@zenbu-labs/pixel 0.0.0 → 0.0.13

package/dist/webview.js

@@ -0,0 +1,481 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebView = void 0;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const node_path_1 = __importDefault(require("node:path"));
+const electron_1 = require("electron");
+const react_1 = require("react");
+const context_menu_1 = require("./context-menu");
+const debug_1 = require("./debug");
+const devtools_1 = require("./devtools");
+const devtools_layout_1 = require("./devtools-layout");
+const layout_1 = require("./layout");
+const popup_1 = require("./popup");
+const react_2 = require("./react");
+const registry_1 = require("./registry");
+const theme_1 = require("./theme");
+const host_1 = require("./web/host");
+const browser_session_1 = require("./web/browser-session");
+const types_1 = require("./web/types");
+const DRAG_RESIZE_MS = 50;
+exports.WebView = (0, react_1.forwardRef)(function WebView(props, ref) {
+    const registry = (0, react_1.useContext)(registry_1.RootContext);
+    if (!registry) {
+        throw new Error("<WebView> has to be rendered by a root from pixel's createRoot()");
+    }
+    const colors = (0, registry_1.useRegistryColors)(registry);
+    const theme = (0, react_1.useMemo)(() => (0, theme_1.makeTheme)(colors), [colors]);
+    const hidden = !!props.hidden;
+    const rem = registry.root.info.basePx;
+    const scale = registry.displayScale;
+    const boxRef = (0, react_1.useRef)(null);
+    const rect = (0, layout_1.useNodeRect)(boxRef, registry);
+    const hostRef = (0, react_1.useRef)(null);
+    const surfaces = (0, react_1.useRef)(null);
+    const stateRef = (0, react_1.useRef)((0, types_1.initialWebViewState)(props.src));
+    const propsRef = (0, react_1.useRef)(props);
+    propsRef.current = props;
+    const hover = (0, react_1.useRef)({ page: false, popup: false, devtools: false, divider: false });
+    const dragging = (0, react_1.useRef)(false);
+    const lastDragResize = (0, react_1.useRef)(0);
+    const pendingInspect = (0, react_1.useRef)(null);
+    const frameListeners = (0, react_1.useRef)(new Set());
+    const changeListeners = (0, react_1.useRef)(new Set());
+    const [popup, setPopup] = (0, react_1.useState)(null);
+    const [devtoolsOpen, setDevtoolsOpen] = (0, react_1.useState)(false);
+    const [dock, setDock] = (0, react_1.useState)(typeof props.devtools === "string" ? props.devtools : "right");
+    const dockRef = (0, react_1.useRef)(dock);
+    dockRef.current = dock;
+    const [fraction, setFraction] = (0, react_1.useState)(0.4);
+    const [dividerEngaged, setDividerEngaged] = (0, react_1.useState)(false);
+    const [menu, setMenu] = (0, react_1.useState)(null);
+    const menuRef = (0, react_1.useRef)(menu);
+    menuRef.current = menu;
+    const devtoolsEnabled = props.devtools === undefined ? process.env.NODE_ENV !== "production" : props.devtools !== false;
+    const entry = (0, react_1.useMemo)(() => ({
+        host: null,
+        handle: null,
+        devtoolsEnabled: false,
+        externalDevtools: false,
+        externalDevtoolsAction: null,
+        toggleDevtools: () => { },
+        handleKey: () => false,
+    }), []);
+    entry.devtoolsEnabled = devtoolsEnabled;
+    entry.toggleDevtools = () => {
+        if (hostRef.current?.devtools)
+            hostRef.current.closeDevtools();
+        else
+            setDevtoolsOpen(true);
+    };
+    entry.handleKey = (event) => {
+        if (!menuRef.current || event.kind === "release")
+            return false;
+        setMenu(null);
+        return event.key === "escape";
+    };
+    const inner = rect ? { x: 0, y: 0, width: rect.width, height: rect.height } : null;
+    const dockOpen = devtoolsOpen && !entry.externalDevtools;
+    const gap = Math.max(2, Math.round(rem * 0.25));
+    const split = inner ? (0, devtools_layout_1.splitForDevtools)(inner, dockOpen ? { dock, fraction } : null, gap) : null;
+    const page = split
+        ? { ...split.page, ...(0, types_1.snapToCssGrid)(split.page.width, split.page.height, scale) }
+        : null;
+    const devtoolsRect = split?.devtools
+        ? { ...split.devtools, ...(0, types_1.snapToCssGrid)(split.devtools.width, split.devtools.height, scale) }
+        : null;
+    const keepFrame = () => dragging.current || propsRef.current.keepFrame !== false;
+    const syncCursor = () => {
+        const host = hostRef.current;
+        const h = hover.current;
+        const shape = h.divider
+            ? dockRef.current === "bottom"
