makecoder 5.0.22 → 5.0.24

package/scripts/assemble-claude-native.mjs

@@ -1,142 +0,0 @@
-#!/usr/bin/env node
-/** Assemble a MakeCoder UI runtime from the official platform binary and patch sidecars. */
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { execFileSync } from "node:child_process";
-import { bootstrapSource, inspectModuleGraph, loaderSource, replaceEntry, sha256 } from "./claude-native-runtime.mjs";
-
-const excluded = new Set(["cc-runtime.json", "cc-native", "cc-native.exe",
-  "cc-native.mjs", "cc-native.exe.mjs"]);
-const windowsLockErrors = new Set(["EPERM", "EACCES", "EBUSY"]);
-const retrySignal = new Int32Array(new SharedArrayBuffer(4));
-
-export function renameWithWindowsRetry(source, target, {
-  platform = process.platform,
-  rename = fs.renameSync,
-  pause = ms => Atomics.wait(retrySignal, 0, 0, ms),
-} = {}) {
-  for (let attempt = 0; ; attempt++) {
-    try {
-      return rename(source, target);
-    } catch (error) {
-      if (platform !== "win32" || !windowsLockErrors.has(error.code) || attempt >= 20) throw error;
-      // A just-exited executable can still have an open handle on Windows.
-      pause(500);
-    }
-  }
-}
-
-export function assembleNative(officialDir, sidecarDir, outputDir) {
-  const official = fs.realpathSync(officialDir);
-  const sidecars = fs.realpathSync(sidecarDir);
-  const output = path.resolve(outputDir);
-  if (output === official || output.startsWith(official + path.sep) ||
-      (output !== sidecars && output.startsWith(sidecars + path.sep))) {
-    throw new Error("Output cannot be inside the official package or patch sidecars");
-  }
-  const pkg = JSON.parse(fs.readFileSync(path.join(official, "package.json"), "utf8"));
-  const platform = pkg.name?.replace(/^@anthropic-ai\/claude-code-/, "");
-  if (!/^@anthropic-ai\/claude-code-(darwin-(arm64|x64)|linux-(arm64|x64)|win32-x64)$/.test(pkg.name) ||
-      !/^\d+\.\d+\.\d+$/.test(pkg.version)) {
-    throw new Error("Expected a versioned official Claude platform package");
-  }
-  const patch = JSON.parse(fs.readFileSync(path.join(sidecars, "cc-runtime.json"), "utf8"));
-  if (patch.schemaVersion !== 1 || patch.mode !== "anthropic-native" ||
-      patch.platform !== platform || patch.version !== pkg.version || patch.package !== pkg.name) {
-    throw new Error("Patch sidecars and official package must have the same platform and version");
-  }
-  const sourceBinary = path.join(official, platform === "win32-x64" ? "claude.exe" : "claude");
-  const upstream = fs.readFileSync(sourceBinary);
-  if (sha256(upstream) !== patch.upstreamSha256 || inspectModuleGraph(upstream).platform !== platform) {
-    throw new Error("Official binary does not match the binary used to build the patch sidecars");
-  }
-  if (sha256(fs.readFileSync(path.join(sidecars, "cc.js"))) !== patch.bundleSha256) {
-    throw new Error("Patch sidecar bundle hash mismatch");
-  }
-  if (platform.startsWith("darwin")) {
-    if (process.platform !== "darwin") throw new Error("macOS assembly requires macOS codesign");
-    execFileSync("codesign", ["--verify", "--strict", sourceBinary], { stdio: "inherit" });
-  }
-  if (fs.existsSync(output)) {
-    const previous = JSON.parse(fs.readFileSync(path.join(output, "cc-runtime.json"), "utf8"));
-    if (previous.schemaVersion !== 1 || previous.mode !== "anthropic-native") {
-      throw new Error(`Output is not a generated native artifact: ${output}`);
-    }
-  }
-  fs.mkdirSync(path.dirname(output), { recursive: true });
-  const staging = fs.mkdtempSync(path.join(path.dirname(output), ".claude-assembled-"));
-  const backup = staging + "-previous";
-  let assemblyError;
-  try {
-    for (const name of fs.readdirSync(sidecars)) {
-      if (!excluded.has(name)) fs.cpSync(path.join(sidecars, name), path.join(staging, name), { recursive: true });
-    }
-    const executable = platform === "win32-x64" ? "cc-native.exe" : "cc-native";
-    const nativePath = path.join(staging, executable);
