boo-flash 0.1.5 → 0.1.6

package/dist/app.js

@@ -2588,7 +2588,6 @@ function resolvePackage(name2) {
 
 // src/dependencies.ts
 var commonTools = ["curl", "zstd"];
-var candidateTools = ["gh", "unzip"];
 function preferredExecutable(name2, platform3, path, macSystemExists) {
   if (platform3 === "darwin" && (name2 === "curl" || name2 === "unzip") && macSystemExists) return `/usr/bin/${name2}`;
   return path;
@@ -2643,7 +2642,7 @@ async function command(argv, signal, options = {}) {
   if (!binary) throw new Error(`Missing ${argv[0]}. Refresh dependency setup before continuing.`);
   const child = spawn(binary, argv.slice(1), {
     stdio: options.terminal ? "inherit" : ["pipe", "pipe", "pipe"],
-    env: { ...process.env, GH_DEBUG: "", GH_PAGER: "cat", PAGER: "cat", GH_PROMPT_DISABLED: "1" }
+    env: { ...process.env, PAGER: "cat" }
   });
   let failure;
   const exited = new Promise((resolve) => {
@@ -2654,7 +2653,7 @@ async function command(argv, signal, options = {}) {
   });
   let stderr = "";
   child.stderr?.on("data", (data) => {
-    if (argv[0] !== "gh") stderr = (stderr + data.toString()).slice(-1500);
+    stderr = (stderr + data.toString()).slice(-1500);
   });
   child.stdin?.on("error", (error) => {
     failure = error;
@@ -2677,8 +2676,7 @@ async function command(argv, signal, options = {}) {
     const code2 = await exited;
     signal.throwIfAborted();
     if (failure || code2 !== 0) {
-      const message = argv[0] === "gh" ? `GitHub request failed. Run ${cleanText(binary)} auth login if needed; check repository access and your connection, then refresh.` : `${argv[0].split("/").pop()} failed (${code2 ?? "not started"}). ${cleanText(stderr || failure?.message || "")}`;
-      throw new Error(message);
+      throw new Error(`${argv[0].split("/").pop()} failed (${code2 ?? "not started"}). ${cleanText(stderr || failure?.message || "")}`);
     }
     return output;
   } finally {
@@ -2690,10 +2688,9 @@ async function command(argv, signal, options = {}) {
 
 // src/installers/homebrew.ts
 import { spawn as spawn2 } from "node:child_process";
-var packages = [...commonTools, ...candidateTools];
-function dependencies(includeGitHub = false) {
-  const required2 = includeGitHub ? packages : commonTools;
-  const absent = missing(required2);
+var packages = commonTools;
+function dependencies() {
+  const absent = missing(packages);
   return {
     missing: absent,
     installer: absent.length ? executable("brew") : null,
@@ -2804,8 +2801,6 @@ async function disks(signal, source, staging = tmpdir(), unmounted) {
   const zstd = executable("zstd");
   if (!zstd) throw new Error("Install zstd before flashing.");
   protectedPaths2.push(zstd);
-  const gh = executable("gh");
-  if (gh) protectedPaths2.push(gh);
   for (const path of protectedPaths2) {
     const canonical = await realpath(path);
     const device = (await command(["/usr/bin/stat", "-f", "%Sd", canonical], signal)).trim();
@@ -3044,7 +3039,7 @@ async function protectedPaths(source, staging) {
     }
   }
   if (process.env.OTUI_ASSET_ROOT) paths.push(process.env.OTUI_ASSET_ROOT);
-  for (const name2 of [...commonTools, ...candidateTools, ...tools]) {
+  for (const name2 of [...commonTools, ...tools]) {
     const path = executable(name2);
     if (path) paths.push(path);
   }
@@ -3239,8 +3234,8 @@ async function disks2(signal, source, staging = tmpdir2(), unmounted) {
   }
   return result;
 }
-function dependencies2(includeGitHub = false) {
-  const required2 = [...commonTools, ...tools, ...includeGitHub ? candidateTools : []];
+function dependencies2() {
+  const required2 = [...commonTools, ...tools];
