idlewatch 0.1.0

package/scripts/validate-packaged-bundled-runtime.sh

@@ -0,0 +1,191 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DIST_LAUNCHER="$ROOT_DIR/dist/IdleWatch.app/Contents/MacOS/IdleWatch"
+TMP_APPS="$(mktemp -d -t idlewatch-packaged-runtime.XXXXXX)"
+
+cleanup_tmp() {
+  rm -rf "$TMP_APPS"
+}
+trap cleanup_tmp EXIT
+
+NODE_BIN="$(command -v node || true)"
+if [[ -z "$NODE_BIN" || ! -x "$NODE_BIN" ]]; then
+  echo "Node.js is required to run bundled-runtime validation." >&2
+  exit 1
+fi
+
+read_metadata_field() {
+  local field=$1
+  "$NODE_BIN" - "$METADATA_PATH" "$field" <<'NODE' | tr -d '\r'
+const fs = require('fs')
+const metadataPath = process.argv[2]
+const field = process.argv[3]
+const metadata = JSON.parse(fs.readFileSync(metadataPath, 'utf8'))
+const value = metadata[field]
+if (typeof value === 'undefined' || value === null) process.exit(0)
+if (typeof value === 'boolean') process.stdout.write(value ? '1' : '0')
+else process.stdout.write(String(value))
+NODE
+}
+
+RUNTIME_DIR="$($NODE_BIN -e 'const path = require("path"); console.log(path.resolve(process.argv[1], "..", ".."))' "$NODE_BIN")"
+METADATA_PATH="$ROOT_DIR/dist/IdleWatch.app/Contents/Resources/packaging-metadata.json"
+BUNDLED_RUNTIME_REQUIRED_RAW="${IDLEWATCH_BUNDLED_RUNTIME_REQUIRED+x}"
+BUNDLED_RUNTIME_REQUIRED="${IDLEWATCH_BUNDLED_RUNTIME_REQUIRED:-0}"
+RESTRICTED_PATH="/usr/bin:/bin"
+ORIGINAL_PATH="${PATH:-/usr/bin:/bin}"
+
+if [[ "${IDLEWATCH_SKIP_PACKAGE_MACOS:-0}" != "1" ]]; then
+  if [[ ! -x "$RUNTIME_DIR/bin/node" ]]; then
+    echo "Resolved runtime dir is invalid (missing executable bin/node): $RUNTIME_DIR" >&2
+    exit 1
+  fi
+  echo "Packaging IdleWatch.app with bundled runtime: $RUNTIME_DIR"
+  IDLEWATCH_NODE_RUNTIME_DIR="$RUNTIME_DIR" npm run package:macos --silent
+else
+  if [[ ! -f "$METADATA_PATH" ]]; then
+    echo "IDLEWATCH_SKIP_PACKAGE_MACOS=1 but metadata is missing: $METADATA_PATH" >&2
+    echo "Run with IDLEWATCH_SKIP_PACKAGE_MACOS unset or prebuild via npm run package:macos first." >&2
+    exit 1
+  fi
+
+  if [[ ! -f "$DIST_LAUNCHER" ]]; then
+    echo "IDLEWATCH_SKIP_PACKAGE_MACOS=1 but packaged launcher is missing: $DIST_LAUNCHER" >&2
+    echo "Run with IDLEWATCH_SKIP_PACKAGE_MACOS unset or prebuild via npm run package:macos first." >&2
+    exit 1
+  fi
+
+  if [[ "$BUNDLED_RUNTIME_REQUIRED" == "1" ]]; then
+    if [[ "$(read_metadata_field nodeRuntimeBundled)" != "1" ]]; then
+      echo "Reused packaged artifact is not bundled-runtime aware. Rebuild first:" >&2
+      echo "  npm run package:macos" >&2
+      echo "(required for node-free PATH validation in bundled-runtime check)" >&2
+      echo "To force launchability-only non-bundled validation, set IDLEWATCH_BUNDLED_RUNTIME_REQUIRED=0." >&2
+      exit 1
+    fi
+  elif [[ "$BUNDLED_RUNTIME_REQUIRED_RAW" != "1" ]]; then
+    if [[ "$(read_metadata_field nodeRuntimeBundled)" != "1" ]]; then
+      echo "Non-bundled artifact detected in reuse mode; running launchability fallback (recommended for non-deterministic reuse checks)." >&2
