## Summary
One download per need, with fewer duplicate or unused assets:
| | Before | After |
|---|---|---|
| **Linux Electron** | portable `tar.gz` | **`.deb`** |
| **Linux Tauri** | `.deb` + AppImage | **AppImage** (self-updating) |
| **Windows Tauri** | ZIP wrapping the installer + the same installer as
`.exe` | **`.exe`** only |
| **Updater signatures** | `latest.json` + separate `.sig` assets |
**`latest.json` only** |
### Linux: Electron deb, Tauri AppImage
- The Electron deb installs as root, so electron-builder's post-install
script gives Chromium's `chrome-sandbox` the `root:root` ownership and
`4755` mode that a user-extracted archive cannot. Electron starts **with
its sandbox** and without any manual step. This fixes#541 properly.
- The package is named `codenomad` and **conflicts with / replaces** the
former Tauri deb (`code-nomad`). Both ship
`/usr/share/applications/CodeNomad.desktop`, so without this, installing
over an existing Tauri deb would fail on the shared file.
- The deb declares Electron's full runtime closure. electron-builder's
default `Depends` omit `libgbm1` and ALSA, which previously arrived only
through Recommends. ALSA is declared as `libasound2t64 | libasound2`,
because `libasound2` is a multi-provider virtual package on Ubuntu
24.04.
- Debian versions: dev builds (`<stable>-dev-<date>-<sha>`) become
`<stable>+dev.<date>.<HHMMSS commit time>.<sha>`, so they install as
upgrades after their stable base and in order on the same day; other
prereleases keep electron-builder's `~`, which sorts before the release.
The workflow rewrites the control `Version` with `dpkg-deb` when it
differs; PR and stable builds rewrite a copy to a synthetic dev version
and check that fields, files, modes, owners and control members are
preserved.
- Tauri Linux builds only the AppImage (`tauri build --bundles
appimage`).
- No unused electron-updater metadata is generated (`publish: null`).
### Windows: installer only
- The Tauri NSIS installer is published directly as
`CodeNomad-Tauri-windows-x64-<version>.exe`. It is also the signed
updater payload, so signed builds upload it once.
- The ZIP that wrapped the same installer is no longer published.
- The WinGet automation defaults now point to the `.exe`.
### Updater signatures
- The updater reads each signature from `latest.json`, never from a
`.sig` asset. Staging still verifies every signature and its trusted
comment and records it in the receipt, and publication still requires
every payload's uploaded digest to match.
- Releases no longer carry `.sig` assets, and staging deletes any left
on a rebuilt tag by older builds.
Rebuilt tags also delete obsolete Electron `tar.gz`, Tauri deb and
Windows ZIP assets.
### Docs
- **README:** shows the deb and AppImage commands. The AppImage uses the
static type2 runtime, so it needs no `libfuse2`;
`--appimage-extract-and-run` covers environments without FUSE. The
Wayland/NVIDIA command now targets the AppImage.
- **BUILD.md, `TAURI_UPDATER.md` and the WinGet guide** describe the new
formats.
## Migration note
Installing the Electron deb over a Tauri deb switches the app from Tauri
to Electron:
- `code-nomad` and `codenomad-tauri` are removed, and the launcher
becomes `CodeNomad`;
- server configuration is shared, but desktop window state is not
migrated.
Tauri deb users never had in-app updates, so the release notes should
say this. The AppImage is their Tauri option.
## Validation
- **Electron deb packaging (CI):** checks package, conflicts, replaces
and version metadata, the contents, the post-install `chmod 4755` step,
the resources/asar smoke checks and `ldd`.
- **Electron deb install (CI):** installs on Ubuntu 24.04 **without
recommends**, so `ldd` proves the declared `Depends` are enough. It
installs over a stand-in `code-nomad` package, then checks that the old
package was replaced, the owner of the desktop entry,
`/usr/bin/CodeNomad`, `chrome-sandbox` `root:root 4755` and shared
libraries.
- **Version mapping:** the mapping, the ordering against stable, later
releases and same-day builds, and both repack branches were checked with
dpkg 1.22.6 on Ubuntu 24.04. The repack keeps the control fields and
root ownership.
- **Dependencies:** every declared dependency resolves on Ubuntu 24.04,
either as a real package or through its t64 provider.
- **Updater scripts:** `updater-artifacts.test.mjs` passes, including
signature-in-manifest publication with no staged `.sig`.
- **Workflow:** the YAML parses.
- **Independent review:** no blocker. The major finding (missing deb
dependencies) and the minor ones (dev version ordering, stale BUILD.md
and README command, unchecked exit codes, unused updater metadata) are
addressed.
## Follow-ups outside this PR
- **WinGet:** the `WINGET_WINDOWS_ASSET_NAME_TEMPLATE` repository
variable still pins the `.zip` name and overrides the new default.
