-
Notifications
You must be signed in to change notification settings - Fork 133
fix: [#1052] bundled cleanup — 5 deferred items + 3 review-fixes #1085
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
59cae82
7b945a3
4f92ed7
78e8287
b73fdc9
3b947f5
c237795
977e207
630accd
5b30a30
d2c2cd6
cafdcf4
dca7360
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,3 +18,7 @@ if (process.versions.bun !== expectedBunVersion) { | |
| } | ||
| ' | ||
| bun typecheck | ||
| # altimate_change — #1052 D8: scan pushed content for internal-tracker refs | ||
| # (see RULES in the script for the specific patterns). Silent on clean; | ||
| # exits 1 on hit. Bypass with SKIP_TRACKER_CHECK=1 for genuine emergencies. | ||
| bun script/check-tracker-leaks.ts | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P2: The guard silently disables itself when the local base ref is missing: check-tracker-leaks.ts computes base from a hardcoded local Prompt for AI agents |
||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -6,6 +6,8 @@ import path from "path" | |||||
| import { fileURLToPath } from "url" | ||||||
| import { createRequire } from "node:module" | ||||||
| import solidPlugin from "@opentui/solid/bun-plugin" | ||||||
| // altimate_change — #1052 D10: sha256 for the per-target build-inputs stamp. | ||||||
| import { createHash } from "node:crypto" | ||||||
|
|
||||||
| const __filename = fileURLToPath(import.meta.url) | ||||||
| const __dirname = path.dirname(__filename) | ||||||
|
|
@@ -15,6 +17,7 @@ process.chdir(dir) | |||||
|
|
||||||
| import { Script } from "@opencode-ai/script" | ||||||
| import pkg from "../package.json" | ||||||
| import { walkInputs } from "./stamp-inputs" | ||||||
|
|
||||||
| // Python engine has been eliminated — all methods run natively in TypeScript. | ||||||
| // ALTIMATE_ENGINE_VERSION is no longer needed at runtime. | ||||||
|
|
@@ -145,43 +148,49 @@ const allTargets: { | |||||
| ] | ||||||
|
|
||||||
| // If --targets is provided, filter to only matching OS values | ||||||
| const validOsValues = new Set(allTargets.map(t => t.os)) | ||||||
| const targetsFlag = process.argv.find(a => a.startsWith('--targets='))?.split('=')[1]?.split(',') | ||||||
| const validOsValues = new Set(allTargets.map((t) => t.os)) | ||||||
| const targetsFlag = process.argv | ||||||
| .find((a) => a.startsWith("--targets=")) | ||||||
| ?.split("=")[1] | ||||||
| ?.split(",") | ||||||
| if (targetsFlag) { | ||||||
| const invalid = targetsFlag.filter(t => !validOsValues.has(t)) | ||||||
| const invalid = targetsFlag.filter((t) => !validOsValues.has(t)) | ||||||
| if (invalid.length > 0) { | ||||||
| console.error(`error: invalid --targets value(s): ${invalid.join(', ')}. Valid values: ${[...validOsValues].join(', ')}`) | ||||||
| console.error( | ||||||
| `error: invalid --targets value(s): ${invalid.join(", ")}. Valid values: ${[...validOsValues].join(", ")}`, | ||||||
| ) | ||||||
| process.exit(1) | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| // --target-index=N builds a single target by index (for parallel CI matrix) | ||||||
| const targetIndexFlag = process.argv.find(a => a.startsWith('--target-index='))?.split('=')[1] | ||||||
|
|
||||||
| const targets = targetIndexFlag !== undefined | ||||||
| ? [allTargets[parseInt(targetIndexFlag, 10)]].filter(Boolean) | ||||||
| : singleFlag | ||||||
| ? allTargets.filter((item) => { | ||||||
| if (item.os !== process.platform || item.arch !== process.arch) { | ||||||
| return false | ||||||
| } | ||||||
|
|
||||||
| // When building for the current platform, prefer a single native binary by default. | ||||||
