amalgm 0.1.124 → 0.1.125

package/runtime/scripts/amalgm-mcp/events/npm-release-runner.js

@@ -0,0 +1,406 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ENGINE_REPO_FULL_NAME = 'amalgm-inc/amalgm-engine';
+const DEFAULT_ENGINE_REPO_URL = 'https://github.com/amalgm-inc/amalgm-engine.git';
+const DEFAULT_CHECKOUT_ROOT = path.join(os.homedir(), '.amalgm', 'workflow-checkouts', 'amalgm-npm-release');
+const DEFAULT_ENV_FILE = path.join(os.homedir(), '.amalgm', 'npm-release.env');
+
+function cleanString(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+function parseEnvFile(text) {
+  const env = {};
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(trimmed);
+    if (!match) continue;
+    let value = match[2] || '';
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.endsWith(quote)) {
+      value = value.slice(1, -1);
+    }
+    env[match[1]] = value;
+  }
+  return env;
+}
+
+function applyNpmReleaseEnv(env = process.env) {
+  const candidates = [
+    cleanString(env.AMALGM_NPM_RELEASE_ENV_FILE),
+    DEFAULT_ENV_FILE,
+  ].filter(Boolean);
+
+  for (const filePath of candidates) {
+    if (!fs.existsSync(filePath)) continue;
+    const values = parseEnvFile(fs.readFileSync(filePath, 'utf8'));
+    for (const [key, value] of Object.entries(values)) {
+      if (!cleanString(env[key])) env[key] = value;
+    }
+  }
+
+  return env;
+}
+
+function prependPath(env, dir) {
+  const cleanDir = cleanString(dir);
+  if (!cleanDir) return env.PATH || '';
+  const parts = String(env.PATH || '').split(path.delimiter).filter(Boolean);
+  return [cleanDir, ...parts.filter((part) => part !== cleanDir)].join(path.delimiter);
+}
+
+function npmReleaseToolEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  applyNpmReleaseEnv(env);
+  const nodeBin = cleanString(env.AMALGM_NPM_RELEASE_NODE_BIN);
+  if (nodeBin && fs.existsSync(nodeBin)) {
+    env.PATH = prependPath(env, path.dirname(nodeBin));
+  }
+  const pathPrefix = cleanString(env.AMALGM_NPM_RELEASE_PATH_PREFIX);
+  if (pathPrefix) env.PATH = prependPath(env, pathPrefix);
+  env.npm_config_python = cleanString(env.AMALGM_NPM_RELEASE_PYTHON)
+    || cleanString(env.npm_config_python)
+    || '/usr/bin/python3';
+  env.npm_config_cache = cleanString(env.AMALGM_NPM_RELEASE_NPM_CACHE)
+    || cleanString(env.npm_config_cache)
+    || path.join(os.tmpdir(), 'amalgm-npm-cache');
+  env.npm_config_prefer_online = 'true';
+  env.npm_config_audit = 'false';
+  env.npm_config_fund = 'false';
+  if (!cleanString(env.NODE_AUTH_TOKEN) && cleanString(env.NPM_TOKEN)) {
+    env.NODE_AUTH_TOKEN = cleanString(env.NPM_TOKEN);
+  }
+  if (!cleanString(env.NPM_TOKEN) && cleanString(env.NODE_AUTH_TOKEN)) {
+    env.NPM_TOKEN = cleanString(env.NODE_AUTH_TOKEN);
+  }
+  return env;
+}
+
+function isFullSha(value) {
+  return /^[a-f0-9]{40}$/i.test(cleanString(value));
+}
+
+function laneForBranch(branch) {
+  if (branch === 'preview') return 'preview';
+  if (branch === 'main') return 'main';
+  return null;
+}
+
+function parsePayloadFromEnv(env = process.env) {
+  const payloadFile = cleanString(env.AMALGM_NPM_RELEASE_PAYLOAD_FILE);
+  const payloadJson = payloadFile ? fs.readFileSync(payloadFile, 'utf8') : cleanString(env.AMALGM_NPM_RELEASE_PAYLOAD_JSON);
+  if (!payloadJson) return null;
+  return JSON.parse(payloadJson);
+}
+
+function requestFromEnv(env = process.env) {
+  const payload = parsePayloadFromEnv(env);
+  const repository = cleanString(
+    env.AMALGM_NPM_RELEASE_SOURCE_REPO
+    || payload?.repository?.full_name,
+  );
+  const ref = cleanString(env.AMALGM_NPM_RELEASE_REF || payload?.ref);
+  const branch = cleanString(
+    env.AMALGM_NPM_RELEASE_BRANCH
+    || (ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : ref),
+  );
+  const after = cleanString(env.AMALGM_NPM_RELEASE_AFTER || payload?.after);
+  const messages = [
+    payload?.head_commit?.message,
+    ...(Array.isArray(payload?.commits) ? payload.commits.map((commit) => commit?.message) : []),
+  ].map((message) => String(message || ''));
+
+  return {
+    payload,
+    repository,
+    ref: ref || (branch ? `refs/heads/${branch}` : ''),
+    branch,
+    after,
+    lane: laneForBranch(branch),
+    delivery: cleanString(env.AMALGM_NPM_RELEASE_DELIVERY),
+    messages,
+    dryRun: ['1', 'true', 'yes', 'on'].includes(cleanString(env.AMALGM_NPM_RELEASE_DRY_RUN).toLowerCase()),
+  };
+}
+
+function shouldHandleRequest(request) {
+  if (request.repository !== ENGINE_REPO_FULL_NAME) {
+    return { ok: false, reason: `Ignored repository "${request.repository || '(missing)'}".` };
+  }
+  if (!request.lane) return { ok: false, reason: `Ignored branch "${request.branch || '(missing)'}".` };
+  if (!isFullSha(request.after)) return { ok: false, reason: 'Ignored push without a full after SHA.' };
+  if (/^0{40}$/.test(request.after)) return { ok: false, reason: 'Ignored branch deletion push.' };
+  if ((request.messages || []).some((message) => /\[(skip npm|skip runtime|skip ci|ci skip)\]/i.test(message))) {
+    return { ok: false, reason: 'Ignored push with npm/runtime skip marker.' };
+  }
+  return { ok: true };
+}
+
+function run(command, args, options = {}) {
+  const printable = [command, ...args].join(' ');
+  console.log(`$ ${printable}`);
+  const result = spawnSync(command, args, {
+    cwd: options.cwd,
+    env: options.env || process.env,
+    encoding: 'utf8',
+    maxBuffer: Number(options.maxBuffer) || 100 * 1024 * 1024,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`${printable} failed with exit code ${result.status ?? result.signal ?? 'unknown'}`);
+  }
+  return result.stdout || '';
+}
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function runWithRetry(command, args, options = {}, attempts = 3) {
+  let lastError = null;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return run(command, args, options);
+    } catch (error) {
+      lastError = error;
+      if (attempt >= attempts) break;
+      const delayMs = Math.min(15_000, attempt * 5_000);
+      console.warn(`${command} ${args[0] || ''} failed on attempt ${attempt}; retrying in ${delayMs}ms.`);
+      sleepSync(delayMs);
+    }
+  }
+  throw lastError;
+}
+
+function readJsonFile(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function ensureCheckout({ dir, repoUrl, branch, ref }) {
+  fs.mkdirSync(path.dirname(dir), { recursive: true });
+  if (!fs.existsSync(path.join(dir, '.git'))) {
+    if (fs.existsSync(dir)) fs.rmSync(dir, { recursive: true, force: true });
+    run('git', ['clone', repoUrl, dir]);
+  }
+
+  run('git', ['remote', 'set-url', 'origin', repoUrl], { cwd: dir });
+  run('git', ['fetch', '--tags', 'origin', branch], { cwd: dir });
+  if (isFullSha(ref)) {
+    run('git', ['checkout', '--detach', ref], { cwd: dir });
+  } else {