   return {
     missing: missing(required2),
     installer: null,
@@ -3423,8 +3418,6 @@ async function clearCachedImages(signal) {
 
 // src/backend.ts
 var profiles = ["intel", "amd", "nvidia"];
-var repository = "anomalyco/boo";
-var repositoryIdentities = /* @__PURE__ */ new Set([repository, "anomalyco/ghostty-distro"]);
 var releaseOrigin = "https://images.os.boo";
 var diskID3 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
 var sha256 = /^[a-f0-9]{64}$/;
@@ -3529,35 +3522,49 @@ async function discoverImages(signal) {
   });
   return { run: build, version: channel.version, revision: channel.revision, timestamp, images };
 }
-async function discoverCandidates(signal) {
-  const api = async (path) => JSON.parse(await command(["gh", "api", "--hostname", "github.com", `repos/${repository}/${path}`], signal));
-  const result = await api("actions/workflows/candidate.yml/runs?status=success&per_page=10");
-  if (!Array.isArray(result.workflow_runs)) throw new Error("Invalid GitHub candidate workflow response.");
-  const candidates = [];
-  for (const run of result.workflow_runs.slice(0, 10)) {
-    if (run.status !== "completed" || run.conclusion !== "success" || run.path !== ".github/workflows/candidate.yml" || !positive(run.id) || !positive(run.run_number) || !Number.isFinite(Date.parse(run.created_at))) continue;
-    const batch = await api(`actions/runs/${run.id}/artifacts?per_page=100`);
-    if (!Array.isArray(batch.artifacts)) throw new Error("Invalid GitHub artifact response.");
-    for (const a of batch.artifacts) {
-      const match = /^boo-(intel|amd|nvidia)-candidate-([a-f0-9]{40})$/.exec(a.name);
-      if (!match || a.expired !== false || !(Date.parse(a.expires_at) > Date.now()) || !positive(a.id) || !positive(a.size_in_bytes) || !/^sha256:[a-f0-9]{64}$/.test(a.digest) || batch.artifacts.filter((other) => other.name === a.name).length !== 1) continue;
-      candidates.push({
-        run: run.id,
-        revision: match[2],
-        timestamp: new Date(run.created_at).toISOString(),
-        images: [{
-          profile: match[1],
-          id: a.id,
-          name: a.name,
-          bytes: a.size_in_bytes,
-          digest: a.digest.slice(7)
-        }],
-        candidate: { number: run.run_number }
-      });
-      if (candidates.length === 10) return candidates;
+function candidateCatalog(result) {
+  if (result?.schema !== 1 || !Array.isArray(result.candidates) || result.candidates.length > 10) {
+    throw new Error("Invalid Boo candidate catalog.");
+  }
+  return result.candidates.map((candidate) => {
+    const profile = candidate?.profile;
+    const image = candidate?.image;
+    const name2 = `boo-${candidate?.version}-candidate-${candidate?.revision?.slice(0, 12)}-x86_64-${profile}.raw.zst`;
+    if (!positive(candidate?.number) || !Number.isFinite(Date.parse(candidate?.timestamp)) || !/^[a-f0-9]{40}$/.test(candidate?.revision) || !profiles.includes(profile) || !semanticVersion.test(candidate?.version) || image?.file !== name2 || image?.prefix !== `candidates/${candidate.revision}/${profile}` || !positive(image?.bytes) || !sha256.test(image?.sha256) || !positive(image?.raw_bytes) || !sha256.test(image?.raw_sha256)) {
+      throw new Error("Invalid Boo candidate metadata.");
     }
-  }
-  return candidates;
+    return {
+      run: candidate.number,
+      version: candidate.version,
+      revision: candidate.revision,
+      timestamp: new Date(candidate.timestamp).toISOString(),
+      candidate: { number: candidate.number },
+      images: [{
+        profile,
+        id: candidate.number,
+        name: name2,
