dshm-compat 0.1.3 → 0.1.5

package/index.js

@@ -14,7 +14,10 @@ import { runDoctor } from './lib/doctor.js'
 import { probeGuest, provisionGuest } from './lib/guest.js'
 import { enqueueInstall } from './lib/install.js'
 import { installLocalTarball, isLocalSpec } from './lib/local-install.js'
+import { uninstallLocalPackage } from './lib/uninstall.js'
 import { buildPlan } from './lib/plan.js'
+import { callSidecar, listSidecars, probeSidecar, stageSidecar } from './lib/sidecar.js'
+import { buildSource } from './lib/source-build.js'
 import { recordInstall, recordReport, status } from './lib/state.js'
 
 export const name = 'dshm-compat'
@@ -152,7 +155,7 @@ export function apply(ctx) {
         profileDir: { type: 'string', description: 'Absolute DSHM profile directory for install:true. Omit to let the host choose.' },
         confirm: { type: 'boolean', description: 'Required when install is true. Confirms that installing the converted package runs third-party code.' },
         vendor: { type: 'boolean', description: 'Vendor missing pure-JS runtime dependencies into the tarball. Default true.' },
-        workerPath: { type: 'string', description: 'Absolute path to a prebuilt AArch64 Linux worker for recipes that need one (currently dsh-ops). Omit to receive the build command instead.' },
+        workerPath: { type: 'string', description: 'Absolute path to a prebuilt AArch64 Linux worker for an S2 plugin. Omit to let the generic adapter return the build command.' },
         allowLocal: { type: 'boolean', description: 'When install is true, unpack the converted tarball into the profile instead of the host queue. Default true; set false to force the queue.' },
       },
       required: ['spec'],
@@ -232,6 +235,106 @@ export function apply(ctx) {
     },
   ), 'compat_guest_provision')
 
