Intermediate commit for bundled cli fixes

Author: opensourcectl

electrobun.config.ts

@@ -42,9 +42,9 @@ export default {
       bundleCEF: false,
       icons: "icons/icon.iconset",
       /**
-       * Bundled Ghostscript/ImageMagick need `DYLD_LIBRARY_PATH` (set in `bundled_cli_apply_embedded_runtime_env`)
-       * so `gs`/`magick` resolve `libjbig2dec` and other merged keg dylibs. Hardened Runtime ignores that var
-       * without this entitlement, which surfaces as `Symbol not found: _jbig2_complete_page`.
+       * Bundled Ghostscript/ImageMagick/qpdf need `DYLD_LIBRARY_PATH` and Ghostscript needs `GS_LIB`
+       * (set in `bundled_cli_apply_embedded_runtime_env`) so CLIs resolve merged keg dylibs and `gs_init.ps`.
+       * Hardened Runtime ignores `DYLD_LIBRARY_PATH` without this entitlement (e.g. `Symbol not found: _jbig2_complete_page`).
        */
       entitlements: {
         "com.apple.security.cs.allow-dyld-environment-variables": true,

scripts/bundled-cli/pack_layout.ts

@@ -73,6 +73,42 @@ function linux_qpdf_shared_libs_present(bin_root: string): boolean {
   }
 }
 
+function darwin_qpdf_dylibs_present(bin_root: string): boolean {
+  const lib_dir = path.join(bin_root, "qpdf-lib");
+  if (!existsSync(lib_dir)) {
+    return false;
+  }
+  try {
+    const names = readdirSync(lib_dir);
+    return names.some((n) => n.startsWith("libqpdf.") && n.endsWith(".dylib"));
+  } catch {
+    return false;
+  }
+}
+
+/** Require Ghostscript init resources under the bundled prefix (Homebrew layout variants). */
+function darwin_ghostscript_gs_init_present(bin_root: string): boolean {
+  const share_gs = path.join(bin_root, "ghostscript", "share", "ghostscript");
+  if (!existsSync(share_gs)) {
+    return false;
+  }
+  const flat_init = path.join(share_gs, "Resource", "Init", "gs_init.ps");
+  if (existsSync(flat_init)) {
+    return true;
+  }
+  try {
+    for (const ver of readdirSync(share_gs)) {
+      const init_file = path.join(share_gs, ver, "Resource", "Init", "gs_init.ps");
+      if (existsSync(init_file)) {
+        return true;
+      }
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
+
 export function list_missing_staged_paths(root: string, kind?: PackPlatformKind): string[] {
   const k = kind ?? pack_kind_from_process();
   const missing: string[] = [];
@@ -84,6 +120,12 @@ export function list_missing_staged_paths(root: string, kind?: PackPlatformKind)
   if (k === "linux" && !linux_qpdf_shared_libs_present(root)) {
     missing.push("qpdf-lib/libqpdf.so*");
   }
+  if (k === "darwin" && !darwin_qpdf_dylibs_present(root)) {
+    missing.push("qpdf-lib/libqpdf*.dylib");
+  }
+  if (k === "darwin" && !darwin_ghostscript_gs_init_present(root)) {
+    missing.push("ghostscript/**/Resource/Init/gs_init.ps");
+  }
   return missing;
 }
 

scripts/lan_release_build.ts

@@ -108,7 +108,11 @@ function mac_bundled_cli_platform_key(): string {
   if (process.platform !== "darwin") {
     throw new Error("lan_release_build expects macOS for the local release build");
   }
-  return process.arch === "arm64" ? "darwin-arm64" : "darwin-x64";
+  const out = spawnSync("sysctl", ["-n", "hw.optional.arm64"], { encoding: "utf8" });
+  if (out.status === 0 && out.stdout.trim() === "1") {
+    return "darwin-arm64";
+  }
+  return "darwin-x64";
 }
 
