const std = @import("std");
extern fn getpid() c_int;
const runner = @import("runner");
const zero_native = @import("zero-native");
pub const panic = std.debug.FullPanic(zero_native.debug.capturePanic);
const WINDOW_W: f32 = 140;
// 180px tall: pet at top:34 + 78px sprite = 112; +16 bottom margin
// after gravity-throw recovery. The bubble sits in the 30px strip
// above the pet via getBoundingClientRect anchoring.
const WINDOW_H: f32 = 180;
const MENU_W: u32 = 480;
const MENU_H: u32 = 420;
const MAX_PET_BYTES: usize = 16 * 1024 * 1024;
const MAX_ACTIVE_BYTES: usize = 4 * 1024;
const MAX_SLUG_LEN: usize = 64;
// Matches web `MAX_SLUGS_IN_COMMAND` — caps deeplink and bridge batch installs.
const MAX_INSTALL_SLUGS: usize = 24;
// Room for `slugs=a,b,c` query values (24 slugs × ~65 chars, matches web cap).
const MAX_SLUGS_QUERY_BYTES: usize = MAX_INSTALL_SLUGS * (MAX_SLUG_LEN + 1);
const DeepLink = union(enum) {
none,
activate: []const u8,
install: std.ArrayList([]const u8),
};
const AgentAsset = struct {
name: []const u8,
bytes: []const u8,
};
const agent_assets = [_]AgentAsset{
.{ .name = "claude-code.svg", .bytes = @embedFile("assets/agents/claude-code.svg") },
.{ .name = "codex.svg", .bytes = @embedFile("assets/agents/codex.svg") },
.{ .name = "gemini.svg", .bytes = @embedFile("assets/agents/gemini.svg") },
.{ .name = "opencode.svg", .bytes = @embedFile("assets/agents/opencode.svg") },
.{ .name = "antigravity.svg", .bytes = @embedFile("assets/agents/antigravity.svg") },
.{ .name = "fallback.svg", .bytes = @embedFile("assets/agents/fallback.svg") },
};
const html_head =
\\
\\
\\
\\
\\
\\
\\
\\
\\
\\
\\
\\
\\
\\
\\
;
const Pet = struct {
slug: []u8,
display_name: []u8,
// Absolute path of the pets root that contains this slug. We
// store it per-pet because we now read from BOTH ~/.petdex/pets
// AND ~/.codex/pets — picking just the first existing root
// (the old behavior) made an empty ~/.petdex/pets dir mask a
// populated ~/.codex/pets, and the binary would exit with "No
// pets in ...".
root: []u8,
};
fn spawnSidecar(allocator: std.mem.Allocator, io: std.Io, sidecar_dir: []const u8, env_map: *std.process.Environ.Map) !void {
// The HTTP sidecar runs on Node (≥ 18). We assume Node is available
// because devs of coding agents almost universally have it installed —
// a much safer assumption than requiring Bun. The pre-built
// `sidecar/server.js` ships next to the binary so we don't need any
// bundler at runtime either.
const node_path = findExecutableOnPath(allocator, io, env_map, "node") catch {
std.debug.print("petdex: `node` not found on PATH; HTTP sidecar disabled. Hooks won't reach the mascot. Install Node.js (>= 18) and relaunch.\n", .{});
return;
};
defer allocator.free(node_path);
const server_path = try std.fs.path.join(allocator, &.{ sidecar_dir, "server.js" });
defer allocator.free(server_path);
// server.js is installed to ~/.petdex/sidecar/server.js by `petdex
// install desktop`. If it's missing, the binary was launched without
// the CLI's install step (or the user wiped ~/.petdex/sidecar). Bail
// gracefully so hooks fail loudly instead of POSTing to a dead port.
var probe = std.Io.Dir.openFileAbsolute(io, server_path, .{}) catch {
std.debug.print("petdex: sidecar not found at {s}. Run `petdex install desktop` (or `petdex update`) to fetch it. Hooks won't reach the mascot.\n", .{server_path});
return;
};
probe.close(io);
// Pass our PID to the sidecar so it can self-terminate if we die. The
// sidecar polls process.kill(parent, 0) every 2s and exits on ESRCH.
// This prevents zombie node processes hogging port 7777 after a
// `petdex desktop stop` or a crash.
var pid_buf: [32]u8 = undefined;
const pid_str = try std.fmt.bufPrint(&pid_buf, "{d}", .{getpid()});
try env_map.put("PETDEX_PARENT_PID", pid_str);
const argv = &[_][]const u8{ node_path, server_path };
_ = std.process.spawn(io, .{
.argv = argv,
.environ_map = env_map,
.stdin = .ignore,
.stdout = .ignore,
.stderr = .ignore,
}) catch |err| {
std.debug.print("petdex: failed to spawn sidecar: {s}\n", .{@errorName(err)});
return;
};
// Detach: we never wait on the child explicitly. The sidecar's parent
// watchdog handles cleanup when we exit; in-band it listens for SIGTERM.
std.debug.print("petdex: sidecar spawned (node {s})\n", .{server_path});
}
fn findExecutableOnPath(allocator: std.mem.Allocator, io: std.Io, env_map: *std.process.Environ.Map, name: []const u8) ![]u8 {
// Pass 1: $PATH as inherited from the parent. Works when the binary
// is launched from a shell (Ghostty, Terminal). Also works when a
// shell login session set launchctl PATH at login (rare on stock
// macOS).
if (env_map.get("PATH")) |path| {
var iter = std.mem.splitScalar(u8, path, ':');
while (iter.next()) |dir| {
if (dir.len == 0) continue;
const candidate = try std.fs.path.join(allocator, &.{ dir, name });
var file = std.Io.Dir.openFileAbsolute(io, candidate, .{}) catch {
allocator.free(candidate);
continue;
};
file.close(io);
return candidate;
}
}
// Pass 2: Finder/launchctl launches inherit a minimal PATH
// (/usr/bin:/bin:/usr/sbin:/sbin) that almost never includes
// homebrew or version managers. Hunter hit this 2026-05-11: the
// .app launched from /Applications/ via Finder couldn't find his
// nvm-installed node, the sidecar never started, and the WebView
// sat there silently with no hooks reaching it. Fall back to the
// common install locations explicitly. Order matters: most-likely-
// current-default first.
const home = env_map.get("HOME") orelse "";
var explicit_buf: [16][]const u8 = undefined;
var explicit_len: usize = 0;
const candidates = [_][]const u8{
"/opt/homebrew/bin", // Apple Silicon homebrew (default since 2020)
"/usr/local/bin", // Intel homebrew, official Node installer
"/usr/bin", // system, unlikely to have node but cheap to check
};
for (candidates) |dir| {
explicit_buf[explicit_len] = dir;
explicit_len += 1;
}
for (explicit_buf[0..explicit_len]) |dir| {
const candidate = try std.fs.path.join(allocator, &.{ dir, name });
var file = std.Io.Dir.openFileAbsolute(io, candidate, .{}) catch {
allocator.free(candidate);
continue;
};
file.close(io);
return candidate;
}
// Pass 3: Node version managers stash node under per-version dirs
// that don't sit on PATH unless the user shimmed them. Probe the
// popular ones. We can't enumerate nvm versions cheaply from zig
// (would need a glob), so we check the "default alias" symlinks
// each manager exposes.
if (home.len > 0 and std.mem.eql(u8, name, "node")) {
const manager_paths = [_][]const u8{
".volta/bin/node", // volta
".fnm/aliases/default/bin/node", // fnm with default alias
".asdf/shims/node", // asdf
".n/bin/node", // tj/n
".local/bin/node", // user-local install
};
for (manager_paths) |rel| {
const candidate = try std.fs.path.join(allocator, &.{ home, rel });
var file = std.Io.Dir.openFileAbsolute(io, candidate, .{}) catch {
allocator.free(candidate);
continue;
};
file.close(io);
return candidate;
}
// nvm: walk ~/.nvm/versions/node/* and pick the highest one.
