gentle-pi 3.7.0 → 4.1.0

package/scripts/bootstrap.sh

@@ -0,0 +1,168 @@
+#!/bin/sh
+# Run from an extracted/checkout bundle, not from a remote pipe.
+# Only prerequisite tooling is acquired here; standard installation belongs to T4.
+set -eu
+umask 077
+fail() { printf '%s\n' "Bootstrap: $1" >&2; exit 1; }
+need() { command -v "$1" >/dev/null 2>&1 || fail "Required utility missing: $1"; }
+for utility in dirname awk; do need "$utility"; done
+bundle=$(CDPATH= cd -P "$(dirname "$0")/.." && pwd) || fail 'Cannot locate installation bundle'
+entry=$bundle/bin/gentle-shell-install.mjs
+[ -f "$entry" ] && [ ! -L "$entry" ] || fail 'Future wizard entry is missing; this bundle cannot start a live wizard'
+[ -f "$bundle/scripts/installer-downloads.mjs" ] || fail 'Download helper missing from bundle'
+for utility in uname mkdir mktemp chmod mv rm sleep wc id ls; do need "$utility"; done
+case ${HOME:-} in /*) ;; *) fail 'HOME must be an absolute per-user directory';; esac
+# Refuse symlink ancestors and group/world-writable acquisition parents.
+check_home=$HOME
+while [ "$check_home" != / ]; do
+    [ ! -L "$check_home" ] || fail 'Unsafe symlink in HOME path'
+    check_home=$(dirname "$check_home")
+done
+[ -d "$HOME" ] || fail 'HOME directory is missing'
+uid=$(id -u)
+ls -nd "$HOME" | awk -v uid="$uid" '$3 == uid && substr($1,6,1) != "w" && substr($1,9,1) != "w" {ok=1} END {exit !ok}' || fail 'Unsafe HOME ownership or permissions'
+minimum=$(awk -F '"' '{for (i=2; i<=NF-2; i+=2) if ($i == "node" && $(i+2) ~ /^>=[0-9]+\.[0-9]+\.[0-9]+$/) {value=$(i+2); sub(/^>=/, "", value); count++}} END {if (count == 1) print value}' "$bundle/package.json")
+[ -n "$minimum" ] || fail 'Cannot establish repository Node minimum'
+version_ok() {
+    awk -v value="$1" -v minimum="$2" 'BEGIN {
+        sub(/^v/, "", value)
+        if (value !~ /^[0-9]+\.[0-9]+\.[0-9]+$/) exit 1
+        split(value, a, "."); split(minimum, b, ".")
+        for (i=1; i<=3; i++) if (length(a[i]) > 9 || (length(a[i]) > 1 && substr(a[i],1,1) == "0")) exit 1
+        for (i=1; i<=3; i++) {
+            if (a[i]+0 > b[i]+0) exit 0
+            if (a[i]+0 < b[i]+0) exit 1
+        }
+    }'
+}
+# Any stable version at all: version_ok against 0.0.0 accepts exactly those.
+stable_version() { version_ok "$1" 0.0.0; }
+# A stock POSIX watchdog avoids assuming GNU timeout on macOS.
+# These fixed prerequisite probes get an unignorable deadline, not graceful TERM.
+# Signal only our direct child PID; do not kill inherited process groups.
+bounded() {
+    seconds=$1
+    shift
+    "$@" &
+    version_pid=$!
+    (
+        sleep "$seconds" &
+        sleeper=$!
+        trap 'kill -s KILL "$sleeper" 2>/dev/null || :; wait "$sleeper" 2>/dev/null || :; exit 0' TERM
+        wait "$sleeper" || :
+        kill -s KILL "$version_pid" 2>/dev/null || :
+    ) >/dev/null 2>&1 &
+    watchdog=$!
+    result=0
+    wait "$version_pid" || result=$?
+    kill "$watchdog" 2>/dev/null || :
+    wait "$watchdog" 2>/dev/null || :
+    return "$result"
+}
+tools=
+owned=0
+# Only the exact directory this attempt claimed; rm -rf never follows links in it.
