WEBDIENSTE/openswarm
1
0
Fork 0
mirror of https://github.com/openswarm-ai/openswarm.git synced 2026-08-17 18:25:42 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
eric/trigger
openswarm/scripts/build-app-win.ps1
T

576 lines
31 KiB
PowerShell
Raw Permalink Blame History

# Master build script for the OpenSwarm desktop app on Windows.
#
# Usage:
# pwsh scripts\build-app-win.ps1 Local dev build (unsigned)
# pwsh scripts\build-app-win.ps1 -Sign Signed build (no publish)
# pwsh scripts\build-app-win.ps1 -Publish Production build (sign + publish to GitHub Releases)
#
# Reads .env.windows (gitignored) for Azure Trusted Signing + GH_TOKEN if -Sign or -Publish.
[CmdletBinding()]
param(
[switch]$Sign,
[switch]$Publish,
# Fast CI gate path: build only the unpacked win-unpacked\ dir (no NSIS
# installer, no LZMA compression of the ~1GB tree - the slowest packaging
# phase). verify-all + Playwright drive the unpacked OpenSwarm.exe directly.
[switch]$DirOnly,
# Phase 7 A/B: build a Squirrel.Windows installer instead of the default
# NSIS one, from the SAME staged tree / SAME commit. Opt-in only; NSIS stays
# the default and shipped target until Squirrel is proven faster AND its
# rollback works on real Win 10/11 machines. EXPERIMENTAL / unverified in CI.
[switch]$Squirrel
)
$ErrorActionPreference = 'Stop'
if ($Publish) { $Sign = $true }
# Override only the win target; everything else (signing hook, extraResources,
# publish config) merges from electron/package.json's build block unchanged.
$TargetOverride = if ($Squirrel) { @('--config.win.target=squirrel', '--config.squirrelWindows.iconUrl=https://raw.githubusercontent.com/openswarm-ai/openswarm/main/electron/build/icon.ico') } else { @() }
$ScriptDir = Split-Path -Parent $PSCommandPath
$ProjectRoot = Split-Path -Parent $ScriptDir
# --- Load .env.windows if present ---
$EnvFile = Join-Path $ProjectRoot '.env.windows'
if (Test-Path $EnvFile) {
Get-Content $EnvFile | ForEach-Object {
$line = $_.Trim()
if ($line -and -not $line.StartsWith('#') -and $line.Contains('=')) {
$idx = $line.IndexOf('=')
$name = $line.Substring(0, $idx).Trim()
$value = $line.Substring($idx + 1).Trim()
if ($value.StartsWith('"') -and $value.EndsWith('"')) {
$value = $value.Substring(1, $value.Length - 2)
}
Set-Item -Path "Env:$name" -Value $value
}
}
}
Write-Host "========================================"
Write-Host " OpenSwarm Desktop App Builder (Windows)"
if ($Publish) { Write-Host " Mode: PRODUCTION (sign + publish to GitHub Releases)" }
elseif ($Sign) { Write-Host " Mode: SIGNED (sign, no publish)" }
else { Write-Host " Mode: LOCAL (unsigned)" }
Write-Host "========================================"
Write-Host ""
# --- Required env validation ---
if ($Sign) {
$required = @(
'AZURE_TENANT_ID','AZURE_CLIENT_ID','AZURE_CLIENT_SECRET',
'AZURE_SIGNING_ENDPOINT','AZURE_SIGNING_ACCOUNT','AZURE_SIGNING_CERT_PROFILE'
)
if ($Publish) { $required += 'GH_TOKEN' }
$missing = $required | Where-Object { -not [Environment]::GetEnvironmentVariable($_) }
if ($missing.Count -gt 0) {
Write-Host "ERROR: Missing required environment variables:" -ForegroundColor Red
$missing | ForEach-Object { Write-Host " - $_" }
Write-Host "Copy .env.windows.example to .env.windows and fill in values."
