@coderook/cli 0.34.0 → 0.34.1

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -32,7 +32,7 @@ project moved by one is understood by the other.
 
 ## Install
 
-Requires Node 20.11 or later, and nothing else.
+Requires Node 22.15 or later (Node 24 is the safe choice), and nothing else. Older Node lacks the zstd support bundles use, and the CLI says so rather than failing later.
 
 ```
 npm install --global @coderook/cli
@@ -446,16 +446,17 @@ cbx build init                    describe the build in coderook.build.json
 ```
 
 `cbx build` makes the project's executables for Windows, Linux and macOS on
-the machine you are using. Each target is built natively, cross-compiled, in
-Docker or in WSL, chosen from what is installed; one that cannot be built here
-is named, with what would build it.
+the machine you are using. Each target is built natively or cross-compiled,
+chosen from what is installed; Docker and WSL are used when present and never
+required for Linux. A target that cannot be built here is named, with what
+would build it.
 
 | Toolchain | From any machine | Needs its own system |
 | --- | --- | --- |
 | Go, Bun, Deno, .NET | Windows, Linux, macOS | — |
 | Rust | all three, with cargo-zigbuild | macOS apps using system frameworks |
-| Electron | Windows and Linux, with Docker (or wine) | macOS |
-| PyInstaller | Linux, with Docker or WSL | Windows, macOS |
+| Electron | Linux (tar.gz) straight from Windows; Windows and Linux elsewhere with Docker or wine | macOS; AppImage and deb need Linux |
+| Python | Windows, Linux, macOS: the target's own CPython with its wheels, as a tar.gz with a launcher (PyInstaller where it runs) | a dependency with no wheel for that system |
 
 The toolchain is recognised from the files present. `coderook.build.json`
 settles it, and takes a command of your own (`{target}`, `{os}`, `{arch}` and

package/dist/cbx/src/core/cbx.js

@@ -31,6 +31,7 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
 const safe_path_js_1 = require("../shared/safe_path.js");
 const node_zlib_1 = require("node:zlib");
 const download_js_1 = require("./download.js");
@@ -411,6 +412,14 @@ async function unpackBundle(source, destination, report) {
                 throw new Error(`${record.path} did not survive the bundle intact`);
             }
             await (0, promises_1.writeFile)(full, contents);
+            /*
+              The mode was recorded when the bundle was made and never put back, so
+              a script that went in executable came out needing chmod. Only the
+              permission bits, and only where the system has them.
+            */
+            if (node_process_1.default.platform !== "win32" && record.mode & 0o111) {
+                await (0, promises_1.chmod)(full, (record.mode & 0o777) | 0o400);
+            }
             written += 1;
             bytes += contents.length;
         }

