a2acalling 0.6.74 → 0.6.75

package/native/macos/src-tauri/src/server.rs

@@ -1,55 +1,287 @@
 use serde::Serialize;
 use std::process::Command;
+use std::sync::atomic::{AtomicBool, AtomicU16, AtomicU32, Ordering};
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+use tauri::{Emitter, Manager};
+use tauri_plugin_shell::process::{CommandChild, CommandEvent};
+use tauri_plugin_shell::ShellExt;
+
+const MAX_CRASH_COUNT: u32 = 5;
+const STABLE_THRESHOLD: Duration = Duration::from_secs(60);
+const MAX_BACKOFF_MS: u64 = 30_000;
 
 #[derive(Debug, Serialize)]
 pub struct StartResult {
     pub success: bool,
     pub message: String,
+    pub port: Option<u16>,
+    pub source: String, // "sidecar" | "external" | "none"
 }
 
-/// Find the `a2a` CLI binary
-fn find_a2a_binary() -> Option<String> {
-    // Check common locations
-    let candidates = [
-        "a2a",  // In PATH
-    ];
-
-    for candidate in &candidates {
-        let result = Command::new("which")
-            .arg(candidate)
-            .output();
-
-        if let Ok(output) = result {
-            if output.status.success() {
-                let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
-                if !path.is_empty() {
-                    return Some(path);
+/// Holds the sidecar child process, port, and crash recovery state.
+pub struct SidecarState {
+    pub child: Mutex<Option<CommandChild>>,
+    pub port: AtomicU16,
+    pub crash_count: AtomicU32,
+    pub shutting_down: AtomicBool,
+    last_start: Mutex<Option<Instant>>,
+}
+
+impl SidecarState {
+    pub fn new() -> Self {
+        SidecarState {
+            child: Mutex::new(None),
+            port: AtomicU16::new(0),
+            crash_count: AtomicU32::new(0),
+            shutting_down: AtomicBool::new(false),
+            last_start: Mutex::new(None),
+        }
+    }
+
+    pub fn port(&self) -> u16 {
+        self.port.load(Ordering::Relaxed)
+    }
+}
+
+/// Calculate exponential backoff: 1s, 2s, 4s, 8s, 16s (capped at 30s).
+fn backoff_ms(crash_count: u32) -> u64 {
+    let exponent = crash_count.saturating_sub(1).min(4);
+    let ms = 1000u64 << exponent;
+    ms.min(MAX_BACKOFF_MS)
+}
+
+/// Pick a port for the sidecar: prefer config, then OS-assigned.
+fn pick_port() -> u16 {
+    let config_ports = crate::discovery::read_config_ports();
+    if let Some(&port) = config_ports.first() {
+        return port;
+    }
+    // Let the OS pick an available port
+    std::net::TcpListener::bind("127.0.0.1:0")
+        .and_then(|l| l.local_addr())
+        .map(|addr| addr.port())
+        .unwrap_or(3001)
+}
+
+/// Start the A2A server via Tauri sidecar (bundled binary).
+pub fn start_sidecar(app: &tauri::AppHandle) -> StartResult {
+    let port = pick_port();
+    let port_str = port.to_string();
+
+    let sidecar_cmd = match app.shell().sidecar("a2a-server") {
+        Ok(cmd) => cmd,
+        Err(_) => return start_external_server(port),
+    };
+
+    let (rx, child) = match sidecar_cmd
+        .env("PORT", &port_str)
+        .spawn()
+    {
+        Ok(pair) => pair,
+        Err(_) => return start_external_server(port),
+    };
+
+    // Store the child handle and record start time
+    if let Some(state) = app.try_state::<SidecarState>() {
+        state.port.store(port, Ordering::Relaxed);
+        if let Ok(mut guard) = state.child.lock() {
+            *guard = Some(child);
+        }
+        if let Ok(mut guard) = state.last_start.lock() {
+            *guard = Some(Instant::now());
+        }
+    }
+
+    // Monitor sidecar stdout/stderr and detect exit for crash recovery
+    spawn_sidecar_monitor(app.clone(), rx);
+
+    StartResult {
+        success: true,
+        message: format!("Sidecar server starting on port {}...", port),
+        port: Some(port),
+        source: "sidecar".to_string(),
+    }
+}
+
+/// Monitor sidecar output and process exit for crash recovery.
+fn spawn_sidecar_monitor(
+    app: tauri::AppHandle,
+    mut rx: tokio::sync::mpsc::Receiver<CommandEvent>,
+) {
+    tauri::async_runtime::spawn(async move {
+        while let Some(event) = rx.recv().await {
+            match event {
+                CommandEvent::Stdout(line) => {
+                    let text = String::from_utf8_lossy(&line);
+                    let _ = app.emit(
+                        "sidecar-log",
+                        serde_json::json!({
+                            "stream": "stdout",
+                            "line": text.trim_end()
+                        }),
+                    );
+                }
+                CommandEvent::Stderr(line) => {
+                    let text = String::from_utf8_lossy(&line);
+                    let _ = app.emit(
+                        "sidecar-log",
+                        serde_json::json!({
+                            "stream": "stderr",
+                            "line": text.trim_end()
+                        }),
+                    );
+                }
+                CommandEvent::Terminated(payload) => {
+                    handle_sidecar_exit(&app, payload.code);
+                    break;
+                }
+                CommandEvent::Error(msg) => {
+                    let _ = app.emit(
+                        "sidecar-log",
+                        serde_json::json!({
+                            "stream": "stderr",
+                            "line": format!("[sidecar error] {}", msg)
+                        }),
+                    );
                 }
+                _ => {}
             }
         }
+    });
+}
+
+/// Handle unexpected sidecar exit with auto-restart and exponential backoff.
+fn handle_sidecar_exit(app: &tauri::AppHandle, exit_code: Option<i32>) {
+    let state = match app.try_state::<SidecarState>() {
+        Some(s) => s,
+        None => return,
+    };
+
+    // Don't restart during intentional shutdown
+    if state.shutting_down.load(Ordering::Relaxed) {
+        return;
     }
 
