Skip to content

Keep the project folder out of app.asar and correct the 5.1.0 notes #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iLevyTate merged 2 commits into from
Nov 1, 2026
+372 −80
Merged

Keep the project folder out of app.asar and correct the 5.1.0 notes #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
85ec5a9
fix(build): keep the project folder out of app.asar
claude Nov 1, 2026
9524665
docs(changelog): correct the 5.1.0 notes
claude Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 30 additions & 10 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,31 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Fixed

- **Packaging:** the app archive (`app.asar`) holds only the app again: the built `dist` folder,
`package.json`, the production dependencies and `src/shared`. In 5.1.0 it also held the project's
webpack build cache, documentation images, sources and tests (about 300 MB unpacked), which made
every download 57 to 82 MB larger than 5.0.0. The release check now fails a build whose `app.asar`
holds anything else.

## [5.1.0] - 2026-10-31

Faster, more predictable Windows startup, a zip instead of the self-extracting portable exe, and
smaller downloads on every platform.
Faster, more predictable Windows startup and a zip instead of the self-extracting portable exe.

### Known issues

- Every download is 57 to 82 MB larger than 5.0.0 (the Windows x64 installer is 735 MB instead of
671 MB) because the build packed the project's webpack build cache, documentation images, sources
and tests into `app.asar` next to the app. The app never loads these files. Fixed for the next
release (see Unreleased).

### Security

- `minimatch` 10 → 11.0.3 for GHSA-g3hv-75wg-m249 (denial of service via globparts amplification).
- Electron 41 → 45 (45.1.0). Electron 41 was outside upstream security support and affected by eight
advisories, including GHSA-jr5w-w6x2-84p9 (HID/USB permission checks attributed to the wrong
origin; SameSite cookies not applied to windows opened from links).

### Changed

- `better-sqlite3` 12 → 13. 12.x no longer compiles against Electron 45; 13.x ships N-API prebuilds,
so it is no longer rebuilt per Electron version.
- macOS 13 (Ventura) is now the minimum supported macOS version (Electron 44 dropped macOS 12).
- **Windows:** the self-extracting portable exe (`StratoSortStack-5.0.0-win-x64.exe`), which
unpacked the whole app into `%TEMP%` on every start, is replaced by
`StratoSortStack-5.1.0-win-x64.zip`. Extract it once and run `StratoSort Stack.exe` from the
Expand All @@ -41,8 +49,8 @@ smaller downloads on every platform.
(`STRATOSORT_ENABLE_EMBEDDING_WORKER`) uses the same record and supported-backend filter.
- The Windows x64 build no longer ships node-llama-cpp's arm64 prebuilt (about 11 MB).
- Each build ships only its own SQLite (`better-sqlite3`) native binary instead of the ones for
every platform: about 15 MB smaller on macOS, about 12 MB on Linux, and one 2 MB file less on
Windows.
every platform: about 15 MB less on macOS, about 12 MB on Linux, and one 2 MB file less on
Windows. In 5.1.0 these savings are outweighed by the known issue above.
- On Windows and macOS the app no longer forces Chromium's `enable-gpu-rasterization` and
`enable-zero-copy` switches, so Chromium's per-driver GPU blocklist applies. Linux keeps forcing
them, as before.
Expand Down Expand Up @@ -70,13 +78,25 @@ smaller downloads on every platform.
First public release of StratoSort Stack: source published on GitHub under the PolyForm
Noncommercial License 1.0.0, with signed installers on GitHub Releases.

The Security entry and the first two Changed entries shipped in 5.0.0 but were missing from its
release notes; the 5.1.0 notes listed them by mistake.

### Security

- Electron 41 → 45 (45.1.0). Electron 41 was outside upstream security support and affected by eight
advisories, including GHSA-jr5w-w6x2-84p9 (HID/USB permission checks attributed to the wrong
origin; SameSite cookies not applied to windows opened from links).

### Added

- Atlas map, timeline, knowledge stats card, Downloads triage trust pack, MCP server kit, and
repository history visualization (PRs #375–#407).

### Changed

- `better-sqlite3` 12 → 13. 12.x no longer compiles against Electron 45; 13.x ships N-API prebuilds,
so it is no longer rebuilt per Electron version.
- macOS 13 (Ventura) is now the minimum supported macOS version (Electron 44 dropped macOS 12).
- **License:** StratoSort Stack is now released under the PolyForm Noncommercial License 1.0.0.
Personal and other noncommercial use is free with every feature; commercial use needs a paid key
(see [docs/COMMERCIAL.md](docs/COMMERCIAL.md)).
Expand Down
40 changes: 24 additions & 16 deletions docs/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,29 +409,37 @@ supported-GPU floor moves with it. `verify-packaged-artifacts.js` requires all f
package code: nothing reads it unless it builds from source, and nothing builds from source inside
Electron.

