fix(update): ship and fetch native binaries from the GitHub release

[elkaix]

Requirement or Bug

Native pythinker update fails with native binary download returned HTTP 404, and the 2.4.0 and 2.4.1 release runs on main end red. Related: #354.

Bug Reproduction Steps

1. Install 2.1.0 with the native installer.
2. Run pythinker update and accept 2.4.0 (or 2.4.1).
3. error: failed to download update 2.4.0: native binary download returned HTTP 404.

On 2.2.0–2.4.1 the same command fails earlier, because manifest.json comes back as an HTML page.

Release runs 36917123003 (2.4.0) and 36942551995 (2.4.1) fail in Update Homebrew tap and Release lane summary.

Root Cause

Three separate defects. All three are fixed at the root, with no workarounds.

1. Missing release asset (affects 2.1.0 clients). produce-manifest.mjs writes manifest.json and latest.json entries that point at the bare binary pythinker-code-<target>[.exe]. It hashes that binary and then deletes it, so only .zip, .zst and .tar.gz get uploaded. A 2.1.0 client downloads the bare file and gets a 404.
2. Wrong download base (affects 2.2.0–2.4.1 clients). chore: upstream reconcile through reference 99eaa993b #323 moved the manifest and binary URLs to code.pythinker.com/pythinker-code/binaries/<v>/…. That route has never served a file: the site answers it with its SPA page and HTTP 200. These clients cannot update, and only a reinstall fixes them (Native installs 2.2.0–2.4.1: reinstall once to get updates again #354).
3. Brew job race (the red X). assertPublishedNpmVersion ran npm view once, 24 s after changeset publish. npm showed 2.4.1 at 23:56:55, about 4 minutes after the check at 23:53:10. The job failed, and Release lane summary fails whenever BREW_RESULT is not success.

Code Changes

• produce-manifest.mjs: copy the binary into the upload set under the name the manifest uses, with a .sha256 sidecar. The existing dist-native-release/* upload step then ships it.
• constant/app.ts, native-manifest.ts, native-stage.ts: replace pythinkerCodeCdnBinariesBase() with pythinkerCodeReleaseAssetUrl(version, filename). It returns the GitHub release URL with the encoded tag, which is the same shape as 2.1.0 and as latest.json. The .zst-first staging path does not change.
• update-brew-formula.mjs: delete the one-shot npm view check. downloadNpmTarball already polls for 600 s, retries on 404, and refuses when the budget runs out, so it is the only gate now.
• cdn-consistency.mjs + verify-release-consistency.mjs: the release gate now HEADs every URL that latest.json and the release manifest.json advertise, and fails on anything unreachable. It retries 403/429. Against the live 2.4.1 release it reports the 6 missing bare binaries, so it would have caught defect 1 on 2.3.0.
• README.md: a pointer for stuck native installs to Native installs 2.2.0–2.4.1: reinstall once to get updates again #354.

Behavior Changes and Affected Users

Behavior	Before	After	Who relies on the old behavior	Escape hatch
Native release assets	.zip, .zst, .tar.gz (+ sidecars)	also the bare binary + .sha256	nobody; it adds an asset that manifests already named	n/a
Native client download URLs (built from this tree)	code.pythinker.com/pythinker-code/binaries/<v>/…	github.com/PyModel/pythinker-code/releases/download/<encoded tag>/…	nobody: the CDN route never returned a file (SPA HTML, 200)	n/a
Brew tap job when npm is slow to show the version	fails at once	polls the tarball up to 600 s	nobody; the old failure was a false negative	RELEASE_LANE_BREW=disabled (unchanged)
Release consistency gate	checks version strings only	also fails on any unreachable advertised download	release operators	none needed; it only reports real 404s

Populations:

• Native installs on 2.1.0 and earlier: they update normally from the next release on (defect 1).
• Native installs on 2.2.0–2.4.1: they need one reinstall, because their own updater has the dead URL built in (defect 2, Native installs 2.2.0–2.4.1: reinstall once to get updates again #354).
• npm and Homebrew installs: not affected.

Contract file touched: apps/pythinker-code/src/cli/update/* (CLI tripwire). The removed /binaries/ base never served data, so no client from a previous release loses anything.

Test coverage:

• release-artifacts.test.ts: every file the manifest names exists in the upload set. Failed before the fix, passes after.
• native-manifest.test.ts: exact encoded GitHub URLs.
• cdn-consistency.test.mjs: URL collection, 404s, 403/429 retry.
• update-brew-formula.test.mjs: the poll is the only gate.
• pnpm test:release 54/54; app update suites 325/325; tsc clean; pnpm lint 0 errors.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue (external PRs: issue must have a maintainer's /approve).
• I have added tests that prove my feature works.
• The behavior-change table above is complete, and every removed behavior or flipped default is named in the changeset and either has an escape hatch or was explicitly approved by a maintainer in this PR.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

Summary by CodeRabbit

• Bug Fixes
  • Native pythinker update now downloads the latest binary from the GitHub release, restoring updates for supported native installations.
  • If you’re using a native install on version 2.2.0–2.4.1, rerun the installation command once to receive a version that can update normally. After reinstalling, use pythinker update for future updates.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: PyModel/pythinker-code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: db7c5365-972f-458a-a006-06f02d36a46e

📥 Commits

Reviewing files that changed from the base of the PR and between 5d166ef and 5dc72ec.