+    // Clear the dead child from state
+    if let Ok(mut guard) = state.child.lock() {
+        guard.take();
+    }
+
+    // Reset crash counter if server ran long enough (60s of stable operation)
+    if let Ok(guard) = state.last_start.lock() {
+        if let Some(start_time) = *guard {
+            if start_time.elapsed() >= STABLE_THRESHOLD {
+                state.crash_count.store(0, Ordering::Relaxed);
+            }
+        }
+    }
+
+    let crashes = state.crash_count.fetch_add(1, Ordering::Relaxed) + 1;
+
+    crate::health::set_disconnected();
+
+    let _ = app.emit(
+        "server-status",
+        serde_json::json!({
+            "connected": false,
+            "crashed": true,
+            "crashCount": crashes,
+            "exitCode": exit_code
+        }),
+    );
+
+    // Stop restarting after too many consecutive crashes
+    if crashes >= MAX_CRASH_COUNT {
+        let _ = app.emit(
+            "server-status",
+            serde_json::json!({
+                "connected": false,
+                "crashed": true,
+                "crashCount": crashes,
+                "fatal": true,
+                "message": "Server crashed too many times. Use View > Restart Server to try again."
+            }),
+        );
+        return;
+    }
+
+    // Schedule restart with exponential backoff
+    let delay = backoff_ms(crashes);
+    let app_clone = app.clone();
+    tauri::async_runtime::spawn(async move {
+        tokio::time::sleep(Duration::from_millis(delay)).await;
+
+        if let Some(st) = app_clone.try_state::<SidecarState>() {
+            if st.shutting_down.load(Ordering::Relaxed) {
+                return;
+            }
+        }
+
+        let result = start_sidecar(&app_clone);
+        if result.success {
+            if let Some(port) = result.port {
+                crate::health::set_connected(port);
+            }
+        }
+    });
+}
+
+/// Restart the sidecar — kills existing process, resets crash counter, starts fresh.
+pub fn restart_sidecar(app: &tauri::AppHandle) -> StartResult {
+    kill_sidecar(app);
+
+    if let Some(state) = app.try_state::<SidecarState>() {
+        state.crash_count.store(0, Ordering::Relaxed);
+        state.shutting_down.store(false, Ordering::Relaxed);
+    }
+
+    start_sidecar(app)
+}
+
+/// Kill the running sidecar process (called on app exit or restart).
+pub fn kill_sidecar(app: &tauri::AppHandle) {
+    if let Some(state) = app.try_state::<SidecarState>() {
+        state.shutting_down.store(true, Ordering::Relaxed);
+        if let Ok(mut guard) = state.child.lock() {
+            if let Some(child) = guard.take() {
+                let _ = child.kill();
+            }
+        }
+    }
+}
+
+// ── External CLI fallback ──
+
+/// Find the `a2a` CLI binary on PATH
+fn find_a2a_binary() -> Option<String> {
+    let result = Command::new("which").arg("a2a").output();
+    if let Ok(output) = result {
+        if output.status.success() {
+            let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            if !path.is_empty() {
+                return Some(path);
+            }
+        }
+    }
     None
 }
 