Before the next stable release:
- update it to `.exe`, or delete it;
- check that the automated `winget-pkgs` PR declares a direct `nullsoft`
installer without the old ZIP fields, and correct it if not.
Until then, a stable release's WinGet job waits for the ZIP and fails
without side effects.
- **Ubuntu desktop trial:** test the Electron deb on a real Ubuntu
desktop.
## Summary
- Upgrade the standalone Node executable bundled with **both Tauri and
Electron** from **22.22.2 to 24.20.0 LTS (Krypton)**.
- Add a single exact `.node-version` pin consumed by the runtime
preparation script and all Node CI setup steps, replacing the previous
Node 20/22 build/test split. Official archive SHA-256 verification and
executable-only packaging are preserved.
- Set **macOS 13.5 minimum** explicitly in both desktop bundle manifests
and update the build documentation. This compatibility change was
explicitly accepted by the requester.
- Strengthen packaged-resource smoke checks: verify the bundled Node
matches the pin, reject stale runtimes, and exercise ESM imports
including the native OpenCode V2 client from the packaged server
directory.
- Add regression coverage for the shared runtime/CI pin and macOS
minimum-version parity.
## Scope and compatibility
This updates the Node process running the CodeNomad backend. It does
**not** upgrade Electron 39 or its internal Node/Chromium, WebView2, the
user's Node installation, or the independently managed OpenCode daemon.
No application dependencies or lockfile versions are changed.
Node 24's official macOS binaries require 13.5 rather than Node 22's
11.0. Windows x64/ARM64 and Linux glibc x64/ARM64 keep their existing
Node platform floors. No additional platform or musl support is
introduced.
The Windows x64 Node executable increases from approximately **83.04 MiB
to 89.06 MiB** uncompressed. Final installer/archive size changes have
not been measured. This is a runtime maintenance update, not the
deferred packaging-size optimization.
## Validation
Performed in an isolated worktree on Windows with the official,
checksum-verified **Node 24.20.0 / npm 11.19.0** distribution:
- [x] Clean `npm ci`; lockfile unchanged.
- [x] UI, Electron, and server TypeScript checks.
- [x] Server suite: **391 passed, 2 platform-skipped, 0 failed**.
- [x] Electron Node-level native-logic suite: **192 passed**.
- [x] Packaging/runtime regression tests: **6 passed**.
- [x] `npm run bundle:server --workspace @codenomad/tauri-app`: rebuild
UI/server resources, stage production dependencies,
download/check/extract Node 24, and run packaged
startup/import/loading-asset checks.
- [x] Negative smoke: the previous release's packaged Node 22.22.2 is
rejected with a version mismatch.
- [x] Desktop manifest schema checks (Tauri numeric-format annotations
ignored by the standalone JSON schema validator).
- [x] `git diff --check`.
The preliminary compatibility study also loaded all 14 direct server
dependencies and the packaged `msgpackr-extract` N-API binary under Node
24, with a successful serialization roundtrip.
## Remaining release gates / existing warnings
- [ ] Cross-platform CI builds and tests on the final head.
- [ ] Native GUI launch, restore, OpenCode streaming, shutdown, and
restart verification for the rebuilt desktop applications. Resource
smoke tests and Node-level Electron tests are **not** a complete
native-release approval.
`npm ci` still reports the existing 49 dependency advisories; this PR
does not run an unrelated dependency upgrade. npm 11.19 also warns about
existing install scripts awaiting `allowScripts` coverage. `actionlint`
reports only the pre-existing constant-false condition in
`build-and-upload.yml` (now line 816).
The touched `build-and-upload.yml` remains approximately 913 lines; no
unrelated workflow refactor is included.
## Summary
- Publish one supported installer on Linux: a Tauri .deb package for
x64.
- Publish one portable fallback: an Electron .tar.gz archive for x64.
- Remove the temporary Flatpak path and stop publishing Linux AppImage,
RPM, and zip variants.
- Remove obsolete Linux assets from reused releases before uploading
replacements.
- Closes#487, Closes#488
## Artifact validation
- Extract the Electron archive and verify its executable, bundled server
resources, app.asar renderer entry, referenced assets, and
shared-library closure.
- Verify Tauri Debian metadata, bundled resources, desktop entry, shared
libraries, and package installation in Ubuntu 24.04.
- Synchronize Tauri package versions before every platform build so
generated metadata follows release inputs.
## Validation
- Parsed the workflow YAML and Electron package JSON.
- Verified the local @electron/asar APIs used by CI.
- Ran the Tauri version synchronization script.
- Ran git diff --check.
- Reviewed the final diff against current dev; full Linux packaging and
Docker installation are delegated to PR CI.
## Compatibility
The Tauri deb is built and installation-tested on Ubuntu 24.04. Older
Debian-based distributions are not yet guaranteed.
---------
Co-authored-by: Pascal André <pascalandr@gmail.com>
