build.sh

#!/usr/bin/env bash
# Build the outsource binary and the compatibility names that dispatch into it.
#
#   ./build.sh              host platform, into skills/outsource/bin/
#   ./build.sh --all        every shipped platform, into dist/
#
# Why the tool names are shell shims and not symlinks, measured 2026-08-19:
# a symlink to the binary breaks every caller that says `bash <path>`, with
# "cannot execute binary file". That form is not hypothetical — it is the
# documented Claude Code status-line config sitting in users' settings.json
# right now (`"command": "bash ~/.claude/skills/outsource/bin/statusline.sh"`),
# it is in grok.md's launch recipe, in glm.md's guard check, and in 2 of the 3
# runs test suites. A three-line shim satisfies `bash X`, `sh X`, `./X` and a
# direct exec alike, and costs one extra fork (~7ms, measured) on that legacy
# path only. Hooks and internal call sites point at the binary directly, so the
# hot paths do not pay it.
#
# A shim carries no logic, so it is not a second implementation and cannot
# drift; it is a name.
set -euo pipefail
cd "$(dirname "$0")"

# Stripped: -s drops the symbol table, -w the DWARF tables. Measured 2.9MB ->
# 1.9MB. CGO off makes it fully static, which is what lets one binary work
# across libc versions. -trimpath keeps build paths out of the artifact so the
# same source produces the same bytes on any machine.
LDFLAGS='-s -w'
# -buildvcs=false is not a detail. Go otherwise stamps the module version from
# git — commit hash, commit timestamp, and "+dirty" when the tree is not clean —
# so the binary's bytes change on every commit even when no source changed. Two
# consequences, both bad for a repo that COMMITS the artifact: the README's
# verification recipe could never match (you would have to be at the same commit
# with an identical tree state), and every commit would carry a fresh multi-MB
# blob into history for no reason. With VCS stamping off the binary is a pure
# function of the source, which is what makes "rebuild it and compare hashes"
# a real offer.
BUILDFLAGS='-trimpath -buildvcs=false'
BIN=outsource

# Every compatibility name, and the tool it dispatches to. Add a line when a
# shell script is ported, and delete that script in the same commit — a name
# that resolves to both a script and the binary is exactly the drift this port
# exists to remove.
SHIMS=(
  "credential.sh:credential"
  "git-guard.sh:guard"
  "grok-run.sh:grok-run"
  "last-report.sh:last-report"
  "outsource-run.sh:outsource-run"
  "quota.sh:quota"
  "runs.sh:runs"
  "spec-lint.sh:spec-lint"
  "statusline.sh:statusline"
  "wait.sh:wait"
)

write_shims() {  # <dir>
  local d="$1" entry name tool
  for entry in "${SHIMS[@]}"; do
    name="${entry%%:*}"; tool="${entry#*:}"
    cat > "$d/$name" <<SHIM
#!/usr/bin/env bash
# Compatibility name for the outsource binary; the implementation is Go, in
# cmd/outsource and internal/$tool. Generated by build.sh — do not edit.
#
# This is a shim rather than a symlink because callers say \`bash <path>\`
# (the status-line config, the launch recipes, the test suites), and bash
# cannot execute a binary. For a fork-free call, invoke: outsource $tool ...
exec "\$(dirname "\${BASH_SOURCE[0]}")/$BIN" $tool "\$@"
SHIM
    chmod +x "$d/$name"
  done
}

if [ "${1:-}" = "--all" ]; then
  mkdir -p dist
  for target in darwin/arm64 darwin/amd64 linux/amd64 linux/arm64; do
    os="${target%/*}"; arch="${target#*/}"
    out="dist/$os-$arch"; mkdir -p "$out"
    CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" \
      go build $BUILDFLAGS -ldflags="$LDFLAGS" -o "$out/$BIN" ./cmd/outsource
    write_shims "$out"
    printf '%-14s %s\n' "$target" "$(du -h "$out/$BIN" | cut -f1)"
  done
  exit 0
fi

CGO_ENABLED=0 go build $BUILDFLAGS -ldflags="$LDFLAGS" -o "skills/outsource/bin/$BIN" ./cmd/outsource
write_shims skills/outsource/bin
echo "built skills/outsource/bin/$BIN ($(du -h "skills/outsource/bin/$BIN" | cut -f1)) + ${#SHIMS[@]} shim(s)"