impel-cli 0.18.15-beta.9 → 0.18.15

package/src/vendorCliBinaries.js

@@ -1,121 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-
-import {
-  environmentValue,
-  findNativeBinary,
-  resolveNativeBinary,
-} from "./nativeProcess.js";
-import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
-
-export const MAC_VENDOR_SIGNING_TEAMS = Object.freeze({
-  claude: "Q6L2SF6YDW",
-  codex: "2DC432GLL2",
-});
-
-const VERSION_RE = /\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/u;
-
-function vendorOverrideName(tool, environmentPrefix = "IMPEL") {
-  if (tool === "claude") return `${environmentPrefix}_CLAUDE_BIN`;
-  if (tool === "codex") return `${environmentPrefix}_CODEX_BIN`;
-  return null;
-}
-
-/** Extract the vendor release from `claude --version` or `codex --version`. */
-export function parseVendorCliVersion(output) {
-  return String(output || "").match(VERSION_RE)?.[0] || null;
-}
-
-/**
- * Accept only the exact reviewed macOS release and its vendor signature.
- * Explicit binary overrides remain authoritative for development and recovery.
- */
-export function verifyReviewedMacVendorCli(
-  tool,
-  binary,
-  environment = process.env,
-  {
-    run = spawnSync,
-    realpath = fs.realpathSync,
-    versions = PINNED_VENDOR_CLI_VERSIONS,
-    signingTeams = MAC_VENDOR_SIGNING_TEAMS,
-    environmentPrefix = "IMPEL",
-  } = {},
-) {
-  if (!versions[tool] || !signingTeams[tool]) return false;
-  try {
-    const override = vendorOverrideName(tool, environmentPrefix);
-    const overriddenBinary = override ? environmentValue(environment, override) : null;
-    if (overriddenBinary && path.resolve(overriddenBinary) === path.resolve(binary)) return true;
-
-    const result = run(binary, ["--version"], {
-      encoding: "utf8",
-      env: environment,
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15_000,
-    });
-    if (result?.status !== 0 || result?.error) return false;
-
-    const version = parseVendorCliVersion(`${result.stdout || ""}\n${result.stderr || ""}`);
-    if (version !== versions[tool]) return false;
-
-    const resolved = realpath(binary);
-    const verified = run("/usr/bin/codesign", ["--verify", "--strict", resolved], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15_000,
-    });
-    if (verified?.status !== 0 || verified?.error) return false;
-    const details = run("/usr/bin/codesign", ["-dv", "--verbose=4", resolved], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15_000,
-    });
-    return details?.status === 0
-      && String(details.stderr || details.stdout || "").includes(`TeamIdentifier=${signingTeams[tool]}`);
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Locate the reviewed macOS vendor CLI. On other platforms this intentionally
- * preserves the existing native resolution behavior.
- */
-export function findReviewedVendorCliBinary(
-  tool,
-  environment = process.env,
-  platform = process.platform,
-  environmentPrefix = "IMPEL",
-  {
-    find = findNativeBinary,
-    verify = verifyReviewedMacVendorCli,
-  } = {},
-) {
-  if (platform !== "darwin") return find(tool, environment, platform, environmentPrefix);
-  return find(
-    tool,
-    environment,
-    platform,
-    environmentPrefix,
-    (binary) => verify(tool, binary, environment, { environmentPrefix }),
-  );
-}
-
-/**
- * Resolve a launch target. macOS deliberately returns null when only an
- * unreviewed or version-drifted binary exists so callers can request repair
- * instead of silently launching it.
- */
-export function resolveReviewedVendorCliBinary(
-  tool,
-  environment = process.env,
-  platform = process.platform,
-  environmentPrefix = "IMPEL",
-) {
-  if (platform !== "darwin") {
-    return resolveNativeBinary(tool, environment, platform, environmentPrefix);
-  }
-  return findReviewedVendorCliBinary(tool, environment, platform, environmentPrefix);
-}

package/src/vendorCliVersions.js

@@ -1,7 +0,0 @@
-// Exact vendor CLI releases reviewed for this impel-cli build. Keep macOS and
-// Windows installers on the same versions; do not replace these with moving
-// channels such as "stable" or "latest".
-export const PINNED_VENDOR_CLI_VERSIONS = Object.freeze({
-  claude: "2.1.212",
-  codex: "0.146.0",
-});