Repository navigation
Update from GitHub Releases without npm - #63
Merged
Merged
Conversation
`herdr-remote update` asked GitHub and every npm registry at once on each check, and always installed through `npm install -g`, which resolves the whole dependency tree and takes a minute where it works at all. A release now carries all of its JavaScript bundled, with node-pty the only dependency npm installs, so the update downloads the release tarball from GitHub, unpacks it beside the package, carries the installed node-pty over and swaps the directories: no npm, under a second once downloaded. npm remains the fallback: for a release that asks for a different node-pty or adds commands, for a download that fails, and, in the check, registries are asked only when GitHub cannot be reached.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Last of three PRs (image ✅ #61 → unified release ✅ #62, shipped as 0.3.31 → npm-free update).
What
Check: asks only GitHub's
latest.json. The npm registries (configured, npmjs, npmmirror) are asked only when GitHub cannot be reached, all at once, and the newest answer wins.Install: since 0.3.31 a release tarball carries all of its JavaScript bundled; node-pty is the only dependency npm installs.
updater/release-install.tstherefore:updater/tarball.ts, a small gzip+ustar/pax reader that refuses links and paths escaping the package)If renaming fails on Windows because the folder is held, the files are copied over in place, keeping node-pty.
npm is only a fallback: when a release asks for a different node-pty or changes
bin(it then installs the same GitHub tarball), when the download fails (npm's registry), or when only a registry could answer the check.Registry discovery moved to
updater/sources.ts. ~160 of the added lines are that verbatim move, so the real diff is under 800 lines. The TUI's "mirror is behind" note is gone, since mirrors are no longer asked alongside GitHub. i18n strings (en + zh) and docs updated.Tested
needsNpmleaves the install untouched, a wrong version or HTTP error changes nothing, path escape and links are refused, pax long paths are handled.tar -xon a realnpm packrelease tarball.herdr-remoteon PATH reports the new version; node-pty still spawns a pty.Note: installs at 0.3.31 or older still run the old update code, so their next update goes through npm once. Updates after that skip npm.