stim 1.25.0 → 1.26.0

package/dist/apk-signed-tail-B46U9hXc.mjs

@@ -0,0 +1,142 @@
+import { y as sharedBuildCache } from "./workspace-state-pUg3_RRA.mjs";
+import { E as findBuildTool } from "./android-DTAcRwBC.mjs";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, fstatSync, openSync, readFileSync, readSync, realpathSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { writeFile } from "node:fs/promises";
+//#region src/engine/apk-signed-tail.ts
+const SIGNED_TAIL_FILE = "apk-signed-tail.json";
+const EOCD_SIGNATURE = 101010256;
+const EOCD_MIN_BYTES = 22;
+const EOCD_SEARCH_BYTES = 65557;
+const SIGNING_BLOCK_FOOTER_BYTES = 24;
+const SIGNING_BLOCK_MAGIC = "APK Sig Block 42";
+const SIGNATURE_SCHEME_IDS = /* @__PURE__ */ new Set([1896449818, 4031998144]);
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const VERIFIED_V2_OR_V3 = /^Verified using v[23] scheme \(APK Signature Scheme v[23]\): true\s*$/m;
+/**
+* The offset where an APK's v2 or v3 signing block starts, or null when the file has no such block, is ZIP64, or is
+* malformed. https://source.android.com/docs/security/features/apksigning/v2#apk-signing-block
+*/
+function signingBlockOffset(size, read) {
+	if (size < EOCD_MIN_BYTES) return null;
+	const searched = Math.min(size, EOCD_SEARCH_BYTES);
+	const end = read(size - searched, searched);
+	let eocd = -1;
+	for (let i = end.length - EOCD_MIN_BYTES; i >= 0; i--) if (end.readUInt32LE(i) === EOCD_SIGNATURE && i + EOCD_MIN_BYTES + end.readUInt16LE(i + 20) === end.length) {
+		eocd = i;
+		break;
+	}
+	if (eocd < 0) return null;
+	const directoryOffset = end.readUInt32LE(eocd + 16);
+	if (directoryOffset === 4294967295 || directoryOffset < 32) return null;
+	const footer = read(directoryOffset - SIGNING_BLOCK_FOOTER_BYTES, SIGNING_BLOCK_FOOTER_BYTES);
+	if (footer.subarray(8).toString("latin1") !== SIGNING_BLOCK_MAGIC) return null;
+	const blockSize = footer.readBigUInt64LE(0);
+	if (blockSize < BigInt(SIGNING_BLOCK_FOOTER_BYTES) || blockSize + 8n > BigInt(directoryOffset)) return null;
+	const start = directoryOffset - Number(blockSize) - 8;
+	const pairs = read(start, Number(blockSize) + 8 - SIGNING_BLOCK_FOOTER_BYTES);
+	if (pairs.readBigUInt64LE(0) !== blockSize) return null;
+	let position = 8;
+	while (position + 12 <= pairs.length) {
+		const length = pairs.readBigUInt64LE(position);
+		if (length < 4n || length > BigInt(pairs.length - position - 8)) return null;
+		if (SIGNATURE_SCHEME_IDS.has(pairs.readUInt32LE(position + 8))) return start;
+		position += 8 + Number(length);
+	}
+	return null;
+}
+function readSignedTail(apkPath) {
+	let fd = null;
+	try {
+		fd = openSync(apkPath, "r");
+		const open = fd;
+		const size = fstatSync(open).size;
+		const read = (position, length) => {
+			const buffer = Buffer.alloc(length);
+			if (readSync(open, buffer, 0, length, position) !== length) throw new Error("short read");
