feat: add cross-platform release pipeline

.github/workflows/linux-packages.yml

@@ -1,84 +0,0 @@
-name: Linux packages
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - 'v*'
-
-permissions:
-  contents: read
-
-jobs:
-  package:
-    name: ${{ matrix.arch }} AppImage and DEB
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - arch: x64
-            runner: ubuntu-24.04
-            deb_arch: amd64
-            elf_machine: x86-64
-          - arch: arm64
-            runner: ubuntu-24.04-arm
-            deb_arch: arm64
-            elf_machine: aarch64
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 60
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: npm
-
-      - name: Install packaging tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes file ruby ruby-dev build-essential
-          sudo gem install fpm --no-document
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run validators
-        run: |
-          npm test
-          npm run typecheck
-          npm run lint
-
-      - name: Build Linux packages
-        run: npm run dist:linux:${{ matrix.arch }}
-
-      - name: Verify package architecture and runtimes
-        shell: bash
-        run: |
-          set -euo pipefail
-          appimage="$(find dist -maxdepth 1 -type f -name '*.AppImage' -print -quit)"
-          deb="$(find dist -maxdepth 1 -type f -name '*.deb' -print -quit)"
-          unpacked="$(find dist -maxdepth 1 -type d -name 'linux*unpacked' -print -quit)"
-          test -n "$appimage"
-          test -n "$deb"
-          test -n "$unpacked"
-          file "$unpacked/goodbuddy" | grep -qi '${{ matrix.elf_machine }}'
-          file "$unpacked/resources/runtimes/opencode/opencode" | grep -qi '${{ matrix.elf_machine }}'
-          test -f "$unpacked/resources/runtimes/continue/dist/index.js"
-          "$unpacked/resources/runtimes/opencode/opencode" --version
-          dpkg-deb --field "$deb" Architecture | grep -qx '${{ matrix.deb_arch }}'
-          dpkg-deb --contents "$deb" | grep -q 'runtimes/opencode/opencode'
-          chmod +x "$appimage"
-          "$appimage" --appimage-extract >/dev/null
-          test -f squashfs-root/resources/runtimes/continue/dist/index.js
-
-      - name: Upload packages
-        uses: actions/upload-artifact@v4
-        with:
-          name: goodbuddy-linux-${{ matrix.arch }}
-          path: |
-            dist/*.AppImage
-            dist/*.deb
-            dist/*.blockmap
-          if-no-files-found: error

.github/workflows/packages.yml

@@ -0,0 +1,122 @@
+name: Cross-platform packages
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+env:
+  ELECTRON_CACHE: ${{ github.workspace }}/.cache/electron
+  ELECTRON_BUILDER_CACHE: ${{ github.workspace }}/.cache/electron-builder
+
+concurrency:
+  group: packages-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Validate source
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Verify release tag version
+        if: github.ref_type == 'tag'
+        run: node -e "const p=require('./package.json'); const expected='v'+p.version; if(process.env.GITHUB_REF_NAME!==expected){throw new Error('Expected tag '+expected+', received '+process.env.GITHUB_REF_NAME)}"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run validators
+        run: |
+          npm test
+          npm run typecheck
+          npm run lint
+
+      - name: Build production bundle
+        run: npm run build:bundle
+
+      - name: Upload production bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: goodbuddy-production-bundle
+          path: out
+          if-no-files-found: error
+          retention-days: 1
+
+  package:
+    name: ${{ matrix.platform }} ${{ matrix.arch }}
+    needs: validate
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: windows
+            arch: x64
+            runner: windows-2025
+          - platform: windows
+            arch: arm64
+            runner: windows-2025
+          - platform: macos
+            arch: x64
+            runner: macos-15-intel
+          - platform: macos
+            arch: arm64
+            runner: macos-15
+          - platform: linux
+            arch: x64
+            runner: ubuntu-24.04
+          - platform: linux
+            arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 75
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Cache packaging toolsets
+        uses: actions/cache@v4
+        with:
+          path: |
+            ${{ env.ELECTRON_CACHE }}
+            ${{ env.ELECTRON_BUILDER_CACHE }}
+          key: packaging-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: packaging-${{ runner.os }}-${{ matrix.arch }}-
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Download production bundle
+        uses: actions/download-artifact@v4
+        with:
+          name: goodbuddy-production-bundle
+          path: out
+
+      - name: Build and verify release packages
+        run: npm run release:package -- --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} --skip-build
+
+      - name: Upload release packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: goodbuddy-${{ matrix.platform }}-${{ matrix.arch }}
+          path: dist/release/${{ matrix.platform }}-${{ matrix.arch }}
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 30

