mirror of
https://github.com/openswarm-ai/openswarm.git
synced 2026-08-17 18:25:42 +02:00
600 lines
32 KiB
PowerShell
600 lines
32 KiB
PowerShell
# Master build script for the OpenSwarm desktop app on Windows.
|
|
#
|
|
# Usage:
|
|
# pwsh scripts\build-app-win.ps1 Local dev build (unsigned)
|
|
# pwsh scripts\build-app-win.ps1 -Sign Signed build (no publish)
|
|
# pwsh scripts\build-app-win.ps1 -Publish Production build (sign + publish to GitHub Releases)
|
|
#
|
|
# Reads .env.windows (gitignored) for Azure Trusted Signing + GH_TOKEN if -Sign or -Publish.
|
|
|
|
[CmdletBinding()]
|
|
param(
|
|
[switch]$Sign,
|
|
[switch]$Publish,
|
|
# Fast CI gate path: build only the unpacked win-unpacked\ dir (no NSIS
|
|
# installer, no LZMA compression of the ~1GB tree - the slowest packaging
|
|
# phase). verify-all + Playwright drive the unpacked OpenSwarm.exe directly.
|
|
[switch]$DirOnly,
|
|
# Phase 7 A/B: build a Squirrel.Windows installer instead of the default
|
|
# NSIS one, from the SAME staged tree / SAME commit. Opt-in only; NSIS stays
|
|
# the default and shipped target until Squirrel is proven faster AND its
|
|
# rollback works on real Win 10/11 machines. EXPERIMENTAL / unverified in CI.
|
|
[switch]$Squirrel
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
if ($Publish) { $Sign = $true }
|
|
# Override only the win target; everything else (signing hook, extraResources,
|
|
# publish config) merges from electron/package.json's build block unchanged.
|
|
$TargetOverride = if ($Squirrel) { @('--config.win.target=squirrel', '--config.squirrelWindows.iconUrl=https://raw.githubusercontent.com/openswarm-ai/openswarm/main/electron/build/icon.ico') } else { @() }
|
|
|
|
$ScriptDir = Split-Path -Parent $PSCommandPath
|
|
$ProjectRoot = Split-Path -Parent $ScriptDir
|
|
|
|
# --- Load .env.windows if present ---
|
|
$EnvFile = Join-Path $ProjectRoot '.env.windows'
|
|
if (Test-Path $EnvFile) {
|
|
Get-Content $EnvFile | ForEach-Object {
|
|
$line = $_.Trim()
|
|
if ($line -and -not $line.StartsWith('#') -and $line.Contains('=')) {
|
|
$idx = $line.IndexOf('=')
|
|
$name = $line.Substring(0, $idx).Trim()
|
|
$value = $line.Substring($idx + 1).Trim()
|
|
if ($value.StartsWith('"') -and $value.EndsWith('"')) {
|
|
$value = $value.Substring(1, $value.Length - 2)
|
|
}
|
|
Set-Item -Path "Env:$name" -Value $value
|
|
}
|
|
}
|
|
}
|
|
|
|
Write-Host "========================================"
|
|
Write-Host " OpenSwarm Desktop App Builder (Windows)"
|
|
if ($Publish) { Write-Host " Mode: PRODUCTION (sign + publish to GitHub Releases)" }
|
|
elseif ($Sign) { Write-Host " Mode: SIGNED (sign, no publish)" }
|
|
else { Write-Host " Mode: LOCAL (unsigned)" }
|
|
Write-Host "========================================"
|
|
Write-Host ""
|
|
|
|
# --- Required env validation ---
|
|
if ($Sign) {
|
|
$required = @(
|
|
'AZURE_TENANT_ID','AZURE_CLIENT_ID','AZURE_CLIENT_SECRET',
|
|
'AZURE_SIGNING_ENDPOINT','AZURE_SIGNING_ACCOUNT','AZURE_SIGNING_CERT_PROFILE'
|
|
)
|
|
if ($Publish) { $required += 'GH_TOKEN' }
|
|
$missing = $required | Where-Object { -not [Environment]::GetEnvironmentVariable($_) }
|
|
if ($missing.Count -gt 0) {
|
|
Write-Host "ERROR: Missing required environment variables:" -ForegroundColor Red
|
|
$missing | ForEach-Object { Write-Host " - $_" }
|
|
Write-Host "Copy .env.windows.example to .env.windows and fill in values."
|
|
exit 1
|
|
}
|
|
# A signed build is one users actually run, so its Widevine VMP signature is
|
|
# mandatory: the afterPack hook hard-fails on a missing/failed signature rather
|
|
# than ship an installer whose Spotify/Netflix audio is silently dead.
|
|
$env:VMP_REQUIRE_SIGN = '1'