exit 1
}
# A signed build is one users actually run, so its Widevine VMP signature is
# mandatory: the afterPack hook hard-fails on a missing/failed signature rather
# than ship an installer whose Spotify/Netflix audio is silently dead.
$env:VMP_REQUIRE_SIGN = '1'
}
# --- Step 0: Bundled uv + uvx for Windows ---
# IMPORTANT: uvx.exe is a tiny shim that requires sibling uv.exe at runtime.
# Without uv.exe, MCPs that use `command: uvx` (e.g. Google Workspace) fail
# with "Could not find the `uv` binary". A prior revision shipped only uvx
# to save ~30MB; that broke first-launch MCP discovery on fresh Macs and
# Windows machines without a system uv install. Ship both.
$UvBinDir = Join-Path $ProjectRoot 'backend\uv-bin'
New-Item -ItemType Directory -Force -Path $UvBinDir | Out-Null
$NeedUv = -not (Test-Path (Join-Path $UvBinDir 'uv.exe')) -or `
-not (Test-Path (Join-Path $UvBinDir 'uvx.exe'))
if ($NeedUv) {
# Pinned uv version. "latest" used to mean a fresh uv could appear in any
# build with zero warning, breaking reproducibility (pillar 3). Override
# with $env:UV_VERSION when deliberately bumping; keep mac (build-app.sh)
# in lockstep. 0.11.16 is what "latest" resolved to when this was pinned.
$UvVersion = if ($env:UV_VERSION) { $env:UV_VERSION } else { '0.11.16' }
Write-Host "[0] Downloading uv + uvx $UvVersion for Windows..."
$UvUrl = "https://github.com/astral-sh/uv/releases/download/$UvVersion/uv-x86_64-pc-windows-msvc.zip"
$TmpZip = Join-Path $env:TEMP "uv-win-$([guid]::NewGuid()).zip"
$TmpExtract = Join-Path $env:TEMP "uv-win-extract-$([guid]::NewGuid())"
try {
Invoke-WebRequest -Uri $UvUrl -OutFile $TmpZip -UseBasicParsing
Expand-Archive -Path $TmpZip -DestinationPath $TmpExtract -Force
Get-ChildItem -Path $TmpExtract -Recurse -Filter 'uv.exe' | Select-Object -First 1 | ForEach-Object { Copy-Item $_.FullName (Join-Path $UvBinDir 'uv.exe') -Force }
Get-ChildItem -Path $TmpExtract -Recurse -Filter 'uvx.exe' | Select-Object -First 1 | ForEach-Object { Copy-Item $_.FullName (Join-Path $UvBinDir 'uvx.exe') -Force }
Write-Host "uv.exe + uvx.exe downloaded and bundled."
} finally {
Remove-Item -Force $TmpZip -ErrorAction SilentlyContinue
Remove-Item -Recurse -Force $TmpExtract -ErrorAction SilentlyContinue
}
} else {
Write-Host "[0] uv.exe + uvx.exe already present."
}
Write-Host ""
# --- Step 0a: Sync the splash icon ---
# electron-builder excludes `build/` from the shipped asar (it's the icon-
# source directory used to generate .ico). The splash window needs to read
# the icon at runtime, so we keep a copy at electron\splash\icon.png which
# IS shipped. See electron/main.js comment at iconPngPath for context.
Copy-Item -Force `
(Join-Path $ProjectRoot 'electron\build\icon.png') `
(Join-Path $ProjectRoot 'electron\splash\icon.png')
# --- Step 0b: Bundle npm MCP servers via esbuild ---
# Each bundle compiles down to a single ~5-15 MB CommonJS file under
# backend\mcp-bundles\, runs on Electron's bundled Node at runtime
# (ELECTRON_RUN_AS_NODE=1), and is preferred by tools_lib.py:521 over
# any pre-installed node_modules tree. Bundling instead of shipping
# node_modules cuts the installer file count from ~28k -> ~9k, which
# is the dominant lever on NSIS install time + Defender scan cost.
$McpBundleDir = Join-Path $ProjectRoot 'backend\mcp-bundles'
New-Item -ItemType Directory -Force -Path $McpBundleDir | Out-Null
# Single-file CJS bundle. Output path: mcp-bundles\<output>.js. Use for
# packages that don't read sibling files at runtime. The import.meta.url
# polyfill is applied uniformly because nearly every modern ESM package
# uses createRequire(import.meta.url) somewhere -- without the polyfill,
# esbuild's ESM->CJS transform leaves import.meta.url as undefined and
# the bundle crashes at module load.
function Build-McpBundleSingle($PackageName, $EntrySubpath, $OutputName) {
$OutFile = Join-Path $McpBundleDir $OutputName
if ((Test-Path $OutFile) -and -not $env:OPENSWARM_REBUILD_BUNDLES) {
Write-Host "[0b] $PackageName bundle already present (set `$env:OPENSWARM_REBUILD_BUNDLES='1' to force rebuild)."
return
}
Write-Host "[0b] Bundling $PackageName -> $OutputName ..."