+        bytes: image.bytes,
+        digest: image.sha256,
+        cacheKind: "raw.zst",
+        url: `${releaseOrigin}/${image.prefix}/${name2}`,
+        rawBytes: image.raw_bytes,
+        rawDigest: image.raw_sha256
+      }]
+    };
+  });
+}
+async function discoverCandidates(signal) {
+  return candidateCatalog(JSON.parse(await command([
+    "curl",
+    "--fail",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--header",
+    "Cache-Control: no-cache",
+    `${releaseOrigin}/candidates/index.json`
+  ], signal, { limit: 1024 ** 2 })));
 }
 var FlashBackend = class {
   constructor(demo2) {
@@ -3583,11 +3590,11 @@ var FlashBackend = class {
     if (this.demo) return "Demo only: no cached images or USB contents were changed.";
     return clearCachedImages(signal);
   }
-  dependencies(includeGitHub = false) {
-    if (!this.demo) return this.requirePlatform().dependencies(includeGitHub);
+  dependencies() {
+    if (!this.demo) return this.requirePlatform().dependencies();
     const setup = this.demo.startsWith("setup") || this.demo === "no-homebrew";
     return {
-      missing: !setup || this.demoInstalled ? [] : this.demo === "setup-gh" ? includeGitHub ? ["gh"] : [] : this.demo === "setup-zstd" ? ["zstd"] : includeGitHub ? ["gh", "zstd"] : ["zstd"],
+      missing: !setup || this.demoInstalled ? [] : ["zstd"],
       installer: this.demo === "no-homebrew" ? null : "Homebrew",
       guidance: "Demo dependency guidance."
     };
@@ -3663,18 +3670,14 @@ var FlashBackend = class {
     if (process.getuid?.() === 0) throw new Error(`Run Boo Flash on ${platform3.id === "macos" ? "macOS" : "Linux"} as your normal user, not with sudo.`);
     if (!diskID3.test(disk.id) || !catalog.images.includes(image) || !profiles.includes(image.profile) || !positive(image.id) || !positive(image.bytes) || !sha256.test(image.digest)) throw new Error("Invalid flash selection.");
     if (catalog.candidate) {
-      if (!positive(catalog.run) || !/^[a-f0-9]{40}$/.test(catalog.revision) || image.cacheKind || image.name !== `boo-${image.profile}-candidate-${catalog.revision}`) throw new Error("Invalid candidate selection.");
-      const artifact = JSON.parse(await command(["gh", "api", "--hostname", "github.com", `repos/${repository}/actions/artifacts/${image.id}`], signal));
-      if (artifact.id !== image.id || artifact.name !== image.name || artifact.workflow_run?.id !== catalog.run || artifact.expired !== false || !(Date.parse(artifact.expires_at) > Date.now()) || artifact.size_in_bytes !== image.bytes || artifact.digest !== `sha256:${image.digest}`) {
-        throw new Error("Selected candidate artifact changed or expired. Refresh Candidates. No disk was written.");
-      }
+      if (!positive(catalog.run) || !/^[a-f0-9]{40}$/.test(catalog.revision) || image.id !== catalog.run || image.cacheKind !== "raw.zst" || image.name !== `boo-${catalog.version}-candidate-${catalog.revision.slice(0, 12)}-x86_64-${image.profile}.raw.zst` || image.url !== `${releaseOrigin}/candidates/${catalog.revision}/${image.profile}/${image.name}` || !positive(image.rawBytes) || !sha256.test(image.rawDigest ?? "")) throw new Error("Invalid candidate selection.");
     } else {
       const build = Number(catalog.version?.slice(catalog.version.lastIndexOf("+") + 1));
       const name2 = `boo-${catalog.version}-x86_64-${image.profile}.raw.zst`;
       if (!releaseVersion.test(catalog.version ?? "") || !positive(build) || catalog.run !== build || image.id !== build || !/^[a-f0-9]{40}$/.test(catalog.revision) || image.name !== name2 || image.cacheKind !== "raw.zst" || image.url !== `${releaseOrigin}/releases/${catalog.version}/${name2}` || !positive(image.rawBytes) || !sha256.test(image.rawDigest ?? "")) throw new Error("Invalid Boo release selection.");
