specrails-hub 1.61.2 → 1.61.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specrails-hub",
-  "version": "1.61.2",
+  "version": "1.61.4",
   "license": "MIT",
   "repository": {
     "type": "git",

package/server/dist/browser-playwright.js

@@ -7,39 +7,6 @@
 //
 // Screencast uses CDP (`Page.startScreencast`) since Playwright exposes no
 // screencast API; input + screenshot + DOM use Playwright's high-level page API.
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createPlaywrightLauncher = createPlaywrightLauncher;
 const chromium_resolver_1 = require("./chromium-resolver");
@@ -577,9 +544,14 @@ class PlaywrightContextHandle {
  */
 function createPlaywrightLauncher() {
     return async (opts) => {
+        // Use CommonJS require (NOT dynamic import()): in the packaged pkg sidecar the
+        // native-addon banner redirects require('playwright') to the externally-copied
+        // package via _Module._load. A dynamic import() goes through Node's ESM resolver
+        // instead, which can't find 'playwright' inside the /snapshot pkg vfs
+        // ("Cannot find package 'playwright'"). require keeps it on the patched path.
         // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const { chromium } = (await Promise.resolve().then(() => __importStar(require('playwright'))));
-        const executablePath = opts.executablePath ?? (0, chromium_resolver_1.resolveBundledChromiumPath)() ?? undefined;
+        const { chromium } = require('playwright');
+        const executablePath = opts.executablePath ?? (await (0, chromium_resolver_1.resolveBundledChromiumExecutable)()) ?? undefined;
         const context = await chromium.launchPersistentContext(opts.userDataDir, {
             headless: true,
             executablePath,

package/server/dist/chromium-resolver.js

@@ -5,23 +5,47 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.discoverChromiumExecutable = discoverChromiumExecutable;
 exports.resolveBundledChromiumPath = resolveBundledChromiumPath;
+exports.resolveBundledChromiumExecutable = resolveBundledChromiumExecutable;
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const stream_1 = require("stream");
+const promises_1 = require("stream/promises");
 /**
  * Resolve the Chromium executable the browser-capture feature should launch.
  *
- * Mirrors the bundled-runtime resolution used by `path-resolver.ts` for node/git:
- * in desktop mode (`SPECRAILS_IS_DESKTOP=1`) we DISCOVER a bundled Chromium shipped
- * under `<runtimes>/chromium/` (declared in tauri.conf.json via the `runtimes/**`
- * glob, codesigned in CI before `tauri build`). When no bundle is present (dev, a
- * runtimes-less build, or a partial extraction) we return `null` so Playwright
- * falls back to its own managed browser — never dead-ending the feature.
+ * In desktop mode (`SPECRAILS_IS_DESKTOP=1`) we ship Chromium INSIDE the app, but
+ * NOT as an unpacked directory: Tauri's resource bundler dereferences symlinks when
+ * it copies `bundle.resources` into the .app (tauri-apps/tauri#13219), which mangles
+ * Chromium's versioned `*.framework` (the `Versions/Current` + top-level symlinks
+ * become flat duplicate copies) and invalidates its code signature — macOS
+ * notarization then rejects the app ("The signature of the binary is invalid").
  *
- * We DISCOVER rather than hard-code the path because Playwright's layout changes
- * across versions (e.g. `chrome-mac/Chromium.app` → `chrome-mac-arm64/Google Chrome
- * for Testing.app`, `chrome-win/chrome.exe`, `chrome-linux/chrome`). The CI assembly
- * copies Playwright's platform folder verbatim under `<runtimes>/chromium/`; this
- * walks that tree to find the real executable.
+ * So we ship Chromium as a single OPAQUE, OBFUSCATED blob
+ * (`<runtimes>/chromium/chromium.pak`):
+ *   - It is an XOR-transformed `chromium.tar.gz`. The notarization service recursively
+ *     unpacks archives it recognises (.zip → .tar.gz → .tar → …) and validates every
+ *     Mach-O inside; Chromium's ~50 nested binaries are only ad-hoc ("linker") signed
+ *     by Google, so a plain archive fails notarization. XOR-ing breaks the gzip/tar
+ *     magic, so the notary cannot identify the file as a container and treats it as
+ *     opaque data — nothing inside is inspected, and the app notarizes with NO
+ *     Developer-ID signing of Chromium. (Obfuscation, not security: the key is public.)
+ *   - Tauri also copies it as one regular file — nothing to dereference.