$TmpDir = Join-Path $env:TEMP "openswarm-mcp-$([guid]::NewGuid())"
New-Item -ItemType Directory -Force -Path $TmpDir | Out-Null
Push-Location $TmpDir
try {
& npm install $PackageName --silent 2>$null
if ($LASTEXITCODE -ne 0) { throw "$PackageName install failed" }
$EntryPath = Join-Path (Join-Path $TmpDir 'node_modules') $EntrySubpath
if (-not (Test-Path $EntryPath)) { throw "$PackageName entry not found at $EntryPath" }
$banner = 'const __OPENSWARM_IMPORT_META_URL__ = require("url").pathToFileURL(__filename).href;'
& npx esbuild $EntryPath --bundle --platform=node --format=cjs --target=node22 --legal-comments=none `
--define:import.meta.url=__OPENSWARM_IMPORT_META_URL__ `
"--banner:js=$banner" `
"--outfile=$OutFile"
if ($LASTEXITCODE -ne 0) { throw "esbuild failed for $PackageName" }
Write-Host "$PackageName bundled."
} finally {
Pop-Location
Remove-Item -Recurse -Force $TmpDir -ErrorAction SilentlyContinue
}
}
# Multi-file bundle. Output is a directory mcp-bundles\<dir>\ that mirrors the
# upstream SDK's "package_root\dist\index.js + ..\package.json" layout. Use this
# for packages whose source reads __dirname\..\package.json (for --version) or
# other sibling data files (e.g. @softeria\ms-365-mcp-server reads endpoints.json).
function Build-McpBundleDir($PackageName, $EntrySubpath, $OutDirName, $Extras, $External) {
$OutDir = Join-Path $McpBundleDir $OutDirName
$OutBundle = Join-Path (Join-Path $OutDir 'dist') 'index.js'
if ((Test-Path $OutBundle) -and -not $env:OPENSWARM_REBUILD_BUNDLES) {
Write-Host "[0b] $PackageName bundle dir already present."
return
}
Write-Host "[0b] Bundling $PackageName -> $OutDirName\ ..."
$TmpDir = Join-Path $env:TEMP "openswarm-mcp-$([guid]::NewGuid())"
New-Item -ItemType Directory -Force -Path $TmpDir | Out-Null
if (Test-Path $OutDir) { Remove-Item -Recurse -Force $OutDir }
New-Item -ItemType Directory -Force -Path (Join-Path $OutDir 'dist') | Out-Null
Push-Location $TmpDir
try {
& npm install $PackageName --silent 2>$null
if ($LASTEXITCODE -ne 0) { throw "$PackageName install failed" }
$EntryPath = Join-Path (Join-Path $TmpDir 'node_modules') $EntrySubpath
if (-not (Test-Path $EntryPath)) { throw "$PackageName entry not found at $EntryPath" }
# Stripped sibling package.json (omits "type":"module" so Node treats the CJS bundle correctly)
$SdkPkgPath = Join-Path (Join-Path $TmpDir 'node_modules') (Join-Path $PackageName 'package.json')
$SdkPkgJson = Get-Content -Raw $SdkPkgPath | ConvertFrom-Json
$SdkVersion = $SdkPkgJson.version
$StrippedPkg = "{`"name`":`"$PackageName`",`"version`":`"$SdkVersion`"}"
Set-Content -Path (Join-Path $OutDir 'package.json') -Value $StrippedPkg -NoNewline
# Copy sibling data files
if ($Extras) {
foreach ($pair in $Extras) {
$src, $dst = $pair -split '='
$srcAbs = Join-Path (Join-Path $TmpDir 'node_modules') $src
$dstAbs = Join-Path $OutDir $dst
New-Item -ItemType Directory -Force -Path (Split-Path $dstAbs -Parent) | Out-Null
Copy-Item -Force $srcAbs $dstAbs
}
}
$banner = 'const __OPENSWARM_IMPORT_META_URL__ = require("url").pathToFileURL(__filename).href;'
$esbuildArgs = @(
$EntryPath, '--bundle', '--platform=node', '--format=cjs',
'--target=node22', '--legal-comments=none',
'--define:import.meta.url=__OPENSWARM_IMPORT_META_URL__',
"--banner:js=$banner",
"--outfile=$OutBundle"
)
if ($External) {
foreach ($ext in $External) { $esbuildArgs += "--external:$ext" }
}
& npx esbuild @esbuildArgs
if ($LASTEXITCODE -ne 0) { throw "esbuild failed for $PackageName" }
Write-Host "$PackageName bundled."