     }
     const staging = await mkdtemp(join5(tmpdir4(), "boo-flash-"));
-    const payload = join5(staging, catalog.candidate ? "image.zip" : "image.raw.zst");
+    const payload = join5(staging, "image.raw.zst");
     let unretained = false;
     let destructive = false;
     try {
@@ -3682,17 +3685,17 @@ var FlashBackend = class {
       let count = 0;
       if (!await reuseArchive(image, payload, signal, (count2) => update({
         stage: "Using cached image",
-        detail: `Verifying cached ${catalog.candidate ? "GitHub ZIP" : `Boo ${catalog.version} image`} size and SHA-256; no download.`,
+        detail: `Verifying cached ${catalog.candidate ? "Boo candidate" : `Boo ${catalog.version} image`} size and SHA-256; no download.`,
         bytes: count2,
         total: image.bytes
       }))) {
         const payloadFile = await open2(payload, "wx", 384);
         const payloadHash = createHash2("sha256");
         const started = performance.now();
-        const detail = catalog.candidate ? "Selected candidate artifact only; authenticated with GitHub." : `Boo ${catalog.version} from images.os.boo.`;
+        const detail = catalog.candidate ? "Selected candidate from images.os.boo." : `Boo ${catalog.version} from images.os.boo.`;
         update({ stage: "Downloading", detail, bytes: 0, total: image.bytes });
         try {
-          const argv = catalog.candidate ? ["gh", "api", "--hostname", "github.com", `repos/${repository}/actions/artifacts/${image.id}/zip`] : ["curl", "--fail", "--silent", "--show-error", "--proto", "=https", image.url];
+          const argv = ["curl", "--fail", "--silent", "--show-error", "--proto", "=https", image.url];
           await command(argv, signal, {
             limit: image.bytes,
             consume: async (chunk) => {
@@ -3712,60 +3715,17 @@ var FlashBackend = class {
           await payloadFile.close();
         }
         if (count !== image.bytes || payloadHash.digest("hex") !== image.digest) {
-          throw new Error(`${catalog.candidate ? "GitHub ZIP" : "Release image"} size or SHA-256 mismatch. No disk was written.`);
+          throw new Error(`${catalog.candidate ? "Candidate" : "Release"} image size or SHA-256 mismatch. No disk was written.`);
         }
         unretained = true;
         await publishArchive(image, payload, signal);
         unretained = false;
       }
       signal.throwIfAborted();
-      let compressed = payload;
-      let rawBytes = image.rawBytes;
-      let rawDigest = image.rawDigest;
-      if (catalog.candidate) {
-        update({ stage: "Verifying", detail: "Checking GitHub ZIP digest, build identity and image checksums." });
-        const names = (await command(["unzip", "-Z1", payload], signal)).trim().split("\n");
-        for (const name2 of ["build-info.json", "SHA256SUMS", "SHA256SUMS.raw"]) {
-          if (names.filter((n) => n === name2).length !== 1) throw new Error(`Archive is missing a unique ${name2}.`);
-        }
-        const extractText = (name2) => command(["unzip", "-p", payload, name2], signal, { limit: 1024 ** 2 });
-        const metadata = JSON.parse(await extractText("build-info.json"));
-        const basename2 = `boo-${image.profile}-x86_64.raw.zst`;
-        if (metadata.semantic_version !== void 0 && (!semanticVersion.test(metadata.semantic_version) || metadata.build_number !== null || metadata.version !== metadata.semantic_version)) {
-          throw new Error("Build metadata has an invalid candidate image version.");