+owned_tools() {
+    [ "$owned" = 1 ] && [ -n "$tools" ] || return 1
+    case "$tools" in "$HOME"/.gentle-shell-bootstrap-tools.*/*) return 1;; "$HOME"/.gentle-shell-bootstrap-tools.*) ;; *) return 1;; esac
+    [ -d "$tools" ] && [ ! -L "$tools" ] && [ -d "$tools/.claim" ] && [ ! -L "$tools/.claim" ]
+}
+cleanup() {
+    if owned_tools; then
+        rm -rf "$tools"
+    fi
+}
+trap cleanup EXIT
+trap 'exit 1' HUP INT TERM
+make_tools() {
+    tools=$(mktemp -d "$HOME/.gentle-shell-bootstrap-tools.XXXXXXXX") || fail 'Cannot create private tooling directory'
+    case "$tools" in "$HOME"/.gentle-shell-bootstrap-tools.*) ;; *) fail 'Conflicting tooling destination';; esac
+    [ -d "$tools" ] && [ ! -L "$tools" ] || fail 'Unsafe tooling destination'
+    ls -nd "$tools" | awk -v uid="$uid" '$3 == uid && $1 == "drwx------" {ok=1} END {exit !ok}' || fail 'Unsafe tooling ownership'
+    # No existing destination is ever reused or replaced.
+    mkdir "$tools/.claim" || fail 'Conflicting tooling destination'
+    owned=1
+    printf '%s\n' 'gentle-pi prerequisite tooling only' > "$tools/.bootstrap-owned" || fail 'Cannot mark tooling ownership'
+}
+acquire_node=1
+if command -v node >/dev/null 2>&1; then
+    node=$(command -v node)
+    version=$(bounded 10 "$node" --version 2>/dev/null) || fail 'Existing Node version probe failed'
+    if version_ok "$version" "$minimum"; then acquire_node=0
+    # An older stable Node is left as it is: the verified Node below runs the
+    # installer instead, exactly as when Node is absent.
+    elif ! stable_version "$version"; then fail 'Existing Node is incompatible or unknown; refusing replacement'; fi
+fi
+if [ "$acquire_node" = 1 ]; then
+    os=$(uname -s)
+    arch=$(uname -m)
+    case "$os" in Darwin) os=darwin;; Linux) os=linux;; *) fail 'Unsupported POSIX platform';; esac
+    case "$arch" in x86_64|amd64) arch=x64;; aarch64|arm64) arch=arm64;; *) fail 'Unsupported architecture';; esac
+    if [ "$os" = linux ]; then
+        need getconf
+        libc=$(getconf GNU_LIBC_VERSION 2>/dev/null) || fail 'Cannot establish native glibc compatibility; musl is not supported'
+        case "$libc" in 'glibc '*) ;; *) fail 'Unsupported libc; only native glibc acquisition is planned';; esac
+        version_ok "${libc#glibc }.0" '2.28.0' || fail 'Native Node requires glibc >=2.28; musl is not supported'
+    fi
+    # Primary source: https://nodejs.org/dist/latest-v24.x/SHASUMS256.txt
+    # Exact release URLs are fixed, even though the provenance page is moving.
+    case "$os-$arch" in
+        darwin-arm64) hash=bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057;;
+        darwin-x64) hash=1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097;;
+        linux-arm64) hash=724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5;;
+        linux-x64) hash=6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff;;
+    esac
+    need curl
+    need tar
+    if command -v sha256sum >/dev/null 2>&1; then hasher=sha256sum
+    elif command -v shasum >/dev/null 2>&1; then hasher=shasum
+    else fail 'Required SHA256 utility missing: sha256sum or shasum'; fi
+    make_tools
+    stem=node-v24.21.0-$os-$arch
+    archive=$tools/node.tar.gz
+    # Also bound disk use on older curl versions lacking streamed-size enforcement.
+    # POSIX uses 512-byte blocks; shells using KiB still impose a 200-MiB ceiling.