+      echo "This keeps non-bundled artifacts supportable while still validating launcher startup semantics." >&2
+      echo "Set IDLEWATCH_BUNDLED_RUNTIME_REQUIRED=1 to enforce strict node-free validation." >&2
+    fi
+  fi
+
+  if ! IDLEWATCH_ARTIFACT_DIR="$ROOT_DIR/dist/IdleWatch.app"     node "$ROOT_DIR/scripts/validate-packaged-artifact.mjs"; then
+    echo "Reusable packaged artifact preflight failed for validate-packaged-bundled-runtime." >&2
+    exit 1
+  fi
+
+  echo "Using existing packaged app at: $DIST_LAUNCHER"
+fi
+
+if [[ ! -x "$DIST_LAUNCHER" ]]; then
+  echo "Packaged launcher missing: $DIST_LAUNCHER" >&2
+  exit 1
+fi
+
+npm run validate:packaged-metadata --silent
+
+NODE_RUNTIME_BUNDLED="$(read_metadata_field nodeRuntimeBundled)"
+
+if [[ "$NODE_RUNTIME_BUNDLED" == "1" ]]; then
+  VALIDATION_PATH="$RESTRICTED_PATH"
+  echo "Running strict path-scrubbed launchability validation using PATH=$RESTRICTED_PATH"
+elif [[ "${IDLEWATCH_USE_ORIGINAL_PATH_FOR_NON_BUNDLED:-1}" == "1" ]]; then
+  if node_path="$(PATH="$RESTRICTED_PATH" /usr/bin/env which node 2>/dev/null || true)" &&
+      [[ -n "$node_path" ]] &&
+      [[ "$node_path" == /* ]] &&
+      [[ -x "$node_path" ]]; then
+    VALIDATION_PATH="$RESTRICTED_PATH"
+    echo "Node is available in restricted PATH; still validating with PATH=$RESTRICTED_PATH to keep behavior deterministic."
+  else
+    VALIDATION_PATH="$ORIGINAL_PATH"
+    echo "Non-bundled artifact detected; node is not available in PATH=$RESTRICTED_PATH." >&2
+    echo "Falling back to current PATH for launchability verification in non-bundled mode." >&2
+    echo "Set IDLEWATCH_BUNDLED_RUNTIME_REQUIRED=1 and provide IDLEWATCH_NODE_RUNTIME_DIR for strict node-free validation." >&2
+  fi
+else
+  VALIDATION_PATH="$RESTRICTED_PATH"
+  echo "Non-bundled artifact detected but strict path mode requested; this run requires bundled runtime validation." >&2
+  exit 1
+fi
+
+IDLEWATCH_DRY_RUN_TIMEOUT_MS="${IDLEWATCH_DRY_RUN_TIMEOUT_MS:-90000}"
+IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS="${IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS:-4000}"
+DRY_RUN_TIMEOUT_RETRY_BONUS_MS="${IDLEWATCH_DRY_RUN_TIMEOUT_RETRY_BONUS_MS:-10000}"
+DRY_RUN_TIMEOUT_MAX_ATTEMPTS="${IDLEWATCH_DRY_RUN_TIMEOUT_MAX_ATTEMPTS:-3}"
+DRY_RUN_TIMEOUT_BACKOFF_MS="${IDLEWATCH_DRY_RUN_TIMEOUT_BACKOFF_MS:-2000}"
+
+run_packaged_dry_run() {
+  local openclaw_usage=${1:-auto}
+  local timeout_ms=${2}
+  local attempt=${3}
+  local validation_path=${4}
+  local attempt_log="$TMP_APPS/packaged-dry-run-${openclaw_usage}-attempt-${attempt}.log"
+
+  if ! env \
+    IDLEWATCH_DRY_RUN_TIMEOUT_MS="$timeout_ms" \
+    IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS="$IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS" \
+    IDLEWATCH_OPENCLAW_USAGE="$openclaw_usage" \
+    HOME="$HOME" \
+    PATH="$validation_path" \
+    "$NODE_BIN" "$ROOT_DIR/scripts/validate-dry-run-schema.mjs" \