-    fs.writeFileSync(nativePath + ".mjs", loaderSource(patch.bundleSha256));
-    fs.writeFileSync(nativePath,
-      replaceEntry(upstream, bootstrapSource(patch.bundleSha256, pkg.version), platform), { mode: 0o755 });
-    if (platform.startsWith("darwin")) {
-      execFileSync("codesign", ["--force", "--sign", process.env.CODER_CODESIGN_IDENTITY || "-", nativePath], { stdio: "inherit" });
-      execFileSync("codesign", ["--verify", "--strict", nativePath], { stdio: "inherit" });
-    }
-    const manifest = {
-      schemaVersion: 1, mode: "anthropic-native", platform, version: pkg.version,
-      package: pkg.name, source: patch.source, upstreamSha256: patch.upstreamSha256,
-      bundleSha256: patch.bundleSha256, executable,
-      runtimeSha256: sha256(fs.readFileSync(nativePath)),
-      loaderSha256: sha256(fs.readFileSync(nativePath + ".mjs")),
-      signing: platform.startsWith("darwin") ? (process.env.CODER_CODESIGN_IDENTITY ? "identity" : "ad-hoc") :
-        platform === "win32-x64" ? "unsigned" : "not-applicable",
-    };
-    if (platform === `${process.platform}-${process.arch}`) {
-      const probe = JSON.parse(execFileSync(nativePath, ["--coder-runtime-info"], { encoding: "utf8", timeout: 30000 }));
-      if (probe.cellSegmenter !== "function" || probe.bundleSha256 !== patch.bundleSha256 ||
-          `${probe.platform}-${probe.arch}` !== platform || probe.version !== pkg.version) {
-        throw new Error("Assembled native runtime capability probe failed");
-      }
-      manifest.bunVersion = probe.bun;
-      const version = execFileSync(nativePath, ["--version"], { encoding: "utf8", timeout: 30000 });
-      if (!version.includes(`${pkg.version} (Claude Code)`)) {
-        throw new Error("Assembled native runtime failed to load the MakeCoder CLI");
-      }
-    }
-    fs.writeFileSync(path.join(staging, "cc-runtime.json"), JSON.stringify(manifest, null, 2) + "\n");
-    // mkdtemp creates a 0700 directory. Docker image builds assemble as root,
-    // but the CLI runs as an unprivileged user after the image is published.
-    if (process.platform !== "win32") fs.chmodSync(staging, 0o755);
-    if (fs.existsSync(output)) renameWithWindowsRetry(output, backup);
-    try { renameWithWindowsRetry(staging, output); }
-    catch (error) {
-      if (fs.existsSync(backup)) {
-        try { renameWithWindowsRetry(backup, output); }
-        catch (restoreError) {
-          throw new AggregateError([error, restoreError], "Failed to install Claude runtime and restore the previous artifact");
-        }
-      }
-      throw error;
-    }
-    fs.rmSync(backup, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 });
-    console.log(`Assembled ${pkg.name}@${pkg.version} -> ${output}`);
-  } catch (error) {
-    assemblyError = error;
-    throw error;
-  } finally {
-    try {
-      // Windows can briefly lock an executable after execFileSync returns.
-      fs.rmSync(staging, { recursive: true, force: true, maxRetries: 10, retryDelay: 500 });
-    } catch (cleanupError) {
-      if (!assemblyError) throw cleanupError;
-      console.warn(`Could not clean staging directory ${staging}: ${cleanupError.message}`);
-    }
-  }
-}
-
-if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
-  const [official, sidecars, output, ...rest] = process.argv.slice(2);
-  if (!official || !sidecars || !output || rest.length) {
-    throw new Error("Usage: assemble-claude-native.mjs <official-platform-package> <patch-sidecars> <output>");
-  }
-  assembleNative(official, sidecars, output);
-}

package/scripts/claude-native-runtime.mjs

@@ -1,230 +0,0 @@
-/**
- * Keep Anthropic's runtime and replace only its standalone entry module.
- * No sections move, no public Bun compiler rewrites private runtime metadata,
- * and all original embedded assets remain available. Unknown layouts fail
- * closed. The on-disk cc.js and its sidecars retain their existing semantics.