+    (
+        ulimit -f 204800 || exit 1
+        curl --fail --silent --show-error --proto '=https' --tlsv1.2 --connect-timeout 10 --max-time 120 --max-filesize 104857600 --output "$archive" "https://nodejs.org/dist/v24.21.0/$stem.tar.gz"
+    ) 2>/dev/null || fail 'Node download failed, was truncated, or its file-size bound is unavailable'
+    size=$(wc -c < "$archive")
+    [ "$size" -gt 0 ] && [ "$size" -le 104857600 ] || fail 'Node download size is invalid'
+    if [ "$hasher" = sha256sum ]; then actual=$(bounded 30 sha256sum "$archive" 2>/dev/null) || fail 'SHA256 process failed'
+    else actual=$(bounded 30 shasum -a 256 "$archive" 2>/dev/null) || fail 'SHA256 process failed'; fi
+    actual=${actual%% *}
+    # Hash tools prefix escaped filenames (e.g. newline/backslash) with a backslash.
+    actual=${actual#\\}
+    [ "$actual" = "$hash" ] || fail 'Node checksum integrity mismatch'
+    mkdir "$tools/staging" || fail 'Conflicting staging destination'
+    # Extract only the trusted regular executable, not npm/Corepack or archive links.
+    member=$stem/bin/node
+    listing=$(bounded 30 tar -tvzf "$archive" "$member" 2>/dev/null) || fail 'Node archive is invalid'
+    case "$listing" in -*) ;; *) fail 'Node archive executable is not a regular file';; esac
+    bounded 30 tar -xzf "$archive" -C "$tools/staging" "$member" 2>/dev/null || fail 'Node extraction failed'
+    candidate=$tools/staging/$member
+    [ -f "$candidate" ] && [ ! -L "$candidate" ] || fail 'Node executable missing or unsafe'
+    version=$(bounded 10 "$candidate" --version 2>/dev/null) || fail 'Acquired Node cannot execute on this native platform'
+    [ "$version" = v24.21.0 ] && version_ok "$version" "$minimum" || fail 'Acquired Node version rejected'
+    bounded 10 chmod 700 "$candidate" 2>/dev/null || fail 'Cannot secure acquired Node executable'
+    [ ! -e "$tools/node" ] && [ ! -L "$tools/node" ] || fail 'Conflicting Node destination'
+    mv "$tools/staging/$stem" "$tools/node" || fail 'Cannot publish verified Node'
+    rm -f "$archive" || fail 'Cannot clean owned Node archive'
+    rm -rf "$tools/staging" || fail 'Cannot clean owned Node staging'
+    node=$tools/node/bin/node
+    PATH=$tools/node/bin:$PATH
+    export PATH
+fi
+# The helper creates an equally private tooling directory only if pnpm is absent.
+# Do not exec: retain ownership cleanup on any helper/child failure.
+"$node" "$bundle/scripts/installer-downloads.mjs" --bootstrap "$bundle" "$tools" || fail 'Prerequisite acquisition or wizard child failed'
+# Exit 0 means node/npm/pnpm now persist under $PNPM_HOME or were already the
+# user's. A removal problem never turns the completed installation into failure.
+if [ "$owned" = 1 ]; then
+    mark=
+    if owned_tools && [ -f "$tools/.bootstrap-owned" ] && [ ! -L "$tools/.bootstrap-owned" ] &&
+        { IFS= read -r mark < "$tools/.bootstrap-owned"; } 2>/dev/null && [ "$mark" = 'gentle-pi prerequisite tooling only' ] &&
+        rm -rf "$tools" 2>/dev/null; then :
+    else printf '%s\n' "Bootstrap: installation finished, but temporary tools could not be removed: $tools" >&2; fi
+fi
+owned=0

package/scripts/build-distribution.mjs

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+// Release distribution assets (S3, T1b): gentle-pi at the release version and
+// the exact Pi (PI_INSTALL_VERSION), with the pnpm-lock.yaml our pinned pnpm
+// resolves for them, published as two release assets that installVersion
+// installs with --frozen-lockfile. pnpm records every platform's optional
+// packages (ffi-rs, fff-bin, esbuild prebuilds) in the lockfile whatever system
+// resolves it, so one lockfile serves Linux, macOS and Windows.
+//
+//   node scripts/build-distribution.mjs build --shell <version> [--pi <version>] --out <dir>
+//   node scripts/build-distribution.mjs verify --assets <dir>
+//
+// Both commands work in a fresh temporary prefix with our own pinned Node and
+// pnpm (and Go on Windows); the user's tools and home are never used.
