feat(cli): ship a standalone binary built as a Node 26 SEA - #76

Ships codework as a standalone binary, so users no longer need Node installed. It is a Node 26 single executable application (SEA): official Node with the CLI bundled into it.

How it works

• Bundle (vp run bundle): the whole CLI as one ESM file, entry src/sea.ts. Before the CLI starts, the entry unpacks the files that must exist on disk to a per-user cache ($TMPDIR/codework-node-<uid>/<hash>-<os>-<arch>, mode 0700, written atomically). It also gives plugins the CLI's own effect.
• Plugins share the host's effect: a bundled host publishes its modules on globalThis[Symbol.for("codework.v1.effect")] (and codework.v1.plugin). The plugin loader serves them as virtual modules that load each one lazily. Unbundled installs resolve exactly as before.
• Unpacked packages: just-bash (its sqlite3 worker, plus zstd and xz) and photon load files from beside their own modules, so they ship as a real node_modules that the harness resolves from CODEWORK_PACKAGES. node-liblzma is rebuilt with xz linked statically, so no system liblzma is needed. just-bash's python and js-exec are not shipped, because the harness doesn't enable them.
• SEA quirks: a SEA's main module has no import.meta.resolve, and its import() reaches only built-ins. So resolution borrows a resolver (Plugin.lendResolve) and imports go through importModule. The bundle also defines __dirname and __filename for npm's installer.
• SEA build (vp run sea): Node 26.11.1 checked against a pinned sha256, --build-sea with mainFormat: "module", and ad-hoc signing on macOS.
• Intel Macs are dropped, both for the binary and the TUI (@codeworksh/tui-darwin-x64 is deprecated on npm).

Releases

publish.yml builds the binary for darwin-arm64, linux-arm64 and linux-x64 on dev and main, each on its own runner. Each row runs the offline binary test, and the release job attaches cli-<os>-<arch>.tar.gz to a GitHub Release:

• dev: devel, one prerelease replaced on every push → releases/download/devel/cli-<os>-<arch>.tar.gz
• main: cli-v<version>, marked latest → releases/latest/download/cli-<os>-<arch>.tar.gz
• canary: stays npm-only.

npm publishing doesn't wait on the binary. The run computes its release id once (scripts/version.mjs), so the binary reports the same version npm publishes.

Testing

packages/codework/test/sea.test.ts runs the real binary with no Node on PATH:

• offline: it unpacks its assets privately, and a plugin with no dependencies runs through the binary's own effect;
• live (OpenAI, OpenRouter): a plugin's Schema.Finite tool works, and sqlite3, tar --zstd and tar -J run in the virtual shell;
• CODEWORK_PLUGIN_LIVE=1: plugins install from the npm registry and from git (codework-tool-spacex v0.5.0 and codework-prompt-musk v0.4.0, both updated to the current SDK), and the spacex tool runs.

All 4 pass locally on darwin-arm64. vp check and typecheck are clean.

The workflow changes can only be proven on GitHub, so the first dev run after merge is their real test. Things to watch:

• that the Ubuntu runners have no node in /usr/bin, which the offline test asserts;
• that cmake is present on ubuntu-24.04-arm.

Not covered yet: the codework.sh/install script, and loading third-party sandbox drivers from the plugin store.

🤖 Generated with Claude Code