build/build-release.cjs

@@ -0,0 +1,619 @@
+const { spawnSync } = require('node:child_process')
+const {
+  existsSync,
+  closeSync,
+  openSync,
+  readFileSync,
+  readSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} = require('node:fs')
+const { basename, dirname, join, parse, resolve } = require('node:path')
+const { sha256File } = require('./file-hash.cjs')
+
+const root = join(__dirname, '..')
+const packageJson = JSON.parse(
+  readFileSync(join(root, 'package.json'), 'utf8')
+)
+const productName = packageJson.build?.productName ?? packageJson.name
+const releaseRoot = join(root, 'dist', 'release')
+const manifestName = 'release-manifest.json'
+const supportedArchitectures = new Set(['x64', 'arm64'])
+const platformAliases = new Map([
+  ['win', 'windows'],
+  ['win32', 'windows'],
+  ['windows', 'windows'],
+  ['darwin', 'macos'],
+  ['mac', 'macos'],
+  ['macos', 'macos'],
+  ['linux', 'linux']
+])
+const hostPlatforms = {
+  win32: 'windows',
+  darwin: 'macos',
+  linux: 'linux'
+}
+const platformDefinitions = {
+  windows: {
+    builderFlag: '--win',
+    defaultFormats: ['nsis', 'portable'],
+    supportedFormats: ['nsis', 'portable'],
+    unpackedPattern: /^win(?:-.+)?-unpacked$/u,
+    executable: [`${productName}.exe`],
+    runtimeExecutable: 'opencode.exe'
+  },
+  macos: {
+    builderFlag: '--mac',
+    defaultFormats: ['dmg', 'zip'],
+    supportedFormats: ['dmg', 'zip'],
+    unpackedPattern: /^mac(?:-.+)?$/u,
+    executable: [
+      `${productName}.app`,
+      'Contents',
+      'MacOS',
+      productName
+    ],
+    runtimeExecutable: 'opencode'
+  },
+  linux: {
+    builderFlag: '--linux',
+    defaultFormats: ['AppImage', 'deb'],
+    supportedFormats: ['AppImage', 'deb'],
+    unpackedPattern: /^linux(?:-.+)?-unpacked$/u,
+    executable: [packageJson.name],
+    runtimeExecutable: 'opencode'
+  }
+}
+const formatExtensions = {
+  nsis: '.exe',
+  portable: '.exe',
+  dmg: '.dmg',
+  zip: '.zip',
+  AppImage: '.AppImage',
+  deb: '.deb'
+}
+
+function normalizePlatform(value) {
+  return platformAliases.get(String(value).toLowerCase())
+}
+
+function normalizeFormat(platform, value) {
+  const definition = platformDefinitions[platform]
+  return definition.supportedFormats.find(
+    (candidate) => candidate.toLowerCase() === value.toLowerCase()
+  )
+}
+
+function parseArguments(argv, environment = process) {
+  const options = {
+    platform: hostPlatforms[environment.platform],
+    arch: environment.arch,
+    formats: [],
+    skipBuild: false,
+    dryRun: false,
+    help: false
+  }
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index]
+    if (argument === '--platform') {
+      options.platform = normalizePlatform(argv[index + 1])
+      index += 1
+    } else if (argument === '--arch') {
+      options.arch = argv[index + 1]
+      index += 1
+    } else if (argument === '--format') {
+      const value = argv[index + 1]
+      if (!value) {
+        throw new Error('--format 缺少值')
+      }
+      options.formats.push(
+        ...value.split(',').map((item) => item.trim()).filter(Boolean)
+      )
+      index += 1
+    } else if (argument === '--skip-build') {
+      options.skipBuild = true
+    } else if (argument === '--dry-run') {
+      options.dryRun = true
+    } else if (argument === '--help' || argument === '-h') {
+      options.help = true
+    } else {
+      throw new Error(`未知参数：${argument}`)
+    }
+  }
+  if (options.help) {
+    return options
+  }
+  if (!options.platform) {
+    throw new Error('不支持当前系统，请显式指定 --platform')
+  }
+  if (!supportedArchitectures.has(options.arch)) {
+    throw new Error(`不支持的架构：${options.arch}`)
+  }
+  const definition = platformDefinitions[options.platform]
+  const requestedFormats =
+    options.formats.length > 0
+      ? options.formats
+      : definition.defaultFormats
+  options.formats = [...new Set(requestedFormats.map((format) => {
+    const normalized = normalizeFormat(options.platform, format)
+    if (!normalized) {
+      throw new Error(
+        `${options.platform} 不支持打包格式：${format}`
+      )
+    }
+    return normalized
+  }))]
+  return options