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { DISTRIBUTION_ASSETS, activateVersion, claimPrefix, distributionAsset, distributionFiles, ensureLauncher, ensureRuntime, installVersion,
+	pnpmEnvironment, readDistribution, runCommand } from "./bundled-install.mjs";
+import { PI_INSTALL_VERSION } from "./installer-preflight.mjs";
+
+const RESOLVE_TIMEOUT = 10 * 60 * 1000;
+// Right after `npm publish` the registry may not list gentle-pi@<version> yet:
+// 10 attempts 30 seconds apart wait about five minutes for it.
+const RESOLVE_ATTEMPTS = 10;
+const RESOLVE_DELAY = 30 * 1000;
+const output = (result) => `${result.stdout ?? ""}${result.stderr ?? ""}`.slice(-4000);
+
+/** Resolves the lockfile for gentle-pi `shell` and Pi `pi` with our pnpm
+ * (`install --lockfile-only`) in a fresh folder under the prefix, from the
+ * unmodified distributionFiles() output and the same environment installVersion
+ * uses. Only "no matching version" for this gentle-pi is retried (pnpm prints it
+ * on stdout); any other failure stops at once. Returns { manifest, assets }
+ * keyed by the release asset names.
+ */
+export async function buildDistribution({ layout, shell, pi = PI_INSTALL_VERSION, env = {}, adapters = {} }) {
+	const manifest = { shell, pi };
+	const files = distributionFiles(manifest);
+	const sleep = adapters.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	// `shell` is an exact SemVer here, so only its dots need escaping.
+	const unpublished = new RegExp(`ERR_PNPM_NO_(?:MATURE_)?MATCHING_VERSION\\] No matching version found for gentle-pi@${shell.replaceAll(".", "\\.")}(?![\\w.+-])`);
+	for (let attempt = 1; ; attempt += 1) {
+		const folder = mkdtempSync(join(layout.tmp, "lockfile-"));
+		try {
+			for (const [name, text] of Object.entries(files)) writeFileSync(join(folder, name), text, { flag: "wx", mode: 0o600 });
+			const result = await (adapters.run ?? runCommand)(layout.node, [layout.pnpm, "install", "--lockfile-only"],
+				{ cwd: folder, env: pnpmEnvironment(layout, { env }), timeout: RESOLVE_TIMEOUT });
+			if (result.status === 0) {
+				// Only the lockfile is read back: pnpm may rewrite pnpm-workspace.yaml with placeholders.
+				const lockfile = readFileSync(join(folder, "pnpm-lock.yaml"), "utf8");
+				return { manifest, assets: { [DISTRIBUTION_ASSETS.distribution]: distributionAsset(manifest, lockfile), [DISTRIBUTION_ASSETS.lockfile]: lockfile } };
+			}
+			if (!unpublished.test(output(result))) throw Object.assign(new Error("pnpm lockfile resolution failed"), { output: output(result) });
+			if (attempt === RESOLVE_ATTEMPTS) {
+				throw Object.assign(new Error(`gentle-pi@${shell} is not on the registry after ${RESOLVE_ATTEMPTS} attempts; check its npm publication`), { output: output(result) });
+			}
+		} finally {
+			rmSync(folder, { recursive: true, force: true });
+		}
+		await sleep(RESOLVE_DELAY);
+	}
+}
+
+/** Runs the launcher with `--version`; the .cmd one through cmd.exe. */
+function launch(launcher, { env, platform }) {
+	const options = { env, encoding: "utf8", timeout: 120000, windowsHide: true };
+	if (platform !== "win32") return spawnSync(launcher, ["--version"], options);
+	const cmd = join(env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows", "System32", "cmd.exe");
+	return spawnSync(cmd, ["/d", "/s", "/c", `""${launcher}" --version"`], { ...options, windowsVerbatimArguments: true });
+}
+
+/** Proves a release asset pair: our runtimes (Go too on Windows, as
+ * installVersion requires), a frozen install of the pair, `current` switched to
+ * it, the launcher written, and `gentle-shell --version` reporting exactly the
+ * pair's gentle-pi and Pi. Returns { id, version }.
