Two findings from a delegated read-only audit of this repo, both verified from the
filesystem before patching.
1. No test asserted the node major, so a node-24 bump would have passed the smoke
suite SILENTLY. scripts/smoke-test.sh:94 was a bare `run "node" "node --version"`
— exit-0 and non-empty output only, the printed version compared to nothing —
while the line above it uses run_expect against $EXPECTED_PI_VERSION for pi. A
reader skimming the suite would reasonably assume node regressions were covered.
Worse, this is where the "node v22.23.2 verified" line in the v1.8.13 recreate
notes came from: printed output, not an assertion.
Now gated on EXPECTED_NODE_MAJOR, which CI derives from Dockerfile.base's ARG
NODE_VERSION — the single source of truth (Dockerfile.base:557 is the ONLY hard
pin in the repo; Dockerfile.variant has no node install at all). That also
catches a stale cached layer whose node disagrees with the declared ARG.
Unset => previous behaviour, so this is backward compatible.
Verified two-sided rather than assumed: the sed derivation yields 22 (empty
would have silently disabled the assertion, reintroducing the bug); grep -Fq
"v22." matches v22.23.2; "v24." does NOT match, so a wrong major is caught; and
"v2." does not prefix-collide. Workflow YAML re-parsed after editing (9 jobs).
2. The v1.8.13 entry claimed "the image's own 0.35.2" for agent-browser. The image
ships 0.36.0: /usr/lib/node_modules/agent-browser/package.json says version
0.36.0, engines.node >=24.0.0, and no 0.35.2 exists anywhere in the image. The
claim was also internally incoherent, contrasting 0.36.0 against a version that
is not present. Corrected in place with a visible note, since the entry is
already released. The reasoning survives untouched: the engines floor really is
vestigial, because /usr/bin/agent-browser is a prebuilt aarch64 ELF invoked
directly and never through node — which is why 0.36.0 runs fine on 22.23.2.
joakimp
5972a2c535