+                ? "row-resize"
+                : "col-resize"
+            : h.devtools
+                ? host?.devtools?.cursorShape ?? "default"
+                : host?.popup
+                    ? h.popup
+                        ? host.popup.cursorShape
+                        : "default"
+                    : h.page
+                        ? host?.cursorShape ?? "default"
+                        : "default";
+        registry.setPointerShape(shape);
+    };
+    const readPopup = (host) => {
+        const top = host.popup;
+        if (!top)
+            return null;
+        let hostName = "";
+        try {
+            hostName = new URL(top.state.url).host;
+        }
+        catch { }
+        return {
+            title: top.state.title,
+            host: hostName,
+            loading: top.state.loading,
+            width: top.state.width,
+            height: top.state.height,
+        };
+    };
+    (0, react_1.useLayoutEffect)(() => {
+        const created = {
+            page: registry.root.createSurface(),
+            popup: registry.root.createSurface(),
+            devtools: registry.root.createSurface(),
+        };
+        surfaces.current = created;
+        registry.register(entry);
+        const initial = propsRef.current;
+        const passthrough = initial.browserWindowOptions ?? {};
+        const browserWindowOptions = {
+            ...passthrough,
+            webPreferences: {
+                ...passthrough.webPreferences,
+                ...(initial.partition ? { partition: (0, browser_session_1.persistentPartition)(initial.partition) } : {}),
+                ...(initial.preload ? { preload: node_path_1.default.resolve(initial.preload) } : {}),
+            },
+        };
+        const info = registry.root.info;
+        const host = new host_1.PageHost(created.page, created.popup, { x: 0, y: 0, width: info.width, height: info.height, scale }, {
+            url: initial.src,
+            background: registry.background(),
+            clipboardRead: !!initial.clipboardRead,
+            proxy: initial.proxy ?? null,
+            browserWindowOptions,
+        }, (state) => {
+            (0, debug_1.debug)("state", state);
+            stateRef.current = state;
+            propsRef.current.onChange?.(state);
+            for (const listener of changeListeners.current)
+                listener(state);
+        });
+        hostRef.current = host;
+        entry.host = host;
+        (0, debug_1.debug)("host created", { info: { width: info.width, height: info.height }, scale, url: initial.src });
+        host.onCursorChange = () => syncCursor();
+        host.onPopupChange = () => {
+            setPopup(readPopup(host));
+            syncCursor();
+        };
+        host.onDevtoolsChange = () => {
+            const open = !!host.devtools;
+            if (!open)
+                entry.externalDevtools = false;
+            setDevtoolsOpen(open);
+            syncCursor();
+        };
+        host.onDevtoolsAction = (action) => {
+            if (entry.externalDevtools) {
+                entry.externalDevtoolsAction?.(action);
+                return;
+            }
+            if (action === "close")
+                host.closeDevtools();
+            else
+                setDock(action === "dock-bottom" ? "bottom" : "right");
+        };
+        host.onContextMenu = (params) => {
+            const custom = propsRef.current.onContextMenu;
+            if (custom)
+                custom(params);
+            else
+                openMenu(params);
+        };
+        host.onOpenWindow = (details) => (0, host_1.decideOpenWindow)(propsRef.current.onOpenWindow, details);
+        host.onDownload = (progress) => propsRef.current.onDownload?.(progress);
+        host.onQuit = () => registry.quit(entry);
+        host.onFrameSubmitted = () => {
+            for (const listener of frameListeners.current)
+                listener();
+        };
+        host.setVisible(!initial.hidden);
+        if (!initial.hidden && (initial.autoFocus ?? registry.views.size === 1))
+            registry.focus(entry);
+        return () => {
+            registry.unregister(entry);
+            host.stop();
+            hostRef.current = null;
+            entry.host = null;
+            created.popup.close();
+            created.devtools.close();
+            surfaces.current = null;
+        };
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    // A zero rect means an ancestor is hidden; keep the page at its last size.
