ci: run on Node 24 and smoke-test the bundle on Node 20

[satsukies]

Summary

Move CI and the release workflow from Node 20 (EOL) to Node 24, and add a bundle-compat CI job that builds the bundle on Node 24 and smoke-tests it on Node 20.0.0, the exact engines minimum. engines.node stays at >=20.0.0, so this has no user-facing change. It unblocks #73 (vitest 5 requires Node ^22.12.0 || ^24.0.0 || >=26.0.0).

• scripts/smoke-bundle.mjs (new): dependency-free script that spawns the bundle with the current Node, sends initialize and tools/list over stdio, and checks the server name and that a non-empty, well-formed tool list comes back. It points HOME / XDG_CONFIG_HOME / APPDATA at an empty temp directory so a locally stored token is never read. It fails on an early exit, a 15s timeout, an error response, or any stdout line that is not a JSON-RPC 2.0 object.
• .github/workflows/ci.yml: check runs on Node 24. New bundle-compat job: npm ci && npm run bundle on Node 24, then copy plugin/ to $RUNNER_TEMP and run node scripts/smoke-bundle.mjs against the copy on Node 20.0.0. The copy matches what the Claude Code plugin cache installs, so neither node_modules nor the root package.json ("type": "module") is visible to the bundle.
• .github/workflows/release.yml: both node-version: 20 entries → 24.
• CLAUDE.md: describe the new CI setup.

Related Issue

Closes #77

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / internal change
• Build / CI / tooling

Test plan

• npm run build passes
• npm test passes (234 tests)
• Manually verified the change (describe how below)

Run locally:

• npm run bundle, then node scripts/smoke-bundle.mjs on Node 20.20.2, 22.23.3, 24.21.0 and 26.5.0: all pass (deploygate 1.5.1, 58 tools).
• The bundle built from Bump the dev-dependencies group across 1 directory with 5 updates #73 (@modelcontextprotocol/sdk 1.32.0, zod 4.6.5) also passes on Node 20.
• Failure cases all exit 1 with a clear message: a bundle that crashes on start, one that never responds (timeout), one that returns no tools, one that prints a non-JSON-RPC line to stdout ({}, null, [], {"jsonrpc":"1.0"}), and a missing bundle path.
• A bundle built with zod left as an external import passes when run inside the checkout but fails with ERR_MODULE_NOT_FOUND once copied out, which confirms the job now catches bundles that are not self-contained.
• The bundle-compat job on this PR is the check that runs on GitHub Actions.

Depends on #79. Pinning Node 20.0.0 exposed a real bug: the installed plugin fails to start on Node 20.0–20.18 and 22.0–22.6 because nothing marks bundle.js as ESM outside this repo. #79 fixes it. Until #79 is merged, bundle-compat here fails with SyntaxError: Cannot use import statement outside a module, which is the job catching that bug. After #79 is merged, rebase this PR and the job should pass. A local simulation of the CI steps fails without #79 and passes with it.

After merge, Dependabot will rebase #73, and its CI should no longer log EBADENGINE for vitest@5.0.3.

Checklist

• I have updated the plugin version in plugin/.codex-plugin/plugin.json and plugin/.claude-plugin/plugin.json if applicable (not applicable: CI only)
• I have read and agree to the Code of Conduct

🤖 Generated with Claude Code

[devin-ai-integration]

Devin Review found 2 potential issues.

[Copilot]

Copilot review overview

🟡 Changes recommended

The compatibility test retains installed dependencies and does not reject all malformed JSON-RPC output.

Review effort: Balanced
Findings: 2

Open (2)

• Smoke test retains node_modules and misses external dependencies · New
• Validate JSON-RPC structure instead of accepting arbitrary JSON · New

What changed in this PR

Updates CI and release tooling to Node 24 while retaining Node 20 bundle compatibility checks.

Changes:

• Runs CI and release workflows on Node 24.
• Adds a Node 20 MCP bundle smoke test.
• Documents the updated CI strategy.

File	Description
.github/​workflows/​ci.yml	Adds Node 24 builds and Node 20 compatibility testing.
.github/​workflows/​release.yml	Moves release jobs to Node 24.
scripts/​smoke-bundle.mjs	Exercises initialization and tool discovery over stdio.
CLAUDE.md	Documents CI runtime and compatibility coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The compatibility job tests the latest Node 20 release rather than the declared minimum of Node 20.0.0.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Validate JSON-RPC structure instead of accepting arbitrary JSON
• Smoke test retains node_modules and misses external dependencies

Previously missed (1)

In code that hasn't changed since last review

Test the declared minimum Node.js engine version

.github/​workflows/​ci.yml:44

node-version: 20 selects the latest 20.x release, not the declared engine floor of 20.0.0. The job can therefore pass even if the bundle uses an API added during the Node 20 release line, leaving engines.node: >=20.0.0 unverified. Pin the actual minimum here (or raise engines to the version being tested).

[Copilot]

Copilot review overview

🟡 Changes recommended

The compatibility job cannot pass until dependent PR #79’s ESM marker is incorporated.

Review effort: Balanced
Findings: 1

Open (1)

• Missing ESM boundary causes bundle job failure · New

[Copilot]

Copilot review overview

🟢 Approval recommended

The workflows and smoke test correctly verify the supported runtime boundary without changing user-facing requirements.

Review effort: Balanced
Findings: 1

Open (1)

• Missing ESM boundary causes bundle job failure

[enomoto-kazuya]

LGTM!