rt-tray: fix the bundle seal, prune node, and make bundled apps mattstack-managed - #37

#!/bin/bash
set -euo pipefail

# Inspect local Deck command handling for duplicate adds and record updates.
rg -n -C 5 --glob '*.{ts,tsx,js,mjs}' \
  'name taken|--managed-by|--cmd|--dir|api/v1/apps|function.*adopt|function.*add' .

# Inspect the current registration flow and duplicate-registration coverage.
sed -n '116,143p' lib/setup/steps/deck.ts
sed -n '470,500p' lib/setup/__tests__/steps-b.test.ts

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Deck-related files ---'
git ls-files | rg -i '(^|/)(deck|.*deck.*|.*setup.*test.*)$' | head -80

printf '%s\n' '--- Deck symbols and API references ---'
rg -n -C 4 --glob '*.{ts,tsx,js,mjs,json,md}' \
  'registerManagedApp|repointBoard|/api/v1/apps|deck add|deck adopt|managedBy|workingDirectory|command' \
  lib README.md package.json 2>/dev/null | head -500

printf '%s\n' '--- setup step and test seams ---'
sed -n '1,180p' lib/setup/steps/deck.ts
sed -n '330,560p' lib/setup/__tests__/steps-b.test.ts

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- repository remotes ---'
git remote -v

printf '%s\n' '--- exact Deck references ---'
rg -n -C 3 --glob '*.{ts,tsx,js,mjs,json,md,yml,yaml}' \
  'deck|MAT-384|MANAGER_DISPLAY|managedBy|workingDirectory' . | head -300

printf '%s\n' '--- dependency and bundled-tool contracts ---'
sed -n '1,90p' lib/deps/resolve.ts
rg -n -C 4 --glob '*.{ts,tsx,js,mjs}' \
  'bundledToolPath|HELPERS_DIR|deck' lib/setup lib/deps commands package.json

#!/bin/bash
set -euo pipefail

# Query likely GitHub repositories without cloning or executing repository code.
for repo in m4ttstack/deck m4ttstack/Deck m4ttstack/mattstack m4ttstack/rt; do
  printf '\n--- %s ---\n' "$repo"
  curl -L --fail --silent --show-error \
    -H 'Accept: application/vnd.github+json' \
    "https://api.github.com/repos/$repo" |
    jq -r '[.full_name, .default_branch, .html_url, .message] | `@tsv`' 2>/dev/null || true
done

#!/bin/bash
set -euo pipefail

tree="$(curl -L --fail --silent --show-error \
  -H 'Accept: application/vnd.github+json' \
  'https://api.github.com/repos/m4ttstack/deck/git/trees/main?recursive=1')"

printf '%s\n' '--- candidate files ---'
printf '%s' "$tree" | jq -r '.tree[] | select(.type=="blob") | .path' |
  rg -i '(^|/)(src|lib|commands|.*test.*|.*spec.*)/|package.json|README|api|app|registry' |
  head -250

printf '%s\n' '--- command-related paths ---'
printf '%s' "$tree" | jq -r '.tree[] | select(.type=="blob") | .path' |
  rg -i 'add|adopt|app|registry|command|route|test|spec' | head -250

#!/bin/bash
set -euo pipefail
base='https://raw.githubusercontent.com/m4ttstack/deck/main'

for path in src/cli/commands.ts src/api/register.ts src/api/register.test.ts src/registry/records.ts src/registry/records.test.ts src/api/server.ts src/api/server.test.ts; do
  printf '\n--- %s ---\n' "$path"
  curl -L --fail --silent --show-error "$base/$path" |
    nl -ba |
    rg -n -C 8 \
      'add|adopt|managedBy|name taken|workingDirectory|command|PATCH|register|update|existing|409' |
    head -260
done

#!/bin/bash
set -euo pipefail
base='https://raw.githubusercontent.com/m4ttstack/deck/main'

for path in src/cli/commands.ts src/api/register.ts src/api/register.test.ts src/registry/records.ts src/registry/records.test.ts src/api/server.ts src/api/server.test.ts; do
  printf '\n--- %s ---\n' "$path"
  tmp="$(mktemp)"
  curl -L --fail --silent --show-error "$base/$path" > "$tmp"
  grep -n -C 8 -E \
    'add|adopt|managedBy|name taken|workingDirectory|command|PATCH|register|update|existing|409' \
    "$tmp" | head -260 || true
  rm -f "$tmp"
done

