GitNexus/gitnexus/prebuilds/bundled

Audited npm grammar prebuild repairs

These five exact npm releases ship x86-64 binaries in their linux-arm64 prebuild directories: C++ 0.23.4, Java 0.23.5, Ruby 0.23.1, JavaScript 0.23.1 (the TypeScript dependency), and TypeScript 0.23.2. The direct JavaScript 0.25.0 package is unaffected. See GitNexus issue #3599.

manifest.json records each immutable npm tarball URL, SHA-512 integrity, SHA-256, upstream commit, unchanged source-file hashes, replacement SHA-256, and build inputs. All generated parser C and scanner sources remain upstream bytes. The TypeScript binary retains both TypeScript and TSX exports.

The committed replacements were cross-built using GCC/G++ 13.3.0, binutils 2.42, node-gyp 11.5.0, node-addon-api 8.9.2 and Node 22.23.1 headers. Although the build sysroot contains glibc 2.39, readelf confirms the outputs require only GLIBC 2.17, GLIBCXX 3.4.21 and CXXABI 1.3.9, with a non-executable stack. All six language exports loaded and parsed using tree-sitter 0.25.1 under ARM64 Node 22.18.0, 22.23.1 and 24.19.0 via QEMU 8.2.2 user emulation. This is emulated execution evidence; the packaged-install CI job supplies native ARM64 evidence.

Regeneration

On Linux ARM64 with Node, npm, Python, make, GCC/G++, tar and readelf installed:

cd gitnexus
node scripts/rebuild-bundled-grammar-prebuilds.cjs
node scripts/prepare-tree-sitter-bundle.cjs --for-publication
npx vitest run test/unit/prepare-tree-sitter-bundle.test.ts test/unit/prebuild-coverage.test.ts test/unit/parser-loader-abi.test.ts

The script downloads the recorded tarballs and headers, verifies their hashes, installs the pinned build helpers with lifecycle scripts disabled, and builds packages serially in a temporary tree. Builds use gcc and g++ from PATH, preserving only PATH and HOME from the caller's environment. Compiler, make, and gyp overrides (including CC, CXX, and flags) are ignored so the recorded toolchain matches the build. It checks unchanged source bytes, ELF architecture, N-API, dynamic dependency baselines, and real native parsing before replacing any committed output. Compiler changes can change the binary hashes; review the updated binaries and provenance together. This is a bounded npm-package overlay rebuild, separate from the source-vendored grammar matrix.

Packaging behavior

Bundle preparation validates every repair before writing peer manifests or binary files. prepack supplies --for-publication to remove local build/Release/*.node and build/Debug/*.node outputs from repaired packages, which would otherwise shadow their platform prebuilds. Normal consumer postinstall keeps legitimate source-built fallbacks intact. Repair assets are included in the npm package so postinstall remains self-contained.

Corrected bytes must exist before consumer child install scripts run. The upstream TypeScript and nested JavaScript builds share node-addon-api Makefile outputs; configuring them at different dependency depths can overwrite those outputs with conflicting relative stamp paths. Repairing this upstream build behavior for explicit --build-from-source or raw source-checkout installation is outside this fix. Ordinary supported Linux ARM64 glibc tarball installation uses the corrected prebuilds and does not require compilation.