|
|
}
|
|
|
|
# --- Step 0: Bundled uv + uvx for Windows ---
|
|
# IMPORTANT: uvx.exe is a tiny shim that requires sibling uv.exe at runtime.
|
|
# Without uv.exe, MCPs that use `command: uvx` (e.g. Google Workspace) fail
|
|
# with "Could not find the `uv` binary". A prior revision shipped only uvx
|
|
# to save ~30MB; that broke first-launch MCP discovery on fresh Macs and
|
|
# Windows machines without a system uv install. Ship both.
|
|
$UvBinDir = Join-Path $ProjectRoot 'backend\uv-bin'
|
|
New-Item -ItemType Directory -Force -Path $UvBinDir | Out-Null
|
|
$NeedUv = -not (Test-Path (Join-Path $UvBinDir 'uv.exe')) -or `
|
|
-not (Test-Path (Join-Path $UvBinDir 'uvx.exe'))
|
|
if ($NeedUv) {
|
|
# Pinned uv version. "latest" used to mean a fresh uv could appear in any
|
|
# build with zero warning, breaking reproducibility (pillar 3). Override
|
|
# with $env:UV_VERSION when deliberately bumping; keep mac (build-app.sh)
|
|
# in lockstep. 0.11.16 is what "latest" resolved to when this was pinned.
|
|
$UvVersion = if ($env:UV_VERSION) { $env:UV_VERSION } else { '0.11.16' }
|
|
Write-Host "[0] Downloading uv + uvx $UvVersion for Windows..."
|
|
$UvUrl = "https://github.com/astral-sh/uv/releases/download/$UvVersion/uv-x86_64-pc-windows-msvc.zip"
|
|
$TmpZip = Join-Path $env:TEMP "uv-win-$([guid]::NewGuid()).zip"
|
|
$TmpExtract = Join-Path $env:TEMP "uv-win-extract-$([guid]::NewGuid())"
|
|
try {
|
|
Invoke-WebRequest -Uri $UvUrl -OutFile $TmpZip -UseBasicParsing
|
|
Expand-Archive -Path $TmpZip -DestinationPath $TmpExtract -Force
|
|
Get-ChildItem -Path $TmpExtract -Recurse -Filter 'uv.exe' | Select-Object -First 1 | ForEach-Object { Copy-Item $_.FullName (Join-Path $UvBinDir 'uv.exe') -Force }
|
|
Get-ChildItem -Path $TmpExtract -Recurse -Filter 'uvx.exe' | Select-Object -First 1 | ForEach-Object { Copy-Item $_.FullName (Join-Path $UvBinDir 'uvx.exe') -Force }
|
|
Write-Host "uv.exe + uvx.exe downloaded and bundled."
|
|
} finally {
|
|
Remove-Item -Force $TmpZip -ErrorAction SilentlyContinue
|
|
Remove-Item -Recurse -Force $TmpExtract -ErrorAction SilentlyContinue
|
|
}
|
|
} else {
|
|
Write-Host "[0] uv.exe + uvx.exe already present."
|
|
}
|
|
Write-Host ""
|
|
|
|
# --- Step 0a: Sync the splash icon ---
|
|
# electron-builder excludes `build/` from the shipped asar (it's the icon-
|
|
# source directory used to generate .ico). The splash window needs to read
|
|
# the icon at runtime, so we keep a copy at electron\splash\icon.png which
|
|
# IS shipped. See electron/main.js comment at iconPngPath for context.
|
|
Copy-Item -Force `
|
|
(Join-Path $ProjectRoot 'electron\build\icon.png') `
|
|
(Join-Path $ProjectRoot 'electron\splash\icon.png')
|
|
|
|
# --- Step 0b: Bundle npm MCP servers via esbuild ---
|
|
# Each bundle compiles down to a single ~5-15 MB CommonJS file under
|
|
# backend\mcp-bundles\, runs on Electron's bundled Node at runtime
|
|
# (ELECTRON_RUN_AS_NODE=1), and is preferred by tools_lib.py:521 over
|
|
# any pre-installed node_modules tree. Bundling instead of shipping
|
|
# node_modules cuts the installer file count from ~28k -> ~9k, which
|
|
# is the dominant lever on NSIS install time + Defender scan cost.
|
|
$McpBundleDir = Join-Path $ProjectRoot 'backend\mcp-bundles'
|
|
New-Item -ItemType Directory -Force -Path $McpBundleDir | Out-Null
|
|
|
|
# Single-file CJS bundle. Output path: mcp-bundles\<output>.js. Use for
|
|
# packages that don't read sibling files at runtime. The import.meta.url
|
|
# polyfill is applied uniformly because nearly every modern ESM package
|
|
# uses createRequire(import.meta.url) somewhere -- without the polyfill,
|
|
# esbuild's ESM->CJS transform leaves import.meta.url as undefined and
|
|
# the bundle crashes at module load.
|
|
function Build-McpBundleSingle($PackageName, $EntrySubpath, $OutputName) {
|
|
$OutFile = Join-Path $McpBundleDir $OutputName
|
|
if ((Test-Path $OutFile) -and -not $env:OPENSWARM_REBUILD_BUNDLES) {
|
|
Write-Host "[0b] $PackageName bundle already present (set `$env:OPENSWARM_REBUILD_BUNDLES='1' to force rebuild)."
|
|
return
|
|
}
|
|
Write-Host "[0b] Bundling $PackageName -> $OutputName ..."