+  register(definition(
+    'compat_sidecar',
+    'Stage and call a native Linux/AArch64 worker in the DSHM Alpine guest. Actions: stage (extract a worker from a converted tarball into $DSH_HOME/dshm-compat/sidecars/<id>), list, probe (run --version), call (one JSON request on stdin, one JSON value on stdout; requires confirm:true). '
+      + 'This is the generic S2 bridge; the worker runs through bash -c and is routed to the guest by dshm-vm-bash.',
+    {
+      type: 'object',
+      properties: {
+        action: { type: 'string', enum: ['stage', 'list', 'probe', 'call'] },
+        id: { type: 'string', description: 'Sidecar id (letters, digits, dot, underscore, dash).' },
+        tarball: { type: 'string', description: 'Converted package tarball containing the worker.' },
+        workerPath: { type: 'string', description: 'Worker path inside the tarball, e.g. runtime/linux-arm64/<worker>.' },
+        input: { type: 'object', additionalProperties: true, description: 'JSON request for action=call. Default {}.' },
+        timeoutMs: { type: 'integer', description: 'Per-call timeout. Default 120000.' },
+        confirm: { type: 'boolean', description: 'Required for action=call: confirms that the worker runs native code in the guest.' },
+      },
+      required: ['action'],
+      additionalProperties: false,
+    },
+    async (args, exec) => {
+      try {
+        if (args?.action === 'stage') {
+          if (typeof args.tarball !== 'string' || typeof args.workerPath !== 'string') {
+            return { status: 'error', error: { code: 'INVALID_ARGUMENT', message: 'stage requires tarball and workerPath' } }
+          }
+          const result = stageSidecar(args.tarball, args.workerPath, { id: args.id })
+          return result.ok ? { status: 'ok', ...result } : { status: 'error', ...result }
+        }
+        if (args?.action === 'list') return { status: 'ok', sidecars: listSidecars() }
+        if (args?.action === 'probe') {
+          if (typeof args.id !== 'string') return { status: 'error', error: { code: 'INVALID_ARGUMENT', message: 'probe requires id' } }
+          return { status: 'ok', ...(await probeSidecar(ctx, args.id, { timeoutMs: args.timeoutMs, signal: exec?.signal })) }
+        }
+        if (args?.action === 'call') {
+          if (typeof args.id !== 'string') return { status: 'error', error: { code: 'INVALID_ARGUMENT', message: 'call requires id' } }
+          if (args.confirm !== true) return { status: 'confirmation-required', message: 'Re-run with confirm:true to execute the worker in the guest.' }
+          return { status: 'ok', ...(await callSidecar(ctx, args.id, args.input ?? {}, { timeoutMs: args.timeoutMs, signal: exec?.signal })) }
+        }
+        return { status: 'error', error: { code: 'INVALID_ACTION', message: `unknown sidecar action: ${String(args?.action)}` } }
+      } catch (error) {
+        return errorResult(error)
+      }
+    },
+  ), 'compat_sidecar')
+
+  register(definition(
+    'compat_build',
+    'Plan or attempt a source build. backend:"plan" returns the exact PC/CI commands; backend:"guest" provisions Node/Rust in the Alpine guest and tries the build there (slow, needs guest network/disk; requires confirm:true). Returns the artifact path on success.',
+    {
+      type: 'object',
+      properties: {
+        spec: { type: 'string', description: 'Source package: npm name, GitHub URL, or local .tgz.' },
+        backend: { type: 'string', enum: ['plan', 'guest'], description: 'plan (default) or guest.' },
+        timeoutMs: { type: 'integer', description: 'Guest build timeout. Default 30 minutes.' },
+        confirm: { type: 'boolean', description: 'Required for backend:"guest". Confirms provisioning a toolchain and running build scripts in the guest.' },
+      },
+      required: ['spec'],
+      additionalProperties: false,
+    },
+    async (args, exec) => {
+      try {
+        if (args?.backend === 'guest' && args.confirm !== true) {
+          return { status: 'confirmation-required', message: 'Re-run with confirm:true to provision a toolchain and run source build scripts in the guest.' }
+        }
+        return await buildSource(ctx, args.spec, {
+          backend: args.backend === 'guest' ? 'guest' : 'plan',
+          timeoutMs: args.timeoutMs,
+          signal: exec?.signal,
+        })
+      } catch (error) {
+        return errorResult(error)
+      }
+    },
+  ), 'compat_build')
+
+  register(definition(
+    'compat_uninstall',
+    'Remove a profile-local plugin: delete profiles/<profile>/node_modules/<name>, remove its dependency entry, and remove it from dsh.profile.bundles. Requires confirm:true and a DSHM restart.',
+    {
+      type: 'object',
+      properties: {
+        name: { type: 'string', description: 'Installed package name, e.g. @scope/plugin.' },
+        profileDir: { type: 'string', description: 'Absolute DSHM profile directory. Omit to infer it.' },
+        confirm: { type: 'boolean', description: 'Must be true. Confirms removing the package from the profile.' },
+      },
+      required: ['name', 'confirm'],
+      additionalProperties: false,
+    },
+    async args => {
+      if (args?.confirm !== true) {
+        return { status: 'confirmation-required', message: 'Re-run with confirm:true to remove the package from the profile.' }
+      }
+      try {
+        const result = uninstallLocalPackage(args.name, { profileDir: args.profileDir })
+        return result.ok ? { status: 'ok', ...result } : { status: 'error', ...result }
+      } catch (error) {
+        return errorResult(error)
+      }
+    },
+  ), 'compat_uninstall')
+
   register(definition(
     'compat_install',
     'Install an already-built plugin artifact. Local .tgz paths (or file:/link: paths) are unpacked into the owning DSH profile and its bundle list, because DSHM\'s host queue rejects local specs; npm names and GitHub repositories still go through the host install queue. '