+}
+
+function npmInvocation(environment = process.env) {
+  if (environment.npm_execpath) {
+    return {
+      command: process.execPath,
+      prefixArgs: [environment.npm_execpath]
+    }
+  }
+  return {
+    command: process.platform === 'win32' ? 'npm.cmd' : 'npm',
+    prefixArgs: []
+  }
+}
+
+function run(command, args, environment = process.env) {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    env: environment,
+    shell: false,
+    stdio: 'inherit',
+    windowsHide: true
+  })
+  if (result.error) {
+    throw result.error
+  }
+  if (result.status !== 0) {
+    throw new Error(
+      `命令执行失败（code ${result.status ?? 1}）：${command} ${args.join(' ')}`
+    )
+  }
+}
+
+function buildElectronBuilderArguments(options, outputDirectory) {
+  const definition = platformDefinitions[options.platform]
+  const builderArguments = [
+    join(root, 'node_modules', 'electron-builder', 'cli.js'),
+    definition.builderFlag,
+    ...options.formats,
+    `--${options.arch}`,
+    `--config.directories.output=${outputDirectory}`
+  ]
+  if (
+    options.platform === 'windows' &&
+    options.formats.includes('nsis')
+  ) {
+    builderArguments.push(
+      `--config.nsis.artifactName=${productName}-\${version}-windows-\${arch}-setup.\${ext}`
+    )
+  }
+  if (
+    options.platform === 'windows' &&
+    options.formats.includes('portable')
+  ) {
+    builderArguments.push(
+      `--config.portable.artifactName=${productName}-\${version}-windows-\${arch}-portable.\${ext}`
+    )
+  }
+  return builderArguments
+}
+
+function detectBinaryArchitecture(buffer) {
+  if (
+    buffer.length >= 64 &&
+    buffer[0] === 0x4d &&
+    buffer[1] === 0x5a
+  ) {
+    const peOffset = buffer.readUInt32LE(0x3c)
+    if (
+      peOffset + 6 <= buffer.length &&
+      buffer.toString('ascii', peOffset, peOffset + 4) === 'PE\0\0'
+    ) {
+      const machine = buffer.readUInt16LE(peOffset + 4)
+      if (machine === 0x8664) {
+        return 'x64'
+      }
+      if (machine === 0xaa64) {
+        return 'arm64'
+      }
+    }
+  }
+  if (
+    buffer.length >= 20 &&
+    buffer[0] === 0x7f &&
+    buffer.toString('ascii', 1, 4) === 'ELF'
+  ) {
+    const machine =
+      buffer[5] === 2
+        ? buffer.readUInt16BE(18)
+        : buffer.readUInt16LE(18)
+    if (machine === 62) {
+      return 'x64'
+    }
+    if (machine === 183) {
+      return 'arm64'
+    }
+  }
+  if (buffer.length >= 8) {
+    const littleMagic = buffer.readUInt32LE(0)
+    const bigMagic = buffer.readUInt32BE(0)
+    const cpuType =
+      littleMagic === 0xfeedfacf
+        ? buffer.readUInt32LE(4)
+        : bigMagic === 0xfeedfacf
+          ? buffer.readUInt32BE(4)
+          : undefined
+    if (cpuType === 0x01000007) {
+      return 'x64'
+    }
+    if (cpuType === 0x0100000c) {
+      return 'arm64'
+    }
+  }
+  return undefined
+}
+
+function binaryArchitecture(filePath) {
+  return detectBinaryArchitecture(readChunk(filePath, 4096))
+}
+
+function readChunk(filePath, length, position = 0) {
+  const descriptor = openSync(filePath, 'r')
+  try {
+    const buffer = Buffer.alloc(length)
+    const bytesRead = readSync(
+      descriptor,
+      buffer,
+      0,
+      length,
+      position
+    )
+    return buffer.subarray(0, bytesRead)
+  } finally {
+    closeSync(descriptor)
+  }
+}
+
+function findUnpackedDirectory(directory, platform) {
+  const pattern = platformDefinitions[platform].unpackedPattern
+  const candidates = readdirSync(directory, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && pattern.test(entry.name))
+    .map((entry) => join(directory, entry.name))
+  if (candidates.length !== 1) {
+    throw new Error(
+      `无法确定 ${platform} unpacked 目录：${candidates.join(', ') || '未生成'}`
+    )
+  }
+  return candidates[0]
+}
+
+function resourceDirectory(unpackedDirectory, platform) {
+  return platform === 'macos'
+    ? join(
+        unpackedDirectory,
+        `${productName}.app`,
+        'Contents',
+        'Resources'
+      )
+    : join(unpackedDirectory, 'resources')
+}
+
+function assertFile(filePath, description) {
