build-codex-intel.sh

#!/usr/bin/env bash
# =============================================================================
# build-codex-intel.sh — Convert an ARM Codex macOS DMG to Intel (x86_64)
#
# Usage:
#   ./build-codex-intel.sh /path/to/Codex.dmg
#
# What this script does (pipeline summary):
#   1.  Preflight checks (via checks.sh)
#   2.  Mount the input DMG read-only
#   3.  Copy Codex.app to a writable workspace
#   4.  Detect Electron version from the app itself
#   5.  Extract native module versions (better-sqlite3, node-pty) from the app
#   6.  Build a temporary x64 Node project and rebuild native modules for x64
#   7.  Replace arm64 .node artifacts with x64 builds
#   8.  Replace bundled arm64 binaries (codex CLI, rg/ripgrep) with x64 versions
#   9.  Handle Sparkle auto-update addon (disable safely)
#  10.  Validate all replaced binaries are x86_64
#  11.  Ad-hoc codesign the app
#  12.  Package into CodexAppMacIntel.dmg
#  13.  Emit SHA256 and report success
#
# Hard constraints (from spec):
#   - No sudo
#   - No persistence changes (no launch agents, daemons, login items, etc.)
#   - No network calls except npm/Homebrew package fetches and binary downloads
#   - Source DMG mounted read-only only
#   - All work confined to the project temp directory
#   - Full build log saved to file
# =============================================================================

set -euo pipefail

# =============================================================================
# SECTION 0: Script-level configuration
# =============================================================================

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUILD_LOG="${SCRIPT_DIR}/build-$(date +%Y%m%d-%H%M%S).log"
WORK_DIR="${SCRIPT_DIR}/work-$(date +%Y%m%d-%H%M%S)"
OUTPUT_DMG="${SCRIPT_DIR}/CodexAppMacIntel.dmg"

# Pinned ripgrep version for deterministic downloads.
# Check https://github.com/BurntSushi/ripgrep/releases for newer versions.
RG_VERSION="14.1.1"
RG_DOWNLOAD_URL="https://github.com/BurntSushi/ripgrep/releases/download/${RG_VERSION}/ripgrep-${RG_VERSION}-x86_64-apple-darwin.tar.gz"
RG_SHA256_EXPECTED=""  # Set to a known-good SHA256 to enable checksum verification.
                       # Leave empty to skip (not recommended for production use).

# Track the DMG mount point so the trap can unmount it on exit.
DMG_MOUNT_POINT=""

# =============================================================================
# SECTION 1: Logging
# =============================================================================

# All output goes to both stdout and the log file.
exec > >(tee -a "${BUILD_LOG}") 2>&1

log() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
}

log_section() {
  echo ""
  echo "============================================================"
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] STEP $*"
  echo "============================================================"
}

die() {
  echo ""
  echo "[ERROR] $*" >&2
  echo "[ERROR] Build failed. See log: ${BUILD_LOG}"
  exit 1
}

# =============================================================================
# SECTION 2: Cleanup trap
# =============================================================================

cleanup() {
  local exit_code=$?
  log "--- Cleanup triggered (exit code: ${exit_code}) ---"

  # Unmount DMG if still mounted.
  if [[ -n "${DMG_MOUNT_POINT}" ]] && mount | grep -q "${DMG_MOUNT_POINT}"; then
    log "Unmounting DMG at: ${DMG_MOUNT_POINT}"
    hdiutil detach "${DMG_MOUNT_POINT}" -force 2>/dev/null || true
  fi

  # Remove the work directory on failure. On success we remove it too (output is the DMG).
  # Guard: only rm -rf paths that are non-empty and under our known SCRIPT_DIR.
  if [[ -n "${WORK_DIR}" && "${WORK_DIR}" == "${SCRIPT_DIR}"/* && -d "${WORK_DIR}" ]]; then
    log "Removing work directory: ${WORK_DIR}"
    rm -rf "${WORK_DIR}"
  fi

  if [[ "${exit_code}" -ne 0 ]]; then
    echo ""
    echo "[FAILED] Build did not complete successfully."
    echo "         Review the log for details: ${BUILD_LOG}"
  fi
}

trap cleanup EXIT

# =============================================================================
# SECTION 3: Argument validation
# =============================================================================

log_section "0 — Argument Validation"

if [[ $# -ne 1 ]]; then
  die "Usage: $0 /path/to/Codex.dmg"
fi

INPUT_DMG="$1"

# Resolve absolute path.
INPUT_DMG="$(cd "$(dirname "${INPUT_DMG}")" && pwd)/$(basename "${INPUT_DMG}")"

if [[ ! -f "${INPUT_DMG}" ]]; then
  die "Input file not found: ${INPUT_DMG}"
fi

if [[ "${INPUT_DMG}" != *.dmg ]]; then
  die "Input file does not have a .dmg extension: ${INPUT_DMG}"
fi

log "Input DMG: ${INPUT_DMG}"
log "Output DMG: ${OUTPUT_DMG}"
log "Work directory: ${WORK_DIR}"
log "Build log: ${BUILD_LOG}"

# =============================================================================
# SECTION 4: Preflight checks
# =============================================================================

log_section "1 — Preflight Checks"

CHECKS_SCRIPT="${SCRIPT_DIR}/checks.sh"
if [[ ! -f "${CHECKS_SCRIPT}" ]]; then
  die "checks.sh not found at ${CHECKS_SCRIPT}. It must be in the same directory as this script."
fi

bash "${CHECKS_SCRIPT}" || die "Preflight checks failed. Resolve the issues and re-run."

log "Preflight checks passed."