+      "$DIST_LAUNCHER" --dry-run --once >"$attempt_log" 2>&1; then
+    echo "Attempt ${attempt} failed for IDLEWATCH_OPENCLAW_USAGE=${openclaw_usage} with PATH=$validation_path. Last output:" >&2
+    tail -n 60 "$attempt_log" >&2 || true
+    return 1
+  fi
+
+  cat "$attempt_log" >&2
+  return 0
+}
+
+run_packaged_dry_run_with_retries() {
+  local openclaw_usage=$1
+  local attempt=1
+  local timeout_ms="$IDLEWATCH_DRY_RUN_TIMEOUT_MS"
+
+  while (( attempt <= DRY_RUN_TIMEOUT_MAX_ATTEMPTS )); do
+    local sleep_ms=0
+    echo "Attempt ${attempt}/${DRY_RUN_TIMEOUT_MAX_ATTEMPTS}: validating packaged launcher dry-run with IDLEWATCH_OPENCLAW_USAGE=${openclaw_usage} timeout=${timeout_ms}ms" >&2
+    if run_packaged_dry_run "$openclaw_usage" "$timeout_ms" "$attempt" "$VALIDATION_PATH"; then
+      return 0
+    fi
+
+    if (( attempt < DRY_RUN_TIMEOUT_MAX_ATTEMPTS )); then
+      timeout_ms=$((timeout_ms + DRY_RUN_TIMEOUT_RETRY_BONUS_MS))
+      sleep_ms=$((DRY_RUN_TIMEOUT_BACKOFF_MS < 0 ? 0 : DRY_RUN_TIMEOUT_BACKOFF_MS))
+      if (( sleep_ms > 0 )); then
+        sleep $(awk -v t="$sleep_ms" 'BEGIN { printf "%.3f", t / 1000 }')
+      fi
+    fi
+    attempt=$((attempt + 1))
+  done
+
+  return 1
+}
+
+set +e
+run_packaged_dry_run_with_retries auto
+rc=$?
+set -e
+
+if [[ $rc -ne 0 ]]; then
+  if run_packaged_dry_run_with_retries off; then
+    echo "bundled runtime validation ok (launcher path-only check ${VALIDATION_PATH:+under PATH=$VALIDATION_PATH})" >&2
+    echo "OpenClaw-enabled dry-run did not emit telemetry within timeout/backoff window; launchability path remains healthy." >&2
+    exit 0
+  fi
+
+  echo "bundled runtime validation failed for both OpenClaw-enabled and OpenClaw-disabled dry-runs" >&2
+  exit 1
+fi
+
+echo "bundled runtime validation ok"
+if [[ "$NODE_RUNTIME_BUNDLED" == "1" ]]; then
+  echo "validated launcher dry-run under restricted PATH in ${IDLEWATCH_DRY_RUN_TIMEOUT_MS}ms baseline (+${DRY_RUN_TIMEOUT_RETRY_BONUS_MS}ms retry increments, up to ${DRY_RUN_TIMEOUT_MAX_ATTEMPTS} attempts)"
+else
+  echo "validated launcher dry-run for non-bundled artifact under PATH=${VALIDATION_PATH} in ${IDLEWATCH_DRY_RUN_TIMEOUT_MS}ms baseline (+${DRY_RUN_TIMEOUT_RETRY_BONUS_MS}ms retry increments, up to ${DRY_RUN_TIMEOUT_MAX_ATTEMPTS} attempts)"
+fi

package/scripts/validate-packaged-metadata.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+METADATA_PATH="$ROOT_DIR/dist/IdleWatch.app/Contents/Resources/packaging-metadata.json"
+PAYLOAD_BIN="$ROOT_DIR/dist/IdleWatch.app/Contents/Resources/payload/package/bin/idlewatch-agent.js"
+
+if [[ ! -f "$METADATA_PATH" ]]; then
+  echo "Missing packaging metadata: $METADATA_PATH" >&2
+  exit 1
+fi
+
+if [[ ! -f "$PAYLOAD_BIN" ]]; then
+  echo "Missing packaged payload entrypoint: $PAYLOAD_BIN" >&2
+  exit 1
+fi
+
+node - "$METADATA_PATH" <<'NODE'
+const fs = require('fs')
+const metadataPath = process.argv[2]
+const data = JSON.parse(fs.readFileSync(metadataPath, 'utf8'))
