feat: revive Sentinel — upgrade all dependencies, add every needed agent, agent parity

.github/actions/setup-bun/action.yml

@@ -6,11 +6,11 @@ runs:
   steps:
     - uses: actions/setup-node@v4
       with:
-        node-version: 21.7.3
+        node-version-file: .nvmrc
 
     - uses: oven-sh/setup-bun@v2
       with:
-        bun-version: 1.3.6
+        bun-version: 1.4.2
 
     - uses: actions/cache@v4
       with:

.github/actions/setup-desktop-build/action.yml

@@ -1,5 +1,5 @@
 name: Setup Desktop Build Environment
-description: Set up Bun, install dependencies, and restore desktop build caches.
+description: Set up Bun, install dependencies, restore desktop build caches, and install the Electron binary.
 
 runs:
   using: composite
@@ -44,3 +44,9 @@ runs:
         key: ${{ runner.os }}-${{ runner.arch }}-desktop-build-${{ hashFiles('bun.lock', 'package.json', 'next.config.*') }}
         restore-keys: |
           ${{ runner.os }}-${{ runner.arch }}-desktop-build-
+
+    # Electron 42+ no longer downloads its binary during install, and
+    # build.electronDist packages node_modules/electron/dist.
+    - name: Install Electron binary
+      shell: bash
+      run: bun run electron:install

.github/workflows/ci.yml

@@ -4,11 +4,27 @@ on:
   pull_request:
     paths:
       - "src/**"
+      - "scripts/**"
+      - "desktop/**"
+      - "manifests/**"
+      - "package.json"
+      - "bun.lock"
+      - "tsconfig.json"
+      - "next.config.js"
+      - ".github/**"
   push:
     branches:
       - main
     paths:
       - "src/**"
+      - "scripts/**"
+      - "desktop/**"
+      - "manifests/**"
+      - "package.json"
+      - "bun.lock"
+      - "tsconfig.json"
+      - "next.config.js"
+      - ".github/**"
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -35,6 +51,14 @@ jobs:
           filters: |
             source:
               - 'src/**'
+              - 'scripts/**'
+              - 'desktop/**'
+              - 'manifests/**'
+              - 'package.json'
+              - 'bun.lock'
+              - 'tsconfig.json'
+              - 'next.config.js'
+              - '.github/**'
 
   pr-metadata:
     if: github.event_name == 'pull_request'
@@ -117,4 +141,27 @@ jobs:
       - uses: ./.github/actions/setup-bun
 
       - name: Run tests
-        run: bun run test
+        run: node scripts/run-tests.mjs --jobs 3
+
+  build:
+    name: build
+    needs: changes
+    if: ${{ needs.changes.outputs.source == 'true' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    env:
+      SKIP_ENV_VALIDATION: "1"
+      NODE_OPTIONS: "--max-old-space-size=4096"
+      SENTINEL_SKIP_STARTUP_TASKS: "1"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/setup-bun
+
+      - name: Build
+        run: bun run build
+
+      - name: Tripwires
+        run: node scripts/verify/tripwires.mjs

.node-version

@@ -1 +1 @@
-21.7.3
+24

.nvmrc

@@ -1 +1 @@
-21.7.3
+24

README.md

@@ -41,9 +41,11 @@ Some parts are solid. Some parts are rough. Things will change.
 Release builds are published on GitHub Releases:
 
 - [Download the latest release](https://github.com/Cronacl/Sentinel/releases)
-- macOS builds are available as DMGs
-- Windows builds are available as NSIS installers
-- Linux builds are available as AppImages, DEBs, and RPMs
+- macOS builds are available as DMGs and need macOS 13 (Ventura) or later
+- Windows builds are available as NSIS installers for 64-bit Windows 10 or later
+- Linux builds are available as AppImages, DEBs, and RPMs for x64 and arm64 and need glibc 2.34 and libstdc++ from GCC 11 or newer (for example Ubuntu 22.04, Debian 12, Fedora 35, or RHEL 9)
+
+Electron 44 dropped support for macOS 12, 32-bit Windows, and 32-bit ARM Linux, so Sentinel no longer ships for them. Copies already installed on macOS 12 keep working, but the in-app updater no longer offers them new versions.
 
 If you want the current development version, run it locally from source.
 
@@ -136,11 +138,11 @@ This is a desktop app first. A lot of the useful parts depend on running close t
 
 ### Prerequisites
 
-- [Bun](https://bun.sh)
-- Node.js
-- Platform build tools for native dependencies when prebuilt binaries are not available:
+- [Bun](https://bun.sh) 1.4 or later
+- Node.js 24 LTS (see `.nvmrc`)
+- On Linux, build tools for `node-pty`, which has no prebuilt Linux binary: `build-essential`, `python3`, `make`, and `g++`
+- On macOS and Windows, build tools only if the native repair step asks for them:
   - macOS: Xcode Command Line Tools
-  - Linux: `build-essential`, `python3`, `make`, and `g++`
   - Windows: Visual Studio Build Tools with Desktop development with C++
 
 ### Run locally
@@ -155,7 +157,9 @@ The app runs at `http://localhost:3232`.
 
 `ENCRYPTION_KEY` can be left empty in `.env`. Sentinel will generate one on first desktop launch.
 
-Sentinel repairs native Node dependencies at startup. Most machines use prebuilt binaries. If a runtime, OS, or CPU combination has no matching prebuild, the startup script builds the native dependency locally and prints the platform package to install when build tools are missing.
+Electron no longer downloads its binary during `bun install`. `bun run dev:desktop` and the desktop build commands fetch it on first use; run `bun run electron:install` to download it ahead of time.
+
+Sentinel checks its native Node dependencies at startup. `better-sqlite3` loads the N-API prebuild bundled for your OS and CPU and is never compiled locally; on Linux that prebuild needs glibc 2.34 and libstdc++ from GCC 11 or newer. `node-pty` uses its prebuilt binary on macOS and Windows; on Linux, `bun install` compiles it. If the `node-pty` binary does not load, the startup script rebuilds it locally and prints the platform package to install when build tools are missing.
 
 On Linux, Sentinel disables Electron's Chromium process sandbox by default for compatibility with systems where user namespaces or the setuid sandbox are unavailable. Linux packages also launch with `--no-sandbox` from their desktop entries. Set `SENTINEL_LINUX_SANDBOX=true` when launching the executable directly to force the Chromium sandbox back on.