codex-app-server-bridge/scripts/verify-packed-package.mjs

#!/usr/bin/env node

import assert from "node:assert/strict";
import { execFile } from "node:child_process";
import { constants } from "node:fs";
import { access, mkdtemp, rm, stat } from "node:fs/promises";
import { tmpdir } from "node:os";
import { basename, join, resolve } from "node:path";
import { promisify } from "node:util";

const execFileAsync = promisify(execFile);
const PACKAGE_NAME = "codex-app-server-bridge";
const DEFAULT_CACHE = "/private/tmp/codex-app-server-bridge-npm-cache";

async function selectedTarball(argv) {
  if (argv.length !== 1) {
    throw new Error("usage: npm run verify:package -- /absolute/path/to/codex-app-server-bridge-VERSION.tgz");
  }
  const tarball = resolve(argv[0]);
  if (!tarball.endsWith(".tgz")) throw new Error("package path must end in .tgz");
  const metadata = await stat(tarball);
  if (!metadata.isFile()) throw new Error("package path must identify a readable file");
  await access(tarball, constants.R_OK);
  return tarball;
}

async function verify() {
  const tarball = await selectedTarball(process.argv.slice(2));
  const prefix = await mkdtemp(join(tmpdir(), "codex-app-server-bridge-package-"));
  const cache = process.env.CODEX_APP_SERVER_BRIDGE_NPM_CACHE ?? DEFAULT_CACHE;

  try {
    await execFileAsync("npm", [
      "install",
      "--prefix",
      prefix,
      "--ignore-scripts",
      "--cache",
      cache,
      tarball,
    ], { maxBuffer: 10 * 1024 * 1024 });

    const executable = join(prefix, "node_modules", ".bin", PACKAGE_NAME);
    await access(executable, constants.X_OK);
    try {
      await execFileAsync(executable, ["--unsupported"], { maxBuffer: 1024 * 1024 });
      throw new Error("installed executable unexpectedly accepted an unsupported invocation");
    } catch (error) {
      if (typeof error !== "object" || error === null || !("code" in error) || error.code !== 1) {
        throw error;
      }
      const stdout = "stdout" in error ? String(error.stdout) : "";
      const stderr = "stderr" in error ? String(error.stderr) : "";
      assert.equal(stdout, "");
      assert.match(stderr, /Usage: codex-app-server-bridge app-server/);
    }

    process.stdout.write(`${JSON.stringify({
      ok: true,
      package: basename(tarball),
      executable: `node_modules/.bin/${PACKAGE_NAME}`,
      invocation: "verified",
    })}\n`);
  } finally {
    await rm(prefix, { recursive: true, force: true });
  }
}

verify().catch((error) => {
  const message = error instanceof Error ? error.message : String(error);
  process.stderr.write(`Packed-package verification failed: ${message}\n`);
  process.exitCode = 1;
});