+    const collapsed = rect != null && (rect.width <= 0 || rect.height <= 0);
+    (0, react_1.useEffect)(() => {
+        hostRef.current?.setVisible(!hidden && !collapsed);
+        if ((hidden || collapsed) && registry.focused === entry)
+            registry.blur(entry);
+    }, [hidden, collapsed]);
+    (0, react_1.useEffect)(() => {
+        const host = hostRef.current;
+        if (!host || !page || hidden || collapsed)
+            return;
+        const layout = { ...page, scale };
+        (0, debug_1.debug)("page resize", layout);
+        host.resize(layout, { keepFrame: keepFrame() });
+    }, [page?.x, page?.y, page?.width, page?.height, scale, hidden]);
+    (0, react_1.useEffect)(() => {
+        const host = hostRef.current;
+        if (!host || !dockOpen || !devtoolsRect || hidden)
+            return;
+        const layout = { ...devtoolsRect, scale };
+        if (!host.devtools) {
+            host.openDevtools(surfaces.current.devtools, layout, dock);
+            host.focusDevtools();
+            const inspect = pendingInspect.current;
+            if (inspect) {
+                pendingInspect.current = null;
+                host.inspect(inspect.x, inspect.y);
+            }
+            return;
+        }
+        host.devtools.resize(layout, { keepFrame: keepFrame() });
+    }, [dockOpen, devtoolsRect?.x, devtoolsRect?.y, devtoolsRect?.width, devtoolsRect?.height, scale]);
+    (0, react_1.useEffect)(() => {
+        hostRef.current?.devtools?.setDock(dock);
+    }, [dock]);
+    const firstSrc = (0, react_1.useRef)(true);
+    (0, react_1.useEffect)(() => {
+        if (firstSrc.current) {
+            firstSrc.current = false;
+            return;
+        }
+        hostRef.current?.navigate(props.src);
+    }, [props.src]);
+    const openMenu = async (params) => {
+        const host = hostRef.current;
+        if (!host || host.popup)
+            return;
+        const canPaste = params.isEditable && (await electron_1.clipboard.readText()).length > 0;
+        const state = stateRef.current;
+        const selectionText = params.selectionText.trim();
+        const mac = process.platform === "darwin";
+        const items = [
+            { id: "back", label: "back", enabled: state.canGoBack, shortcut: "" },
+            { id: "forward", label: "forward", enabled: state.canGoForward, shortcut: "" },
+            { id: "reload", label: "reload", enabled: true, shortcut: "" },
+        ];
+        if (selectionText) {
+            items.push({ id: "copy", label: "copy", enabled: true, shortcut: mac ? "cmd+c" : "ctrl+c" });
+        }
+        if (params.isEditable) {
+            items.push({
+                id: "paste",
+                label: "paste",
+                enabled: canPaste,
+                shortcut: mac ? "cmd+v" : "ctrl+v",
+            });
+        }
+        if (params.linkURL) {
+            items.push({ id: "open-link", label: "open link", enabled: true, shortcut: "" });
+            items.push({ id: "copy-link", label: "copy link address", enabled: true, shortcut: "" });
+        }
+        if (devtoolsEnabled) {
+            items.push({ id: "inspect", label: "inspect", enabled: true, shortcut: "f12" });
+            items.push({ id: "engine-devtools", label: "pixel devtools", enabled: true, shortcut: "" });
+        }
+        const pageRect = page ?? { x: 0, y: 0 };
+        setMenu({
+            x: pageRect.x + params.x * scale,
+            y: pageRect.y + params.y * scale,
+            pageX: params.x,
+            pageY: params.y,
+            items,
+            linkURL: params.linkURL,
+            selectionText,
+        });
+    };
+    const runMenu = (id) => {
+        const current = menuRef.current;
+        setMenu(null);
+        const host = hostRef.current;
+        if (!current || !host)
+            return;
+        switch (id) {
+            case "back":
+                return host.back();
+            case "forward":
+                return host.forward();
+            case "reload":
+                return host.reload();
+            case "copy":
+                return registry.root.setClipboard(current.selectionText);
