mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-03 05:45:04 +03:00
df9550fce9
* fix(cli): ensure `~/.cache` is created and `XDG_CACHE_HOME` is set before Next.js loads on Android/Termux to prevent silent HTTP 500 errors due to instrumentation hook failures (#8519) * chore(quality): ignore XDG_CACHE_HOME in the env/docs contract scanner XDG_CACHE_HOME is an XDG Base Directory spec variable set by the OS or the operator, never OmniRoute product config — the same reason XDG_CONFIG_HOME is already ignored. The Android/Termux cache-dir preparation added here reads it to honor an operator-set cache location, which made check-env-doc-sync demand an .env.example/ENVIRONMENT.md entry for a variable we do not own. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * build(pack): require bin/cli/utils/ensureAndroidCacheDir.mjs in the tarball bin/omniroute.mjs imports this module at startup to prepare the Next.js cache dir before serve on Android/Termux. bin/cli/ is only an allowlist PREFIX, so a file missing from the tarball would not fail the unexpected-paths check — it would ship a CLI that throws ERR_MODULE_NOT_FOUND on the very platform this change targets. Registering it makes the absence loud, same guard class as storageKeyProvision.mjs and versionFastPath.mjs. Caught by tests/unit/pack-artifact-entrypoint-closures.test.ts in the v3.8.49 merge-train. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
241 lines
9.0 KiB
TypeScript
241 lines
9.0 KiB
TypeScript
/**
|
|
* Shared policy for OmniRoute npm publish artifact hygiene.
|
|
*
|
|
* The package publishes the standalone runtime under dist/ (Layer 1: renamed from app/).
|
|
* This policy keeps local backups, QA scratch files, and development-only
|
|
* directories out of the staged dist/ tree and out of the final tarball.
|
|
*/
|
|
|
|
const STAGING_FORBIDDEN_DIRECTORIES = [
|
|
"app.__qa_backup",
|
|
"coverage",
|
|
"electron",
|
|
"logs",
|
|
"scripts/scratch",
|
|
"tests",
|
|
"vscode-extension",
|
|
"_ideia",
|
|
"_mono_repo",
|
|
"_references",
|
|
"_tasks",
|
|
];
|
|
|
|
const STAGING_FORBIDDEN_FILES = ["audit-report.json", "package-lock.json"];
|
|
|
|
export const APP_STAGING_REMOVAL_PATHS: string[] = [
|
|
...STAGING_FORBIDDEN_DIRECTORIES,
|
|
...STAGING_FORBIDDEN_FILES,
|
|
// onnxruntime CUDA provider binary (~316 MB) inflates the npm tarball
|
|
// past the registry 413 limit for npm.org. It's only needed on systems
|
|
// with a CUDA GPU — users install CUDA providers separately.
|
|
"node_modules/onnxruntime-node/bin/napi-v6/linux/x64/libonnxruntime_providers_cuda.so",
|
|
];
|
|
|
|
export const APP_STAGING_ALLOWED_EXACT_PATHS: string[] = [
|
|
".env.example",
|
|
"BUILD_SHA",
|
|
"docs/openapi.yaml",
|
|
// #7065: imported by dist/server-ws.mjs; assembleStandalone copies it but without
|
|
// this bare entry the prepublish prune deleted it → every `omniroute` boot of the
|
|
// published 3.8.47 crashed with ERR_MODULE_NOT_FOUND (same class as tls-options/3.8.41).
|
|
"head-response-guard.cjs",
|
|
"http-method-guard.cjs",
|
|
"open-sse/mcp-server/server.js",
|
|
// LLMLingua ONNX worker — esbuild'd standalone .js spawned via worker_threads
|
|
// (the Next.js bundler can't trace the computed Worker path). Kept like the MCP server.
|
|
"open-sse/services/compression/engines/llmlingua/onnxWorker.js",
|
|
"package.json",
|
|
"peer-stamp.mjs",
|
|
"main-server-timeouts.mjs",
|
|
"responses-ws-proxy.mjs",
|
|
"scripts/dev/sync-env.mjs",
|
|
"scripts/dev/tls-options.mjs",
|
|
"server.js",
|
|
"server-ws.mjs",
|
|
// #5452: dist/tls-options.mjs is copied by assembleStandalone (EXTRA_MODULE_ENTRIES)
|
|
// and imported by dist/server-ws.mjs for opt-in native HTTPS/TLS (#5361). Without
|
|
// this bare entry the prepublish prune (Step 10.7) deletes it → `omniroute serve`
|
|
// crashes with ERR_MODULE_NOT_FOUND (regressed in the published 3.8.41 tarball).
|
|
"tls-options.mjs",
|
|
"webdav-handler.mjs",
|
|
];
|
|
|
|
export const APP_STAGING_ALLOWED_PATH_PREFIXES: string[] = [
|
|
// Layer 1: Next.js distDir changed from ".next" to ".build/next"; the server
|
|
// bundle now lives under .build/next/ inside the standalone output.