package/dist/cli/src/build_command.js

@@ -43,6 +43,7 @@ exports.detectTools = detectTools;
 exports.describeProject = describeProject;
 exports.wslPath = wslPath;
 exports.planBuild = planBuild;
+exports.markExecutables = markExecutables;
 exports.fileFromTar = fileFromTar;
 exports.outputsOf = outputsOf;
 exports.commandBuild = commandBuild;
@@ -78,6 +79,7 @@ const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const node_process_1 = __importDefault(require("node:process"));
+const portable_python_js_1 = require("./portable_python.js");
 const ESC = String.fromCharCode(27);
 const colour = node_process_1.default.stdout.isTTY && !node_process_1.default.env.NO_COLOR;
 const paint = (code) => (value) => (colour ? `${ESC}[${code}m${value}${ESC}[0m` : value);
@@ -156,6 +158,8 @@ async function detectTools(host = thisHost()) {
         /* The daemon, not the client: a stopped Docker Desktop answers --version. */
         ["docker", answers("docker", ["info", "--format", "{{.ServerVersion}}"], 15000)],
         ["pyinstaller", answers("pyinstaller", ["--version"], 15000)],
+        ["uv", answers("uv", ["--version"])],
+        ["python", answers(host.os === "windows" ? "python" : "python3", ["-m", "pip", "--version"], 15000)],
         ["wine", host.os === "windows" ? Promise.resolve(false) : answers("wine", ["--version"])],
         ["node", answers(node_process_1.default.execPath, ["--version"])],
     ];
@@ -210,6 +214,8 @@ async function describeProject(folder) {
             preset = "bun";
         else if (spec || (await (0, promises_1.readFile)(node_path_1.default.join(folder, "requirements.txt"), "utf8").catch(() => "")).match(/pyinstaller/i))
             preset = "pyinstaller";
+        else if (here("requirements.txt") || here("pyproject.toml") || here("main.py") || here("app.py"))
+            preset = "python";
     }
     let name = config.name ?? "";
     let entry = config.entry ?? null;
@@ -240,7 +246,7 @@ async function describeProject(folder) {
                 ["main.ts", "mod.ts", "index.ts", "src/main.ts", "src/index.ts", "index.js"].find(here) ??
                 null;
     }
-    if (preset === "pyinstaller") {
+    if (preset === "pyinstaller" || preset === "python") {
         entry ??= spec ?? ["main.py", "app.py", "__main__.py", "src/main.py"].find(here) ?? null;
     }
     if (!name && typeof pkg?.name === "string")
@@ -327,7 +333,21 @@ function planBuild(project, host, tools, targets) {
         const sameOs = host.os === os_;
         const file = `${project.name}-${target}${exe(target)}`;
         const pre = before ? [{ shell: before }] : [];
-        const missing = (tool, why = "") => ({ target, ok: false, why: `needs ${tool}${why}` });
+        /* Found by asking the PATH, so a tool installed but not on it reads as absent: say both. */
+        const missing = (tool, why = "") => ({ target, ok: false, why: `needs ${tool}${why}, on the PATH this command sees` });
+        /*
+          Python for any system from any system: the target's own CPython, its
+          wheels and the program, in one archive. Needs uv, or Python with pip to
+          fetch uv; a dependency with no wheel for the target is the one thing it
+          cannot do, and it says which.
+        */
+        const portable = () => tools.uv || tools.python
+            ? {
+                target, ok: true, route: native ? "native" : "cross", out,
+                how: `portable CPython for ${target} + its wheels (uv), as a tar.gz with a launcher`,
+                steps: [...pre, { portablePython: { target, out: outAbs } }],
+            }
+            : null;
         switch (project.preset) {
             case "go": {
                 if (!tools.go)
@@ -471,6 +491,27 @@ function planBuild(project, host, tools, targets) {
                         steps: [...pre, { program: node_process_1.default.execPath, args: [node_path_1.default.join(project.folder, "node_modules", "electron-builder", "cli.js"), ...builder.slice(1), outputFlag(out)] }],
                     };
                 }
+                /*
+                  Linux from Windows needs no container. electron-builder packages a
+                  Linux app on Windows by itself; what it cannot do is mark anything
+                  executable, because Windows has no such bit, so every program in
+                  the archive arrives as a plain file. The archive is fixed up after.
+                  A tar.gz only: AppImage needs symlinks and Linux tools, deb needs fpm.
+                */
+                if (os_ === "linux" && host.os === "windows") {
+                    return {
+                        target, ok: true, route: "cross", out,
+                        how: `electron-builder --linux tar.gz --${arch} on Windows, executables marked afterwards (AppImage and deb need Linux)`,
+                        steps: [
+                            ...pre,
+                            {
+                                program: node_process_1.default.execPath,
+                                args: [node_path_1.default.join(project.folder, "node_modules", "electron-builder", "cli.js"), "--linux", "tar.gz", `--${arch}`, "--publish", "never", ...extra, outputFlag(out)],
+                            },
+                            { fixTarModes: outAbs },
+                        ],
+                    };
+                }
                 const nativeOk = sameOs || (os_ === "windows" && host.os !== "windows" && tools.wine);
                 if (nativeOk) {
                     return {
@@ -507,7 +548,7 @@ function planBuild(project, host, tools, targets) {
                     : ["--noconfirm", "--onefile", "--name", `${project.name}-${target}`, "--distpath", dist, "--workpath", workDir, "--specpath", specDir, ...extra, project.entry];
                 if (native) {
                     if (!tools.pyinstaller)
-                        return missing("PyInstaller (pip install pyinstaller)");
+                        return portable() ?? missing("PyInstaller (pip install pyinstaller)");
                     return {
                         target, ok: true, route: "native", out, how: "pyinstaller",
                         steps: [...pre, { program: "pyinstaller", args: flags(outAbs, node_path_1.default.join(project.folder, work), node_path_1.default.join(project.folder, "build", "coderook")) }],
@@ -531,9 +572,14 @@ function planBuild(project, host, tools, targets) {