- */
-import { createHash } from "node:crypto";
-
-const TRAILER = Buffer.from("\n---- Bun! ----\n");
-const MODULE_SIZE = 52;
-const OFFSETS_SIZE = 32;
-
-function check(condition, message) {
-  if (!condition) throw new Error(`Unsupported Claude native runtime: ${message}`);
-}
-
-function range(buffer, offset, size, label) {
-  check(Number.isSafeInteger(offset) && Number.isSafeInteger(size) &&
-    offset >= 0 && size >= 0 && offset <= buffer.length - size,
-  `${label} is outside the binary`);
-}
-
-function u64(buffer, offset) {
-  range(buffer, offset, 8, "uint64");
-  const value = Number(buffer.readBigUInt64LE(offset));
-  check(Number.isSafeInteger(value), "uint64 exceeds safe integer range");
-  return value;
-}
-
-function name(buffer, offset, size) {
-  range(buffer, offset, size, "section name");
-  const bytes = buffer.subarray(offset, offset + size);
-  return bytes.subarray(0, bytes.indexOf(0) < 0 ? size : bytes.indexOf(0)).toString();
-}
-
-/** Locate the file-backed Bun section using platform headers, not byte scans. */
-export function inspectExecutable(buffer) {
-  range(buffer, 0, 64, "executable header");
-  let platform;
-  let signatureDirectory;
-  let checksumOffset;
-  const sections = [];
-  if (buffer.readUInt32LE(0) === 0xfeedfacf) {
-    const cpu = buffer.readUInt32LE(4);
-    check(cpu === 0x100000c || cpu === 0x1000007, "unknown Mach-O CPU");
-    platform = cpu === 0x100000c ? "darwin-arm64" : "darwin-x64";
-    check(buffer.readUInt32LE(12) === 2, "Mach-O is not executable");
-    const end = 32 + buffer.readUInt32LE(20);
-    range(buffer, 32, end - 32, "Mach-O commands");
-    let cursor = 32;
-    for (let i = 0; i < buffer.readUInt32LE(16); i++) {
-      check(cursor + 8 <= end, "truncated Mach-O command");
-      const cmd = buffer.readUInt32LE(cursor);
-      const size = buffer.readUInt32LE(cursor + 4);
-      check(size >= 8 && size % 8 === 0 && cursor + size <= end, "invalid Mach-O command size");
-      if (cmd === 0x19) {
-        check(size >= 72, "truncated segment command");
-        const count = buffer.readUInt32LE(cursor + 64);
-        check(size === 72 + count * 80, "unexpected segment command layout");
-        if (name(buffer, cursor + 8, 16) === "__BUN") {
-          check(count === 1, "expected one __BUN section");
-          const offset = u64(buffer, cursor + 40);
-          const length = u64(buffer, cursor + 48);
-          check(buffer.readUInt32LE(cursor + 72 + 48) === offset &&
-            u64(buffer, cursor + 72 + 40) <= length, "__BUN section/segment mismatch");
-          sections.push({ offset, length });
-        }
-      }
-      cursor += size;
-    }
-    check(cursor === end, "Mach-O command count mismatch");
-  } else if (buffer.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46]))) {
-    check(buffer[4] === 2 && buffer[5] === 1 && buffer[6] === 1,
-      "expected little-endian ELF64");
-    const cpu = buffer.readUInt16LE(18);
-    check(cpu === 62 || cpu === 183, "unknown ELF CPU");
-    check([2, 3].includes(buffer.readUInt16LE(16)), "ELF is not executable");
-    platform = cpu === 183 ? "linux-arm64" : "linux-x64";
-    const table = u64(buffer, 40);
-    const count = buffer.readUInt16LE(60);
-    const stringsIndex = buffer.readUInt16LE(62);
-    check(buffer.readUInt16LE(58) === 64 && count > 0 && stringsIndex < count,
-      "unsupported ELF section table");
-    range(buffer, table, count * 64, "ELF sections");
-    const stringsHeader = table + stringsIndex * 64;