+    run('git', ['checkout', '-B', branch, `origin/${branch}`], { cwd: dir });
+  }
+  run('git', ['reset', '--hard'], { cwd: dir });
+  run('git', ['clean', '-ffd', '-e', 'node_modules/'], { cwd: dir });
+}
+
+function timestampForVersion(date = new Date()) {
+  const pad = (value) => String(value).padStart(2, '0');
+  return [
+    date.getUTCFullYear(),
+    pad(date.getUTCMonth() + 1),
+    pad(date.getUTCDate()),
+    pad(date.getUTCHours()),
+    pad(date.getUTCMinutes()),
+    pad(date.getUTCSeconds()),
+  ].join('');
+}
+
+function baseVersion(rawVersion) {
+  const match = /^(\d+\.\d+\.\d+)(?:-.+)?$/.exec(String(rawVersion || '').trim());
+  if (!match) throw new Error(`Unsupported npm package version: ${rawVersion}`);
+  return match[1];
+}
+
+function npmReleasePlan(sourcePackageVersion, lane, options = {}) {
+  const sourceVersion = cleanString(sourcePackageVersion);
+  if (!sourceVersion) throw new Error('Missing source package version.');
+  if (lane === 'main') {
+    if (sourceVersion.includes('-')) {
+      throw new Error(`Main npm releases must use a stable package version, received: ${sourceVersion}`);
+    }
+    return {
+      lane,
+      version: sourceVersion,
+      publishTag: 'latest',
+      distTags: ['latest', 'main'],
+      sourcePackageVersion: sourceVersion,
+    };
+  }
+  if (lane === 'preview') {
+    const stamp = cleanString(options.timestamp) || timestampForVersion(options.date);
+    return {
+      lane,
+      version: `${baseVersion(sourceVersion)}-canary.${stamp}`,
+      publishTag: 'canary',
+      distTags: ['canary'],
+      sourcePackageVersion: sourceVersion,
+    };
+  }
+  throw new Error(`Unsupported npm release lane: ${lane}`);
+}
+
+function writePackageVersions(engineDir, version, env) {
+  run('npm', ['version', '--no-git-tag-version', '--allow-same-version', version], { cwd: engineDir, env });
+  run('npm', ['version', '--no-git-tag-version', '--allow-same-version', version], {
+    cwd: path.join(engineDir, 'packages', 'amalgm'),
+    env,
+  });
+}
+
+function npmAuthToken(env) {
+  return cleanString(env.NODE_AUTH_TOKEN) || cleanString(env.NPM_TOKEN);
+}
+
+function withProjectNpmrc(packageDir, env, fn) {
+  const token = npmAuthToken(env);
+  if (!token) return fn();
+
+  const npmrcPath = path.join(packageDir, '.npmrc');
+  const hadPrior = fs.existsSync(npmrcPath);
+  const prior = hadPrior ? fs.readFileSync(npmrcPath, 'utf8') : '';
+  fs.writeFileSync(npmrcPath, `//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}\n`);
+  try {
+    return fn();
+  } finally {
+    if (hadPrior) fs.writeFileSync(npmrcPath, prior);
+    else fs.rmSync(npmrcPath, { force: true });
+  }
+}
+
+function npmPackageExists(packageDir, version, env) {
+  const result = spawnSync('npm', ['view', `amalgm@${version}`, 'version', '--json'], {
+    cwd: packageDir,
+    env,
+    encoding: 'utf8',
+    maxBuffer: 10 * 1024 * 1024,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (result.status === 0) return true;
+  const output = `${result.stdout || ''}\n${result.stderr || ''}`;
+  if (/E404|404 Not Found|is not in this registry/i.test(output)) return false;
+  throw new Error(`Could not check amalgm@${version}: ${output.trim() || `exit ${result.status}`}`);
+}
+
+function publishPackage(packageDir, plan, env) {
+  const exists = npmPackageExists(packageDir, plan.version, env);
+  let published = false;
+  if (exists) {
