mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 23:10:11 +00:00
* feat: embedded registry catalog and WASM bundle install pipeline Embed registry manifests at compile time so the extension catalog is available without network access. Add tar.gz bundle support for WASM extension downloads (tools and channels), a /api/extensions/registry endpoint, CI job to build and publish WASM bundles on release, and ephemeral in-memory secrets fallback so the extension manager works even without a persistent secrets store. Key changes: - build.rs: collect registry/*.json into embedded_catalog.json at compile time - src/registry/embedded.rs + catalog.rs: load embedded or on-disk catalog - src/extensions/manager.rs: download_and_install_wasm handles tar.gz bundles, bare .wasm files, and separate capabilities downloads; wasm channel install - src/channels/web/server.rs: /api/extensions/registry endpoint + no-cache headers - src/app.rs: ephemeral InMemorySecretsStore fallback for extension manager - registry/*.json: populate artifact download URLs for release bundles - .github/workflows/release.yml: build-wasm-extensions CI job - Simplified setup wizard and CLI registry commands Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review — archive hardening, decompression bomb guard, test fix - Add 100 MB decompressed entry size cap to tar.gz extraction in both manager.rs and installer.rs to prevent decompression bombs - Add archive.set_preserve_permissions(false) and set_unpack_xattrs(false) for defense-in-depth against malicious archives - Fix test assertion logic in catalog.rs (|| → || with correct negation) - Replace silent tar fallback in CI with explicit if/else for capabilities - Add warning when installing without SHA256 verification Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: resolve clippy warning in settings.rs and enforce zero-warnings policy Use struct initializer with ..Default::default() instead of field reassignment. Update CLAUDE.md to codify zero clippy warnings policy — all warnings must be fixed before committing, including pre-existing ones. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review round 2 — build reliability, caps validation, naming - build.rs: emit per-file rerun-if-changed for reliable content tracking; fix bundles fallback to match BundlesFile shape ({"bundles":{}}) - embedded.rs: parse catalog once via OnceLock instead of double-parsing - manager.rs + installer.rs: add 1 MB size cap on capabilities_url downloads with proper error surfacing - secrets/store.rs: rename misleading `pub mod testing` to `pub mod in_memory` - server.rs: track installed extensions by (name, kind) tuple to avoid false positives across different extension kinds Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
198 lines
6.1 KiB
Rust
198 lines
6.1 KiB
Rust
//! Build script: compile Telegram channel WASM from source.
|
|
//!
|
|
//! Do not commit compiled WASM binaries — they are a supply chain risk.
|
|
//! This script builds telegram.wasm from channels-src/telegram before the main crate compiles.
|
|
//!
|
|
//! Reproducible build:
|
|
//! cargo build --release
|
|
//! (build.rs invokes the channel build automatically)
|
|
//!
|
|
//! Prerequisites: rustup target add wasm32-wasip2, cargo install wasm-tools
|
|
|
|
use std::env;
|
|
use std::path::{Path, PathBuf};
|
|
use std::process::Command;
|
|
|
|
fn main() {
|
|
let manifest_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
|
|
let root = PathBuf::from(&manifest_dir);
|
|
|
|
// ── Embed registry manifests ────────────────────────────────────────
|
|
embed_registry_catalog(&root);
|
|
|
|
// ── Build Telegram channel WASM ─────────────────────────────────────
|
|
let channel_dir = root.join("channels-src/telegram");
|
|
let wasm_out = channel_dir.join("telegram.wasm");
|
|
|
|
// Rerun when channel source or build script changes
|
|
println!("cargo:rerun-if-changed=channels-src/telegram/src");
|
|
println!("cargo:rerun-if-changed=channels-src/telegram/Cargo.toml");
|
|
println!("cargo:rerun-if-changed=wit/channel.wit");
|
|
|
|
if !channel_dir.is_dir() {
|
|
return;
|
|
}
|
|
|
|
// Build WASM module
|
|
let status = match Command::new("cargo")
|
|
.args([
|
|
"build",
|
|
"--release",
|
|
"--target",
|
|
"wasm32-wasip2",
|
|
"--manifest-path",
|
|
channel_dir.join("Cargo.toml").to_str().unwrap(),
|
|
])
|
|
.current_dir(&root)
|
|
.status()
|
|
{
|
|
Ok(s) => s,
|
|
Err(_) => {
|
|
eprintln!(
|
|
"cargo:warning=Telegram channel build failed. Run: ./channels-src/telegram/build.sh"
|
|
);
|
|
return;
|
|
}
|
|
};
|
|
|
|
if !status.success() {
|
|
eprintln!(
|
|
"cargo:warning=Telegram channel build failed. Run: ./channels-src/telegram/build.sh"
|
|
);
|
|
return;
|
|
}
|
|
|
|
let raw_wasm = channel_dir.join("target/wasm32-wasip2/release/telegram_channel.wasm");
|
|
if !raw_wasm.exists() {
|
|
eprintln!(
|
|
"cargo:warning=Telegram WASM output not found at {:?}",
|
|
raw_wasm
|
|
);
|
|
return;
|
|
}
|
|
|
|
// Convert to component and strip (wasm-tools)
|
|
let component_ok = Command::new("wasm-tools")
|
|
.args([
|
|
"component",
|
|
"new",
|
|
raw_wasm.to_str().unwrap(),
|
|
"-o",
|
|
wasm_out.to_str().unwrap(),
|
|
])
|
|
.current_dir(&root)
|
|
.status()
|
|
.map(|s| s.success())
|
|
.unwrap_or(false);
|
|
|
|
if !component_ok {
|
|
// Fallback: copy raw module if wasm-tools unavailable
|
|
if std::fs::copy(&raw_wasm, &wasm_out).is_err() {
|
|
eprintln!("cargo:warning=wasm-tools not found. Run: cargo install wasm-tools");
|
|
}
|
|
} else {
|
|
// Strip debug info (use temp file to avoid clobbering)
|
|
let stripped = wasm_out.with_extension("wasm.stripped");
|
|
let strip_ok = Command::new("wasm-tools")
|
|
.args([
|
|
"strip",
|
|
wasm_out.to_str().unwrap(),
|
|
"-o",
|
|
stripped.to_str().unwrap(),
|
|
])
|
|
.current_dir(&root)
|
|
.status()
|
|
.map(|s| s.success())
|
|
.unwrap_or(false);
|
|
if strip_ok {
|
|
let _ = std::fs::rename(&stripped, &wasm_out);
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Collect all registry manifests into a single JSON blob at compile time.
|
|
///
|
|
/// Output: `$OUT_DIR/embedded_catalog.json` with structure:
|
|
/// ```json
|
|
/// { "tools": [...], "channels": [...], "bundles": {...} }
|
|
/// ```
|
|
fn embed_registry_catalog(root: &Path) {
|
|
use std::fs;
|
|
|
|
let registry_dir = root.join("registry");
|
|
|
|
// Rerun if the bundles file changes (per-file watches for tools/channels
|
|
// are emitted inside collect_json_files to track content changes reliably).
|
|
println!("cargo:rerun-if-changed=registry/_bundles.json");
|
|
|
|
let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
|
|
let out_path = out_dir.join("embedded_catalog.json");
|
|
|
|
if !registry_dir.is_dir() {
|
|
// No registry dir: write empty catalog
|
|
fs::write(
|
|
&out_path,
|
|
r#"{"tools":[],"channels":[],"bundles":{"bundles":{}}}"#,
|
|
)
|
|
.unwrap();
|
|
return;
|
|
}
|
|
|
|
let mut tools = Vec::new();
|
|
let mut channels = Vec::new();
|
|
|
|
// Collect tool manifests
|
|
let tools_dir = registry_dir.join("tools");
|
|
if tools_dir.is_dir() {
|
|
collect_json_files(&tools_dir, &mut tools);
|
|
}
|
|
|
|
// Collect channel manifests
|
|
let channels_dir = registry_dir.join("channels");
|
|
if channels_dir.is_dir() {
|
|
collect_json_files(&channels_dir, &mut channels);
|
|
}
|
|
|
|
// Read bundles
|
|
let bundles_path = registry_dir.join("_bundles.json");
|
|
let bundles_raw = if bundles_path.is_file() {
|
|
fs::read_to_string(&bundles_path).unwrap_or_else(|_| r#"{"bundles":{}}"#.to_string())
|
|
} else {
|
|
r#"{"bundles":{}}"#.to_string()
|
|
};
|
|
|
|
// Build the combined JSON
|
|
let catalog = format!(
|
|
r#"{{"tools":[{}],"channels":[{}],"bundles":{}}}"#,
|
|
tools.join(","),
|
|
channels.join(","),
|
|
bundles_raw,
|
|
);
|
|
|
|
fs::write(&out_path, catalog).unwrap();
|
|
}
|
|
|
|
/// Read all .json files from a directory and push their raw contents into `out`.
|
|
fn collect_json_files(dir: &Path, out: &mut Vec<String>) {
|
|
use std::fs;
|
|
|
|
let mut entries: Vec<_> = fs::read_dir(dir)
|
|
.unwrap()
|
|
.filter_map(|e| e.ok())
|
|
.filter(|e| {
|
|
e.path().is_file() && e.path().extension().and_then(|x| x.to_str()) == Some("json")
|
|
})
|
|
.collect();
|
|
|
|
// Sort for deterministic output
|
|
entries.sort_by_key(|e| e.file_name());
|
|
|
|
for entry in entries {
|
|
// Emit per-file watch so Cargo reruns when file contents change
|
|
println!("cargo:rerun-if-changed={}", entry.path().display());
|
|
if let Ok(content) = fs::read_to_string(entry.path()) {
|
|
out.push(content);
|
|
}
|
|
}
|
|
}
|