Netcatty/scripts/afterPackMacUuid.cjs

/**
 * electron-builder afterPack hook — give the macOS app a unique Mach-O LC_UUID.
 *
 * macOS keys the "Local Network" privacy permission on the main executable's
 * Mach-O LC_UUID (see Apple TN3179). Electron's prebuilt binary is linked with
 * LLD, which derives the UUID from a content hash, so EVERY app built from the
 * same Electron version ships the *same* LC_UUID — even with a different bundle
 * id. That collision makes the Local Network grant unreliable: macOS may apply
 * another Electron app's decision to ours, so a user who toggles the permission
 * on still gets `EHOSTUNREACH` when connecting to LAN/VMware host-only addresses
 * (issue #1040).
 *
 * This hook rewrites the LC_UUID of the packaged main executable to a value
 * derived deterministically from the appId — stable across builds (so users
 * don't have to re-grant on every update) but distinct from every other app.
 * It runs in `afterPack`, i.e. BEFORE electron-builder code-signs, so the
 * signature/notarization covers the patched binary.
 */
const fs = require("node:fs");
const path = require("node:path");
const crypto = require("node:crypto");
const { execFileSync } = require("node:child_process");
const {
  copyPatchedNodePtyToPackagedApp,
  rebuildPatchedNodePty,
} = require("./nodePtyConptyPatch.cjs");

const LC_UUID = 0x1b;
const MH_MAGIC_64 = 0xfeedfacf; // thin 64-bit, little-endian on disk
const MH_CIGAM_64 = 0xcffaedfe; // thin 64-bit, byte-swapped
const FAT_MAGIC = 0xcafebabe; // fat, big-endian
const FAT_MAGIC_64 = 0xcafebabf;
const MACH_HEADER_64_SIZE = 32;

/**
 * Deterministic, app-specific 16-byte UUID. Stable across builds (so the
 * Local Network grant survives updates) yet unique per appId.
 * @param {string} appId
 * @returns {Buffer}
 */
function deriveUuid(appId) {
  const hash = crypto.createHash("sha1").update(`netcatty-local-network|${appId}`).digest();
  const uuid = Buffer.from(hash.subarray(0, 16));
  uuid[6] = (uuid[6] & 0x0f) | 0x50; // version 5
  uuid[8] = (uuid[8] & 0x3f) | 0x80; // RFC 4122 variant
  return uuid;
}

function formatUuid(buf) {
  const h = buf.toString("hex").toUpperCase();
  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
}

/**
 * Patch every LC_UUID load command inside a single thin Mach-O slice.
 * @returns {string[]} the old UUIDs that were replaced (hex)
 */
function patchThinSlice(buf, sliceOffset, uuid) {
  const magic = buf.readUInt32LE(sliceOffset);
  if (magic !== MH_MAGIC_64 && magic !== MH_CIGAM_64) return [];
  const swapped = magic === MH_CIGAM_64;
  const readU32 = (o) => (swapped ? buf.readUInt32BE(o) : buf.readUInt32LE(o));

  const ncmds = readU32(sliceOffset + 16);
  let off = sliceOffset + MACH_HEADER_64_SIZE;
  const replaced = [];
  for (let i = 0; i < ncmds; i += 1) {
    const cmd = readU32(off);
    const cmdsize = readU32(off + 4);
    if (cmdsize <= 0) break;
    if (cmd === LC_UUID) {
      replaced.push(buf.subarray(off + 8, off + 24).toString("hex"));
      uuid.copy(buf, off + 8); // uuid[16] follows cmd(4) + cmdsize(4)
    }
    off += cmdsize;
  }
  return replaced;
}