| Pattern | Why it is unused at runtime | Estimated saving |
| :------------------------------------------------------------------------------------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------ |
| `node-llama-cpp/llama/gitRelease.bundle` | Read only by `utils/gitReleaseBundles.js`, which only the source download/clone path uses. `getLlama` defaults `build` to `"never"` when `process.versions.electron` is set and the app never overrides it, so `canBuild` is false and the clone path is unreachable. | 36 MB, 1 file |
| `node-llama-cpp/llama/{addon,cmake,patches,profiles,toolchains,xpack}`, `llama/CMakeLists.txt` | Inputs to `compileLlamaCpp` (cmake-js), behind the same `canBuild` gate. | 0.3 MB, 57 files |
| `node-llama-cpp/templates` | Used only by the `init` CLI command. | 0.2 MB, 3 files |
| `@fugood/whisper.node/{src,whisper.cpp}`, `CMakeLists.txt` | C/C++ sources for building the addon. `lib/` only `require`s the prebuilt variant packages (or `build/Release`). | 5.4 MB, about 117 files |
| `better-sqlite3/{deps,src}` | SQLite amalgamation and addon sources for node-gyp. `lib/binding.js` loads `prebuilds/<platform>-<arch>.node` or `build/Release`. | 10.4 MB, 33 files |
| `better-sqlite3/prebuilds/` other than this build's own (`win.files`, `mac.files`, `linux.files`) | `getPrebuildPath()` loads only `<platform>-<arch>.node`, or `linuxmusl-<arch>.node` on musl Linux. Each platform's rule keeps `win32-${arch}`, `darwin-${arch}` or `linux-${arch}` plus `linuxmusl-${arch}`; electron-builder expands `${arch}` per packed arch. | 15 MB, 7 files (Windows, macOS); 12 MB, 6 files (Linux) |
| Pattern | Why it is unused at runtime | Estimated saving |
| :--------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------ |
| `node-llama-cpp/llama/gitRelease.bundle` | Read only by `utils/gitReleaseBundles.js`, which only the source download/clone path uses. `getLlama` defaults `build` to `"never"` when `process.versions.electron` is set and the app never overrides it, so `canBuild` is false and the clone path is unreachable. | 36 MB, 1 file |
| `node-llama-cpp/llama/{addon,cmake,patches,profiles,toolchains,xpack}`, `llama/CMakeLists.txt` | Inputs to `compileLlamaCpp` (cmake-js), behind the same `canBuild` gate. | 0.3 MB, 57 files |
| `node-llama-cpp/templates` | Used only by the `init` CLI command. | 0.2 MB, 3 files |
| `@fugood/whisper.node/{src,whisper.cpp}`, `CMakeLists.txt` | C/C++ sources for building the addon. `lib/` only `require`s the prebuilt variant packages (or `build/Release`). | 5.4 MB, about 117 files |
| `better-sqlite3/{deps,src}` | SQLite amalgamation and addon sources for node-gyp. `lib/binding.js` loads `prebuilds/<platform>-<arch>.node` or `build/Release`. | 10.4 MB, 33 files |
| `better-sqlite3/prebuilds/` other than this build's own | `getPrebuildPath()` loads only `<platform>-<arch>.node`, or `linuxmusl-<arch>.node` on musl Linux. The rule keeps `${platform}-${arch}` and `${platform}musl-${arch}`: electron-builder expands `${platform}` to the build machine's `process.platform` (each release leg builds on its own OS) and `${arch}` per packed arch, and only Linux has `musl` prebuilds. | 15 MB, 7 files (Windows, macOS); 12 MB, 6 files (Linux) |

Together that is roughly 65 MB and 220 files less to write and scan on first launch (estimates from
the on-disk sizes in `node_modules`; the download shrinks less, by an estimated 40 to 50 MB, because
the installer compresses the source files well). Update the download size in
[INSTALL_GUIDE.md](INSTALL_GUIDE.md) after the next packaged build. `verify-packaged-artifacts.js`
checks that `llama/binariesGithubRelease.json` (read by node-llama-cpp on import) still ships and
that `llama/gitRelease.bundle` does not. `@node-llama-cpp/win-arm64` (11 MB) declares
`cpu: ["arm64", "x64"]`, so npm installs it on x64 runners too. `win.files` excludes the other
arch's llama prebuilts with `!**/node_modules/@node-llama-cpp/win-!(${arch}|${arch}-*)/**`:
electron-builder expands `${arch}` per packed arch, so the x64 build drops `win-arm64` and the arm64
build (which inherits `win.files` through `extends`) drops any `win-x64*` package.
`verify-packaged-artifacts.js` fails if a package for the other arch still holds files. It also
requires each build's own `better-sqlite3` prebuild (without it `lib/binding.js` falls back to
`build/Release`, which is not packaged, and SQLite cannot load) and fails if a prebuild for another
platform or arch was packaged.
`cpu: ["arm64", "x64"]`, so npm installs it on x64 runners too. The rule
`!**/node_modules/@node-llama-cpp/win-!(${arch}|${arch}-*)/**` excludes the other arch's llama
prebuilts: electron-builder expands `${arch}` per packed arch, so the x64 build drops `win-arm64`
and the arm64 build (`electron-builder.win-arm64.json` extends the base config) drops any `win-x64*`
package. npm does not install `win-*` packages on macOS or Linux. `verify-packaged-artifacts.js`
fails if a package for the other arch still holds files. It also requires each build's own
`better-sqlite3` prebuild (without it `lib/binding.js` falls back to `build/Release`, which is not
packaged, and SQLite cannot load) and fails if a prebuild for another platform or arch was packaged.