+  if (!statSync(filePath, { throwIfNoEntry: false })?.isFile()) {
+    throw new Error(`${description}缺失：${filePath}`)
+  }
+}
+
+function verifyUnpackedOutput(directory, options) {
+  const definition = platformDefinitions[options.platform]
+  const unpackedDirectory = findUnpackedDirectory(
+    directory,
+    options.platform
+  )
+  const applicationExecutable = join(
+    unpackedDirectory,
+    ...definition.executable
+  )
+  const resources = resourceDirectory(
+    unpackedDirectory,
+    options.platform
+  )
+  const runtimeExecutable = join(
+    resources,
+    'runtimes',
+    'opencode',
+    definition.runtimeExecutable
+  )
+  assertFile(applicationExecutable, '应用主程序')
+  assertFile(join(resources, 'app.asar'), '应用 ASAR')
+  assertFile(runtimeExecutable, 'OpenCode Runtime')
+  assertFile(
+    join(resources, 'runtimes', 'continue', 'dist', 'index.js'),
+    'Continue Runtime'
+  )
+  for (const [filePath, label] of [
+    [applicationExecutable, '应用主程序'],
+    [runtimeExecutable, 'OpenCode Runtime']
+  ]) {
+    const actualArchitecture = binaryArchitecture(filePath)
+    if (actualArchitecture !== options.arch) {
+      throw new Error(
+        `${label}架构错误：期望 ${options.arch}，实际 ${actualArchitecture ?? '未知'}`
+      )
+    }
+  }
+  return unpackedDirectory
+}
+
+function verifyArtifacts(directory, options) {
+  const files = readdirSync(directory, { withFileTypes: true })
+    .filter((entry) => entry.isFile())
+    .map((entry) => entry.name)
+  for (const format of options.formats) {
+    const extension = formatExtensions[format]
+    const candidates = files.filter((name) => name.endsWith(extension))
+    const matches =
+      options.platform === 'windows'
+        ? candidates.filter((name) =>
+            format === 'nsis'
+              ? /-setup\.exe$/iu.test(name)
+              : /-portable\.exe$/iu.test(name)
+          )
+        : candidates
+    if (matches.length !== 1) {
+      throw new Error(
+        `${format} 产物数量错误：${matches.join(', ') || '未生成'}`
+      )
+    }
+    verifyArtifactSignature(
+      join(directory, matches[0]),
+      format,
+      options.arch
+    )
+  }
+}
+
+function verifyArtifactSignature(filePath, format, arch) {
+  if (format === 'nsis' || format === 'portable') {
+    if (readChunk(filePath, 2).toString('ascii') !== 'MZ') {
+      throw new Error(`${format} 产物不是有效的 Windows PE 文件`)
+    }
+    return
+  }
+  if (format === 'zip') {
+    const signature = readChunk(filePath, 4).toString('hex')
+    if (
+      !['504b0304', '504b0506', '504b0708'].includes(signature)
+    ) {
+      throw new Error('zip 产物不是有效的 ZIP 文件')
+    }
+    return
+  }
+  if (format === 'dmg') {
+    const size = statSync(filePath).size
+    if (
+      size < 512 ||
+      readChunk(filePath, 4, size - 512).toString('ascii') !==
+        'koly'
+    ) {
+      throw new Error('dmg 产物缺少 UDIF 尾部')
+    }
+    return
+  }
+  if (format === 'AppImage') {
+    if (
+      detectBinaryArchitecture(readChunk(filePath, 4096)) !== arch
+    ) {
+      throw new Error(`AppImage 产物架构不是 ${arch}`)
+    }
+    return
+  }
+  if (
+    format === 'deb' &&
+    readChunk(filePath, 8).toString('ascii') !== '!<arch>\n'
+  ) {
+    throw new Error('deb 产物不是有效的 ar 归档')
+  }
+}
+
+async function writeManifest(directory, options) {
+  const entries = readdirSync(directory, { withFileTypes: true })
+    .filter(
+      (entry) => entry.isFile() && entry.name !== manifestName
+    )
+    .sort((left, right) => left.name.localeCompare(right.name))
+  const files = []
+  for (const entry of entries) {
+    const filePath = join(directory, entry.name)
+    files.push({
+      name: entry.name,
+      size: statSync(filePath).size,
+      sha256: await sha256File(filePath)
+    })
+  }
+  const manifest = {
+    formatVersion: 1,
+    productName,
+    version: packageJson.version,
+    platform: options.platform,
+    arch: options.arch,
+    formats: options.formats,
+    files
+  }
+  writeFileSync(
+    join(directory, manifestName),
+    `${JSON.stringify(manifest, null, 2)}\n`,
+    'utf8'
+  )
+  return manifest
+}
+
+function assertReplaceableOutput(directory, options) {
