magpie-gemini-web 0.5.0 → 0.5.2

package/scripts/studio-archive.go

@@ -0,0 +1,92 @@
+// Package the managed backend reproducibly using Go's standard archive writers.
+// Usage: go run scripts/studio-archive.go <output.tar.gz|output.zip> <binary> <LICENSE>
+package main
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"compress/gzip"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+func main() {
+	if err := pack(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func pack() error {
+	if len(os.Args) != 4 {
+		return fmt.Errorf("usage: studio-archive <archive> <binary> <LICENSE>")
+	}
+	binary, err := os.ReadFile(os.Args[2])
+	if err != nil {
+		return err
+	}
+	license, err := os.ReadFile(os.Args[3])
+	if err != nil {
+		return err
+	}
+	entries := []struct {
+		name string
+		data []byte
+		mode int64
+	}{
+		{"LICENSE", license, 0644},
+		{"README-MAGPIE.txt", []byte("AIStudio2API, managed by magpie-gemini-web.\nOnline updates are disabled. Upgrade through the Magpie plugin.\nSource and build instructions: https://github.com/BUKOWSKIREAL/magpie-gemini-web\n"), 0644},
+		{filepath.Base(os.Args[2]), binary, 0755},
+	}
+	file, err := os.Create(os.Args[1])
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	if strings.HasSuffix(os.Args[1], ".zip") {
+		writer := zip.NewWriter(file)
+		for _, entry := range entries {
+			header := &zip.FileHeader{Name: entry.name, Method: zip.Deflate}
+			header.SetModTime(time.Date(1980, 1, 1, 0, 0, 0, 0, time.UTC))
+			header.SetMode(os.FileMode(entry.mode))
+			out, err := writer.CreateHeader(header)
+			if err != nil {
+				return err
+			}
+			if _, err = out.Write(entry.data); err != nil {
+				return err
+			}
+		}
+		if err := writer.Close(); err != nil {
+			return err
+		}
+		return file.Close()
+	}
+	if !strings.HasSuffix(os.Args[1], ".tar.gz") {
+		return fmt.Errorf("unsupported archive extension")
+	}
+	compressed, err := gzip.NewWriterLevel(file, gzip.BestCompression)
+	if err != nil {
+		return err
+	}
+	writer := tar.NewWriter(compressed)
+	for _, entry := range entries {
+		header := &tar.Header{Name: entry.name, Mode: entry.mode, Size: int64(len(entry.data)), ModTime: time.Unix(0, 0), Format: tar.FormatUSTAR}
+		if err := writer.WriteHeader(header); err != nil {
+			return err
+		}
+		if _, err := writer.Write(entry.data); err != nil {
+			return err
+		}
+	}
+	if err := writer.Close(); err != nil {
+		return err
+	}
+	if err := compressed.Close(); err != nil {
+		return err
+	}
+	return file.Close()
+}

