feat: ship self-contained DSCODE terminal packages

Bundle a private pinned runtime and native dependencies, isolate user data from existing DSH installations, and replace whole packages during updates. Preserve native settings in a separate user layer and retain runtime leases until descendants exit.

Switch terminal release CI to verified ARM64 and Intel GitHub assets, generate a matching Homebrew formula, and document curl installation and legacy migration. Validated full repository checks, focused data/update regressions, and both packaged architectures locally (Intel via Rosetta).

Author: qiz029

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       publish:
-        description: Publish the verified packages to npm and the Hub
+        description: Publish verified self-contained packages and the Desktop plugin
         type: boolean
         default: false
       verify_credentials:
@@ -42,25 +42,66 @@ jobs:
       # `npm run setup` writes into node_modules, and nothing else applies it.
       - run: npm run setup
       - run: npm run check
-      - name: Build the release candidates
-        env:
-          DSCODE_REPOSITORY: ${{ github.server_url }}/${{ github.repository }}
+      - name: Build the self-contained release candidates
         run: |
-          npm run build:packages
-          npm run release:hub
           npm run dist
-      - run: npm run verify:hub
+          node scripts/homebrew-formula.mjs
+      - run: node scripts/verify-standalone.mjs
       # One tarball keeps the exact layout: upload-artifact roots the archive at the
       # least common ancestor of its paths, which silently dropped the `artifacts/`
-      # prefix and left the publish job without bundle-pack.json.
+      # prefix and left the publish job without the expected artifact paths.
       - name: Pack the verified artifacts for the publish job
-        run: tar -czf release-candidates.tar.gz artifacts/npm artifacts/local/hub-verification.json artifacts/dscode-*.tar.gz
+        run: tar -czf release-candidates.tar.gz artifacts/dscode-*.tar.gz artifacts/dscode-*.sha256 artifacts/dscode.rb artifacts/local/standalone-*.json
       - uses: actions/upload-artifact@v4
         with:
           name: release-candidates
           if-no-files-found: error
           path: release-candidates.tar.gz
 
+  verify-intel:
+    needs: build
+    runs-on: macos-15-intel
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-candidates
+      - run: tar -xzf release-candidates.tar.gz
+      - run: node scripts/verify-standalone.mjs
+      - uses: actions/upload-artifact@v4
+        with:
+          name: standalone-intel-verification
+          path: artifacts/local/standalone-darwin-x64.json
+
+  publish-terminal:
+    needs: [build, verify-intel]
+    if: github.ref_type == 'tag' || inputs.publish
+    runs-on: macos-14
+    environment: release
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-candidates
+      - run: tar -xzf release-candidates.tar.gz
+      - name: Publish the same complete packages used by installers and Homebrew
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(node -p "require('./package.json').version")
+          test -f "docs/releases/$version.md"
+          set -- "artifacts/dscode-$version-darwin-arm64-standalone.tar.gz" "artifacts/dscode-$version-darwin-x64-standalone.tar.gz" artifacts/dscode-*.sha256 artifacts/dscode.rb
+          if gh release view "v$version" >/dev/null 2>&1; then
+            gh release upload "v$version" "$@" --clobber
+          else
+            gh release create "v$version" "$@" --title "DSCODE $version" --notes-file "docs/releases/$version.md"
+          fi
+
   desktop:
     runs-on: macos-14
     timeout-minutes: 20
@@ -85,9 +126,9 @@ jobs:
           if-no-files-found: error
           path: desktop-candidate.tar.gz
 