|
|
$TmpDir = Join-Path $env:TEMP "openswarm-mcp-$([guid]::NewGuid())"
|
|
New-Item -ItemType Directory -Force -Path $TmpDir | Out-Null
|
|
Push-Location $TmpDir
|
|
try {
|
|
& npm install $PackageName --silent 2>$null
|
|
if ($LASTEXITCODE -ne 0) { throw "$PackageName install failed" }
|
|
$EntryPath = Join-Path (Join-Path $TmpDir 'node_modules') $EntrySubpath
|
|
if (-not (Test-Path $EntryPath)) { throw "$PackageName entry not found at $EntryPath" }
|
|
$banner = 'const __OPENSWARM_IMPORT_META_URL__ = require("url").pathToFileURL(__filename).href;'
|
|
& npx esbuild $EntryPath --bundle --platform=node --format=cjs --target=node22 --legal-comments=none `
|
|
--define:import.meta.url=__OPENSWARM_IMPORT_META_URL__ `
|
|
"--banner:js=$banner" `
|
|
"--outfile=$OutFile"
|
|
if ($LASTEXITCODE -ne 0) { throw "esbuild failed for $PackageName" }
|
|
Write-Host "$PackageName bundled."
|
|
} finally {
|
|
Pop-Location
|
|
Remove-Item -Recurse -Force $TmpDir -ErrorAction SilentlyContinue
|
|
}
|
|
}
|
|
|
|
# Multi-file bundle. Output is a directory mcp-bundles\<dir>\ that mirrors the
|
|
# upstream SDK's "package_root\dist\index.js + ..\package.json" layout. Use this
|
|
# for packages whose source reads __dirname\..\package.json (for --version) or
|
|
# other sibling data files (e.g. @softeria\ms-365-mcp-server reads endpoints.json).
|
|
function Build-McpBundleDir($PackageName, $EntrySubpath, $OutDirName, $Extras, $External) {
|
|
$OutDir = Join-Path $McpBundleDir $OutDirName
|
|
$OutBundle = Join-Path (Join-Path $OutDir 'dist') 'index.js'
|
|
if ((Test-Path $OutBundle) -and -not $env:OPENSWARM_REBUILD_BUNDLES) {
|
|
Write-Host "[0b] $PackageName bundle dir already present."
|
|
return
|
|
}
|
|
Write-Host "[0b] Bundling $PackageName -> $OutDirName\ ..."
|
|
$TmpDir = Join-Path $env:TEMP "openswarm-mcp-$([guid]::NewGuid())"
|
|
New-Item -ItemType Directory -Force -Path $TmpDir | Out-Null
|
|
if (Test-Path $OutDir) { Remove-Item -Recurse -Force $OutDir }
|
|
New-Item -ItemType Directory -Force -Path (Join-Path $OutDir 'dist') | Out-Null
|
|
Push-Location $TmpDir
|
|
try {
|
|
& npm install $PackageName --silent 2>$null
|
|
if ($LASTEXITCODE -ne 0) { throw "$PackageName install failed" }
|
|
$EntryPath = Join-Path (Join-Path $TmpDir 'node_modules') $EntrySubpath
|
|
if (-not (Test-Path $EntryPath)) { throw "$PackageName entry not found at $EntryPath" }
|
|
|
|
# Stripped sibling package.json (omits "type":"module" so Node treats the CJS bundle correctly)
|
|
$SdkPkgPath = Join-Path (Join-Path $TmpDir 'node_modules') (Join-Path $PackageName 'package.json')
|
|
$SdkPkgJson = Get-Content -Raw $SdkPkgPath | ConvertFrom-Json
|
|
$SdkVersion = $SdkPkgJson.version
|
|
$StrippedPkg = "{`"name`":`"$PackageName`",`"version`":`"$SdkVersion`"}"
|
|
Set-Content -Path (Join-Path $OutDir 'package.json') -Value $StrippedPkg -NoNewline
|
|
|
|
# Copy sibling data files
|
|
if ($Extras) {
|
|
foreach ($pair in $Extras) {
|
|
$src, $dst = $pair -split '='
|
|
$srcAbs = Join-Path (Join-Path $TmpDir 'node_modules') $src
|
|
$dstAbs = Join-Path $OutDir $dst
|
|
New-Item -ItemType Directory -Force -Path (Split-Path $dstAbs -Parent) | Out-Null
|
|
Copy-Item -Force $srcAbs $dstAbs
|
|
}
|
|
}
|
|
|
|
$banner = 'const __OPENSWARM_IMPORT_META_URL__ = require("url").pathToFileURL(__filename).href;'
|
|
$esbuildArgs = @(
|
|
$EntryPath, '--bundle', '--platform=node', '--format=cjs',
|
|
'--target=node22', '--legal-comments=none',
|
|
'--define:import.meta.url=__OPENSWARM_IMPORT_META_URL__',
|
|
"--banner:js=$banner",
|
|
"--outfile=$OutBundle"
|
|
)
|
|
if ($External) {
|
|
foreach ($ext in $External) { $esbuildArgs += "--external:$ext" }
|
|
}
|
|
& npx esbuild @esbuildArgs
|
|
if ($LASTEXITCODE -ne 0) { throw "esbuild failed for $PackageName" }
|
|
Write-Host "$PackageName bundled."
