Skip to content

fix(runtime): support Node.js 25 for remote setup and development - #546

Open
starsalwaysineyes wants to merge 1 commit into
BytePioneer-AI:mainfrom
starsalwaysineyes:fix/node25-runtime-support
Open

fix(runtime): support Node.js 25 for remote setup and development#546
starsalwaysineyes wants to merge 1 commit into
BytePioneer-AI:mainfrom
starsalwaysineyes:fix/node25-runtime-support

Conversation

@starsalwaysineyes

@starsalwaysineyes starsalwaysineyes commented Oct 16, 2026

Copy link
Copy Markdown

Closes #545

问题与改动

Homebrew Node.js 25.4.0 能被远端登录 shell 正确找到，但 SSH 安装器的版本白名单只允许 22.19+（22.x）和 24.x，导致远程服务安装以错误码 55 退出。本 PR 增加明确的 25.x 支持；22.x 的最低版本和其他 major 的拒绝行为保持不变。

  • SSH 安装/维护检查允许 Node 25，并同步中英文错误提示。
  • 同步源码启动入口、根 package/lockfile 的 engines 范围、安装及开发文档；不改变发行包内嵌 Node 或 CI 的固定工具链。
  • 新增执行真实 JavaScript 检查的 SSH 安装回归测试，覆盖版本边界，并验证拒绝版本时不会调用 npm 或修改服务；扩展源码启动及提示文案测试。

验证

在 macOS arm64、独立 Node.js 25.4.0 环境中执行：

  • cargo test --locked -p codexhost-updater：23 个测试通过。
  • cargo clippy --locked -p codexhost-updater --all-targets -- -D warnings：通过。
  • cargo fmt --all --check：通过。
  • npm run build:typescript、npm run build:renderer：通过。
  • npx vitest run --config tests/vitest.config.js tools/dev-desktop/run.test.mjs packages/renderer-extension/test/settings/remote-failure-messages.test.ts：28 个测试通过。
  • npx vitest run --config tests/vitest.config.js tests/release/npm-package.test.mjs：38 个测试通过。
  • 修改文件的 ESLint、Prettier、git diff --check 和提交钩子：通过。

实机：codexhost 0.13.2 的本地安装器加入相同的 Node 25 放行条件后，远端 Homebrew Node.js 25.4.0 的 codexhost remote status 显示 state: ready、runtime.state: running、runtime.protocol: codexhost、issues: []。本机 Desktop 为 26.1013.31256（build 20586）。未在 Windows/Linux 或所有 Harness 上执行完整端到端验证。

@starsalwaysineyes starsalwaysineyes mentioned this pull request Oct 16, 2026
Open
@coderabbitai

coderabbitai Bot commented Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: BytePioneer-AI/codex-host/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 2ae7ffd4-54bf-47f5-b7c1-0c3e1e009436
📥 Commits

Reviewing files that changed from the base of the PR and between 1aa9f65 and 7ad2528.

⛔ Files ignored due to path filters: 1
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing: 15
  • README.md
  • crates/updater/src/ssh.rs
  • crates/updater/src/ssh/tests.rs
  • docs/platforms/remote/remote-ssh-host.md
  • docs/platforms/remote/remote-ssh-host.zh-CN.md
  • docs/project/README.ko.md
  • docs/project/README.zh-CN.md
  • openspec/specs/engineering-workspace/spec.md
  • package.json
  • packages/renderer-extension/src/settings/remote-failure-messages.ts
  • packages/renderer-extension/test/settings/remote-failure-messages.test.ts
  • scripts/release/prepare-npm-meta.mjs
  • scripts/release/prepare-npm.mjs
  • tools/dev-desktop/run.mjs
  • tools/dev-desktop/run.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout: 2
  • GitHub Check: Check ubuntu-22.04
  • GitHub Check: Check windows-latest
🧰 Additional context used
🪛 ast-grep (0.45.3)
crates/updater/src/ssh/tests.rs

[error] 37-38: Passing non-literal (user-controlled or interpolated) data to a shell invoked via std::process::Command::new("sh"|"bash"|...) with -c allows command injection. Avoid spawning a shell: pass the program and each argument separately to Command::new(program).arg(arg) so the OS never re-parses the string, or strictly allowlist/escape any value that must reach a shell.
Context: Command::new("/bin/sh")
.args(["-c", &format!("{mocks}{}", script(&r).unwrap())])
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(command-injection-process-shell-rust)

🔇 Additional comments: 9
packages/renderer-extension/src/settings/remote-failure-messages.ts: 1

43-44: LGTM!

packages/renderer-extension/test/settings/remote-failure-messages.test.ts: 1

35-43: LGTM!