// Cheaper than parsing the alias file and tolerates a missing
// 'default' alias. We pick lexicographically last, which works
// for sane v20+ semver dirs (v20.10.0 < v22.14.0).
const nvm_root = try std.fs.path.join(allocator, &.{ home, ".nvm", "versions", "node" });
defer allocator.free(nvm_root);
if (std.Io.Dir.openDirAbsolute(io, nvm_root, .{ .iterate = true })) |dir_h| {
var dir_handle = dir_h;
defer dir_handle.close(io);
var best: ?[]u8 = null;
errdefer if (best) |b| allocator.free(b);
var it = dir_handle.iterate();
while (try it.next(io)) |entry| {
if (entry.kind != .directory) continue;
if (best) |b| {
if (std.mem.lessThan(u8, b, entry.name)) {
allocator.free(b);
best = try allocator.dupe(u8, entry.name);
}
} else {
best = try allocator.dupe(u8, entry.name);
}
}
if (best) |b| {
defer allocator.free(b);
const candidate = try std.fs.path.join(allocator, &.{ nvm_root, b, "bin", "node" });
var file = std.Io.Dir.openFileAbsolute(io, candidate, .{}) catch {
allocator.free(candidate);
return error.ExecutableNotFound;
};
file.close(io);
return candidate;
}
} else |_| {}
}
return error.ExecutableNotFound;
}
const PetdexState = struct {
allocator: std.mem.Allocator,
io: std.Io,
config_dir: []u8,
// Every existing pets root in priority order (.petdex first,
// .codex second). Stored as a list rather than a single dir so
// setActiveCmd can resolve the correct root when the user
// installed a pet into ~/.codex/pets but NOT ~/.petdex/pets —
// the previous "first root wins" logic made an empty .petdex
// dir mask a populated .codex dir at startup.
pets_roots: [][]u8,
asset_root: []u8,
// Held so respawn_sidecar can re-issue spawnSidecar without
// having to re-resolve sidecar_dir or rebuild the env map.
sidecar_dir: []u8,
env_map: *std.process.Environ.Map,
bridge_handlers: [14]zero_native.BridgeHandler = undefined,
fn deinit(self: *PetdexState) void {
self.allocator.free(self.config_dir);
for (self.pets_roots) |r| self.allocator.free(r);
self.allocator.free(self.pets_roots);
self.allocator.free(self.asset_root);
self.allocator.free(self.sidecar_dir);
}
fn bridge(self: *PetdexState) zero_native.BridgeDispatcher {
self.bridge_handlers = .{
.{ .name = "petdex.set_active", .context = self, .invoke_fn = setActiveCmd },
.{ .name = "petdex.quit", .context = self, .invoke_fn = quitCmd },
.{ .name = "petdex.read_runtime_state", .context = self, .invoke_fn = readRuntimeStateCmd },
.{ .name = "petdex.read_runtime_bubble", .context = self, .invoke_fn = readRuntimeBubbleCmd },
.{ .name = "petdex.read_incoming_url", .context = self, .invoke_fn = readIncomingUrlCmd },
.{ .name = "petdex.install_pet", .context = self, .invoke_fn = installPetCmd },
.{ .name = "petdex.refresh_pets", .context = self, .invoke_fn = refreshPetsCmd },
.{ .name = "petdex.read_update_info", .context = self, .invoke_fn = readUpdateInfoCmd },
.{ .name = "petdex.read_init_status", .context = self, .invoke_fn = readInitStatusCmd },
.{ .name = "petdex.read_desktop_settings", .context = self, .invoke_fn = readDesktopSettingsCmd },
.{ .name = "petdex.write_desktop_settings", .context = self, .invoke_fn = writeDesktopSettingsCmd },
.{ .name = "petdex.trigger_update", .context = self, .invoke_fn = triggerUpdateCmd },
.{ .name = "petdex.respawn_sidecar", .context = self, .invoke_fn = respawnSidecarCmd },
.{ .name = "petdex.set_mascot_state", .context = self, .invoke_fn = setMascotStateCmd },
};
return .{
.policy = .{ .enabled = true, .commands = &petdex_command_policies },
.registry = .{ .handlers = &self.bridge_handlers },
};
}
// Called by the WebView JS when /health fails repeatedly. The
// old sidecar's parent watchdog handles cleanup if it's alive,
// so this is fire-and-forget. We don't track the new pid; the
// next health probe is the success/failure signal.
fn respawnSidecarCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
spawnSidecar(self.allocator, self.io, self.sidecar_dir, self.env_map) catch |err| {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"{s}\"}}", .{@errorName(err)});
};
return std.fmt.bufPrint(output, "{{\"ok\":true}}", .{});
}
fn readRuntimeStateCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
const path = try std.fs.path.join(self.allocator, &.{ self.config_dir, "runtime", "state.json" });
defer self.allocator.free(path);
var file = std.Io.Dir.openFileAbsolute(self.io, path, .{}) catch {
return std.fmt.bufPrint(output, "{{\"state\":\"idle\",\"counter\":0}}", .{});
};
defer file.close(self.io);
const stat = try file.stat(self.io);
const size: usize = @intCast(stat.size);
if (size == 0 or size > output.len) {
return std.fmt.bufPrint(output, "{{\"state\":\"idle\",\"counter\":0}}", .{});
}
const read = try file.readPositionalAll(self.io, output[0..size], 0);
return output[0..read];
}
// Read + consume the incoming-url.txt the AppleEvent handler writes.
// Returns {kind, slug, slugs?} for the WebView. Always deletes the file
// after read so re-polling doesn't see stale URLs.
fn readIncomingUrlCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
const home = self.env_map.get("HOME") orelse {
return std.fmt.bufPrint(output, "{{\"kind\":\"none\",\"slug\":\"\"}}", .{});
};
const runtime_dir = try std.fs.path.join(self.allocator, &.{ home, ".petdex-desktop", "runtime" });
defer self.allocator.free(runtime_dir);
const incoming_path = try std.fs.path.join(self.allocator, &.{ runtime_dir, "incoming-url.txt" });
defer self.allocator.free(incoming_path);
var deeplink = readDeepLinkFromPath(self.allocator, self.io, incoming_path) catch DeepLink{ .none = {} };
std.Io.Dir.deleteFileAbsolute(self.io, incoming_path) catch {};
const pending_path = try std.fs.path.join(self.allocator, &.{ runtime_dir, "pending-deeplink.txt" });
defer self.allocator.free(pending_path);
if (deeplink == .none) {
deeplink = readDeepLinkFromPath(self.allocator, self.io, pending_path) catch DeepLink{ .none = {} };
}
// Drop any leftover pending link so a fresh incoming URL cannot leave
// a stale install/activate queued for the next poll.
std.Io.Dir.deleteFileAbsolute(self.io, pending_path) catch {};
defer freeDeepLink(self.allocator, deeplink);
return try formatDeepLinkJson(self.allocator, deeplink, output);
}
// Mirror of readRuntimeStateCmd, but reads ~/.petdex/runtime/bubble.json
// (written by the sidecar's POST /bubble handler). The WebView polls
// this every 200ms via the bridge, alongside the state poll. A
// missing file is normal on first launch — we return an empty
// payload so the JS side just shows nothing.
fn readRuntimeBubbleCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
const path = try std.fs.path.join(self.allocator, &.{ self.config_dir, "runtime", "bubble.json" });
defer self.allocator.free(path);
var file = std.Io.Dir.openFileAbsolute(self.io, path, .{}) catch {
return std.fmt.bufPrint(output, "{{\"text\":\"\",\"counter\":0}}", .{});
};
defer file.close(self.io);
const stat = try file.stat(self.io);
const size: usize = @intCast(stat.size);
if (size == 0 or size > output.len) {
return std.fmt.bufPrint(output, "{{\"text\":\"\",\"counter\":0}}", .{});
}
const read = try file.readPositionalAll(self.io, output[0..size], 0);
return output[0..read];
}
// Spawn `node ~/.petdex/bin/petdex.js install ` and wait for
// it to finish. Used by the URL-scheme deep-link path: when the
// user opens petdex:// for a pet they don't have installed,
// we shell out to the CLI which downloads the sprite + petJson
// from petdex.crafter.run, validates the host allowlist, and
// writes them under ~/.petdex/pets/. The CLI is the
// single source of truth for install logic — replicating it in
// zig would mean two places to keep in sync.
fn installPetCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
const self: *PetdexState = @ptrCast(@alignCast(context));
var slugs = try parseInstallSlugsFromPayload(self.allocator, invocation.request.payload);
defer {
for (slugs.items) |s| self.allocator.free(s);
slugs.deinit(self.allocator);
}
if (slugs.items.len == 0) return error.MissingSlug;
const home = self.env_map.get("HOME") orelse {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"no_home\"}}", .{});
};
const cli_path = try std.fs.path.join(self.allocator, &.{ home, ".petdex", "bin", "petdex.js" });
defer self.allocator.free(cli_path);
// Verify the CLI snapshot exists. If `petdex hooks install`
// was never run, this file is absent and we can't auto-install.
std.Io.Dir.accessAbsolute(self.io, cli_path, .{}) catch {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"cli_not_persisted\"}}", .{});
};
// Resolve node via the same PATH-aware lookup the sidecar uses.
