Standalone Executable

[rinatkhaziev]

Description

This depends on #2736 to be merged first. This is the first pass on shipping a standalone executable (no need to download Node and such).

The next pass is actually code-signing the executables so that they can be ran on all supported platforms.

Pull request checklist

• Update SETUP.md with any new environmental variables.
• Update the documentation.
• Manually test the relevant changes.
• Follow the pull request checklist
• Add/update automated tests as needed.

New release checklist

• Automated tests pass.
• The Preparing for release checklist is completed.

Steps to Test

Outline the steps to test and verify the PR here.

Example:

1. Check out PR.
2. Run npm run build
3. Run ./dist/bin/vip-cookies.js nom
4. Verify cookies are delicious.

[Copilot]

Pull request overview

This PR introduces first-pass support for distributing VIP-CLI as a standalone Node SEA executable, including runtime dependency extraction, internal command dispatch, and updates to dev-env/Lando loading to work in SEA mode.

Changes:

• Add SEA runtime preparation (embedded node_modules archive extraction) and internal-bin dispatch for standalone execution.
• Refactor Lando/dev-env module loading to resolve from the SEA runtime filesystem when applicable, and add readiness polling for dev-env start/exec.
• Add SEA build tooling (helpers/build-sea.js, npm run build:sea), CI workflow for building/signing artifacts, and supporting documentation/runbooks.

Reviewed changes

Copilot reviewed 19 out of 23 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/lib/dev-environment/lando-loader.ts	Adds SEA-aware require/resolve for loading Lando modules from extracted runtime deps.
src/lib/dev-environment/dev-environment-lando.ts	Switches direct Lando imports to SEA-aware lazy loaders; logs runtime mode in dev-env log banner.
src/lib/dev-environment/dev-environment-core.ts	Loads template assets from SEA when available; adds bounded readiness checks + one retry after start/rebuild.
src/lib/dev-environment/dev-environment-cli.ts	Loads Lando formatter module via SEA-aware loader.
src/lib/cli/sea-runtime.js	Extracts embedded node_modules archive and amends module resolution for SEA runtime.
src/lib/cli/sea-dispatch.js	Resolves internal bins from argv and rewrites argv for internal execution under SEA.
src/lib/cli/runtime-mode.ts	Adds runtime-mode detection and label for diagnostics/logging.
src/lib/cli/internal-bin-loader.js	Adds internal bin dynamic import map for SEA-mode dispatch.
src/lib/cli/exit.ts	Includes runtime mode label in debug output.
src/lib/cli/config.ts	Ensures a default publish config is always available via JSON import (SEA-friendly).
src/lib/cli/command.js	Commander-backed args compatibility wrapper + SEA-aware subcommand execution path; update-notifier disabled in SEA mode.
src/commands/dev-env-sync-sql.ts	Type-only import tweak for Lando.
src/bin/vip.js	Adds SEA target-bin dispatch and makes command argv handling async.
src/bin/vip-sea.js	New SEA entrypoint to prep runtime FS and set dispatch env vars before importing vip.
src/bin/vip-dev-env-exec.js	Adds bounded readiness polling before failing “env not running”.
helpers/build-sea.js	Adds SEA build script to bundle CLI, generate blob, inject into Node, and emit executable.
docs/SEA-BUILD-SIGNING.md	Adds build/signing runbook for macOS/Linux/Windows (+ WSL notes).
docs/COMMANDER-MIGRATION.md	Adds migration status and verification guidance.
AGENTS.md / CLAUDE.md	Adds contributor/agent guidance and pointers to SEA docs.
.github/workflows/sea-build-sign.yml	Adds workflow to build SEA artifacts across platforms and optionally sign them.
package.json / npm-shrinkwrap.json	Adds build:sea, introduces esbuild + postject, replaces args with commander.

Files not reviewed (1)

• npm-shrinkwrap.json: Language not supported

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/sea-build-sign.yml

Package	Version	License	Issue Type
actions/checkout	6.*.*	Null	Unknown License
actions/setup-node	6.*.*	Null	Unknown License
actions/upload-artifact	4.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	6.*.*	🟢 5.9	Details Check Score Reason Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 8 SAST tool detected but not run on all commits
actions/actions/setup-node	6.*.*	🟢 6.1	Details Check Score Reason Maintained 🟢 10 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 9 binaries present in source code Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
actions/actions/upload-artifact	4.*.*	🟢 5.6	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 4 4 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 4 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 10 SAST tool is run on all commits
npm/esbuild	^0.27.3	Unknown	Unknown
npm/postject	^1.0.0-alpha.6	Unknown	Unknown

Scanned Files

• .github/workflows/sea-build-sign.yml
• package.json

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud