mirror of https://github.com/colbymchenry/codegraph.git synced 2026-10-24 19:30:10 +08:00

Files

T

Colby MchenryandClaude Opus 5.5 b8c3c032be fix(bundle): bundle Node 24.22.1, the October security release, and verify the download (#2817 )

Release bundles were set to ship Node 24.21.0. The release workflow runs
build-bundle.sh with no version, so the script's default decides the Node
every bundle carries, and that default predates Node's October 2026
security release. v24.22.1 (2026-10-20) fixes 8 CVEs, 4 rated High (TLS,
DNS, Brotli), and ships OpenSSL 3.5.9. It keeps V8 13.6.233.17, libuv
1.52.1 and module ABI 137, and it carries 24.20.0's fix for the Windows
abort at exit (issue #2617). The script also never checked the Node
download against the SHA-256 sums nodejs.org publishes.

Fix:
- The default and the usage example move to v24.22.1. The comment and a
  new test hold the default at 24.22.1 or later, on 24.x.
- Step 1 downloads the release's SHASUMS256.txt and refuses the archive,
  before unpacking anything, unless its SHA-256 matches the listed one.
  The zip and tar.gz downloads now share that one code path (sha256sum,
  or shasum on macOS).
- The unreleased CHANGELOG bullet for issue #2617 now names 24.22.1 and
  the check. BUNDLING.md describes the check.

Validation (Windows 11 x64):
- bundle-launcher.test.ts: 4 new tests (the version floor; a matching
  download is unpacked; a mismatched or unlisted one is refused before
  unpacking). With main's build-bundle.sh all 4 fail; with the fix the
  file has 7 passed and 3 POSIX-only skipped.
- build-bundle.sh win32-x64 with the new default: the check passed
  (sha256 d2046d28...8b95fa5, as listed). The bundled node.exe is
  byte-identical to the official v24.22.1 one and prints v24.22.1
  (OpenSSL 3.5.9). Its launchers from Git Bash, cmd and PowerShell, with
  no system Node on PATH, ran --version, init, status, query, callers and
  sync on a small TypeScript + Python fixture: all exit 0.
- Node's own reproducer for the exit abort, 300 runs per mode, 4 at a
  time: the bundled v24.22.1 exited cleanly 300/300 in all three modes.
  The official v24.16.0 control aborted 299/300 with 0xC0000409 when the
  child ran directly.
- 13 runtime-facing test files (sqlite, wasm flags, worker and stdin
  teardown, watcher, launcher, shim) run on the bundled node.exe: 136
  passed, 22 skipped, 0 failed.

Fixes #2780

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-22 23:32:10 +00:00

3.9 KiB

Raw Blame History

Distribution: self-contained bundles

CodeGraph ships a vendored Node runtime alongside the app. Because Node 22.5+ has a built-in real SQLite (node:sqlite, with WAL + FTS5), bundling Node means:

No native build — better-sqlite3 is gone, so there are zero native addons to compile or rebuild.
No wasm fallback — and therefore no more database is locked (issue #238).
No Node-version dependence — the app always runs on the bundled Node, whatever the user has (or doesn't have) installed.

What's in a bundle

Built by scripts/build-bundle.sh — one archive per platform, identical recipe (only the Node download differs):

codegraph-<target>/
  node | node.exe          # official Node runtime for <target>
  lib/
    dist/                  # compiled app (+ tree-sitter .wasm grammars, schema.sql)
    node_modules/          # production deps only (pure JS / wasm — portable)
  bin/
    codegraph | codegraph.cmd   # launcher → runs the bundled Node with the app

Targets: darwin-arm64, darwin-x64, linux-x64, linux-arm64, win32-x64, win32-arm64. Unix targets produce .tar.gz (shell launcher); Windows produces .zip (node.exe + a .cmd launcher).

scripts/build-bundle.sh linux-x64            # -> release/codegraph-linux-x64.tar.gz
scripts/build-bundle.sh win32-x64            # -> release/codegraph-win32-x64.zip

The Node runtime is the official nodejs.org release named by the script's default NODE_VERSION (or its second argument). The download is refused unless it matches the SHA-256 listed in that release's SHASUMS256.txt.

Because dropping better-sqlite3 left zero native addons, building a bundle is pure file-packaging — any target builds on any OS (the whole matrix builds on one Linux runner). Cross-compilation isn't a concern; only run-testing a bundle needs the target platform (or emulation, e.g. docker run --platform linux/amd64).

Install channels (all deliver the same bundle)

curl | sh (install.sh) — no Node required; ideal for a fresh Linux VPS over SSH. Detects os/arch, pulls the archive from GitHub Releases, symlinks codegraph onto PATH. Re-run to upgrade; --uninstall to remove.
npm (scripts/npm-shim.js) — preserves npm i -g @colbymchenry/codegraph. The main package is a tiny shim; the bundles ship as per-platform optionalDependencies (@colbymchenry/codegraph-<target> with os/cpu), so npm installs only the matching one. The shim — run by the user's Node — execs the bundle, so the real work runs on the bundled Node 24. Works even on old Node. On Windows it invokes the bundled node.exe against the app entry directly (not the .cmd launcher) — modern Node throws EINVAL when asked to spawn a .cmd/.bat.
Windows (install.ps1) — irm … | iex; same flow as install.sh (detect arch, pull the .zip from Releases, add to PATH).
Homebrew / Scoop — TODO (tap + cask pointing at the Release archives).

Release pipeline

.github/workflows/release.yml — manually triggered. Reads the version from package.json, builds every platform bundle on one runner, creates the GitHub Release (notes from CHANGELOG.md), and publishes the npm shim + per-platform packages. Requires the NPM_TOKEN repo secret.

Still TODO:

Code signing — the main gap for "download & run": macOS Gatekeeper needs a Developer ID + notarization; Windows needs Authenticode. Homebrew softens the macOS case (handles quarantine).
Retire the now-vestigial Node-version gate in src/bin/codegraph.ts — the bundle always runs Node 24, and the npm shim does no tree-sitter work.
Re-wire npm uninstall cleanup (the agent-config preuninstall) through the shim — the generated main package doesn't carry it.

3.9 KiB Raw Blame History

Distribution: self-contained bundles

What's in a bundle

Install channels (all deliver the same bundle)

Release pipeline

3.9 KiB

Raw Blame History