|
|
} finally {
|
|
Pop-Location
|
|
Remove-Item -Recurse -Force $TmpDir -ErrorAction SilentlyContinue
|
|
}
|
|
}
|
|
|
|
Build-McpBundleSingle 'reddit-mcp-buddy' 'reddit-mcp-buddy/dist/index.js' 'reddit-mcp-buddy.js'
|
|
Build-McpBundleDir '@notionhq/notion-mcp-server' '@notionhq/notion-mcp-server/bin/cli.mjs' `
|
|
'notionhq-notion-mcp-server' `
|
|
@('@notionhq/notion-mcp-server/scripts/notion-openapi.json=scripts/notion-openapi.json') `
|
|
@()
|
|
Build-McpBundleDir '@softeria/ms-365-mcp-server' '@softeria/ms-365-mcp-server/dist/index.js' `
|
|
'softeria-ms-365-mcp-server' `
|
|
@('@softeria/ms-365-mcp-server/dist/endpoints.json=dist/endpoints.json') `
|
|
@('keytar')
|
|
|
|
# Wipe legacy single-file Notion bundle if the dir-style bundle now supersedes it.
|
|
$LegacyNotionFile = Join-Path $McpBundleDir 'notionhq-notion-mcp-server.js'
|
|
$NotionDir = Join-Path $McpBundleDir 'notionhq-notion-mcp-server'
|
|
if ((Test-Path $LegacyNotionFile) -and (Test-Path $NotionDir)) {
|
|
Remove-Item -Force $LegacyNotionFile
|
|
}
|
|
|
|
# Defensively wipe any legacy npm-servers/ tree from prior builds so it
|
|
# doesn't ride along into the installer (would re-introduce the ~19k
|
|
# files we just removed by switching to bundling).
|
|
$LegacyNpmServers = Join-Path $ProjectRoot 'backend\npm-servers'
|
|
if (Test-Path $LegacyNpmServers) {
|
|
Write-Host "[0b] Removing legacy backend\npm-servers\ (now superseded by mcp-bundles)..."
|
|
Remove-Item -Recurse -Force $LegacyNpmServers
|
|
}
|
|
Write-Host ""
|
|
|
|
# --- Step 1: Frontend build ---
|
|
Write-Host "[1/5] Building frontend..."
|
|
Push-Location (Join-Path $ProjectRoot 'frontend')
|
|
try {
|
|
# npm ci (not install): installs exactly what package-lock.json pins, never
|
|
# silently mutates the lock, fails loudly on drift. Reproducible builds
|
|
# (pillar 3) depend on the lock being boss.
|
|
& npm ci
|
|
if ($LASTEXITCODE -ne 0) { throw "npm ci (frontend) failed" }
|
|
& npm run build
|
|
if ($LASTEXITCODE -ne 0) { throw "frontend build failed" }
|
|
} finally { Pop-Location }
|
|
if (-not (Test-Path (Join-Path $ProjectRoot 'frontend\dist\index.html'))) {
|
|
throw "Frontend build failed - dist\index.html not found"
|
|
}
|
|
Write-Host "Frontend build complete."
|
|
Write-Host ""
|
|
|
|
# --- Step 2: Python env ---
|
|
$PythonEnv = Join-Path $ProjectRoot 'electron\python-env'
|
|
$PythonExe = Join-Path $PythonEnv 'python.exe'
|
|
if ((Test-Path $PythonExe) -and -not $env:OPENSWARM_REBUILD_PYTHON) {
|
|
Write-Host "[2/5] Python environment already present at $PythonEnv (set `$env:OPENSWARM_REBUILD_PYTHON='1' to force rebuild)."
|
|
} else {
|
|
Write-Host "[2/5] Building Python environment..."
|
|
& (Join-Path $ScriptDir 'build-python-env-win.ps1')
|
|
if ($LASTEXITCODE -ne 0) { throw "Python env build failed" }
|
|
}
|
|
if (-not (Test-Path (Join-Path $ProjectRoot 'electron\python-env'))) {
|
|
throw "Python environment not found at electron\python-env\"
|
|
}
|
|
Write-Host "Python environment ready."
|
|
Write-Host ""
|
|
# NOTE: #9 items 1+3 (zip stdlib + pyc-only site-packages) were measured to give
|
|
# NO cold-start benefit (cold is native-binary-scan-bound, not file-count-bound),
|
|
# so they are NOT wired in. scripts/zip-python-stdlib.ps1 + strip-py-to-pyc.ps1
|
|
# remain as drafts. The cold lever is the opt-in Defender exclusion (item 5).
|
|
|
|
# --- Step 3: Fetch Router from npm ---
|
|
# The 9router Next.js server is published as an npm package with a pre-built
|
|
# standalone output. Stage it directly from npm instead of vendoring + rebuilding.
|
|
Write-Host "[3/5] Fetching Router from npm..."
|
|
$Staging = Join-Path $ProjectRoot 'electron\build-staging'
|
|
if (Test-Path $Staging) { Remove-Item -Recurse -Force $Staging }
|
|
New-Item -ItemType Directory -Force -Path $Staging | Out-Null
|
|
|
|
& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $ProjectRoot 'scripts\fetch-router.ps1') -Dest (Join-Path $Staging 'router')
|
|
if ($LASTEXITCODE -ne 0) { throw "fetch-router.ps1 failed" }
|
|
|
|
if (-not (Test-Path (Join-Path $Staging 'router\server.js'))) {
|
|
throw "Router fetch failed - server.js not found in staging"
|
|
}
|
|
Write-Host "Router staged."
|
|
Write-Host ""
|
|
|
|
# --- Step 3b: Bundle a real Node.js binary so 9Router and MCP servers
|
|
# don't fall back to ELECTRON_RUN_AS_NODE on user machines without system
|
|
# node. Wins: (1) avoids the bouncing "exec" Dock icon (irrelevant on
|
|
# Windows but matches the macOS build for consistency); (2) shrinks
|
|
# 9Router cold-start from ~10s (Electron-as-Node) to ~1-2s (real node),
|
|
# which directly shrinks the splash window the user sees during boot.
|
|
# Pinned to Node 20 LTS, NODE_MODULE_VERSION 115. 9router 0.3.60 has
|
|
# no native bindings (sql.js, not better-sqlite3) so any Node 18+ works.
|
|
Write-Host "[3b/5] Bundling Node.js runtime..."