+ */
+export async function verifyDistribution({ layout, distribution, lockfile, platform, arch, env = {}, adapters = {} }) {
+	const { manifest } = readDistribution(distribution, lockfile);
+	const runtime = await ensureRuntime({ layout, platform, arch, go: platform === "win32", env, adapters });
+	const { id } = await installVersion({ layout, manifest, lockfile, platform, env, go: runtime.go, adapters });
+	activateVersion(layout, id);
+	ensureLauncher(layout);
+	// The environment our pnpm ran in (no NODE_OPTIONS, NODE_PATH or npm/pnpm
+	// settings from the host), without any Pi or Gentle override that could point
+	// the launcher at another Pi or agent home.
+	const launchEnv = Object.fromEntries(Object.entries(pnpmEnvironment(layout, { platform, env })).filter(([key]) => !/^(?:gentle_|pi_)/i.test(key)));
+	const result = await (adapters.launch ?? launch)(layout.launcher, { env: launchEnv, platform });
+	const version = String(result.stdout ?? "").trim();
+	const [shellLine, piLine] = version.split(/\r?\n/);
+	if (result.status !== 0 || shellLine !== `gentle-shell ${manifest.shell}` || piLine !== `pi ${manifest.pi}`) {
+		throw Object.assign(new Error(`The launcher reported ${JSON.stringify(version)}, not gentle-shell ${manifest.shell} with pi ${manifest.pi}`),
+			{ output: output(result) });
+	}
+	return { id, version };
+}
+
+/** A fresh prefix in a new temporary folder. On Windows the private-folder claim
+ * (owner, ACL, marker) has its own native tests; here the new folder stands in
+ * for it, as in those tests.
+ */
+function temporaryPrefix(root, platform, base) {
+	if (platform !== "win32") {
+		const home = join(root, "home");
+		mkdirSync(home, { mode: 0o700 });
+		const env = { ...base, HOME: home };
+		return { env, layout: claimPrefix({ platform, env, home }) };
+	}
+	const [local, roaming, profile] = ["local", "roaming", "profile"].map((name) => join(root, name));
+	for (const folder of [local, roaming, profile]) mkdirSync(folder);
+	const kept = Object.entries(base).filter(([key]) => !/^(?:localappdata|appdata|userprofile|home)$/i.test(key));
+	const env = { ...Object.fromEntries(kept), LOCALAPPDATA: local, APPDATA: roaming, USERPROFILE: profile, HOME: profile };
+	const claim = (folder) => { mkdirSync(folder); return "claimed"; };
+	return { env, layout: claimPrefix({ platform, env, home: profile, adapters: { storage: () => {}, claim } }) };
+}
+
+/** The CLI. Its temporary prefix (`gsd-*`) is always removed, whether the
+ * command succeeded or failed; invalid input is refused before it exists.
+ */
+export async function main(argv, { platform = process.platform, arch = process.arch, env = process.env, temporaryRoot = tmpdir(), adapters = {} } = {}) {
+	const { positionals: [command], values } = parseArgs({ args: argv, allowPositionals: true,
+		options: { shell: { type: "string" }, pi: { type: "string" }, out: { type: "string" }, assets: { type: "string" } } });
+	const build = command === "build" && values.shell && values.out;
+	if (!build && !(command === "verify" && values.assets)) {
+		throw new Error("Usage: build-distribution.mjs build --shell <version> [--pi <version>] --out <dir> | verify --assets <dir>");
+	}
+	// A non-exact version is refused before anything is downloaded.