/**
 * Rewrite all LC_UUID load commands in a Mach-O buffer (thin or fat) in place.
 * @returns {{ patched: number, oldUuids: string[] }}
 */
function patchMachOBuffer(buf, uuid) {
  const magicBE = buf.readUInt32BE(0);
  const oldUuids = [];

  if (magicBE === FAT_MAGIC || magicBE === FAT_MAGIC_64) {
    const is64 = magicBE === FAT_MAGIC_64;
    const archSize = is64 ? 32 : 20;
    const nfat = buf.readUInt32BE(4);
    for (let i = 0; i < nfat; i += 1) {
      const archOff = 8 + i * archSize;
      const sliceOffset = is64
        ? Number(buf.readBigUInt64BE(archOff + 8))
        : buf.readUInt32BE(archOff + 8);
      oldUuids.push(...patchThinSlice(buf, sliceOffset, uuid));
    }
  } else {
    oldUuids.push(...patchThinSlice(buf, 0, uuid));
  }

  return { patched: oldUuids.length, oldUuids };
}

function patchMachOFile(file, uuid) {
  const buf = fs.readFileSync(file);
  const result = patchMachOBuffer(buf, uuid);
  if (result.patched > 0) fs.writeFileSync(file, buf);
  return result;
}

function adHocSignAppBundle(appPath, options = {}) {
  const hostPlatform = options.hostPlatform || process.platform;
  const execFile = options.execFileSync || execFileSync;

  if (hostPlatform !== "darwin") {
    console.warn(
      `[afterPack] Skipping ad-hoc codesign for ${appPath}; host platform is ${hostPlatform}`,
    );
    return false;
  }

  execFile("codesign", ["--force", "--deep", "--sign", "-", "--timestamp=none", appPath], {
    stdio: ["ignore", "pipe", "pipe"],
  });
  return true;
}

const ELECTRON_BUILDER_ARCH_NAMES = {
  0: "ia32",
  1: "x64",
  2: "armv7l",
  3: "arm64",
  4: "universal",
};

function archNameFromContext(context) {
  const arch = context?.arch;
  if (typeof arch === "string") return arch;
  if (typeof arch === "number" && ELECTRON_BUILDER_ARCH_NAMES[arch]) {
    return ELECTRON_BUILDER_ARCH_NAMES[arch];
  }
  return process.arch;
}

function cursorPlatformPackageBases(platform) {
  if (platform === "darwin") return ["sdk-darwin-arm64", "sdk-darwin-x64"];
  if (platform === "linux") return ["sdk-linux-arm64", "sdk-linux-x64"];
  if (platform === "win32") return ["sdk-win32-x64"];
  return [];
}

function cursorPackagesToKeep(platform, archName) {
  if (platform === "darwin" && archName === "universal") {
    return new Set(["sdk-darwin-arm64", "sdk-darwin-x64"]);
  }
  if (platform === "darwin" && (archName === "arm64" || archName === "x64")) {
    return new Set([`sdk-darwin-${archName}`]);
  }
  if (platform === "linux" && (archName === "arm64" || archName === "x64")) {
    return new Set([`sdk-linux-${archName}`]);
  }
  if (platform === "win32" && archName === "x64") {
    return new Set(["sdk-win32-x64"]);
  }
  return new Set();
}

function appResourcesDir(context) {
  if (context.electronPlatformName === "darwin") {
    const productFilename = context.packager.appInfo.productFilename;
    return path.join(context.appOutDir, `${productFilename}.app`, "Contents", "Resources");
  }
  return path.join(context.appOutDir, "resources");
}

function readAsarHeader(asarPath) {
  const fd = fs.openSync(asarPath, "r");
  try {
    const sizeBuf = Buffer.alloc(8);
    if (fs.readSync(fd, sizeBuf, 0, sizeBuf.length, 0) !== sizeBuf.length) {
      throw new Error(`[afterPack] Unable to read ASAR header size: ${asarPath}`);
    }

    const sizePicklePayloadSize = sizeBuf.readUInt32LE(0);
    if (sizePicklePayloadSize !== 4) {
      throw new Error(`[afterPack] Unsupported ASAR size pickle in ${asarPath}`);
    }

    const headerSize = sizeBuf.readUInt32LE(4);
    const headerBuf = Buffer.alloc(headerSize);
    if (fs.readSync(fd, headerBuf, 0, headerSize, 8) !== headerSize) {
      throw new Error(`[afterPack] Unable to read ASAR header: ${asarPath}`);
    }

    const headerPicklePayloadSize = headerBuf.readUInt32LE(0);
    if (headerPicklePayloadSize !== headerSize - 4) {
      throw new Error(`[afterPack] Unsupported ASAR header pickle in ${asarPath}`);
    }

