feat: support macOS arm64 remote Agent hosts
Extend GoodBuddy Agent packaging, installation, SSH attachment, Runtime lifecycle, and Desktop package management to macOS arm64. Linux x64, Linux arm64, and Darwin arm64 share the existing signed catalog. Preserve Ask read-only behavior and Execute account permissions, and stop detached tool descendants during Mac cancellation. Upgrade Desktop before publishing the first mixed-platform catalog because older Linux-only readers reject Darwin entries. Intel Macs are not supported; no launchd service or administrator access is required. This commit does not publish a release. Validation: 3520 tests passed, 57 skipped; typecheck, lint, and development build passed. Real Mac installation, Ask/Execute, cancellation and reconnect passed; final Linux installation, Ask and reconnect passed. Nine real model requests were recorded. Release note: 支持将 Apple Silicon Mac 用作远程项目 Host，可安装 macOS arm64 Agent 并使用 Ask、Execute 和断线重连；与 Linux 共用一个包目录，发布混合目录前需升级 Desktop。
This commit is contained in:
mesalogo
@@ -0,0 +1,151 @@
|
||||
import { createHash, generateKeyPairSync, sign } from 'node:crypto'
|
||||
import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
|
||||
import { createRequire } from 'node:module'
|
||||
import { tmpdir } from 'node:os'
|
||||
import { dirname, join } from 'node:path'
|
||||
import { c as createTar } from 'tar'
|
||||
import { unzipSync } from 'fflate'
|
||||
import { afterEach, describe, expect, it } from 'vitest'
|
||||
|
||||
const require = createRequire(import.meta.url)
|
||||
const ci = require('../build/agent-ci-bundle.cjs') as {
|
||||
readCiLocks(platform?: string, arch?: string): {
|
||||
lock: { agentVersion: string; node: { targets: Record<string, unknown> }; protocol: object }
|
||||
runtimeLock: { runtimes: { opencode: { version: string; targets: Record<string, { package: string; integrity: string }> } } }
|
||||
}
|
||||
}
|
||||
const agent = require('../build/agent-bundle.cjs') as {
|
||||
koffiPayloadPaths(arch: string, platform: string): { required: string[]; native: string[] }
|
||||
createManifest(directory: string, metadata: object): object
|
||||
canonicalManifestBytes(manifest: object): Buffer
|
||||
signaturePayload(bytes: Buffer): Buffer
|
||||
}
|
||||
const runtime = require('../build/remote-runtime-bundle.cjs') as {
|
||||
buildRuntimeBundle(options: object): { bundleDirectory: string; manifest: { platform: string } }
|
||||
}
|
||||
const packager = require('../build/agent-package.cjs') as {
|
||||
assembleAgentPackage(options: object): { sha256: string; descriptor: { platform: string } }
|
||||
}
|
||||
const target = require('../build/agent-build-target.cjs') as {
|
||||
assertTargetBinary(path: string, arch: string, platform: string, label: string): void
|
||||
}
|
||||
const roots: string[] = []
|
||||
afterEach(() => {
|
||||
for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
|
||||
})
|
||||
|
||||
function scratch(): string {
|
||||
const root = mkdtempSync(join(tmpdir(), 'goodbuddy-darwin-build-test-'))
|
||||
roots.push(root)
|
||||
return root
|
||||
}
|
||||
|
||||
function machO(): Buffer {
|
||||
const bytes = Buffer.alloc(64)
|
||||
bytes.writeUInt32LE(0xfeedfacf)
|
||||
bytes.writeUInt32LE(0x0100000c, 4)
|
||||
return bytes
|
||||
}
|
||||
|
||||
function write(root: string, path: string, contents: string | Buffer, mode = 0o644): void {
|
||||
const file = join(root, path)
|
||||
mkdirSync(dirname(file), { recursive: true })
|
||||
writeFileSync(file, contents)
|
||||
chmodSync(file, mode)
|
||||
}
|
||||
|
||||
describe('Darwin arm64 Agent packages', () => {
|
||||
it('uses the same pinned native inputs for CI and production packaging', () => {
|
||||
const linux = ci.readCiLocks()
|
||||
const darwin = ci.readCiLocks('darwin', 'arm64')
|
||||
expect(linux).toEqual(darwin)
|
||||
expect(darwin.lock.node.targets['darwin-arm64']).toMatchObject({
|
||||
archive: 'node-v24.19.0-darwin-arm64.tar.gz',
|
||||
sha256: '8294b7aa9b03997481c06babf1e8b270c859358f27da57a11509afe537ac381d'
