join(bridgeDest, "index.mjs"))
+    cpSync(path.join(bridgeSrc, "package.json"), path.join(bridgeDest, "package.json"))
+    // The SDK + its dependency tree.
+    cpSync(tmpModules, path.join(bridgeDest, "node_modules"), { recursive: true })
+
+    writeFileSync(shimPath, shimSource)
+    console.log(`  bundled SDK bridge -> adapters/claude-sdk-bridge + reclaude-shim.mjs`)
+  } catch (error) {
+    if (options.skipAdapter) {
+      console.warn(`  warning: skipping SDK bridge bundle (${error.message})`)
+      return
+    }
+    throw new Error(`failed to bundle SDK bridge: ${error.message}`)
+  } finally {
+    rmSync(tmp, { recursive: true, force: true })
+  }
+}
+
+// copyEasyTier bundles the vendored EasyTier binaries (easytier-core/easytier-cli,
+// plus wintun.dll on Windows) for the target platform into the package bin/ dir.
+export async function copyEasyTier(sourceRoot, buildBin, platform) {
+  const vendorMap = {
+    "win32-x64": "windows-x86_64",
+    "darwin-arm64": "macos-aarch64",
+    "linux-x64": "linux-x86_64",
+  }
+  const vendorName = vendorMap[platform]
+  if (!vendorName) {
+    console.warn(`  warning: no EasyTier mapping for ${platform}; mesh disabled for this platform`)
+    return
+  }
+  const srcDir = path.join(sourceRoot, "vendor", "easytier", vendorName, `easytier-${vendorName}`)
+  if (!existsSync(srcDir)) {
+    console.warn(`  warning: EasyTier binaries not found at ${srcDir}; run vendor download first`)
+    return
+  }
+  const isWin = platform.startsWith("win32")
+  // Packet.dll + WinDivert64.sys are REQUIRED: easytier-core.exe statically
+  // imports Packet.dll, so without it the process dies at launch with
+  // STATUS_DLL_NOT_FOUND (0xC0000135) before writing any log. wintun.dll is the
+  // TUN backend. easytier-cli.exe does not need Packet.dll (it still launches).
+  const files = isWin
+    ? ["easytier-core.exe", "easytier-cli.exe", "wintun.dll", "Packet.dll", "WinDivert64.sys"]
+    : ["easytier-core", "easytier-cli"]
+  let copied = 0
+  for (const f of files) {
+    const src = path.join(srcDir, f)
+    if (!existsSync(src)) {
+      console.warn(`  warning: EasyTier file missing: ${f}`)
+      continue
+    }
+    await cp(src, path.join(buildBin, f), { force: true })
+    copied++
+  }
+  console.log(`  bundled EasyTier ${vendorName} (${copied} files)`)
+}