    const headerStringLength = headerBuf.readInt32LE(4);
    const headerString = headerBuf.subarray(8, 8 + headerStringLength).toString("utf8");
    return { header: JSON.parse(headerString), headerSize };
  } finally {
    fs.closeSync(fd);
  }
}

function writeAsarHeaderPreservingDataOffset(asarPath, header, headerSize) {
  const headerString = JSON.stringify(header);
  const headerStringLength = Buffer.byteLength(headerString);
  const fixedPrefixSize = 8; // payload size uint32 + string length int32
  if (fixedPrefixSize + headerStringLength > headerSize) {
    throw new Error(
      `[afterPack] Updated ASAR header is larger than the original header for ${asarPath}`,
    );
  }

  const headerBuf = Buffer.alloc(headerSize);
  headerBuf.writeUInt32LE(headerSize - 4, 0);
  headerBuf.writeInt32LE(headerStringLength, 4);
  headerBuf.write(headerString, fixedPrefixSize, headerStringLength, "utf8");

  const fd = fs.openSync(asarPath, "r+");
  try {
    fs.writeSync(fd, headerBuf, 0, headerBuf.length, 8);
  } finally {
    fs.closeSync(fd);
  }
}

function removeAsarHeaderEntry(header, entryPath) {
  const segments = entryPath.split(/[\\/]+/).filter(Boolean);
  if (segments.length === 0) return false;

  let node = header;
  for (const segment of segments.slice(0, -1)) {
    node = node.files?.[segment];
    if (!node) return false;
  }

  const leaf = segments[segments.length - 1];
  if (!Object.prototype.hasOwnProperty.call(node.files || {}, leaf)) return false;
  delete node.files[leaf];
  return true;
}

function pruneAsarHeaderEntries(asarPath, entryPaths) {
  if (!fs.existsSync(asarPath) || entryPaths.length === 0) return [];

  const { header, headerSize } = readAsarHeader(asarPath);
  const removed = entryPaths.filter((entryPath) => removeAsarHeaderEntry(header, entryPath));
  if (removed.length > 0) {
    writeAsarHeaderPreservingDataOffset(asarPath, header, headerSize);
  }
  return removed;
}

function pruneCursorSdkPlatformPackages(context) {
  const platform = context.electronPlatformName;
  const candidates = cursorPlatformPackageBases(platform);
  if (candidates.length === 0) return [];

  const keep = cursorPackagesToKeep(platform, archNameFromContext(context));
  if (keep.size === 0) return [];

  const cursorRoot = path.join(
    appResourcesDir(context),
    "app.asar.unpacked",
    "node_modules",
    "@cursor",
  );
  if (!fs.existsSync(cursorRoot)) return [];

  const removed = [];
  const asarHeaderEntriesToRemove = [];
  for (const baseName of candidates) {
    if (keep.has(baseName)) continue;
    const dir = path.join(cursorRoot, baseName);
    if (!fs.existsSync(dir)) continue;
    removed.push(baseName);
    asarHeaderEntriesToRemove.push(`node_modules/@cursor/${baseName}`);
  }

  if (removed.length === 0) return [];

  const appAsar = path.join(appResourcesDir(context), "app.asar");
  pruneAsarHeaderEntries(appAsar, asarHeaderEntriesToRemove);

  for (const baseName of removed) {
    fs.rmSync(path.join(cursorRoot, baseName), { recursive: true, force: true });
  }
  return removed;
}

function pruneNativePrebuilds(context) {
  const platform = context.electronPlatformName;
  const arch = typeof context.arch === "number" ? ELECTRON_BUILDER_ARCH_NAMES[context.arch] : context.arch;
  if (!["darwin", "linux", "win32"].includes(platform)) return [];
  const architectures = platform === "darwin" && arch === "universal"
    ? ["arm64", "x64"]
    : [arch === "armv7l" ? "arm" : arch];
  if (!architectures.every((value) => ["arm", "arm64", "ia32", "x64"].includes(value))) return [];