-        }
-        if (metadata.image !== basename2 || names.filter((name2) => name2 === basename2).length !== 1 || metadata.schema !== 1 || !repositoryIdentities.has(metadata.repository) || metadata.revision !== catalog.revision || metadata.variant !== image.profile || metadata.source_state !== "clean" || !positive(metadata.compressed_bytes) || metadata.compressed_bytes > image.bytes || !positive(metadata.raw_apparent_bytes) || !sha256.test(metadata.compressed_sha256) || !sha256.test(metadata.raw_sha256)) {
-          throw new Error("Build metadata does not match the selected candidate.");
-        }
-        if (metadata.candidate?.resolved_sha !== catalog.revision || metadata.candidate?.profile !== image.profile || metadata.candidate?.qualification !== "build-only" || typeof metadata.candidate?.source_ref !== "string" || !metadata.candidate.source_ref.trim()) {
-          throw new Error("Candidate source metadata does not match the selected artifact.");
-        }
-        if ((await extractText("SHA256SUMS")).trim() !== `${metadata.compressed_sha256}  ${basename2}` || (await extractText("SHA256SUMS.raw")).trim() !== `${metadata.raw_sha256}  ${basename2.slice(0, -4)}`) {
-          throw new Error("Image checksum manifests disagree with build metadata.");
-        }
-        compressed = join5(staging, basename2);
-        const file = await open2(compressed, "wx", 384);
-        const hash = createHash2("sha256");
-        count = 0;
-        try {
-          await command(["unzip", "-p", payload, basename2], signal, {
-            limit: metadata.compressed_bytes,
-            consume: async (chunk) => {
-              hash.update(chunk);
-              await file.writeFile(chunk);
-              count += chunk.length;
-              update({ stage: "Verifying", detail: "Extracting only the selected image; checking compressed SHA-256.", bytes: count, total: metadata.compressed_bytes });
-            }
-          });
-        } finally {
-          await file.close();
-        }
-        if (count !== metadata.compressed_bytes || hash.digest("hex") !== metadata.compressed_sha256) throw new Error("Compressed image size or SHA-256 mismatch.");
-        rawBytes = metadata.raw_apparent_bytes;
-        rawDigest = metadata.raw_sha256;
-      } else {
-        update({ stage: "Verifying", detail: `Boo ${catalog.version} release metadata and compressed SHA-256 verified.` });
-      }
+      const compressed = payload;
+      const rawBytes = image.rawBytes;
+      const rawDigest = image.rawDigest;
+      update({ stage: "Verifying", detail: `${catalog.candidate ? "Boo candidate" : `Boo ${catalog.version}`} metadata and compressed SHA-256 verified.` });
       if (!positive(rawBytes) || !sha256.test(rawDigest ?? "")) throw new Error("Image raw-stream metadata is invalid.");
       if (rawBytes > disk.bytes) throw new Error(`Image needs ${bytes(rawBytes)}; the selected USB is too small.`);
       const revalidate = async (unmounted = false) => {
@@ -3897,7 +3857,7 @@ function App(props) {
         if (!closing) {
           const setup = screen() === "installing";
           setError(controller.signal.aborted && setup ? "Setup cancelled. Refresh to check what is still missing." : controller.signal.aborted && props.backend.demo ? "Demo cancelled. No disks were written or ejected." : e instanceof Error ? e.message : "Operation failed. Refresh and try again.");
-          if (setup) setDependencies(props.backend.dependencies(setupCandidates()));
+          if (setup) setDependencies(props.backend.dependencies());
           setScreen(setup ? "setup" : "error");