+ *   - At first use we reverse the XOR and extract it to a writable cache
+ *     (`~/.specrails/runtimes/chromium`), restoring the framework symlinks intact. The
+ *     extracted Chromium keeps Google's ad-hoc signature, which is sufficient to execute
+ *     on Apple Silicon, and — being self-extracted rather than downloaded — carries no
+ *     `com.apple.quarantine` xattr, so Gatekeeper does not block it.
+ *
+ * A plain `chromium.tar.gz`/`chromium.tar` is also accepted (e.g. unobfuscated local
+ * builds). When no archive is present (dev, a runtimes-less build, a partial
+ * extraction) we fall back to discovering an UNPACKED `<runtimes>/chromium` tree, and
+ * finally to `null` so Playwright uses its own managed browser — never dead-ending.
+ *
+ * We DISCOVER rather than hard-code the executable path because Playwright's layout
+ * changes across versions (`chrome-mac/Chromium.app` → `chrome-mac-arm64/Google Chrome
+ * for Testing.app`, `chrome-win/chrome.exe`, `chrome-linux/chrome`).
  */
 const MAX_DEPTH = 6;
 function isFile(p) {
@@ -109,8 +133,13 @@ function discoverChromiumExecutable(chromiumRoot) {
     return findFirstFile(chromiumRoot, (n) => n === 'chrome' || n === 'chromium' || n === 'chrome-wrapper');
 }
 /**
- * Returns the absolute path to the bundled Chromium binary, or `null` when no
- * bundle is present (so Playwright uses its managed browser). Never throws.
+ * Returns the absolute path to an UNPACKED bundled Chromium binary, or `null`.
+ *
+ * This is the synchronous, no-extraction path: it only inspects a chromium tree that
+ * already exists on disk under `<runtimes>/chromium`. Prefer the async
+ * `resolveBundledChromiumExecutable()` for the launch path — it additionally extracts
+ * the shipped `chromium.tar.gz` archive. Kept for the unpacked fallback (local builds)
+ * and never throws.
  */
 function resolveBundledChromiumPath() {
     if (process.env.SPECRAILS_IS_DESKTOP !== '1')
@@ -125,3 +154,155 @@ function resolveBundledChromiumPath() {
         return null;
     }
 }
+/** Candidate archive names under `<runtimes>/chromium`, in preference order. */
+const ARCHIVE_NAMES = ['chromium.pak', 'chromium.tar.gz', 'chromium.tar'];
+// XOR key for the obfuscated `chromium.pak` blob. Keep byte-identical to KEY in
+// scripts/obfuscate-chromium.mjs — the round-trip is covered by a unit test.
+const OBFUSCATION_KEY = Buffer.from('specrails-hub-chromium-pack-v1', 'utf8');
+/** Streaming XOR transform (symmetric: packs and unpacks). */
+function xorStream() {
+    let offset = 0;
+    return new stream_1.Transform({
+        transform(chunk, _enc, cb) {
+            const out = Buffer.allocUnsafe(chunk.length);
+            for (let i = 0; i < chunk.length; i++) {
+                out[i] = chunk[i] ^ OBFUSCATION_KEY[(offset + i) % OBFUSCATION_KEY.length];
+            }
+            offset += chunk.length;
+            cb(null, out);
+        },
+    });
+}
+/** De-obfuscate a `.pak` blob into a real `.tar.gz` at `outPath`. */
+async function deobfuscate(pakPath, outPath) {
+    await (0, promises_1.pipeline)(fs_1.default.createReadStream(pakPath), xorStream(), fs_1.default.createWriteStream(outPath));
+}
+/** Writable extraction destination (overridable for tests via env). */
+function chromiumCacheDir() {
+    return (process.env.SPECRAILS_CHROMIUM_CACHE_DIR ||
+        path_1.default.join(os_1.default.homedir(), '.specrails', 'runtimes', 'chromium'));
+}
+/** Identity string for an archive (size:mtime) used to skip re-extraction. */
+function archiveIdentity(archivePath) {
+    const st = fs_1.default.statSync(archivePath);
+    return `${st.size}:${Math.round(st.mtimeMs)}`;
+}
+/** Resolve the platform `tar` binary. macOS/Linux ship `/usr/bin/tar`; Windows 10+ ships `tar` (bsdtar) on PATH. */
+function tarBinary() {
+    if (process.platform !== 'win32' && isFile('/usr/bin/tar'))
+        return '/usr/bin/tar';
+    return 'tar';
+}
+/** Extract `archivePath` into `destDir` using the system tar (auto-detects gzip). */
+function runTarExtract(archivePath, destDir) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(tarBinary(), ['-xf', archivePath, '-C', destDir], { stdio: ['ignore', 'ignore', 'pipe'] });
+        let stderr = '';
+        child.stderr?.on('data', (d) => { stderr += d.toString(); });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`tar exited ${code}: ${stderr.trim().slice(0, 500)}`));
+        });
+    });
+}
+// In-process single-slot cache so concurrent / StrictMode double-invokes share one
+// extraction instead of racing. Keyed by archive identity; invalidated if it changes.