Keep every `files` rule in the top-level list. electron-builder turns the top-level strings into one
file set, but a string list under `win`, `mac` or `linux` becomes a second matcher that holds only
exclusions, and electron-builder starts such a matcher with `**/*`. 5.1.0 shipped that way: its
`app.asar` held the whole project folder (webpack cache, docs, sources, tests; about 300 MB more),
so every download grew by 57 to 82 MB instead of shrinking. `verify-packaged-artifacts.js` now fails
when `app.asar` holds anything besides `dist`, `node_modules`, `package.json` and `src/shared`, and
`test/electron-builder-config.test.js` runs electron-builder's own matchers for each release leg.

## Signing And Notarization Requirements

Expand Down
6 changes: 4 additions & 2 deletions docs/commercial-use-inventory.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"generatedAt": "2026-10-31T15:05:19.740Z",
"generatedAt": "2026-11-01T00:30:59.499Z",
"projectLicense": {
"riskLevel": "allowed",
"reason": "Project license is PolyForm Noncommercial 1.0.0 for personal/noncommercial use. Commercial rights are sold separately; third-party dependency obligations remain governed by their own licenses.",
Expand Down Expand Up @@ -23818,7 +23818,9 @@
"!**/node_modules/node-llama-cpp/templates/**",
"!**/node_modules/@fugood/whisper.node/CMakeLists.txt",
"!**/node_modules/@fugood/whisper.node/{src,whisper.cpp}/**",
"!**/node_modules/better-sqlite3/{deps,src}/**"
"!**/node_modules/better-sqlite3/{deps,src}/**",
"!**/node_modules/better-sqlite3/prebuilds/!(${platform}-${arch}|${platform}musl-${arch}).node",
"!**/node_modules/@node-llama-cpp/win-!(${arch}|${arch}-*)/**"
],
"extraResources": [
{
Expand Down
16 changes: 4 additions & 12 deletions electron-builder.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,9 @@
"!**/node_modules/node-llama-cpp/templates/**",
"!**/node_modules/@fugood/whisper.node/CMakeLists.txt",
"!**/node_modules/@fugood/whisper.node/{src,whisper.cpp}/**",
"!**/node_modules/better-sqlite3/{deps,src}/**"
"!**/node_modules/better-sqlite3/{deps,src}/**",
"!**/node_modules/better-sqlite3/prebuilds/!(${platform}-${arch}|${platform}musl-${arch}).node",
"!**/node_modules/@node-llama-cpp/win-!(${arch}|${arch}-*)/**"
],
"extraMetadata": {
"main": "dist/main.js"
Expand All @@ -88,11 +90,7 @@
"win": {
"icon": "assets/icons/win/icon.ico",
"target": ["nsis", "zip"],
"compression": "normal",
"files": [
"!**/node_modules/better-sqlite3/prebuilds/!(win32-${arch}).node",
"!**/node_modules/@node-llama-cpp/win-!(${arch}|${arch}-*)/**"
]
"compression": "normal"
},
"nsis": {
"oneClick": false,
Expand All @@ -111,9 +109,6 @@
"artifactName": "StratoSortStack-Setup-${version}.exe"
},
"mac": {
"files": [
"!**/node_modules/better-sqlite3/prebuilds/!(darwin-${arch}).node"
],
"icon": "assets/icons/mac/icon.icns",
"category": "public.app-category.productivity",
"hardenedRuntime": true,
Expand Down Expand Up @@ -143,9 +138,6 @@
]
},
"linux": {
"files": [
"!**/node_modules/better-sqlite3/prebuilds/!(linux-${arch}|linuxmusl-${arch}).node"
],
"icon": "assets/icons/png/512x512.png",
"maintainer": "Kennedy Applied Sciences, Inc. <contact@kennedyappliedsciences.com>",
"target": ["AppImage", "deb"],
Expand Down
Loading
Loading