# =============================================================================
# SECTION 5: Set up work directory
# =============================================================================

log_section "2 — Work Directory Setup"

mkdir -p "${WORK_DIR}"
log "Created work directory: ${WORK_DIR}"

APP_WORKSPACE="${WORK_DIR}/app"
NATIVE_BUILD_DIR="${WORK_DIR}/native-rebuild"
DOWNLOADS_DIR="${WORK_DIR}/downloads"

mkdir -p "${APP_WORKSPACE}" "${NATIVE_BUILD_DIR}" "${DOWNLOADS_DIR}"

# =============================================================================
# SECTION 6: Mount DMG read-only
# =============================================================================

log_section "3 — Mount DMG (read-only)"

log "Mounting: ${INPUT_DMG}"
MOUNT_OUTPUT="$(hdiutil attach -readonly -nobrowse -plist "${INPUT_DMG}")"

# Extract the mount point from the plist output using a simple Python one-liner
# (avoids needing xmllint or other tools).
DMG_MOUNT_POINT="$(echo "${MOUNT_OUTPUT}" | python3 -c "
import sys, plistlib
data = plistlib.loads(sys.stdin.buffer.read())
for entry in data.get('system-entities', []):
    mp = entry.get('mount-point', '')
    if mp:
        print(mp)
        break
" 2>/dev/null || true)"

if [[ -z "${DMG_MOUNT_POINT}" ]]; then
  # Fallback: parse mount output for /Volumes/ paths
  DMG_MOUNT_POINT="$(echo "${MOUNT_OUTPUT}" | grep -o '/Volumes/[^\n]*' | head -1 || true)"
fi

if [[ -z "${DMG_MOUNT_POINT}" ]] || [[ ! -d "${DMG_MOUNT_POINT}" ]]; then
  die "Could not determine DMG mount point. hdiutil output: ${MOUNT_OUTPUT}"
fi

log "DMG mounted at: ${DMG_MOUNT_POINT}"

# Find Codex.app inside the mounted volume.
SOURCE_APP="$(find "${DMG_MOUNT_POINT}" -maxdepth 2 -name "Codex.app" -type d | head -1 || true)"
if [[ -z "${SOURCE_APP}" ]]; then
  die "Could not find Codex.app inside mounted DMG at ${DMG_MOUNT_POINT}"
fi
log "Found source app: ${SOURCE_APP}"

# =============================================================================
# SECTION 7: Copy app to writable workspace
# =============================================================================

log_section "4 — Copy App to Workspace"

CODEX_APP="${APP_WORKSPACE}/Codex.app"
log "Copying Codex.app to workspace (this may take a moment)..."
cp -R "${SOURCE_APP}" "${APP_WORKSPACE}/"
log "Copy complete: ${CODEX_APP}"

# Unmount the DMG as soon as we have our copy — we no longer need it.
log "Unmounting DMG (no longer needed)..."
hdiutil detach "${DMG_MOUNT_POINT}" -force
DMG_MOUNT_POINT=""  # Clear so trap doesn't attempt a second unmount.
log "DMG unmounted."

# =============================================================================
# SECTION 8: Detect Electron version
# =============================================================================

log_section "5 — Detect Electron Version"

# Strategy: read the version string from the Electron Framework binary's
# embedded Info.plist or from the framework's own Info.plist file.
# We do NOT rely on npm or guessing.

ELECTRON_FRAMEWORK_DIR="${CODEX_APP}/Contents/Frameworks/Electron Framework.framework"

ELECTRON_VERSION=""

# Helper: validate a string looks like a semver version (X.Y.Z)
is_valid_version() {
  echo "$1" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'
}

# Attempt 1: Read from Electron Framework's Info.plist using Python plistlib
# (avoids plutil/defaults stdout error-message pollution)
ELECTRON_INFOPLIST="${ELECTRON_FRAMEWORK_DIR}/Resources/Info.plist"
if [[ -f "${ELECTRON_INFOPLIST}" ]]; then
  ELECTRON_VERSION="$(python3 - "${ELECTRON_INFOPLIST}" <<'PYEOF' 2>/dev/null || true
import sys, plistlib
try:
    with open(sys.argv[1], 'rb') as f:
        d = plistlib.load(f)
    for key in ['CFBundleShortVersionString', 'CFBundleVersion']:
        v = d.get(key, '').strip()
        if v and v[0].isdigit():
            print(v)
            break
except Exception:
    pass
PYEOF
)"
  log "Electron version from Electron Framework Info.plist: ${ELECTRON_VERSION:-'(not found)'}"
fi

# Attempt 2: Read from the main app's Info.plist
if [[ -z "${ELECTRON_VERSION}" ]] || ! is_valid_version "${ELECTRON_VERSION}"; then
  ELECTRON_VERSION=""
  APP_INFOPLIST="${CODEX_APP}/Contents/Info.plist"
  if [[ -f "${APP_INFOPLIST}" ]]; then
    ELECTRON_VERSION="$(python3 - "${APP_INFOPLIST}" <<'PYEOF' 2>/dev/null || true
import sys, plistlib
try:
    with open(sys.argv[1], 'rb') as f:
        d = plistlib.load(f)
    for key in ['ElectronVersion', 'CFBundleShortVersionString', 'CFBundleVersion']:
        v = d.get(key, '').strip()
        if v and v[0].isdigit():
            print(v)
            break
except Exception:
    pass
PYEOF
)"
    log "Electron version from app Info.plist: ${ELECTRON_VERSION:-'(not found)'}"
  fi
fi

# Attempt 3: Extract from app.asar's package.json (devDependencies or similar)
if [[ -z "${ELECTRON_VERSION}" ]]; then
  ASAR_FILE="${CODEX_APP}/Contents/Resources/app.asar"
  if [[ -f "${ASAR_FILE}" ]]; then
    log "Attempting to read Electron version from app.asar package.json..."
    ASAR_EXTRACT_DIR="${WORK_DIR}/asar-probe"
    mkdir -p "${ASAR_EXTRACT_DIR}"
    # Extract just the package.json from the asar
    npx --yes @electron/asar extract-file "${ASAR_FILE}" package.json "${ASAR_EXTRACT_DIR}/package.json" 2>/dev/null || true
    if [[ -f "${ASAR_EXTRACT_DIR}/package.json" ]]; then
      ELECTRON_VERSION="$(python3 -c "
import json, sys
with open('${ASAR_EXTRACT_DIR}/package.json') as f:
    d = json.load(f)
# Check common places the electron version appears
for key in ['electronVersion', 'electron_version']:
    if key in d:
        print(d[key])
        sys.exit(0)
devdeps = d.get('devDependencies', {})
if 'electron' in devdeps:
    v = devdeps['electron'].lstrip('^~>=')
    print(v)
    sys.exit(0)
" 2>/dev/null || true)"
      log "Electron version from app.asar package.json: ${ELECTRON_VERSION}"
    fi
    rm -rf "${ASAR_EXTRACT_DIR}"
  fi
fi