| // Baseline binaries require additional Bun artifacts and can be flaky to download. | ||||||
| if (item.avx2 === false) { | ||||||
| return baselineFlag | ||||||
| } | ||||||
|
|
||||||
| // also skip abi-specific builds for the same reason | ||||||
| if (item.abi !== undefined) { | ||||||
| return false | ||||||
| } | ||||||
|
|
||||||
| return true | ||||||
| }) | ||||||
| : targetsFlag | ||||||
| ? allTargets.filter(t => targetsFlag.includes(t.os)) | ||||||
| : allTargets | ||||||
| const targetIndexFlag = process.argv.find((a) => a.startsWith("--target-index="))?.split("=")[1] | ||||||
|
|
||||||
| const targets = | ||||||
| targetIndexFlag !== undefined | ||||||
| ? [allTargets[parseInt(targetIndexFlag, 10)]].filter(Boolean) | ||||||
| : singleFlag | ||||||
| ? allTargets.filter((item) => { | ||||||
| if (item.os !== process.platform || item.arch !== process.arch) { | ||||||
| return false | ||||||
| } | ||||||
|
|
||||||
| // When building for the current platform, prefer a single native binary by default. | ||||||
| // Baseline binaries require additional Bun artifacts and can be flaky to download. | ||||||
| if (item.avx2 === false) { | ||||||
| return baselineFlag | ||||||
| } | ||||||
|
|
||||||
| // also skip abi-specific builds for the same reason | ||||||
| if (item.abi !== undefined) { | ||||||
| return false | ||||||
| } | ||||||
|
|
||||||
| return true | ||||||
| }) | ||||||
| : targetsFlag | ||||||
| ? allTargets.filter((t) => targetsFlag.includes(t.os)) | ||||||
| : allTargets | ||||||
|
|
||||||
| // Defense in depth: refuse to produce no artifacts at all, and refuse to build | ||||||
| // the glibc target on a musl host where the binary would crash at startup. | ||||||
|
|
@@ -194,13 +203,14 @@ const targets = targetIndexFlag !== undefined | |||||
| // `linux-x64` (glibc), produces a glibc binary that the musl host can't | ||||||
| // load, and dies later with a cryptic linker error. | ||||||
| if (targets.length === 0) { | ||||||
| const reason = targetIndexFlag !== undefined | ||||||
| ? `--target-index=${targetIndexFlag} is out of range (allTargets has ${allTargets.length} entries — musl/win32-arm64 were removed).` | ||||||
| : singleFlag | ||||||
| ? `--single found no entry in allTargets matching ${process.platform}/${process.arch} (host may be excluded — see allTargets at the top of build.ts).` | ||||||
| : targetsFlag | ||||||
| ? `--targets=${targetsFlag.join(",")} matched nothing in allTargets.` | ||||||
| : "allTargets is empty." | ||||||
| const reason = | ||||||
| targetIndexFlag !== undefined | ||||||
| ? `--target-index=${targetIndexFlag} is out of range (allTargets has ${allTargets.length} entries — musl/win32-arm64 were removed).` | ||||||
| : singleFlag | ||||||
| ? `--single found no entry in allTargets matching ${process.platform}/${process.arch} (host may be excluded — see allTargets at the top of build.ts).` | ||||||
| : targetsFlag | ||||||
| ? `--targets=${targetsFlag.join(",")} matched nothing in allTargets.` | ||||||
| : "allTargets is empty." | ||||||
| console.error(`error: no build targets selected. ${reason}`) | ||||||
| process.exit(1) | ||||||
| } | ||||||
|
|
@@ -219,8 +229,12 @@ if (singleFlag && process.platform === "linux") { | |||||
| return false | ||||||
| })() | ||||||
| if (isMuslHost) { | ||||||
| console.error("error: --single on a musl-linux host would build the glibc target and produce a binary the host cannot run.") | ||||||
| console.error(" altimate-core has no NAPI prebuild for musl yet. Build on a glibc host, or install via `apk add gcompat` + the npm wrapper.") | ||||||
| console.error( | ||||||
| "error: --single on a musl-linux host would build the glibc target and produce a binary the host cannot run.", | ||||||