} finally {
Pop-Location
Remove-Item -Recurse -Force $TmpDir -ErrorAction SilentlyContinue
}
}
Build-McpBundleSingle 'reddit-mcp-buddy' 'reddit-mcp-buddy/dist/index.js' 'reddit-mcp-buddy.js'
Build-McpBundleDir '@notionhq/notion-mcp-server' '@notionhq/notion-mcp-server/bin/cli.mjs' `
'notionhq-notion-mcp-server' `
@('@notionhq/notion-mcp-server/scripts/notion-openapi.json=scripts/notion-openapi.json') `
@()
Build-McpBundleDir '@softeria/ms-365-mcp-server' '@softeria/ms-365-mcp-server/dist/index.js' `
'softeria-ms-365-mcp-server' `
@('@softeria/ms-365-mcp-server/dist/endpoints.json=dist/endpoints.json') `
@('keytar')
# Wipe legacy single-file Notion bundle if the dir-style bundle now supersedes it.
$LegacyNotionFile = Join-Path $McpBundleDir 'notionhq-notion-mcp-server.js'
$NotionDir = Join-Path $McpBundleDir 'notionhq-notion-mcp-server'
if ((Test-Path $LegacyNotionFile) -and (Test-Path $NotionDir)) {
Remove-Item -Force $LegacyNotionFile
}
# Defensively wipe any legacy npm-servers/ tree from prior builds so it
# doesn't ride along into the installer (would re-introduce the ~19k
# files we just removed by switching to bundling).
$LegacyNpmServers = Join-Path $ProjectRoot 'backend\npm-servers'
if (Test-Path $LegacyNpmServers) {
Write-Host "[0b] Removing legacy backend\npm-servers\ (now superseded by mcp-bundles)..."
Remove-Item -Recurse -Force $LegacyNpmServers
}
Write-Host ""
# --- Step 1: Frontend build ---
Write-Host "[1/5] Building frontend..."
Push-Location (Join-Path $ProjectRoot 'frontend')
try {
# npm ci (not install): installs exactly what package-lock.json pins, never
# silently mutates the lock, fails loudly on drift. Reproducible builds
# (pillar 3) depend on the lock being boss.
& npm ci
if ($LASTEXITCODE -ne 0) { throw "npm ci (frontend) failed" }
& npm run build
if ($LASTEXITCODE -ne 0) { throw "frontend build failed" }
} finally { Pop-Location }
if (-not (Test-Path (Join-Path $ProjectRoot 'frontend\dist\index.html'))) {
throw "Frontend build failed - dist\index.html not found"
}
Write-Host "Frontend build complete."
Write-Host ""
# --- Step 2: Python env ---
$PythonEnv = Join-Path $ProjectRoot 'electron\python-env'
$PythonExe = Join-Path $PythonEnv 'python.exe'
if ((Test-Path $PythonExe) -and -not $env:OPENSWARM_REBUILD_PYTHON) {
Write-Host "[2/5] Python environment already present at $PythonEnv (set `$env:OPENSWARM_REBUILD_PYTHON='1' to force rebuild)."
} else {
Write-Host "[2/5] Building Python environment..."
& (Join-Path $ScriptDir 'build-python-env-win.ps1')
if ($LASTEXITCODE -ne 0) { throw "Python env build failed" }
}
if (-not (Test-Path (Join-Path $ProjectRoot 'electron\python-env'))) {
throw "Python environment not found at electron\python-env\"
}
Write-Host "Python environment ready."
Write-Host ""
# NOTE: #9 items 1+3 (zip stdlib + pyc-only site-packages) were measured to give
# NO cold-start benefit (cold is native-binary-scan-bound, not file-count-bound),
# so they are NOT wired in. scripts/zip-python-stdlib.ps1 + strip-py-to-pyc.ps1
# remain as drafts. The cold lever is the opt-in Defender exclusion (item 5).
# --- Step 3: Fetch Router from npm ---
# The 9router Next.js server is published as an npm package with a pre-built
# standalone output. Stage it directly from npm instead of vendoring + rebuilding.
Write-Host "[3/5] Fetching Router from npm..."
$Staging = Join-Path $ProjectRoot 'electron\build-staging'
if (Test-Path $Staging) { Remove-Item -Recurse -Force $Staging }
New-Item -ItemType Directory -Force -Path $Staging | Out-Null
& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $ProjectRoot 'scripts\fetch-router.ps1') -Dest (Join-Path $Staging 'router')
if ($LASTEXITCODE -ne 0) { throw "fetch-router.ps1 failed" }
if (-not (Test-Path (Join-Path $Staging 'router\server.js'))) {
throw "Router fetch failed - server.js not found in staging"
}
Write-Host "Router staged."
