fix(genbi): preserve source checkout context loader install

Author: goldmedal

apps/context-loader/SOURCE_WORKSPACE

@@ -0,0 +1 @@
+This tracked marker identifies the source workspace package. It is intentionally excluded from the npm package files allowlist.

apps/context-loader/scripts/installer.mjs

@@ -1,18 +1,10 @@
 import { createHash } from "node:crypto";
-import { execFile as execFileCallback } from "node:child_process";
-import { lstatSync } from "node:fs";
 import { chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat } from "node:fs/promises";
 import path from "node:path";
-import { promisify } from "node:util";
 import { gunzipSync } from "node:zlib";
 import { CANONICAL_BINARY, ContextLoaderPackageError, isSha256, sha256File, targetFor } from "../lib/verified.mjs";
 
-const execFile = promisify(execFileCallback);
-const SOURCE_ORIGINS = new Set([
-  "git@github.com:Canner/WrenAI.git",
-  "https://github.com/Canner/WrenAI.git",
-  "ssh://git@github.com/Canner/WrenAI.git",
-]);
+const SOURCE_MARKER = "SOURCE_WORKSPACE";
 
 /** Downloads, verifies, and atomically installs the exact manifest row for this package. */
 export async function installContextLoader({ packageRoot, fetchImpl = fetch, platform = process.platform, arch = process.arch } = {}) {
@@ -67,23 +59,19 @@ export async function installContextLoader({ packageRoot, fetchImpl = fetch, pla
 
 /**
  * The checked-out source package carries an intentionally empty, pre-release
- * artifact template. Only that exact repository layout skips postinstall;
- * packed packages always download and verify their tagged artifact.
+ * artifact template. Only the tracked source-only marker in the canonical
+ * workspace layout skips postinstall; the package files allowlist excludes it,
+ * so packed packages always download and verify their tagged artifact.
  */
 export async function isRepositorySourcePackage(packageRoot) {
   try {
-    if (!lstatSync(packageRoot).isDirectory()) return false;
-    const physicalPackage = await realpath(packageRoot);
-    const { stdout: repositoryOutput } = await execFile("git", ["-C", physicalPackage, "rev-parse", "--show-toplevel"], { timeout: 2_000 });
-    const repositoryRoot = await realpath(repositoryOutput.trim());
-    if (physicalPackage !== path.join(repositoryRoot, "apps", "context-loader")) return false;
-    const { stdout: originOutput } = await execFile("git", ["-C", repositoryRoot, "remote", "get-url", "origin"], { timeout: 2_000 });
-    if (!SOURCE_ORIGINS.has(originOutput.trim())) return false;
-    await execFile(
-      "git",
-      ["-C", repositoryRoot, "ls-files", "--error-unmatch", "--", "apps/context-loader/package.json", "pnpm-workspace.yaml", "core/wren/pyproject.toml"],
-      { timeout: 2_000 },
-    );
+    const physicalPackage = await physicalPackageRoot(packageRoot);
+    const workspaceRoot = path.resolve(physicalPackage, "..", "..");
+    if (physicalPackage !== path.join(workspaceRoot, "apps", "context-loader")) return false;
+    if (!(await lstat(workspaceRoot)).isDirectory() || (await realpath(workspaceRoot)) !== workspaceRoot) return false;
+    const marker = await ownedRegularFile(physicalPackage, SOURCE_MARKER);
+    const workspaceManifest = await ownedRegularFile(workspaceRoot, "pnpm-workspace.yaml");
+    if (marker !== path.join(physicalPackage, SOURCE_MARKER) || workspaceManifest !== path.join(workspaceRoot, "pnpm-workspace.yaml")) return false;
     return true;
   } catch {
     return false;

apps/context-loader/test/installer.test.mjs

@@ -46,6 +46,14 @@ async function fixture({ artifact = Buffer.from("#!/bin/sh\necho loader\n"), tar
 
 const fetchArchive = (archive) => async () => ({ ok: true, arrayBuffer: async () => archive });
 