-  publish:
-    needs: [build, desktop]
-    if: github.ref_type == 'tag' || inputs.publish || inputs.verify_credentials
+  publish-desktop:
+    needs: [desktop, publish-terminal]
+    if: always() && needs.desktop.result == 'success' && (needs.publish-terminal.result == 'success' || inputs.verify_credentials)
     runs-on: macos-14
     timeout-minutes: 60
     environment: release
@@ -100,46 +141,16 @@ jobs:
           node-version: 24
           cache: npm
       - run: npm ci --ignore-scripts
-      - uses: actions/download-artifact@v4
-        with:
-          name: release-candidates
       - uses: actions/download-artifact@v4
         with:
           name: desktop-candidate
-      - name: Restore the verified artifacts
-        run: |
-          tar -xzf release-candidates.tar.gz
-          tar -xzf desktop-candidate.tar.gz
-          test -f artifacts/npm/bundle-pack.json || { echo "::error::the release candidate archive is incomplete"; exit 1; }
-          test -f artifacts/local/hub-verification.json || { echo "::error::the hub verification record is missing"; exit 1; }
-      # Read-only: both tokens authenticate and this version is still free. A manual
-      # dispatch with verify_credentials stops here.
-      - name: Check the publishing credentials
+      - name: Restore and check the Desktop candidate
         env:
           NPM_PUBLISH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
           DSH_HUB_TOKEN: ${{ secrets.DSH_HUB_TOKEN }}
         run: |
-          test -n "$NPM_PUBLISH_TOKEN" || { echo "::error::add the NPM_PUBLISH_TOKEN secret (granular npm token with bypass 2FA for the launcher, bundle and Desktop package)"; exit 1; }
-          test -n "$DSH_HUB_TOKEN" || { echo "::error::add the DSH_HUB_TOKEN secret (Hub CI token)"; exit 1; }
-          node scripts/check-publish-credentials.mjs
+          tar -xzf desktop-candidate.tar.gz
           npm run publish:desktop -- credentials
-      # Never publish the launcher before its Hub release resolves: the three
-      # phases each re-check the artifact hashes they verified above.
-      - name: Publish the bundle to npm
-        if: github.ref_type == 'tag' || inputs.publish
-        env:
-          NPM_PUBLISH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
-        run: npm run publish:hub -- bundle
-      - name: Sync npm and publish the Hub profile
-        if: github.ref_type == 'tag' || inputs.publish
-        env:
-          DSH_HUB_TOKEN: ${{ secrets.DSH_HUB_TOKEN }}
-        run: npm run publish:hub -- profile
-      - name: Publish the launcher to npm
-        if: github.ref_type == 'tag' || inputs.publish
-        env:
-          NPM_PUBLISH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
-        run: npm run publish:hub -- launcher
       - name: Publish the qualified Desktop plugin and verify public discovery
         if: github.ref_type == 'tag' || inputs.publish
         env:
@@ -156,20 +167,10 @@ jobs:
           name: desktop-public-verification
           if-no-files-found: error
           path: artifacts/local/desktop-public-install.json
-      # The curl installer, `dscode update` and the README all fetch these tarballs from
-      # the release: the prebuilt ones install without npm, the source one is the fallback.
-      - name: Attach the release tarballs to the GitHub release
+      - name: Attach Desktop assets to the existing release
         if: github.ref_type == 'tag' || inputs.publish
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           version=$(node -p "require('./package.json').version")
-          set -- "artifacts/dscode-$version.tar.gz" "artifacts/dscode-$version-darwin-arm64.tar.gz" "artifacts/dscode-$version-darwin-x64.tar.gz" artifacts/desktop/release/*.tgz artifacts/desktop/release/*.sha256 artifacts/desktop/release/*-README.md artifacts/desktop/release/*-release-notes.md
-          for tarball in "$@"; do
-            test -f "$tarball" || { echo "::error::missing $tarball"; exit 1; }
-          done
-          if gh release view "v$version" >/dev/null 2>&1; then
-            gh release upload "v$version" "$@" --clobber
-          else
-            gh release create "v$version" "$@" --title "DSCODE $version" --notes-file "docs/releases/$version.md"
-          fi
+          gh release upload "v$version" artifacts/desktop/release/*.tgz artifacts/desktop/release/*.sha256 artifacts/desktop/release/*-README.md artifacts/desktop/release/*-release-notes.md --clobber

AGENTS.md

@@ -6,14 +6,14 @@ For agents working in this repository. The human contribution flow lives in [CON
 
 **Rule: a release is not just a version bump.** These four items ship in the same change as the code; if any one is missing, the tree is not releasable.
 