|
|
".build/next/",
|
|
".next/",
|
|
"data/",
|
|
"node_modules/",
|
|
"open-sse/services/compression/engines/rtk/filters/",
|
|
"open-sse/services/compression/rules/",
|
|
"public/",
|
|
"src/lib/db/migrations/",
|
|
"src/mitm/",
|
|
];
|
|
|
|
export const PACK_ARTIFACT_ALLOWED_EXACT_PATHS: string[] = APP_STAGING_ALLOWED_EXACT_PATHS.map(
|
|
(filePath: string) => `dist/${filePath}`
|
|
);
|
|
|
|
export const PACK_ARTIFACT_ALLOWED_PATH_PREFIXES: string[] = APP_STAGING_ALLOWED_PATH_PREFIXES.map(
|
|
(directoryPath: string) => `dist/${directoryPath}`
|
|
);
|
|
|
|
export const PACK_ARTIFACT_ROOT_ALLOWED_EXACT_PATHS: string[] = [
|
|
".env.example",
|
|
"LICENSE",
|
|
"README.md",
|
|
"bin/aliasResolver.mjs",
|
|
// #7808: ESM loader hook split out of bin/aliasResolver.mjs to silence CodeQL
|
|
// js/incomplete-url-substring-sanitization (the old code built a
|
|
// `data:text/javascript,...` URL dynamically). Loaded via pathToFileURL() at
|
|
// runtime; shipped via package.json "files", so it must be allowed here.
|
|
"bin/aliasResolverHook.mjs",
|
|
"bin/mcp-server.mjs",
|
|
"bin/nodeRuntimeSupport.mjs",
|
|
"bin/omniroute.mjs",
|
|
"bin/reset-password.mjs",
|
|
// Operator incident-recovery / cold-start shell tooling (rollback, snapshot,
|
|
// restore, cold-start bench) shipped in bin/ for self-hosters — not imported by
|
|
// the runtime. Included via the package.json "files": ["bin/"] entry, so they
|
|
// must be allowed here. Each script is self-documenting via --help.
|
|
"bin/_ops-common.sh",
|
|
"bin/cold-start-bench.sh",
|
|
"bin/restore-data.sh",
|
|
"bin/restore-policies.sh",
|
|
"bin/rollback.sh",
|
|
"bin/snapshot-data.sh",
|
|
"open-sse/mcp-server/README.md",
|
|
"open-sse/mcp-server/audit.ts",
|
|
"open-sse/mcp-server/httpTransport.ts",
|
|
"open-sse/mcp-server/index.ts",
|
|
"open-sse/mcp-server/runtimeHeartbeat.ts",
|
|
"open-sse/mcp-server/scopeEnforcement.ts",
|
|
"open-sse/mcp-server/server.ts",
|
|
// Runtime polyfill eagerly imported by bin/omniroute.mjs (Node <22 compat);
|
|
// shipped via package.json "files", so it must be allowed in the tarball.
|
|
"open-sse/utils/setupPolyfill.ts",
|
|
"package.json",
|
|
"scripts/build/build-next-isolated.mjs",
|
|
"scripts/check/check-supported-node-runtime.ts",
|
|
"scripts/build/native-binary-compat.mjs",
|
|
"scripts/build/postinstall.mjs",
|
|
"scripts/build/postinstallSupport.mjs",
|
|
"scripts/build/colocateOptionals.mjs",
|
|
// #7802: imported by scripts/build/postinstall.mjs to repair tls-client-node's
|
|
// native binary (chatgpt-web/claude-web/grok-web/lmarena/perplexity-web transport).
|
|
"scripts/build/fixTlsClientNodeBinary.mjs",
|
|
// #5227: imported at runtime by bin/cli/commands/serve.mjs (heap auto-calibration).
|
|
"scripts/build/runtime-env.mjs",
|
|
"scripts/build/sync-env.mjs",
|
|
"scripts/dev/responses-ws-proxy.mjs",
|
|
"scripts/dev/sync-env.mjs",
|
|
// #5361: imported at runtime by bin/cli/commands/serve.mjs + the standalone
|
|
// server wrapper for opt-in native HTTPS/TLS serving (kept dependency-light).
|
|
"scripts/dev/tls-options.mjs",
|
|
"scripts/postinstall.mjs",
|
|
"src/shared/utils/nodeRuntimeSupport.ts",
|
|
];
|
|
|
|
export const PACK_ARTIFACT_ROOT_ALLOWED_PATH_PREFIXES: string[] = [
|
|
"@omniroute/opencode-plugin/",
|
|
"@omniroute/opencode-provider/",
|
|
"bin/cli/",
|
|
// Broad open-sse + src source dirs added to package.json "files" in v3.8.21
|
|
// to allow TypeScript-first imports from the published package.