package/lib/analyze.js

@@ -245,10 +245,11 @@ export async function analyze(spec, options = {}) {
     confidence = 'high'
     reasons.push('the archive carries only win32 payloads and no C/C++/Rust source to rebuild')
     next.push('ask the plugin author for source or a linux-arm64 build')
-  } else if (nativeFiles.length > 0 || unknownNativeDeps.length > 0 || electronSurface) {
+  } else if (nativeFiles.length > 0 || unknownNativeDeps.length > 0 || electronSurface || hasNativeSource) {
     strategy = 'S2'
     confidence = 'medium'
     if (nativeFiles.length > 0) reasons.push(`${nativeFiles.length} native file(s) need a linux-arm64 runtime outside the DSHM host process`)
+    if (hasNativeSource && nativeFiles.length === 0) reasons.push('native source needs a Linux/guest build; no prebuilt runtime is present')
     if (unknownNativeDeps.length > 0) reasons.push(`unrecognized native dependencies: ${unknownNativeDeps.map(dep => dep.name).join(', ')}`)
     if (Object.keys(installScripts).length > 0) reasons.push(`install scripts: ${Object.keys(installScripts).join(', ')}`)
     if (electronSurface) reasons.push(`Electron API surface detected (${scan.electron} reference(s)); needs a shim or a sidecar UI`)
@@ -328,6 +329,9 @@ export async function analyze(spec, options = {}) {
       description: pkg.description,
       type: pkg.type,
       main: pkg.main,
+      repository: pkg.repository,
+      homepage: pkg.homepage,
+      bugs: pkg.bugs,
       os: pkg.os,
       cpu: pkg.cpu,
       scripts,
@@ -360,6 +364,10 @@ export async function analyze(spec, options = {}) {
       },
       nativeDeps,
       unknownNativeDeps: unknownNativeDeps.map(dep => dep.name),
+      nativeSource: hasNativeSource,
+      rustSource: files.some(file => /(?:^|\/)Cargo\.toml$/.test(file.path) || /\.rs$/.test(file.path)),
+      cSource: files.some(file => /\.(?:c|cc|cpp)$/.test(file.path)),
+      nodeGyp: files.some(file => /(?:^|\/)binding\.gyp$/.test(file.path)),
       dependencies: {
         core: dependencyCheck.core,
         present: dependencyCheck.present.slice(0, 100),

package/lib/convert.js

@@ -41,20 +41,69 @@ function safeName(name) {
   return String(name).replace(/^@/, '').replace(/[\\/]/g, '-').replace(/[^A-Za-z0-9._-]/g, '_')
 }
 
+/**
+ * A GitHub source checkout may have no built `main`. Prefer the package's
+ * published npm build instead of stopping at needs-build; this is generic and
+ * keeps the source version only when the registry has nothing newer/built.
+ *
+ * @param {any} report
+ * @param {any} options
+ */
+async function registryFallback(report, options) {
+  const name = report.package?.name
+  if (typeof name !== 'string' || name === '' || options.registryFallback === true) return undefined
+  let resolved
+  try {
+    resolved = await resolveSpec(`${name}@latest`, { registry: options.registry, signal: options.signal })
+  } catch {
+    return undefined
+  }
+  const version = typeof resolved.version === 'string' ? resolved.version : undefined
+  if (version === undefined || version === report.package.version) return undefined
+  let fallbackReport
+  try {
+    fallbackReport = await analyze(`${name}@latest`, { textScan: false, signal: options.signal, registry: options.registry })
+  } catch {
+    return undefined
+  }
+  if (fallbackReport.strategy !== 'S2') return undefined
+  const { convertS2Native } = await import('./s2-native.js')
+  const converted = await convertS2Native(`${name}@latest`, {
+    report: fallbackReport,
+    workerPath: options.workerPath,
+    workerBinary: options.workerBinary,
+    workerName: options.workerName,
+    signal: options.signal,
+    registryFallback: true,
+  })
+  if (converted.status !== 'ok') return undefined
+  return {
+    ...converted,
+    fallback: { from: report.spec, to: `${name}@${version}`, version },
+    changed: [...(converted.changed ?? []), `replaced source checkout with published ${name}@${version}`],
+  }
+}
+
 /**
  * @param {string} spec
- * @param {{ report?: any, registry?: string, signal?: AbortSignal, maxBytes?: number }} [options]
+ * @param {{ report?: any, registry?: string, signal?: AbortSignal, maxBytes?: number, workerPath?: string, workerBinary?: Buffer, workerName?: string, registryFallback?: boolean }} [options]
  */
 export async function convert(spec, options = {}) {
   const report = options.report ?? await analyze(spec, { textScan: false, signal: options.signal, registry: options.registry })
-  if (report.package?.name === 'dsh-ops' && report.rule?.nativeBuild?.language === 'rust') {
-    const { convertDshOps } = await import('./recipes/dsh-ops.js')
-    return await convertDshOps(spec, {
+  if (report.strategy === 'S2') {
+    const { convertS2Native } = await import('./s2-native.js')
+    const result = await convertS2Native(spec, {
       report,
       workerPath: options.workerPath,
       workerBinary: options.workerBinary,
+      workerName: options.workerName,
       signal: options.signal,
     })
+    if (result.status === 'needs-build' && result.sourcePackage === true) {
+      const fallback = await registryFallback(report, options)
+      if (fallback !== undefined) return fallback
+    }
+    return result
   }
   if (report.strategy !== 'S0' && report.strategy !== 'S1') {
     return {
@@ -96,6 +145,11 @@ export async function convert(spec, options = {}) {
 
