Wire authenticated voice watch notices through an owned native launcher

apps/desktop/scripts/before-pack.mjs

@@ -57,6 +57,7 @@
  *   - electronPlatformName: 'win32' | 'darwin' | 'linux'
  *   - arch:                 Arch enum (0=ia32, 1=x64, 2=armv7l, 3=arm64, 4=universal)
  */
+import { buildNativeWatchLauncher } from './build-native-watch-launcher.mjs'
 import { existsSync, rmSync, renameSync } from 'node:fs'
 import path from 'node:path'
 import { Arch } from 'electron-builder'
@@ -111,6 +112,7 @@ export function preserveRollbackBackup(appOutDir, productExeName = 'Hermes.exe')
 }
 
 export default async function beforePack(context) {
+  if (context?.electronPlatformName === 'win32') buildNativeWatchLauncher()
   const appOutDir = context && context.appOutDir
   const platformName = context && context.electronPlatformName
   try {

apps/desktop/scripts/build-native-watch-launcher.mjs

@@ -0,0 +1,30 @@
+/** Build the Windows artifact from source on Windows or the Linux/Wine CI host. */
+import { execFileSync } from 'node:child_process'
+import { rmSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const sourceHome = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../assets/codex-bridge')
+export function compilerCommand({ platform = process.platform, env = process.env, source, output }) {
+  const args = ['/nologo', '/target:exe', '/platform:anycpu', '/reference:System.Web.Extensions.dll', `/out:${output}`, source]
+  if (platform === 'win32') {
+    return { command: path.win32.join(env.SystemRoot || 'C:/Windows', 'Microsoft.NET/Framework64/v4.0.30319/csc.exe'), args }
+  }
+  if (platform === 'linux') return { command: 'mcs', args }
+  throw new Error(`Windows launcher compilation is not configured on ${platform}`)
+}
+
+export function buildNativeWatchLauncher({ home = sourceHome, ...options } = {}) {
+  const output = path.join(home, 'native-watch.exe')
+  const invocation = compilerCommand({ ...options, source: path.join(home, 'NativeWatchBootstrap.cs'), output })
+  // A missing compiler or broken source must fail packaging, never reuse an old EXE.
+  rmSync(output, { force: true })
+  execFileSync(invocation.command, invocation.args, { windowsHide: true, stdio: 'inherit' })
+  const bytes = readFileSync(output)
+  if (bytes.length < 64 || bytes.toString('ascii', 0, 2) !== 'MZ' || bytes.toString('ascii', bytes.readUInt32LE(60), bytes.readUInt32LE(60) + 4) !== 'PE\0\0') {
+    rmSync(output, { force: true })
+    throw new Error('Native watch compiler did not produce a Windows PE executable')
+  }
+  return output
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) buildNativeWatchLauncher()

apps/desktop/scripts/build-native-watch-launcher.test.mjs

@@ -0,0 +1,36 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, copyFileSync, readFileSync, writeFileSync, existsSync, rmSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { compilerCommand, buildNativeWatchLauncher } from './build-native-watch-launcher.mjs'
+
+const desktop = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+test('Windows and Linux hosts build the same Windows source with the required assembly', () => {
+  const input = { source: 'source with spaces.cs', output: 'output with spaces.exe' }
+  const win = compilerCommand({ ...input, platform: 'win32', env: { SystemRoot: 'D:/Windows' } })
+  const linux = compilerCommand({ ...input, platform: 'linux' })
+  assert.equal(win.command, 'D:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe')
+  assert.equal(linux.command, 'mcs')
+  assert.deepEqual(win.args, linux.args)
+  assert.ok(linux.args.includes('/reference:System.Web.Extensions.dll'))
+  assert.equal(linux.args.at(-1), input.source)
+  assert.throws(() => compilerCommand({ ...input, platform: 'darwin' }), /not configured/)
+})
+
+test('real host compiler builds PE from source, and broken source fails without stale artifact', () => {
+  // Inside the source workspace, including on the mounted Linux CI fixture.
+  const home = mkdtempSync(path.join(desktop, '.native-watch-test-'))
+  try {
+    copyFileSync(path.join(desktop, 'assets/codex-bridge/NativeWatchBootstrap.cs'), path.join(home, 'NativeWatchBootstrap.cs'))
+    const exe = buildNativeWatchLauncher({ home })
+    const first = readFileSync(exe)
+    assert.equal(first.toString('ascii', 0, 2), 'MZ')
+    writeFileSync(exe, 'stale artifact')
+    buildNativeWatchLauncher({ home })
+    assert.equal(readFileSync(exe).toString('ascii', 0, 2), 'MZ')
+    writeFileSync(path.join(home, 'NativeWatchBootstrap.cs'), 'invalid C# source')
+    assert.throws(() => buildNativeWatchLauncher({ home }))
+    assert.equal(existsSync(exe), false)
+  } finally { rmSync(home, { recursive: true, force: true }) }
+})