amosblomqvist
8cb5e14691
- desktop:dist cleans dist/ + .next/standalone before next build: the trace sweep was shipping the PREVIOUS build's DMG inside every new one (standalone/dist = 8.0GB inside the app; measured 7.4GB DMG → 144MB). - the same sweep shipped the repo-root auth.json (dev BYOK keys, byte-identical) in every DMG ever built — excluded in the trace and REFUSED by a new build-server.mjs guard (.env* belt-and-braces). - WARNING (next.config.ts): dir-style trace excludes (dist/** etc., "./"-anchored or not) strip server-external packages to bare package.jsons — pi-ai/pi-agent-core lost their dist/, the packaged server 500'd on ERR_MODULE_NOT_FOUND. Only the three verified-safe entries stay. - new scripts/smoke-server.mjs gates desktop:dist between payload curation and packaging: boots the standalone exactly as the Electron shell does (temp LH_DATA_DIR, empty auth) and requires 200s on / + graph/models/settings. Caught both defects above on its first day. - entitlements: allow-unsigned-executable-memory dropped (2019-era relic per current electron-builder docs; weakens hardened runtime). - pi-ai + pi-agent-core pinned exact 1.0.2 — persisted chat records carry their wire shapes; post-release a bump is a migration event. Gates: typecheck, lint, 1459/1459 tests, full desktop:dist + smoke PASS.
73 lines
2.9 KiB
JavaScript
73 lines
2.9 KiB
JavaScript
/**
|
|
* build-server.mjs — curate the Electron shell's server payload.
|
|
*
|
|
* `next build` (output: "standalone") produces .next/standalone/ with
|
|
* server.js + the traced node_modules subset, but leaves two pieces
|
|
* outside that the docs require us to copy: public/ and .next/static/.
|
|
* This script finishes the job and sanity-checks the result — including
|
|
* the exclusion that keeps the repo's real data/ OUT of the bundle
|
|
* (see next.config.ts outputFileTracingExcludes).
|
|
*/
|
|
import * as fs from "node:fs";
|
|
import * as path from "node:path";
|
|
|
|
const ROOT = path.resolve(import.meta.dirname, "..");
|
|
const STANDALONE = path.join(ROOT, ".next", "standalone");
|
|
|
|
const copyTree = (from, to) => {
|
|
fs.cpSync(from, to, { recursive: true });
|
|
};
|
|
|
|
const exists = (p) => fs.existsSync(p);
|
|
|
|
if (!exists(path.join(STANDALONE, "server.js"))) {
|
|
console.error("[build-server] .next/standalone/server.js missing — run `next build` first (output: 'standalone').");
|
|
process.exit(1);
|
|
}
|
|
|
|
// 1) Static assets: public/ → standalone/public, .next/static → standalone/.next/static
|
|
const staticFrom = path.join(ROOT, ".next", "static");
|
|
const staticTo = path.join(STANDALONE, ".next", "static");
|
|
if (!exists(staticFrom)) {
|
|
console.error("[build-server] .next/static missing — the build looks incomplete.");
|
|
process.exit(1);
|
|
}
|
|
copyTree(staticFrom, staticTo);
|
|
if (exists(path.join(ROOT, "public"))) {
|
|
copyTree(path.join(ROOT, "public"), path.join(STANDALONE, "public"));
|
|
}
|
|
|
|
// 2) Safety: the repo's real data/ must NEVER ride along in the bundle.
|
|
const leakedData = path.join(STANDALONE, "data");
|
|
if (exists(leakedData)) {
|
|
console.error("[build-server] REFUSING: standalone contains a data/ directory — repo session data would ship in the app.");
|
|
console.error(" Check outputFileTracingExcludes in next.config.ts.");
|
|
process.exit(1);
|
|
}
|
|
|
|
// 2b) Safety: the repo's dev SECRETS must never ride along either — the
|
|
// same trace sweep that catches data/ shipped the repo-root auth.json
|
|
// (the DEV BYOK key store, 0600) byte-identical into the DMG (caught in
|
|
// the 2026-10-08 payload audit; excluded in next.config.ts — this guard
|
|
// makes a regression loud instead of silent).
|
|
for (const secret of ["auth.json", ".env", ".env.local"]) {
|
|
if (exists(path.join(STANDALONE, secret))) {
|
|
console.error(`[build-server] REFUSING: standalone contains ${secret} — dev secrets would ship in the app.`);
|
|
console.error(" Check outputFileTracingExcludes in next.config.ts.");
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
// 3) Sanity: the runtime-read prompt assets must be present (the teacher
|
|
// agent reads them from disk at request time).
|
|
for (const asset of [
|
|
path.join("src", "agent", "system-prompt.md"),
|
|
path.join("src", "agent", "prompts", "teacher", "20-teaching.md"),
|
|
]) {
|
|
if (!exists(path.join(STANDALONE, asset))) {
|
|
console.error(`[build-server] prompt asset missing from the trace: ${asset}`);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
console.log("[build-server] server payload ready:", STANDALONE); |