   if (pkg.os !== undefined) { delete pkg.os; changed.push('removed package.json os gate') }
   if (pkg.cpu !== undefined) { delete pkg.cpu; changed.push('removed package.json cpu gate') }
+  if (pkg.engines !== null && typeof pkg.engines === 'object' && !Array.isArray(pkg.engines) && pkg.engines.dsh !== undefined) {
+    delete pkg.engines.dsh
+    if (Object.keys(pkg.engines).length === 0) delete pkg.engines
+    changed.push('removed engines.dsh gate')
+  }
   if (pkg.scripts !== null && typeof pkg.scripts === 'object' && !Array.isArray(pkg.scripts)) {
     for (const name of ['preinstall', 'install', 'postinstall', 'prepare']) {
       if (typeof pkg.scripts[name] === 'string') { delete pkg.scripts[name]; changed.push(`removed scripts.${name}`) }

package/lib/elf.js

@@ -0,0 +1,41 @@
+/**
+ * Minimal AArch64 ELF checks shared by the generic S2 adapter and the generic
+ * sidecar staging path.
+ *
+ * @module dshm-compat/elf
+ */
+
+/** @param {Buffer} buffer */
+export function isAarch64Elf(buffer) {
+  return buffer.length >= 64
+    && buffer[0] === 0x7f && buffer[1] === 0x45 && buffer[2] === 0x4c && buffer[3] === 0x46
+    && buffer[4] === 2 && buffer[5] === 1
+    && buffer.readUInt16LE(18) === 183
+}
+
+/** @param {Buffer} buffer */
+export function isX64Elf(buffer) {
+  return buffer.length >= 64
+    && buffer[0] === 0x7f && buffer[1] === 0x45 && buffer[2] === 0x4c && buffer[3] === 0x46
+    && buffer[4] === 2 && buffer[5] === 1
+    && buffer.readUInt16LE(18) === 62
+}
+
+/** @param {Buffer} buffer @returns {'arm64'|'x64'|undefined} */
+export function elfArch(buffer) {
+  if (isAarch64Elf(buffer)) return 'arm64'
+  if (isX64Elf(buffer)) return 'x64'
+  return undefined
+}
+
+/** @param {Buffer} buffer */
+export function elfSummary(buffer) {
+  if (!isAarch64Elf(buffer)) return undefined
+  return {
+    class: 64,
+    endian: 'little',
+    machine: 'AArch64',
+    type: buffer.readUInt16LE(16) === 3 ? 'DYN' : buffer.readUInt16LE(16) === 2 ? 'EXEC' : String(buffer.readUInt16LE(16)),
+    bytes: buffer.length,
+  }
+}