| ) | ||||||
| console.error( | ||||||
| " altimate-core has no NAPI prebuild for musl yet. Build on a glibc host, or install via `apk add gcompat` + the npm wrapper.", | ||||||
| ) | ||||||
| process.exit(1) | ||||||
| } | ||||||
| } | ||||||
|
|
@@ -238,10 +252,18 @@ await $`rm -rf dist` | |||||
| const requiredExternals: string[] = [] | ||||||
| const optionalExternals = [ | ||||||
| // Database drivers — native addons, users install on demand per warehouse | ||||||
| "pg", "snowflake-sdk", "@google-cloud/bigquery", "@databricks/sql", | ||||||
| "mysql2", "mssql", "oracledb", "duckdb", | ||||||
| "pg", | ||||||
| "snowflake-sdk", | ||||||
| "@google-cloud/bigquery", | ||||||
| "@databricks/sql", | ||||||
| "mysql2", | ||||||
| "mssql", | ||||||
| "oracledb", | ||||||
| "duckdb", | ||||||
| // Optional infra packages — native addons or heavy optional deps | ||||||
| "keytar", "ssh2", "dockerode", | ||||||
| "keytar", | ||||||
| "ssh2", | ||||||
| "dockerode", | ||||||
| ] | ||||||
|
|
||||||
| const binaries: Record<string, string> = {} | ||||||
|
|
@@ -265,7 +287,9 @@ function altimateCorePlatformFor(item: { os: string; arch: "arm64" | "x64"; abi? | |||||
| platformTag: string | ||||||
| } { | ||||||
| if (item.abi === "musl") { | ||||||
| throw new Error(`No @altimateai/altimate-core prebuild for linux-${item.arch}-musl; this target should not be in allTargets.`) | ||||||
| throw new Error( | ||||||
| `No @altimateai/altimate-core prebuild for linux-${item.arch}-musl; this target should not be in allTargets.`, | ||||||
| ) | ||||||
| } | ||||||
| if (item.os === "darwin") { | ||||||
| const tag = `darwin-${item.arch}` | ||||||
|
|
@@ -280,7 +304,9 @@ function altimateCorePlatformFor(item: { os: string; arch: "arm64" | "x64"; abi? | |||||
| const tag = "win32-x64-msvc" | ||||||
| return { pkg: `@altimateai/altimate-core-${tag}`, nodeFile: `altimate-core.${tag}.node`, platformTag: tag } | ||||||
| } | ||||||
| throw new Error(`No @altimateai/altimate-core prebuild for win32-${item.arch}; this target should not be in allTargets.`) | ||||||
| throw new Error( | ||||||
| `No @altimateai/altimate-core prebuild for win32-${item.arch}; this target should not be in allTargets.`, | ||||||
| ) | ||||||
| } | ||||||
| throw new Error(`Unsupported build target: ${item.os}-${item.arch}`) | ||||||
| } | ||||||
|
|
@@ -297,9 +323,7 @@ const altimateCoreLoaderDir = fs.realpathSync(path.dirname(altimateCoreLoaderPkg | |||||
| // .node into today's release archive. | ||||||
| { | ||||||
| const expected = pkg.dependencies["@altimateai/altimate-core"] | ||||||
| const resolvedVersion = JSON.parse( | ||||||
| fs.readFileSync(path.join(altimateCoreLoaderDir, "package.json"), "utf8"), | ||||||
| ).version | ||||||
| const resolvedVersion = JSON.parse(fs.readFileSync(path.join(altimateCoreLoaderDir, "package.json"), "utf8")).version | ||||||
| if (resolvedVersion !== expected) { | ||||||
| throw new Error( | ||||||
| `build.ts: resolved @altimateai/altimate-core version ${resolvedVersion} ` + | ||||||
|
|
@@ -523,6 +547,119 @@ for (const item of targets) { | |||||
| 2, | ||||||
| ), | ||||||
| ) | ||||||
|
|
||||||
| // altimate_change start — #1052 D10: emit a build-inputs stamp so the | ||||||
| // smoke-test staleness guard can compare against ALL binary-embedded inputs, | ||||||
| // not just src/ + script/ mtimes. | ||||||
| // | ||||||
| // The previous guard (m5) walked src/ + script/ for the newest mtime — good | ||||||
| // for the common case but blind to changes in CHANGELOG.md, migrations, | ||||||
| // bundled skills, the models.dev snapshot, the parser worker, and the | ||||||