+            case "paste":
+                return electron_1.clipboard.readText().then((text) => host.paste(text));
+            case "open-link":
+                return host.navigate(current.linkURL);
+            case "copy-link":
+                return registry.root.setClipboard(current.linkURL);
+            case "engine-devtools":
+                return registry.root.openDevtools();
+            case "inspect":
+                pendingInspect.current = { x: current.pageX, y: current.pageY };
+                if (host.devtools) {
+                    pendingInspect.current = null;
+                    host.focusDevtools();
+                    host.inspect(current.pageX, current.pageY);
+                }
+                else {
+                    setDevtoolsOpen(true);
+                }
+                return;
+        }
+    };
+    const onDividerDrag = (event) => {
+        if (!rect || !page || !devtoolsRect)
+            return;
+        if (event.phase === "start") {
+            dragging.current = true;
+            setDividerEngaged(true);
+            return;
+        }
+        if (event.phase === "end") {
+            dragging.current = false;
+            setDividerEngaged(false);
+            return;
+        }
+        const now = Date.now();
+        if (now - lastDragResize.current < DRAG_RESIZE_MS)
+            return;
+        lastDragResize.current = now;
+        const absPage = { x: rect.x + page.x, y: rect.y + page.y, width: page.width, height: page.height };
+        const absDevtools = {
+            x: rect.x + devtoolsRect.x,
+            y: rect.y + devtoolsRect.y,
+            width: devtoolsRect.width,
+            height: devtoolsRect.height,
+            dock,
+        };
+        setFraction((0, devtools_layout_1.dividerFraction)(absPage, absDevtools, event.x, event.y));
+    };
+    (0, react_1.useImperativeHandle)(ref, () => {
+        const host = () => {
+            const current = hostRef.current;
+            if (!current) {
+                throw new Error("[placeholder copy: this WebView has already been unmounted]");
+            }
+            return current;
+        };
+        const handle = {
+            get webContents() {
+                return host().webContents;
+            },
+            get state() {
+                return stateRef.current;
+            },
+            onChange: (listener) => {
+                changeListeners.current.add(listener);
+                return () => {
+                    changeListeners.current.delete(listener);
+                };
+            },
+            loadURL: (url) => host().navigate(url),
+            focus: () => registry.focus(entry),
+            blur: () => registry.blur(entry),
+            back: () => host().back(),
+            forward: () => host().forward(),
+            reload: () => host().reload(),
+            zoom: (direction) => host().zoom(direction),
+            find: (text) => host().find(text),
+            findNext: (forward) => host().findNext(forward),
+            stopFind: () => host().stopFind(),
+            cdp: (method, params) => host().cdp(method, params),
+            openDevtools: () => setDevtoolsOpen(true),
+            closeDevtools: () => hostRef.current?.closeDevtools(),
+            closePopup: () => hostRef.current?.popup?.close(),
+            recording: {
+                start: (dir) => host().surface.startCapture(dir),
+                onFrame: (listener) => {
+                    frameListeners.current.add(listener);
+                    return () => {
+                        frameListeners.current.delete(listener);
+                    };
+                },
+                frameSize: () => hostRef.current?.frameSize() ?? null,
+                pinFrameRate: (pinned) => host().pinFrameRate(pinned),
+                invalidate: () => hostRef.current?.invalidate(),
+            },
+        };
+        registry_1.handleEntries.set(handle, entry);
+        entry.handle = handle;
+        return handle;
+    }, [registry, entry]);
+    const popupView = (() => {
+        if (!popup || !page)