+	if (build) distributionFiles({ shell: values.shell, pi: values.pi ?? PI_INSTALL_VERSION });
+	const root = realpathSync(mkdtempSync(join(temporaryRoot, "gsd-")));
+	try {
+		const prefix = temporaryPrefix(root, platform, env);
+		if (build) {
+			await ensureRuntime({ layout: prefix.layout, platform, arch, env: prefix.env, adapters });
+			const { manifest, assets } = await buildDistribution({ layout: prefix.layout, shell: values.shell, pi: values.pi, env: prefix.env, adapters });
+			mkdirSync(values.out, { recursive: true });
+			for (const [name, text] of Object.entries(assets)) writeFileSync(join(values.out, name), text, { flag: "wx" });
+			console.log(`Built ${Object.keys(assets).join(" and ")} for gentle-pi ${manifest.shell} with pi ${manifest.pi} in ${values.out}`);
+		} else {
+			const read = (name) => readFileSync(join(values.assets, name), "utf8");
+			const result = await verifyDistribution({ layout: prefix.layout, distribution: read(DISTRIBUTION_ASSETS.distribution), lockfile: read(DISTRIBUTION_ASSETS.lockfile),
+				platform, arch, env: prefix.env, adapters });
+			console.log(`Verified ${result.id}:\n${result.version}`);
+		}
+	} finally {
+		// Windows may hold a file a moment after its process exits.
+		rmSync(root, { recursive: true, force: true, maxRetries: 5 });
+	}
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	main(process.argv.slice(2)).catch((error) => {
+		const detail = error.output ?? error.stderr;
+		console.error(detail ? `${error.message}\n${detail}` : error.message);
+		process.exitCode = 1;
+	});
+}

package/scripts/build-installer-bundles.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+// Double-click installers: one unsigned download per system that opens the
+// browser installation wizard with no git, clone or typed command.
+//
+// Each archive holds a launcher next to an `installer/` folder with the
+// wizard's own files (they import only `node:` modules, so no dependencies).
+// The launcher runs the bundled bootstrap, which fetches Node.js and pnpm when
+// they are missing and opens the wizard in the browser. Real files only: the
+// bootstrap refuses symlinked bundle files.
+//
+//   node scripts/build-installer-bundles.mjs --out <folder>
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, posix, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { installerPaths } from "./verify-package-files.mjs";
+
+/** Stable names, so `releases/latest/download/<name>` always points at the newest release. */
+const MACOS_ASSET = "gentle-shell-installer-macos.zip";
+const WINDOWS_ASSET = "gentle-shell-installer-windows.zip";
+const LINUX_ASSET = "gentle-shell-installer-linux.tar.gz";
+export const INSTALLER_ASSETS = Object.freeze([MACOS_ASSET, WINDOWS_ASSET, LINUX_ASSET]);
+export const INSTALLER_CHECKSUMS = "gentle-shell-installers-SHA256SUMS.txt";
+
+// Static and dynamic imports, and files a module reads next to itself through
+// `new URL("./file.ext", import.meta.url)`. Folder URLs (a trailing slash) are not
+// followed: their files are listed in installerPaths.
+const RELATIVE_REFERENCE = /(?:from\s+|import\s*\(\s*|new URL\(\s*)["'](\.{1,2}\/[^"']*[^/"'])["']/g;
+
+/** Relative module and file references in a module's source. */
+export function relativeReferences(text) {
+	return [...text.matchAll(RELATIVE_REFERENCE)].map((match) => match[1]);
+}
+
+/** Wizard files, package.json and everything their modules import, sorted. */
+export function bundleFiles(root) {
+	const files = new Set(["package.json", ...installerPaths]);
+	const pending = [...files].filter((path) => path.endsWith(".mjs"));
+	while (pending.length > 0) {
+		const file = pending.pop();
+		for (const specifier of relativeReferences(readFileSync(join(root, file), "utf8"))) {
+			const target = posix.normalize(posix.join(posix.dirname(file), specifier));
+			if (files.has(target)) continue;
+			if (!existsSync(join(root, target))) throw new Error(`${file} imports ${specifier}, which does not exist`);
+			files.add(target);
+			if (target.endsWith(".mjs")) pending.push(target);
+		}
+	}
+	return [...files].sort();
+}