+  if (!existsSync(directory)) {
+    return
+  }
+  if (readdirSync(directory).length === 0) {
+    return
+  }
+  try {
+    const manifest = JSON.parse(
+      readFileSync(join(directory, manifestName), 'utf8')
+    )
+    if (
+      manifest.productName === productName &&
+      manifest.formatVersion === 1 &&
+      manifest.platform === options.platform &&
+      manifest.arch === options.arch
+    ) {
+      return
+    }
+  } catch {
+    // The explicit error below describes the safe recovery path.
+  }
+  throw new Error(
+    `拒绝覆盖未识别的发布目录：${directory}`
+  )
+}
+
+function replaceOutput(stagingDirectory, destination, options) {
+  const backup = `${destination}.previous-${process.pid}`
+  assertReplaceableOutput(destination, options)
+  rmSync(backup, { recursive: true, force: true })
+  if (existsSync(destination)) {
+    renameSync(destination, backup)
+  }
+  try {
+    renameSync(stagingDirectory, destination)
+  } catch (error) {
+    if (!existsSync(destination) && existsSync(backup)) {
+      renameSync(backup, destination)
+    }
+    throw error
+  }
+  rmSync(backup, { recursive: true, force: true })
+}
+
+function safeReleasePath(filePath) {
+  const resolved = resolve(filePath)
+  if (
+    resolved === parse(resolved).root ||
+    resolved === root ||
+    resolved === dirname(releaseRoot)
+  ) {
+    throw new Error(`拒绝使用不安全的发布目录：${resolved}`)
+  }
+  return resolved
+}
+
+function printHelp() {
+  console.log(`${productName} 跨平台发布构建
+
+用法：
+  npm run release:package -- --platform <windows|macos|linux> --arch <x64|arm64>
+
+参数：
+  --format <列表>  覆盖默认格式，逗号分隔
+  --skip-build     复用已有 out 生产构建
+  --dry-run        仅显示目标与 electron-builder 参数
+
+默认格式：
+  windows: nsis, portable
+  macos:   dmg, zip
+  linux:   AppImage, deb`)
+}
+
+async function main(argv = process.argv.slice(2)) {
+  const options = parseArguments(argv)
+  if (options.help) {
+    printHelp()
+    return
+  }
+  const targetName = `${options.platform}-${options.arch}`
+  const destination = safeReleasePath(join(releaseRoot, targetName))
+  const stagingDirectory = safeReleasePath(
+    join(releaseRoot, `.stage-${targetName}-${process.pid}`)
+  )
+  const builderArguments = buildElectronBuilderArguments(
+    options,
+    stagingDirectory
+  )
+  if (options.dryRun) {
+    console.log(JSON.stringify({
+      target: targetName,
+      formats: options.formats,
+      output: destination,
+      command: process.execPath,
+      arguments: builderArguments
+    }, null, 2))
+    return
+  }
+  const hostPlatform = hostPlatforms[process.platform]
+  if (options.platform !== hostPlatform) {
+    throw new Error(
+      `${options.platform} 包必须在对应系统构建，当前系统为 ${hostPlatform ?? process.platform}`
+    )
+  }
+
+  rmSync(stagingDirectory, { recursive: true, force: true })
+  try {
+    if (!options.skipBuild) {
+      const npm = npmInvocation()
+      run(npm.command, [...npm.prefixArgs, 'run', 'build'])
+    }
+    run(
+      process.execPath,
+      builderArguments,
+      {
+        ...process.env,
+        CSC_IDENTITY_AUTO_DISCOVERY:
+          process.env.CSC_IDENTITY_AUTO_DISCOVERY ?? 'false'
+      }
+    )
+    const unpackedDirectory = verifyUnpackedOutput(
+      stagingDirectory,
+      options
+    )
+    verifyArtifacts(stagingDirectory, options)
+    rmSync(unpackedDirectory, { recursive: true, force: true })
+    const manifest = await writeManifest(stagingDirectory, options)
+    replaceOutput(stagingDirectory, destination, options)
+    console.log(`发布包构建完成：${destination}`)
+    for (const file of manifest.files) {
+      console.log(
+        `${basename(file.name)}  ${file.size} bytes  sha256:${file.sha256}`
+      )
+    }
+  } finally {
+    rmSync(stagingDirectory, { recursive: true, force: true })
+  }
+}
+
+module.exports = {
+  assertReplaceableOutput,
+  buildElectronBuilderArguments,
+  detectBinaryArchitecture,
+  normalizePlatform,
+  parseArguments,
+  platformDefinitions,
+  replaceOutput,
+  verifyArtifacts,
+  verifyArtifactSignature,
+  writeManifest
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    console.error(error)
+    process.exitCode = 1
+  })
+}