package/lib/guest.js

@@ -8,6 +8,8 @@
  *
  * @module dshm-compat/guest
  */
+import { isAbsolute } from 'node:path'
+
 const PROBE_SCRIPT = [
   'echo DSHM_COMPAT_PROBE_BEGIN',
   'uname -srm 2>/dev/null || true',
@@ -19,7 +21,6 @@ const PROBE_SCRIPT = [
   'command -v python3 || true',
   'echo DSHM_COMPAT_PROBE_END',
 ].join('\n')
-
 /** Packages the provisioning tool may install. */
 export const PROVISION_PACKAGES = Object.freeze([
   'bash',
@@ -29,6 +30,8 @@ export const PROVISION_PACKAGES = Object.freeze([
   'python3',
   'build-base',
   'linux-headers',
+  'rust',
+  'cargo',
   'git',
   'ffmpeg',
 ])
@@ -98,7 +101,7 @@ export async function runGuest(ctx, script, options = {}) {
  * @param {{ timeoutMs?: number, signal?: AbortSignal, cwd?: string }} [options]
  */
 export async function runGuestFile(ctx, file, args = [], input = '', options = {}) {
-  if (typeof file !== 'string' || !file.startsWith('/')) {
+  if (typeof file !== 'string' || !isAbsolute(file)) {
     return { status: 'invalid', reason: 'worker path must be absolute and visible inside the guest' }
   }
   const subprocess = ctx.get('subprocess')
@@ -112,7 +115,7 @@ export async function runGuestFile(ctx, file, args = [], input = '', options = {
   if (options.signal) signals.push(options.signal)
   try {
     const handle = subprocess.spawn({
-      argv: ['bash', '-c', 'exec "$0" "$@"', file, ...args.map(String)],
+      argv: ['bash', file, ...args.map(String)],
       cwd: options.cwd ?? '/',
       stdio: {
         ...(input !== '' ? { stdin: { data: input } } : {}),

package/lib/plan.js

@@ -18,6 +18,16 @@ function record(value) {
 function nativeBuildOf(report) {
   const rule = record(report.rule)
   if (record(rule?.nativeBuild) !== undefined) return rule.nativeBuild
+  const signals = record(report.signals) ?? {}
+  if (signals.nodeGyp === true) {
+    return { language: 'node-gyp', target: 'aarch64-unknown-linux-musl', notes: 'build in the Alpine guest with build-base and python3' }
+  }
+  if (signals.rustSource === true) {
+    return { language: 'rust', target: 'aarch64-unknown-linux-musl' }
+  }
+  if (signals.cSource === true) {
+    return { language: 'c/c++', target: 'aarch64-unknown-linux-musl', notes: 'build in the Alpine guest' }
+  }
   const native = Array.isArray(report.files?.native) ? report.files.native : []
   if (native.some(file => typeof file.path === 'string' && file.path.endsWith('binding.gyp'))) {
     return { language: 'node-gyp', target: 'aarch64-unknown-linux-musl', notes: 'build in the Alpine guest with build-base and python3' }