|
||||
})
|
||||
expect(darwin.runtimeLock.runtimes.opencode.targets['darwin-arm64']?.package)
|
||||
.toBe('opencode-darwin-arm64')
|
||||
expect(ci.readCiLocks().lock).toEqual(linux.lock)
|
||||
})
|
||||
|
||||
it('rejects a Linux ELF binary even when its architecture is arm64', () => {
|
||||
const root = scratch()
|
||||
write(root, 'native', machO())
|
||||
expect(() => target.assertTargetBinary(join(root, 'native'), 'arm64', 'darwin', 'test')).not.toThrow()
|
||||
expect(() => target.assertTargetBinary(join(root, 'native'), 'arm64', 'linux', 'test')).toThrow()
|
||||
const elf = Buffer.alloc(64)
|
||||
elf.set([0x7f, 0x45, 0x4c, 0x46])
|
||||
elf[5] = 1
|
||||
elf.writeUInt16LE(183, 18)
|
||||
write(root, 'native', elf)
|
||||
expect(() => target.assertTargetBinary(join(root, 'native'), 'arm64', 'darwin', 'test')).toThrow()
|
||||
})
|
||||
|
||||
it('assembles deterministic Darwin packages and rejects cross-platform bundle selection', () => {
|
||||
const root = scratch()
|
||||
const bundle = join(root, 'agent')
|
||||
const { lock, runtimeLock } = ci.readCiLocks('darwin', 'arm64')
|
||||
const { privateKey, publicKey } = generateKeyPairSync('ed25519')
|
||||
const identity = { keyId: 'darwin-build-test', privateKey }
|
||||
const registry = {
|
||||
formatVersion: 1,
|
||||
keys: [{
|
||||
keyId: identity.keyId,
|
||||
publicKeySpkiBase64: publicKey.export({ type: 'spki', format: 'der' }).toString('base64'),
|
||||
environment: 'test'
|
||||
}],
|
||||
revocations: []
|
||||
}
|
||||
write(bundle, 'node', machO(), 0o755)
|
||||
write(bundle, 'goodbuddy-agent', '#!/bin/sh\n', 0o755)
|
||||
write(bundle, 'lib/agent.cjs', '// fixture\n')
|
||||
const koffi = agent.koffiPayloadPaths('arm64', 'darwin')
|
||||
expect(koffi.native).toEqual([
|
||||
'lib/node_modules/@koromix/koffi-darwin-arm64/darwin_arm64/koffi.node'
|
||||
])
|
||||
for (const path of koffi.required) {
|
||||
write(bundle, path, koffi.native.includes(path) ? machO() : '{}')
|
||||
}
|
||||
for (const license of ['GoodBuddy-0BSD', 'Node.js-MIT', 'zod-MIT', 'koffi-MIT', 'koffi-native-MIT']) {
|
||||
write(bundle, `licenses/${license}.txt`, 'fixture license')
|
||||
}
|
||||
const manifest = agent.createManifest(bundle, {
|
||||
platform: 'darwin', arch: 'arm64', agentVersion: lock.agentVersion,
|
||||
nodeVersion: '24.19.0', zodVersion: '4.4.3', koffiVersion: '3.1.4',
|
||||
koffiNativePackage: '@koromix/koffi-darwin-arm64',
|
||||
protocol: lock.protocol, signingKeyId: identity.keyId
|
||||
})
|
||||
const bytes = agent.canonicalManifestBytes(manifest)
|
||||
write(bundle, 'manifest.json', bytes)
|
||||
write(bundle, 'manifest.sig', `${sign(null, agent.signaturePayload(bytes), privateKey).toString('base64')}\n`)
|
||||
const source = join(root, 'source')
|
||||
write(source, 'package/package.json', JSON.stringify({
|
||||
name: 'opencode-darwin-arm64', version: runtimeLock.runtimes.opencode.version
|
||||
}))
|
||||
write(source, 'package/bin/opencode', machO(), 0o755)
|
||||
const archive = join(root, `opencode-darwin-arm64-${runtimeLock.runtimes.opencode.version}.tgz`)
|
||||
createTar({ cwd: source, file: archive, sync: true, gzip: true }, ['package'])
|
||||
runtimeLock.runtimes.opencode.targets['darwin-arm64']!.integrity =
|
||||
`sha512-${createHash('sha512').update(readFileSync(archive)).digest('base64')}`
|
||||
const built = runtime.buildRuntimeBundle({
|
||||
platform: 'darwin', architecture: 'arm64', runtimeArchive: archive,
|
||||
outputRoot: join(root, 'runtime'), lock: runtimeLock, registry,
|
||||
testSigningIdentity: identity
|
||||
})
|
||||
expect(built.manifest.platform).toBe('darwin')
|
||||
const output = join(root, `goodbuddy-agent-${lock.agentVersion}-darwin-arm64.gbagent`)
|
||||
const options = {
|
||||
platform: 'darwin', architecture: 'arm64', minimumDesktopVersion: '0.12.4',
|
||||
agentBundle: bundle, runtimeBundle: built.bundleDirectory,
|
||||
agentLock: lock, runtimeLock, registry, testSigningIdentity: identity, output
|
||||
}
|
||||