-1. **Release notes** `docs/releases/<version>.md` must exist. `make attach` refuses outright while the GitHub release does not exist yet: `docs/releases/<version>.md is missing; write the release notes first`. Follow the recent files (for example `docs/releases/0.7.21.md`): a one-sentence summary, then per change what changed, why, and where the behaviour stops, ending with which checks actually ran and which paths have no automated case.
+1. **Release notes** `docs/releases/<version>.md` must exist. `make attach` refuses publication without them: `write the release notes first`. Follow the recent files (for example `docs/releases/0.7.21.md`): a one-sentence summary, then per change what changed, why, and where the behaviour stops, ending with which checks actually ran and which paths have no automated case.
 2. **`package.json` `version`** must match the git tag; `make version-check` rejects a mismatch.
 3. **`docs/CHANGELOG.md`** gets this version's entry, newest first.
 4. **Both READMEs stay in step**: `README.md` and `README.zh-CN.md` are two parallel texts, so a change to a feature description, a command, an install step or an index table on one side needs the other side.
 
 ## Cutting a release
 
-Follow the [release checklist](docs/hub-distribution.md). Two rules break most runs: the tag must equal `v<package.json version>` exactly, and a version already on npm from a different build cannot be re-tagged, so bump `package.json` and cut a new tag instead. After pushing the tag, confirm the run with `gh run list --workflow=release.yml` and read a failure with `gh run view --job=<job-id> --log-failed`; a publish job that dies in about 30 seconds at the credential check is usually that version conflict, not a missing secret. `make release`, `make verify` and `npm run doctor` cannot run inside a dscode session because the nested sandbox is refused — run them from a normal terminal.
+Follow the [self-contained package release checklist](docs/distribution.md#build-and-release). Terminal packages no longer publish through npm/Hub; the [legacy checklist](docs/hub-distribution.md) applies only when maintaining those older channels. Two rules break most runs: the tag must equal `v<package.json version>` exactly, and a version already on npm from a different build cannot be re-tagged, so bump `package.json` and cut a new tag instead. After pushing the tag, confirm the run with `gh run list --workflow=release.yml` and read a failure with `gh run view --job=<job-id> --log-failed`; a publish job that dies in about 30 seconds at the credential check is usually that version conflict, not a missing secret. `make release`, `make verify` and `npm run doctor` cannot run inside a dscode session because the nested sandbox is refused — run them from a normal terminal.
 
 ## Language
 

CONTRIBUTING.md

@@ -47,7 +47,7 @@ History uses a descriptive subject line plus a body explaining the situation, th
 
 ## Releases
 
-Releases are cut by the maintainer with `make release` and published with `make publish`; see [docs/hub-distribution.md](docs/hub-distribution.md). You do not need to bump versions in a pull request.
+Releases are cut by the maintainer with `make release` and published with `make publish`; see [docs/distribution.md](docs/distribution.md). You do not need to bump versions in a pull request.
 
 ## Security
 

Makefile

@@ -2,13 +2,12 @@
 #
 # Every target mirrors a step of .github/workflows/release.yml, so the sequence can be
 # rehearsed on this machine before a tag is pushed. The workflow remains the
-# only path that publishes from CI; a local `make publish` uses the npm token in the Keychain
-# (scripts/npm-token.mjs) and the Hub token exported in your shell.
+# only path that publishes from CI; local terminal publication uses gh authentication.
 #
 #   make release    the build job: check, build the candidates, verify and pack them
-#   make publish    the publish job: credentials, terminal and Desktop publication, release assets
+#   make publish    attach the verified terminal packages; Desktop remains separate
 #
-# Publishing reads NPM_PUBLISH_TOKEN, DSH_HUB_TOKEN and, for the release asset, GH_TOKEN.
+# Terminal publication uses GH_TOKEN or gh login. Legacy/Desktop targets use npm and Hub credentials.
 