build/file-hash.cjs

@@ -0,0 +1,14 @@
+const { createHash } = require('node:crypto')
+const { createReadStream } = require('node:fs')
+
+function sha256File(filePath) {
+  const hash = createHash('sha256')
+  return new Promise((resolve, reject) => {
+    const stream = createReadStream(filePath)
+    stream.on('data', (chunk) => hash.update(chunk))
+    stream.once('error', reject)
+    stream.once('end', () => resolve(hash.digest('hex')))
+  })
+}
+
+module.exports = { sha256File }

build/runtime-hooks.cjs

@@ -8,10 +8,11 @@ const {
   stat,
   writeFile
 } = require('node:fs/promises')
-const { createReadStream, existsSync } = require('node:fs')
+const { existsSync } = require('node:fs')
 const { join } = require('node:path')
 const { spawnSync } = require('node:child_process')
 const tar = require('tar')
+const { sha256File } = require('./file-hash.cjs')
 
 const opencodeVersion = '1.18.9'
 const architectureNames = {
@@ -28,17 +29,6 @@ function sha512Integrity(contents) {
   return `sha512-${createHash('sha512').update(contents).digest('base64')}`
 }
 
-async function sha256File(filePath) {
-  const hash = createHash('sha256')
-  await new Promise((resolveHash, reject) => {
-    const stream = createReadStream(filePath)
-    stream.on('data', (chunk) => hash.update(chunk))
-    stream.once('error', reject)
-    stream.once('end', resolveHash)
-  })
-  return hash.digest('hex')
-}
-
 async function lockedIntegrity(projectDir, packageName) {
   const lock = JSON.parse(
     await readFile(join(projectDir, 'package-lock.json'), 'utf8')

package.json

@@ -18,7 +18,8 @@
     "lint": "eslint .",
     "test": "vitest run",
     "test:watch": "vitest",
-    "build": "npm run typecheck && electron-vite build",
+    "build": "npm run typecheck && npm run build:bundle",
+    "build:bundle": "electron-vite build",
     "dist": "npm run build && electron-builder",
     "dist:win": "npm run build && electron-builder --win nsis --x64 --arm64",
     "dist:mac": "npm run build && electron-builder --mac dmg --x64 --arm64",
@@ -26,6 +27,7 @@
     "dist:linux:x64": "npm run build && electron-builder --linux AppImage deb --x64",
     "dist:linux:arm64": "npm run build && electron-builder --linux AppImage deb --arm64",
     "icons": "node build/generate-icons.mjs",
+    "release:package": "node build/build-release.cjs",
     "portable": "npm run build && node build/build-portable.cjs"
   },
   "build": {