 /** Match lan_sync_run: non-interactive SSH bash does not load Bun from .bashrc on Ubuntu. */

scripts/stage-bundled-bins.ts

@@ -7,6 +7,9 @@
  * `powershell.exe`. Override 7z path: `PROMETHEUS_7Z`; override PowerShell: `PROMETHEUS_PWSH`.
  * 7-Zip is also used for Ghostscript Inno extract + ImageMagick `.7z`.
  * Skip entirely: PROMETHEUS_SKIP_STAGE_BINS=1. Invoked from run-electrobun-with-build-at.ts before build.
+ *
+ * macOS: pack key follows **hardware** (Apple Silicon → `darwin-arm64`, Intel → `darwin-x64`), not `process.arch`,
+ * so a Rosetta-translated `bun` still stages arm64 CLIs on M-series Macs.
  */
 import { createHash } from "node:crypto";
 import {
@@ -118,16 +121,19 @@ function stage_script_sha256(): string {
   return sha256_file(script_path);
 }
 
+function darwin_bundled_cli_platform_key(): "darwin-arm64" | "darwin-x64" {
+  const out = spawnSync("sysctl", ["-n", "hw.optional.arm64"], { encoding: "utf8" });
+  if (out.status === 0 && out.stdout.trim() === "1") {
+    return "darwin-arm64";
+  }
+  return "darwin-x64";
+}
+
 function host_platform_key(): string {
-  const arch = process.arch;
   if (process.platform === "darwin") {
-    if (arch === "arm64") {
-      return "darwin-arm64";
-    }
-    if (arch === "x64") {
-      return "darwin-x64";
-    }
+    return darwin_bundled_cli_platform_key();
   }
+  const arch = process.arch;
   if (process.platform === "linux" && arch === "x64") {
     return "linux-x64";
   }
@@ -541,7 +547,9 @@ async function stage_yt_dlp(): Promise<void> {
 
 async function stage_qpdf(): Promise<void> {
   if (process.platform === "darwin") {
-    stage_macos_homebrew_bottle_binary("qpdf", "qpdf", path.join(out_dir, "qpdf"));
+    stage_macos_homebrew_bottle_qpdf_with_libs();
+    /** libqpdf links to Homebrew openssl (@@HOMEBREW_PREFIX@@); ship those dylibs next to qpdf. */
+    stage_macos_merge_formula_lib_into_destinations("openssl@3", [path.join(out_dir, "qpdf-lib")]);
     return;
   }
   if (process.platform === "linux") {
@@ -633,17 +641,37 @@ function macos_resolve_latest_bottle_tarball(formula: string): string {
   return path.join(downloads_dir, bottle);
 }
 
-function stage_macos_homebrew_bottle_binary(formula: string, binary_name: string, dest_path: string): void {
-  const bottle_path = macos_resolve_latest_bottle_tarball(formula);
-  const tmp = mkdtempSync(path.join(tmpdir(), `prometheus-${formula}-`));
+/**
+ * qpdf binary plus libqpdf dylibs for a relocatable bundle (dyld / @rpath).
+ */
+function stage_macos_homebrew_bottle_qpdf_with_libs(): void {
+  const bottle_path = macos_resolve_latest_bottle_tarball("qpdf");
+  const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-qpdf-prefix-"));
   try {
     run("tar", ["-xzf", bottle_path, "-C", tmp]);
-    const found = find_file_by_basename(tmp, binary_name);
-    if (!found) {
-      throw new Error(`Could not find ${binary_name} in ${formula} bottle extract`);
+    const formula_root = path.join(tmp, "qpdf");
+    if (!existsSync(formula_root)) {
+      throw new Error("Bottle extract missing qpdf/ (formula root)");
+    }
+    const versions = readdirSync(formula_root);
+    if (versions.length < 1) {
+      throw new Error("Empty version list for qpdf bottle");
+    }
+    const prefix = path.join(formula_root, versions[0]!);
+    const bin_src = path.join(prefix, "bin", "qpdf");
+    if (!existsSync(bin_src)) {
+      throw new Error("qpdf bottle missing bin/qpdf");
+    }
+    const dest_bin = path.join(out_dir, "qpdf");
+    copyFileSync(bin_src, dest_bin);
+    chmodSync(dest_bin, 0o755);
+    const lib_src = path.join(prefix, "lib");
+    const lib_dest = path.join(out_dir, "qpdf-lib");
+    if (!existsSync(lib_src)) {
+      throw new Error("qpdf bottle missing lib/ (libqpdf dylibs required at runtime)");
     }
-    copyFileSync(found, dest_path);
-    chmodSync(dest_path, 0o755);
+    rmSync(lib_dest, { recursive: true, force: true });
+    cpSync(lib_src, lib_dest, { recursive: true, dereference: true });
   } finally {
     rmSync(tmp, { recursive: true, force: true });
   }

scripts/update-bundled-tool.ts

@@ -46,16 +46,19 @@ type GitHubReleaseJson = {
   assets?: { name?: string; browser_download_url?: string }[];
 };
 