// launchctl PATH on Finder-launched .apps is /usr/bin:/bin:/usr/sbin:/sbin
// — no nvm, no homebrew, no node. Plain `node` in argv would
// resolve to FileNotFound and the user would see "Install failed:
// FileNotFound" (Hunter 2026-05-11) with no idea what to do.
const node_path = findExecutableOnPath(self.allocator, self.io, self.env_map, "node") catch {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"node_not_found\"}}", .{});
};
defer self.allocator.free(node_path);
var argv: std.ArrayList([]const u8) = .empty;
defer argv.deinit(self.allocator);
try argv.appendSlice(self.allocator, &.{ node_path, cli_path, "install" });
try argv.appendSlice(self.allocator, slugs.items);
const runtime_dir = try std.fs.path.join(self.allocator, &.{ home, ".petdex-desktop", "runtime" });
defer self.allocator.free(runtime_dir);
try ensurePrivateDir(self.allocator, self.io, runtime_dir);
const summary_path = try std.fs.path.join(self.allocator, &.{ runtime_dir, "install-machine-summary.json" });
defer self.allocator.free(summary_path);
std.Io.Dir.deleteFileAbsolute(self.io, summary_path) catch {};
var child_env = std.process.Environ.Map.init(self.allocator);
defer child_env.deinit();
{
const keys = self.env_map.keys();
const vals = self.env_map.values();
for (keys, vals) |k, v| {
try child_env.put(k, v);
}
}
try child_env.put("PETDEX_INSTALL_MACHINE_SUMMARY_PATH", summary_path);
var child = std.process.spawn(self.io, .{
.argv = argv.items,
.stdin = .ignore,
.stdout = .ignore,
.stderr = .ignore,
.environ_map = &child_env,
}) catch |err| {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"spawn_{s}\"}}", .{@errorName(err)});
};
const term = child.wait(self.io) catch |err| {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"{s}\"}}", .{@errorName(err)});
};
const report_opt = readOptionalInstallMachineReport(self.allocator, self.io, summary_path);
defer if (report_opt) |rp| self.allocator.free(rp);
std.Io.Dir.deleteFileAbsolute(self.io, summary_path) catch {};
const disk_installed = countRequestedSlugsOnDisk(self.io, self.pets_roots, slugs.items);
switch (term) {
.exited => |code| {
if (code == 0) {
return try formatInstallPetBridgeJson(self.allocator, output, true, null, report_opt, slugs.items.len, disk_installed);
}
var err_buf: [48]u8 = undefined;
const err_tag = std.fmt.bufPrint(&err_buf, "exit_{d}", .{code}) catch "exit_unknown";
return try formatInstallPetBridgeJson(self.allocator, output, false, err_tag, report_opt, slugs.items.len, disk_installed);
},
else => {
return try formatInstallPetBridgeJson(self.allocator, output, false, "abnormal_exit", report_opt, slugs.items.len, disk_installed);
},
}
}
fn refreshPetsCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
var pets = try listPetsAcrossRoots(self.allocator, self.io, self.pets_roots);
errdefer {
for (pets.items) |p| {
self.allocator.free(p.slug);
self.allocator.free(p.display_name);
self.allocator.free(p.root);
}
pets.deinit(self.allocator);
}
if (pets.items.len == 0) {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"no_pets\"}}", .{});
}
const stored_active = try readActiveSlug(self.allocator, self.io, self.config_dir);
defer if (stored_active) |s| self.allocator.free(s);
const active_slug = blk: {
if (stored_active) |s| {
for (pets.items) |p| {
if (std.mem.eql(u8, p.slug, s)) break :blk s;
}
}
break :blk pets.items[0].slug;
};
const sprite = try loadSpritesheetAcrossRoots(self.allocator, self.io, self.pets_roots, active_slug);
defer self.allocator.free(sprite.bytes);
var root_dir = try std.Io.Dir.openDirAbsolute(self.io, self.asset_root, .{});
defer root_dir.close(self.io);
try writeFileAll(self.io, root_dir, "spritesheet.webp", sprite.bytes);
if (!std.mem.eql(u8, sprite.ext, "webp")) {
const sprite_name = if (std.mem.eql(u8, sprite.ext, "png")) "spritesheet.png" else "spritesheet.webp";
try writeFileAll(self.io, root_dir, sprite_name, sprite.bytes);
}
const petdex_json = try buildPetdexJson(self.allocator, pets.items, active_slug);
defer self.allocator.free(petdex_json);
const html_doc = try buildHtml(self.allocator, petdex_json);
defer self.allocator.free(html_doc);
try writeFileAll(self.io, root_dir, "index.html", html_doc);
try copyAllSpritesheets(self.allocator, self.io, self.asset_root, pets.items);
const response = try std.fmt.bufPrint(output, "{{\"ok\":true,\"active\":\"{s}\"}}", .{active_slug});
for (pets.items) |p| {
self.allocator.free(p.slug);
self.allocator.free(p.display_name);
self.allocator.free(p.root);
}
pets.deinit(self.allocator);
return response;
}
fn setActiveCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
const self: *PetdexState = @ptrCast(@alignCast(context));
const slug = jsonStringField(invocation.request.payload, "slug") orelse return error.MissingSlug;
// Load BEFORE persisting active.json. Reversed order would
// poison the stored slug if the sprite is unreadable: the
// file would point at a broken pet, and every subsequent
// launch would crash in main()'s loadSpritesheet call until
// the user manually edited active.json. Validating first
// means a failed selection leaves the previous active intact.
//
// We try each pets root in priority order (.petdex first,
// .codex second) and use the first one that has the slug.
// The picker would have shown the slug from whichever root
// it actually came from — we just need to find it again.
const sprite = try loadSpritesheetAcrossRoots(self.allocator, self.io, self.pets_roots, slug);
defer self.allocator.free(sprite.bytes);
var root_dir = try std.Io.Dir.openDirAbsolute(self.io, self.asset_root, .{});
defer root_dir.close(self.io);
try writeFileAll(self.io, root_dir, "spritesheet.webp", sprite.bytes);
if (!std.mem.eql(u8, sprite.ext, "webp")) {
const sprite_name = if (std.mem.eql(u8, sprite.ext, "png")) "spritesheet.png" else "spritesheet.webp";
try writeFileAll(self.io, root_dir, sprite_name, sprite.bytes);
}
// Persist last — by here we've proven the pet is loadable
// AND we've successfully written the sprite into asset_root.
try writeActiveSlug(self.io, self.config_dir, slug);
return std.fmt.bufPrint(output, "{{\"ok\":true}}", .{});
}
fn quitCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = context;
_ = invocation;
std.process.exit(0);
return std.fmt.bufPrint(output, "{{\"ok\":true}}", .{});
}
fn readUpdateInfoCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
const path = try std.fs.path.join(self.allocator, &.{ self.config_dir, "runtime", "update.json" });
defer self.allocator.free(path);
var file = std.Io.Dir.openFileAbsolute(self.io, path, .{}) catch {
return std.fmt.bufPrint(output, "{{\"available\":false,\"status\":\"idle\"}}", .{});
};
defer file.close(self.io);
const stat = try file.stat(self.io);
const size: usize = @intCast(stat.size);
if (size == 0 or size > output.len) {
return std.fmt.bufPrint(output, "{{\"available\":false,\"status\":\"idle\"}}", .{});
}
const read = try file.readPositionalAll(self.io, output[0..size], 0);
return output[0..read];
}
fn readInitStatusCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
const path = try std.fs.path.join(self.allocator, &.{ self.config_dir, "runtime", "init-status.json" });
defer self.allocator.free(path);
var file = std.Io.Dir.openFileAbsolute(self.io, path, .{}) catch {
return std.fmt.bufPrint(output, "{{\"needsInit\":false,\"reason\":null,\"checkedAt\":0}}", .{});
};
defer file.close(self.io);
const stat = try file.stat(self.io);
const size: usize = @intCast(stat.size);
if (size == 0 or size > output.len) {
return std.fmt.bufPrint(output, "{{\"needsInit\":false,\"reason\":null,\"checkedAt\":0}}", .{});
}
const read = try file.readPositionalAll(self.io, output[0..size], 0);
return output[0..read];
}
fn readDesktopSettingsCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
return try self.formatDesktopSettingsJson(output);
}
fn writeDesktopSettingsCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
const self: *PetdexState = @ptrCast(@alignCast(context));
const auto_updates = jsonBoolField(invocation.request.payload, "autoInstallUpdates") orelse return error.MissingAutoInstallUpdates;
const text = if (auto_updates) "{\"autoInstallUpdates\":true}\n" else "{\"autoInstallUpdates\":false}\n";
var dir = try std.Io.Dir.openDirAbsolute(self.io, self.config_dir, .{});
defer dir.close(self.io);
try writeFileAll(self.io, dir, "preferences.json", text);
return try self.formatDesktopSettingsJson(output);
}
fn readDesktopAutoInstallUpdates(self: *PetdexState) bool {
const path = std.fs.path.join(self.allocator, &.{ self.config_dir, "preferences.json" }) catch return true;
defer self.allocator.free(path);
var file = std.Io.Dir.openFileAbsolute(self.io, path, .{}) catch return true;
defer file.close(self.io);
var buf: [4096]u8 = undefined;
const read = file.readPositionalAll(self.io, &buf, 0) catch return true;
return jsonBoolField(buf[0..read], "autoInstallUpdates") orelse true;
}
fn formatDesktopSettingsJson(self: *PetdexState, output: []u8) ![]const u8 {
var buf: std.ArrayList(u8) = .empty;
defer buf.deinit(self.allocator);
try buf.appendSlice(self.allocator, "{\"autoInstallUpdates\":");
try buf.appendSlice(self.allocator, if (self.readDesktopAutoInstallUpdates()) "true" else "false");
try buf.appendSlice(self.allocator, ",\"version\":");
const version_path = try std.fs.path.join(self.allocator, &.{ self.config_dir, "version" });
defer self.allocator.free(version_path);
var version_buf: [128]u8 = undefined;
if (std.Io.Dir.openFileAbsolute(self.io, version_path, .{})) |version_file| {
var file = version_file;
defer file.close(self.io);
const read = file.readPositionalAll(self.io, &version_buf, 0) catch 0;
const version = std.mem.trim(u8, version_buf[0..read], " \t\r\n");
try buf.append(self.allocator, '"');
try appendJsonEscaped(&buf, self.allocator, version);
try buf.append(self.allocator, '"');
} else |_| {
try buf.appendSlice(self.allocator, "null");
}
try buf.appendSlice(self.allocator, ",\"configDir\":\"");
try appendJsonEscaped(&buf, self.allocator, self.config_dir);
try buf.appendSlice(self.allocator, "\",\"petsRoots\":[");
for (self.pets_roots, 0..) |root, i| {
if (i > 0) try buf.append(self.allocator, ',');
try buf.append(self.allocator, '"');
try appendJsonEscaped(&buf, self.allocator, root);
try buf.append(self.allocator, '"');
}
try buf.appendSlice(self.allocator, "]}");
if (buf.items.len > output.len) return error.BufferTooSmall;
@memcpy(output[0..buf.items.len], buf.items);
return output[0..buf.items.len];
}
fn triggerUpdateCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
_ = invocation;
const self: *PetdexState = @ptrCast(@alignCast(context));
// Read the per-session token the sidecar wrote to ~/.petdex/
// runtime/update-token (mode 0600). Forward it as a header so
// a drive-by website can't trigger this endpoint via no-cors.