                             steps: [{ program: "wsl", args: ["-e", "sh", "-lc", inner] }],
                         };
                     }
-                    return { target, ok: false, why: `PyInstaller builds only for the system it runs on; needs Docker running, or WSL with PyInstaller, or ${NEEDS("linux")}` };
+                    return portable() ?? { target, ok: false, why: `PyInstaller builds only for the system it runs on; needs Docker running, or WSL with PyInstaller, or ${NEEDS("linux")}` };
                 }
-                return { target, ok: false, why: `PyInstaller builds only for the system it runs on; ${NEEDS(os_)}` };
+                return portable() ?? { target, ok: false, why: `PyInstaller builds only for the system it runs on; ${NEEDS(os_)}` };
+            }
+            case "python": {
+                if (!project.entry)
+                    return { target, ok: false, why: `no entry point; set "entry" in ${CONFIG_FILE}` };
+                return portable() ?? missing("uv, or Python with pip (https://docs.astral.sh/uv)");
             }
             case "custom": {
                 if (!project.config.command)
@@ -570,6 +616,55 @@ function output(program, args) {
         child.on("exit", (code) => done(code === 0 ? text.trim() : null));
     });
 }
+/**
+ * Mark the programs in a tar archive executable: Linux ELF binaries and
+ * scripts with a `#!` line. Each entry's mode is rewritten in its header and
+ * the header checksum recomputed; nothing else in the archive moves.
+ */
+function markExecutables(archive) {
+    const out = Buffer.from(archive);
+    const marked = [];
+    let at = 0;
+    while (at + 512 <= out.length) {
+        const header = out.subarray(at, at + 512);
+        if (header.every((byte) => byte === 0))
+            break;
+        const field = (start, length) => header.subarray(start, start + length).toString("utf8").replace(/\0.*$/s, "");
+        const size = parseInt(field(124, 12).trim() || "0", 8);
+        const type = String.fromCharCode(header[156] ?? 48);
+        const body = out.subarray(at + 512, at + 512 + Math.min(size, 4));
+        const program = (body[0] === 0x7f && body.toString("latin1", 1, 4) === "ELF") || body.toString("latin1", 0, 2) === "#!";
+        if ((type === "0" || type === "\0") && program) {
+            const mode = parseInt(field(100, 8).trim() || "0", 8);
+            const wanted = mode | 0o755;
+            if (wanted !== mode) {
+                header.write(`${wanted.toString(8).padStart(7, "0")}\0`, 100, 8, "latin1");
+                header.fill(0x20, 148, 156);
+                let sum = 0;
+                for (const byte of header)
+                    sum += byte;
+                header.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "latin1");
+                const prefix = field(345, 155);
+                marked.push(prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
+            }
+        }
+        at += 512 + Math.ceil(size / 512) * 512;
+    }
+    return { archive: out, marked };
+}
+async function fixTarModes(folder) {
+    for (const name of await (0, promises_1.readdir)(folder).catch(() => [])) {
+        if (!name.endsWith(".tar.gz"))
+            continue;
+        const file = node_path_1.default.join(folder, name);
+        const { archive, marked } = markExecutables((0, node_zlib_1.gunzipSync)(await (0, promises_1.readFile)(file)));
+        if (!marked.length)
+            continue;
+        await (0, promises_1.writeFile)(file, (0, node_zlib_1.gzipSync)(archive, { level: 9 }));
+        console.log(dim(`Marked ${marked.length} program${marked.length === 1 ? "" : "s"} executable in ${name}.`));
+    }
+    return 0;
+}
 /** The one file at `name` in a tar archive, read without unpacking the rest. */
 function fileFromTar(archive, name) {
     let at = 0;
@@ -619,9 +714,37 @@ async function fetchBunRuntime(target, to) {
         return 1;
     }
 }
+/** The project being built, for the steps that need more than a command line. */
+let building = null;
+async function runPortable(step) {
+    if (!building?.entry)
+        return 1;
+    try {
+        await (0, portable_python_js_1.buildPortablePython)({
+            folder: building.folder,
+            target: step.target,
+            name: building.name,
+            entry: building.entry,
+            ...(building.config.python ? { python: building.config.python } : {}),
+            ...(building.config.gui ? { gui: true } : {}),
+            outFolder: step.out,
+            cache: cacheDirectory(),
+            say: (text) => console.log(dim(text)),
+        });
+        return 0;
+    }
+    catch (error) {
+        console.error(red(error instanceof Error ? error.message : String(error)));
+        return 1;
+    }
+}
 function run(step, cwd) {
+    if ("portablePython" in step)
+        return runPortable(step.portablePython);
     if ("bunRuntime" in step)
         return fetchBunRuntime(step.bunRuntime.target, step.bunRuntime.to);
+    if ("fixTarModes" in step)
+        return fixTarModes(step.fixTarModes);
     if ("copy" in step) {
         return (async () => {
             try {
@@ -688,8 +811,8 @@ async function commandBuild(parsed) {
         project = { ...project, preset: presetFlag };
     if (!project.preset) {
         console.error(red("No toolchain recognised in this folder."));
-        console.error(dim(`  Looked for go.mod, Cargo.toml, a .csproj, electron-builder, deno.json, a Bun lockfile and a PyInstaller .spec.`));
-        console.error(dim(`  Say which with ${accent("--preset <go|bun|deno|rust|dotnet|electron|pyinstaller>")}, or describe it in ${CONFIG_FILE} (${accent("cbx build init")}).`));
+        console.error(dim(`  Looked for go.mod, Cargo.toml, a .csproj, electron-builder, deno.json, a Bun lockfile, a PyInstaller .spec and Python files.`));
+        console.error(dim(`  Say which with ${accent("--preset <go|bun|deno|rust|dotnet|electron|pyinstaller|python>")}, or describe it in ${CONFIG_FILE} (${accent("cbx build init")}).`));
         return 1;
     }
     let targets;
@@ -705,6 +828,7 @@ async function commandBuild(parsed) {
         console.error(red(error instanceof Error ? error.message : String(error)));
         return 1;
     }
+    building = project;
     const host = thisHost();
     console.log(dim(`Checking what this ${host.os} ${host.arch} machine can build with…`));
     const tools = await detectTools(host);