+let _extractInflight = null;
+/** First archive that exists under `<runtimes>/chromium`, or null. */
+function findBundledArchive(runtimesPath) {
+    for (const name of ARCHIVE_NAMES) {
+        const p = path_1.default.join(runtimesPath, 'chromium', name);
+        if (isFile(p))
+            return p;
+    }
+    return null;
+}
+async function extractAndDiscover(archivePath, identity) {
+    const destRoot = chromiumCacheDir();
+    const marker = path_1.default.join(destRoot, '.source');
+    // Fast path: already extracted from this exact archive.
+    try {
+        if (fs_1.default.readFileSync(marker, 'utf8') === identity) {
+            const exe = discoverChromiumExecutable(destRoot);
+            if (exe)
+                return exe;
+        }
+    }
+    catch { /* not yet extracted / stale → fall through */ }
+    // Extract to a temp sibling, then atomically swap in.
+    const tmpDir = `${destRoot}.tmp-${process.pid}`;
+    fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+    fs_1.default.mkdirSync(tmpDir, { recursive: true });
+    // An obfuscated `.pak` is XOR-decoded to a real `.tar.gz` first; plain archives
+    // are fed straight to tar.
+    const isPak = archivePath.endsWith('.pak');
+    const decodedTar = isPak ? `${tmpDir}.tar.gz` : null;
+    try {
+        let tarSource = archivePath;
+        if (decodedTar) {
+            await deobfuscate(archivePath, decodedTar);
+            tarSource = decodedTar;
+        }
+        await runTarExtract(tarSource, tmpDir);
+        const exeInTmp = discoverChromiumExecutable(tmpDir);
+        if (!exeInTmp)
+            throw new Error('no chromium executable found after extraction');
+        try {
+            fs_1.default.chmodSync(exeInTmp, 0o755);
+        }
+        catch { /* perms best-effort */ }
+        fs_1.default.rmSync(destRoot, { recursive: true, force: true });
+        fs_1.default.mkdirSync(path_1.default.dirname(destRoot), { recursive: true });
+        fs_1.default.renameSync(tmpDir, destRoot);
+        fs_1.default.writeFileSync(marker, identity);
+        return discoverChromiumExecutable(destRoot);
+    }
+    finally {
+        fs_1.default.rmSync(tmpDir, { recursive: true, force: true });
+        if (decodedTar)
+            fs_1.default.rmSync(decodedTar, { force: true });
+    }
+}
+/**
+ * Resolve the bundled Chromium executable for the launch path, extracting the
+ * shipped archive on first use. Returns `null` (never throws) when not in desktop
+ * mode, when no bundle is present, or when extraction fails — so Playwright falls
+ * back to its managed browser rather than dead-ending.
+ */
+async function resolveBundledChromiumExecutable() {
+    if (process.env.SPECRAILS_IS_DESKTOP !== '1')
+        return null;
+    const runtimesPath = process.env.SPECRAILS_BUNDLED_RUNTIMES_PATH;
+    if (!runtimesPath)
+        return null;
+    let archivePath = null;
+    try {
+        archivePath = findBundledArchive(runtimesPath);
+    }
+    catch {
+        archivePath = null;
+    }
+    // No archive shipped → fall back to an unpacked tree (local/dev builds).
+    if (!archivePath)
+        return resolveBundledChromiumPath();
+    let identity;
+    try {
+        identity = archiveIdentity(archivePath);
+    }
+    catch {
+        return resolveBundledChromiumPath();
+    }
+    if (_extractInflight && _extractInflight.identity === identity) {
+        return _extractInflight.promise;
+    }
+    const promise = extractAndDiscover(archivePath, identity).catch((err) => {
+        console.error('[chromium-resolver] extraction failed:', err instanceof Error ? err.message : err);
+        _extractInflight = null; // allow a later retry
+        return resolveBundledChromiumPath();
+    });
+    _extractInflight = { identity, promise };
+    return promise;
+}