mirror of
https://github.com/block/buzz.git
synced 2026-10-31 14:31:02 +00:00
## Summary Introduces a protected-build boundary for the default-off Bestie experiment without adding any Bestie product surface. - Official OSS builds select an empty protected-feature module and emit no Bestie/Chief metadata or implementation content. - Protected internal builds select a separate module graph containing the Bestie experiment definition. - Within an internal build, Bestie remains disabled until the user opts in under Settings → Experiments. - The production build runs an artifact matrix and fails if OSS output contains protected content or internal output lacks the Bestie manifest. ## Build contract | Build variant | User opt-in | Result | | --- | --- | --- | | Official OSS | Any/forged | Bestie absent from the compiled artifact | | Protected internal | Off | Bestie available but disabled | | Protected internal | On | Bestie enabled | The companion protected-release change is squareup/buzz-releases#91. It sets `VITE_BUZZ_BESTIE=1`, requires that exact value, forwards it into the signed macOS build, and asserts the contract in release validation. ## Why this is separate This gives later Bestie PRs one build-selected import seam. Protected implementations must be reachable only from the internal module so they never enter the official OSS module graph. ## Non-goals - No Bestie persona or provisioning - No sidebar, app-chrome, or message-toolbar UI - No entitlement or secrecy claim: the source is public; this boundary controls official Block artifacts ## Verification - Exact commit `523cf49ced03cba9be43836a54d6aa5d6923cc82` - Full `just ci`: 5,673 Desktop tests, 2,773 Tauri tests, 1,860 mobile tests, Rust/Tauri/web/mobile static checks and builds - OSS production artifact: scanner confirms no `Bestie`, `Chief of Staff`, or `builtin:bestie` content - Internal production artifact: scanner confirms the protected Bestie manifest is emitted - Both build orders verified; `dist` retains the requested variant for Vite/Tauri packaging --------- Signed-off-by: Arjun Mahanti <arjun@squareup.com> Signed-off-by: Fizz <fizz@buzz.local> Signed-off-by: Fizz <dae5f6af70b8695a8b83c8deae555f63be41630ec2b8cd493e41a439c9527dd8@buzz.block.builderlab.xyz> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Fizz <fizz@buzz.local> Co-authored-by: Fizz <dae5f6af70b8695a8b83c8deae555f63be41630ec2b8cd493e41a439c9527dd8@buzz.block.builderlab.xyz>
96 lines
3.0 KiB
JavaScript
96 lines
3.0 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import {
|
|
mkdtempSync,
|
|
mkdirSync,
|
|
readFileSync,
|
|
rmSync,
|
|
writeFileSync,
|
|
} from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import path from "node:path";
|
|
import { describe, it } from "node:test";
|
|
import { loadEnv } from "vite";
|
|
|
|
import {
|
|
buildArtifactMatrix,
|
|
selectInternalVariant,
|
|
} from "../../scripts/build-protected-feature-artifacts.mjs";
|
|
|
|
const INTERNAL_MARKER = "Try a personal agent that is always close at hand";
|
|
|
|
function fakeBuilder(calls) {
|
|
return ({ internal, output }) => {
|
|
calls.push(internal);
|
|
rmSync(output, { recursive: true, force: true });
|
|
mkdirSync(output, { recursive: true });
|
|
writeFileSync(
|
|
path.join(output, "index.js"),
|
|
internal ? INTERNAL_MARKER : "public desktop artifact",
|
|
);
|
|
};
|
|
}
|
|
|
|
describe("protected feature production artifact selection", () => {
|
|
it("honors env-file selection while process overrides retain the requested dist", () => {
|
|
const root = mkdtempSync(path.join(tmpdir(), "buzz-protected-build-test-"));
|
|
const envRoot = path.join(root, "env");
|
|
mkdirSync(envRoot);
|
|
writeFileSync(path.join(envRoot, ".env.local"), "VITE_BUZZ_BESTIE=1\n");
|
|
|
|
try {
|
|
const modeEnv = loadEnv("production", envRoot, "");
|
|
const internalOutput = path.join(root, "internal-dist");
|
|
const internalAlternate = path.join(root, "internal-alternate");
|
|
const internalCalls = [];
|
|
const fileSelectedInternal = selectInternalVariant({
|
|
processEnv: {},
|
|
modeEnv,
|
|
});
|
|
|
|
assert.equal(fileSelectedInternal, true);
|
|
buildArtifactMatrix({
|
|
selectedInternalVariant: fileSelectedInternal,
|
|
selectedOutput: internalOutput,
|
|
alternateOutput: internalAlternate,
|
|
build: fakeBuilder(internalCalls),
|
|
});
|
|
assert.deepEqual(internalCalls, [false, true]);
|
|
assert.match(
|
|
readFileSync(path.join(internalOutput, "index.js"), "utf8"),
|
|
/personal agent/u,
|
|
);
|
|
assert.doesNotMatch(
|
|
readFileSync(path.join(internalAlternate, "index.js"), "utf8"),
|
|
/personal agent/u,
|
|
);
|
|
|
|
const ossOutput = path.join(root, "oss-dist");
|
|
const ossAlternate = path.join(root, "oss-alternate");
|
|
const ossCalls = [];
|
|
const processSelectedOss = selectInternalVariant({
|
|
processEnv: { VITE_BUZZ_BESTIE: "0" },
|
|
modeEnv,
|
|
});
|
|
|
|
assert.equal(processSelectedOss, false);
|
|
buildArtifactMatrix({
|
|
selectedInternalVariant: processSelectedOss,
|
|
selectedOutput: ossOutput,
|
|
alternateOutput: ossAlternate,
|
|
build: fakeBuilder(ossCalls),
|
|
});
|
|
assert.deepEqual(ossCalls, [true, false]);
|
|
assert.doesNotMatch(
|
|
readFileSync(path.join(ossOutput, "index.js"), "utf8"),
|
|
/personal agent/u,
|
|
);
|
|
assert.match(
|
|
readFileSync(path.join(ossAlternate, "index.js"), "utf8"),
|
|
/personal agent/u,
|
|
);
|
|
} finally {
|
|
rmSync(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|