package/dist/cli/src/cli.js

@@ -29,6 +29,7 @@ const progress_js_1 = require("./progress.js");
 const publish_js_1 = require("./publish.js");
 const attach_command_js_1 = require("./attach_command.js");
 const build_command_js_1 = require("./build_command.js");
+const node_check_js_1 = require("./node_check.js");
 const pages_command_js_1 = require("./pages_command.js");
 const project_commands_js_1 = require("./project_commands.js");
 const track_commands_js_1 = require("./track_commands.js");
@@ -371,8 +372,7 @@ async function commandUnlink(parsed) {
         console.log("This folder was not linked to a project.");
         return 0;
     }
-    console.log(`Detached ${bold(node_path_1.default.basename(folder))}` +
-        (link?.slug ? dim(` from ${link.slug}`) : "") +
+    console.log((link?.slug ? `Unlinked this folder from ${bold(link.slug)}` : `Unlinked ${bold(node_path_1.default.basename(folder))}`) +
         ".");
     console.log(dim("Nothing was deleted. The next submit from here asks which project it is."));
     return 0;
@@ -3309,8 +3309,9 @@ SPECS.push({
     usage: "build [folder] [--target win,linux,mac]",
     detail: "Builds the project in this folder for each target, using whatever this\n" +
         "machine has: Go, Bun, Deno and .NET build every platform from any one;\n" +
-        "Rust does with cargo-zigbuild; Electron builds Windows and Linux in\n" +
-        "Docker; PyInstaller builds Linux in Docker or WSL. A target this machine\n" +
+        "Rust does with cargo-zigbuild; Electron builds Linux from Windows with\n" +
+        "nothing extra; Python ships the target's own interpreter and wheels.\n" +
+        "Linux never needs Docker. A target this machine\n" +
         "cannot build is named, with what would build it. Nothing is uploaded\n" +
         "unless --ship is given. Output goes to .coderook/build/<target>/.\n\n" +
         "The toolchain is recognised from the files here. To fix it, or to give\n" +
@@ -3319,7 +3320,7 @@ SPECS.push({
     options: [
         { flags: "-t, --target <list>", description: "windows-x64, linux-arm64, macos-arm64 … or win, linux, mac, all" },
         { flags: "--plan", description: "say how each target would be built, build nothing" },
-        { flags: "--preset <name>", description: "go, bun, deno, rust, dotnet, electron, pyinstaller or custom" },
+        { flags: "--preset <name>", description: "go, bun, deno, rust, dotnet, electron, pyinstaller, python or custom" },
         { flags: "--ship", description: "attach what was built to the project's newest save" },
     ],
     examples: [
@@ -3355,6 +3356,11 @@ SPECS.push(localTwin("push", "submit", local_commands_js_1.localPush, {
 }, [{ flags: "-f, --force", description: "discard unsaved changes that are in the way" }]));
 const REGISTRY = (0, registry_js_1.buildRegistry)(SPECS);
 async function main(argv) {
+    const old = (0, node_check_js_1.nodeTooOld)();
+    if (old) {
+        console.error(red(old));
+        return 1;
+    }
     const [name, ...rest] = argv;
     if (!name || name === "--help" || name === "-h") {
         console.log((0, help_js_1.renderHelp)(REGISTRY, version_js_1.VERSION));

package/dist/cli/src/git_remote_bin.js

@@ -14,6 +14,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 */
 const node_process_1 = __importDefault(require("node:process"));
 const git_remote_js_1 = require("./git_remote.js");
+const node_check_js_1 = require("./node_check.js");
 /**
  * Finish, without cutting the pipe to git mid-sentence.
  *
@@ -36,7 +37,8 @@ function finish(code) {
     node_process_1.default.stdin.pause();
     setTimeout(() => node_process_1.default.exit(code), 5000).unref();
 }
-(0, git_remote_js_1.main)(node_process_1.default.argv.slice(2))
+const old = (0, node_check_js_1.nodeTooOld)();
+(old ? Promise.reject(new Error(old)) : (0, git_remote_js_1.main)(node_process_1.default.argv.slice(2)))
     .then(finish)
     .catch((error) => {
     /*

package/dist/cli/src/node_check.js

@@ -0,0 +1,26 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MINIMUM_NODE = void 0;
+exports.nodeTooOld = nodeTooOld;
+/*
+  The Node this needs, said before anything else runs.
+
+  The package said Node 20.11, and that was wrong: bundles and local histories
+  use zstd, which Node gained in 23.8 and 22.15. On Linux, Node 22.12 got as
+  far as reading a project and then died with
+  "(0 , node_zlib_1.zstdDecompressSync) is not a function", which names
+  nothing anybody can act on.
+*/
+const node_process_1 = __importDefault(require("node:process"));
+const node_zlib_1 = __importDefault(require("node:zlib"));
+exports.MINIMUM_NODE = "22.15";
+/** A sentence for a Node that is too old, or null when this one will do. */
+function nodeTooOld() {
+    if (typeof node_zlib_1.default.zstdDecompressSync === "function")
+        return null;
+    return (`CodeRook needs Node ${exports.MINIMUM_NODE} or later; this is Node ${node_process_1.default.versions.node} (${node_process_1.default.execPath}).\n` +
+        `Install a current Node (https://nodejs.org), or put a newer one first on your PATH.`);
+}