+            return null;
+        const headerPx = Math.round(rem * 1.7);
+        const maxW = Math.round(page.width * 0.94);
+        const maxH = Math.round(page.height * 0.94) - headerPx;
+        return {
+            ...popup,
+            width: Math.max(60, Math.min(Math.round(popup.width * scale), maxW)),
+            height: Math.max(60, Math.min(Math.round(popup.height * scale), maxH)),
+        };
+    })();
+    if (hidden) {
+        return (0, jsx_runtime_1.jsx)(react_2.Box, { style: { position: "absolute", inset: { top: 0, left: 0 }, width: 0, height: 0 } });
+    }
+    return ((0, jsx_runtime_1.jsxs)(react_2.Box, { ref: boxRef, style: { ...props.style, overflow: "hidden" }, children: [page && ((0, jsx_runtime_1.jsx)(react_2.Box, { surface: surfaces.current?.page, style: {
+                    position: "absolute",
+                    inset: { top: page.y, left: page.x },
+                    width: page.width,
+                    height: page.height,
+                    cornerRadius: props.style?.cornerRadius,
+                    background: theme.bg,
+                }, onPointer: (event) => {
+                    if (menuRef.current) {
+                        if (event.kind === "down")
+                            setMenu(null);
+                        if (event.kind !== "up")
+                            return;
+                    }
+                    registry.focus(entry);
+                    hostRef.current?.pointer(event);
+                    propsRef.current.onPointer?.(event);
+                }, onWheel: (event) => {
+                    registry.focus(entry);
+                    hostRef.current?.wheel(event);
+                }, onMouseEnter: () => {
+                    hover.current.page = true;
+                    syncCursor();
+                }, onMouseLeave: () => {
+                    hover.current.page = false;
+                    syncCursor();
+                } })), devtoolsRect && surfaces.current && ((0, jsx_runtime_1.jsx)(devtools_1.DevtoolsDockPane, { rect: devtoolsRect, dock: dock, rem: rem, theme: theme, surface: surfaces.current.devtools, dividerEngaged: dividerEngaged, onPointer: (event) => {
+                    const host = hostRef.current;
+                    if (!host?.devtools)
+                        return;
+                    registry.focus(entry, "devtools");
+                    host.devtools.input.pointer(event);
+                }, onWheel: (event) => {
+                    const host = hostRef.current;
+                    if (!host?.devtools)
+                        return;
+                    registry.focus(entry, "devtools");
+                    host.devtools.input.wheel(event);
+                }, onHover: (hovering) => {
+                    hover.current.devtools = hovering;
+                    syncCursor();
+                }, onDividerDrag: onDividerDrag, onDividerHover: (hovering) => {
+                    hover.current.divider = hovering;
+                    syncCursor();
+                } })), popupView && page && surfaces.current && ((0, jsx_runtime_1.jsx)(popup_1.PopupCard, { view: popupView, page: page, rem: rem, theme: theme, surface: surfaces.current.popup, onPointer: (event) => {
+                    registry.focus(entry, "popup");
+                    hostRef.current?.popup?.input.pointer(event);
+                }, onWheel: (event) => {
+                    registry.focus(entry, "popup");
+                    hostRef.current?.popup?.input.wheel(event);
+                }, onHover: (hovering) => {
+                    hover.current.popup = hovering;
+                    syncCursor();
+                }, onClose: () => hostRef.current?.popup?.close() })), menu && rect && ((0, jsx_runtime_1.jsx)(context_menu_1.ContextMenu, { x: menu.x, y: menu.y, bounds: { width: rect.width, height: rect.height }, items: menu.items, rem: rem, theme: theme, onAction: runMenu, onClose: () => setMenu(null) }))] }));
+});

package/package.json

@@ -1,7 +1,73 @@
 {
   "name": "@zenbu-labs/pixel",
-  "version": "0.0.0",
-  "description": "[placeholder copy: reserves the name; real releases are published from github.com/zenbu-labs/pixel]",