+if (!data.version) throw new Error('packaging metadata missing version')
+if (!data.platform) throw new Error('packaging metadata missing platform')
+if (data.platform !== 'darwin') throw new Error('packaging metadata platform is not darwin')
+if (!data.bundleName) throw new Error('packaging metadata missing bundleName')
+if (!data.payloadTarball) throw new Error('packaging metadata missing payloadTarball')
+if (typeof data.nodeRuntimeBundled !== 'boolean') throw new Error('packaging metadata missing nodeRuntimeBundled')
+if (typeof data.sourceGitCommit !== 'undefined' && typeof data.sourceGitCommit !== 'string') {
+  throw new Error('packaging metadata sourceGitCommit must be a string when present')
+}
+if (typeof data.sourceGitDirty !== 'undefined' && typeof data.sourceGitDirty !== 'boolean') {
+  throw new Error('packaging metadata sourceGitDirty must be a boolean when present')
+}
+if (typeof data.sourceGitDirtyKnown !== 'undefined' && typeof data.sourceGitDirtyKnown !== 'boolean') {
+  throw new Error('packaging metadata sourceGitDirtyKnown must be a boolean when present')
+}
+console.log(`packaging metadata ok for ${data.bundleName} ${data.version}`)
+if (data.sourceGitCommit) {
+  console.log(`source commit: ${data.sourceGitCommit}${data.sourceGitDirty ? ' (dirty)' : ''}`)
+}
+NODE
+
+echo "packaging metadata validation ok"

package/scripts/validate-packaged-openclaw-cache-recovery-e2e.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict'
+import { mkdtempSync, writeFileSync, chmodSync, rmSync, readFileSync } from 'node:fs'
+import { readTelemetryJsonRow } from './lib/telemetry-row-parser.mjs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { execFileSync, spawnSync } from 'node:child_process'
+
+const repoRoot = process.cwd()
+const rootDir = process.cwd()
+const tempDir = mkdtempSync(join(tmpdir(), 'idlewatch-openclaw-cache-recover-pkg-'))
+const mockBinPath = join(tempDir, 'openclaw-mock.sh')
+const callLog = join(tempDir, 'calls.txt')
+const cachePath = join(tempDir, 'openclaw-last-good.json')
+
+function writeMockOpenClaw(pathToScript) {
+  const script = `#!/usr/bin/env bash
+set -euo pipefail
+
+calls_file="${callLog}"
+if [[ ! -f "$calls_file" ]]; then
+  echo 0 > "$calls_file"
+fi
+
+n=$(cat "$calls_file")
+next=$((n + 1))
+echo "$next" > "$calls_file"
+
+if [[ "$n" -lt 7 ]]; then
+  echo "temporary probe failure \$n" >&2
+  exit 1
+fi
+
+now_ms=$(($(date +%s) * 1000))
+updated_at=$((now_ms - 1500))
+cat <<JSON
+{
+  "sessions": {
+    "recent": [
+      {
+        "sessionId": "cached-recover-packaged",
+        "agentId": "agent-cache-pkg",
+        "model": "gpt-5.3-codex",
+        "totalTokens": 9090,
+        "updatedAt": $updated_at,
+        "updated_at": $updated_at
+      }
+    ]
+  },
+  "ts": $now_ms
+}
+JSON
+`
+  writeFileSync(pathToScript, script, 'utf8')
+  chmodSync(pathToScript, 0o755)
+}
+
+function readRow(output) {
+  return readTelemetryJsonRow(output)
+}
+
+function collectRow(env) {
+  const launcher = join(rootDir, 'dist', 'IdleWatch.app', 'Contents', 'MacOS', 'IdleWatch')