| // per-platform altimate-core prebuild. Editing any of those without touching | ||||||
| // a .ts file would leave the guard silent and the binary silently stale. | ||||||
| // | ||||||
| // Stamp format: JSON with one entry per input, sha256 of file content. Read | ||||||
| // side rehashes each listed path and compares; any mismatch → stale. Paths | ||||||
| // are REPO_ROOT-relative so entries under packages/tui, packages/core, the | ||||||
| // workspace-root package.json, bun.lock, etc. resolve without munging. | ||||||
| const REPO_ROOT = path.resolve(dir, "../..") | ||||||
| const stampInputs: Array<{ path: string; sha256: string }> = [] | ||||||
|
coderabbitai[bot] marked this conversation as resolved.
|
||||||
| const addFile = (absPath: string) => { | ||||||
| try { | ||||||
| const buf = fs.readFileSync(absPath) | ||||||
| const rel = path.relative(REPO_ROOT, absPath) | ||||||
| const hash = createHash("sha256").update(buf).digest("hex") | ||||||
| stampInputs.push({ path: rel, sha256: hash }) | ||||||
| } catch { | ||||||
| // Missing file: silently skip. The stamp only covers what actually | ||||||
| // shipped; a file the build didn't need doesn't invalidate the guard. | ||||||
| } | ||||||
| } | ||||||
| // CHANGELOG.md | ||||||
| addFile(changelogPath) | ||||||
| // Migrations | ||||||
| for (const m of migrationDirs) addFile(path.join(dir, "migration", m, "migration.sql")) | ||||||
| // Skills bundled via .opencode/skills/ | ||||||
| for (const entry of skillEntries) addFile(path.join(skillsRoot, entry.name, "SKILL.md")) | ||||||
| // Generated models snapshot (build.ts rewrote it before we got here) | ||||||
| addFile(path.join(dir, "src/provider/models-snapshot.ts")) | ||||||
| // opentui parser worker | ||||||
| addFile(parserWorker) | ||||||
| // Per-target altimate-core NAPI prebuild | ||||||
| addFile(platformNodeSrc) | ||||||
| // altimate_change — #1052 D10 review-fix (M2): package.json + bun.lock cover | ||||||
| // dependency-version bumps that change what Bun.build embeds. Without these, | ||||||
| // `bun install` bumping a bundled dep would leave the stamp reporting fresh. | ||||||
| // Sibling workspace manifests are added in the packages walk below; this | ||||||
| // package's own manifest is added here, because that walk skips `opencode` | ||||||
| // (its src/ and script/ trees are already covered) and would otherwise leave | ||||||
| // `imports`, `exports` and other bundler-relevant fields unstamped. | ||||||
| addFile(path.join(REPO_ROOT, "package.json")) | ||||||
| addFile(path.join(REPO_ROOT, "bun.lock")) | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [WARNING]:
Reply with |
||||||
| addFile(path.join(dir, "package.json")) | ||||||
| // Also include tsconfig files that affect compiled output shape | ||||||
| // (bot review: tsconfig changes can flip target/moduleResolution). | ||||||
| addFile(path.join(dir, "tsconfig.json")) | ||||||
| // src/ + script/ TypeScript tree — hash every file the compiler actually saw. | ||||||
| // The walk rules live in ./build-inputs so the smoke-test guard can | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [SUGGESTION]: Comment names a module that doesn't exist The shared walk lives in
Suggested change
Reply with |
||||||
| // re-enumerate with identical rules and notice files ADDED after the build. | ||||||
| const walkedRoots: string[] = [] | ||||||
| const walk = (root: string): void => { | ||||||
| if (!fs.existsSync(root)) return | ||||||
| walkedRoots.push(path.relative(REPO_ROOT, root)) | ||||||
| for (const file of walkInputs(root)) addFile(file) | ||||||
|
coderabbitai[bot] marked this conversation as resolved.