+function darwin_bundled_cli_platform_key(): "darwin-arm64" | "darwin-x64" {
+  const out = spawnSync("sysctl", ["-n", "hw.optional.arm64"], { encoding: "utf8" });
+  if (out.status === 0 && out.stdout.trim() === "1") {
+    return "darwin-arm64";
+  }
+  return "darwin-x64";
+}
+
 function host_platform_key(): string {
-  const arch = process.arch;
   if (process.platform === "darwin") {
-    if (arch === "arm64") {
-      return "darwin-arm64";
-    }
-    if (arch === "x64") {
-      return "darwin-x64";
-    }
+    return darwin_bundled_cli_platform_key();
   }
+  const arch = process.arch;
   if (process.platform === "linux" && arch === "x64") {
     return "linux-x64";
   }

src/bun/cli/index.ts

@@ -6,6 +6,7 @@ import { db_init } from "../db/db";
 import { db_logs_init_defaults } from "../db/db.logs";
 import { db_cli_schedules_add, db_cli_schedules_list, db_cli_schedules_remove } from "../db/db.cli_schedules";
 import { bundled_cli_apply_embedded_runtime_env } from "../utils/bundled_cli_paths";
+import { bundled_toolchain_cli_abort_if_invalid } from "../utils/bundled_toolchain";
 import {
   CLI_EXIT_CODE_CANCELLED,
   CLI_EXIT_CODE_RUNTIME_ERROR,
@@ -74,6 +75,7 @@ function cli_progress_print(event: CliProgressEvent, format: CliOutputFormat, co
 
 async function cli_main(): Promise<void> {
   bundled_cli_apply_embedded_runtime_env();
+  bundled_toolchain_cli_abort_if_invalid();
   await db_init();
   db_logs_init_defaults();
 

src/bun/index.ts

@@ -25,8 +25,10 @@ import { command_debug_bind_emitter } from "./tools/command-debug";
 import { windows_bundle_icon_apply_to_window } from "./helpers/windows_bundle_icon";
 import type { CommandDebugEntry } from "./types/rpc";
 import { bundled_cli_apply_embedded_runtime_env } from "./utils/bundled_cli_paths";
+import { bundled_toolchain_run_startup_validation } from "./utils/bundled_toolchain";
 
 bundled_cli_apply_embedded_runtime_env();
+bundled_toolchain_run_startup_validation();
 
 let win: BrowserWindow;
 const runtime_os: RuntimeOS = process.platform === "darwin" ? "macos" : process.platform === "win32" ? "windows" : "linux";

src/bun/rpc/requests/core.ts

@@ -1,11 +1,17 @@
+import { spawn } from "node:child_process";
 import { Updater } from "electrobun/bun";
 import { localization_t } from "../../../shared/localization";
 import type { UpdateStatusPayload } from "../../types/rpc";
+import type { BundledToolchainFailure } from "../../utils/bundled_toolchain";
 import { guard_parse } from "../../helpers/runtime_guards";
 import { TOOL_BACKEND_PATHS, TOOL_PAGE_COPY } from "../constants";
 import type { RpcBaseContext } from "../../types/rpc_context";
 import { rpc_emit_update_state_changed } from "../emitters";
 import { get_tool_page_data_params_schema } from "./core_schemas";
+import {
+  bundled_toolchain_startup_failures,
+  bundled_toolchain_startup_blocked,
+} from "../../utils/bundled_toolchain";
 