|
|
$NodeVersion = 'v20.18.1'
|
|
$NodeStageDir = Join-Path $Staging 'node\x64'
|
|
New-Item -ItemType Directory -Force -Path $NodeStageDir | Out-Null
|
|
$NodeZip = Join-Path $env:TEMP "node-win-$([guid]::NewGuid()).zip"
|
|
$NodeExtract = Join-Path $env:TEMP "node-win-extract-$([guid]::NewGuid())"
|
|
try {
|
|
$NodeUrl = "https://nodejs.org/dist/$NodeVersion/node-$NodeVersion-win-x64.zip"
|
|
Write-Host "[3b] Downloading $NodeUrl..."
|
|
Invoke-WebRequest -Uri $NodeUrl -OutFile $NodeZip -UseBasicParsing
|
|
Expand-Archive -Path $NodeZip -DestinationPath $NodeExtract -Force
|
|
$SrcRoot = Join-Path $NodeExtract "node-$NodeVersion-win-x64"
|
|
$SrcNode = Join-Path $SrcRoot 'node.exe'
|
|
if (-not (Test-Path $SrcNode)) { throw "node.exe not found at $SrcNode after extract" }
|
|
Copy-Item -Force $SrcNode (Join-Path $NodeStageDir 'node.exe')
|
|
# Bundle npm too so packaged apps with custom deps can `npm install` them. npm.cmd + node_modules\npm sit next to node.exe in the win dist; p_resolve_npm finds node_dir\npm.cmd.
|
|
Copy-Item -Force (Join-Path $SrcRoot 'npm.cmd') (Join-Path $NodeStageDir 'npm.cmd')
|
|
Copy-Item -Recurse -Force (Join-Path $SrcRoot 'node_modules') (Join-Path $NodeStageDir 'node_modules')
|
|
$Size = (Get-Item (Join-Path $NodeStageDir 'node.exe')).Length / 1MB
|
|
Write-Host ("[3b] Node {0} (x64) staged ({1:N1} MB)" -f $NodeVersion, $Size)
|
|
} finally {
|
|
if (Test-Path $NodeZip) { Remove-Item -Force $NodeZip }
|
|
if (Test-Path $NodeExtract) { Remove-Item -Recurse -Force $NodeExtract }
|
|
}
|
|
Write-Host ""
|
|
|
|
# --- Step 4: Snapshot source dirs into electron\build-staging\ ---
|
|
# (Router was already staged in step 3; do not wipe or re-copy it here.)
|
|
Write-Host "[4/5] Snapshotting source directories..."
|
|
|
|
function Copy-Excluded($Source, $Dest, $Exclude) {
|
|
# robocopy: built-in, fast, handles long paths.
|
|
$args = @($Source, $Dest, '/E', '/NJH', '/NJS', '/NDL', '/NFL', '/NP', '/MT:8')
|
|
foreach ($d in $Exclude.Dirs) { $args += '/XD'; $args += $d }
|
|
foreach ($f in $Exclude.Files) { $args += '/XF'; $args += $f }
|
|
& robocopy @args | Out-Null
|
|
# robocopy exit codes 0-7 are success
|
|
if ($LASTEXITCODE -ge 8) { throw "robocopy failed ($Source -> $Dest, exit $LASTEXITCODE)" }
|
|
$global:LASTEXITCODE = 0
|
|
}
|
|
|
|
Copy-Excluded `
|
|
(Join-Path $ProjectRoot 'backend') (Join-Path $Staging 'backend') `
|
|
@{ Dirs = @('__pycache__','.venv','data','uv-bin','tests'); Files = @('*.pyc','.env','.env.*') }
|
|
# The '.env.*' exclude above is recursive, so it also strips the vendored
|
|
# webapp_template/.env.example that seed_workspace copies into each new app's
|
|
# .env (BACKEND_PORT=NONE). The mac build anchors its exclude to avoid this;
|
|
# here we restore the one file. Without it, Windows-built apps seed with no
|
|
# .env, run.sh takes the backend branch, and the app dies on a missing backend.
|
|
# (seed_workspace also now writes a default .env when this is absent, but
|
|
# shipping it keeps the template snapshot complete and matches mac.)
|
|
$EnvExampleSrc = Join-Path $ProjectRoot 'backend\apps\outputs\webapp_template\.env.example'
|
|
$EnvExampleDst = Join-Path $Staging 'backend\apps\outputs\webapp_template\.env.example'
|
|
if (Test-Path $EnvExampleSrc) {
|
|
New-Item -ItemType Directory -Force -Path (Split-Path $EnvExampleDst -Parent) | Out-Null
|
|
Copy-Item -Force $EnvExampleSrc $EnvExampleDst
|
|
Write-Host "Restored webapp_template/.env.example (stripped by the .env.* exclude)"
