fix(release): check notices against actual distributed components

scripts/rust/README.md

@@ -42,6 +42,8 @@ node scripts/rust/notices.mjs check
 
 Review the generated inventory and license texts. [notices-sources.json](notices-sources.json) records reviewed upstream exceptions. Release assembly also includes notices from the actual V8 build and Rust standard library. The TSV inventory does not replace full license texts.
 
+`notices.json` records reviewed component identities, sources and license-data digests. `notices check` resolves the Rust dependency closure and builds a temporary product bundle to identify embedded JavaScript packages; it does not download license texts. First-party source edits alone do not invalidate coverage, while importing an unreviewed package already present in the lockfile does. Native packaging checks its target's components and the actual Cargo-produced bundle inputs before packing, reusing that build instead of bundling again. The reviewed catalog may cover additional platforms.
+
 For offline comparisons of the production Rust and TypeScript Hosts on Linux,
 use [host-comparison](host-comparison/README.md). It drives real public clients
 against a loopback SSE fixture, verifies canonical output, and retains per-process

scripts/rust/README.zh-CN.md

@@ -42,6 +42,8 @@ node scripts/rust/notices.mjs check
 
 检查生成的清单和许可证文本。[notices-sources.json](notices-sources.json)记录已审查的上游例外。发布组装还包含实际 V8 构建与 Rust 标准库的 notices。TSV 清单不能替代完整许可证文本。
 
+`notices.json` 记录已审核的组件身份、来源和许可证资料摘要。`notices check` 解析 Rust 依赖闭包，并构建临时产品 bundle 来识别内嵌 JavaScript 包；不会下载许可证文本。仅修改第一方业务源码不会使覆盖检查失效，但从已有 lockfile 中新引入未审核的包会被拒绝。原生打包在构建后、打包前核对当前目标的组件及 Cargo 实际生成的 bundle 输入，复用本次构建而不再次打包 JavaScript。审核清单可以覆盖额外平台。
+
 终端行为使用 [terminal-shell 测试](../../products/maka/terminal-shell/tests/real_host/mod.rs)。通过 `cargo nextest run -p maka-cli --test integration -E 'test(terminal::)'` 运行当前组件和产品交互检查。渲染性能另用固定终端协议、视口和负载的 release 产物比较。
 
 长历史性能使用保留的 [Engine 夹具](../../plugins/agent/engine/tests/integration/long_task_perf.rs)。构建 release 测试程序，比较相同夹具源码和依赖 feature：

scripts/rust/build-cli.mjs

@@ -97,9 +97,12 @@ export async function compileCli({
       }
     : env;
   const result = await cargoBuild(args, { cwd: repositoryRoot, env: buildEnv });
-  const binary = result.executables.get('maka');
+  const artifact = result.executables.get('maka');
+  const binary = artifact?.path;
   if (result.code === 0 && !result.signal && !binary)
     throw new Error('Cargo did not report the Maka executable');
+  if (result.code === 0 && !result.signal && !artifact.outDir)
+    throw new Error('Cargo did not report the Maka build output directory');
   if (result.code === 0 && !result.signal && desktop && triple.includes('-apple-darwin')) {
     const directory = dirname(binary);
     await stageDesktopBundle(
@@ -108,13 +111,18 @@ export async function compileCli({
       join(directory, 'Maka.app'),
     );
   }
-  return { code: result.code, signal: result.signal, binary };
+  return {
+    code: result.code,
+    signal: result.signal,
+    binary,
+    bundleInputs: artifact?.outDir && join(artifact.outDir, 'product', 'bundle-inputs.json'),
+  };
 }
 
 export async function buildCli(options = {}) {
-  const { code, signal, binary } = await compileCli(options);
+  const { code, signal, binary, bundleInputs } = await compileCli(options);
   if (code !== 0 || signal) throw new Error(`Maka build failed: ${signal ?? code}`);
-  return binary;
+  return { binary, bundleInputs };
 }
 
 /**
@@ -232,5 +240,5 @@ if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1]
       timings: { type: 'boolean' },
     },
   });
-  console.log(await buildCli(values));
+  console.log((await buildCli(values)).binary);
 }