 /**
  * Current update status of the application
@@ -230,6 +236,28 @@ export function create_core_requests(
       };
     },
     get_tool_backend_paths: async () => ({ os: context.runtime_os, tools: TOOL_BACKEND_PATHS[context.runtime_os] }),
+    get_bundled_toolchain_startup_block: async () => {
+      const failures = bundled_toolchain_startup_failures();
+      const blocked = bundled_toolchain_startup_blocked();
+      const list: BundledToolchainFailure[] = failures ?? [];
+      return { blocked, failures: list };
+    },
+    macos_open_full_disk_access_settings: async () => {
+      if (process.platform !== "darwin") {
+        return { ok: false, message: localization_t("runtime.full_disk_access_macos_only") };
+      }
+      try {
+        const child = spawn(
+          "open",
+          ["x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles"],
+          { detached: true, stdio: "ignore" }
+        );
+        child.unref();
+        return { ok: true, message: "" };
+      } catch (error) {
+        return { ok: false, message: String(error) };
+      }
+    },
     update_get_status: () => update_get_status_request(context),
     update_check: () => update_check_request(context),
     update_download: () => update_download_request(context),

src/bun/tools/utilities/documents/common/macos.ts

@@ -1,4 +1,3 @@
-import { existsSync, readdirSync } from "node:fs";
 import type { CommandResult } from "./types/common";
 import { command_debug_log_finish, command_debug_log_start } from "../../../command-debug";
 import { OperationCancelledError } from "../../../../helpers/operation_cancelled_error";
@@ -106,35 +105,9 @@ export async function documents_macos_command_succeeds(command: string[]): Promi
   }
 }
 
-/** argv[0] for qpdf subprocesses (bundled binary). */
+/** argv[0] for qpdf subprocesses (bundled binary only; validated at startup). */
 export function documents_macos_qpdf_command(): string {
-  const bundled_qpdf = bundled_cli_path("qpdf");
-  const bundled_lib_dir = resolve_path_relative_to_qpdf_lib_dir(bundled_qpdf);
-  if (bundled_lib_dir && has_qpdf_dylib_in_dir(bundled_lib_dir)) {
-    return bundled_qpdf;
-  }
-
-  const system_qpdf_candidates = ["/opt/homebrew/bin/qpdf", "/usr/local/bin/qpdf", "/usr/bin/qpdf"];
-  for (const candidate of system_qpdf_candidates) {
-    if (existsSync(candidate)) {
-      return candidate;
-    }
-  }
-  return bundled_qpdf;
-}
-
-function resolve_path_relative_to_qpdf_lib_dir(qpdf_path: string): string | null {
-  const lib_dir = `${qpdf_path}/../lib`;
-  return existsSync(lib_dir) ? lib_dir : null;
-}
-
-function has_qpdf_dylib_in_dir(dir_path: string): boolean {
-  try {
-    const entries = readdirSync(dir_path);
-    return entries.some((entry) => entry.startsWith("libqpdf.") && entry.endsWith(".dylib"));
-  } catch {
-    return false;
-  }
+  return bundled_cli_path("qpdf");
 }
 
 /**

src/bun/tools/utilities/video/yt-dlp/macos.ts

@@ -1,7 +1,11 @@
 import type { AnalyzeResult, RunResult } from "./types/macos";
 import { documents_macos_pick_directory } from "../../documents/common/macos";
 import { yt_dlp_run_stream_command } from "./run_stream";
-import { yt_dlp_build_argv, yt_dlp_run_payload_parse } from "./run_validate";
+import {
+  yt_dlp_build_argv,
+  yt_dlp_run_payload_parse,
+  yt_dlp_stderr_suggests_macos_safari_cookie_denial,
+} from "./run_validate";
 import { bundled_cli_path } from "../../../../utils/bundled_cli_paths";
 import { yt_dlp_analyze_run } from "./analyze";
 
@@ -43,11 +47,16 @@ export async function yt_dlp_macos_run_streaming(
     cwd: payload.output_directory,
   });
   const ok = result.exit_code === 0;
+  const full_disk_access_hint =
+    !ok &&
+    payload.use_browser_cookies === true &&
+    yt_dlp_stderr_suggests_macos_safari_cookie_denial(result.stderr_tail);
   return {
     ok,
     exit_code: result.exit_code,
     message: ok ? "Download finished." : `yt-dlp exited with code ${result.exit_code}.`,
     stdout_tail: result.stdout_tail,
     stderr_tail: result.stderr_tail,
+    ...(full_disk_access_hint ? { full_disk_access_hint: true as const } : {}),
   };
 }