package/scripts/studio-managed-smoke.mjs

@@ -0,0 +1,66 @@
+// Isolated real-binary check: no Google accounts, no generation or online update.
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { installStudio, ensureStudio, stopStudio, studioAdmin, studioStatus, computeFileHash, STUDIO_VERSION } from '../lib/studio-native.mjs';
+import release from '../lib/studio-release.json' with { type: 'json' };
+
+const root = fileURLToPath(new URL('..', import.meta.url));
+const key = `${process.platform}-${process.arch}`;
+const pin = release.binaries[key];
+assert.ok(pin, `Unsupported platform ${key}`);
+const archivePath = path.join(root, 'studio-build/release', pin.asset);
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'magpie-studio-managed-smoke-'));
+let local;
+try {
+  local = await installStudio({ dataDir, archivePath });
+  const bin = path.join(dataDir, 'package', process.platform === 'win32' ? 'aistudio2api.exe' : 'aistudio2api');
+  assert.equal(computeFileHash(bin), pin.binarySha256);
+  await ensureStudio({ dataDir, managementOnly: true });
+  const pidBefore = fs.readFileSync(path.join(dataDir, 'backend.pid'), 'utf8');
+  const status = await studioAdmin(local, 'GET', '/api/status');
+  assert.equal(status.version, STUDIO_VERSION);
+  for (const query of ['', '?refresh=1']) {
+    const update = await studioAdmin(local, 'GET', `/api/update${query}`);
+    assert.equal(update.mode, 'managed');
+    assert.equal(update.available, false);
+    assert.equal(update.updating, false);
+    assert.equal(update.current, STUDIO_VERSION);
+  }
+  let updateHTTP;
+  await assert.rejects(studioAdmin(local, 'POST', '/api/update', null, {
+    fetchFn: async (...args) => {
+      const response = await fetch(...args);
+      if (String(args[0]).endsWith('/api/update')) updateHTTP = response.status;
+      return response;
+    }
+  }), /Magpie/);
+  assert.equal(updateHTTP, 403);
+  assert.equal(computeFileHash(bin), pin.binarySha256, 'update must not replace the binary');
+  assert.equal(fs.readFileSync(path.join(dataDir, 'backend.pid'), 'utf8'), pidBefore, 'update must not restart');
+  const html = await (await fetch(local.origin)).text();
+  const entry = /src="([^"]+\.js)"/.exec(html)?.[1];
+  assert.ok(entry, 'admin page must load');
+  const js = await (await fetch(new URL(entry, local.origin))).text();
+  const versionPanel = /(?:\.\/|\/assets\/)?(VersionPanel-[\w-]+\.js)/.exec(js)?.[1];
+  assert.ok(versionPanel, 'built admin version panel must exist');
+  const panel = await (await fetch(`${local.origin}/assets/${versionPanel}`)).text();
+  assert.match(panel, /Online updates are disabled/);
+  assert.ok(!panel.includes('applyUpdate'), 'version panel must not offer online installation');
+  assert.deepEqual(await stopStudio({ dataDir }), { stopped: true });
+  assert.equal((await studioStatus({ dataDir })).status, 'stopped');
+  console.log(`PASS ${key}: ${STUDIO_VERSION}, managed status, update HTTP 403, unchanged executable/PID, managed UI, clean stop`);
+} finally {
+  let stopped = !local;
+  if (local) stopped = (await stopStudio({ dataDir }).catch(() => ({ stopped: false }))).stopped;
+  if (stopped) {
+    const pkg = path.join(dataDir, 'package');
+    if (fs.existsSync(pkg)) fs.chmodSync(pkg, 0o755);
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  } else {
+    console.error(`Could not confirm backend exit; preserved ${dataDir}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/studio-release.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// Clean upstream commit + reviewed patch -> managed archives, never a developer's dirty tree.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = fileURLToPath(new URL('..', import.meta.url));
+const pinPath = path.join(root, 'lib/studio-release.json');
+const release = JSON.parse(fs.readFileSync(pinPath, 'utf8'));
+const args = process.argv.slice(2);
+for (const arg of args) {
+  if (!['--write-pins', '--verify'].includes(arg) && !arg.startsWith('--target=') && !arg.startsWith('--source=')) throw new Error(`Unknown argument: ${arg}`);
+}
+const writePins = args.includes('--write-pins');
+const verify = args.includes('--verify');
+const requested = args.find(arg => arg.startsWith('--target='))?.slice(9);
+const target = requested === 'host' ? `${process.platform}-${process.arch}` : requested;
+const platforms = { 'darwin-arm64': ['darwin', 'arm64'], 'darwin-x64': ['darwin', 'amd64'],
+  'linux-x64': ['linux', 'amd64'], 'linux-arm64': ['linux', 'arm64'], 'win32-x64': ['windows', 'amd64'] };
+if (target && !platforms[target]) throw new Error(`Unsupported target: ${target}`);
+if (writePins && (target || verify)) throw new Error('--write-pins requires all targets without --verify');
+const output = path.join(root, 'studio-build/release');
+fs.mkdirSync(output, { recursive: true });
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'magpie-studio-build-'));
+const source = path.join(scratch, 'source');
+fs.mkdirSync(source);
+const env = { ...process.env, CGO_ENABLED: '0', GOFLAGS: '', GOEXPERIMENT: '',
+  GOTOOLCHAIN: `go${release.goVersion}`, GOAMD64: 'v1', GOARM64: 'v8.0' };
+for (const key of ['GOOS', 'GOARCH']) delete env[key];
+const hash = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+const go = (argv, extra = {}) => execFileSync('go', argv, { cwd: source, env: { ...env, ...extra }, stdio: 'inherit' });
+const npm = argv => execFileSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', argv,
+  { cwd: path.join(source, 'web'), stdio: 'inherit', shell: process.platform === 'win32' });
+const patch = path.join(root, 'patches/studio-managed.patch');
+const flags = ['-mod=readonly', '-trimpath', '-buildvcs=false',
+  `-ldflags=-s -w -X github.com/Mag1cFall/AIStudio2API/internal/app.managedVersion=v${release.version}`];
+
+try {
+  let upstream = args.find(arg => arg.startsWith('--source='))?.slice(9);
+  if (upstream) {
+    upstream = path.resolve(upstream);
+    execFileSync('git', ['-C', upstream, 'cat-file', '-e', `${release.upstream.commit}^{commit}`]);
+  } else {
+    upstream = path.join(scratch, 'upstream');
+    execFileSync('git', ['init', '-q', upstream]);
+    execFileSync('git', ['-C', upstream, 'fetch', '--depth=1', release.upstream.repository, release.upstream.commit], { stdio: 'inherit' });
+  }
+  execFileSync('git', ['-C', upstream, 'archive', '--format=tar', `--output=${path.join(scratch, 'upstream.tar')}`, release.upstream.commit]);
+  execFileSync('tar', ['-xf', 'upstream.tar', '-C', 'source'], { cwd: scratch });
+  execFileSync('git', ['apply', '--check', patch], { cwd: source, stdio: 'inherit' });
+  execFileSync('git', ['apply', patch], { cwd: source, stdio: 'inherit' });
+  npm(['ci', '--no-audit', '--no-fund']);
+  npm(['run', 'lint']);
+  npm(['run', 'build']);
+  go(['test', '-mod=readonly', './cmd/...', './internal/...', '-count=1']);
+  const binaries = {};
+  for (const key of target ? [target] : Object.keys(platforms)) {
+    const [goos, goarch] = platforms[key];
+    const binary = path.join(scratch, goos === 'windows' ? 'aistudio2api.exe' : 'aistudio2api');
+    const asset = `aistudio2api-v${release.version}-${goos}-${goarch}.${goos === 'windows' ? 'zip' : 'tar.gz'}`;
+    console.log(`Building ${key}: ${asset}`);
+    go(['build', ...flags, '-o', binary, './cmd/aistudio2api'], { GOOS: goos, GOARCH: goarch });
+    go(['run', path.join(root, 'scripts/studio-archive.go'), path.join(output, asset), binary, path.join(source, 'LICENSE')]);
+    const sha256 = hash(path.join(output, asset));
+    const binarySha256 = hash(binary);
+    if (verify && (release.binaries[key]?.sha256 !== sha256 || release.binaries[key]?.binarySha256 !== binarySha256 || release.binaries[key]?.asset !== asset)) {
+      throw new Error(`Release pin mismatch for ${key}: ${sha256}`);
+    }
+    binaries[key] = { asset, sha256, binarySha256 };
+  }
+  fs.copyFileSync(path.join(source, 'LICENSE'), path.join(output, 'LICENSE-AISTUDIO'));
+  fs.writeFileSync(path.join(output, target ? `build-${target}.json` : 'build.json'), JSON.stringify({
+    version: release.version, upstream: release.upstream, goVersion: release.goVersion,
+    nodeVersion: process.version, patchSha256: hash(patch), flags, binaries
+  }, null, 2) + '\n');
+  fs.writeFileSync(path.join(output, target ? `SHA256SUMS-${target}.txt` : 'SHA256SUMS.txt'),
+    Object.values(binaries).map(pin => `${pin.sha256}  ${pin.asset}\n`).join(''));
+  if (writePins) fs.writeFileSync(pinPath, JSON.stringify({ ...release, binaries }, null, 2) + '\n');
+  console.log(`Managed Studio archives ready: ${output}`);
+} finally {
+  fs.rmSync(scratch, { recursive: true, force: true });
+}