📒 Files selected for processing (13)

• .changeset/native-update-release-assets.md
• README.md
• apps/pythinker-code/scripts/native/produce-manifest.mjs
• apps/pythinker-code/src/cli/update/native-manifest.ts
• apps/pythinker-code/src/cli/update/native-stage.ts
• apps/pythinker-code/src/constant/app.ts
• apps/pythinker-code/test/cli/update/native-manifest.test.ts
• apps/pythinker-code/test/scripts/native/release-artifacts.test.ts
• scripts/release/cdn-consistency.mjs
• scripts/release/cdn-consistency.test.mjs
• scripts/release/update-brew-formula.mjs
• scripts/release/update-brew-formula.test.mjs
• scripts/release/verify-release-consistency.mjs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Native binaries now use versioned GitHub release assets, and release checks test the download URLs advertised by CDN and GitHub manifests. The Homebrew formula update script relies on tarball polling rather than an exact-version npm query.

Changes

Native binary release assets

Layer / File(s)	Summary
Package and resolve release assets apps/pythinker-code/scripts/native/produce-manifest.mjs, apps/pythinker-code/src/constant/app.ts, apps/pythinker-code/src/cli/update/*, apps/pythinker-code/test/cli/update/*, apps/pythinker-code/test/scripts/native/*, README.md, .changeset/*	Manifest generation copies bare binaries and writes checksum sidecars. Native manifest and binary URLs now point to versioned GitHub release assets. Tests verify the URL paths and generated artifacts. The README and changeset describe the update limitation for native installs on versions 2.2.0–2.4.1.
Verify advertised download URLs scripts/release/cdn-consistency.mjs, scripts/release/cdn-consistency.test.mjs, scripts/release/verify-release-consistency.mjs	The release check collects URLs from CDN and GitHub manifests, then checks reachability. It retries transport errors, 5xx, 403, and 429 responses. Tests cover URL collection, failures, and successful retries.

Homebrew formula update gate

Layer / File(s)	Summary
Use tarball polling for npm availability scripts/release/update-brew-formula.mjs, scripts/release/update-brew-formula.test.mjs	The script removes the exact-version npm view check and proceeds to its existing tarball polling flow. Tests for the removed check are deleted; tarball download tests remain.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant Verifier as verify-release-consistency
  participant CDN
  participant GitHub as GitHub release
  participant Assets as Advertised download URLs
  Verifier->>CDN: Fetch latest.json
  Verifier->>GitHub: Fetch manifest.json
  Verifier->>Assets: HEAD-check collected URLs
  Assets-->>Verifier: Return response status

Loading

Merge Risk: ⚪ Minimal · up to 5dc72

Native updates now use published GitHub release assets, release checks verify advertised downloads, and Homebrew retains its tarball availability gate. No concrete merge-blocking issue is established; merge after normal checks pass.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 5dc72

The new download source aligns with the release publisher, while existing version, checksum and activation checks remain in place. No introduced security vulnerability was established. Some uncertainty remains about control of the externally hosted update metadata and the release checker’s outbound requests.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The principal sensitive outcome is replacement of installed native executables with release-owned bytes. Compromise of the authority supplying both a release manifest and its binaries could affect clients installing that release within their local execution privileges; manifest checksums alone do not authenticate a compromised publisher. No such compromise was demonstrated.

Security Findings and Attack Paths

• observed — The new production checker passes externally served latest.json platform URLs to outbound HEAD requests without an origin restriction. This creates a metadata-to-network boundary requiring publication-authority assessment; attacker write access and effective network exposure were not established, so it is not a verified attack path.

Trust Boundaries and Controls

• observed — The routed public-entrypoint ranges are tests with injected network functions, not production services. Production checks issue HEAD requests without attaching the deployment webhook credential. Native asset publication requests repository-content write permission, while the separate tap token is restricted to content writes in homebrew-tap.

Resilience and Maintainability Implications

• observed — The existing activation path rechecks checksum and executable version, rejects non-newer versions, evaluates automatic-update policy and serializes swaps with a mutex. Failed installation attempts restore the prior executable where possible and retain recovery artifacts when restoration fails. The documented interruption window during replacement predates this PR’s URL change.

Hardening Proposals

• proposed — Constrain advertised URLs and redirect destinations to approved HTTPS download origins before the release checker fetches them. This would make its network boundary explicit without treating the unproven metadata-control scenario as an observed vulnerability.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 41.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 11 files. (2 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the required fix prefix, stays within 72 characters, uses imperative wording, and accurately describes the native binary release and download changes.
Description check	✅ Passed	The description includes the required bug details, reproduction steps, root cause, code changes, behavior-change table, affected users, test coverage, and completed checklist. It is directly related t…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 41.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 11 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@pymodel/pythinker-code@5dc72ec

npx https://pkg.pr.new/@pymodel/pythinker-code@5dc72ec

commit: 5dc72ec