-/// Start the a2a server as a detached process
-pub fn start_server() -> StartResult {
+/// Start the A2A server via external CLI (fallback when sidecar unavailable).
+fn start_external_server(port: u16) -> StartResult {
     let binary = match find_a2a_binary() {
         Some(b) => b,
         None => {
             return StartResult {
                 success: false,
-                message: "Could not find 'a2a' CLI. Is a2acalling installed? Run: npm install -g a2acalling".to_string(),
+                message: "Could not find bundled sidecar or 'a2a' CLI. Is a2acalling installed? Run: npm install -g a2acalling".to_string(),
+                port: None,
+                source: "none".to_string(),
             };
         }
     };
 
-    let port = crate::discovery::read_config_ports()
-        .first()
-        .copied()
-        .unwrap_or(3001);
     let port_str = port.to_string();
-
     let result = Command::new(&binary)
         .args(["server", "--port", &port_str])
         .stdout(std::process::Stdio::null())
@@ -60,11 +292,15 @@ pub fn start_server() -> StartResult {
     match result {
         Ok(_child) => StartResult {
             success: true,
-            message: format!("Server starting on port {}...", port),
+            message: format!("External server starting on port {}...", port),
+            port: Some(port),
+            source: "external".to_string(),
         },
         Err(err) => StartResult {
             success: false,
             message: format!("Failed to start server: {}", err),
+            port: None,
+            source: "none".to_string(),
         },
     }
 }

package/native/macos/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/tauri-apps/tauri/dev/crates/tauri-config-schema/schema.json",
   "productName": "A2A Callbook",
-  "version": "0.1.0",
+  "version": "0.6.74",
   "identifier": "com.openclaw.a2a-callbook",
   "build": {
     "frontendDist": "../index.html"
@@ -20,7 +20,13 @@
   },
   "bundle": {
     "active": true,
-    "targets": ["dmg", "app"],
+    "targets": [
+      "dmg",
+      "app"
+    ],
+    "externalBin": [
+      "binaries/a2a-server"
+    ],
     "icon": [
       "icons/32x32.png",
       "icons/128x128.png",
@@ -28,13 +34,16 @@
     ],
     "macOS": {
       "minimumSystemVersion": "12.0",
-      "frameworks": []
+      "frameworks": [],
+      "entitlements": "entitlements.plist"
     }
   },
   "plugins": {
     "deep-link": {
       "desktop": {
-        "schemes": ["a2a"]
+        "schemes": [
+          "a2a"
+        ]
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "a2acalling",
-  "version": "0.6.74",
+  "version": "0.6.75",
   "description": "Agent-to-agent calling for OpenClaw - A2A agent communication",
   "main": "src/index.js",
   "bin": {
@@ -11,9 +11,12 @@
     "postinstall": "node scripts/postinstall.js",
     "start": "node src/server.js",
     "test": "node test/run.js",
+    "test:coverage": "c8 node test/run.js",
     "lint": "biome lint src/",
     "lint:check": "biome check src/",
-    "knip": "knip"
+    "knip": "knip",
+    "build:standalone": "bash scripts/build-standalone.sh",
+    "build:sync-version": "bash scripts/sync-version.sh"
   },
   "keywords": [
     "openclaw",
@@ -41,7 +44,9 @@
     "express": "^4.21.0"
   },
   "devDependencies": {
+    "@yao-pkg/pkg": "^6.0.0",
     "@biomejs/biome": "^2.4.4",
+    "c8": "^11.0.0",
     "eslint": "^10.0.2",
     "eslint-plugin-sonarjs": "^4.0.0",
     "knip": "^5.85.0"