+			return buffer;
+		};
+		const tailOffset = signingBlockOffset(size, read);
+		if (tailOffset === null) return null;
+		const tailSha256 = createHash("sha256").update(read(tailOffset, size - tailOffset)).digest("hex");
+		return {
+			file: basename(apkPath),
+			size,
+			tailOffset,
+			tailSha256
+		};
+	} catch {
+		return null;
+	} finally {
+		if (fd !== null) try {
+			closeSync(fd);
+		} catch {}
+	}
+}
+const apksignerPath = () => findBuildTool(["apksigner"])?.path ?? null;
+async function computeSignedTail(apkPath, run, findSigner = apksignerPath) {
+	const tail = readSignedTail(apkPath);
+	if (!tail) return null;
+	const signer = findSigner();
+	if (!signer) return null;
+	try {
+		if (!VERIFIED_V2_OR_V3.test(String(await run(signer, [
+			"verify",
+			"--verbose",
+			apkPath
+		])))) return null;
+	} catch {
+		return null;
+	}
+	const after = readSignedTail(apkPath);
+	return after && after.size === tail.size && after.tailSha256 === tail.tailSha256 ? tail : null;
+}
+function recordedSignedTail(apkPath) {
+	try {
+		const parsed = JSON.parse(readFileSync(join(dirname(apkPath), SIGNED_TAIL_FILE), "utf-8"));
+		if (!parsed || typeof parsed !== "object" || !("file" in parsed) || !("size" in parsed) || !("tailOffset" in parsed) || !("tailSha256" in parsed)) return null;
+		const { file, size, tailOffset, tailSha256 } = parsed;
+		if (file !== basename(apkPath) || typeof size !== "number" || typeof tailOffset !== "number" || typeof tailSha256 !== "string" || !SHA256_HEX.test(tailSha256) || !Number.isSafeInteger(size) || !Number.isSafeInteger(tailOffset) || tailOffset < 0 || tailOffset >= size) return null;
+		const current = readSignedTail(apkPath);
+		if (!current || current.size !== size || current.tailOffset !== tailOffset || current.tailSha256 !== tailSha256) return null;
+		return {
+			file,
+			size,
+			tailOffset,
+			tailSha256
+		};
+	} catch {
+		return null;
+	}
+}
+async function writeSignedTail(dir, tail) {
+	const target = join(dir, SIGNED_TAIL_FILE);
+	const temporary = `${target}.${randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, JSON.stringify(tail));
+		renameSync(temporary, target);
+	} catch (error) {
+		rmSync(temporary, { force: true });
+		throw error;
+	}
+}
+function inBuildCacheEntry(apkPath) {
+	try {
+		return realpathSync(dirname(dirname(apkPath))) === realpathSync(join(sharedBuildCache(), "android"));
+	} catch {
+		return false;
+	}
+}
+async function signedTailFor(apkPath, run, findSigner) {
+	const recorded = recordedSignedTail(apkPath);
+	if (recorded || !inBuildCacheEntry(apkPath)) return recorded;
+	const computed = await computeSignedTail(apkPath, run, findSigner);
+	if (!computed) return null;
+	try {
+		await writeSignedTail(dirname(apkPath), computed);
+	} catch {}
+	return computed;
+}
+//#endregion
+export { signedTailFor as n, writeSignedTail as r, computeSignedTail as t };