+
+const unixLauncher = (title) => [
+	"#!/bin/sh",
+	`# ${title}: double-click to install or update Gentle Shell.`,
+	"# It runs the bundled bootstrap, which opens the installation wizard in your browser.",
+	'cd "$(dirname "$0")" || exit 1',
+	'sh "./installer/scripts/bootstrap.sh"',
+	"status=$?",
+	'if [ "$status" -eq 0 ]; then',
+	'	printf "\\n%s\\n" "You can close this window."',
+	"else",
+	'	printf "\\n%s\\n" "The installer stopped. Read the messages above, then close this window."',
+	"fi",
+	'exit "$status"',
+	"",
+].join("\n");
+
+const windowsLauncher = [
+	"@echo off",
+	"rem Double-click to install or update Gentle Shell.",
+	"rem It runs the bundled bootstrap, which opens the installation wizard in your browser.",
+	'call "%~dp0installer\\scripts\\bootstrap.cmd"',
+	"echo.",
+	"if errorlevel 1 (",
+	"  echo The installer stopped. Read the messages above, then close this window.",
+	") else (",
+	"  echo You can close this window.",
+	")",
+	"pause",
+	"",
+].join("\r\n");
+
+function run(command, args, cwd) {
+	const result = spawnSync(command, args, { cwd, encoding: "utf8" });
+	if (result.error || result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed: ${result.error?.message ?? result.stderr}`);
+}
+
+function stage(root, folder, files, launcher) {
+	mkdirSync(folder, { recursive: true });
+	for (const file of files) {
+		const target = join(folder, "installer", file);
+		mkdirSync(dirname(target), { recursive: true });
+		copyFileSync(join(root, file), target);
+		if (file.endsWith(".sh")) chmodSync(target, 0o755);
+	}
+	const path = join(folder, launcher.name);
+	writeFileSync(path, launcher.content);
+	chmodSync(path, 0o755);
+}
+
+/** Builds the three downloads and their checksums into `outDir`; returns their paths. */
+export function buildInstallerBundles({ root, outDir }) {
+	const files = bundleFiles(root);
+	const work = mkdtempSync(join(tmpdir(), "gentle-shell-installers-"));
+	try {
+		mkdirSync(outDir, { recursive: true });
+		const zipped = (asset, folder, launcher) => {
+			stage(root, join(work, asset, folder), files, launcher);
+			rmSync(join(outDir, asset), { force: true });
+			run("zip", ["-q", "-r", join(outDir, asset), folder], join(work, asset));
+		};
+		zipped(MACOS_ASSET, "Gentle Shell Installer", { name: "Install Gentle Shell.command", content: unixLauncher("macOS") });
+		zipped(WINDOWS_ASSET, "Gentle Shell Installer", { name: "Install Gentle Shell.cmd", content: windowsLauncher });
+		const linux = join(work, LINUX_ASSET);
+		stage(root, join(linux, "gentle-shell-installer"), files, { name: "install-gentle-shell.sh", content: unixLauncher("Linux") });
+		run("tar", ["-czf", join(outDir, LINUX_ASSET), "gentle-shell-installer"], linux);
+		const sums = INSTALLER_ASSETS.map((asset) => `${createHash("sha256").update(readFileSync(join(outDir, asset))).digest("hex")}  ${asset}\n`);
+		writeFileSync(join(outDir, INSTALLER_CHECKSUMS), sums.join(""));
+		return [...INSTALLER_ASSETS, INSTALLER_CHECKSUMS].map((asset) => join(outDir, asset));
+	} finally {
+		rmSync(work, { recursive: true, force: true });
+	}
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+	const at = process.argv.indexOf("--out");
+	const out = at === -1 ? undefined : process.argv[at + 1];
+	if (!out || process.argv.length !== 4) {
+		console.error("usage: node scripts/build-installer-bundles.mjs --out <folder>");
+		process.exit(2);
+	}
+	const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+	for (const path of buildInstallerBundles({ root, outDir: resolve(out) })) console.log(path);
+}

package/scripts/build-runtime-modules.mjs

@@ -12,8 +12,16 @@ const sources = [
 	"review-integration-v2",
 	"review-risk-assessment",
 	"native-review-cli",
+	"status-timing-diagnostics",
 	"telemetry-trigger",
+	"child-package-injection",
 	"gentle-shell-launcher",
+	"gentle-shell-bundled",
+	"gentle-shell-startup-update",
+	"gentle-shell-update-panel",
+	"gentle-shell-startup-flow",
+	"gentle-shell-resume-hint",
+	"gentle-shell-uninstall",
 ];
 const header = "// Generated by scripts/build-runtime-modules.mjs. Do not edit.\n";