|
||||||
| } | ||||||
| walk(path.join(dir, "src")) | ||||||
| walk(path.join(dir, "script")) | ||||||
|
cubic-dev-ai[bot] marked this conversation as resolved.
|
||||||
| // altimate_change — #1052 D10 review-fix (M2): also hash every workspace | ||||||
| // package's src/ tree. `packages/opencode/src` imports from | ||||||
| // `@opencode-ai/{core,tui,util,plugin,sdk,server,cli,...}` and | ||||||
| // `@altimateai/{dbt-tools,drivers}` — Bun.build follows these imports and | ||||||
| // bundles them into the binary transitively. The original stamp walked only | ||||||
| // packages/opencode, so edits under any sibling workspace package would leave | ||||||
| // the binary silently stale. Enumerate `packages/*/src` at build time (rather | ||||||
| // than hard-coding names) so new packages get covered automatically. | ||||||
| const packagesRoot = path.resolve(REPO_ROOT, "packages") | ||||||
| try { | ||||||
| for (const pkg of fs.readdirSync(packagesRoot, { withFileTypes: true })) { | ||||||
| if (!pkg.isDirectory() || pkg.name.startsWith(".")) continue | ||||||
| // Skip packages/opencode — already covered by the walks above. | ||||||
| if (pkg.name === "opencode") continue | ||||||
|
cubic-dev-ai[bot] marked this conversation as resolved.
|
||||||
| const pkgSrc = path.join(packagesRoot, pkg.name, "src") | ||||||
| if (fs.existsSync(pkgSrc)) walk(pkgSrc) | ||||||
| // Each workspace package.json influences its resolution/exports and could | ||||||
| // change what ends up in the binary even when its src/ files are unchanged. | ||||||
| const pkgJson = path.join(packagesRoot, pkg.name, "package.json") | ||||||
| if (fs.existsSync(pkgJson)) addFile(pkgJson) | ||||||
| } | ||||||
| } catch { | ||||||
| // packages/ missing (unlikely at build time) — skip; addFile() ignores non-existent paths anyway. | ||||||
| } | ||||||
| // Deterministic order so the aggregate hash is stable across build runs. | ||||||
| stampInputs.sort((a, b) => a.path.localeCompare(b.path)) | ||||||
| const aggregate = createHash("sha256") | ||||||
| .update(stampInputs.map((i) => `${i.path}\t${i.sha256}`).join("\n")) | ||||||
| .digest("hex") | ||||||
| await Bun.file(`dist/${name}/bin/build-inputs.json`).write( | ||||||
| JSON.stringify( | ||||||
| { | ||||||
| target: name, | ||||||
| version: Script.version, | ||||||
| aggregate, | ||||||
| // Roots the walk covered, so the read side can detect files added after | ||||||
| // the build rather than only rehashing what was present at build time. | ||||||
| roots: [...new Set(walkedRoots)].sort(), | ||||||
| // Glob form so the read side notices a package added AFTER this build; | ||||||
| // concrete roots only describe what existed while it ran. | ||||||
| rootGlobs: ["packages/*/src"], | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P1: When a migration or bundled skill is added after a stamped build, the smoke test reports the binary fresh and can run an artifact that no longer matches the build inputs. Add re-enumeration metadata for every dynamic migration and skill input, or make the stamp fallback stale when those sets cannot be checked. Prompt for AI agentsThere was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [WARNING]: Migrations (line 581) and Reply with |
||||||
| inputs: stampInputs, | ||||||
| }, | ||||||
| null, | ||||||
| 2, | ||||||
| ), | ||||||
| ) | ||||||
| // altimate_change end | ||||||
|
|
||||||
| binaries[name] = Script.version | ||||||
| } | ||||||
|
|
||||||
|
|