package/lib/release.js

@@ -0,0 +1,185 @@
+/**
+ * Generic GitHub Release worker acquisition.
+ *
+ * Some native plugins do not ship a runtime in their npm tarball but publish
+ * per-platform workers as release assets. This module finds a Linux asset,
+ * extracts it, and returns the first AArch64/x86_64 ELF. It is repository
+ * agnostic; no package name is special-cased.
+ *
+ * @module dshm-compat/release
+ */
+import { createHash } from 'node:crypto'
+import { basename } from 'node:path'
+import { elfArch } from './elf.js'
+import { downloadBuffer } from './fetch.js'
+import { extractTar } from './tar.js'
+import { extractZip } from './zip.js'
+
+const API = 'https://api.github.com'
+
+/** @param {any} report */
+export function githubRepo(report) {
+  if (report?.resolved?.kind === 'github' && typeof report.resolved.name === 'string') {
+    const [owner, repo] = report.resolved.name.split('/')
+    if (owner && repo) return { owner, repo }
+  }
+  const repository = report?.package?.repository
+  const candidates = [
+    typeof repository === 'string' ? repository : repository?.url,
+    typeof report?.package?.homepage === 'string' ? report.package.homepage : undefined,
+    typeof report?.package?.bugs === 'string' ? report.package.bugs : report?.package?.bugs?.url,
+  ].filter(value => typeof value === 'string')
+  for (const url of candidates) {
+    const match = url.match(/github\.com[/:]([^/]+)\/([^/#?]+)/i)
+    if (match) return { owner: match[1], repo: match[2].replace(/\.git$/i, '') }
+  }
+  const tarball = report?.resolved?.tarballUrl
+  if (typeof tarball === 'string') {
+    const match = tarball.match(/api\.github\.com\/repos\/([^/]+)\/([^/]+)/i)
+    if (match) return { owner: match[1], repo: match[2] }
+  }
+  return undefined
+}
+
+/** @param {string} url @param {AbortSignal} [signal] */
+async function fetchJson(url, signal) {
+  const timeout = AbortSignal.timeout(20000)
+  const combined = signal === undefined ? timeout : AbortSignal.any([signal, timeout])
+  const response = await fetch(url, {
+    signal: combined,
+    headers: { accept: 'application/vnd.github+json', 'user-agent': 'dshm-compat' },
+  })
+  if (!response.ok) throw new Error(`GitHub API ${response.status} for ${url}`)
+  return await response.json()
+}
+
+/** @param {string} owner @param {string} repo @param {string|undefined} version @param {AbortSignal} [signal] */
+async function releaseAssets(owner, repo, version, signal) {
+  if (typeof version === 'string' && version !== '') {
+    for (const tag of [`v${version}`, version]) {
+      try {
+        const tagged = await fetchJson(`${API}/repos/${owner}/${repo}/releases/tags/${encodeURIComponent(tag)}`, signal)
+        if (Array.isArray(tagged?.assets) && tagged.assets.length > 0) return tagged.assets
+      } catch { /* try the next tag, then the latest release */ }
+    }
+  }
+  try {
+    const latest = await fetchJson(`${API}/repos/${owner}/${repo}/releases/latest`, signal)
+    if (Array.isArray(latest?.assets) && latest.assets.length > 0) return latest.assets
+  } catch { /* fall through to the list endpoint */ }
+  const releases = await fetchJson(`${API}/repos/${owner}/${repo}/releases?per_page=5`, signal)
+  /** @type {any[]} */
+  const assets = []
+  for (const release of Array.isArray(releases) ? releases : []) {
+    if (Array.isArray(release?.assets)) assets.push(...release.assets)
+  }
+  return assets
+}
+
+/** @param {any} asset */
+function assetRank(asset) {
+  const name = String(asset?.name ?? '').toLowerCase()
+  if (!/\.(?:zip|tgz|tar\.gz)$/.test(name)) return undefined
+  if (/win32|windows|darwin|macos|source|checksum|sha256/.test(name)) return undefined
+  if (!/linux|musl/.test(name)) return undefined
+  if (/aarch64|arm64/.test(name)) return 0
+  if (/x86_64|amd64|x64/.test(name)) return 1
+  return undefined
+}
+
+/** @param {Buffer} archive @param {string} name */
+function archiveEntries(archive, name) {
+  if (/\.zip$/i.test(name)) return extractZip(archive)
+  return extractTar(archive).entries
+    .filter(entry => entry.type === 'file')
+    .map(entry => ({ path: entry.path, data: entry.data }))
+}
+
+/**
+ * @param {any} report
+ * @param {{ signal?: AbortSignal }} [options]
+ * @returns {Promise<
+ *   | { ok: true, buffer: Buffer, name: string, arch: 'arm64'|'x64', asset: string, sha256: string, attempts: any[] }
+ *   | { ok: false, reason: string, attempts: any[] }
+ * >}
+ */
+export async function findReleaseWorker(report, options = {}) {
+  const attempts = []
+  const repo = githubRepo(report)
+  if (repo === undefined) return { ok: false, reason: 'no GitHub repository in the package metadata', attempts }
+
+  let assets
+  try {
+    assets = await releaseAssets(repo.owner, repo.repo, report?.package?.version ?? report?.resolved?.version, options.signal)
+  } catch (error) {
+    return { ok: false, reason: `GitHub release lookup failed: ${String(error?.message ?? error)}`, attempts }
+  }
+  const ranked = assets
+    .map(asset => ({ asset, rank: assetRank(asset) }))
+    .filter(item => item.rank !== undefined)
+    .sort((a, b) => a.rank - b.rank)
+  if (ranked.length === 0) return { ok: false, reason: 'no Linux worker asset in the latest releases', attempts }
+
+  for (const { asset } of ranked) {
+    if (Number(asset.size ?? 0) > 64 * 1024 * 1024) {
+      attempts.push({ asset: asset.name, stage: 'size', error: `asset is larger than 64 MiB` })
+      continue
+    }
+    const urls = [asset.browser_download_url]
+    if (asset.id !== undefined) urls.push(`${API}/repos/${repo.owner}/${repo.repo}/releases/assets/${asset.id}`)
+    let archive
+    let downloadedUrl
+    for (const url of urls) {
+      if (typeof url !== 'string') continue
+      try {
+        archive = await downloadBuffer(url, {
+          maxBytes: 64 * 1024 * 1024,
+          signal: options.signal,
+          headers: url.includes('/releases/assets/') ? { accept: 'application/octet-stream' } : {},
+        })
+        downloadedUrl = url
+        attempts.push({ asset: asset.name, url, stage: 'download', ok: true })
+        break
+      } catch (error) {
+        attempts.push({ asset: asset.name, url, stage: 'download', error: String(error?.message ?? error) })
+      }
+    }
+    if (archive === undefined || downloadedUrl === undefined) continue
+
+    const digestMatch = typeof asset.digest === 'string' ? asset.digest.match(/^sha256:([a-f0-9]{64})$/i) : null
+    if (digestMatch !== null) {
+      const actual = createHash('sha256').update(archive).digest('hex')
+      if (actual !== digestMatch[1].toLowerCase()) {
+        attempts.push({ asset: asset.name, stage: 'sha256', error: `expected ${digestMatch[1]}, got ${actual}` })
+        continue
+      }
+    }
+
+    let entries
+    try {
+      entries = archiveEntries(archive, asset.name)
+    } catch (error) {
+      attempts.push({ asset: asset.name, stage: 'extract', error: String(error?.message ?? error) })
+      continue
+    }
+    const candidates = entries
+      .filter(entry => elfArch(entry.data) !== undefined)
+      .sort((a, b) => b.data.length - a.data.length)
+    if (candidates.length === 0) {
+      attempts.push({ asset: asset.name, stage: 'worker', error: 'archive contains no AArch64/x86_64 ELF' })
+      continue
+    }
+    const worker = candidates[0]
+    attempts.push({ asset: asset.name, url: downloadedUrl, stage: 'worker', ok: true })
+    return {
+      ok: true,
+      buffer: worker.data,
+      name: basename(worker.path),
+      arch: elfArch(worker.data),
+      asset: asset.name,
+      sha256: createHash('sha256').update(worker.data).digest('hex'),
+      attempts,
+    }
+  }
+  return { ok: false, reason: 'no usable Linux worker asset could be downloaded', attempts }
+}