package/dist/cli/src/portable_python.js

@@ -0,0 +1,370 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UV_PLATFORM = exports.PYTHON_TRIPLE = void 0;
+exports.tarEntry = tarEntry;
+exports.renamedEntries = renamedEntries;
+exports.scriptOf = scriptOf;
+exports.runtimeRequirements = runtimeRequirements;
+exports.buildPortablePython = buildPortablePython;
+/**
+ * A Python program built for another system, without that system.
+ *
+ * PyInstaller freezes a program with the interpreter it runs under, so it
+ * only ever builds for the machine it is on — which left Python as the one
+ * language `cbx build` could not take to Linux from Windows. This assembles
+ * the same result from parts instead:
+ *
+ * - the target system's own CPython, from python-build-standalone (the
+ *   relocatable builds uv and others use), checked against its published
+ *   SHA-256;
+ * - the program's dependencies as the target system's wheels, resolved by
+ *   uv for that platform — environment markers included, which pip with
+ *   `--platform` gets wrong because it evaluates them for this machine;
+ * - the program's own files, and a launcher.
+ *
+ * Out comes `<name>-<target>.tar.gz`: one folder holding `python/`, `lib/`,
+ * `app/` and the launcher, with every program in it marked executable. The
+ * interpreter's archive is never unpacked here — its symlinks would not
+ * survive Windows — its entries are carried across with their paths renamed.
+ *
+ * The limit is a package that publishes no wheel for the target: there is no
+ * compiler for another system here, and uv says so by name.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
+const node_zlib_1 = require("node:zlib");
+const rules_js_1 = require("../../cbx/src/core/rules.js");
+const worktree_js_1 = require("../../cbx/src/core/worktree.js");
+/** python-build-standalone's name for each system. */
+exports.PYTHON_TRIPLE = {
+    "windows-x64": "x86_64-pc-windows-msvc",
+    "windows-arm64": "aarch64-pc-windows-msvc",
+    "linux-x64": "x86_64-unknown-linux-gnu",
+    "linux-arm64": "aarch64-unknown-linux-gnu",
+    "macos-x64": "x86_64-apple-darwin",
+    "macos-arm64": "aarch64-apple-darwin",
+};
+/**
+ * uv's name for the platform wheels are chosen for. Linux asks for glibc 2.28
+ * (Debian 10, Ubuntu 20.04, RHEL 8 and later), which is where most projects'
+ * wheels are built now; older wheels still qualify.
+ */
+exports.UV_PLATFORM = {
+    "windows-x64": "x86_64-pc-windows-msvc",
+    "windows-arm64": "aarch64-pc-windows-msvc",
+    "linux-x64": "x86_64-manylinux_2_28",
+    "linux-arm64": "aarch64-manylinux_2_28",
+    "macos-x64": "x86_64-apple-darwin",
+    "macos-arm64": "aarch64-apple-darwin",
+};
+/* ------------------------------------------------------------------ tar */
+function octal(value, width) {
+    return `${value.toString(8).padStart(width - 1, "0")}\0`;
+}
+function checksum(header) {
+    header.fill(0x20, 148, 156);
+    let sum = 0;
+    for (const byte of header)
+        sum += byte;
+    header.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "latin1");
+}
+/** Where a path goes in a ustar header: name alone, or prefix and name. */
+function splitName(full) {
+    if (Buffer.byteLength(full) <= 100)
+        return { prefix: "", name: full };
+    for (let at = full.indexOf("/"); at !== -1; at = full.indexOf("/", at + 1)) {
+        const prefix = full.slice(0, at);
+        const name = full.slice(at + 1);
+        if (Buffer.byteLength(prefix) <= 155 && Buffer.byteLength(name) <= 100 && name)
+            return { prefix, name };
+    }
+    return null;
+}
+/** A pax header carrying a path too long for ustar. */
+function paxFor(full) {
+    let record = ` path=${full}\n`;
+    let length = Buffer.byteLength(record);
+    /* The record counts its own length digits. */
+    while (Buffer.byteLength(`${length}${record}`) !== length)
+        length = Buffer.byteLength(`${length}${record}`);
+    const body = Buffer.from(`${length}${record}`);
+    const header = Buffer.alloc(512);
+    header.write("PaxHeader", 0);
+    header.write(octal(0o644, 8), 100, "latin1");
+    header.write(octal(0, 8), 108, "latin1");
+    header.write(octal(0, 8), 116, "latin1");
+    header.write(octal(body.length, 12), 124, "latin1");
+    header.write(octal(0, 12), 136, "latin1");
+    header.write("x", 156, "latin1");
+    header.write("ustar\0", 257, "latin1");
+    header.write("00", 263, "latin1");
+    checksum(header);
+    return Buffer.concat([header, body, Buffer.alloc((512 - (body.length % 512)) % 512)]);
+}
+function setName(header, full) {
+    header.fill(0, 0, 100);
+    header.fill(0, 345, 500);
+    const split = splitName(full);
+    if (split) {
+        header.write(split.name, 0, 100, "utf8");