Write-Host ""
# --- Step 3b: Bundle a real Node.js binary so 9Router and MCP servers
# don't fall back to ELECTRON_RUN_AS_NODE on user machines without system
# node. Wins: (1) avoids the bouncing "exec" Dock icon (irrelevant on
# Windows but matches the macOS build for consistency); (2) shrinks
# 9Router cold-start from ~10s (Electron-as-Node) to ~1-2s (real node),
# which directly shrinks the splash window the user sees during boot.
# Pinned to Node 20 LTS, NODE_MODULE_VERSION 115. 9router 0.3.60 has
# no native bindings (sql.js, not better-sqlite3) so any Node 18+ works.
Write-Host "[3b/5] Bundling Node.js runtime..."
$NodeVersion = 'v20.18.1'
$NodeStageDir = Join-Path $Staging 'node\x64'
New-Item -ItemType Directory -Force -Path $NodeStageDir | Out-Null
$NodeZip = Join-Path $env:TEMP "node-win-$([guid]::NewGuid()).zip"
$NodeExtract = Join-Path $env:TEMP "node-win-extract-$([guid]::NewGuid())"
try {
$NodeUrl = "https://nodejs.org/dist/$NodeVersion/node-$NodeVersion-win-x64.zip"
Write-Host "[3b] Downloading $NodeUrl..."
Invoke-WebRequest -Uri $NodeUrl -OutFile $NodeZip -UseBasicParsing
Expand-Archive -Path $NodeZip -DestinationPath $NodeExtract -Force
$SrcRoot = Join-Path $NodeExtract "node-$NodeVersion-win-x64"
$SrcNode = Join-Path $SrcRoot 'node.exe'
if (-not (Test-Path $SrcNode)) { throw "node.exe not found at $SrcNode after extract" }
Copy-Item -Force $SrcNode (Join-Path $NodeStageDir 'node.exe')
# Bundle npm too so packaged apps with custom deps can `npm install` them. npm.cmd + node_modules\npm sit next to node.exe in the win dist; p_resolve_npm finds node_dir\npm.cmd.
Copy-Item -Force (Join-Path $SrcRoot 'npm.cmd') (Join-Path $NodeStageDir 'npm.cmd')
Copy-Item -Recurse -Force (Join-Path $SrcRoot 'node_modules') (Join-Path $NodeStageDir 'node_modules')
$Size = (Get-Item (Join-Path $NodeStageDir 'node.exe')).Length / 1MB
Write-Host ("[3b] Node {0} (x64) staged ({1:N1} MB)" -f $NodeVersion, $Size)
} finally {
if (Test-Path $NodeZip) { Remove-Item -Force $NodeZip }
if (Test-Path $NodeExtract) { Remove-Item -Recurse -Force $NodeExtract }
}
Write-Host ""
# --- Step 4: Snapshot source dirs into electron\build-staging\ ---
# (Router was already staged in step 3; do not wipe or re-copy it here.)
Write-Host "[4/5] Snapshotting source directories..."
function Copy-Excluded($Source, $Dest, $Exclude) {
# robocopy: built-in, fast, handles long paths.
$args = @($Source, $Dest, '/E', '/NJH', '/NJS', '/NDL', '/NFL', '/NP', '/MT:8')
foreach ($d in $Exclude.Dirs) { $args += '/XD'; $args += $d }
foreach ($f in $Exclude.Files) { $args += '/XF'; $args += $f }
& robocopy @args | Out-Null
# robocopy exit codes 0-7 are success
if ($LASTEXITCODE -ge 8) { throw "robocopy failed ($Source -> $Dest, exit $LASTEXITCODE)" }
$global:LASTEXITCODE = 0
}
Copy-Excluded `
(Join-Path $ProjectRoot 'backend') (Join-Path $Staging 'backend') `
@{ Dirs = @('__pycache__','.venv','data','uv-bin','tests'); Files = @('*.pyc','.env','.env.*') }