package/pkg.config.json

@@ -0,0 +1,14 @@
+{
+  "pkg": {
+    "scripts": [
+      "src/**/*.js",
+      "bin/cli.js"
+    ],
+    "assets": [
+      "src/dashboard/public/**/*",
+      "node_modules/better-sqlite3/build/Release/better_sqlite3.node",
+      "node_modules/better-sqlite3/prebuilds/**/*"
+    ],
+    "outputPath": "native/macos/src-tauri/binaries"
+  }
+}

package/scripts/build-standalone.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# Build standalone Node.js binary for the A2A server using @yao-pkg/pkg.
+# Usage:
+#   scripts/build-standalone.sh                  # Build for current arch
+#   scripts/build-standalone.sh --universal      # Build macOS universal binary (aarch64 + x86_64)
+#   scripts/build-standalone.sh --arch arm64     # Build for specific arch
+#   scripts/build-standalone.sh --arch x64       # Build for specific arch
+#
+# Output: native/macos/src-tauri/binaries/a2a-server-<target-triple>
+# Requires: Node.js 20+, npm, macOS (for native binary builds)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+OUTPUT_DIR="$PROJECT_DIR/native/macos/src-tauri/binaries"
+PKG_TARGET_NODE="node20"
+BINARY_NAME="a2a-server"
+
+cd "$PROJECT_DIR"
+
+# ── Parse args ──
+UNIVERSAL=false
+TARGET_ARCH=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --universal) UNIVERSAL=true; shift ;;
+    --arch) TARGET_ARCH="$2"; shift 2 ;;
+    *) echo "Unknown option: $1" >&2; exit 2 ;;
+  esac
+done
+
+# ── Detect platform ──
+OS="$(uname -s)"
+if [[ "$OS" != "Darwin" ]]; then
+  echo "Warning: This build script is designed for macOS. Binary will target macOS regardless." >&2
+fi
+
+NATIVE_ARCH="$(uname -m)"
+case "$NATIVE_ARCH" in
+  arm64|aarch64) NATIVE_ARCH="arm64" ;;
+  x86_64)        NATIVE_ARCH="x64" ;;
+  *) echo "Unsupported architecture: $NATIVE_ARCH" >&2; exit 1 ;;
+esac
+
+# ── Ensure @yao-pkg/pkg is available ──
+if ! npx --no-install pkg --version >/dev/null 2>&1; then
+  echo "Installing @yao-pkg/pkg..."
+  npm install --save-dev @yao-pkg/pkg
+fi
+
+# ── Ensure production dependencies are built ──
+echo "Rebuilding native modules..."
+npm rebuild better-sqlite3
+
+# ── Build function ──
+build_arch() {
+  local arch="$1"
+  local target="${PKG_TARGET_NODE}-macos-${arch}"
+  local triple
+
+  case "$arch" in
+    arm64)  triple="aarch64-apple-darwin" ;;
+    x64)    triple="x86_64-apple-darwin" ;;
+    *) echo "Unsupported arch: $arch" >&2; return 1 ;;
+  esac
+
+  local output_path="$OUTPUT_DIR/${BINARY_NAME}-${triple}"
+
+  echo "Building standalone binary: $target → $output_path"
+
+  npx pkg src/server.js \
+    --config pkg.config.json \
+    --target "$target" \
+    --output "$output_path" \
+    --compress GZip
+
+  chmod +x "$output_path"
+  echo "Built: $output_path ($(du -h "$output_path" | cut -f1))"
+}
+
+# ── Execute builds ──
+mkdir -p "$OUTPUT_DIR"
+
+if $UNIVERSAL; then
+  echo "=== Building macOS universal binary ==="
+  build_arch "arm64"
+  build_arch "x64"
+
+  ARM_BIN="$OUTPUT_DIR/${BINARY_NAME}-aarch64-apple-darwin"
+  X64_BIN="$OUTPUT_DIR/${BINARY_NAME}-x86_64-apple-darwin"
+  UNIVERSAL_BIN="$OUTPUT_DIR/${BINARY_NAME}-universal-apple-darwin"
+
+  echo "Creating universal binary with lipo..."
+  lipo -create "$ARM_BIN" "$X64_BIN" -output "$UNIVERSAL_BIN"
+  chmod +x "$UNIVERSAL_BIN"
+  echo "Universal: $UNIVERSAL_BIN ($(du -h "$UNIVERSAL_BIN" | cut -f1))"
+elif [[ -n "$TARGET_ARCH" ]]; then
+  build_arch "$TARGET_ARCH"
+else
+  build_arch "$NATIVE_ARCH"
+fi
+
+echo ""
+echo "=== Build complete ==="
+ls -lh "$OUTPUT_DIR"/${BINARY_NAME}-* 2>/dev/null || echo "(no binaries found)"