package/dist/{artifact-Co8zixVx.mjs → artifact-BxREhAaV.mjs}

@@ -1,17 +1,17 @@
 import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir } from "./paths-DQtTgsBf.mjs";
-import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BBvS1H6v.mjs";
-import { Bn as RESOLVE_TIMEOUT_MS, Gn as isEasAuthFailureText, Wn as easAuthNote } from "./budget-HyShrIpL.mjs";
-import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-D5OJsGwA.mjs";
-import { g as providerDownloadPath, h as prepareProviderDownloadDir } from "./build-cache-CKCzxzxA.mjs";
-import { n as CCACHE_UNAVAILABLE, r as ccacheActivityLine, t as CCACHE_NOT_RUN } from "./ccache-h1FKhZeg.mjs";
-import { c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText } from "./client-BQsmyp_-.mjs";
-import { i as namedBuildMachine, o as requireLocalBuild, r as fingerprintMismatchRemedy, t as OffloadRefusal } from "./selection-D5cxEl3t.mjs";
-import { f as formatDiagnostic } from "./react-native-build-CwZB-agu.mjs";
-import { u as skippedMissReason } from "./prebuild-JUaqOLpc.mjs";
-import { t as buildPlacementRecord } from "./placement-log-DjOXJRIH.mjs";
-import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-zA4S7RHE.mjs";
-import { a as PLATFORM, h as displayPath } from "./support-Cxj9CmII.mjs";
+import { E as workspaceDir } from "./workspace-state-pUg3_RRA.mjs";
+import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BF5AR2dL.mjs";
+import { Jn as easAuthNote, Wn as RESOLVE_TIMEOUT_MS, Yn as isEasAuthFailureText } from "./budget-k2mZGvvk.mjs";
+import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-BfIDFKLH.mjs";
+import { v as prepareProviderDownloadDir, y as providerDownloadPath } from "./build-cache-DrXNCy3T.mjs";
+import { n as CCACHE_UNAVAILABLE, r as ccacheActivityLine, t as CCACHE_NOT_RUN } from "./ccache-Bx5TbxwG.mjs";
+import { c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText } from "./client-D9CaRks-.mjs";
+import { i as namedBuildMachine, r as fingerprintMismatchRemedy, s as requireLocalBuild, t as OffloadRefusal } from "./selection-BNPBZ6T5.mjs";
+import { f as formatDiagnostic } from "./react-native-build-oNwqF5Wb.mjs";
+import { u as skippedMissReason } from "./prebuild-gmouvmJZ.mjs";
+import { t as buildPlacementRecord } from "./placement-log-DIFPQAXp.mjs";
+import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-DVsvSwf7.mjs";
+import { a as PLATFORM, h as displayPath } from "./support-BGSCBoib.mjs";
 import { t as AndroidRecipeRefusal } from "./android-project-BCAAmMwz.mjs";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
@@ -780,11 +780,14 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			now
 		}
 	});
-	if (!acquired.ok) return {
-		ok: false,
-		failure: acquired.failure,
-		ccache: ccacheActivity
-	};
+	if (!acquired.ok) {
+		recipe.fingerprintCheck?.()?.cancel();
+		return {
+			ok: false,
+			failure: acquired.failure,
+			ccache: ccacheActivity
+		};
+	}
 	return {
 		ok: true,
 		artifact: {
@@ -792,7 +795,9 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			handoff,
 			androidPackage,
 			apkPackage: record.cacheHit && storeKey ? entryAppId(PLATFORM, storeKey) : null,
+			fingerprintCheck: recipe.fingerprintCheck?.() ?? null,
 			release: async () => {
+				recipe.fingerprintCheck?.()?.cancel();
 				await settleArtifactUploads(providerUpload, uploadPending);
 				acquired.release();
 			},