# The '.env.*' exclude above is recursive, so it also strips the vendored
# webapp_template/.env.example that seed_workspace copies into each new app's
# .env (BACKEND_PORT=NONE). The mac build anchors its exclude to avoid this;
# here we restore the one file. Without it, Windows-built apps seed with no
# .env, run.sh takes the backend branch, and the app dies on a missing backend.
# (seed_workspace also now writes a default .env when this is absent, but
# shipping it keeps the template snapshot complete and matches mac.)
$EnvExampleSrc = Join-Path $ProjectRoot 'backend\apps\outputs\webapp_template\.env.example'
$EnvExampleDst = Join-Path $Staging 'backend\apps\outputs\webapp_template\.env.example'
if (Test-Path $EnvExampleSrc) {
New-Item -ItemType Directory -Force -Path (Split-Path $EnvExampleDst -Parent) | Out-Null
Copy-Item -Force $EnvExampleSrc $EnvExampleDst
Write-Host "Restored webapp_template/.env.example (stripped by the .env.* exclude)"
}
# --- Step 4b: Pre-build the webapp-template node_modules archive (.tar.gz).
# The Windows build never shipped any node_modules, and the bundled node has no
# npm, so the App Builder frontend had no way to get its deps; the preview died
# with the misleading "backend exited with code 1". We ship a single compressed
# archive (mirrors the Mac build's step 3c); the runtime's _try_extract_bundled_archive
# unpacks it into the warm cache (kicked off in the background by
# warm_cache_in_background at startup, so it is off the first-app create path).
# NOTE: we deliberately do NOT ship node_modules pre-extracted into resources --
# that adds ~30k tiny files which made electron-builder/Squirrel LZMA compression
# blow the build past 50 min and bloats the installer. One .tar.gz (~26 MB) keeps
# the build fast and the installer small. Built natively so the esbuild/rollup
# win32 binaries are correct. Non-fatal: a failure warns but does not break the
# build. Digest == _warm_cache_digest() (sha256 of frontend/package.json, 12 hex).
Write-Host "[4b] Pre-building webapp-template node_modules archive (.tar.gz)..."
try {
$TmplFrontend = Join-Path $Staging 'backend\apps\outputs\webapp_template\frontend'
$PkgJson = Join-Path $TmplFrontend 'package.json'
if (-not (Test-Path $PkgJson)) { throw "template package.json not found at $PkgJson" }
$Digest = (Get-FileHash -Algorithm SHA256 $PkgJson).Hash.ToLower().Substring(0, 12)
$CacheDir = Join-Path $Staging 'backend\apps\outputs\webapp_template_cache'
New-Item -ItemType Directory -Force -Path $CacheDir | Out-Null
$OutArchive = Join-Path $CacheDir "node_modules.$Digest.tar.gz"
$WorkDir = Join-Path $env:TEMP "os-tmpl-nm-$([guid]::NewGuid())"
New-Item -ItemType Directory -Force -Path $WorkDir | Out-Null
try {
Copy-Item -Force $PkgJson (Join-Path $WorkDir 'package.json')
$Lock = Join-Path $TmplFrontend 'package-lock.json'
Push-Location $WorkDir
if (Test-Path $Lock) {
Copy-Item -Force $Lock (Join-Path $WorkDir 'package-lock.json')
& npm ci --prefer-offline --no-audit --no-fund --loglevel=error
} else {
& npm install --prefer-offline --no-audit --no-fund --loglevel=error
}
if ($LASTEXITCODE -ne 0) { throw "npm install/ci failed ($LASTEXITCODE)" }
if (-not (Test-Path (Join-Path $WorkDir 'node_modules'))) { throw "no node_modules produced" }
# tar.exe (bsdtar) ships with Windows 10+; archive root is node_modules/.
& tar -czf $OutArchive -C $WorkDir node_modules
if ($LASTEXITCODE -ne 0) { throw "tar failed ($LASTEXITCODE)" }
Pop-Location
$ArchMB = (Get-Item $OutArchive).Length / 1MB
Write-Host ("[4b] webapp-template archive staged: node_modules.$Digest.tar.gz ({0:N1} MB)" -f $ArchMB)
} finally {
if ((Get-Location).Path -eq $WorkDir) { Pop-Location }
if (Test-Path $WorkDir) { Remove-Item -Recurse -Force $WorkDir }
}
} catch {
Write-Warning "[4b] webapp-template archive build FAILED: $_ (App Builder first-app falls back to live npm; non-fatal)"