||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| // altimate_change start — #1052 D10 bot-review fix: shared build-input walk. | ||
| // | ||
| // The build stamp and the smoke-test staleness guard have to agree on exactly | ||
| // which files count as a build input. When the walk lived only inside build.ts, | ||
| // the guard could rehash the paths the stamp listed but had no way to notice a | ||
| // file ADDED after the build — a new module under any walked root left the | ||
| // binary stale while the guard stayed silent. Sharing the walk lets the guard | ||
| // re-enumerate with identical rules and compare sets, not just hashes. | ||
| import fs from "fs" | ||
| import path from "path" | ||
|
|
||
| /** Directories never part of a build input set. */ | ||
| export const IGNORED_DIRS = new Set(["node_modules", ".turbo", ".cache", "dist", "target"]) | ||
|
|
||
| /** | ||
| * Extensions Bun.build can pull into the binary from a walked source tree. | ||
| * `.mp3` is here because packages/tui imports its attention sounds with | ||
| * `{ type: "file" }`, so a changed or added sound is embedded in the binary and | ||
| * must invalidate the stamp like any source edit. | ||
| */ | ||
| export const INPUT_EXTENSIONS = /\.(tsx?|json|txt|md|mp3)$/ | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Keep the mtime fallback input matcher aligned. Line 21 adds Use Proposed fix-import { walkInputs } from "../../script/stamp-inputs"
+import { INPUT_EXTENSIONS, walkInputs } from "../../script/stamp-inputs"
- if (!/\.(tsx?|json|txt|md)$/.test(entry.name)) continue
+ if (!INPUT_EXTENSIONS.test(entry.name)) continue🤖 Prompt for AI AgentsThere was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P2: When a bundled workspace adds or edits a JavaScript or WASM asset under a walked Prompt for AI agentsThere was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P2: When the stamp is missing or invalid, the mtime fallback ignores Prompt for AI agentsThere was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [SUGGESTION]: Adding
Reply with |
||
|
|
||
| /** | ||
| * Absolute paths of every input file under `root`, applying the shared rules. | ||
| * Missing roots yield an empty list — callers treat that as "nothing to add". | ||
| */ | ||
| export function walkInputs(root: string): string[] { | ||
| const found: string[] = [] | ||
| const walk = (current: string): void => { | ||
| let entries: fs.Dirent[] | ||
| try { | ||
| entries = fs.readdirSync(current, { withFileTypes: true }) | ||
| } catch { | ||
| return | ||
| } | ||
| for (const entry of entries) { | ||
| if (entry.name.startsWith(".")) continue | ||
| if (IGNORED_DIRS.has(entry.name)) continue | ||
| const full = path.join(current, entry.name) | ||
| if (entry.isDirectory()) { | ||
| walk(full) | ||
| continue | ||
| } | ||
| if (!INPUT_EXTENSIONS.test(entry.name)) continue | ||
| found.push(full) | ||
| } | ||
| } | ||
| walk(root) | ||
| return found | ||
| } | ||
| // altimate_change end | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
P1: The pre-push hook can approve one ref while pushing another because it never passes the hook's pushed ref/update data to the scanner; the scanner always examines the current
HEAD. A command such asgit push origin featurefrom a cleanmaincan therefore publish an unchecked branch. Reading the pre-push stdin tuples and scanning each pushed local OID (or restricting the hook to the checked-out ref) would align the check with the actual push.Prompt for AI agents