A developer with no JavaScript runtime installed should go from our page to a completed redential scan in one copy-paste. Today, npx is a dead end for every Python/Go/Rust/C++ developer without Node — and a real first-time corporate user churned on exactly that. The docs fix (#README "Don't have Node?") stops the bleeding; this issue is the cure: standalone executables with the runtime embedded.
Plan
Packaging (decided after evaluating the field; arguments welcome before code lands):
- esbuild bundles the CLI to a single CJS file. This adds esbuild as a devDependency — written justification: it's the standard bundler, maintained by the esbuild org, no install scripts, exact pin, dev-only (never ships to users). No realistic zero-dependency alternative exists for this.
- Node SEA (the official Single Executable Applications mechanism) injects that bundle into the platform's Node binary.
vercel/pkg is archived/dead and not considered.
- Known lumps, stated up front:
- Binaries will weigh tens of MB (the bundle embeds the TypeScript compiler, which the structural detection tier uses as its parser). Accepted cost.
- ESM→CJS quirks (
import.meta, the dynamic import in the scan→submit hand-off) get explicit smoke coverage.
signatures/ and taxonomy.json ship inside the bundle; the loader grows a SEA-aware path (today they're read from package files).
Artifacts per release, attached to the GitHub Release by a new release.yml job (same trigger discipline as everything there: tags only, never pull_request):
redential-macos-arm64, redential-macos-x64, redential-linux-x64, redential-linux-arm64, redential-win-x64.exe, plus a SHA256SUMS file and the same attestation story our npm packages get.
Installers, versioned in this repo — our trust story forbids an opaque installer: install.sh and install.ps1 live here, auditable, and do exactly: detect platform → download from the latest GitHub Release → verify checksum → install to a user directory → print PATH guidance. The website will serve them as a redirect to the raw versioned files, never a copy.
Acceptance bar
- CI smoke job runs the actual built binary per OS:
--version + a non-TTY --json scan of a fixture repo, asserting a schema-valid bundle and zero network. Runs on tags AND on main pushes touching packaging config.
- Manual: the curl one-liner completes a full scan on machines without Node (macOS, bare Ubuntu container, Windows PowerShell).
- Privacy invariants unchanged by construction: same code, new wrapper; the privacy suite already guards the code itself.
Out of scope, tracked separately: Docker image, Homebrew tap, AUR/winget (those get their own issues once binaries exist — AUR and winget will be community up-for-grabs).
Being implemented in-house (it rewires release.yml, the one workflow with publish rights), with the repo's reviewer gate. Comments and objections welcome before it lands — that's what this issue is for.
A developer with no JavaScript runtime installed should go from our page to a completed
redential scanin one copy-paste. Today,npxis a dead end for every Python/Go/Rust/C++ developer without Node — and a real first-time corporate user churned on exactly that. The docs fix (#README "Don't have Node?") stops the bleeding; this issue is the cure: standalone executables with the runtime embedded.Plan
Packaging (decided after evaluating the field; arguments welcome before code lands):
vercel/pkgis archived/dead and not considered.import.meta, the dynamic import in the scan→submit hand-off) get explicit smoke coverage.signatures/andtaxonomy.jsonship inside the bundle; the loader grows a SEA-aware path (today they're read from package files).Artifacts per release, attached to the GitHub Release by a new
release.ymljob (same trigger discipline as everything there: tags only, neverpull_request):redential-macos-arm64,redential-macos-x64,redential-linux-x64,redential-linux-arm64,redential-win-x64.exe, plus aSHA256SUMSfile and the same attestation story our npm packages get.Installers, versioned in this repo — our trust story forbids an opaque installer:
install.shandinstall.ps1live here, auditable, and do exactly: detect platform → download from the latest GitHub Release → verify checksum → install to a user directory → print PATH guidance. The website will serve them as a redirect to the raw versioned files, never a copy.Acceptance bar
--version+ a non-TTY--jsonscan of a fixture repo, asserting a schema-valid bundle and zero network. Runs on tags AND on main pushes touching packaging config.Out of scope, tracked separately: Docker image, Homebrew tap, AUR/winget (those get their own issues once binaries exist — AUR and winget will be community up-for-grabs).
Being implemented in-house (it rewires
release.yml, the one workflow with publish rights), with the repo's reviewer gate. Comments and objections welcome before it lands — that's what this issue is for.