 SHELL := /bin/sh
 # Every phase consumes the artifacts of the one before it, so parallel prerequisites would
@@ -17,24 +16,23 @@ SHELL := /bin/sh
 .DEFAULT_GOAL := help
 
 VERSION := $(shell node -p "require('./package.json').version" 2>/dev/null)
-REPOSITORY ?= https://github.com/qiz029/dscode
 TAG ?= v$(VERSION)
 DESKTOP_RUNTIME ?= .research/desktop-release-runtime
 DESKTOP_ASSETS = artifacts/desktop/release/*.tgz artifacts/desktop/release/*.sha256 artifacts/desktop/release/*-README.md artifacts/desktop/release/*-release-notes.md
-# The source tarball plus one prebuilt tarball per platform (scripts/distribute.mjs).
-TARBALLS := artifacts/dscode-$(VERSION).tar.gz artifacts/dscode-$(VERSION)-darwin-arm64.tar.gz artifacts/dscode-$(VERSION)-darwin-x64.tar.gz
+# One self-contained application per platform, plus checksums and a matching tap formula.
+TARBALLS := artifacts/dscode-$(VERSION)-darwin-arm64-standalone.tar.gz artifacts/dscode-$(VERSION)-darwin-x64-standalone.tar.gz artifacts/dscode-$(VERSION)-darwin-arm64-standalone.tar.gz.sha256 artifacts/dscode-$(VERSION)-darwin-x64-standalone.tar.gz.sha256 artifacts/dscode.rb
 
 .PHONY: help install check version-check build verify candidates unpack release credentials publish publish-bundle publish-profile publish-launcher desktop publish-desktop attach
 
 help:
 	@echo 'DSCODE release targets (VERSION=$(VERSION)):'
-	@echo '  make release            version-check, check, build, verify, desktop, candidates'
-	@echo '  make publish            credentials, bundle, profile, launcher, desktop, attach'
+	@echo '  make release            version-check, check, build, verify, candidates'
+	@echo '  make publish            attach the verified self-contained terminal packages'
 	@echo '  make install            npm ci --ignore-scripts'
 	@echo '  make check              npm run check (lint, coverage, integration, package, eval)'
 	@echo '  make version-check      TAG must match the manifest version (TAG defaults to v$(VERSION))'
-	@echo '  make build              build:packages, release:hub, dist'
-	@echo '  make verify             verify:hub against the candidates in artifacts/'
+	@echo '  make build              dist and the matching Homebrew formula'
+	@echo '  make verify             verify the self-contained candidate for this machine'
 	@echo '  make desktop            prepare and verify Desktop (requires DSCODE_TEST_CHROME)'
 	@echo '  make publish-desktop    publish Desktop, sync Hub and verify public installation'
 	@echo '  make candidates         pack release-candidates.tar.gz for a publish job'
@@ -43,7 +41,7 @@ help:
 	@echo '  make publish-bundle     publish the bundle to npm'
 	@echo '  make publish-profile    sync the Hub to npm, then publish the dscode profile'
 	@echo '  make publish-launcher   publish the launcher to npm'
-	@echo '  make attach             attach the source and prebuilt tarballs to the GitHub release'
+	@echo '  make attach             attach the self-contained packages to the GitHub release'
 
 # The workflow installs with --ignore-scripts: the exact dependency set the release is
 # verified against.
@@ -58,33 +56,29 @@ check:
 version-check:
 	@version=$$(node -p "require('./package.json').version"); test "$(TAG)" = "v$$version" || { echo "tag $(TAG) does not match version $$version" >&2; exit 1; }; echo "tag $(TAG) matches version $$version"
 