const token_path = try std.fs.path.join(self.allocator, &.{ self.config_dir, "runtime", "update-token" });
defer self.allocator.free(token_path);
var token_file = std.Io.Dir.openFileAbsolute(self.io, token_path, .{}) catch {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"no_token\"}}", .{});
};
defer token_file.close(self.io);
var token_buf: [128]u8 = undefined;
const token_read = token_file.readPositionalAll(self.io, &token_buf, 0) catch {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"token_read\"}}", .{});
};
const token = std.mem.trim(u8, token_buf[0..token_read], " \t\r\n");
if (token.len == 0) {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"empty_token\"}}", .{});
}
// Build "X-Petdex-Update-Token: " header arg.
const header_arg = try std.fmt.allocPrint(
self.allocator,
"X-Petdex-Update-Token: {s}",
.{token},
);
defer self.allocator.free(header_arg);
// Spawn `curl -fsS -X POST -H "..." http://127.0.0.1:7777/update`
// and wait for its exit code. We used to detach this and return
// ok:true unconditionally, which masked sidecar-down failures
// (Hunter 2026-05-11: clicked update card, nothing happened, no
// way to tell why). The POST body is empty and the sidecar
// returns 202 within milliseconds — synchronous wait is fine.
const argv = &[_][]const u8{
"curl",
"-fsS",
"-m",
"5",
"-X",
"POST",
"-H",
header_arg,
"http://127.0.0.1:7777/update",
};
var child = std.process.spawn(self.io, .{
.argv = argv,
.stdin = .ignore,
.stdout = .ignore,
.stderr = .ignore,
}) catch |err| {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"spawn_{s}\"}}", .{@errorName(err)});
};
const term = child.wait(self.io) catch |err| {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"wait_{s}\"}}", .{@errorName(err)});
};
switch (term) {
.exited => |code| {
if (code == 0) {
return std.fmt.bufPrint(output, "{{\"ok\":true}}", .{});
}
// curl exit 7 = could not connect (sidecar dead). Surface
// the code so the WebView can render an actionable error.
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"curl_exit_{d}\"}}", .{code});
},
else => return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"curl_abnormal_exit\"}}", .{}),
}
}
// Forward a {state, duration} payload to the sidecar so the
// mascot sprite reflects WebView-side events (install fails, etc.).
// Without this, all mascot state changes flow through external
// hooks (claude-code, opencode posting to /state); WebView-internal
// failures had no way to drive the sprite. Hunter 2026-05-11:
// "deepling install failed but mascot kept smiling".
//
// Same auth pattern as triggerUpdateCmd: read the per-session token
// and forward it as a header so a drive-by website can't bypass.
fn setMascotStateCmd(context: *anyopaque, invocation: zero_native.bridge.Invocation, output: []u8) anyerror![]const u8 {
const self: *PetdexState = @ptrCast(@alignCast(context));
const state = jsonStringField(invocation.request.payload, "state") orelse return error.MissingState;
const token_path = try std.fs.path.join(self.allocator, &.{ self.config_dir, "runtime", "update-token" });
defer self.allocator.free(token_path);
var token_file = std.Io.Dir.openFileAbsolute(self.io, token_path, .{}) catch {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"no_token\"}}", .{});
};
defer token_file.close(self.io);
var token_buf: [128]u8 = undefined;
const token_read = token_file.readPositionalAll(self.io, &token_buf, 0) catch {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"token_read\"}}", .{});
};
const token = std.mem.trim(u8, token_buf[0..token_read], " \t\r\n");
if (token.len == 0) {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"empty_token\"}}", .{});
}
const header_arg = try std.fmt.allocPrint(
self.allocator,
"X-Petdex-Update-Token: {s}",
.{token},
);
defer self.allocator.free(header_arg);
// Build {"state":"","duration":3000} body. Duration
// bounded so an install-failure sprite doesn't pin the mascot
// forever — the next idle tick reverts it.
const body = try std.fmt.allocPrint(
self.allocator,
"{{\"state\":\"{s}\",\"duration\":3000}}",
.{state},
);
defer self.allocator.free(body);
const argv = &[_][]const u8{
"curl",
"-fsS",
"-m",
"3",
"-X",
"POST",
"-H",
header_arg,
"-H",
"Content-Type: application/json",
"-d",
body,
"http://127.0.0.1:7777/state",
};
var child = std.process.spawn(self.io, .{
.argv = argv,
.stdin = .ignore,
.stdout = .ignore,
.stderr = .ignore,
}) catch |err| {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"spawn_{s}\"}}", .{@errorName(err)});
};
const term = child.wait(self.io) catch |err| {
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"wait_{s}\"}}", .{@errorName(err)});
};
switch (term) {
.exited => |code| {
if (code == 0) {
return std.fmt.bufPrint(output, "{{\"ok\":true}}", .{});
}
return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"curl_exit_{d}\"}}", .{code});
},
else => return std.fmt.bufPrint(output, "{{\"ok\":false,\"error\":\"curl_abnormal_exit\"}}", .{}),
}
}
};
const petdex_origins = [_][]const u8{ "zero://app", "zero://inline" };
const petdex_command_policies = [_]zero_native.BridgeCommandPolicy{
.{ .name = "petdex.set_active", .origins = &petdex_origins },
.{ .name = "petdex.quit", .origins = &petdex_origins },
.{ .name = "petdex.read_runtime_state", .origins = &petdex_origins },
.{ .name = "petdex.read_runtime_bubble", .origins = &petdex_origins },
.{ .name = "petdex.read_incoming_url", .origins = &petdex_origins },
.{ .name = "petdex.install_pet", .origins = &petdex_origins },
.{ .name = "petdex.refresh_pets", .origins = &petdex_origins },
.{ .name = "petdex.read_update_info", .origins = &petdex_origins },
.{ .name = "petdex.read_init_status", .origins = &petdex_origins },
.{ .name = "petdex.read_desktop_settings", .origins = &petdex_origins },
.{ .name = "petdex.write_desktop_settings", .origins = &petdex_origins },
.{ .name = "petdex.trigger_update", .origins = &petdex_origins },
.{ .name = "petdex.respawn_sidecar", .origins = &petdex_origins },
.{ .name = "petdex.set_mascot_state", .origins = &petdex_origins },
};
fn jsonStringField(payload: []const u8, key: []const u8) ?[]const u8 {
var key_buf: [64]u8 = undefined;
const needle = std.fmt.bufPrint(&key_buf, "\"{s}\":\"", .{key}) catch return null;
const start = std.mem.indexOf(u8, payload, needle) orelse return null;
const value_start = start + needle.len;
const end = std.mem.indexOfScalarPos(u8, payload, value_start, '"') orelse return null;
return payload[value_start..end];
}
fn jsonUintField(json: []const u8, key: []const u8) ?usize {
var key_buf: [48]u8 = undefined;
const needle = std.fmt.bufPrint(&key_buf, "\"{s}\":", .{key}) catch return null;
const start = std.mem.indexOf(u8, json, needle) orelse return null;
var i = start + needle.len;
while (i < json.len and std.ascii.isWhitespace(json[i])) i += 1;
if (i >= json.len) return null;
var end = i;
while (end < json.len and std.ascii.isDigit(json[end])) end += 1;
if (end == i) return null;
return std.fmt.parseInt(usize, json[i..end], 10) catch null;
}
fn jsonBoolField(json: []const u8, key: []const u8) ?bool {
var key_buf: [64]u8 = undefined;
const needle = std.fmt.bufPrint(&key_buf, "\"{s}\":", .{key}) catch return null;
const start = std.mem.indexOf(u8, json, needle) orelse return null;
var i = start + needle.len;
while (i < json.len and std.ascii.isWhitespace(json[i])) i += 1;
if (std.mem.startsWith(u8, json[i..], "true")) return true;
if (std.mem.startsWith(u8, json[i..], "false")) return false;
return null;
}
// Counts string elements in a JSON array field (e.g. `"missing":["a","b"]`).