package/scripts/smoke-test-standalone.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# A2A-97: fast smoke coverage for packaged standalone server startup + SQLite-backed routes.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+BINARY_PATH="${1:-}"
+
+if [[ -z "$BINARY_PATH" ]]; then
+  for candidate in \
+    "$PROJECT_DIR/native/macos/src-tauri/binaries/a2a-server-universal-apple-darwin" \
+    "$PROJECT_DIR/native/macos/src-tauri/binaries/a2a-server-aarch64-apple-darwin" \
+    "$PROJECT_DIR/native/macos/src-tauri/binaries/a2a-server-x86_64-apple-darwin"
+  do
+    if [[ -x "$candidate" ]]; then
+      BINARY_PATH="$candidate"
+      break
+    fi
+  done
+fi
+
+if [[ -z "$BINARY_PATH" || ! -x "$BINARY_PATH" ]]; then
+  echo "Standalone binary not found or not executable: ${BINARY_PATH:-<unset>}" >&2
+  exit 1
+fi
+
+TMP_ROOT="$(mktemp -d)"
+CONFIG_DIR="$TMP_ROOT/config"
+LOG_FILE="$TMP_ROOT/server.log"
+mkdir -p "$CONFIG_DIR"
+
+PORT="$((
+  $(node -e "const net=require('net'); const s=net.createServer(); s.listen(0,'127.0.0.1',()=>{console.log(s.address().port); s.close();});")
+))"
+
+PID=""
+cleanup() {
+  if [[ -n "$PID" ]] && kill -0 "$PID" 2>/dev/null; then
+    kill "$PID" 2>/dev/null || true
+    wait "$PID" 2>/dev/null || true
+  fi
+  rm -rf "$TMP_ROOT"
+}
+trap cleanup EXIT
+
+fail() {
+  echo "Smoke test failed: $1" >&2
+  if [[ -f "$LOG_FILE" ]]; then
+    echo "---- server log tail (last 50 lines) ----" >&2
+    tail -n 50 "$LOG_FILE" >&2 || true
+  fi
+  exit 1
+}
+
+A2A_RUNTIME=test \
+NO_AUTO_UPDATE=1 \
+A2A_CONFIG_DIR="$CONFIG_DIR" \
+OPENCLAW_CONFIG_DIR="$CONFIG_DIR" \
+"$BINARY_PATH" "$PORT" >"$LOG_FILE" 2>&1 &
+PID="$!"
+
+health_ok=0
+for _ in $(seq 1 60); do
+  if curl -fsS "http://127.0.0.1:${PORT}/api/a2a/status" >/dev/null 2>&1; then
+    health_ok=1
+    break
+  fi
+  sleep 1
+done
+
+if [[ "$health_ok" -ne 1 ]]; then
+  fail "server did not become healthy within 60 seconds"
+fi
+
+# A2A-97: hit conversation list endpoint to exercise SQLite-backed dashboard storage path.
+curl -fsS "http://127.0.0.1:${PORT}/api/a2a/dashboard/calls" >/dev/null \
+  || fail "dashboard calls endpoint failed (possible SQLite/native binding issue)"
+
+create_resp="$(
+  curl -fsS -X POST "http://127.0.0.1:${PORT}/api/a2a/dashboard/invites" \
+    -H 'content-type: application/json' \
+    -d '{"name":"CI Smoke","tier":"public","expires":"1h"}'
+)"
+
+invite_id="$(node -e "const payload=JSON.parse(process.argv[1]); process.stdout.write(payload.token && payload.token.id ? payload.token.id : '');" "$create_resp")"
+if [[ -z "$invite_id" ]]; then
+  fail "invite creation returned no token id"
+fi
+
+curl -fsS -X POST "http://127.0.0.1:${PORT}/api/a2a/dashboard/invites/${invite_id}/revoke" >/dev/null \
+  || fail "invite revoke failed"
+
+if ! kill -0 "$PID" 2>/dev/null; then
+  fail "server exited unexpectedly during smoke checks"
+fi
+
+kill "$PID" 2>/dev/null || true
+wait "$PID" 2>/dev/null || true
+PID=""
+
+echo "Standalone smoke test passed for ${BINARY_PATH}"