|
|
"open-sse/",
|
|
"src/domain/",
|
|
"src/lib/",
|
|
"src/models/",
|
|
"src/mitm/",
|
|
"src/server/",
|
|
"src/shared/",
|
|
"src/sse/",
|
|
"src/types/",
|
|
];
|
|
|
|
export const PACK_ARTIFACT_REQUIRED_PATHS: string[] = [
|
|
"dist/open-sse/services/compression/engines/rtk/filters/generic-output.json",
|
|
"dist/open-sse/services/compression/rules/en/filler.json",
|
|
"dist/server.js",
|
|
"dist/server-ws.mjs",
|
|
"dist/responses-ws-proxy.mjs",
|
|
"dist/peer-stamp.mjs",
|
|
"dist/main-server-timeouts.mjs",
|
|
"dist/http-method-guard.cjs",
|
|
// #5452: regression guard — make check:pack-artifact fail loudly if the TLS
|
|
// opt-in sidecar (imported by dist/server-ws.mjs) ever vanishes from the tarball.
|
|
"dist/tls-options.mjs",
|
|
// #7065: regression guard for the HEAD response guard (dist/server-ws.mjs import).
|
|
"dist/head-response-guard.cjs",
|
|
"dist/webdav-handler.mjs",
|
|
"bin/cli/program.mjs",
|
|
// Direct imports of bin/omniroute.mjs — bin/cli/ is only an allowlist PREFIX, so a
|
|
// file vanishing from the tarball never fails the unexpected-paths check; only these
|
|
// required entries make its absence loud (#7065 class; derived + enforced by
|
|
// tests/unit/pack-artifact-entrypoint-closures.test.ts).
|
|
"bin/cli/data-dir.mjs",
|
|
"bin/cli/utils/ensureAndroidCacheDir.mjs",
|
|
"bin/cli/utils/storageKeyProvision.mjs",
|
|
"bin/cli/utils/versionFastPath.mjs",
|
|
"bin/mcp-server.mjs",
|
|
"bin/nodeRuntimeSupport.mjs",
|
|
"bin/omniroute.mjs",
|
|
// #7808: aliasResolver + its hook file. bin/omniroute.mjs imports
|
|
// bin/aliasResolver.mjs at startup, which in turn registers
|
|
// bin/aliasResolverHook.mjs as the ESM loader. Both must ship in the tarball
|
|
// or the CLI fails to boot — list them REQUIRED so a regression is loud.
|
|
"bin/aliasResolver.mjs",
|
|
"bin/aliasResolverHook.mjs",
|
|
"package.json",
|
|
"scripts/build/native-binary-compat.mjs",
|
|
"scripts/build/postinstall.mjs",
|
|
"scripts/build/postinstallSupport.mjs",
|
|
"scripts/build/colocateOptionals.mjs",
|
|
"scripts/build/fixTlsClientNodeBinary.mjs",
|
|
"scripts/build/runtime-env.mjs",
|
|
"src/shared/utils/nodeRuntimeSupport.ts",
|
|
];
|
|
|
|
PACK_ARTIFACT_ALLOWED_EXACT_PATHS.push(...PACK_ARTIFACT_ROOT_ALLOWED_EXACT_PATHS);
|
|
PACK_ARTIFACT_ALLOWED_PATH_PREFIXES.push(...PACK_ARTIFACT_ROOT_ALLOWED_PATH_PREFIXES);
|
|
|
|
export function normalizeArtifactPath(filePath: string): string {
|
|
return String(filePath || "")
|
|
.replace(/\\/g, "/")
|
|
.replace(/^\.\//, "")
|
|
.replace(/^\/+/, "")
|
|
.replace(/\/{2,}/g, "/");
|
|
}
|
|
|
|
export function findUnexpectedArtifactPaths(
|
|
filePaths: string[],
|
|
{ exactPaths = [], prefixPaths = [] }: { exactPaths?: string[]; prefixPaths?: string[] } = {}
|
|
): string[] {
|
|
const normalizedExact = new Set(exactPaths.map(normalizeArtifactPath));
|
|
const normalizedPrefixes = prefixPaths.map(normalizeArtifactPath);
|
|
|
|
return filePaths
|
|
.map(normalizeArtifactPath)
|
|
.filter(Boolean)
|
|
.filter(
|
|
(filePath) =>
|
|
!normalizedExact.has(filePath) &&
|
|
!normalizedPrefixes.some((prefix) => filePath.startsWith(prefix))
|
|
)
|
|
.sort();
|
|
}
|
|
|
|
export function findMissingArtifactPaths(
|
|
filePaths: string[],
|
|
requiredPaths: string[] = []
|
|
): string[] {
|
|
const normalizedPaths = new Set(filePaths.map(normalizeArtifactPath).filter(Boolean));
|
|
return requiredPaths
|
|
.map(normalizeArtifactPath)
|
|
.filter(Boolean)
|
|
.filter((requiredPath) => !normalizedPaths.has(requiredPath))
|
|
.sort();
|
|
}
|