fn jsonStringArrayLength(json: []const u8, key: []const u8) ?usize {
var key_buf: [48]u8 = undefined;
const needle = std.fmt.bufPrint(&key_buf, "\"{s}\":[", .{key}) catch return null;
const start = std.mem.indexOf(u8, json, needle) orelse return null;
var i = start + needle.len;
while (i < json.len and std.ascii.isWhitespace(json[i])) i += 1;
if (i >= json.len or json[i] == ']') return 0;
var count: usize = 0;
while (i < json.len and json[i] != ']') {
if (json[i] == '"') {
count += 1;
i += 1;
while (i < json.len and json[i] != '"') i += 1;
}
i += 1;
}
return count;
}
// Counts object elements in a JSON array field (e.g. `"failed":[{"slug":"a"},…]`).
fn jsonObjectArrayLength(json: []const u8, key: []const u8) ?usize {
var key_buf: [48]u8 = undefined;
const needle = std.fmt.bufPrint(&key_buf, "\"{s}\":[", .{key}) catch return null;
const start = std.mem.indexOf(u8, json, needle) orelse return null;
var i = start + needle.len;
while (i < json.len and std.ascii.isWhitespace(json[i])) i += 1;
if (i >= json.len or json[i] == ']') return 0;
var count: usize = 0;
while (i < json.len and json[i] != ']') {
if (json[i] == '{') count += 1;
i += 1;
}
return count;
}
fn countRequestedSlugsOnDisk(io: std.Io, roots: []const []u8, slugs: []const []const u8) usize {
var count: usize = 0;
for (slugs) |slug| {
var found = false;
for (roots) |root_path| {
var dir = std.Io.Dir.openDirAbsolute(io, root_path, .{ .iterate = true }) catch continue;
defer dir.close(io);
if (hasSpritesheet(io, dir, slug)) {
found = true;
break;
}
}
if (found) count += 1;
}
return count;
}
fn readFileAll(io: std.Io, allocator: std.mem.Allocator, file: std.Io.File, max_bytes: usize) ![]u8 {
const stat = try file.stat(io);
const size: usize = @intCast(stat.size);
if (size > max_bytes) return error.FileTooLarge;
const buf = try allocator.alloc(u8, size);
errdefer allocator.free(buf);
const read = try file.readPositionalAll(io, buf, 0);
if (read != size) return error.ShortRead;
return buf;
}
fn readOptionalInstallMachineReport(allocator: std.mem.Allocator, io: std.Io, path: []const u8) ?[]const u8 {
var file = std.Io.Dir.openFileAbsolute(io, path, .{}) catch return null;
defer file.close(io);
const raw = readFileAll(io, allocator, file, 8192) catch return null;
const trimmed = std.mem.trim(u8, raw, " \t\r\n");
const owned = allocator.dupe(u8, trimmed) catch {
allocator.free(raw);
return null;
};
allocator.free(raw);
if (owned.len == 0 or owned[0] != '{') {
allocator.free(owned);
return null;
}
return owned;
}
fn resolveInstalledCount(
report: ?[]const u8,
disk_installed_count: usize,
) usize {
if (report) |r| {
if (jsonUintField(r, "installed_count")) |n| return n;
}
return disk_installed_count;
}
fn tryAppendInstallIssueNote(
buf: *std.ArrayList(u8),
allocator: std.mem.Allocator,
report: ?[]const u8,
requested_count: usize,
installed: usize,
) !void {
const missing: usize = if (report) |r| jsonStringArrayLength(r, "missing") orelse 0 else 0;
const failed: usize = if (report) |r| jsonObjectArrayLength(r, "failed") orelse 0 else 0;
const gap: usize = if (installed < requested_count) requested_count - installed else 0;
const other: usize = if (gap > missing + failed) gap - missing - failed else 0;
var msg: std.ArrayList(u8) = .empty;
defer msg.deinit(allocator);
var part_buf: [64]u8 = undefined;
if (missing > 0) {
const part = try std.fmt.bufPrint(&part_buf, "{d} skipped (not found). ", .{missing});
try msg.appendSlice(allocator, part);
}
if (failed > 0) {
const part = try std.fmt.bufPrint(&part_buf, "{d} failed to download. ", .{failed});
try msg.appendSlice(allocator, part);
}
if (other > 0) {
const part = try std.fmt.bufPrint(&part_buf, "{d} not installed. ", .{other});
try msg.appendSlice(allocator, part);
}
if (msg.items.len == 0) return;
try buf.appendSlice(allocator, ",\"issue_note\":\"");
try appendJsonEscaped(buf, allocator, msg.items);
try buf.appendSlice(allocator, "\"");
}
fn formatInstallPetBridgeJson(
allocator: std.mem.Allocator,
output: []u8,
ok: bool,
err_opt: ?[]const u8,
report: ?[]const u8,
requested_count: usize,
disk_installed_count: usize,
) ![]const u8 {
var buf: std.ArrayList(u8) = .empty;
defer buf.deinit(allocator);
var num_buf: [24]u8 = undefined;
const installed = resolveInstalledCount(report, disk_installed_count);
try buf.appendSlice(allocator, "{\"ok\":");
try buf.appendSlice(allocator, if (ok) "true" else "false");
if (err_opt) |e| {
try buf.appendSlice(allocator, ",\"error\":\"");
try appendJsonEscaped(&buf, allocator, e);
try buf.appendSlice(allocator, "\"");
}
const req_str = try std.fmt.bufPrint(&num_buf, "{d}", .{requested_count});
try buf.appendSlice(allocator, ",\"requested_count\":");
try buf.appendSlice(allocator, req_str);
if (report) |r| {
try buf.appendSlice(allocator, ",\"install_report\":");
try buf.appendSlice(allocator, r);
}
if (ok) {
const inst_str = try std.fmt.bufPrint(&num_buf, "{d}", .{installed});
try buf.appendSlice(allocator, ",\"installed_count\":");
try buf.appendSlice(allocator, inst_str);
} else if (report) |r| {
if (jsonUintField(r, "installed_count")) |installed_from_report| {
const inst_str = try std.fmt.bufPrint(&num_buf, "{d}", .{installed_from_report});
try buf.appendSlice(allocator, ",\"installed_count\":");
try buf.appendSlice(allocator, inst_str);
}
}
try tryAppendInstallIssueNote(&buf, allocator, report, requested_count, installed);
try buf.appendSlice(allocator, "}");
if (buf.items.len > output.len) return error.BufferTooSmall;
@memcpy(output[0..buf.items.len], buf.items);
return output[0..buf.items.len];
}
fn writeFileAll(io: std.Io, dir: std.Io.Dir, name: []const u8, bytes: []const u8) !void {
var file = try dir.createFile(io, name, .{ .truncate = true });
defer file.close(io);
try file.writePositionalAll(io, bytes, 0);
}
fn ensureDir(io: std.Io, path: []const u8) !void {
std.Io.Dir.createDirAbsolute(io, path, .default_dir) catch |err| switch (err) {
error.PathAlreadyExists => {},
else => return err,
};
}
// Same as ensureDir but with mode 0700 (rwx for owner only). Used for
// directories that hold WebView assets / runtime state we don't want
// other local users reading or pre-staging symlinks into. On Windows
// the mode is ignored; per-user isolation comes from the parent
// directory living under %USERPROFILE%.
fn ensurePrivateDir(allocator: std.mem.Allocator, io: std.Io, path: []const u8) !void {
const private_perms = std.Io.File.Permissions.fromMode(0o700);
std.Io.Dir.createDirAbsolute(io, path, private_perms) catch |err| switch (err) {
// If it already exists, tighten the mode in case a previous
// version created it with a wider default. chmod is a no-op
// on Windows (mode_t is u0 there). std.Io.Dir doesn't expose
// chmod directly, so we go through libc with a NUL-terminated
// path.
error.PathAlreadyExists => {
if (@sizeOf(std.posix.mode_t) > 0) {
const path_z = try allocator.dupeZ(u8, path);
defer allocator.free(path_z);
_ = std.c.chmod(path_z.ptr, 0o700);
}
},
else => return err,
};
}
fn pathExists(io: std.Io, absolute_path: []const u8) bool {
var dir = std.Io.Dir.openDirAbsolute(io, absolute_path, .{}) catch return false;
defer dir.close(io);
return true;
}
// Returns every existing pets root in priority order. Callers must
// own and free the inner slices. Empty result means no canonical
// pets root exists at all (fresh install, or HOME without .petdex
// or .codex). Existing-but-empty roots are still returned — the
// caller filters via listPetsAcrossRoots.