+        header.write(split.prefix, 345, 155, "utf8");
+        return [];
+    }
+    header.write(full.slice(-99), 0, 100, "utf8");
+    return [paxFor(full)];
+}
+/** One file, or a symlink, as tar bytes. */
+function tarEntry(full, body, mode, link) {
+    const header = Buffer.alloc(512);
+    const before = setName(header, full);
+    header.write(octal(mode, 8), 100, "latin1");
+    header.write(octal(0, 8), 108, "latin1");
+    header.write(octal(0, 8), 116, "latin1");
+    header.write(octal(link ? 0 : body.length, 12), 124, "latin1");
+    header.write(octal(Math.floor(Date.now() / 1000), 12), 136, "latin1");
+    header.write(link ? "2" : "0", 156, "latin1");
+    if (link)
+        header.write(link, 157, 100, "utf8");
+    header.write("ustar\0", 257, "latin1");
+    header.write("00", 263, "latin1");
+    checksum(header);
+    const data = link ? [] : [body, Buffer.alloc((512 - (body.length % 512)) % 512)];
+    return Buffer.concat([...before, header, ...data]);
+}
+/**
+ * Every entry of a ustar archive, renamed under `top/`, header by header.
+ * Bodies and link targets are untouched, so symlinks and modes survive.
+ */
+function renamedEntries(archive, top) {
+    const out = [];
+    let at = 0;
+    while (at + 512 <= archive.length) {
+        const header = Buffer.from(archive.subarray(at, at + 512));
+        if (header.every((byte) => byte === 0))
+            break;
+        const field = (start, length) => header.subarray(start, start + length).toString("utf8").replace(/\0.*$/s, "");
+        const size = parseInt(field(124, 12).trim() || "0", 8);
+        const type = String.fromCharCode(header[156] ?? 48);
+        const span = 512 + Math.ceil(size / 512) * 512;
+        if (type === "x" || type === "g" || type === "L" || type === "K") {
+            throw new Error("the interpreter archive uses long-name headers this does not rewrite");
+        }
+        const prefix = field(345, 155);
+        const name = prefix ? `${prefix}/${field(0, 100)}` : field(0, 100);
+        const before = setName(header, `${top}/${name}`);
+        checksum(header);
+        out.push(...before, header, Buffer.from(archive.subarray(at + 512, at + span)));
+        at += span;
+    }
+    return out;
+}
+const isProgram = (body) => (body[0] === 0x7f && body.toString("latin1", 1, 4) === "ELF") ||
+    body.toString("latin1", 0, 2) === "#!" ||
+    (body.length >= 4 && [0xfeedfacf, 0xcafebabe, 0xbebafeca].includes(body.readUInt32LE(0)));
+/* ------------------------------------------------------------- runtime */
+function run(program, args, options = {}) {
+    return new Promise((done) => {
+        let out = "";
+        const child = (0, node_child_process_1.spawn)(program, args, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+        child.stdout.on("data", (chunk) => {
+            out += chunk;
+            if (!options.quiet)
+                node_process_1.default.stdout.write(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            out += chunk;
+            if (!options.quiet)
+                node_process_1.default.stderr.write(chunk);
+        });
+        child.on("error", (error) => done({ code: 1, out: error.message }));
+        child.on("exit", (code) => done({ code: code ?? 1, out }));
+    });
+}
+/** uv on PATH, or one installed into the cache with this machine's pip. */
+async function findUv(cache) {
+    if ((await run("uv", ["--version"], { quiet: true })).code === 0)
+        return "uv";
+    const local = node_path_1.default.join(cache, "uv", "bin", node_process_1.default.platform === "win32" ? "uv.exe" : "uv");
+    if ((0, node_fs_1.existsSync)(local))
+        return local;
+    for (const python of ["python3", "python"]) {
+        const installed = await run(python, ["-m", "pip", "install", "--quiet", "--disable-pip-version-check", "--target", node_path_1.default.join(cache, "uv"), "uv"], { quiet: true });
+        if (installed.code === 0 && (0, node_fs_1.existsSync)(local))
+            return local;
+    }
+    throw new Error("needs uv (https://docs.astral.sh/uv) or Python with pip to fetch it");
+}
+/** The target's CPython, downloaded once, checked against its published digest. */
+async function pythonRuntime(cache, version, target, say) {
+    const folder = node_path_1.default.join(cache, "python");
+    await (0, promises_1.mkdir)(folder, { recursive: true });
+    const wanted = new RegExp(`^cpython-${version.replace(".", "\\.")}\\.\\d+\\+\\d+-${exports.PYTHON_TRIPLE[target]}-install_only\\.tar\\.gz$`);
+    const cached = (await (0, promises_1.readdir)(folder)).find((name) => wanted.test(name));
+    if (cached)
+        return (0, promises_1.readFile)(node_path_1.default.join(folder, cached));