}
# data: backend/config/paths.py points DATA_ROOT at %APPDATA%/OpenSwarm/data in
# packaged mode and no code seeds from the bundle, so the entire shipped
# backend/data/ tree was dead weight (and was leaking the dev machine's
# auth.token + install_id + dev session artifacts).
# uv-bin: source dir holds the binary so dev works; staged separately below
# so extraResources can substitute ${arch} (matches the mac build).
# Production .env: OAuth helper base URL + Google credentials. See
# Google client_id/secret are no longer shipped: nothing reads them at runtime,
# so we don't bake a secret into the .env.
$ShipOauthBaseUrl = if ($env:OPENSWARM_OAUTH_BASE_URL_OVERRIDE) {
$env:OPENSWARM_OAUTH_BASE_URL_OVERRIDE
} else {
'https://api.openswarm.com'
}
$ShipEnvPath = Join-Path $Staging 'backend\.env'
New-Item -ItemType Directory -Force -Path (Split-Path $ShipEnvPath -Parent) | Out-Null
@(
"# OAuth helper base URL.",
"OPENSWARM_OAUTH_BASE_URL=$ShipOauthBaseUrl"
) | Set-Content -Path $ShipEnvPath
Write-Host "Staged production .env"
# Stage uv-bin into per-arch staging so package.json extraResources can
# substitute ${arch} and ship only the matching slice. Windows is x64-only
# today; matches the mac build's per-arch staging shape.
$UvStageX64 = Join-Path $Staging 'uv-bin\x64'
New-Item -ItemType Directory -Force -Path $UvStageX64 | Out-Null
Copy-Item -Force (Join-Path $UvBinDir 'uv.exe') (Join-Path $UvStageX64 'uv.exe')
Copy-Item -Force (Join-Path $UvBinDir 'uvx.exe') (Join-Path $UvStageX64 'uvx.exe')
Copy-Excluded `
(Join-Path $ProjectRoot 'debugger') (Join-Path $Staging 'debugger') `
@{ Dirs = @('__pycache__','.venv','node_modules'); Files = @('*.pyc') }
Copy-Item -Recurse -Force (Join-Path $ProjectRoot 'frontend\dist\*') (New-Item -ItemType Directory -Force -Path (Join-Path $Staging 'frontend')).FullName
Write-Host ""
Write-Host "========================================" -BackgroundColor Green -ForegroundColor White
Write-Host " SOURCE SNAPSHOT COMPLETE " -BackgroundColor Green -ForegroundColor White
Write-Host " Safe to modify your codebase now. " -BackgroundColor Green -ForegroundColor White
Write-Host "========================================" -BackgroundColor Green -ForegroundColor White
Write-Host ""
# --- Provenance stamp ---
# Record the exact commit this artifact was built from. electron\build-info.json
# ships inside the asar; main.js reads it for the startup [provenance] log line
# and the About panel. Gitignored + regenerated each build.
$BuildSha = (git -C $ProjectRoot rev-parse HEAD 2>$null)
if (-not $BuildSha) { $BuildSha = 'unknown' }
$BuildVersion = (Get-Content -Raw (Join-Path $ProjectRoot 'electron\package.json') | ConvertFrom-Json).version
$BuildChannel = if ($BuildVersion -match '-') { 'experimental' } else { 'stable' }
$BuildShortSha = if ($BuildSha.Length -ge 12) { $BuildSha.Substring(0, 12) } else { $BuildSha }
$BuildInfo = [ordered]@{
sha = $BuildSha
shortSha = $BuildShortSha
builtAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
channel = $BuildChannel
version = $BuildVersion
}
$BuildInfo | ConvertTo-Json -Compress | Set-Content -Path (Join-Path $ProjectRoot 'electron\build-info.json') -Encoding utf8
Write-Host "Stamped build-info.json: sha=$BuildShortSha channel=$BuildChannel"
# --- Step 5: Package with electron-builder ---
Write-Host "[5/5] Packaging with electron-builder..."
Push-Location (Join-Path $ProjectRoot 'electron')
try {
# npm ci: lockfile-exact, no drift. See frontend note above.
& npm ci
if ($LASTEXITCODE -ne 0) { throw "npm ci (electron) failed" }
if (-not $Sign) {
$env:CSC_IDENTITY_AUTO_DISCOVERY = 'false'
