MS7 — Distribution & Release: npx nirmiqcodesensei, CHANGELOG, scaling-N/A ADR#10
Merged
Conversation
Turns the repo into distributable software. The old launcher assumed a repo checkout and ran `next dev`; the package was `private: true` and MS6's standalone build was never shipped. Verified end to end by installing the real tarball into an empty directory: HTTP 200, runtime-migrated DB, MCP handshake. Design: ship the prebuilt standalone server, let npm resolve native modules per platform. scripts/pack-standalone.mjs assembles dist/ (standalone + .next/static), strips the build machine's native binaries, and hard-fails if a database, dotenv, git history or .node binary reaches the bundle. Five bugs found only by installing the tarball, each of which would have shipped a broken or unsafe 1.0: - File tracing copies data/ into .next/standalone — the local database *and* the user's imported projects, including their .git. outputFileTracingExcludes does not stop it (tried; zero effect), so the pack script filters at copy time and asserts. Publishing would have leaked third-party source. - Standalone server.js does process.chdir(__dirname), so the DB resolved to node_modules/nirmiqcodesensei/dist/data/ — every `npx …@latest` would have silently wiped the user's learning history. The launcher now pins NCS_DATA_DIR to the invoking cwd (the hook lib/db/client.ts already had). - server.js defaults HOSTNAME to 0.0.0.0, exposing a 127.0.0.1-only product across the LAN. Launcher pins the loopback. - The tracer copies the repo's .gitignore into the bundle; npm honours nested ignore files, so node_modules/ and .next/ were dropped from the tarball — publish succeeds, every install boots a server with nothing behind it. - Turbopack requires serverExternalPackages by *hashed* name (better-sqlite3-90e2652d…), so deleting it 500s every request. Replaced with a shim delegating to the platform-correct copy npm installs. MCP now works from a published install: bundled with esbuild at prepack (CJS — an ESM bundle crashes on typescript-estree's __filename), and its banner moved to stderr so stdout stays pure JSON-RPC. Also: fileURLToPath for ROOT (%20 broke "C:\Program Files"), shell:false for direct node spawns (space-safe args), and lint ignores dist/ (eslint OOM-crashed walking the 12 MB bundle). Version 1.0.0 across package, MCP serverInfo, manifest. Gate: lint + typecheck + build + 24/24 green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Completes MS7's documentation criteria and closes out the REVIEW-011 megasprint program. - CHANGELOG.md (Keep a Changelog) — first release entry for 1.0.0, leading with `npx nirmiqcodesensei@latest` and naming the distribution bugs that would otherwise have shipped. - REVIEW-013 — the scaling-N/A ADR REVIEW-011 asked for: load balancing, horizontal scaling and traffic handling are out of scope *by design*, not deferred. A single-user, loopback-bound tool over a single-writer embedded SQLite database has no traffic to distribute and no replicas to balance; a second instance would contend for the WAL lock or fragment the user's history. Scaling here means per-machine analysis performance, which is measured (BENCHMARKS.md). Revisit only on a move to a hosted model — and re-architect the data tier first, which is the actual blocker. - README leads with the npx path; MCP config uses `npx nirmiqcodesensei mcp` (the old `npm run mcp` + cwd form only works from a clone). - Roadmap MS7 → ✅; REVIEW-011 → complete. - PROJECT_DOSSIER: MS7 outcome, status, and a new §7 subsection on the distribution class of bugs — none were visible to lint, typecheck, build or 24 passing tests; all five surfaced only from installing the real tarball. That is now the recorded verification step for packaging changes. Gate: lint + typecheck + build + 24/24 green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final megasprint of the REVIEW-011 program. Turns the repo into installable software.
What lands
npx nirmiqcodesensei— ships MS6's standalone build.scripts/pack-standalone.mjsassemblesdist/(standalone +.next/static), strips the build machine's native binaries, and hard-fails if a database, dotenv, git history or.nodebinary reaches the bundle.Verified, not asserted
Installed the real tarball into an empty directory:
/dashboard,/workspaces,/workspaces/importnode_modules.node/.git/ imported projects127.0.0.1onlyFive ship-blockers a green build could not see
Every one was invisible to lint, typecheck, build and 24 passing tests:
data/into the bundle: the local database and the user's imported projects, including their.git.outputFileTracingExcludesdoes not stop it (tried; zero effect). Publishing would have shipped a third party's source.server.jschdirs to its own dir, so the DB resolved tonode_modules/…/dist/data/. Everynpx …@latestwould have wiped the user's learning history.server.jsdefaultsHOSTNAMEto0.0.0.0on a 127.0.0.1-only product..gitignoremade npm dropnode_modules/and.next/from the tarball.npm publishwould have succeeded.better-sqlite3broke it. Replaced with a shim delegating to the platform-correct copy.Plus: MCP banner corrupting the JSON-RPC stream, an ESM bundle crashing on
__filename,%20in install paths, and eslint OOM-crashing ondist/.Gate
lint + typecheck + build + 24/24.
Not in this PR
The v1.0.0 tag and GitHub Release await explicit go-ahead;
npm publishis the maintainer's to run.🤖 Generated with Claude Code