+  const out = spawnSync(launcher, ['--dry-run'], {
+    cwd: repoRoot,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: 25000,
+    env,
+    maxBuffer: 16 * 1024 * 1024,
+    killSignal: 'SIGINT'
+  })
+
+  const output = String(out.stdout || '') + String(out.stderr || '')
+  assert.equal(out.status, 0, `packaged dry-run exited with ${out.status}`)
+  assert.ok(output.trim(), 'packaged dry-run produced no output')
+  return readRow(output)
+}
+
+function run() {
+  const nowMs = Date.now()
+  const staleAgeMs = 90000
+
+  if (process.env.IDLEWATCH_SKIP_PACKAGE_MACOS !== '1') {
+    execFileSync('npm', ['run', 'package:macos', '--silent'], {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+  }
+
+  writeMockOpenClaw(mockBinPath)
+
+  const staleSnapshot = {
+    at: nowMs,
+    usage: {
+      model: 'gpt-5.3-codex',
+      totalTokens: 8080,
+      tokensPerMin: 18.2,
+      sessionId: 'cached-recover-packaged',
+      agentId: 'agent-cache-pkg',
+      usageTimestampMs: nowMs - staleAgeMs,
+      sourceCommand: 'cached-recovery-stale'
+    }
+  }
+  writeFileSync(cachePath, JSON.stringify(staleSnapshot), 'utf8')
+  writeFileSync(callLog, '0', 'utf8')
+
+  const env = {
+    ...process.env,
+    HOME: process.env.HOME || '',
+    IDLEWATCH_OPENCLAW_BIN: mockBinPath,
+    IDLEWATCH_OPENCLAW_BIN_STRICT: '1',
+    IDLEWATCH_OPENCLAW_PROBE_RETRIES: '0',
+    IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH: cachePath,
+    IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS: '120000',
+    IDLEWATCH_USAGE_STALE_MS: '30000',
+    IDLEWATCH_USAGE_NEAR_STALE_MS: '15000',
+    IDLEWATCH_USAGE_STALE_GRACE_MS: '3000',
+    IDLEWATCH_USAGE_REFRESH_REPROBES: '4',
+    IDLEWATCH_USAGE_REFRESH_DELAY_MS: '20',
+    IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE: '1',
+    IDLEWATCH_INTERVAL_MS: '1000',
+    IDLEWATCH_OPENCLAW_USAGE: 'auto',
+    IDLEWATCH_REQUIRE_OPENCLAW_USAGE: '1'
+  }
+
+  const row = collectRow(env)
+
+  assert.equal(row?.source?.usage, 'openclaw', 'usage source should remain openclaw during packaged cache recovery')
+  assert.equal(row?.source?.usageProbeAttempts >= 1, true, 'probe attempts should run for refresh path')
+  assert.equal(row?.source?.usageRefreshAttempted, true, 'packaged stale recovery should attempt refresh')
+  assert.equal(row?.source?.usageRefreshAttempts >= 1, true, 'at least one refresh reprobe attempt should run after stale cache')
+  assert.equal(row?.source?.usageRefreshRecovered, true, 'stale packaged cache should recover after successful reprobe')
+  assert.equal(row?.source?.usageProbeResult, 'ok', 'final usage probe result should be ok after recovery')
+  assert.equal(row?.source?.usageFreshnessState, 'fresh', 'usage should be fresh after successful recovery')
+  assert.equal(row?.source?.usageAlertLevel, 'ok', 'usage alert should settle to ok after recovery')
+  assert.equal(row?.openclawSessionId, 'cached-recover-packaged')
