fix: guard packaged AstrBot runtime version

scripts/prepare-resources.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url';
 import {
   readAstrbotVersionFromPyproject,
   syncDesktopVersionFiles,
+  validateAstrbotRuntimeVersion,
 } from './prepare-resources/version-sync.mjs';
 import {
   ensureSourceRepo,
@@ -60,6 +61,10 @@ const main = async () => {
   const astrbotVersion =
     desktopVersionOverride || (await readAstrbotVersionFromPyproject({ sourceDir }));
 
+  if (!desktopVersionOverride) {
+    await validateAstrbotRuntimeVersion({ sourceDir, expectedVersion: astrbotVersion });
+  }
+
   if (desktopVersionOverride && needsSourceRepo) {
     const sourceVersion = await readAstrbotVersionFromPyproject({ sourceDir });
     if (sourceVersion !== desktopVersionOverride) {

scripts/prepare-resources/version-sync.mjs

@@ -49,6 +49,37 @@ export const readAstrbotVersionFromPyproject = async ({ sourceDir }) => {
   throw new Error(`Cannot resolve [project].version from ${pyprojectPath}`);
 };
 
+export const readAstrbotRuntimeVersion = async ({ sourceDir }) => {
+  const defaultConfigPath = path.join(sourceDir, 'astrbot', 'core', 'config', 'default.py');
+  if (!existsSync(defaultConfigPath)) {
+    throw new Error(`Cannot find AstrBot runtime version file: ${defaultConfigPath}`);
+  }
+
+  const content = await readFile(defaultConfigPath, 'utf8');
+  const match = /^\s*VERSION\s*=\s*["']([^"']+)["']\s*(?:#.*)?$/m.exec(content);
+  if (!match) {
+    throw new Error(`Cannot resolve AstrBot runtime VERSION from ${defaultConfigPath}`);
+  }
+
+  return match[1].trim();
+};
+
+export const validateAstrbotRuntimeVersion = async ({ sourceDir, expectedVersion }) => {
+  const runtimeVersion = await readAstrbotRuntimeVersion({ sourceDir });
+  if (runtimeVersion === '0.0.0') {
+    throw new Error(
+      `AstrBot runtime VERSION resolved to 0.0.0 in ${sourceDir}. Use an AstrBot source ref that contains the static runtime VERSION fix.`,
+    );
+  }
+  if (runtimeVersion !== expectedVersion) {
+    throw new Error(
+      `AstrBot version mismatch in ${sourceDir}: pyproject.toml has ${expectedVersion}, but runtime VERSION is ${runtimeVersion}.`,
+    );
+  }
+
+  return runtimeVersion;
+};
+
 const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 const CARGO_LOCK_PACKAGE_HEADER = /^\s*\[\[package\]\]\s*(?:#.*)?$/;
 const CARGO_LOCK_ANY_HEADER = /^\s*\[\[/;

scripts/prepare-resources/version-sync.test.mjs

@@ -7,8 +7,10 @@ import assert from 'node:assert/strict';
 import {
   DESKTOP_TAURI_CRATE_NAME,
   normalizeDesktopVersionOverride,
+  readAstrbotRuntimeVersion,
   readAstrbotVersionFromPyproject,
   syncDesktopVersionFiles,
+  validateAstrbotRuntimeVersion,
 } from './version-sync.mjs';
 
 const createTempDesktopProject = async ({ cargoLockContents, version = '0.1.0' }) => {
@@ -39,6 +41,23 @@ const createTempDesktopProject = async ({ cargoLockContents, version = '0.1.0' }
   return { tempDir, srcTauriDir };
 };
 
+const createTempAstrBotSource = async ({ pyprojectVersion = '1.2.3', runtimeVersion = '1.2.3' }) => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), 'astrbot-source-'));
+  const configDir = path.join(tempDir, 'astrbot', 'core', 'config');
+  await mkdir(configDir, { recursive: true });
+  await writeFile(
+    path.join(tempDir, 'pyproject.toml'),
+    `[project]\nname = "AstrBot"\nversion = "${pyprojectVersion}"\n`,
+    'utf8',
+  );
+  await writeFile(
+    path.join(configDir, 'default.py'),
+    `import os\n\nVERSION = "${runtimeVersion}"\n`,
+    'utf8',
+  );
+  return tempDir;
+};
+
 test('normalizeDesktopVersionOverride trims and strips leading v', () => {
   assert.equal(normalizeDesktopVersionOverride(' v1.2.3 '), '1.2.3');
   assert.equal(normalizeDesktopVersionOverride('2.0.0'), '2.0.0');
@@ -68,6 +87,44 @@ version = "1.9.1"
   }
 });
 
+test('readAstrbotRuntimeVersion reads static VERSION from default.py', async () => {
+  const tempDir = await createTempAstrBotSource({ runtimeVersion: '4.26.0-beta.10' });
+  try {
+    const version = await readAstrbotRuntimeVersion({ sourceDir: tempDir });
+    assert.equal(version, '4.26.0-beta.10');
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('validateAstrbotRuntimeVersion rejects 0.0.0 runtime version', async () => {
+  const tempDir = await createTempAstrBotSource({ runtimeVersion: '0.0.0' });
+  try {
+    await assert.rejects(
+      validateAstrbotRuntimeVersion({ sourceDir: tempDir, expectedVersion: '4.26.0-beta.10' }),
+      /runtime VERSION resolved to 0\.0\.0/,
+    );
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('validateAstrbotRuntimeVersion rejects runtime version drift', async () => {
+  const tempDir = await createTempAstrBotSource({
+    pyprojectVersion: '4.26.0-beta.10',
+    runtimeVersion: '4.26.0-beta.9',
+  });
+  try {
+    const expectedVersion = await readAstrbotVersionFromPyproject({ sourceDir: tempDir });
+    await assert.rejects(
+      validateAstrbotRuntimeVersion({ sourceDir: tempDir, expectedVersion }),
+      /pyproject\.toml has 4\.26\.0-beta\.10, but runtime VERSION is 4\.26\.0-beta\.9/,
+    );
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
 test('syncDesktopVersionFiles updates package.json, tauri.conf.json, Cargo.toml and Cargo.lock', async () => {
   let tempDir;
   let srcTauriDir;