|
|
}
|
|
|
|
# --- Step 4b: Pre-build the webapp-template node_modules archive (.tar.gz).
|
|
# The Windows build never shipped any node_modules, and the bundled node has no
|
|
# npm, so the App Builder frontend had no way to get its deps; the preview died
|
|
# with the misleading "backend exited with code 1". We ship a single compressed
|
|
# archive (mirrors the Mac build's step 3c); the runtime's _try_extract_bundled_archive
|
|
# unpacks it into the warm cache (kicked off in the background by
|
|
# warm_cache_in_background at startup, so it is off the first-app create path).
|
|
# NOTE: we deliberately do NOT ship node_modules pre-extracted into resources --
|
|
# that adds ~30k tiny files which made electron-builder/Squirrel LZMA compression
|
|
# blow the build past 50 min and bloats the installer. One .tar.gz (~26 MB) keeps
|
|
# the build fast and the installer small. Built natively so the esbuild/rollup
|
|
# win32 binaries are correct. Non-fatal: a failure warns but does not break the
|
|
# build. Digest == _warm_cache_digest() (sha256 of frontend/package.json, 12 hex).
|
|
Write-Host "[4b] Pre-building webapp-template node_modules archive (.tar.gz)..."
|
|
try {
|
|
$TmplFrontend = Join-Path $Staging 'backend\apps\outputs\webapp_template\frontend'
|
|
$PkgJson = Join-Path $TmplFrontend 'package.json'
|
|
if (-not (Test-Path $PkgJson)) { throw "template package.json not found at $PkgJson" }
|
|
$Digest = (Get-FileHash -Algorithm SHA256 $PkgJson).Hash.ToLower().Substring(0, 12)
|
|
$CacheDir = Join-Path $Staging 'backend\apps\outputs\webapp_template_cache'
|
|
New-Item -ItemType Directory -Force -Path $CacheDir | Out-Null
|
|
$OutArchive = Join-Path $CacheDir "node_modules.$Digest.tar.gz"
|
|
$WorkDir = Join-Path $env:TEMP "os-tmpl-nm-$([guid]::NewGuid())"
|
|
New-Item -ItemType Directory -Force -Path $WorkDir | Out-Null
|
|
try {
|
|
Copy-Item -Force $PkgJson (Join-Path $WorkDir 'package.json')
|
|
$Lock = Join-Path $TmplFrontend 'package-lock.json'
|
|
Push-Location $WorkDir
|
|
if (Test-Path $Lock) {
|
|
Copy-Item -Force $Lock (Join-Path $WorkDir 'package-lock.json')
|
|
& npm ci --prefer-offline --no-audit --no-fund --loglevel=error
|
|
} else {
|
|
& npm install --prefer-offline --no-audit --no-fund --loglevel=error
|
|
}
|
|
if ($LASTEXITCODE -ne 0) { throw "npm install/ci failed ($LASTEXITCODE)" }
|
|
if (-not (Test-Path (Join-Path $WorkDir 'node_modules'))) { throw "no node_modules produced" }
|
|
# tar.exe (bsdtar) ships with Windows 10+; archive root is node_modules/.
|
|
& tar -czf $OutArchive -C $WorkDir node_modules
|
|
if ($LASTEXITCODE -ne 0) { throw "tar failed ($LASTEXITCODE)" }
|
|
Pop-Location
|
|
$ArchMB = (Get-Item $OutArchive).Length / 1MB
|
|
Write-Host ("[4b] webapp-template archive staged: node_modules.$Digest.tar.gz ({0:N1} MB)" -f $ArchMB)
|
|
} finally {
|
|
if ((Get-Location).Path -eq $WorkDir) { Pop-Location }
|
|
if (Test-Path $WorkDir) { Remove-Item -Recurse -Force $WorkDir }
|
|
}
|
|
} catch {
|
|
Write-Warning "[4b] webapp-template archive build FAILED: $_ (App Builder first-app falls back to live npm; non-fatal)"
|
|
}
|
|
# data: backend/config/paths.py points DATA_ROOT at %APPDATA%/OpenSwarm/data in
|
|
# packaged mode and no code seeds from the bundle, so the entire shipped
|
|
# backend/data/ tree was dead weight (and was leaking the dev machine's
|
|
# auth.token + install_id + dev session artifacts).
|
|
# uv-bin: source dir holds the binary so dev works; staged separately below
|
|
# so extraResources can substitute ${arch} (matches the mac build).
|
|
|
|
# Production .env: OAuth helper base URL + Google credentials. See
|
|
# Google client_id/secret are no longer shipped: nothing reads them at runtime,
|
|
# so we don't bake a secret into the .env.
|
|
$ShipOauthBaseUrl = if ($env:OPENSWARM_OAUTH_BASE_URL_OVERRIDE) {
|
|
$env:OPENSWARM_OAUTH_BASE_URL_OVERRIDE
|
|
} else {
|
|
'https://api.openswarm.com'
|
|
}
|
|
$ShipEnvPath = Join-Path $Staging 'backend\.env'
|
|
New-Item -ItemType Directory -Force -Path (Split-Path $ShipEnvPath -Parent) | Out-Null
|
|
@(
|
|
"# OAuth helper base URL.",
|
|
"OPENSWARM_OAUTH_BASE_URL=$ShipOauthBaseUrl"
|
|
) | Set-Content -Path $ShipEnvPath
|
|
Write-Host "Staged production .env"