-    const strings = u64(buffer, stringsHeader + 24);
-    const stringsSize = u64(buffer, stringsHeader + 32);
-    range(buffer, strings, stringsSize, "ELF section names");
-    for (let i = 0; i < count; i++) {
-      const header = table + i * 64;
-      const nameOffset = buffer.readUInt32LE(header);
-      check(nameOffset < stringsSize, "ELF section name outside string table");
-      if (name(buffer, strings + nameOffset, Math.min(5, stringsSize - nameOffset)) === ".bun" &&
-          buffer[strings + nameOffset + 4] === 0) {
-        check(buffer.readUInt32LE(header + 4) === 1, ".bun is not PROGBITS");
-        sections.push({ offset: u64(buffer, header + 24), length: u64(buffer, header + 32) });
-      }
-    }
-  } else if (buffer.readUInt16LE(0) === 0x5a4d) {
-    const pe = buffer.readUInt32LE(0x3c);
-    range(buffer, pe, 24, "PE header");
-    check(buffer.readUInt32LE(pe) === 0x4550 && buffer.readUInt16LE(pe + 4) === 0x8664,
-      "expected x64 PE");
-    platform = "win32-x64";
-    const optional = pe + 24;
-    const optionalSize = buffer.readUInt16LE(pe + 20);
-    range(buffer, optional, optionalSize, "PE optional header");
-    check(optionalSize >= 152 && buffer.readUInt16LE(optional) === 0x20b &&
-      buffer.readUInt32LE(optional + 108) >= 5, "unsupported PE optional header");
-    signatureDirectory = optional + 112 + 4 * 8;
-    checksumOffset = optional + 64;
-    const table = optional + optionalSize;
-    const count = buffer.readUInt16LE(pe + 6);
-    range(buffer, table, count * 40, "PE sections");
-    for (let i = 0; i < count; i++) {
-      const header = table + i * 40;
-      if (name(buffer, header, 8) === ".bun") {
-        sections.push({ offset: buffer.readUInt32LE(header + 20), length: buffer.readUInt32LE(header + 16) });
-      }
-    }
-  } else {
-    throw new Error("Unsupported Claude native runtime: expected Mach-O, ELF64 or PE64");
-  }
-  check(sections.length === 1, "expected exactly one Bun section");
-  const section = sections[0];
-  range(buffer, section.offset, section.length, "Bun section");
-  check(section.length >= 8 + OFFSETS_SIZE + TRAILER.length, "Bun section is too short");
-  return { platform, ...section, signatureDirectory, checksumOffset };
-}
-
-export function inspectModuleGraph(buffer) {
-  const executable = inspectExecutable(buffer);
-  const { offset, length } = executable;
-  const graphSize = u64(buffer, offset);
-  check(graphSize >= OFFSETS_SIZE + TRAILER.length && graphSize <= length - 8,
-    "invalid Bun graph size");
-  const start = offset + 8;
-  const trailer = start + graphSize - TRAILER.length;
-  check(buffer.subarray(trailer, trailer + TRAILER.length).equals(TRAILER), "Bun trailer mismatch");
-  const offsets = trailer - OFFSETS_SIZE;
-  check(u64(buffer, offsets) === offsets - start, "Bun byte count mismatch");
-  const table = start + buffer.readUInt32LE(offsets + 8);
-  const tableSize = buffer.readUInt32LE(offsets + 12);
-  const entryIndex = buffer.readUInt32LE(offsets + 16);
-  check(tableSize > 0 && tableSize % MODULE_SIZE === 0 && table >= start &&
-    table + tableSize <= offsets, "unsupported Bun module table");
-  check(entryIndex < tableSize / MODULE_SIZE, "entry index outside module table");
-  const entry = table + entryIndex * MODULE_SIZE;
-  const regions = [];
-  for (let row = table; row < table + tableSize; row += MODULE_SIZE) {
-    // path, source, sourcemap, bytecode, bytecode module map, module path.