package/lib/rules.js

@@ -1,9 +1,11 @@
 /**
- * Compatibility rules for known packages.
+ * Custom compatibility rules.
  *
- * Heuristics classify unknown packages. A rule is for a package whose exact
- * blocker and conversion recipe are already known; it wins over the heuristic
- * and carries the build/run instructions the converter cannot infer.
+ * Heuristics classify unknown packages. A rule is an operator-supplied hint for
+ * a package whose exact blocker and conversion recipe are already known; it wins
+ * over the heuristic and carries build/run instructions the converter cannot
+ * infer. Built-in per-package rules are intentionally absent: adaptation lives
+ * in the generic engines, not in a package-name branch.
  *
  * A deployment can add rules in
  * `$DSH_HOME/dshm-compat/registry.json`:
@@ -28,24 +30,7 @@ import { compatDir } from './state.js'
  */
 
 /** @type {Record<string, PackageRule>} */
-export const PACKAGE_RULES = {
-  'dsh-ops': {
-    strategy: 'S2',
-    reason: 'the plugin is a Rust worker executable; the published package carries only win32-x64, linux-x64 and darwin-arm64 payloads',
-    next: [
-      'cross-build native/ for aarch64-unknown-linux-musl',
-      'run dsh-ops-worker in the Alpine guest and proxy the ops_* tools over RPC',
-      'rewrite PLATFORMS, package.json os/cpu and dsh-plugin.json targets for linux-arm64',
-    ],
-    nativeBuild: {
-      language: 'rust',
-      target: 'aarch64-unknown-linux-musl',
-      crate: 'native/Cargo.toml',
-      binary: 'dsh-ops-worker',
-      notes: 'the crate is portable; windows/darwin metadata crates are target-gated',
-    },
-  },
-}
+export const PACKAGE_RULES = {}
 
 const STRATEGIES = new Set(['S0', 'S1', 'S2', 'S3', 'S4'])