  const resourcesDir = appResourcesDir(context);
  const unpackedDir = path.join(resourcesDir, "app.asar.unpacked");
  const removed = [];
  for (const packageName of ["node-pty", "@serialport/bindings-cpp"]) {
    const prebuilds = `node_modules/${packageName}/prebuilds`;
    const directory = path.join(unpackedDir, prebuilds);
    if (!fs.existsSync(directory)) continue;
    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
      if (!entry.isDirectory()) continue;
      const tuple = /^([a-z0-9]+)-([a-z0-9+]+)$/.exec(entry.name);
      if (!tuple) continue;
      const [, buildPlatform, buildArchitectures] = tuple;
      if (buildPlatform === platform && architectures.some((value) => buildArchitectures.split("+").includes(value))) continue;
      removed.push(`${prebuilds}/${entry.name}`);
    }
  }
  if (removed.length === 0) return [];

  pruneAsarHeaderEntries(path.join(resourcesDir, "app.asar"), removed);
  for (const entry of removed) {
    fs.rmSync(path.join(unpackedDir, entry), { recursive: true, force: true });
  }
  return removed;
}

/** @param {import('electron-builder').AfterPackContext} context */
async function afterPack(context) {
  const removedCursorPackages = pruneCursorSdkPlatformPackages(context);
  if (removedCursorPackages.length > 0) {
    console.log(
      `[afterPack] Removed unused Cursor SDK platform package(s): ${removedCursorPackages.join(", ")}`,
    );
  }

  const removedPrebuilds = pruneNativePrebuilds(context);
  if (removedPrebuilds.length > 0) {
    console.log(`[afterPack] Removed unused native prebuild(s): ${removedPrebuilds.join(", ")}`);
  }

  if (context.electronPlatformName === "win32") {
    const projectDir = context.packager.appDir || context.packager.projectDir;
    rebuildPatchedNodePty({ projectDir, platform: "win32", arch: context.arch });
    copyPatchedNodePtyToPackagedApp({
      projectDir,
      resourcesDir: appResourcesDir(context),
    });
    console.log("[afterPack] Installed patched node-pty ConPTY runtime into packaged app");
    return;
  }

  if (context.electronPlatformName !== "darwin") return;

  const appId = context.packager.appInfo.id || "com.netcatty.app";
  const productFilename = context.packager.appInfo.productFilename;
  const appPath = path.join(context.appOutDir, `${productFilename}.app`);
  const exePath = path.join(
    appPath,
    "Contents",
    "MacOS",
    productFilename,
  );

  if (!fs.existsSync(exePath)) {
    throw new Error(`[afterPack] macOS executable not found: ${exePath}`);
  }

  const uuid = deriveUuid(appId);
  const { patched, oldUuids } = patchMachOFile(exePath, uuid);

  if (patched === 0) {
    throw new Error(
      `[afterPack] No LC_UUID load command found in ${exePath} — Local Network UUID fix did not apply`,
    );
  }

  console.log(
    `[afterPack] Mach-O LC_UUID rewritten for Local Network privacy (#1040): ` +
      `${oldUuids.map((h) => formatUuid(Buffer.from(h, "hex"))).join(", ")} -> ${formatUuid(uuid)} ` +
      `(${patched} slice(s), appId=${appId})`,
  );

  // The official Developer ID signing step runs after afterPack and replaces
  // this temporary signature. Local unsigned builds skip that step, so the
  // patched app bundle still needs a valid ad-hoc signature or macOS kills it
  // before Electron can start. Signing the whole bundle also covers Electron's
  // nested frameworks, which codesign validates as subcomponents.
  if (adHocSignAppBundle(appPath)) {
    console.log("[afterPack] Ad-hoc signed patched macOS app for local unsigned builds");
  }
}

module.exports = afterPack;
module.exports.default = afterPack;
module.exports.deriveUuid = deriveUuid;
module.exports.formatUuid = formatUuid;
module.exports.patchMachOBuffer = patchMachOBuffer;
module.exports.patchMachOFile = patchMachOFile;
module.exports.adHocSignAppBundle = adHocSignAppBundle;
module.exports.readAsarHeader = readAsarHeader;
module.exports.pruneAsarHeaderEntries = pruneAsarHeaderEntries;
module.exports.pruneCursorSdkPlatformPackages = pruneCursorSdkPlatformPackages;
module.exports.pruneNativePrebuilds = pruneNativePrebuilds;