# Attempt 4: Read version string embedded in the framework binary via strings
if [[ -z "${ELECTRON_VERSION}" ]]; then
  ELECTRON_BINARY="${ELECTRON_FRAMEWORK_DIR}/Electron Framework"
  if [[ -f "${ELECTRON_BINARY}" ]]; then
    log "Attempting to extract version from Electron Framework binary strings..."
    # Look specifically for the "Electron/X.Y.Z" user-agent style string embedded
    # in the binary — this is far more specific than matching bare version numbers.
    ELECTRON_VERSION="$(strings "${ELECTRON_BINARY}" 2>/dev/null \
      | grep -Eo 'Electron/[0-9]+\.[0-9]+\.[0-9]+' \
      | head -1 \
      | sed 's|Electron/||' || true)"
    log "Electron version from binary strings: ${ELECTRON_VERSION}"
  fi
fi

if [[ -z "${ELECTRON_VERSION}" ]] || ! is_valid_version "${ELECTRON_VERSION}"; then
  die "Could not detect a valid Electron version (got: '${ELECTRON_VERSION:-empty}'). Cannot continue without knowing the correct ABI target."
fi

log "Using Electron version: ${ELECTRON_VERSION}"

# =============================================================================
# SECTION 8b: Replace Electron runtime with x64 version
# =============================================================================

log_section "5b — Replace Electron Runtime with x64"

# The Codex.app bundles the arm64 Electron runtime (Contents/MacOS/Codex and
# the Electron Framework.framework). We need to download the official x64
# Electron distribution and swap in the x64 binaries.

ELECTRON_ZIP_URL="https://github.com/electron/electron/releases/download/v${ELECTRON_VERSION}/electron-v${ELECTRON_VERSION}-darwin-x64.zip"
ELECTRON_ZIP="${DOWNLOADS_DIR}/electron-v${ELECTRON_VERSION}-darwin-x64.zip"
ELECTRON_EXTRACT_DIR="${WORK_DIR}/electron-x64"

log "Downloading Electron v${ELECTRON_VERSION} x64 from GitHub..."
curl -fsSL "${ELECTRON_ZIP_URL}" -o "${ELECTRON_ZIP}" || die "Failed to download Electron x64. URL: ${ELECTRON_ZIP_URL}"
log "Download complete: ${ELECTRON_ZIP}"

log "Extracting Electron x64..."
mkdir -p "${ELECTRON_EXTRACT_DIR}"
unzip -q "${ELECTRON_ZIP}" -d "${ELECTRON_EXTRACT_DIR}"
log "Extraction complete."

# The zip contains Electron.app. Find it.
ELECTRON_X64_APP="$(find "${ELECTRON_EXTRACT_DIR}" -maxdepth 2 -name "Electron.app" -type d | head -1 || true)"
if [[ -z "${ELECTRON_X64_APP}" ]]; then
  die "Could not find Electron.app inside extracted Electron zip."
fi

# --- Replace the main executable ---
# The main binary is at Contents/MacOS/<AppName>. In the Electron dist it's
# Contents/MacOS/Electron; in Codex.app it's Contents/MacOS/Codex.
CODEX_MAIN_BIN="${CODEX_APP}/Contents/MacOS/Codex"
ELECTRON_X64_BIN="${ELECTRON_X64_APP}/Contents/MacOS/Electron"

if [[ -f "${ELECTRON_X64_BIN}" ]]; then
  log "Replacing main Electron binary..."
  cp "${ELECTRON_X64_BIN}" "${CODEX_MAIN_BIN}"
  chmod +x "${CODEX_MAIN_BIN}"
  log "  Main executable replaced: $(file "${CODEX_MAIN_BIN}")"
else
  die "Electron x64 main binary not found at: ${ELECTRON_X64_BIN}"
fi

# --- Replace ALL frameworks (Electron Framework, Squirrel, ReactiveObjC, Mantle, etc.) ---
# The x64 Electron distribution ships several .framework bundles that all need
# to be x64. Replace every .framework in the app with the x64 version.
log "Replacing all frameworks from x64 Electron distribution..."
while IFS= read -r src_framework; do
  fw_name="$(basename "${src_framework}")"
  dest_framework="${CODEX_APP}/Contents/Frameworks/${fw_name}"

  if [[ -d "${dest_framework}" ]]; then
    log "  Replacing: ${fw_name}"
    rm -rf "${dest_framework}"
    cp -R "${src_framework}" "${dest_framework}"
  else
    log "  New framework (not in original app): ${fw_name} — copying in."
    cp -R "${src_framework}" "${dest_framework}"
  fi
done < <(find "${ELECTRON_X64_APP}/Contents/Frameworks" -maxdepth 1 -name "*.framework" -type d)
log "  All frameworks replaced."