//
// Why not the old "first existing" behavior: an empty/broken
// ~/.petdex/pets dir (left over from an aborted install, for
// example) used to mask a populated ~/.codex/pets, and the binary
// would exit "No pets". Reading both roots and merging fixes that.
fn resolvePetsRoots(allocator: std.mem.Allocator, io: std.Io, env_map: *std.process.Environ.Map) ![][]u8 {
const home = env_map.get("HOME") orelse return error.NoHome;
var roots: std.ArrayList([]u8) = .empty;
errdefer {
for (roots.items) |r| allocator.free(r);
roots.deinit(allocator);
}
const petdex_path = try std.fs.path.join(allocator, &.{ home, ".petdex", "pets" });
if (pathExists(io, petdex_path)) {
try roots.append(allocator, petdex_path);
} else {
allocator.free(petdex_path);
}
const codex_path = try std.fs.path.join(allocator, &.{ home, ".codex", "pets" });
if (pathExists(io, codex_path)) {
try roots.append(allocator, codex_path);
} else {
allocator.free(codex_path);
}
return roots.toOwnedSlice(allocator);
}
fn resolveConfigDir(allocator: std.mem.Allocator, io: std.Io, env_map: *std.process.Environ.Map) ![]u8 {
const home = env_map.get("HOME") orelse return error.NoHome;
const dir = try std.fs.path.join(allocator, &.{ home, ".petdex" });
try ensureDir(io, dir);
return dir;
}
fn resolveSidecarDir(allocator: std.mem.Allocator, env_map: *std.process.Environ.Map) ![]u8 {
// Local development override: lets the author run the binary against
// the in-tree sidecar without copying server.js to ~/.petdex/sidecar/.
if (env_map.get("PETDEX_SIDECAR_DIR")) |override| {
return try allocator.dupe(u8, override);
}
// .app bundle: when shipped as Petdex.app the sidecar is bundled at
// Contents/Resources/sidecar/ so the user doesn't need a separate
// `petdex install desktop` step. We detect this by checking whether
// the executable lives at .../Contents/MacOS/ — a path that
// can only exist inside an .app — and resolve sidecar relative to
// that.
if (try resolveBundledSidecarDir(allocator)) |bundled| return bundled;
// Bare-binary install path (legacy v0.1.0): the CLI installs the
// sidecar bundle at ~/.petdex/sidecar/server.js.
const home = env_map.get("HOME") orelse return error.NoHome;
return try std.fs.path.join(allocator, &.{ home, ".petdex", "sidecar" });
}
// Returns Contents/Resources/sidecar IFF the running executable is
// inside an .app bundle. Otherwise returns null and the caller falls
// back to the legacy ~/.petdex/sidecar path.
fn resolveBundledSidecarDir(allocator: std.mem.Allocator) !?[]u8 {
var path_buf: [std.fs.max_path_bytes]u8 = undefined;
var size: u32 = path_buf.len;
// Darwin-specific. _NSGetExecutablePath fills the buffer with the
// path of the running executable. Returns 0 on success; -1 means
// size was too small (we never hit that with max_path_bytes).
if (std.c._NSGetExecutablePath(&path_buf, &size) != 0) return null;
// Find the NUL byte and slice to the actual length.
const exe_path = std.mem.sliceTo(@as([*:0]u8, @ptrCast(&path_buf)), 0);
// Look for ".app/Contents/MacOS/" anywhere in the path.
const needle = "/Contents/MacOS/";
const idx = std.mem.indexOf(u8, exe_path, needle) orelse return null;
const contents_root = exe_path[0 .. idx + "/Contents".len];
return try std.fs.path.join(allocator, &.{ contents_root, "Resources", "sidecar" });
}
fn readActiveSlug(allocator: std.mem.Allocator, io: std.Io, config_dir: []const u8) !?[]u8 {
const path = try std.fs.path.join(allocator, &.{ config_dir, "active.json" });
defer allocator.free(path);
var file = std.Io.Dir.openFileAbsolute(io, path, .{}) catch return null;
defer file.close(io);
const bytes = try readFileAll(io, allocator, file, MAX_ACTIVE_BYTES);
defer allocator.free(bytes);
const slug = jsonStringField(bytes, "slug") orelse return null;
return try allocator.dupe(u8, slug);
}
fn writeActiveSlug(io: std.Io, config_dir: []const u8, slug: []const u8) !void {
var dir = try std.Io.Dir.openDirAbsolute(io, config_dir, .{});
defer dir.close(io);
var buf: [512]u8 = undefined;
const json_text = try std.fmt.bufPrint(&buf, "{{\"slug\":\"{s}\"}}\n", .{slug});
try writeFileAll(io, dir, "active.json", json_text);
}
fn isValidSlug(slug: []const u8) bool {
if (slug.len == 0 or slug.len > MAX_SLUG_LEN) return false;
for (slug) |ch| {
const ok = (ch >= 'a' and ch <= 'z') or
(ch >= 'A' and ch <= 'Z') or
(ch >= '0' and ch <= '9') or
ch == '-' or ch == '_';
if (!ok) return false;
}
return true;
}
fn freeDeepLink(allocator: std.mem.Allocator, deeplink: DeepLink) void {
switch (deeplink) {
.none => {},
.activate => |slug| allocator.free(slug),
.install => |slugs| {
var owned = slugs;
for (owned.items) |s| allocator.free(s);
owned.deinit(allocator);
},
}
}
fn readDeepLinkFromPath(allocator: std.mem.Allocator, io: std.Io, path: []const u8) !DeepLink {
var file = std.Io.Dir.openFileAbsolute(io, path, .{}) catch return DeepLink{ .none = {} };
defer file.close(io);
const bytes = readFileAll(io, allocator, file, MAX_ACTIVE_BYTES) catch return DeepLink{ .none = {} };
defer allocator.free(bytes);
return parseDeepLinkFromUrl(allocator, bytes) catch DeepLink{ .none = {} };
}
fn readDeepLinkFromUrlFile(allocator: std.mem.Allocator, io: std.Io, env: *const std.process.Environ.Map) !DeepLink {
const home = env.get("HOME") orelse return DeepLink{ .none = {} };
const path = try std.fs.path.join(allocator, &.{ home, ".petdex-desktop", "runtime", "incoming-url.txt" });
defer allocator.free(path);
const deeplink = try readDeepLinkFromPath(allocator, io, path);
std.Io.Dir.deleteFileAbsolute(io, path) catch {};
return deeplink;
}
fn readDeepLinkFromUrlArg(allocator: std.mem.Allocator, args: std.process.Args) !DeepLink {
var iter = std.process.Args.Iterator.initAllocator(args, allocator) catch return DeepLink{ .none = {} };
defer iter.deinit();
var idx: usize = 0;
while (iter.next()) |arg_z| : (idx += 1) {
if (idx == 0) continue;
const arg: []const u8 = arg_z;
const prefix = "petdex://";
if (arg.len <= prefix.len or !std.mem.startsWith(u8, arg, prefix)) continue;
return parseDeepLinkFromUrl(allocator, arg) catch DeepLink{ .none = {} };
}
return DeepLink{ .none = {} };
}
fn parseDeepLinkFromUrl(allocator: std.mem.Allocator, raw: []const u8) !DeepLink {
const trimmed = std.mem.trim(u8, raw, " \t\r\n");
const prefix = "petdex://";
if (trimmed.len <= prefix.len or !std.mem.startsWith(u8, trimmed, prefix)) {
return DeepLink{ .none = {} };
}
var rest = trimmed[prefix.len..];
if (std.mem.endsWith(u8, rest, "/")) rest = rest[0 .. rest.len - 1];
if (rest.len == 0) return DeepLink{ .none = {} };
const q_mark = std.mem.indexOfScalar(u8, rest, '?');
const path = if (q_mark) |i| rest[0..i] else rest;
const query = if (q_mark) |i| rest[i + 1 ..] else "";
if (std.mem.eql(u8, path, "install")) {
return try parseInstallSlugsFromQuery(allocator, query);
}
if (query.len > 0 or std.mem.indexOfScalar(u8, path, '/') != null) {
return DeepLink{ .none = {} };
}
if (!isValidSlug(path)) return DeepLink{ .none = {} };
return DeepLink{ .activate = try allocator.dupe(u8, path) };
}
fn parseInstallSlugsFromQuery(allocator: std.mem.Allocator, query: []const u8) !DeepLink {
var slugs: std.ArrayList([]const u8) = .empty;
errdefer {
for (slugs.items) |s| allocator.free(s);
slugs.deinit(allocator);
}
var pair_iter = std.mem.splitScalar(u8, query, '&');
while (pair_iter.next()) |pair| {
if (pair.len == 0) continue;
if (std.mem.startsWith(u8, pair, "slugs=")) {
const value = pair["slugs=".len..];
var decoded_buf: [MAX_SLUGS_QUERY_BYTES]u8 = undefined;
const csv = percentDecodeSlug(value, &decoded_buf) orelse value;
var slug_iter = std.mem.splitScalar(u8, csv, ',');
while (slug_iter.next()) |part| {
const slug = std.mem.trim(u8, part, " \t");
try appendInstallSlug(allocator, &slugs, slug);
}
} else if (std.mem.startsWith(u8, pair, "slug=")) {
const value = pair["slug=".len..];
var decoded: [MAX_SLUG_LEN + 8]u8 = undefined;
const slug = percentDecodeSlug(value, &decoded) orelse continue;
try appendInstallSlug(allocator, &slugs, slug);
}
}
if (slugs.items.len == 0) return DeepLink{ .none = {} };
return DeepLink{ .install = slugs };
}
fn appendInstallSlug(allocator: std.mem.Allocator, slugs: *std.ArrayList([]const u8), slug: []const u8) !void {
if (slugs.items.len >= MAX_INSTALL_SLUGS) return;