-    for (const field of [0, 8, 16, 24, 32, 40]) {
-      const pos = buffer.readUInt32LE(row + field);
-      const size = buffer.readUInt32LE(row + field + 4);
-      check(pos <= table - start && size <= table - start - pos,
-        "module data overlaps metadata or exceeds graph");
-      if (size > 0) regions.push({ row, field, start: start + pos, end: start + pos + size });
-    }
-  }
-  const sourceOffset = start + buffer.readUInt32LE(entry + 8);
-  const sourceSize = buffer.readUInt32LE(entry + 12);
-  check(sourceSize > 0 && buffer[sourceOffset + sourceSize] === 0, "entry source is not null terminated");
-  for (const region of regions) {
-    if (region.row === entry && region.field === 8) continue;
-    check(region.end <= sourceOffset || region.start > sourceOffset + sourceSize,
-      "entry source overlaps another module field");
-  }
-  check(buffer.subarray(entry + 48, entry + 52).equals(Buffer.from([1, 1, 1, 0])),
-    "expected UTF-8 JavaScript ESM entry (module ABI changed)");
-  const pathOffset = start + buffer.readUInt32LE(entry);
-  const entryPath = buffer.subarray(pathOffset, pathOffset + buffer.readUInt32LE(entry + 4)).toString();
-  check(/^(\/\$bunfs\/root\/|B:\/~BUN\/root\/|file:\/\/\/B:\/%7EBUN\/root\/)/.test(entryPath),
-    "unexpected standalone entry path");
-  return { ...executable, start, offsets, table, tableSize, entry, entryPath, sourceOffset, sourceSize };
-}
-
-export function sha256(buffer) {
-  return createHash("sha256").update(buffer).digest("hex");
-}
-
-/** The hash binds the native entry to exactly the patched bundle we packaged. */
-export function bootstrapSource(bundleSha256, version) {
-  check(/^[a-f0-9]{64}$/.test(bundleSha256), "invalid bundle SHA-256");
-  // Native graph entries carry an upstream builtin-import map. A dynamic
-  // filesystem import enters Bun's normal loader without reusing that map.
-  return `if (typeof Bun.ant?.CellSegmenter !== "function") throw new Error("Claude requires Anthropic's private Bun.ant.CellSegmenter runtime");
-if (process.argv[2] === "--coder-runtime-info") {
-  console.log(JSON.stringify({version:${JSON.stringify(version)},bun:Bun.version,platform:process.platform,arch:process.arch,cellSegmenter:typeof Bun.ant.CellSegmenter,bundleSha256:${JSON.stringify(bundleSha256)}}));
-} else {
-  globalThis[Symbol.for("coder.claude.bundleSha256")] = ${JSON.stringify(bundleSha256)};
-  await import(process.execPath + ".mjs");
-}
-`;
-}
-
-export function loaderSource(bundleSha256) {
-  check(/^[a-f0-9]{64}$/.test(bundleSha256), "invalid bundle SHA-256");
-  return `import { dirname, join } from "node:path";
-import { pathToFileURL } from "node:url";
-import { readFileSync } from "node:fs";
-import { createHash } from "node:crypto";
-const bundle = join(dirname(process.execPath), "cc.js");
-if (globalThis[Symbol.for("coder.claude.bundleSha256")] !== ${JSON.stringify(bundleSha256)}) throw new Error("Claude native runtime / loader hash mismatch; reinstall the complete platform artifact");
-if (createHash("sha256").update(readFileSync(bundle)).digest("hex") !== ${JSON.stringify(bundleSha256)}) throw new Error("Claude native runtime / cc.js hash mismatch; rebuild and copy the complete platform artifact");
-await import(pathToFileURL(bundle).href);
-`;
-}
-
-export function replaceEntry(buffer, source, expectedPlatform) {
-  const graph = inspectModuleGraph(buffer);
-  check(graph.platform === expectedPlatform, `expected ${expectedPlatform}, found ${graph.platform}`);
-  const code = Buffer.from(source);
-  check(code.length > 0 && code.length <= graph.sourceSize, "replacement exceeds entry source allocation");
-  const result = Buffer.from(buffer);
-  result.fill(0, graph.sourceOffset, graph.sourceOffset + graph.sourceSize);
-  code.copy(result, graph.sourceOffset);
-  result.writeUInt32LE(code.length, graph.entry + 12);
-  // Invalidate the entry's source map, compiled bytecode and bytecode module
-  // map; otherwise JSC can execute the old Claude entry despite the new source.
-  result.fill(0, graph.entry + 16, graph.entry + 40);
-  if (graph.signatureDirectory !== undefined) {
-    // The upstream Authenticode signature is no longer valid. Leave overlay
-    // bytes in place, detach its certificate table, and let release signing
-    // apply the project's identity. A zero PE checksum is valid for user apps.
-    result.fill(0, graph.signatureDirectory, graph.signatureDirectory + 8);
-    result.writeUInt32LE(0, graph.checksumOffset);
-  }
-  inspectModuleGraph(result);
-  return result;
-}