tests/build-release.test.ts

@@ -0,0 +1,331 @@
+import {
+  existsSync,
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+interface ReleaseOptions {
+  platform: 'windows' | 'macos' | 'linux'
+  arch: 'x64' | 'arm64'
+  formats: string[]
+  skipBuild: boolean
+  dryRun: boolean
+  help: boolean
+}
+
+interface ReleaseBuilderModule {
+  assertReplaceableOutput: (
+    directory: string,
+    options: ReleaseOptions
+  ) => void
+  buildElectronBuilderArguments: (
+    options: ReleaseOptions,
+    outputDirectory: string
+  ) => string[]
+  detectBinaryArchitecture: (
+    buffer: Buffer
+  ) => 'x64' | 'arm64' | undefined
+  parseArguments: (
+    arguments_: string[],
+    environment?: { platform: string; arch: string }
+  ) => ReleaseOptions
+  replaceOutput: (
+    stagingDirectory: string,
+    destination: string,
+    options: ReleaseOptions
+  ) => void
+  verifyArtifacts: (
+    directory: string,
+    options: ReleaseOptions
+  ) => void
+  writeManifest: (
+    directory: string,
+    options: ReleaseOptions
+  ) => Promise<{
+    files: Array<{
+      name: string
+      size: number
+      sha256: string
+    }>
+  }>
+}
+
+const require = createRequire(import.meta.url)
+const releaseBuilder = require(
+  '../build/build-release.cjs'
+) as ReleaseBuilderModule
+const windowsOptions: ReleaseOptions = {
+  platform: 'windows',
+  arch: 'x64',
+  formats: ['nsis', 'portable'],
+  skipBuild: false,
+  dryRun: false,
+  help: false
+}
+
+function pe(machine: number): Buffer {
+  const buffer = Buffer.alloc(256)
+  buffer.write('MZ', 0, 'ascii')
+  buffer.writeUInt32LE(128, 0x3c)
+  buffer.write('PE\0\0', 128, 'ascii')
+  buffer.writeUInt16LE(machine, 132)
+  return buffer
+}
+
+function elf(machine: number, bigEndian = false): Buffer {
+  const buffer = Buffer.alloc(64)
+  buffer.set([0x7f, 0x45, 0x4c, 0x46])
+  buffer[5] = bigEndian ? 2 : 1
+  if (bigEndian) {
+    buffer.writeUInt16BE(machine, 18)
+  } else {
+    buffer.writeUInt16LE(machine, 18)
+  }
+  return buffer
+}
+
+function machO(cpuType: number): Buffer {
+  const buffer = Buffer.alloc(8)
+  buffer.writeUInt32LE(0xfeedfacf, 0)
+  buffer.writeUInt32LE(cpuType, 4)
+  return buffer
+}
+
+describe('release build arguments', () => {
+  it.each([
+    ['win32', 'x64', 'windows', ['nsis', 'portable']],
+    ['darwin', 'arm64', 'macos', ['dmg', 'zip']],
+    ['linux', 'x64', 'linux', ['AppImage', 'deb']]
+  ])(
+    'uses %s host defaults',
+    (host, arch, platform, formats) => {
+      expect(
+        releaseBuilder.parseArguments([], {
+          platform: host,
+          arch
+        })
+      ).toMatchObject({ platform, arch, formats })
+    }
+  )
+
+  it('normalizes aliases, formats, and duplicate formats', () => {
+    expect(
+      releaseBuilder.parseArguments(
+        [
+          '--platform',
+          'mac',
+          '--arch',
+          'arm64',
+          '--format',
+          'DMG,zip,dmg',
+          '--skip-build',
+          '--dry-run'
+        ],
+        { platform: 'win32', arch: 'x64' }
+      )
+    ).toEqual({
+      platform: 'macos',
+      arch: 'arm64',
+      formats: ['dmg', 'zip'],
+      skipBuild: true,
+      dryRun: true,
+      help: false
+    })
+  })
+
+  it.each([
+    [['--platform', 'freebsd'], '不支持当前系统'],
+    [['--arch', 'ia32'], '不支持的架构'],
+    [['--format', 'rpm'], '不支持打包格式'],
+    [['--unknown'], '未知参数']
+  ])('rejects invalid arguments', (arguments_, message) => {
+    expect(() =>
+      releaseBuilder.parseArguments(arguments_, {
+        platform: 'linux',
+        arch: 'x64'
+      })
+    ).toThrow(message)
+  })
+
+  it('builds target-specific electron-builder arguments', () => {
+    const arguments_ =
+      releaseBuilder.buildElectronBuilderArguments(
+        {
+          platform: 'windows',
+          arch: 'arm64',
+          formats: ['nsis', 'portable'],
+          skipBuild: false,
+          dryRun: false,
+          help: false
+        },
+        'C:\\release-stage'
+      )
+
+    expect(arguments_).toEqual(
+      expect.arrayContaining([
+        '--win',
+        'nsis',
+        'portable',
