From 882c9dee5addbc28a6b974f87fcfc9d48e6238fd Mon Sep 17 00:00:00 2001
From: Cita <juricek.chen@gmail.com>
Date: Thu, 19 Mar 2026 20:49:24 +0800
Subject: [PATCH] fix: harden mac release architecture verification

---
 scripts/desktop/verifyMacArchitecture.test.ts | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 scripts/desktop/verifyMacArchitecture.test.ts

diff --git a/scripts/desktop/verifyMacArchitecture.test.ts b/scripts/desktop/verifyMacArchitecture.test.ts
new file mode 100644
index 0000000..f02cb28
--- /dev/null
+++ b/scripts/desktop/verifyMacArchitecture.test.ts
@@ -0,0 +1,54 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+import { verifyMacArchitecture } from './verifyMacArchitecture.mjs';
+
+const tempDirs: string[] = [];
+
+function createReleaseBinary() {
+  const releaseDir = mkdtempSync(join(tmpdir(), 'metapi-mac-arch-'));
+  tempDirs.push(releaseDir);
+
+  const binaryPath = join(releaseDir, 'mac-x64', 'Metapi.app', 'Contents', 'MacOS', 'Metapi');
+  mkdirSync(dirname(binaryPath), { recursive: true });
+  writeFileSync(binaryPath, 'binary');
+
+  return { releaseDir, binaryPath };
+}
+
+afterEach(() => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (dir) {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+});
+
+describe('verifyMacArchitecture', () => {
+  it('accepts x64 binaries when lipo reports x86_64', () => {
+    const { releaseDir, binaryPath } = createReleaseBinary();
+
+    expect(
+      verifyMacArchitecture({
+        releaseDir,
+        expectedArch: 'x64',
+        inspectBinaryArchs: () => 'x86_64',
+      }),
+    ).toEqual([{ archs: 'x86_64', binaryPath }]);
+  });
+
+  it('rejects x64 binaries when lipo reports arm64', () => {
+    const { releaseDir } = createReleaseBinary();
+
+    expect(() =>
+      verifyMacArchitecture({
+        releaseDir,
+        expectedArch: 'x64',
+        inspectBinaryArchs: () => 'arm64',
+      }),
+    ).toThrow(/Expected x86_64-only binary but got: arm64/);
+  });
+});