}
if ($DirOnly) {
# Unpacked-only build for the fast CI gate. afterPack (router node_modules)
# and locale-pak filtering still run during the pack phase, so the produced
# win-unpacked\OpenSwarm.exe is fully functional; only the NSIS installer +
# update feed are skipped (verify-update-feed skips cleanly when absent).
& npx electron-builder --win --x64 --dir $TargetOverride --publish never
} elseif ($Publish) {
# Safety check: warn if the matching Mac release isn't on GitHub yet.
# Mac and Windows publishes don't conflict (different asset names,
# different latest*.yml manifests), but a Windows-only release means
# Mac users will skip this version entirely. Better to know now than
# explain it after the fact. Non-fatal; sleeps 8s to let the user
# Ctrl+C if it surprises them.
try {
$pkgJson = Get-Content -Raw (Join-Path $ProjectRoot 'electron\package.json') | ConvertFrom-Json
$version = $pkgJson.version
$macYmlUrl = "https://github.com/openswarm-ai/openswarm/releases/download/v$version/latest-mac.yml"
$null = Invoke-WebRequest -Uri $macYmlUrl -Method Head -UseBasicParsing -ErrorAction Stop -TimeoutSec 10
Write-Host " > Mac release v$version detected on GitHub (latest-mac.yml present). OK to proceed."
} catch {
Write-Host ""
Write-Host "WARNING: Mac release v$version is NOT yet published on GitHub." -ForegroundColor Yellow
Write-Host " -> Uploading Windows assets to a release with no Mac assets means" -ForegroundColor Yellow
Write-Host " Mac users will skip v$version entirely (electron-updater on Mac" -ForegroundColor Yellow
Write-Host " will see no latest-mac.yml). Recommended order:" -ForegroundColor Yellow
Write-Host " 1. bash publish.sh (on the Mac)" -ForegroundColor Yellow
Write-Host " 2. pwsh publish-win.ps1 (here)" -ForegroundColor Yellow
Write-Host " -> Continuing in 8s. Press Ctrl+C to abort." -ForegroundColor Yellow
Start-Sleep -Seconds 8
}
& npx electron-builder --win --x64 $TargetOverride --publish always
} else {
& npx electron-builder --win --x64 $TargetOverride --publish never
}
if ($LASTEXITCODE -ne 0) { throw "electron-builder failed" }
} finally { Pop-Location }
# NOTE: the bundled 9Router's node_modules (which electron-builder 26 drops from
# extraResources) is restored by the build/after-pack.js afterPack hook, which
# runs inside electron-builder BEFORE code-signing so the copied files are sealed
# by the signature. See that file for the why.
Remove-Item -Recurse -Force $Staging -ErrorAction SilentlyContinue
# --- Step 5b: Stable-named installer alias for the website download button ---
# Squirrel names the local installer per `artifactName` (in
# dist\squirrel-windows\) but RENAMES the published asset to
# `openswarm-Setup-<version>.exe`, so the fixed openswarm.com download link
# 404s without this stable-named copy. -Recurse because the .exe sits in the
# squirrel-windows\ subdir, not the dist\ root. Byte copy keeps the signature;
# invisible to the updater, which keys off RELEASES + .nupkg, not the filename.
if ($Publish) {
Write-Host "[5b/5] Uploading stable-named installer alias (OpenSwarm-Setup-x64.exe)..."
$version = (Get-Content -Raw (Join-Path $ProjectRoot 'electron\package.json') | ConvertFrom-Json).version
$DistDir = Join-Path $ProjectRoot 'electron\dist'
$SetupExe = Get-ChildItem -Path $DistDir -Recurse -Filter '*Setup*.exe' -ErrorAction SilentlyContinue | Select-Object -First 1
if (-not $SetupExe) { throw "No Squirrel Setup .exe found under $DistDir to alias" }
if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
throw "gh CLI not found; cannot upload OpenSwarm-Setup-x64.exe alias (install gh or upload it manually)"
}
$AliasExe = Join-Path $DistDir 'OpenSwarm-Setup-x64.exe'
Copy-Item -Force $SetupExe.FullName $AliasExe
& gh release upload "v$version" $AliasExe --repo openswarm-ai/openswarm --clobber
if ($LASTEXITCODE -ne 0) { throw "gh release upload of OpenSwarm-Setup-x64.exe failed" }
Write-Host "Uploaded OpenSwarm-Setup-x64.exe to release v$version."
}
Write-Host ""
Write-Host "========================================"
Write-Host " Build Complete!"
Write-Host "========================================"
Write-Host ""
Write-Host "Output files:"
Get-ChildItem -Path (Join-Path $ProjectRoot 'electron\dist') -Filter '*.exe' -ErrorAction SilentlyContinue | Format-Table Name, Length, LastWriteTime
Get-ChildItem -Path (Join-Path $ProjectRoot 'electron\dist') -Filter '*.zip' -ErrorAction SilentlyContinue | Format-Table Name, Length, LastWriteTime
Reference in New Issue View Git Blame Copy Permalink