|
|
|
|
# Stage uv-bin into per-arch staging so package.json extraResources can
|
|
# substitute ${arch} and ship only the matching slice. Windows is x64-only
|
|
# today; matches the mac build's per-arch staging shape.
|
|
$UvStageX64 = Join-Path $Staging 'uv-bin\x64'
|
|
New-Item -ItemType Directory -Force -Path $UvStageX64 | Out-Null
|
|
Copy-Item -Force (Join-Path $UvBinDir 'uv.exe') (Join-Path $UvStageX64 'uv.exe')
|
|
Copy-Item -Force (Join-Path $UvBinDir 'uvx.exe') (Join-Path $UvStageX64 'uvx.exe')
|
|
|
|
Copy-Excluded `
|
|
(Join-Path $ProjectRoot 'debugger') (Join-Path $Staging 'debugger') `
|
|
@{ Dirs = @('__pycache__','.venv','node_modules'); Files = @('*.pyc') }
|
|
|
|
Copy-Item -Recurse -Force (Join-Path $ProjectRoot 'frontend\dist\*') (New-Item -ItemType Directory -Force -Path (Join-Path $Staging 'frontend')).FullName
|
|
|
|
Write-Host ""
|
|
Write-Host "========================================" -BackgroundColor Green -ForegroundColor White
|
|
Write-Host " SOURCE SNAPSHOT COMPLETE " -BackgroundColor Green -ForegroundColor White
|
|
Write-Host " Safe to modify your codebase now. " -BackgroundColor Green -ForegroundColor White
|
|
Write-Host "========================================" -BackgroundColor Green -ForegroundColor White
|
|
Write-Host ""
|
|
|
|
# --- Provenance stamp ---
|
|
# Record the exact commit this artifact was built from. electron\build-info.json
|
|
# ships inside the asar; main.js reads it for the startup [provenance] log line
|
|
# and the About panel. Gitignored + regenerated each build.
|
|
$BuildSha = (git -C $ProjectRoot rev-parse HEAD 2>$null)
|
|
if (-not $BuildSha) { $BuildSha = 'unknown' }
|
|
$BuildVersion = (Get-Content -Raw (Join-Path $ProjectRoot 'electron\package.json') | ConvertFrom-Json).version
|
|
$BuildChannel = if ($BuildVersion -match '-') { 'experimental' } else { 'stable' }
|
|
$BuildShortSha = if ($BuildSha.Length -ge 12) { $BuildSha.Substring(0, 12) } else { $BuildSha }
|
|
$BuildInfo = [ordered]@{
|
|
sha = $BuildSha
|
|
shortSha = $BuildShortSha
|
|
builtAt = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
|
|
channel = $BuildChannel
|
|
version = $BuildVersion
|
|
}
|
|
$BuildInfo | ConvertTo-Json -Compress | Set-Content -Path (Join-Path $ProjectRoot 'electron\build-info.json') -Encoding utf8
|
|
Write-Host "Stamped build-info.json: sha=$BuildShortSha channel=$BuildChannel"
|
|
|
|
# --- Step 4.5: Sign the bundled Claude CLI before packaging ---
|
|
# The Bun-compiled claude.exe ships unsigned inside python-env, and Windows AV
|
|
# quarantines it out of installed apps (field class: "Claude Code not found",
|
|
# permanent product death). Sign it with the same Azure Trusted Signing hook as
|
|
# the app exe, then smoke it: Authenticode appends to the PE, and a Bun exe that
|
|
# locates its embedded bundle end-of-file-relative would break; a broken CLI must
|
|
# fail the build here, never ship.
|
|
if ($Sign) {
|
|
$BundledCli = Join-Path $ProjectRoot 'electron\python-env\Lib\site-packages\claude_agent_sdk\_bundled\claude.exe'
|
|
if (-not (Test-Path $BundledCli)) { throw "bundled claude.exe not found at $BundledCli (python-env layout changed?)" }
|
|
Write-Host "[4.5/5] Signing bundled Claude CLI..."
|
|
Push-Location $ProjectRoot
|
|
try {
|
|
& node -e "require('./electron/build/sign-windows.js').default({ path: process.argv[1] }).then(() => process.exit(0), (e) => { console.error(e); process.exit(1); })" $BundledCli
|
|
if ($LASTEXITCODE -ne 0) { throw "signing bundled claude.exe failed" }
|
|
} finally {
|
|
Pop-Location
|
|
}
|
|
& $BundledCli --version
|
|
if ($LASTEXITCODE -ne 0) { throw "signed claude.exe no longer runs (signing corrupted the Bun binary); aborting build" }
|
|
Write-Host "Bundled Claude CLI signed and still runs."
|
|
Write-Host ""
|
|
}
|
|
|
|
# --- Step 5: Package with electron-builder ---
|
|
Write-Host "[5/5] Packaging with electron-builder..."
