build.sh
86 lines · scripts/build.sh at 3f79d81
1#!/usr/bin/env bash
2set -e
4ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
5cd "$ROOT"
7BUN_CMD="${BUN_CMD:-bun}"
8BUN_CMD_WAS_COPIED=0
9BUILD_STAMP="$ROOT/browse/dist/.build-complete"
10BUILD_STAMP_TMP="$BUILD_STAMP.tmp.$$"
12# Setup trusts this stamp as proof that the selected multi-binary build completed.
13# CSO is optional: a failed CSO build or publish is reported and recorded in
14# bin/.gstack-cso-build-result, and the rest of the build still completes (#3071).
15# GSTACK_STRICT_BUILD=1 (CI) makes a CSO failure fatal. Setup may explicitly omit
16# CSO after its host capability probe, while still publishing the general build.
17# Invalidate before touching output so an interrupted build cannot hide staleness.
18rm -f "$BUILD_STAMP" "$BUILD_STAMP_TMP"
20case "$(uname -s)" in
21 MINGW*|MSYS*|CYGWIN*|Windows_NT)
22 bun_path="$(command -v "$BUN_CMD" 2>/dev/null || true)"
23 case "$bun_path" in
24 *[![:ascii:]]*)
25 bun_copy_dir="$ROOT/.tmp-bun-bin"
26 mkdir -p "$bun_copy_dir"
27 cp -f "$bun_path" "$bun_copy_dir/bun.exe"
28 BUN_CMD="$bun_copy_dir/bun.exe"
29 BUN_CMD_WAS_COPIED=1
30 ;;
31 esac
32 ;;
33esac
35# A project's .env or bunfig.toml must never reach the shipped binaries: they run
36# inside untrusted repos, and dotenv could set security switches such as
37# GSTACK_CHROMIUM_NO_SANDBOX while a bunfig preload runs arbitrary code (D0).
38"$BUN_CMD" run vendor:xterm
39# Inside an install, render only the hosts setup installed from this checkout
40# (#1694): every host's render under ~/.claude/skills/gstack is scanned by
41# Claude Code and Cursor. bin/gstack-host-renders.sh owns the record.
42. "$ROOT/bin/gstack-host-renders.sh"
43gstack_render_hosts_select "$ROOT"
44if [ "$GSTACK_RENDER_HOST_LIST" = all ]; then
45 echo "Rendering skills for every host: $GSTACK_RENDER_HOST_REASON"
46 "$BUN_CMD" run gen:skill-docs --host all
47else
48 echo "Rendering skills for: $GSTACK_RENDER_HOST_LIST ($GSTACK_RENDER_HOST_REASON)"
49 for render_host in $GSTACK_RENDER_HOST_LIST; do
50 "$BUN_CMD" run gen:skill-docs --host "$render_host"
51 done
52fi
53"$BUN_CMD" build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig browse/src/cli.ts --outfile browse/dist/browse
54"$BUN_CMD" build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig browse/src/find-browse.ts --outfile browse/dist/find-browse
55"$BUN_CMD" build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig design/src/cli.ts --outfile design/dist/design
56"$BUN_CMD" build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig make-pdf/src/cli.ts --outfile make-pdf/dist/pdf
57"$BUN_CMD" build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig bin/gstack-global-discover.ts --outfile bin/gstack-global-discover
58if [ "${GSTACK_SETUP_RUNNING:-0}" = "1" ] && [ "${GSTACK_SETUP_SKIP_CSO_BUILD:-0}" = "1" ]; then
59 # Setup removes these before invoking us too. Repeat here so the setup-private
60 # escape hatch can never publish a completion stamp beside stale trusted code.
61 rm -f bin/gstack-cso-launcher bin/gstack-cso-launcher.exe \
62 bin/gstack-cso-core bin/gstack-cso-core.exe bin/gstack-cso-watchdog \
63 bin/.gstack-cso-generation bin/.gstack-cso-generation.lock
64else
65 CSO_BUILD_LOG_FILE="$ROOT/bin/.gstack-cso-build.log"
66 if ! (set -o pipefail; GSTACK_CSO_BUILD_LOG="$CSO_BUILD_LOG_FILE" BUN_CMD="$BUN_CMD" bash scripts/build-cso.sh 2>&1 | tee "$CSO_BUILD_LOG_FILE"); then
67 cso_stage="$(sed -n 's/^stage=//p' bin/.gstack-cso-build-result 2>/dev/null | head -1)"
68 if [ "${GSTACK_STRICT_BUILD:-0}" = "1" ]; then
69 echo "CSO ${cso_stage:-build} failed and GSTACK_STRICT_BUILD=1 makes it fatal. Log: $CSO_BUILD_LOG_FILE" >&2
70 exit 1
71 fi
72 echo "CSO unavailable: the ${cso_stage:-build} step failed; the rest of the build continues. Log: $CSO_BUILD_LOG_FILE. Retry: cd $ROOT && bun run build:cso" >&2
73 fi
74fi
75bash browse/scripts/build-node-server.sh
76bash scripts/write-version-files.sh browse/dist/.version design/dist/.version make-pdf/dist/.version
77chmod +x browse/dist/browse browse/dist/find-browse design/dist/design make-pdf/dist/pdf bin/gstack-global-discover
78rm -f .*.bun-build
79if [ "$BUN_CMD_WAS_COPIED" -eq 1 ]; then
80 rm -rf "$ROOT/.tmp-bun-bin"
81fi
83# Publish last and on the same filesystem. A failure or interruption before the
84# rename leaves the canonical stamp absent, which makes setup rebuild everything.
85printf 'complete\n' > "$BUILD_STAMP_TMP"
86mv -f "$BUILD_STAMP_TMP" "$BUILD_STAMP"