package/dist/{artifact-DN8JNwqS.mjs → artifact-CsAP6AGK.mjs}

@@ -1,17 +1,17 @@
 import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir } from "./paths-DQtTgsBf.mjs";
-import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BBvS1H6v.mjs";
-import { Bn as RESOLVE_TIMEOUT_MS, Gn as isEasAuthFailureText, Wn as easAuthNote } from "./budget-HyShrIpL.mjs";
-import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-D5OJsGwA.mjs";
-import { _ as providerUploadOutcome, g as providerDownloadPath, h as prepareProviderDownloadDir, x as storedAppId } from "./build-cache-CKCzxzxA.mjs";
-import { o as compilationCacheActivityLine, t as COMPILATION_CACHE_NOT_RUN } from "./xcode-CiIIDnuD.mjs";
-import { C as COMPILATION_CACHE_CORRUPT, c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText, w as clearCorruptCompilationCache } from "./client-BQsmyp_-.mjs";
-import { i as namedBuildMachine, o as requireLocalBuild, r as fingerprintMismatchRemedy, t as OffloadRefusal } from "./selection-D5cxEl3t.mjs";
-import { S as xcodeFailureReport, p as printDiagnostics } from "./support-qKcbgmI5.mjs";
-import { u as skippedMissReason } from "./prebuild-JUaqOLpc.mjs";
-import { t as buildPlacementRecord } from "./placement-log-DjOXJRIH.mjs";
-import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-zA4S7RHE.mjs";
-import { r as finishIosUpload, t as IosRecipeRefusal } from "./ios-project-DCUDo06I.mjs";
+import { E as workspaceDir } from "./workspace-state-pUg3_RRA.mjs";
+import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BF5AR2dL.mjs";
+import { Jn as easAuthNote, Wn as RESOLVE_TIMEOUT_MS, Yn as isEasAuthFailureText } from "./budget-k2mZGvvk.mjs";
+import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-BfIDFKLH.mjs";
+import { b as providerUploadOutcome, v as prepareProviderDownloadDir, w as storedAppId, y as providerDownloadPath } from "./build-cache-DrXNCy3T.mjs";
+import { P as compilationCacheActivityLine, k as COMPILATION_CACHE_NOT_RUN } from "./toolchain-J4J8MrAr.mjs";
+import { C as COMPILATION_CACHE_CORRUPT, c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, s as offloadCheck, u as remotePhaseText, w as clearCorruptCompilationCache } from "./client-D9CaRks-.mjs";
+import { i as namedBuildMachine, o as podsFailedRemedy, p as predictedRefusal, r as fingerprintMismatchRemedy, s as requireLocalBuild, t as OffloadRefusal } from "./selection-BNPBZ6T5.mjs";
+import { S as xcodeFailureReport, p as printDiagnostics } from "./support-CVOCp0Ft.mjs";
+import { f as settleFingerprintCheck, u as skippedMissReason } from "./prebuild-gmouvmJZ.mjs";
+import { t as buildPlacementRecord } from "./placement-log-DIFPQAXp.mjs";
+import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-DVsvSwf7.mjs";
+import { r as finishIosUpload, t as IosRecipeRefusal } from "./ios-project-Ty5pHl9O.mjs";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { machineCapacity } from "@stim-cli/core/state";
@@ -354,6 +354,13 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			if (mode !== "off") phase("build", `placement: here (${placement.reason})`);
 			return null;
 		}
+		const named = machines.find((each) => each.machine === buildMachine);
+		const offload = recipe.offload;
+		if (placement.code === "named" && named && offload && runtime) {
+			const { problems } = await offloadCheck(root, async () => [await offload.target(runtime)])(named);
+			const predicted = predictedRefusal(buildMachine, problems);
+			if (predicted) throw new OffloadRefusal(buildMachine, predicted.reason, predicted.remedy);
+		}
 		return {
 			cacheOnly: false,
 			mode,
@@ -364,14 +371,17 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			machines
 		};
 	}
+	let localCocoapods = null;
 	/** Asks the paired machines once the post-mutation key is known; null builds here. */
 	async function chooseMachine(candidate) {
 		const offload = recipe.offload;
 		if (!offload) return null;
 		let asked = [];
+		const target = await offload.target(candidate.runtime);
+		localCocoapods = target.platform === "ios" ? target.local.cocoapods : null;
 		const choice = await chooseBuildMachine({
 			projectRoot: root,
-			target: await offload.target(candidate.runtime),
+			target,
 			mode: candidate.mode,
 			here: candidate.here,
 			note: (line) => note(chalk.dim(phaseLine("build", `offload: ${line}`))),
@@ -484,7 +494,7 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			fallBack(`${choice.machine}: ${why}`, `offload failed: ${why}`, {
 				code: corrupt === void 0 ? "offload-failed" : COMPILATION_CACHE_CORRUPT,
 				machine: choice.machine,
-				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason)
+				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason) ?? podsFailedRemedy(choice.machine, outcome.reason, localCocoapods)
 			});
 			logWriter().write({
 				src: "build",
@@ -778,11 +788,14 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 		logFile,
 		deps: d
 	});
-	if (!acquired.ok) return {
-		ok: false,
-		failure: acquired.failure,
-		compilationCache
-	};
+	if (!acquired.ok) {
+		recipe.fingerprintCheck?.()?.cancel();
+		return {
+			ok: false,
+			failure: acquired.failure,
+			compilationCache
+		};
+	}
 	appPath = acquired.artifact;
 	return {
 		ok: true,
@@ -822,8 +835,10 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 					if (outcome.warn) note(chalk.yellow(phaseLine("cache", outcome.line)));
 					else phase("cache", outcome.line);
 				}
+				await settleFingerprintCheck(recipe.fingerprintCheck?.() ?? null, "ios", (line) => note(chalk.yellow(phaseLine("fingerprint", line))), (record) => logWriter().write(record));
 				return abandonedRemote || uploadWasAbandoned;
 			},
+			cancelFingerprintCheck: () => recipe.fingerprintCheck?.()?.cancel(),
 			release: async () => {
 				await settleArtifactUploads(providerUpload, uploadPending);
 				acquired.release();