+        '--arm64',
+        '--config.directories.output=C:\\release-stage',
+        expect.stringContaining('nsis.artifactName='),
+        expect.stringContaining('portable.artifactName=')
+      ])
+    )
+  })
+})
+
+describe('release binary architecture detection', () => {
+  it.each([
+    [pe(0x8664), 'x64'],
+    [pe(0xaa64), 'arm64'],
+    [elf(62), 'x64'],
+    [elf(183, true), 'arm64'],
+    [machO(0x01000007), 'x64'],
+    [machO(0x0100000c), 'arm64'],
+    [Buffer.from('not an executable'), undefined]
+  ])('detects binary headers', (buffer, expected) => {
+    expect(
+      releaseBuilder.detectBinaryArchitecture(buffer)
+    ).toBe(expected)
+  })
+})
+
+describe('release output safety', () => {
+  it('writes a deterministic artifact manifest with streaming hashes', async () => {
+    const directory = mkdtempSync(
+      join(tmpdir(), 'goodbuddy-release-manifest-')
+    )
+    try {
+      writeFileSync(join(directory, 'artifact.exe'), 'release')
+      const manifest = await releaseBuilder.writeManifest(
+        directory,
+        windowsOptions
+      )
+
+      expect(manifest.files).toEqual([
+        {
+          name: 'artifact.exe',
+          size: 7,
+          sha256:
+            'a4d451ec23463726f72c43d64c710968f6b602cd653b4de8adee1b556240a829'
+        }
+      ])
+      expect(
+        JSON.parse(
+          readFileSync(
+            join(directory, 'release-manifest.json'),
+            'utf8'
+          )
+        )
+      ).toMatchObject({
+        productName: 'GoodBuddy',
+        platform: 'windows',
+        arch: 'x64'
+      })
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('refuses to replace an unrecognized non-empty directory', () => {
+    const directory = mkdtempSync(
+      join(tmpdir(), 'goodbuddy-release-unsafe-')
+    )
+    try {
+      writeFileSync(join(directory, 'user-file.txt'), 'keep')
+      expect(() =>
+        releaseBuilder.assertReplaceableOutput(
+          directory,
+          windowsOptions
+        )
+      ).toThrow('拒绝覆盖未识别的发布目录')
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('atomically replaces a recognized release directory', () => {
+    const parent = mkdtempSync(
+      join(tmpdir(), 'goodbuddy-release-replace-')
+    )
+    const destination = join(parent, 'windows-x64')
+    const staging = join(parent, 'staging')
+    try {
+      mkdirSync(destination)
+      mkdirSync(staging)
+      writeFileSync(
+        join(destination, 'release-manifest.json'),
+        JSON.stringify({
+          formatVersion: 1,
+          productName: 'GoodBuddy',
+          platform: 'windows',
+          arch: 'x64'
+        })
+      )
+      writeFileSync(join(destination, 'old.exe'), 'old')
+      writeFileSync(join(staging, 'new.exe'), 'new')
+
+      releaseBuilder.replaceOutput(
+        staging,
+        destination,
+        windowsOptions
+      )
+
+      expect(existsSync(join(destination, 'new.exe'))).toBe(true)
+      expect(existsSync(join(destination, 'old.exe'))).toBe(false)
+      expect(existsSync(staging)).toBe(false)
+    } finally {
+      rmSync(parent, { recursive: true, force: true })
+    }
+  })
+
+  it('requires one artifact for every requested format', () => {
+    const directory = mkdtempSync(
+      join(tmpdir(), 'goodbuddy-release-artifacts-')
+    )
+    try {
+      writeFileSync(
+        join(
+          directory,
+          'GoodBuddy-0.1.0-windows-x64-setup.exe'
+        ),
+        'MZ'
+      )
+      writeFileSync(
+        join(
+          directory,
+          'GoodBuddy-0.1.0-windows-x64-portable.exe'
+        ),
+        'MZ'
+      )
+      expect(() =>
+        releaseBuilder.verifyArtifacts(
+          directory,
+          windowsOptions
+        )
+      ).not.toThrow()
+      rmSync(
+        join(
+          directory,
+          'GoodBuddy-0.1.0-windows-x64-portable.exe'
+        )
+      )
+      expect(() =>
+        releaseBuilder.verifyArtifacts(
+          directory,
+          windowsOptions
+        )
+      ).toThrow('portable 产物数量错误')
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+})