Merge remote-tracking branch 'origin/main' into dependabot/cargo/src/code-validator/guest/napi-3.9.0

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>

# Conflicts:
#	.gitignore
#	.prettierignore
#	src/code-validator/guest/Cargo.lock
#	src/code-validator/guest/host/build.rs

Author: simongdavies

.gitignore

@@ -55,6 +55,6 @@ plugins/host-modules.d.ts
 output-hyperagent-*/
 scripts/bash-bundle/_tmp_bundle.js
 
-# Generated NAPI binding loader + type declarations (emitted by `napi build`)
+# Generated NAPI bindings (emitted by `napi build`)
 src/code-validator/guest/host/index.d.ts
 src/code-validator/guest/host/index.js

.prettierignore

@@ -1,6 +1,4 @@
-# Generated NAPI binding loader + type declarations (emitted by `napi build`).
-# napi-derive >= 3 writes JSDoc into the .d.ts and emits a loader .js, neither of
-# which is Prettier-formatted. The canonical, hand-written loader/types live in
-# src/code-validator/guest/index.js and src/code-validator/guest/index.d.ts.
+# Generated NAPI binding type declarations (emitted by `napi build`).
+# napi-derive >= 3 writes JSDoc into this file, which is not Prettier-formatted.
+# The canonical, hand-written types live in src/code-validator/guest/index.d.ts.
 src/code-validator/guest/host/index.d.ts
-src/code-validator/guest/host/index.js

src/code-validator/guest/Cargo.lock

@@ -166,30 +166,38 @@ fn bundle_runtime() {
     let runtime_resource = build_runtime();
     let runtime_bytes = fs::read(&runtime_resource).expect("Failed to read runtime binary");
 
-    // Compute SHA256 hash
+    assert!(
+        !runtime_bytes.is_empty(),
+        "analysis runtime binary is empty: {runtime_resource:?}"
+    );
+
+    let out_dir = env::var_os("OUT_DIR").unwrap();
+
+    // Snapshot the runtime binary into this crate's OUT_DIR and embed THAT copy.
+    //
+    // The hash below is computed from `runtime_bytes`, while the embedded bytes
+    // come from `include_bytes!` evaluated when this crate is compiled — two
+    // reads at different times. The build path of `runtime_resource` lives in a
+    // shared target directory that other cargo invocations (clippy, the napi
+    // typedef pass, repeated `just build`/`just test` runs) can rebuild, and the
+    // guest binary is not bit-for-bit reproducible. If that file changed between
+    // hashing and the `include_bytes!` compile, the embedded bytes would no
+    // longer match the stored hash and the runtime integrity check would fail.
+    //
+    // Writing a private snapshot into OUT_DIR — which nothing else ever touches —
+    // and pointing `include_bytes!` at it guarantees the embedded bytes are
+    // exactly the bytes we hashed, as a single atomic pair.
+    let embedded_path = Path::new(&out_dir).join("analysis-runtime.bin");
+    fs::write(&embedded_path, &runtime_bytes).expect("Failed to write runtime snapshot");
+
+    // Compute SHA256 hash of the same in-memory buffer we just embedded.
     use sha2::{Digest, Sha256};
     let mut hasher = Sha256::new();
     hasher.update(&runtime_bytes);
     let hash = hasher.finalize();
     let hash_hex = hex::encode(hash);
 
-    let out_dir = env::var_os("OUT_DIR").unwrap();
-    let out_dir = Path::new(&out_dir);
-
-    // Stage the runtime binary into OUT_DIR and embed that copy rather than the
-    // live build-target binary. `include_bytes!` is expanded by rustc when the
-    // host crate is compiled, which happens after this build script runs. If we
-    // pointed `include_bytes!` at the mutable target-dir binary, a later rebuild
-    // of the runtime (e.g. by clippy or a subsequent `cargo build` that does not
-    // re-trigger this script) could change those bytes while the recorded
-    // ANALYSIS_RUNTIME_SHA256 stays stale, producing a `.node` whose embedded
-    // bytes and integrity hash disagree. The OUT_DIR copy is written here, in
-    // lock-step with the hash, and is only ever touched by this build script, so
-    // the embedded bytes and hash can never desync.
-    let embedded_path = out_dir.join("analysis-runtime.bin");
-    fs::write(&embedded_path, &runtime_bytes).expect("Failed to stage runtime binary in OUT_DIR");
-
-    let dest_path = out_dir.join("host_resource.rs");
+    let dest_path = Path::new(&out_dir).join("host_resource.rs");
     let contents = format!(
         r#"pub(crate) static ANALYSIS_RUNTIME: &[u8] = include_bytes!({embedded_path:?});
 pub(crate) const ANALYSIS_RUNTIME_SHA256: &str = "{hash_hex}";"#