# --- Replace Electron Helper apps ---
log "Replacing Electron Helper apps..."
while IFS= read -r helper_app; do
  helper_name="$(basename "${helper_app}")"
  # Map from Electron helper name to Codex helper name
  codex_helper_name="${helper_name//Electron/Codex}"
  codex_helper_path="${CODEX_APP}/Contents/Frameworks/${codex_helper_name}"

  if [[ -d "${codex_helper_path}" ]]; then
    # Replace the helper's main binary
    helper_bin_name="${helper_name%.app}"
    electron_helper_bin="${helper_app}/Contents/MacOS/${helper_bin_name}"
    codex_helper_bin_name="${codex_helper_name%.app}"
    codex_helper_bin="${codex_helper_path}/Contents/MacOS/${codex_helper_bin_name}"

    if [[ -f "${electron_helper_bin}" ]] && [[ -f "${codex_helper_bin}" ]]; then
      cp "${electron_helper_bin}" "${codex_helper_bin}"
      chmod +x "${codex_helper_bin}"
      log "  Replaced helper: ${codex_helper_name}"
    fi
  else
    # No matching Codex-named helper — copy the Electron helper as-is
    # (some helpers may not have been renamed in the original app)
    log "  No matching Codex helper for: ${helper_name} — copying Electron helper directly."
    cp -R "${helper_app}" "${CODEX_APP}/Contents/Frameworks/${helper_name}"
  fi
done < <(find "${ELECTRON_X64_APP}/Contents/Frameworks" -maxdepth 1 -name "Electron Helper*.app" -type d)

# Clean up the large Electron download
rm -rf "${ELECTRON_EXTRACT_DIR}" "${ELECTRON_ZIP}"
log "Electron x64 runtime replacement complete."

# =============================================================================
# SECTION 9: Extract native module versions from the app
# =============================================================================

log_section "6 — Extract Native Module Versions"

ASAR_FILE="${CODEX_APP}/Contents/Resources/app.asar"
ASAR_UNPACKED="${CODEX_APP}/Contents/Resources/app.asar.unpacked"

if [[ ! -f "${ASAR_FILE}" ]]; then
  die "app.asar not found at: ${ASAR_FILE}"
fi

# Extract the full asar to read metadata.
ASAR_EXTRACT_DIR="${WORK_DIR}/asar-extracted"
log "Extracting app.asar to ${ASAR_EXTRACT_DIR}..."
npx --yes @electron/asar extract "${ASAR_FILE}" "${ASAR_EXTRACT_DIR}"
log "Extraction complete."

# Read better-sqlite3 version
BETTER_SQLITE3_VERSION=""
BETTER_SQLITE3_PKG="${ASAR_EXTRACT_DIR}/node_modules/better-sqlite3/package.json"
if [[ -f "${BETTER_SQLITE3_PKG}" ]]; then
  BETTER_SQLITE3_VERSION="$(python3 -c "import json; d=json.load(open('${BETTER_SQLITE3_PKG}')); print(d['version'])")"
  log "better-sqlite3 version: ${BETTER_SQLITE3_VERSION}"
else
  warn "better-sqlite3 not found in extracted asar. It may be in app.asar.unpacked."
  # Try asar.unpacked
  BETTER_SQLITE3_PKG_UP="${ASAR_UNPACKED}/node_modules/better-sqlite3/package.json"
  if [[ -f "${BETTER_SQLITE3_PKG_UP}" ]]; then
    BETTER_SQLITE3_VERSION="$(python3 -c "import json; d=json.load(open('${BETTER_SQLITE3_PKG_UP}')); print(d['version'])")"
    log "better-sqlite3 version (from asar.unpacked): ${BETTER_SQLITE3_VERSION}"
  fi
fi

# Read node-pty version
NODE_PTY_VERSION=""
NODE_PTY_PKG="${ASAR_EXTRACT_DIR}/node_modules/node-pty/package.json"
if [[ -f "${NODE_PTY_PKG}" ]]; then
  NODE_PTY_VERSION="$(python3 -c "import json; d=json.load(open('${NODE_PTY_PKG}')); print(d['version'])")"
  log "node-pty version: ${NODE_PTY_VERSION}"
else
  warn "node-pty not found in extracted asar. It may be in app.asar.unpacked."
  NODE_PTY_PKG_UP="${ASAR_UNPACKED}/node_modules/node-pty/package.json"
  if [[ -f "${NODE_PTY_PKG_UP}" ]]; then
    NODE_PTY_VERSION="$(python3 -c "import json; d=json.load(open('${NODE_PTY_PKG_UP}')); print(d['version'])")"
    log "node-pty version (from asar.unpacked): ${NODE_PTY_VERSION}"
  fi
fi

if [[ -z "${BETTER_SQLITE3_VERSION}" && -z "${NODE_PTY_VERSION}" ]]; then
  die "Could not find either better-sqlite3 or node-pty in the app. Cannot rebuild native modules."
fi

log "Native modules to rebuild:"
log "  better-sqlite3: ${BETTER_SQLITE3_VERSION:-'NOT FOUND — will skip'}"
log "  node-pty:       ${NODE_PTY_VERSION:-'NOT FOUND — will skip'}"

# =============================================================================
# SECTION 10: Build x64 native modules
# =============================================================================

log_section "7 — Build x64 Native Modules"

# We use @electron/rebuild which handles electron ABI targeting cleanly.
# Install it locally in the temp build dir to avoid polluting global npm.

log "Setting up native rebuild project in: ${NATIVE_BUILD_DIR}"
cd "${NATIVE_BUILD_DIR}"

# Write a minimal package.json so npm is happy.
cat > package.json <<'PKGJSON'
{
  "name": "codex-native-rebuild",
  "version": "1.0.0",
  "private": true
}
PKGJSON

log "Installing @electron/rebuild locally..."
npm install --save-dev @electron/rebuild 2>&1 | tail -5

# Install better-sqlite3 at the pinned version (if found)
if [[ -n "${BETTER_SQLITE3_VERSION}" ]]; then
  log "Installing better-sqlite3@${BETTER_SQLITE3_VERSION}..."
  npm install "better-sqlite3@${BETTER_SQLITE3_VERSION}" 2>&1 | tail -5
fi

# Install node-pty at the pinned version (if found)
if [[ -n "${NODE_PTY_VERSION}" ]]; then
  log "Installing node-pty@${NODE_PTY_VERSION}..."
  npm install "node-pty@${NODE_PTY_VERSION}" 2>&1 | tail -5
fi

# Run electron-rebuild targeting x64 + the detected Electron version.
log "Running @electron/rebuild for x64, Electron ${ELECTRON_VERSION}..."
npx @electron/rebuild \
  --version "${ELECTRON_VERSION}" \
  --arch x64 \
  2>&1 | tail -20

log "Native module rebuild complete."
cd "${SCRIPT_DIR}"