README.md: 1

290-290: LGTM!

docs/platforms/remote/remote-ssh-host.md: 1

20-20: LGTM!

docs/platforms/remote/remote-ssh-host.zh-CN.md: 1

20-20: LGTM!

docs/project/README.ko.md: 1

287-287: LGTM!

docs/project/README.zh-CN.md: 1

290-290: LGTM!

scripts/release/prepare-npm-meta.mjs: 1

54-54: LGTM!

scripts/release/prepare-npm.mjs: 1

852-852: LGTM!

📝 Summary

Summary by CodeRabbit

  • 兼容性
    • 新增对 Node.js 25 的支持，适用于开发环境和远程 SSH 主机。
    • Node.js 22 仍要求版本为 22.19 或更高；Node.js 24 继续受支持。
    • Node.js 23 和 26 不在支持范围内。

Node.js 25.x 已加入远程 SSH 安装器和开发桌面入口的支持范围。版本声明、错误提示、发布 README 和多语言文档也已更新。新增测试覆盖受支持版本和拒绝的版本边界。

Changes: Node.js 25 支持范围

Layer / File(s) Summary
运行时版本范围与边界验证
package.json, openspec/specs/engineering-workspace/spec.md, crates/updater/src/ssh.rs, crates/updater/src/ssh/tests.rs, tools/dev-desktop/run.mjs, tools/dev-desktop/run.test.mjs		 包的 Node.js 引擎范围、SSH 安装器和开发桌面入口现在接受 Node.js 25.x。测试覆盖 22.19、24、25 的通过情况，以及 22.18、23、26 的拒绝情况。
提示、文档与发布说明
packages/renderer-extension/src/settings/remote-failure-messages.ts, packages/renderer-extension/test/settings/remote-failure-messages.test.ts, README.md, docs/platforms/remote/*, docs/project/README.*.md, scripts/release/prepare-npm-meta.mjs, scripts/release/prepare-npm.mjs		 错误提示、项目和远程主机文档、工程规范及 npm README 生成内容均列出 Node.js 25.x。

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: bytepioneer-ai

Merge Risk: ⚪ Minimal · up to 7ad25

No merge-blocking issue is identified; the Node.js 25 support change is ready for normal merge checks.

Pre-merge checks: Passed 3 · Inconclusive 1

Failed Failed checks: 1 inconclusive

Check name Status Explanation Resolution
Linked Issues check Inconclusive 直接关联的开放 issue #545 要求允许 Node.js 25.x，同时保留 22.19+（仅 22.x）和 24.x，并继续拒绝 22.18、23 和 26。摘要显示 crates/updater/src/ssh.rs 已实现该规则，SSH 回归测试覆盖这些边界，并检查拒绝版本不调用 npm 或修改服务。tools/dev-desktop/run.mjs、版本声明、文档和中英文提示… 需要提供根 package-lock.json 中相关 engines 声明的可审查证据，或提供独立证据证明该声明与 Node.js 22.19+（22.x）、24.x、25.x 的要求同步。
Passed Passed checks: 3 passed
Check name Status Explanation
Description check Passed 描述准确说明了 Node.js 25 支持、版本边界、测试范围和验证结果，与变更内容直接相关。
Title check Passed 标题简洁且准确，明确说明了为远程设置和开发环境支持 Node.js 25。
Out of Scope Changes check Passed 变更范围与 issue #545 的编码目标一致。SSH 版本门槛和回归测试直接实现远程安装要求。源码启动入口、package engines、安装文档、开发文档及中英文提示支持版本同步。测试扩展验证这些行为。摘要未显示修改发行包内嵌 Node.js、固定 CI 工具链或其他无关功能。
Full details: Linked Issues check

Explanation

直接关联的开放 issue #545 要求允许 Node.js 25.x，同时保留 22.19+（仅 22.x）和 24.x，并继续拒绝 22.18、23 和 26。摘要显示 crates/updater/src/ssh.rs 已实现该规则，SSH 回归测试覆盖这些边界，并检查拒绝版本不调用 npm 或修改服务。tools/dev-desktop/run.mjs、版本声明、文档和中英文提示也已同步。无法确认根 package-lock.json 的 engines 声明是否与 package.json 同步，因为该文件按 !**/package-lock.json 规则被排除，且没有其他可审查证据。

Resolution

需要提供根 package-lock.json 中相关 engines 声明的可审查证据，或提供独立证据证明该声明与 Node.js 22.19+（22.x）、24.x、25.x 的要求同步。

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug] Remote SSH 安装拒绝 Homebrew Node.js 25，放行后服务可正常运行

1 participant

@starsalwaysineyes