-# The workflow exports this for the whole build step, so a fork names itself in everything
-# the step generates instead of publishing the upstream URL.
 build:
-	DSCODE_REPOSITORY="$(REPOSITORY)" npm run build:packages
-	DSCODE_REPOSITORY="$(REPOSITORY)" npm run release:hub
-	DSCODE_REPOSITORY="$(REPOSITORY)" npm run dist
+	npm run dist
+	node scripts/homebrew-formula.mjs
 
 verify:
-	npm run verify:hub
+	node scripts/verify-standalone.mjs
 
 desktop:
 	npm run prepare:desktop -- "$(DESKTOP_RUNTIME)"
 	npm run release:desktop -- "$(DESKTOP_RUNTIME)"
 
 # One tarball keeps the exact layout the publish job restores, artifacts/ prefix included.
 candidates:
-	tar -czf release-candidates.tar.gz artifacts/npm artifacts/local/hub-verification.json artifacts/desktop/release $(TARBALLS)
+	tar -czf release-candidates.tar.gz artifacts/local/standalone-*.json $(TARBALLS)
 
 # The publish job restores the candidates it downloaded and refuses an incomplete archive;
 # locally this is also how a candidate tarball from another machine enters the tree.
 unpack:
 	@test -f release-candidates.tar.gz || { echo "release-candidates.tar.gz is missing; run make candidates" >&2; exit 1; }
 	tar -xzf release-candidates.tar.gz
-	@test -f artifacts/npm/bundle-pack.json || { echo "the release candidate archive is incomplete" >&2; exit 1; }
-	@test -f artifacts/local/hub-verification.json || { echo "the hub verification record is missing" >&2; exit 1; }
+	@test -f artifacts/dscode.rb || { echo "the release candidate archive is incomplete" >&2; exit 1; }
 
-release: version-check check build verify desktop candidates
+release: version-check check build verify candidates
 
 # Read-only: the npm token authenticates as the publishing user — NPM_PUBLISH_TOKEN, or the
 # Keychain token scripts/npm-token.mjs stores for a login-free local release — the Hub token
@@ -114,9 +108,10 @@ publish-desktop:
 
 # The tag always comes from the manifest version — the build job refuses a tag that does not
 # name it — and the curl installer, `dscode update` and the README fetch these assets: the
-# prebuilt tarballs install without npm, the source one is the fallback.
+# self-contained archives include Node and dependencies; there is no source fallback.
 attach:
-	@for tarball in $(TARBALLS) $(DESKTOP_ASSETS); do test -f "$$tarball" || { echo "$$tarball is missing; run make build" >&2; exit 1; }; done
-	@version=$(VERSION); if gh release view "v$$version" >/dev/null 2>&1; then gh release upload "v$$version" $(TARBALLS) $(DESKTOP_ASSETS) --clobber; else test -f "docs/releases/$$version.md" || { echo "docs/releases/$$version.md is missing; write the release notes first" >&2; exit 1; }; gh release create "v$$version" $(TARBALLS) $(DESKTOP_ASSETS) --title "DSCODE $$version" --notes-file "docs/releases/$$version.md"; fi
+	@test -f "docs/releases/$(VERSION).md" || { echo "write the release notes first" >&2; exit 1; }
+	@for tarball in $(TARBALLS); do test -f "$$tarball" || { echo "$$tarball is missing; run make build" >&2; exit 1; }; done
+	@version=$(VERSION); if gh release view "v$$version" >/dev/null 2>&1; then gh release upload "v$$version" $(TARBALLS) --clobber; else test -f "docs/releases/$$version.md" || { echo "docs/releases/$$version.md is missing; write the release notes first" >&2; exit 1; }; gh release create "v$$version" $(TARBALLS) --title "DSCODE $$version" --notes-file "docs/releases/$$version.md"; fi
 
-publish: credentials publish-bundle publish-profile publish-launcher publish-desktop attach
+publish: attach