# =============================================================================
# SECTION 11: Replace arm64 .node artifacts with x64 builds
# =============================================================================

log_section "8 — Replace Native .node Artifacts"

replace_native_module() {
  local module_name="$1"
  local built_node_file="$2"
  # Locate the .node file(s) in the app's asar.unpacked
  local target_dir="${ASAR_UNPACKED}/node_modules/${module_name}"

  if [[ ! -d "${target_dir}" ]]; then
    warn "Module directory not found in asar.unpacked: ${target_dir} — skipping replacement."
    return 0
  fi

  # Find all .node files in the module's build directory
  while IFS= read -r target_node; do
    log "Replacing: ${target_node}"
    log "  with:    ${built_node_file}"

    # Confirm the replacement is x86_64
    local file_output
    file_output="$(file "${built_node_file}")"
    if [[ "${file_output}" != *"x86_64"* ]]; then
      die "Built .node file is not x86_64: ${built_node_file} — file output: ${file_output}"
    fi

    cp "${built_node_file}" "${target_node}"
    log "  Replaced successfully."
  done < <(find "${target_dir}" -name "*.node" -type f)
}

# Replace better-sqlite3
if [[ -n "${BETTER_SQLITE3_VERSION}" ]]; then
  BUILT_SQLITE3="$(find "${NATIVE_BUILD_DIR}/node_modules/better-sqlite3" -name "*.node" -type f | head -1 || true)"
  if [[ -n "${BUILT_SQLITE3}" ]]; then
    replace_native_module "better-sqlite3" "${BUILT_SQLITE3}"
  else
    die "better-sqlite3 was installed but no .node file found in build dir. Rebuild may have failed."
  fi
fi

# Replace node-pty
if [[ -n "${NODE_PTY_VERSION}" ]]; then
  BUILT_NODE_PTY="$(find "${NATIVE_BUILD_DIR}/node_modules/node-pty" -name "*.node" -type f | head -1 || true)"
  if [[ -n "${BUILT_NODE_PTY}" ]]; then
    replace_native_module "node-pty" "${BUILT_NODE_PTY}"
  else
    die "node-pty was installed but no .node file found in build dir. Rebuild may have failed."
  fi
fi

# ---- Also replace spawn-helper for node-pty (arm64 helper binary) -----------
if [[ -n "${NODE_PTY_VERSION}" ]]; then
  log "Checking for node-pty spawn-helper..."
  TARGET_SPAWN_HELPER="$(find "${ASAR_UNPACKED}/node_modules/node-pty" -name "spawn-helper" -type f 2>/dev/null | head -1 || true)"
  if [[ -n "${TARGET_SPAWN_HELPER}" ]]; then
    # Find x64 spawn-helper from our rebuild (check prebuilds and build dirs)
    BUILT_SPAWN_HELPER="$(find "${NATIVE_BUILD_DIR}/node_modules/node-pty" -name "spawn-helper" -path "*darwin-x64*" -type f 2>/dev/null | head -1 || true)"
    if [[ -z "${BUILT_SPAWN_HELPER}" ]]; then
      BUILT_SPAWN_HELPER="$(find "${NATIVE_BUILD_DIR}/node_modules/node-pty" -name "spawn-helper" -type f 2>/dev/null | while read -r f; do
        if file "$f" | grep -q x86_64; then echo "$f"; break; fi
      done || true)"
    fi
    if [[ -n "${BUILT_SPAWN_HELPER}" ]]; then
      log "Replacing spawn-helper: ${TARGET_SPAWN_HELPER}"
      cp "${BUILT_SPAWN_HELPER}" "${TARGET_SPAWN_HELPER}"
      chmod +x "${TARGET_SPAWN_HELPER}"
      log "  spawn-helper replaced: $(file "${TARGET_SPAWN_HELPER}" | sed 's/.*: //')"
    else
      warn "Could not find x64 spawn-helper in rebuild dir. Terminal features may not work."
    fi
  fi
fi

# ---- Handle sparkle.node in Contents/Resources/native/ ---------------------
# This native addon lives OUTSIDE of asar.unpacked and loads via dlopen at
# runtime. If it's arm64-only, delete it — Sparkle auto-updates are disabled.
log "Checking for native sparkle.node outside asar..."
NATIVE_SPARKLE="${CODEX_APP}/Contents/Resources/native/sparkle.node"
if [[ -f "${NATIVE_SPARKLE}" ]]; then
  SPARKLE_ARCH="$(file "${NATIVE_SPARKLE}")"
  log "  Found: ${NATIVE_SPARKLE}"
  log "  Arch: ${SPARKLE_ARCH}"
  if [[ "${SPARKLE_ARCH}" == *"arm64"* ]] && [[ "${SPARKLE_ARCH}" != *"x86_64"* ]]; then
    log "  Removing arm64-only sparkle.node (auto-updates already disabled)."
    rm "${NATIVE_SPARKLE}"
  fi
fi

log "Native module replacement complete."

# =============================================================================
# SECTION 12: Replace bundled arm64 binaries
# =============================================================================

log_section "9 — Replace Bundled Binaries"

# ---- 12a: ripgrep (rg) -------------------------------------------------------
# Download the pinned x64 macOS release from GitHub.

log "Downloading ripgrep ${RG_VERSION} for x86_64..."
RG_TARBALL="${DOWNLOADS_DIR}/ripgrep-${RG_VERSION}-x86_64.tar.gz"

curl -fsSL "${RG_DOWNLOAD_URL}" -o "${RG_TARBALL}"
log "Download complete: ${RG_TARBALL}"