package/scripts/studio.mjs

@@ -124,6 +124,7 @@ async function main() {
   switch (command) {
     case 'install': {
       const status = await studioStatus({ dataDir });
+      if (status.status === 'version_conflict') throw new Error(status.reason);
       if (status.status === 'running' || status.status === 'outdated' || status.status === 'unresponsive') {
         throw new Error('Cannot install or update AI Studio while service is running. Stop the service first.');
       }
@@ -143,6 +144,7 @@ async function main() {
     }
     case 'start': {
       const status = await studioStatus({ dataDir });
+      if (status.status === 'version_conflict') throw new Error(status.reason);
       if (status.status === 'running') {
         if (flags.proxy !== undefined) {
           throw new Error('Cannot update proxy while service is running. Stop the service first.');
@@ -180,13 +182,15 @@ async function main() {
             console.log(`  - ${a.label || a.id} (${a.state || 'active'})`);
           }
         }
+      } else if (status.status === 'version_conflict') {
+        console.log(status.reason);
       } else if (status.status === 'outdated') {
         console.log(`Running version: ${status.version} from an earlier install (this plugin uses ${status.expected})`);
-        console.log(`To replace it, run: ${studioCommand('start')}`);
-        console.log(`To stop it, run: ${studioCommand('stop')}`);
+        console.log(`To replace it, run: ${studioCommand('start', { dataDir })}`);
+        console.log(`To stop it, run: ${studioCommand('stop', { dataDir })}`);
       } else if (status.status === 'unresponsive') {
         console.log(`Port ${status.port} answers but not properly (${status.reason})`);
-        console.log(`If the service is stuck, run: ${studioCommand('stop')}`);
+        console.log(`If the service is stuck, run: ${studioCommand('stop', { dataDir })}`);
       } else if (status.status === 'foreign') {
         console.log(`Warning: Foreign listener on port ${status.port} (${status.reason})`);
       } else {
@@ -228,7 +232,7 @@ async function main() {
         const names = expired.map(a => a.label || a.id).join(', ');
         throw new Error(wanted
           ? `${wanted} doesn't need to sign in again; these do: ${names}`
-          : `Several accounts need to sign in again; name one: ${studioCommand('relogin <account>')} (${names})`);
+          : `Several accounts need to sign in again; name one: ${studioCommand('relogin <account>', { dataDir })} (${names})`);
       }
       console.log(`Opening isolated browser window to sign ${chosen.label || chosen.id} in again...`);
       const res = await studioAdmin(local, 'POST', `/api/accounts/${encodeURIComponent(chosen.id)}/login`, {}, { timeoutMs: LOGIN_TIMEOUT_MS });