+    const release = (await (await fetch("https://api.github.com/repos/astral-sh/python-build-standalone/releases/latest", {
+        headers: { accept: "application/vnd.github+json", "user-agent": "coderook-cli" },
+    })).json());
+    const asset = (release.assets ?? []).find((one) => wanted.test(one.name));
+    if (!asset)
+        throw new Error(`no CPython ${version} build for ${target} in the latest python-build-standalone release`);
+    if (!asset.digest?.startsWith("sha256:"))
+        throw new Error("the release does not publish a digest for it");
+    say(`Fetching ${asset.name}…`);
+    const body = Buffer.from(await (await fetch(asset.browser_download_url)).arrayBuffer());
+    if ((0, node_crypto_1.createHash)("sha256").update(body).digest("hex") !== asset.digest.slice("sha256:".length)) {
+        throw new Error("the download does not match its published digest");
+    }
+    await (0, promises_1.writeFile)(node_path_1.default.join(folder, asset.name), body);
+    return body;
+}
+/* ------------------------------------------------------------- project */
+/** The script PyInstaller would freeze: from a .spec's Analysis, or the file itself. */
+function scriptOf(entry, specText = "") {
+    if (!entry.endsWith(".spec"))
+        return entry;
+    const found = specText.match(/Analysis\(\s*\[\s*(?:r)?['"]([^'"]+)['"]/);
+    if (!found)
+        throw new Error(`could not find the script in ${entry}; set "entry" to it`);
+    /* A spec written on Windows escapes its backslashes: `src\\app\\main.py`. */
+    return found[1].replace(/\\+/g, "/");
+}
+/** Requirements, minus the build tools that freeze rather than run the program. */
+function runtimeRequirements(text) {
+    return text
+        .split(/\r?\n/)
+        .filter((line) => !/^\s*(pyinstaller|pyinstaller-hooks-contrib|nuitka|cx[-_]freeze)\b/i.test(line))
+        .join("\n");
+}
+const SKIP = new Set([...rules_js_1.UNCOUNTED_DIRECTORIES, "__pycache__", "build", "dist", "venv", ".venv", "env", "node_modules", ".mypy_cache", ".pytest_cache", ".tox"]);
+/** The program's own files, as the project's ignore rules see them. */
+async function appFiles(folder) {
+    const rules = await (0, worktree_js_1.readRules)(folder);
+    const layers = [{ base: "", rules: (0, rules_js_1.parseRules)(`${rules.shared}\n${rules.local}`) }];
+    const found = [];
+    const walk = async (relative) => {
+        for (const entry of await (0, promises_1.readdir)(node_path_1.default.join(folder, relative), { withFileTypes: true })) {
+            const rel = relative ? `${relative}/${entry.name}` : entry.name;
+            if (entry.isDirectory()) {
+                if (SKIP.has(entry.name) || (0, rules_js_1.excludes)(rel, true, layers))
+                    continue;
+                await walk(rel);
+            }
+            else if (entry.isFile() && !(0, rules_js_1.excludes)(rel, false, layers) && !/\.(pyc|pyo|spec)$/.test(entry.name)) {
+                found.push(rel);
+            }
+        }
+    };
+    await walk("");
+    return found;
+}
+async function buildPortablePython(request) {
+    const say = request.say ?? ((text) => console.log(text));
+    const { folder, target } = request;
+    const windows = target.startsWith("windows");
+    const top = `${request.name}-${target}`;
+    const hostVersion = (await run("python3", ["-c", "import sys;print('%d.%d'%sys.version_info[:2])"], { quiet: true }));
+    const hostVersionAlt = hostVersion.code === 0 ? hostVersion : await run("python", ["-c", "import sys;print('%d.%d'%sys.version_info[:2])"], { quiet: true });
+    const version = request.python ?? (hostVersionAlt.code === 0 ? hostVersionAlt.out.trim() : "3.12");
+    const script = scriptOf(request.entry, request.entry.endsWith(".spec") ? await (0, promises_1.readFile)(node_path_1.default.join(folder, request.entry), "utf8") : "");
+    if (!(0, node_fs_1.existsSync)(node_path_1.default.join(folder, script)))
+        throw new Error(`${script} is not in the project`);
+    const runtime = (0, node_zlib_1.gunzipSync)(await pythonRuntime(request.cache, version, target, say));
+    const uv = await findUv(request.cache);
+    /* Dependencies, as the target's wheels. */
+    const scratch = await (0, promises_1.mkdtemp)(node_path_1.default.join(node_os_1.default.tmpdir(), "coderook-pybuild-"));
+    try {
+        const lib = node_path_1.default.join(scratch, "lib");
+        await (0, promises_1.mkdir)(lib);
+        let requirements = "";
+        if ((0, node_fs_1.existsSync)(node_path_1.default.join(folder, "requirements.txt"))) {
+            requirements = runtimeRequirements(await (0, promises_1.readFile)(node_path_1.default.join(folder, "requirements.txt"), "utf8"));