# Verify SHA256 if we have an expected value.
if [[ -n "${RG_SHA256_EXPECTED}" ]]; then
  log "Verifying ripgrep SHA256..."
  ACTUAL_SHA="$(shasum -a 256 "${RG_TARBALL}" | awk '{print $1}')"
  if [[ "${ACTUAL_SHA}" != "${RG_SHA256_EXPECTED}" ]]; then
    die "ripgrep tarball SHA256 mismatch! Expected: ${RG_SHA256_EXPECTED} Got: ${ACTUAL_SHA}"
  fi
  log "SHA256 verified."
fi

log "Extracting ripgrep..."
RG_EXTRACT_DIR="${DOWNLOADS_DIR}/ripgrep-extracted"
mkdir -p "${RG_EXTRACT_DIR}"
tar -xzf "${RG_TARBALL}" -C "${RG_EXTRACT_DIR}"
BUILT_RG="$(find "${RG_EXTRACT_DIR}" -name "rg" -type f | head -1 || true)"
if [[ -z "${BUILT_RG}" ]]; then
  die "Could not find 'rg' binary in extracted ripgrep tarball."
fi
log "Extracted rg binary: ${BUILT_RG}"

# Confirm it's x86_64
file_output="$(file "${BUILT_RG}")"
if [[ "${file_output}" != *"x86_64"* ]]; then
  die "Downloaded rg binary is not x86_64: ${file_output}"
fi
log "Confirmed: rg is x86_64."

# Locate and replace the rg binary in the app.
TARGET_RG="$(find "${CODEX_APP}" -name "rg" -type f | head -1 || true)"
if [[ -z "${TARGET_RG}" ]]; then
  warn "Could not find 'rg' binary inside Codex.app. It may not be bundled, or may have a different name."
  warn "Skipping rg replacement."
else
  log "Replacing: ${TARGET_RG}"
  cp "${BUILT_RG}" "${TARGET_RG}"
  chmod +x "${TARGET_RG}"
  log "rg replaced successfully."
fi

# ---- 12b: codex CLI binary ---------------------------------------------------
# The @openai/codex npm package uses platform-specific optional dependencies.
# The x64 macOS native binary is published as a versioned dist-tag:
#   npm:@openai/codex@<version>-darwin-x64
# It contains the real Mach-O x86_64 binary at:
#   vendor/x86_64-apple-darwin/codex/codex

log "Looking for bundled 'codex' CLI binary..."

# Search for an executable named 'codex' (not the .app itself)
CODEX_CLI_BINARY="$(find "${CODEX_APP}/Contents/Resources" -type f -name "codex" ! -name "*.app" | head -1 || true)"
if [[ -z "${CODEX_CLI_BINARY}" ]]; then
  # Broaden search to all of Contents
  CODEX_CLI_BINARY="$(find "${CODEX_APP}/Contents" -type f -name "codex" ! -path "*/MacOS/Codex" | head -1 || true)"
fi

if [[ -z "${CODEX_CLI_BINARY}" ]]; then
  log "No bundled 'codex' CLI binary found. Skipping."
else
  CODEX_CLI_FILETYPE="$(file "${CODEX_CLI_BINARY}")"
  log "Found codex CLI binary: ${CODEX_CLI_BINARY}"
  log "  file output: ${CODEX_CLI_FILETYPE}"

  if [[ "${CODEX_CLI_FILETYPE}" == *"x86_64"* ]]; then
    log "  codex CLI is already x86_64. No replacement needed."
  elif [[ "${CODEX_CLI_FILETYPE}" == *"arm64"* ]]; then
    log "  codex CLI is arm64. Fetching x64 native binary from npm platform package..."

    CODEX_CLI_BUILD_DIR="${WORK_DIR}/codex-cli-build"
    mkdir -p "${CODEX_CLI_BUILD_DIR}"
    cd "${CODEX_CLI_BUILD_DIR}"
    cat > package.json <<'CPKGJSON'
{"name":"codex-cli-fetch","version":"1.0.0","private":true}
CPKGJSON

    # Detect the version of the bundled codex CLI from nearby metadata.
    CODEX_CLI_VERSION=""
    CODEX_CLI_PKG="$(find "$(dirname "${CODEX_CLI_BINARY}")" -name "package.json" -maxdepth 2 | head -1 || true)"
    if [[ -n "${CODEX_CLI_PKG}" ]]; then
      CODEX_CLI_VERSION="$(python3 -c "import json; d=json.load(open('${CODEX_CLI_PKG}')); print(d.get('version',''))" 2>/dev/null || true)"
      log "  Detected codex CLI version: ${CODEX_CLI_VERSION}"
    fi
    if [[ -z "${CODEX_CLI_VERSION}" ]]; then
      CODEX_CLI_VERSION="$(npm view @openai/codex version 2>/dev/null || true)"
      log "  Using latest @openai/codex version from npm: ${CODEX_CLI_VERSION}"
    fi

    # Install the platform-specific package: @openai/codex@<version>-darwin-x64
    CODEX_X64_SPEC="@openai/codex@${CODEX_CLI_VERSION}-darwin-x64"
    log "  Installing ${CODEX_X64_SPEC}..."
    if npm install "${CODEX_X64_SPEC}" 2>&1 | tail -5; then
      NEW_CODEX_CLI="$(find "${CODEX_CLI_BUILD_DIR}/node_modules/@openai/codex" -path "*/x86_64-apple-darwin/codex/codex" -type f | head -1 || true)"
      if [[ -z "${NEW_CODEX_CLI}" ]]; then
        NEW_CODEX_CLI="$(find "${CODEX_CLI_BUILD_DIR}/node_modules/@openai/codex" -name "codex" -type f | while read -r f; do
          if file "$f" | grep -q x86_64; then echo "$f"; break; fi
        done || true)"
      fi

      if [[ -n "${NEW_CODEX_CLI}" ]] && file "${NEW_CODEX_CLI}" | grep -q x86_64; then
        cp "${NEW_CODEX_CLI}" "${CODEX_CLI_BINARY}"
        chmod +x "${CODEX_CLI_BINARY}"
        log "  codex CLI replaced with x64 native binary: $(file "${CODEX_CLI_BINARY}" | sed 's/.*: //')"
      else
        die "Could not find x86_64 codex binary in ${CODEX_X64_SPEC}."$'\n'"Manual intervention required: place an x86_64 codex binary at:"$'\n'"  ${CODEX_CLI_BINARY}"
      fi
    else
      die "Failed to install ${CODEX_X64_SPEC}."$'\n'"Manual intervention required: place an x86_64 codex binary at:"$'\n'"  ${CODEX_CLI_BINARY}"
    fi

    cd "${SCRIPT_DIR}"
  else
    log "  codex CLI does not appear to be a native binary (may be a script): ${CODEX_CLI_FILETYPE}"
    log "  Skipping replacement."
  fi
fi

log "Binary replacement complete."