#!/bin/bash
set -euo pipefail
base='https://raw.githubusercontent.com/m4ttstack/deck/main'

tmp="$(mktemp)"
curl -L --fail --silent --show-error "$base/src/api/register.ts" > "$tmp"
printf '%s\n' '--- adoptApp and editApp implementation ---'
grep -n -A95 -B12 -E 'export async function adoptApp|export async function editApp' "$tmp" | head -260
rm -f "$tmp"

tmp="$(mktemp)"
curl -L --fail --silent --show-error "$base/src/api/register.test.ts" > "$tmp"
printf '%s\n' '--- adoption and edit tests ---'
grep -n -A45 -B10 -E 'adopt|edit.*command|workingDirectory|managedBy' "$tmp" | head -300
rm -f "$tmp"

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- bundled gitq entry point and server verb ---'
rg -n -C 8 --glob '*.{ts,tsx,js,mjs}' \
  'gitq board|server verb|usage|serve|process\.exit' \
  . | head -180

printf '%s\n' '--- focused Deck behavior probe ---'
python3 - <<'PY'
import urllib.request

base = "https://raw.githubusercontent.com/m4ttstack/deck/main/"
register = urllib.request.urlopen(base + "src/api/register.ts").read().decode()

taken = 'if (taken) return { status: 409, body: { error: "name taken", name } };'
adopt_write = 'putRecord({ ...current, managedBy });'
assert taken in register, "duplicate registration does not show the expected 409 guard"
assert adopt_write in register, "adoption does not show the managedBy-only write"

taken_at = register.index(taken)
write_at = register.index(adopt_write)
assert taken_at < write_at, "duplicate guard is not before the adoption write"

window = register[write_at - 120:write_at + len(adopt_write) + 120]
assert "command" not in window and "workingDirectory" not in window, \
    "adoption write unexpectedly includes command or workingDirectory"

print("duplicate add: 409 before record write")
print("adopt update: managedBy only; command and workingDirectory preserved")
PY

#!/bin/bash
set -euo pipefail

# Demonstrate that `|| true` masks a failed pipeline.
set -o pipefail
false | cat | grep -v 'replacing existing signature' || true
test "$?" -eq 0

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- target lines ---'
sed -n '330,410p' rt-tray/build.sh

printf '%s\n' '--- shell settings and signing references ---'
rg -n -C 4 'set -|pipefail|codesign|SIGN_FLAGS|signed|helper' rt-tray/build.sh

printf '%s\n' '--- executable context ---'
sed -n '1,40p' rt-tray/build.sh

#!/bin/bash
set -u

# Reproduce xargs' failure status and the reviewed pipeline's status.
set -o pipefail
set +e
printf 'helper-file\0' |
  xargs -0 -P 8 sh -c 'printf "codesign failed\n" >&2; exit 1' _ 2>&1 |
  grep -v 'replacing existing signature'
pipeline_status=$?
pipeline_parts=("${PIPESTATUS[@]}")
set -e
printf 'pipeline_status=%s pipe_statuses=%s\n' \
  "$pipeline_status" "${pipeline_parts[*]}"

# Show that the trailing `|| true` changes the compound command status.
set +e
set -o pipefail
printf 'helper-file\0' |
  xargs -0 -P 8 sh -c 'exit 1' _ 2>&1 |
  grep -v 'replacing existing signature' || true
masked_status=$?
set -e
printf 'masked_status=%s\n' "$masked_status"

# Confirm the relevant source conditions without executing the repository script.
printf '%s\n' '--- source assertions ---'
grep -nF 'set -euo pipefail' rt-tray/build.sh
grep -nF 'find "$root" -type f -print0 | xargs -0 -P 8 codesign "${SIGN_FLAGS[@]}"' rt-tray/build.sh
grep -nF 'echo "  ✓ Signed Helpers/$(basename "$path") ($ent, $SIGNED_FILE_COUNT files)"' rt-tray/build.sh