package/dist/{attempt-DW-mQqM7.mjs → attempt-ClyJlZPT.mjs}

@@ -10,13 +10,15 @@ function due(state, settings, now, attemptedAt) {
 		pressure: settings.pressureCheckMinutes * 6e4,
 		size: settings.sizeCheckMinutes * 6e4,
 		worktree: settings.removeFinishedWorktrees ? settings.worktreeCheckMinutes * 6e4 : Infinity,
-		sweep: settings.sweepHours > 0 ? settings.sweepHours * 36e5 : Infinity
+		sweep: settings.sweepHours > 0 ? settings.sweepHours * 36e5 : Infinity,
+		idle: settings.idleCheckMinutes * 6e4
 	};
 	return [
 		"pressure",
 		"size",
 		"worktree",
-		"sweep"
+		"sweep",
+		"idle"
 	].filter((check) => {
 		if (intervalMs[check] === Infinity || elapsed(state?.deferredAt?.[check]) < DEFERRED_RETRY_MS) return false;
 		return elapsed(state?.lastAt[check]) >= intervalMs[check];

package/dist/{browser-web-CCgZsHmI.mjs → browser-web-rYPyqhTf.mjs}

@@ -1,18 +1,17 @@
 import { D as ownership_claim_exports, S as process_identity_exports, c as throwIfCancelled, l as WorkspaceProcessCleanupError, s as cancelledError, t as getExecutor, u as withWorkspaceProcessLock } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir, m as workspaceLogsDir$1 } from "./paths-DQtTgsBf.mjs";
-import { p as getProject } from "./config-BZhXY15H.mjs";
-import { l as phaseLine } from "./command-output-BBvS1H6v.mjs";
-import { l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-CPSp3mav.mjs";
-import { M as metroPortSetting, a as SETTING_SHAPE_REMEDY, ot as webSettings } from "./settings-B5tCoq9N.mjs";
-import { b as isPackageResolvable, v as detectIsExpo } from "./project-BiC68mIp.mjs";
-import { d as resolveProjectMetro } from "./metro-1pJgCX4U.mjs";
+import { E as workspaceDir, k as workspaceLogsDir$1, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-pUg3_RRA.mjs";
+import { p as getProject } from "./config-BktkY_zC.mjs";
+import { l as phaseLine } from "./command-output-BF5AR2dL.mjs";
+import { M as metroPortSetting, a as SETTING_SHAPE_REMEDY, ot as webSettings } from "./settings-CosW5X-S.mjs";
+import { b as isPackageResolvable, v as detectIsExpo } from "./project-BUu6Is4k.mjs";
+import { d as resolveProjectMetro } from "./metro-CjC10t6E.mjs";
 import { s as readNdjsonGenerations$1 } from "./ndjson-CgE_o3Dl.mjs";
-import { f as webLogFile, m as webSupervisorLogFile, o as readWebRecord, s as updateWebRecord } from "./state-DMRNP7-4.mjs";
-import { rn as readMetroRecords } from "./budget-HyShrIpL.mjs";
-import { D as teardownBrowserHeld, g as resolveSupervisorTarget } from "./workspaces-C9w4aeXF.mjs";
-import { i as reserveBrowserPort, n as getNamedPort } from "./named-ports-BVbn8SvC.mjs";
+import { f as webLogFile, m as webSupervisorLogFile, o as readWebRecord, s as updateWebRecord } from "./state-C1i2nMOP.mjs";
+import { sn as readMetroRecords } from "./budget-k2mZGvvk.mjs";
+import { D as teardownBrowserHeld, g as resolveSupervisorTarget } from "./workspaces-g2lhdBXF.mjs";
+import { i as reserveBrowserPort, n as getNamedPort } from "./named-ports-BG0j1X4g.mjs";
 import { n as sendToOwnedPage, t as liveWebRecord } from "./page-CzEA_-5_.mjs";
-import { o as resolveWorkspaceMetroPort } from "./start-YMpNwLhh.mjs";
+import { o as resolveWorkspaceMetroPort } from "./start-_BdJ32cZ.mjs";
 import { t as spawnEntry } from "./spawn-entry-jw19m8Nl.mjs";
 import { n as windowsLauncherArgs } from "./detached-entry-KmieOKgN.mjs";
 import { a as findChrome, t as CHROME_INSTALL_REMEDY } from "./chrome-BvV8ssI3.mjs";