+async function makeSourceWorkspace(root) {
+  const packageRoot = path.join(root, "apps", "context-loader");
+  await mkdir(packageRoot, { recursive: true });
+  await writeFile(path.join(root, "pnpm-workspace.yaml"), "packages: []\n");
+  await writeFile(path.join(packageRoot, "SOURCE_WORKSPACE"), "source marker\n");
+  return packageRoot;
+}
+
 test("installs a digest-verified darwin-arm64 binary atomically and records canonical state", async () => {
   const { root, archive, artifact } = await fixture();
   const first = await installContextLoader({ packageRoot: root, fetchImpl: fetchArchive(archive), platform: "darwin", arch: "arm64" });
@@ -123,23 +131,24 @@ test("refuses a same-bytes external binary during reuse and a bin-directory link
   assert.deepEqual(await readdir(externalDir), ["wren-context-loader"]);
 });
 
-test("skips only the tracked source checkout, never a lookalike git repository or packed copy", async () => {
-  const sourcePackage = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-  assert.equal(await isRepositorySourcePackage(sourcePackage), true);
-
-  const fakeRoot = await mkdtemp(path.join(os.tmpdir(), "context-loader-fake-source-"));
-  const fakePackage = path.join(fakeRoot, "apps", "context-loader");
-  await mkdir(path.join(fakeRoot, "core", "wren"), { recursive: true });
-  await mkdir(fakePackage, { recursive: true });
-  await writeFile(path.join(fakePackage, "package.json"), "{}\n");
-  await writeFile(path.join(fakeRoot, "pnpm-workspace.yaml"), "packages: []\n");
-  await writeFile(path.join(fakeRoot, "core", "wren", "pyproject.toml"), "[project]\nname = \"wren\"\n");
-  execFileSync("git", ["init", fakeRoot]);
-  execFileSync("git", ["-C", fakeRoot, "add", "apps/context-loader/package.json", "pnpm-workspace.yaml", "core/wren/pyproject.toml"]);
-  execFileSync("git", ["-C", fakeRoot, "remote", "add", "origin", "https://example.invalid/lookalike.git"]);
-  assert.equal(await isRepositorySourcePackage(fakePackage), false);
-
-  const packedCopy = path.join(fakeRoot, "node_modules", "@wrenai", "context-loader");
-  await mkdir(packedCopy, { recursive: true });
-  assert.equal(await isRepositorySourcePackage(packedCopy), false);
+test("recognizes fork and source-archive workspaces, while npm-packed copies cannot bypass", async () => {
+  const forkRoot = await mkdtemp(path.join(os.tmpdir(), "context-loader-fork-"));
+  const forkPackage = await makeSourceWorkspace(forkRoot);
+  execFileSync("git", ["init", forkRoot]);
+  execFileSync("git", ["-C", forkRoot, "remote", "add", "origin", "https://example.invalid/fork.git"]);
+  assert.equal(await isRepositorySourcePackage(forkPackage), true);
+
+  const sourceArchiveRoot = await mkdtemp(path.join(os.tmpdir(), "context-loader-source-archive-"));
+  const sourceArchivePackage = await makeSourceWorkspace(sourceArchiveRoot);
+  assert.equal(await isRepositorySourcePackage(sourceArchivePackage), true);
+
+  const actualPackageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+  const packed = JSON.parse(execFileSync("npm", ["pack", "--json", "--dry-run"], { cwd: actualPackageRoot, encoding: "utf8" }));
+  assert.equal(packed[0].files.some((entry) => entry.path === "SOURCE_WORKSPACE"), false);
+
+  const unpackedRoot = await mkdtemp(path.join(os.tmpdir(), "context-loader-unpacked-"));
+  const unpackedPackage = path.join(unpackedRoot, "apps", "context-loader");
+  await mkdir(unpackedPackage, { recursive: true });
+  await writeFile(path.join(unpackedRoot, "pnpm-workspace.yaml"), "packages: []\n");
+  assert.equal(await isRepositorySourcePackage(unpackedPackage), false);
 });