if (!isValidSlug(slug)) return;
for (slugs.items) |existing| {
if (std.mem.eql(u8, existing, slug)) return;
}
try slugs.append(allocator, try allocator.dupe(u8, slug));
}
fn hexNibble(c: u8) ?u4 {
if (c >= '0' and c <= '9') return @intCast(c - '0');
if (c >= 'a' and c <= 'f') return @intCast(c - 'a' + 10);
if (c >= 'A' and c <= 'F') return @intCast(c - 'A' + 10);
return null;
}
fn percentDecodeSlug(encoded: []const u8, out: []u8) ?[]const u8 {
var len: usize = 0;
var i: usize = 0;
while (i < encoded.len) : (i += 1) {
if (encoded[i] == '%' and i + 2 < encoded.len) {
const hi = hexNibble(encoded[i + 1]) orelse return null;
const lo = hexNibble(encoded[i + 2]) orelse return null;
if (len >= out.len) return null;
out[len] = @as(u8, hi) * 16 + @as(u8, lo);
len += 1;
i += 2;
} else {
if (len >= out.len) return null;
out[len] = encoded[i];
len += 1;
}
}
return out[0..len];
}
fn parseInstallSlugsFromPayload(allocator: std.mem.Allocator, payload: []const u8) !std.ArrayList([]const u8) {
var slugs: std.ArrayList([]const u8) = .empty;
errdefer {
for (slugs.items) |s| allocator.free(s);
slugs.deinit(allocator);
}
if (jsonStringField(payload, "slugs")) |csv| {
var iter = std.mem.splitScalar(u8, csv, ',');
while (iter.next()) |part| {
const slug = std.mem.trim(u8, part, " \t");
try appendInstallSlug(allocator, &slugs, slug);
}
}
if (slugs.items.len == 0) {
if (jsonStringField(payload, "slug")) |slug| {
try appendInstallSlug(allocator, &slugs, slug);
}
}
return slugs;
}
fn formatDeepLinkJson(allocator: std.mem.Allocator, deeplink: DeepLink, output: []u8) ![]const u8 {
switch (deeplink) {
.none => return std.fmt.bufPrint(output, "{{\"kind\":\"none\",\"slug\":\"\"}}", .{}),
.activate => |slug| return std.fmt.bufPrint(output, "{{\"kind\":\"activate\",\"slug\":\"{s}\"}}", .{slug}),
.install => |*slug_list| {
var buf: std.ArrayList(u8) = .empty;
defer buf.deinit(allocator);
try buf.appendSlice(allocator, "{\"kind\":\"install\",\"slug\":\"\",\"slugs\":[");
for (slug_list.items, 0..) |slug, i| {
if (i > 0) try buf.appendSlice(allocator, ",");
try buf.appendSlice(allocator, "\"");
try appendJsonEscaped(&buf, allocator, slug);
try buf.appendSlice(allocator, "\"");
}
try buf.appendSlice(allocator, "]}");
if (buf.items.len > output.len) return error.BufferTooSmall;
@memcpy(output[0..buf.items.len], buf.items);
return output[0..buf.items.len];
},
}
}
fn deepLinkToUrl(allocator: std.mem.Allocator, deeplink: DeepLink) !?[]u8 {
switch (deeplink) {
.none => return null,
.activate => |slug| return try std.fmt.allocPrint(allocator, "petdex://{s}", .{slug}),
.install => |*slug_list| {
var buf: std.ArrayList(u8) = .empty;
errdefer buf.deinit(allocator);
try buf.appendSlice(allocator, "petdex://install");
for (slug_list.items, 0..) |slug, i| {
if (i == 0) {
try buf.appendSlice(allocator, "?");
} else {
try buf.appendSlice(allocator, "&");
}
try buf.appendSlice(allocator, "slug=");
try buf.appendSlice(allocator, slug);
}
const slice = try buf.toOwnedSlice(allocator);
return slice;
},
}
}
fn writePendingDeepLink(io: std.Io, allocator: std.mem.Allocator, env: *const std.process.Environ.Map, deeplink: DeepLink) !void {
const url = try deepLinkToUrl(allocator, deeplink);
defer if (url) |u| allocator.free(u);
const url_text = url orelse return;
const home = env.get("HOME") orelse return;
const runtime_dir = try std.fs.path.join(allocator, &.{ home, ".petdex-desktop", "runtime" });
defer allocator.free(runtime_dir);
try ensurePrivateDir(allocator, io, runtime_dir);
const path = try std.fs.path.join(allocator, &.{ runtime_dir, "pending-deeplink.txt" });
defer allocator.free(path);
var file = try std.Io.Dir.createFileAbsolute(io, path, .{ .truncate = true });
defer file.close(io);
try file.writePositionalAll(io, url_text, 0);
}
// True only if the pet directory contains a readable sprite file.
// listPets() and the bridge picker rely on this so that an incomplete
// install (e.g. an aborted `petdex install` that left a slug folder
// without a spritesheet) is filtered out instead of becoming a
// startup-killing default. Without this guard, sorting by slug could
// pick the broken pet first; setActiveCmd would also persist it to
// active.json before loadSpritesheet failed, poisoning future
// launches until the user manually edited the file.
// True only if the pet has a spritesheet file that loadSpritesheet
// could actually read — that is, present AND within MAX_PET_BYTES.
// Just checking openFile() would let a 50 MB spritesheet.webp pass
// the listing filter, sort to the top alphabetically, and then
// crash startup with FileTooLarge at main()'s loadSpritesheet call.
// Mirroring the size cap here keeps the listing in lockstep with
// what the loader can actually consume.
fn hasSpritesheet(io: std.Io, parent: std.Io.Dir, slug: []const u8) bool {
var pet_dir = parent.openDir(io, slug, .{}) catch return false;
defer pet_dir.close(io);
if (checkSpritesheetVariant(io, pet_dir, slug, "spritesheet.webp")) return true;
if (checkSpritesheetVariant(io, pet_dir, slug, "spritesheet.png")) return true;
return false;
}
// Helper extracted from hasSpritesheet because Zig 0.16 forbids
// `defer file.close()` inside an `inline for` body — the defer is
// runtime, the loop is comptime, and the mix produces "comptime
// control flow inside runtime block". Folding the body into a
// regular fn keeps each variant's defer scope clean.
fn checkSpritesheetVariant(
io: std.Io,
pet_dir: std.Io.Dir,
slug: []const u8,
name: []const u8,
) bool {
var file = pet_dir.openFile(io, name, .{}) catch return false;
defer file.close(io);
const stat = file.stat(io) catch return false;
if (stat.size > MAX_PET_BYTES) {
std.debug.print(
"Skipping pet '{s}': {s} is {d} bytes, exceeds {d} byte cap\n",
.{ slug, name, stat.size, MAX_PET_BYTES },
);
return false;
}
return true;
}
fn listPets(allocator: std.mem.Allocator, io: std.Io, pets_dir: []const u8) !std.ArrayList(Pet) {
var dir = try std.Io.Dir.openDirAbsolute(io, pets_dir, .{ .iterate = true });
defer dir.close(io);
return listPetsFromDir(allocator, io, dir, pets_dir);
}
// Iterates each root in priority order and returns the merged list.
// Slug conflicts (same slug installed in BOTH .petdex and .codex)
// resolve to the first occurrence — i.e. .petdex wins, since it
// comes first in resolvePetsRoots. This matches the CLI install
// behavior: `petdex install ` writes to both roots, so they
// should hold byte-identical copies and which root we pick from
// doesn't matter when both have it. When only one root has it, we
// surface that root's pet.
fn listPetsAcrossRoots(
allocator: std.mem.Allocator,
io: std.Io,
roots: []const []u8,
) !std.ArrayList(Pet) {
var pets: std.ArrayList(Pet) = .empty;
errdefer {
for (pets.items) |p| {
allocator.free(p.slug);
allocator.free(p.display_name);
allocator.free(p.root);
}
pets.deinit(allocator);
}
var seen_slugs: std.StringHashMap(void) = .init(allocator);
defer seen_slugs.deinit();
for (roots) |root_path| {
var dir = std.Io.Dir.openDirAbsolute(io, root_path, .{ .iterate = true }) catch continue;
defer dir.close(io);
var iter = dir.iterate();
while (try iter.next(io)) |entry| {
if (entry.kind != .directory) continue;
if (seen_slugs.contains(entry.name)) continue;
if (!hasSpritesheet(io, dir, entry.name)) {
std.debug.print(
"Skipping pet '{s}' in {s}: no spritesheet.webp or spritesheet.png\n",
.{ entry.name, root_path },
);
continue;
}
const slug = try allocator.dupe(u8, entry.name);
errdefer allocator.free(slug);
const display_name = try readDisplayName(allocator, io, dir, entry.name) orelse try allocator.dupe(u8, entry.name);
errdefer allocator.free(display_name);
const root_copy = try allocator.dupe(u8, root_path);
errdefer allocator.free(root_copy);
try pets.append(allocator, .{
.slug = slug,
.display_name = display_name,
.root = root_copy,
});
try seen_slugs.put(slug, {});
}
}
std.mem.sort(Pet, pets.items, {}, petLessThan);
return pets;
}
// Same as listPets but takes an already-open Dir. Split out so tests
// can drive it against a tmpDir without going through realpath() to
// recover an absolute path. Production code paths through listPets
// and listPetsAcrossRoots; the picker filtering and skip-logging
// behavior live here.