const first = packager.assembleAgentPackage(options)
|
||||
const second = packager.assembleAgentPackage(options)
|
||||
expect(first.sha256).toBe(second.sha256)
|
||||
expect(first.descriptor.platform).toBe('darwin')
|
||||
const files = unzipSync(readFileSync(output))
|
||||
expect(JSON.parse(Buffer.from(files['agent-package.json']!).toString()).platform).toBe('darwin')
|
||||
expect(() => packager.assembleAgentPackage({ ...options, platform: 'linux' }))
|
||||
.toThrow('platform')
|
||||
})
|
||||
})
|
||||
@@ -89,21 +89,26 @@ describe('GoodBuddy Agents workflow', () => {
|
||||
expect(workflow.match(/'src\/shared\/\*\*'/gu)).toHaveLength(2)
|
||||
})
|
||||
|
||||
it('builds both Agent architectures on native Linux runners', () => {
|
||||
it('builds Linux and Darwin arm64 targets on native runners', () => {
|
||||
expect(
|
||||
parsedWorkflow.jobs.build?.strategy?.matrix?.include
|
||||
).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({
|
||||
).toEqual([
|
||||
{
|
||||
platform: 'linux',
|
||||
arch: 'x64',
|
||||
runner: 'ubuntu-24.04'
|
||||
}),
|
||||
expect.objectContaining({
|
||||
},
|
||||
{
|
||||
platform: 'linux',
|
||||
arch: 'arm64',
|
||||
runner: 'ubuntu-24.04-arm'
|
||||
})
|
||||
},
|
||||
{
|
||||
platform: 'darwin',
|
||||
arch: 'arm64',
|
||||
runner: 'macos-15'
|
||||
}
|
||||
])
|
||||
)
|
||||
expect(parsedWorkflow.jobs.build?.needs).toBe('validate')
|
||||
expect(serializedJob('build')).toContain(
|
||||
'"runs-on":"${{ matrix.runner }}"'
|
||||
@@ -125,7 +130,7 @@ describe('GoodBuddy Agents workflow', () => {
|
||||
it('resolves and verifies the locked official Node runtime', () => {
|
||||
const scripts = jobScripts('build')
|
||||
expect(scripts).toContain(
|
||||
"require('./agent-runtime-lock.json')"
|
||||
"require('./build/agent-ci-bundle.cjs').readCiLocks("
|
||||
)
|
||||
expect(scripts).toContain("url.protocol !== 'https:'")
|
||||
expect(scripts).toContain("url.hostname !== 'nodejs.org'")
|
||||
@@ -133,14 +138,15 @@ describe('GoodBuddy Agents workflow', () => {
|
||||
"curl --proto '=https' --tlsv1.2"
|
||||
)
|
||||
expect(scripts).toContain('--max-filesize 104857600')
|
||||
expect(scripts).toContain('sha256sum --check --strict -')
|
||||
expect(scripts).toContain('Node runtime archive integrity mismatch')
|
||||
expect(scripts).not.toContain('sha256sum')
|
||||
expect(serializedJob('build')).toContain('actions/cache@v6')
|
||||
})
|
||||
|
||||
it('resolves and verifies the locked official OpenCode Runtime', () => {
|
||||
const scripts = jobScripts('build')
|
||||
expect(scripts).toContain(
|
||||
"require('./remote-runtime-lock.json')"
|
||||
"require('./build/agent-ci-bundle.cjs').readCiLocks("
|
||||
)
|
||||
expect(scripts).toContain(
|
||||
'--registry https://registry.npmjs.org/'
|
||||
@@ -219,4 +225,26 @@ describe('GoodBuddy Agents workflow', () => {
|
||||
])
|
||||
).toThrow('Unknown Agent CI bundle argument')
|
||||
})
|
||||
|
||||
it('includes Darwin in production packaging while retaining native target checks', () => {
|
||||
expect(serializedJob('build')).toContain("matrix.platform == 'linux'")
|
||||
expect(jobScripts('build')).toContain('src/agent-daemon/darwin-process-identity.test.ts')
|
||||
const release = readFileSync(
|
||||
join(process.cwd(), '.github/workflows/agent-release.yml'), 'utf8'
|
||||
)
|
||||
expect(release).toContain('macos-15')
|
||||
expect(release).toContain('AGENT_PLATFORM')
|
||||
for (const target of ['darwin', 'win32']) {
|
||||
expect(() => agentCiBundle.parseArguments([
|
||||
'--platform', target, '--arch', 'x64'
|
||||
])).toThrow('Unsupported Agent build target')
|
||||
}
|
||||
expect(agentCiBundle.parseArguments([
|
||||
'--platform', 'darwin', '--arch', 'arm64',
|
||||
'--node-archive', 'node.tar.gz',
|
||||
'--opencode-archive', 'opencode.tgz',
|
||||
'--output-directory', 'bundle',
|
||||
'--archive', 'goodbuddy-agent-1.0.0-darwin-arm64.gbagent'
|
||||
])).toMatchObject({ platform: 'darwin', arch: 'arm64' })
|
||||
})
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user