# =============================================================================
# SECTION 13: Handle Sparkle auto-update addon
# =============================================================================

log_section "10 — Handle Sparkle Auto-Update Addon"

# Decision rationale (logged for auditability):
# Sparkle's native addon (sparkle.node or similar) is arm64-only in the ARM
# build. Rebuilding Sparkle is complex and the auto-update feature is not
# critical for a manually-converted local build. The safest approach is to
# delete the .node file so the require() call fails at the module level, then
# patch the require to catch the error gracefully. However, patching inside
# the asar means we need to repack. Instead, we delete the .node file and
# stub it with a no-op module. This prevents crashes while disabling updates.
# The asar will be repacked after this step.

log "Searching for Sparkle native addon (.node file)..."
SPARKLE_NODE="$(find "${ASAR_UNPACKED}" -name "*.node" | xargs -I{} sh -c 'file "{}" | grep -li sparkle' 2>/dev/null | head -1 || true)"

if [[ -z "${SPARKLE_NODE}" ]]; then
  # Try by name pattern
  SPARKLE_NODE="$(find "${ASAR_UNPACKED}" \( -name "sparkle.node" -o -name "Sparkle.node" -o -name "*sparkle*.node" \) -type f | head -1 || true)"
fi

if [[ -z "${SPARKLE_NODE}" ]]; then
  # Check inside asar.unpacked for any node_modules related to sparkle
  SPARKLE_NODE="$(find "${ASAR_UNPACKED}" -path "*/sparkle*/*.node" -type f | head -1 || true)"
fi

if [[ -n "${SPARKLE_NODE}" ]]; then
  SPARKLE_FILETYPE="$(file "${SPARKLE_NODE}")"
  log "Found Sparkle .node: ${SPARKLE_NODE}"
  log "  file: ${SPARKLE_FILETYPE}"

  if [[ "${SPARKLE_FILETYPE}" == *"arm64"* ]]; then
    log "  Sparkle .node is arm64-only."
    log "  Action: Replacing with a stub no-op native addon to prevent crashes."
    log "  Effect: Codex auto-updates via Sparkle will be disabled."

    # Remove the arm64 .node file
    rm "${SPARKLE_NODE}"

    # Write a minimal stub JavaScript file in its place.
    # Node's module loader will accept a .node path; if we replace the binary
    # with a JS file named .node it will fail. So we instead locate where
    # the module is required and patch the JS to guard the require.
    # Simpler approach: write a zero-byte placeholder and let the error be caught.
    # Even simpler and safer: find the JS file that does require('sparkle') or
    # similar and wrap it in a try/catch via the asar repack.
    # We'll take the most surgical approach: stub the .node path with a
    # minimal native addon compiled on-the-fly, OR just leave it absent and
    # patch the JS require site.

    # Find the JS file that requires this module in the extracted asar
    SPARKLE_REQUIRE_SITE="$(grep -rl "sparkle" "${ASAR_EXTRACT_DIR}" --include="*.js" | head -1 || true)"
    if [[ -n "${SPARKLE_REQUIRE_SITE}" ]]; then
      log "  Patching require site: ${SPARKLE_REQUIRE_SITE}"
      # Wrap any require call involving sparkle in a try/catch
      python3 - "${SPARKLE_REQUIRE_SITE}" <<'PYEOF'
import sys, re
path = sys.argv[1]
with open(path, 'r', encoding='utf-8', errors='replace') as f:
    content = f.read()
# Wrap require lines that reference sparkle in a try/catch
# Pattern: require(...sparkle...) possibly assigned to a variable
patched = re.sub(
    r'((?:const|let|var)\s+\w+\s*=\s*)?require\([^)]*[Ss]parkle[^)]*\)',
    r'(function(){try{return \g<0>}catch(e){return {}}})()',
    content
)
if patched != content:
    with open(path, 'w', encoding='utf-8') as f:
        f.write(patched)
    print("  Patched.")
else:
    print("  No sparkle require found — file may use dynamic import.")
PYEOF
    else
      log "  Could not find Sparkle require site in extracted asar. The deleted .node file"
      log "  may cause a non-fatal require error at runtime (should be caught by Electron)."
    fi
  else
    log "  Sparkle .node is not arm64-only (may already be universal or x64). Leaving as-is."
  fi
else
  log "No Sparkle .node addon found. Nothing to do."
fi

# =============================================================================
# SECTION 14: Repack app.asar
# =============================================================================

log_section "11 — Replace .node Files Inside Extracted Asar and Repack"

# The extracted asar contains its own copies of native .node files (separate
# from asar.unpacked). Electron extracts these to temp dirs before dlopen'ing.
# We must replace them with x64 versions before repacking.
log "Replacing arm64 .node files inside extracted asar content..."
while IFS= read -r asar_node_file; do
  ASAR_NODE_FILETYPE="$(file "${asar_node_file}")"
  if [[ "${ASAR_NODE_FILETYPE}" == *"arm64"* ]]; then
    # Derive the relative path to find the matching x64 version in asar.unpacked
    REL_PATH="${asar_node_file#${ASAR_EXTRACT_DIR}/}"
    UNPACKED_MATCH="${ASAR_UNPACKED}/${REL_PATH}"
    if [[ -f "${UNPACKED_MATCH}" ]]; then
      UNPACKED_ARCH="$(file "${UNPACKED_MATCH}")"
      if [[ "${UNPACKED_ARCH}" == *"x86_64"* ]]; then
        log "  Replacing (from asar.unpacked): ${REL_PATH}"
        cp "${UNPACKED_MATCH}" "${asar_node_file}"
      else
        warn "  asar.unpacked version also not x64: ${REL_PATH}"
      fi
    else
      # Try to find matching .node in the native rebuild dir
      NODE_BASENAME="$(basename "${asar_node_file}")"
      REBUILD_MATCH="$(find "${NATIVE_BUILD_DIR}/node_modules" -name "${NODE_BASENAME}" -type f 2>/dev/null | while read -r f; do
        if file "$f" | grep -q x86_64; then echo "$f"; break; fi
      done || true)"
      if [[ -n "${REBUILD_MATCH}" ]]; then
        log "  Replacing (from rebuild): ${REL_PATH}"
        cp "${REBUILD_MATCH}" "${asar_node_file}"
      else
        warn "  No x64 replacement found for: ${REL_PATH}"
      fi
    fi
  fi
done < <(find "${ASAR_EXTRACT_DIR}" -name "*.node" -type f)