fn listPetsFromDir(allocator: std.mem.Allocator, io: std.Io, dir: std.Io.Dir, root_path: []const u8) !std.ArrayList(Pet) {
var pets: std.ArrayList(Pet) = .empty;
errdefer {
for (pets.items) |p| {
allocator.free(p.slug);
allocator.free(p.display_name);
allocator.free(p.root);
}
pets.deinit(allocator);
}
var iter = dir.iterate();
while (try iter.next(io)) |entry| {
if (entry.kind != .directory) continue;
// Skip entries without a usable sprite. Logging the skip is
// helpful when a user wonders why their freshly-installed pet
// doesn't show up in the picker.
if (!hasSpritesheet(io, dir, entry.name)) {
std.debug.print(
"Skipping pet '{s}': no spritesheet.webp or spritesheet.png\n",
.{entry.name},
);
continue;
}
const slug = try allocator.dupe(u8, entry.name);
errdefer allocator.free(slug);
const display_name = try readDisplayName(allocator, io, dir, entry.name) orelse try allocator.dupe(u8, entry.name);
errdefer allocator.free(display_name);
const root_copy = try allocator.dupe(u8, root_path);
try pets.append(allocator, .{
.slug = slug,
.display_name = display_name,
.root = root_copy,
});
}
std.mem.sort(Pet, pets.items, {}, petLessThan);
return pets;
}
fn petLessThan(_: void, a: Pet, b: Pet) bool {
return std.mem.lessThan(u8, a.slug, b.slug);
}
// pet.json is typically ~200 bytes (slug + displayName + a few
// optional metadata fields), but it's user-authored and not strictly
// validated, so we leave headroom for hand-edited files with longer
// descriptions. 32 KB is generous enough that no real pet.json will
// hit it and small enough to bound a malformed file's read time.
const MAX_PET_JSON_BYTES: usize = 32 * 1024;
// display_name is optional — every caller falls back to the slug
// when this returns null. So any failure (oversized file, truncated
// read, parse error, transient I/O) MUST be downgraded to null
// rather than propagated, otherwise one bad pet.json on disk would
// fail listPetsAcrossRoots entirely and prevent the desktop from
// starting even when an unrelated pet is the active one.
fn readDisplayName(allocator: std.mem.Allocator, io: std.Io, parent: std.Io.Dir, slug: []const u8) !?[]u8 {
const path = std.fs.path.join(allocator, &.{ slug, "pet.json" }) catch return null;
defer allocator.free(path);
var file = parent.openFile(io, path, .{}) catch return null;
defer file.close(io);
const bytes = readFileAll(io, allocator, file, MAX_PET_JSON_BYTES) catch return null;
defer allocator.free(bytes);
const display = jsonStringField(bytes, "displayName") orelse return null;
return allocator.dupe(u8, display) catch null;
}
// Sprite payload returned by both loadSpritesheet and
// loadSpritesheetAcrossRoots. Named struct so Zig keeps a single
// nominal type instead of two anonymous structs that can't be
// interchanged.
const SpritePayload = struct { ext: []const u8, bytes: []u8 };
// Find the slug across all roots in priority order, return the
// first sprite that loads. Used by setActiveCmd because the slug
// the picker handed us could live in either ~/.petdex/pets or
// ~/.codex/pets and we don't carry the source root through the
// bridge invocation payload.
fn loadSpritesheetAcrossRoots(
allocator: std.mem.Allocator,
io: std.Io,
roots: []const []u8,
slug: []const u8,
) !SpritePayload {
for (roots) |root_path| {
if (loadSpritesheet(allocator, io, root_path, slug)) |sprite| {
return sprite;
} else |_| {
// Try the next root.
}
}
return error.NoSpritesheet;
}
fn loadSpritesheet(allocator: std.mem.Allocator, io: std.Io, pets_dir: []const u8, slug: []const u8) !SpritePayload {
var dir = try std.Io.Dir.openDirAbsolute(io, pets_dir, .{});
defer dir.close(io);
var pet_dir = try dir.openDir(io, slug, .{});
defer pet_dir.close(io);
if (pet_dir.openFile(io, "spritesheet.webp", .{})) |file| {
defer file.close(io);
return .{ .ext = "webp", .bytes = try readFileAll(io, allocator, file, MAX_PET_BYTES) };
} else |_| {}
if (pet_dir.openFile(io, "spritesheet.png", .{})) |file| {
defer file.close(io);
return .{ .ext = "png", .bytes = try readFileAll(io, allocator, file, MAX_PET_BYTES) };
} else |_| {}
return error.NoSpritesheet;
}
fn copyAllSpritesheets(allocator: std.mem.Allocator, io: std.Io, asset_root: []const u8, pets: []const Pet) !void {
var root_dir = try std.Io.Dir.openDirAbsolute(io, asset_root, .{});
defer root_dir.close(io);
var copied: u32 = 0;
var skipped: u32 = 0;
for (pets) |p| {
const abs_sub = try std.fs.path.join(allocator, &.{ asset_root, p.slug });
defer allocator.free(abs_sub);
ensureDir(io, abs_sub) catch {};
// Each pet now carries the absolute root it lives under, so
// the freshness check + sprite read use that root directly
// instead of assuming a single global pets_dir.
if (isSpritesheetFresh(allocator, io, p.root, abs_sub, p.slug)) {
skipped += 1;
continue;
}
const sprite = loadSpritesheet(allocator, io, p.root, p.slug) catch continue;
defer allocator.free(sprite.bytes);
var sub_dir = std.Io.Dir.openDirAbsolute(io, abs_sub, .{}) catch continue;
defer sub_dir.close(io);
const sprite_name = if (std.mem.eql(u8, sprite.ext, "png")) "spritesheet.png" else "spritesheet.webp";
writeFileAll(io, sub_dir, sprite_name, sprite.bytes) catch {};
if (!std.mem.eql(u8, sprite.ext, "webp")) {
writeFileAll(io, sub_dir, "spritesheet.webp", sprite.bytes) catch {};
}
copied += 1;
}
std.debug.print("Spritesheets: {d} copied, {d} cached\n", .{ copied, skipped });
}
fn isSpritesheetFresh(allocator: std.mem.Allocator, io: std.Io, pets_dir: []const u8, cached_dir: []const u8, slug: []const u8) bool {
const cached_path = std.fs.path.join(allocator, &.{ cached_dir, "spritesheet.webp" }) catch return false;
defer allocator.free(cached_path);
var cached_file = std.Io.Dir.openFileAbsolute(io, cached_path, .{}) catch return false;
defer cached_file.close(io);
const cached_stat = cached_file.stat(io) catch return false;
const source_dir = std.fs.path.join(allocator, &.{ pets_dir, slug }) catch return false;
defer allocator.free(source_dir);
inline for (.{ "spritesheet.webp", "spritesheet.png" }) |name| {
const source_path = std.fs.path.join(allocator, &.{ source_dir, name }) catch return false;
defer allocator.free(source_path);
if (std.Io.Dir.openFileAbsolute(io, source_path, .{})) |source_file| {
defer source_file.close(io);
const source_stat = source_file.stat(io) catch return false;
return cached_stat.mtime.nanoseconds >= source_stat.mtime.nanoseconds;
} else |_| {}
}
return false;
}
fn buildPetdexJson(allocator: std.mem.Allocator, pets: []const Pet, active_slug: []const u8) ![]u8 {
var buf: std.ArrayList(u8) = .empty;
errdefer buf.deinit(allocator);
try buf.appendSlice(allocator, "{\"pets\":[");
for (pets, 0..) |p, i| {
if (i > 0) try buf.appendSlice(allocator, ",");
try buf.appendSlice(allocator, "{\"slug\":\"");
try appendJsonEscaped(&buf, allocator, p.slug);
try buf.appendSlice(allocator, "\",\"displayName\":\"");
try appendJsonEscaped(&buf, allocator, p.display_name);
try buf.appendSlice(allocator, "\"}");
}
try buf.appendSlice(allocator, "],\"active\":\"");
try appendJsonEscaped(&buf, allocator, active_slug);
const dims = try std.fmt.allocPrint(allocator, "\",\"compactWidth\":{d},\"compactHeight\":{d},\"menuWidth\":{d},\"menuHeight\":{d}}}", .{
@as(u32, @intFromFloat(WINDOW_W)),
@as(u32, @intFromFloat(WINDOW_H)),
MENU_W,
MENU_H,
});
defer allocator.free(dims);
try buf.appendSlice(allocator, dims);
return buf.toOwnedSlice(allocator);
}
fn appendJsonEscaped(buf: *std.ArrayList(u8), allocator: std.mem.Allocator, s: []const u8) !void {
// JSON-escape plus HTML/script-context defenses:
// - `<` becomes `<` so `` inside a string can never close
// the surrounding