scripts/rust/build-cli.test.mjs

@@ -74,14 +74,30 @@ test('CLI builds use the requested target and artifact path', async (t) => {
     const child = new EventEmitter();
     child.stdout = new PassThrough();
     queueMicrotask(() => {
-      if (exitCode === 0)
+      if (exitCode === 0) {
+        child.stdout.write(
+          JSON.stringify({
+            reason: 'build-script-executed',
+            package_id: 'cli-source',
+            out_dir: join(dirname(executable), 'build/cli-source/out'),
+          }) + '\n',
+        );
+        child.stdout.write(
+          JSON.stringify({
+            reason: 'build-script-executed',
+            package_id: 'other-package',
+            out_dir: join(root, 'unrelated-output'),
+          }) + '\n',
+        );
         child.stdout.write(
           JSON.stringify({
             reason: 'compiler-artifact',
+            package_id: 'cli-source',
             target: { name: 'maka', kind: ['bin'] },
             executable,
           }) + '\n',
         );
+      }
       child.stdout.end();
       child.emit('exit', exitCode, null);
     });
@@ -109,7 +125,22 @@ test('CLI builds use the requested target and artifact path', async (t) => {
     await mkdir(binaryDirectory, { recursive: true });
     await writeFile(join(binaryDirectory, 'maka-desktop-shell'), 'shell bytes');
     executable = join(binaryDirectory, triple.includes('-windows-') ? 'maka.exe' : 'maka');
-    const output = await buildCli({ release: true, target, timings: true, repositoryRoot: root });
+    const inputManifest = join(binaryDirectory, 'build/cli-source/out/product/bundle-inputs.json');
+    await mkdir(dirname(inputManifest), { recursive: true });
+    await writeFile(inputManifest, JSON.stringify(['actual-input-for-' + triple]));
+    const { binary: output, bundleInputs } = await buildCli({
+      release: true,
+      target,
+      timings: true,
+      repositoryRoot: root,
+    });
+    assert.equal(
+      bundleInputs,
+      join(binaryDirectory, 'build/cli-source/out/product/bundle-inputs.json'),
+    );
+    assert.deepEqual(JSON.parse(await readFile(bundleInputs, 'utf8')), [
+      'actual-input-for-' + triple,
+    ]);
     // The workbench is compiled into the shell: nothing is staged beside it.
     await assert.rejects(lstat(join(dirname(output), 'app')), { code: 'ENOENT' });
     if (macos) {
@@ -172,11 +203,13 @@ test('CLI builds use the requested target and artifact path', async (t) => {
   await writeFile(join(development, 'maka-desktop-shell'), 'shell bytes');
   executable = join(development, process.platform === 'win32' ? 'maka.exe' : 'maka');
   assert.equal(
-    await buildCli({
-      repositoryRoot: root,
-      timings: true,
-      env: { ...process.env, MAKA_CUA_BUILD_MODE: 'native' },
-    }),
+    (
+      await buildCli({
+        repositoryRoot: root,
+        timings: true,
+        env: { ...process.env, MAKA_CUA_BUILD_MODE: 'native' },
+      })
+    ).binary,
     executable,
   );
   assert.deepEqual(invocation.args, [
@@ -199,12 +232,14 @@ test('CLI builds use the requested target and artifact path', async (t) => {
   );
   executable = join(sourceRoot, 'target/aarch64-apple-darwin/release/maka');
   assert.equal(
-    await buildCli({
-      release: true,
-      target: 'aarch64-apple-darwin',
-      repositoryRoot: sourceRoot,
-      env: sourceEnv,
-    }),
+    (
+      await buildCli({
+        release: true,
+        target: 'aarch64-apple-darwin',
+        repositoryRoot: sourceRoot,
+        env: sourceEnv,
+      })
+    ).binary,
     join(sourceRoot, 'target/aarch64-apple-darwin/release/maka'),
   );
   assert.equal(invocation.options.cwd, sourceRoot);

scripts/rust/cargo.mjs

@@ -32,7 +32,8 @@ export async function cargoBuild(args, { cwd, env }) {
     child.once('error', reject);
     child.once('exit', (code, signal) => resolveRun({ code, signal }));
   });
-  const executables = new Map();
+  const artifacts = new Map();
+  const buildScripts = new Map();
   try {
     const [result] = await Promise.all([
       completed,
@@ -41,16 +42,29 @@ export async function cargoBuild(args, { cwd, env }) {
           const message = JSON.parse(line);
           if (message.reason === 'compiler-message' && message.message.rendered)
             process.stderr.write(message.message.rendered);
+          if (message.reason === 'build-script-executed')
+            buildScripts.set(message.package_id, resolve(cwd, message.out_dir));
           if (
             message.reason === 'compiler-artifact' &&
             message.target.kind.includes('bin') &&
             message.executable
           )
-            executables.set(message.target.name, resolve(cwd, message.executable));
+            artifacts.set(message.target.name, message);
         }
       })(),
     ]);
-    return { ...result, executables };
+    return {
+      ...result,
+      executables: new Map(
+        [...artifacts].map(([name, artifact]) => [
+          name,
+          {
+            path: resolve(cwd, artifact.executable),
+            outDir: buildScripts.get(artifact.package_id),
+          },
+        ]),
+      ),
+    };
   } catch (error) {
     child.kill();
     throw error;