           setCursor(0);
         }
@@ -3932,7 +3892,7 @@ function App(props) {
     setCursor(0);
     setScreen("candidates");
     operation(async (signal) => {
-      const state = props.backend.dependencies(true);
+      const state = props.backend.dependencies();
       if (state.missing.length) {
         setDependencies(state);
         setScreen("setup");
@@ -4741,10 +4701,7 @@ function App(props) {
               return _el$80;
             })(), (() => {
               var _el$81 = createElement("text");
-              insert(_el$81, (() => {
-                var _c$0 = memo2(() => !!props.backend.demo);
-                return () => _c$0() ? "The real flow checks the write, flush and safe removal." : catalog()?.candidate ? "GitHub ZIP, compressed image and raw stream verified. Not a device read-back." : "Compressed image and raw stream verified. Not a device read-back.";
-              })());
+              insert(_el$81, () => props.backend.demo ? "The real flow checks the write, flush and safe removal." : "Compressed image and raw stream verified. Not a device read-back.");
               effect((_$p) => setProp(_el$81, "fg", palette.muted, _$p));
               return _el$81;
             })(), (() => {
@@ -4793,8 +4750,8 @@ function App(props) {
     setProp(_el$87, "flexShrink", 0);
     setProp(_el$87, "wrapMode", "none");
     insert(_el$87, (() => {
-      var _c$1 = memo2(() => !!busy());
-      return () => _c$1() ? "Esc cancel / Q stop & quit" : dimensions().width < 56 ? "Arrows / Enter / Esc / R / Q quit" : "Arrows / Enter / Esc back / R refresh / Q quit";
+      var _c$0 = memo2(() => !!busy());
+      return () => _c$0() ? "Esc cancel / Q stop & quit" : dimensions().width < 56 ? "Arrows / Enter / Esc / R / Q quit" : "Arrows / Enter / Esc back / R refresh / Q quit";
     })());
     effect((_p$) => {
       var _v$36 = palette.background, _v$37 = dimensions().width <= 80 ? "100%" : 80, _v$38 = dimensions().height <= 24 ? "100%" : 24, _v$39 = palette.border, _v$40 = palette.card, _v$41 = palette.accent, _v$42 = TextAttributes2.BOLD, _v$43 = props.backend.demo ? palette.warning : palette.muted, _v$44 = palette.danger, _v$45 = tight() ? 0 : 1, _v$46 = tight() ? 0 : 1, _v$47 = tight() || (compact() || dimensions().width < 56) && screen() === "setup" ? 0 : 1, _v$48 = palette.muted;
@@ -4835,8 +4792,8 @@ function App(props) {
 var args = process.argv.slice(2);
 var demo = args.includes("--demo");
 var fixture = args.find((arg) => arg.startsWith("--demo="))?.slice(7);
-if (args.length > 1 || args.some((arg) => !["--demo", "--demo=empty", "--demo=error", "--demo=setup", "--demo=setup-gh", "--demo=setup-zstd", "--demo=setup-error", "--demo=setup-interrupted", "--demo=no-homebrew", "--list-images", "--clear-cache"].includes(arg))) {
-  console.error("Usage: bun start [--demo[=empty|error|setup|setup-gh|setup-zstd|setup-error|setup-interrupted|no-homebrew] | --list-images | --clear-cache]");
+if (args.length > 1 || args.some((arg) => !["--demo", "--demo=empty", "--demo=error", "--demo=setup", "--demo=setup-zstd", "--demo=setup-error", "--demo=setup-interrupted", "--demo=no-homebrew", "--list-images", "--clear-cache"].includes(arg))) {
+  console.error("Usage: bun start [--demo[=empty|error|setup|setup-zstd|setup-error|setup-interrupted|no-homebrew] | --list-images | --clear-cache]");
   process.exitCode = 1;
 } else if (args.includes("--clear-cache")) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boo-flash",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Flash qualified Boo images to USB drives on macOS and Linux",
   "license": "MIT",
   "type": "module",