|
|
Push-Location (Join-Path $ProjectRoot 'electron')
|
|
try {
|
|
# npm ci: lockfile-exact, no drift. See frontend note above.
|
|
& npm ci
|
|
if ($LASTEXITCODE -ne 0) { throw "npm ci (electron) failed" }
|
|
|
|
if (-not $Sign) {
|
|
$env:CSC_IDENTITY_AUTO_DISCOVERY = 'false'
|
|
}
|
|
|
|
if ($DirOnly) {
|
|
# Unpacked-only build for the fast CI gate. afterPack (router node_modules)
|
|
# and locale-pak filtering still run during the pack phase, so the produced
|
|
# win-unpacked\OpenSwarm.exe is fully functional; only the NSIS installer +
|
|
# update feed are skipped (verify-update-feed skips cleanly when absent).
|
|
& npx electron-builder --win --x64 --dir $TargetOverride --publish never
|
|
} elseif ($Publish) {
|
|
# Safety check: warn if the matching Mac release isn't on GitHub yet.
|
|
# Mac and Windows publishes don't conflict (different asset names,
|
|
# different latest*.yml manifests), but a Windows-only release means
|
|
# Mac users will skip this version entirely. Better to know now than
|
|
# explain it after the fact. Non-fatal; sleeps 8s to let the user
|
|
# Ctrl+C if it surprises them.
|
|
try {
|
|
$pkgJson = Get-Content -Raw (Join-Path $ProjectRoot 'electron\package.json') | ConvertFrom-Json
|
|
$version = $pkgJson.version
|
|
$macYmlUrl = "https://github.com/openswarm-ai/openswarm/releases/download/v$version/latest-mac.yml"
|
|
$null = Invoke-WebRequest -Uri $macYmlUrl -Method Head -UseBasicParsing -ErrorAction Stop -TimeoutSec 10
|
|
Write-Host " > Mac release v$version detected on GitHub (latest-mac.yml present). OK to proceed."
|
|
} catch {
|
|
Write-Host ""
|
|
Write-Host "WARNING: Mac release v$version is NOT yet published on GitHub." -ForegroundColor Yellow
|
|
Write-Host " -> Uploading Windows assets to a release with no Mac assets means" -ForegroundColor Yellow
|
|
Write-Host " Mac users will skip v$version entirely (electron-updater on Mac" -ForegroundColor Yellow
|
|
Write-Host " will see no latest-mac.yml). Recommended order:" -ForegroundColor Yellow
|
|
Write-Host " 1. bash publish.sh (on the Mac)" -ForegroundColor Yellow
|
|
Write-Host " 2. pwsh publish-win.ps1 (here)" -ForegroundColor Yellow
|
|
Write-Host " -> Continuing in 8s. Press Ctrl+C to abort." -ForegroundColor Yellow
|
|
Start-Sleep -Seconds 8
|
|
}
|
|
& npx electron-builder --win --x64 $TargetOverride --publish always
|
|
} else {
|
|
& npx electron-builder --win --x64 $TargetOverride --publish never
|
|
}
|
|
if ($LASTEXITCODE -ne 0) { throw "electron-builder failed" }
|
|
} finally { Pop-Location }
|
|
|
|
# NOTE: the bundled 9Router's node_modules (which electron-builder 26 drops from
|
|
# extraResources) is restored by the build/after-pack.js afterPack hook, which
|
|
# runs inside electron-builder BEFORE code-signing so the copied files are sealed
|
|
# by the signature. See that file for the why.
|
|
|
|
Remove-Item -Recurse -Force $Staging -ErrorAction SilentlyContinue
|
|
|
|
# --- Step 5b: Stable-named installer alias for the website download button ---
|
|
# Squirrel names the local installer per `artifactName` (in
|
|
# dist\squirrel-windows\) but RENAMES the published asset to
|
|
# `openswarm-Setup-<version>.exe`, so the fixed openswarm.com download link
|
|
# 404s without this stable-named copy. -Recurse because the .exe sits in the
|
|
# squirrel-windows\ subdir, not the dist\ root. Byte copy keeps the signature;
|
|
# invisible to the updater, which keys off RELEASES + .nupkg, not the filename.
|
|
if ($Publish) {
|
|
Write-Host "[5b/5] Uploading stable-named installer alias (OpenSwarm-Setup-x64.exe)..."
|
|
$version = (Get-Content -Raw (Join-Path $ProjectRoot 'electron\package.json') | ConvertFrom-Json).version
|
|
$DistDir = Join-Path $ProjectRoot 'electron\dist'
|
|
$SetupExe = Get-ChildItem -Path $DistDir -Recurse -Filter '*Setup*.exe' -ErrorAction SilentlyContinue | Select-Object -First 1
|
|
if (-not $SetupExe) { throw "No Squirrel Setup .exe found under $DistDir to alias" }
|
|
if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
|
|
throw "gh CLI not found; cannot upload OpenSwarm-Setup-x64.exe alias (install gh or upload it manually)"
|
|
}
|
|
$AliasExe = Join-Path $DistDir 'OpenSwarm-Setup-x64.exe'
|
|
Copy-Item -Force $SetupExe.FullName $AliasExe
|
|
& gh release upload "v$version" $AliasExe --repo openswarm-ai/openswarm --clobber
|
|
if ($LASTEXITCODE -ne 0) { throw "gh release upload of OpenSwarm-Setup-x64.exe failed" }
|
|
Write-Host "Uploaded OpenSwarm-Setup-x64.exe to release v$version."
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "========================================"
|
|
Write-Host " Build Complete!"
|
|
Write-Host "========================================"
|
|
Write-Host ""
|
|
Write-Host "Output files:"
|
|
Get-ChildItem -Path (Join-Path $ProjectRoot 'electron\dist') -Filter '*.exe' -ErrorAction SilentlyContinue | Format-Table Name, Length, LastWriteTime
|
|
Get-ChildItem -Path (Join-Path $ProjectRoot 'electron\dist') -Filter '*.zip' -ErrorAction SilentlyContinue | Format-Table Name, Length, LastWriteTime
|