+    console.log(`amalgm@${plan.version} already exists; skipping npm publish.`);
+  } else {
+    runWithRetry('npm', ['publish', '--access', 'public', '--tag', plan.publishTag], { cwd: packageDir, env }, 3);
+    published = true;
+  }
+
+  for (const tag of plan.distTags) {
+    runWithRetry('npm', ['dist-tag', 'add', `amalgm@${plan.version}`, tag], { cwd: packageDir, env }, 3);
+  }
+
+  let currentDistTags = {};
+  try {
+    currentDistTags = JSON.parse(run('npm', ['view', 'amalgm', 'dist-tags', '--json'], { cwd: packageDir, env }));
+  } catch {
+    currentDistTags = {};
+  }
+
+  return { published, alreadyExists: exists, currentDistTags };
+}
+
+function publishNpmRelease(request, options = {}) {
+  applyNpmReleaseEnv(process.env);
+  const releaseEnv = npmReleaseToolEnv(process.env);
+  const decision = shouldHandleRequest(request);
+  if (!decision.ok) {
+    console.log(decision.reason);
+    return { ok: true, skipped: true, reason: decision.reason };
+  }
+
+  const sourcePackageVersion = cleanString(options.sourcePackageVersion || process.env.AMALGM_NPM_RELEASE_SOURCE_PACKAGE_VERSION);
+  if (request.dryRun) {
+    const plan = npmReleasePlan(sourcePackageVersion || (request.lane === 'main' ? '0.1.0' : '0.1.0-canary.0'), request.lane, options);
+    return {
+      ok: true,
+      dryRun: true,
+      lane: request.lane,
+      branch: request.branch,
+      repository: request.repository,
+      ref: request.after,
+      plan,
+    };
+  }
+
+  const checkoutRoot = cleanString(options.checkoutRoot || process.env.AMALGM_NPM_RELEASE_CHECKOUT_ROOT)
+    || DEFAULT_CHECKOUT_ROOT;
+  const laneRoot = path.join(checkoutRoot, request.lane);
+  const engineDir = cleanString(process.env.AMALGM_NPM_RELEASE_ENGINE_REPO_PATH)
+    || path.join(laneRoot, 'amalgm-engine');
+  const engineRepoUrl = cleanString(process.env.AMALGM_ENGINE_REPO_URL) || DEFAULT_ENGINE_REPO_URL;
+
+  ensureCheckout({ dir: engineDir, repoUrl: engineRepoUrl, branch: request.branch, ref: request.after });
+
+  const packageDir = path.join(engineDir, 'packages', 'amalgm');
+  const checkedOutVersion = readJsonFile(path.join(packageDir, 'package.json')).version;
+  const plan = npmReleasePlan(checkedOutVersion, request.lane);
+  const sha = cleanString(run('git', ['rev-parse', 'HEAD'], { cwd: engineDir }));
+
+  run('npm', ['ci'], { cwd: engineDir, env: releaseEnv });
+  writePackageVersions(engineDir, plan.version, releaseEnv);
+  run('npm', ['run', 'npm:sync'], { cwd: engineDir, env: releaseEnv });
+  run('npm', ['run', 'npm:check'], { cwd: engineDir, env: releaseEnv });
+
+  const publishResult = withProjectNpmrc(packageDir, releaseEnv, () => publishPackage(packageDir, plan, releaseEnv));
+
+  return {
+    ok: true,
+    skipped: false,
+    lane: request.lane,
+    branch: request.branch,
+    repository: request.repository,
+    ref: request.after,
+    sha,
+    version: plan.version,
+    sourcePackageVersion: checkedOutVersion,
+    publishTag: plan.publishTag,
+    distTags: plan.distTags,
+    published: publishResult.published,
+    alreadyExists: publishResult.alreadyExists,
+    currentDistTags: publishResult.currentDistTags,
+  };
+}
+
+function main() {
+  applyNpmReleaseEnv(process.env);
+  const request = requestFromEnv(process.env);
+  const result = publishNpmRelease(request);
+  console.log(JSON.stringify(result, null, 2));