package/scripts/sync-version.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+TAURI_CONF="$PROJECT_DIR/native/macos/src-tauri/tauri.conf.json"
+
+PACKAGE_VERSION="$(node -p "require('$PROJECT_DIR/package.json').version")"
+
+# A2A-95: force native bundle version to match npm package version for release parity.
+node - "$TAURI_CONF" "$PACKAGE_VERSION" <<'NODE'
+const fs = require('fs');
+const tauriConfPath = process.argv[2];
+const nextVersion = process.argv[3];
+
+const raw = fs.readFileSync(tauriConfPath, 'utf8');
+const config = JSON.parse(raw);
+const prevVersion = config.version;
+
+if (prevVersion === nextVersion) {
+  console.log(`Tauri version already in sync: ${nextVersion}`);
+  process.exit(0);
+}
+
+config.version = nextVersion;
+fs.writeFileSync(tauriConfPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+console.log(`Updated tauri.conf.json version: ${prevVersion} -> ${nextVersion}`);
+NODE

package/scripts/verify-app-bundle.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# A2A-97: verify packaged app has sidecar + expected metadata before release upload.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+APP_PATH="${1:-$PROJECT_DIR/native/macos/src-tauri/target/universal-apple-darwin/release/bundle/macos/A2A Callbook.app}"
+
+fail() {
+  echo "App bundle verification failed: $1" >&2
+  if [[ -d "$APP_PATH/Contents/MacOS" ]]; then
+    echo "---- Contents/MacOS ----" >&2
+    ls -la "$APP_PATH/Contents/MacOS" >&2 || true
+  fi
+  exit 1
+}
+
+[[ -d "$APP_PATH" ]] || fail "missing app bundle at $APP_PATH"
+[[ -f "$APP_PATH/Contents/Info.plist" ]] || fail "missing Info.plist"
+[[ -f "$APP_PATH/Contents/Resources/icon.icns" ]] || fail "missing icon.icns"
+
+if ! ls "$APP_PATH/Contents/MacOS"/a2a-server-* >/dev/null 2>&1; then
+  fail "missing bundled a2a-server sidecar binary"
+fi
+
+EXPECTED_VERSION="$(node -p "require('$PROJECT_DIR/package.json').version")"
+ACTUAL_VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$APP_PATH/Contents/Info.plist" 2>/dev/null || true)"
+[[ -n "$ACTUAL_VERSION" ]] || fail "unable to read CFBundleShortVersionString"
+
+if [[ "$ACTUAL_VERSION" != "$EXPECTED_VERSION" ]]; then
+  fail "bundle version mismatch (expected $EXPECTED_VERSION, got $ACTUAL_VERSION)"
+fi
+
+echo "App bundle verification passed for $APP_PATH"