+  "version": "0.0.13",
+  "description": "[placeholder copy: Electron apps that render into your terminal pane]",
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/zenbu-labs/pixel.git" }
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zenbu-labs/pixel.git",
+    "directory": "packages/pixel"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "pixel": "dist/bin.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./preload": {
+      "types": "./dist/preload/index.d.ts",
+      "default": "./dist/preload/index.js"
+    },
+    "./electron": {
+      "types": "./dist/electron/index.d.ts",
+      "default": "./dist/electron/index.js"
+    },
+    "./terminal": {
+      "types": "./dist/terminal/index.d.ts",
+      "default": "./dist/terminal/index.js"
+    },
+    "./ssh": {
+      "types": "./dist/ssh/index.d.ts",
+      "default": "./dist/ssh/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "scripts/postinstall.mjs",
+    "scripts/apparmor.sh"
+  ],
+  "config": {
+    "electron": "44.2.0"
+  },
+  "scripts": {
+    "postinstall": "node scripts/postinstall.mjs",
+    "build": "tsc -p tsconfig.json",
+    "build:native": "node scripts/build-native.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test \"test/*.test.js\""
+  },
+  "dependencies": {
+    "react-reconciler": "^0.29.2"
+  },
+  "peerDependencies": {
+    "react": "^18.3.1"
+  },
+  "optionalDependencies": {
+    "@zenbu-labs/pixel-native-darwin-arm64": "0.0.13",
+    "@zenbu-labs/pixel-native-darwin-x64": "0.0.13",
+    "@zenbu-labs/pixel-native-linux-arm64": "0.0.13",
+    "@zenbu-labs/pixel-native-linux-x64": "0.0.13"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.0",
+    "@types/react-reconciler": "^0.28.8",
+    "react": "^18.3.1",
+    "typescript": "^5.5.0"
+  }
 }

package/scripts/apparmor.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+set -euo pipefail
+
+BINARY="${1:-$(dirname "$0")/../electron/electron}"
+
+[ "$(uname -s)" = Linux ] || exit 0
+[ -z "${PIXEL_SKIP_APPARMOR:-}" ] || exit 0
+[ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns 2>/dev/null || true)" = 1 ] || exit 0
+
+if [ ! -x "$BINARY" ]; then
+  echo "no electron binary at $BINARY" >&2
+  exit 1
+fi
+BINARY="$(readlink -f "$BINARY")"
+
+# When a setuid chrome-sandbox binary sits next to electron, chromium builds its
+# sandbox with that root helper instead of user namespaces, so the profile this
+# script writes would change nothing.
+[ ! -u "$(dirname "$BINARY")/chrome-sandbox" ] || exit 0
+
+# The kernel matches a profile against the path it actually executes, and one profile
+# per binary lets a checkout and an installed copy each keep their own.
+NAME="pixel-$(printf '%s' "$BINARY" | sha256sum | cut -c1-12)"
+PROFILE="/etc/apparmor.d/$NAME"
+
+# Ubuntu 24.04 ships AppArmor 4.x (abi/4.0 only). Newer releases may have abi/5.0.
+if [ -f /etc/apparmor.d/abi/5.0 ]; then
+  ABI=5.0
+elif [ -f /etc/apparmor.d/abi/4.0 ]; then
+  ABI=4.0
+else
+  echo "no supported AppArmor abi under /etc/apparmor.d/abi/ - cannot install profile" >&2
+  exit 1
+fi
+
+WANTED="abi <abi/${ABI}>,
+
+include <tunables/global>
+
+@{exec_path} = $BINARY
+profile $NAME @{exec_path} flags=(unconfined) {
+  userns,
+  @{exec_path} mr,
+
+  include if exists <local/$NAME>
+}"
+
+[ "$(cat "$PROFILE" 2>/dev/null || true)" != "$WANTED" ] || exit 0
+
+echo "chromium needs unprivileged user namespaces, which this system grants only to"
+echo "programs with an AppArmor profile. writing one at $PROFILE"
+
+TMP="$(mktemp)"
+trap 'rm -f "$TMP"' EXIT
+printf '%s\n' "$WANTED" > "$TMP"
+
+SUDO=sudo
+[ "$(id -u)" != 0 ] || SUDO=""
+if [ -n "$SUDO" ] && ! command -v sudo >/dev/null 2>&1; then
+  echo "no sudo here — copy $TMP to $PROFILE as root and run: apparmor_parser -r $PROFILE" >&2
+  trap - EXIT
+  exit 1
+fi
+
+$SUDO install -m 0644 -o root -g root "$TMP" "$PROFILE"
+if ! $SUDO apparmor_parser -r "$PROFILE"; then
+  $SUDO rm -f "$PROFILE"
+  echo "the kernel refused the profile, so it is gone and the next run will retry" >&2
+  exit 1
+fi
+echo "AppArmor profile installed for $BINARY"