+  assert.equal(row?.openclawAgentId, 'agent-cache-pkg')
+  assert.equal(row?.openclawTotalTokens, 9090)
+  assert.equal(row?.source?.usageCommand?.includes('--json') || row?.source?.usageCommand?.includes('status'), true, 'command path should be OpenClaw command text')
+
+  const calls = Number(readFileSync(callLog, 'utf8').trim())
+  assert.ok(Number.isFinite(calls) && calls >= 3, `expected at least 3 probe calls, got ${calls}`)
+
+  console.log('validate-packaged-openclaw-cache-recovery-e2e: ok (packaged stale cache recovers through reprobe attempts)')
+}
+
+try {
+  run()
+} finally {
+  rmSync(tempDir, { recursive: true, force: true })
+}

package/scripts/validate-packaged-openclaw-release-gates.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import { existsSync, accessSync, constants } from 'node:fs'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const repoRoot = process.cwd()
+const appPath = join(repoRoot, 'dist', 'IdleWatch.app', 'Contents', 'MacOS', 'IdleWatch')
+
+function ensureReleaseArtifact() {
+  if (!existsSync(appPath)) {
+    console.error(`Missing packaged app launcher at ${appPath}`)
+    console.error('Run npm run package:macos --silent before running trusted release gates.')
+    process.exit(1)
+  }
+
+  try {
+    accessSync(appPath, constants.X_OK)
+  } catch {
+    console.error(`Packaged launcher is not executable: ${appPath}`)
+    process.exit(1)
+  }
+}
+
+function shouldRequireOpenClaw(rawValue) {
+  const raw = String(rawValue ?? '1').trim().toLowerCase()
+  if (raw === '0' || raw === 'false' || raw === 'off' || raw === 'no') return false
+  if (raw === '1' || raw === 'true' || raw === 'on' || raw === 'yes') return true
+  return true
+}
+
+const RELEASE_GATE_TIMEOUT_MS = process.env.IDLEWATCH_DRY_RUN_TIMEOUT_MS || '60000'
+
+function runValidator(name, extraEnv = {}) {
+  const requireOpenClawUsage = shouldRequireOpenClaw(process.env.IDLEWATCH_REQUIRE_OPENCLAW_USAGE)
+  const requireOpenClaw = requireOpenClawUsage ? '1' : '0'
+
+  const result = spawnSync('npm', ['run', name, '--silent'], {
+    cwd: repoRoot,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      IDLEWATCH_SKIP_PACKAGE_MACOS: '1',
+      IDLEWATCH_REQUIRE_OPENCLAW_USAGE: requireOpenClaw,
+      IDLEWATCH_DRY_RUN_TIMEOUT_MS: RELEASE_GATE_TIMEOUT_MS,
+      ...extraEnv
+    }
+  })
+
+  const out = String(result.stdout || '') + String(result.stderr || '')
+  if (result.status !== 0) {
+    if (out.trim()) {
+      console.error(out.trim())
+    }
+    console.error(`Validator ${name} failed with exit code ${result.status}`)
+    process.exit(result.status)
+  }
+
+  process.stdout.write(out)
+}
+
+function main() {
+  ensureReleaseArtifact()
+
+  runValidator('validate:packaged-usage-health')
+  runValidator('validate:packaged-openclaw-stats-ingestion')
+  runValidator('validate:packaged-openclaw-cache-recovery-e2e')
+
+  console.log('validate-packaged-openclaw-release-gates: ok (release artifact validates OpenClaw health, stats fallback, and cache recovery)')
+}
+
+main()