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error?.stack || error?.message || String(error));
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  applyNpmReleaseEnv,
+  baseVersion,
+  npmReleasePlan,
+  npmReleaseToolEnv,
+  parseEnvFile,
+  publishNpmRelease,
+  requestFromEnv,
+  shouldHandleRequest,
+  timestampForVersion,
+};

package/runtime/scripts/amalgm-mcp/tests/desktop-release-automation-seed.test.js

@@ -0,0 +1,58 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-desktop-release-automation-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_EVENTS_PUBLIC_URL = 'https://desktop-release.example/events';
+
+const { closeLocalDb } = require('../state/db');
+const { listAutomations, listTriggers } = require('../automations/store');
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('automations store seeds the internal release webhook automation', () => {
+  const automation = listAutomations().find((item) => item.id === 'internal-amalgm-desktop-release');
+
+  assert.ok(automation);
+  assert.equal(automation.status, 'active');
+  assert.equal(automation.name, 'Run Amalgm release automation');
+  assert.deepEqual(automation.workflows.map((workflow) => workflow.id), [
+    'internal-amalgm-desktop-release-workflow',
+    'internal-amalgm-npm-release-workflow',
+  ]);
+  assert.equal(automation.workflows[0].status, 'active');
+  assert.equal(automation.workflows[1].status, 'active');
+  assert.equal(automation.workflows[1].name, 'Publish npm runtime release');
+  assert.match(automation.workflows[0].workflowText, /String\(secrets\.CSC_LINK \|\| ""\)\.trim\(\)/);
+  assert.doesNotMatch(automation.workflows[0].workflowText, /CSC_LINK: secrets\.CSC_LINK \|\| ""/);
+  assert.match(automation.workflows[0].workflowText, /AMALGM_DESKTOP_RELEASE_PROVIDER/);
+  assert.match(automation.workflows[0].workflowText, /AMALGM_DESKTOP_RELEASE_FLY_APP/);
+  assert.match(automation.workflows[0].workflowText, /AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN/);
+  assert.match(automation.workflows[0].workflowText, /AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY/);
+  assert.match(automation.workflows[0].workflowText, /AMALGM_DESKTOP_UPDATE_BASE_URL/);
+  assert.match(automation.workflows[0].workflowText, /FLY_ACCESS_TOKEN/);
+  assert.match(automation.workflows[0].workflowText, /APPLE_API_KEY/);
+  assert.match(automation.workflows[0].workflowText, /AMALGM_DESKTOP_NOTARIZE/);
+  assert.ok(automation.workflows[0].allowlist.secrets.includes('AMALGM_DESKTOP_RELEASE_FLY_ROOT'));
+  assert.ok(automation.workflows[0].allowlist.secrets.includes('AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES'));
+  assert.ok(automation.workflows[0].allowlist.secrets.includes('AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY'));
+  assert.ok(automation.workflows[0].allowlist.secrets.includes('AMALGM_DESKTOP_UPDATE_URL'));
+  assert.ok(automation.workflows[0].allowlist.secrets.includes('APPLE_API_KEY'));
+  assert.ok(automation.workflows[0].allowlist.secrets.includes('AMALGM_DESKTOP_NOTARIZE'));
+
+  const trigger = listTriggers().find((item) => item.id === 'internal-amalgm-desktop-release-github-push');
+  assert.ok(trigger);
+  assert.equal(trigger.kind, 'event');
+  assert.equal(trigger.source, 'github');
+  assert.equal(trigger.event, 'push');
+  assert.equal(trigger.webhookUrl, 'https://desktop-release.example/events');
+  assert.match(trigger.secret, /^[a-f0-9]{32}$/);
+});