log "Repacking modified app content into app.asar..."
# Back up original asar
cp "${ASAR_FILE}" "${ASAR_FILE}.arm64.bak"
log "Original asar backed up to: ${ASAR_FILE}.arm64.bak"

npx --yes @electron/asar pack "${ASAR_EXTRACT_DIR}" "${ASAR_FILE}"
log "app.asar repacked successfully."

# Clean up extracted asar (it's large and no longer needed)
rm -rf "${ASAR_EXTRACT_DIR}"

# =============================================================================
# SECTION 15: Validate all replaced binaries are x86_64
# =============================================================================

log_section "12 — Validate Binary Architectures"

VALIDATION_ERRORS=0

validate_binary() {
  local path="$1"
  local label="$2"
  if [[ ! -f "${path}" ]]; then
    log "  [SKIP] ${label}: file not found at ${path}"
    return 0
  fi
  local output
  output="$(file "${path}")"
  if [[ "${output}" == *"x86_64"* ]]; then
    log "  [PASS] ${label}: x86_64 confirmed"
  elif [[ "${output}" == *"arm64"* ]]; then
    log "  [FAIL] ${label}: still arm64! Path: ${path}"
    log "         file: ${output}"
    ((VALIDATION_ERRORS++)) || true
  else
    log "  [INFO] ${label}: not a native binary — ${output}"
  fi
}

log "Validating .node files in asar.unpacked..."
while IFS= read -r node_file; do
  validate_binary "${node_file}" "$(basename "$(dirname "${node_file}")")/$(basename "${node_file}")"
done < <(find "${ASAR_UNPACKED}" -name "*.node" -type f)

log "Validating bundled executables..."
if [[ -n "${TARGET_RG:-}" ]] && [[ -f "${TARGET_RG}" ]]; then
  validate_binary "${TARGET_RG}" "rg (ripgrep)"
fi
if [[ -n "${CODEX_CLI_BINARY:-}" ]] && [[ -f "${CODEX_CLI_BINARY}" ]]; then
  validate_binary "${CODEX_CLI_BINARY}" "codex CLI"
fi

# Also validate the main Codex executable
CODEX_MAIN_EXE="${CODEX_APP}/Contents/MacOS/Codex"
if [[ -f "${CODEX_MAIN_EXE}" ]]; then
  validate_binary "${CODEX_MAIN_EXE}" "Codex main executable"
fi

if [[ "${VALIDATION_ERRORS}" -gt 0 ]]; then
  die "${VALIDATION_ERRORS} binary/binaries failed x86_64 validation. See log above."
fi
log "All validated binaries are x86_64."

# =============================================================================
# SECTION 16: Ad-hoc codesign
# =============================================================================

log_section "13 — Ad-hoc Codesign"

# Ad-hoc signing (identity: -) is required so that macOS will load the app
# at all. Note: this is NOT Developer ID signing — Gatekeeper will still
# flag the app. Users must run: xattr -cr /Applications/Codex.app
log "Codesigning Codex.app (ad-hoc, deep)..."
codesign --force --deep --sign - "${CODEX_APP}" 2>&1 || {
  warn "codesign returned a non-zero exit code. This is sometimes a warning, not a fatal error."
  warn "The app may still work. Proceeding."
}
log "Codesign complete."

# =============================================================================
# SECTION 17: Package final DMG
# =============================================================================

log_section "14 — Package Output DMG"

# Remove any existing output DMG to avoid hdiutil refusal to overwrite.
if [[ -f "${OUTPUT_DMG}" ]]; then
  log "Removing existing output DMG: ${OUTPUT_DMG}"
  rm "${OUTPUT_DMG}"
fi

log "Creating DMG: ${OUTPUT_DMG}"
hdiutil create \
  -volname "CodexAppMacIntel" \
  -srcfolder "${CODEX_APP}" \
  -ov \
  -format UDZO \
  "${OUTPUT_DMG}"

log "DMG created: ${OUTPUT_DMG}"

# =============================================================================
# SECTION 18: Emit SHA256 and final report
# =============================================================================

log_section "15 — Final Report"

OUTPUT_SHA256="$(shasum -a 256 "${OUTPUT_DMG}" | awk '{print $1}')"

echo ""
echo "============================================================"
echo "  BUILD SUCCESSFUL"
echo "============================================================"
echo ""
echo "  Output DMG : ${OUTPUT_DMG}"
echo "  SHA256     : ${OUTPUT_SHA256}"
echo "  Build log  : ${BUILD_LOG}"
echo ""
echo "  Next steps:"
echo "    1. Mount:        hdiutil attach '${OUTPUT_DMG}'"
echo "    2. Install:      cp -R /Volumes/CodexAppMacIntel/Codex.app /Applications/"
echo "    3. Quarantine:   xattr -cr /Applications/Codex.app"
echo "    4. Launch:       open /Applications/Codex.app"
echo ""
echo "  NOTE: Gatekeeper will flag this app (ad-hoc signed only)."
echo "        The xattr -cr step above is required to bypass the quarantine."
echo "        Auto-updates via Sparkle are disabled."
echo ""