+        }
+        if (requirements.trim()) {
+            const file = node_path_1.default.join(scratch, "requirements.txt");
+            await (0, promises_1.writeFile)(file, requirements);
+            say(`Resolving dependencies for ${target} (${exports.UV_PLATFORM[target]}, Python ${version})…`);
+            const installed = await run(uv, [
+                "pip", "install", "--quiet", "--target", lib,
+                "--python-platform", exports.UV_PLATFORM[target], "--python-version", version,
+                /* No building from source: it would build for this machine, not the target. */
+                "--no-build", "-r", file,
+            ]);
+            if (installed.code !== 0) {
+                throw new Error(/no wheels|--no-build|only-binary|has no wheel/i.test(installed.out)
+                    ? `a dependency publishes no ${target} wheel, and it cannot be compiled for ${target} here; build on that system instead`
+                    : "resolving the dependencies failed (above)");
+            }
+        }
+        const entries = renamedEntries(runtime, top);
+        const add = async (base, prefix, skipTop = new Set()) => {
+            const walk = async (relative) => {
+                for (const entry of await (0, promises_1.readdir)(node_path_1.default.join(base, relative), { withFileTypes: true })) {
+                    const rel = relative ? `${relative}/${entry.name}` : entry.name;
+                    if (!relative && skipTop.has(entry.name))
+                        continue;
+                    if (entry.isDirectory()) {
+                        if (entry.name === "__pycache__")
+                            continue;
+                        await walk(rel);
+                    }
+                    else if (entry.isFile()) {
+                        const body = await (0, promises_1.readFile)(node_path_1.default.join(base, rel));
+                        entries.push(tarEntry(`${top}/${prefix}/${rel}`, body, isProgram(body) ? 0o755 : 0o644));
+                    }
+                }
+            };
+            await walk("");
+        };
+        /* uv writes console scripts for this machine into bin/; they are not the target's. */
+        await add(lib, "lib", new Set(["bin"]));
+        for (const rel of await appFiles(folder)) {
+            const body = await (0, promises_1.readFile)(node_path_1.default.join(folder, rel));
+            entries.push(tarEntry(`${top}/app/${rel}`, body, isProgram(body) ? 0o755 : 0o644));
+        }
+        if (windows) {
+            const python = request.gui ? "pythonw.exe" : "python.exe";
+            const launcher = [
+                "@echo off",
+                "setlocal",
+                'set "HERE=%~dp0"',
+                'set "PYTHONPATH=%HERE%lib;%HERE%app"',
+                "set PYTHONNOUSERSITE=1",
+                `${request.gui ? 'start "" ' : ""}"%HERE%python\\${python}" "%HERE%app\\${script.replace(/\//g, "\\")}" %*`,
+                "",
+            ].join("\r\n");
+            entries.push(tarEntry(`${top}/${request.name}.cmd`, Buffer.from(launcher), 0o755));
+        }
+        else {
+            const launcher = [
+                "#!/bin/sh",
+                "# Runs the program with the Python beside it. Made by cbx build.",
+                'here="$(cd "$(dirname "$0")" && pwd -P)"',
+                /* Exported, not prefixed: assignments before `exec` are not passed on by every sh. */
+                'PYTHONPATH="$here/lib:$here/app${PYTHONPATH:+:$PYTHONPATH}"',
+                "PYTHONNOUSERSITE=1",
+                "export PYTHONPATH PYTHONNOUSERSITE",
+                `exec "$here/python/bin/python3" "$here/app/${script}" "$@"`,
+                "",
+            ].join("\n");
+            entries.push(tarEntry(`${top}/${request.name}`, Buffer.from(launcher), 0o755));
+        }
+        entries.push(Buffer.alloc(1024));
+        await (0, promises_1.mkdir)(request.outFolder, { recursive: true });
+        const archive = node_path_1.default.join(request.outFolder, `${top}.tar.gz`);
+        await (0, promises_1.writeFile)(archive, (0, node_zlib_1.gzipSync)(Buffer.concat(entries), { level: 9 }));
+        say(`Wrote ${node_path_1.default.basename(archive)} (${((await (0, promises_1.stat)(archive)).size / 1024 ** 2).toFixed(1)} MB): unpack it and run ${windows ? `${request.name}.cmd` : `./${request.name}`}.`);
+        return archive;
+    }
+    finally {
+        await (0, promises_1.rm)(scratch, { recursive: true, force: true });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",
@@ -20,7 +20,7 @@
     "gamedev"
   ],
   "engines": {
-    "node": ">=20.11.0"
+    "node": ">=22.15.0"
   },
   "bin": {
     "cbx": "dist/cli/src/cli.js",