fix(sea): match blob generator to target Node version

[robertsLando]

Summary

SEA binaries built via pkg --sea . crashed at startup on a range of host/target Node.js patch-release combinations, reported on macOS arm64 + Linux arm64 + Windows x64 in discussion #236 (minimal NestJS repro: julianpoemp/yao-pkg-nestjs-sea-example). Symptoms:

EXC_BAD_ACCESS inside node::BlobDeserializer<SeaDeserializer>::ReadArithmetic<unsigned long>
  → node::sea::FindSingleExecutableResource()
  → node::sea::FixupArgsForSEA(int, char**)
  → node::Start(int, char**)

Root cause

Node.js changes the SEA prep-blob header layout between patch releases within the same major line — not just between majors (22.19/22.20 added fields, 25.8 added exec_argv_extension, etc.). pkg's old pickBlobGeneratorBinary matched host-to-target only at the major level, so any Node 22.x on the host would be used verbatim to generate a blob that the downloaded Node 22.22.2 target binary (the one pkg injects into) couldn't deserialize — segfault at FindSingleExecutableResource.

Reproduced the exact same crash on Linux by iterating host Node via nvm:

host Node	target = node22-linux-x64
v22.12.0 – v22.18.0	exit 139 (SIGSEGV, matching frame-for-frame)
v22.20.0+	works

Fix

Rewrote pickBlobGeneratorBinary in lib/sea.ts to:

1. Prefer a downloaded target binary whose platform+arch matches the host. It's the exact same version pkg will inject into and it's runnable locally — so generator and reader are byte-for-byte version-matched by construction.
2. Fall back to process.execPath only for true cross-platform builds (e.g. Linux host → Windows target) where no downloaded target is executable on the host. Same-major skew is still theoretically possible there but there's no alternative — pkg can't fabricate a host-runnable binary of the exact target version for a foreign platform.

Secondary cleanups in the same PR

• Skip patchMachOExecutable for SEA binaries — for SEA, __LINKEDIT already sits after NODE_SEA at the file tail, so the patch is a no-op. Per the Node.js SEA docs, SEA binaries on macOS just need codesign --sign -.
• Drop the redundant codesign --remove-signature pre-strip in bake(). signMacOSIfNeeded → codesign -f --sign - already force-replaces the existing signature after postject injection.
• Collapse signMacOS{,Sea}IfNeeded behind an isSea flag.

Test plan

• Reproduced the crash on Linux x64 with host Node 22.12.0/22.15.0/22.17.1/22.18.0 — same gdb stack trace as the reporter's lldb trace on macOS arm64.
• After the fix, every one of those host versions produces a working binary that serves GET /api → {"message":"Hello API"}.
• Cross-platform fallback verified (Linux x64 host → macos-arm64 target via ldid).
• Multi-target build verified (-t node22-linux-x64,node22-macos-arm64,node22-win-x64 from a Linux x64 host — all three artifacts produced, linux-x64 runs cleanly).
• All SEA tests pass on Linux x64.
• yarn lint clean.
• macOS arm64 host verification — @julianpoemp to confirm against the repro.

Refs: discussion #236

[robertsLando]

Follow-up: root cause identified, additional fix pushed (a24854e)

After the first two commits didn't fix the macOS segfault for @julianpoemp, I re-ran the investigation end-to-end on a clean Linux x64 host using the NestJS repro:

Binaries I cross-compiled from Linux (PR branch at HEAD before this commit) — all confirmed working by the reporter:

Target	Verified by
linux-x64	me (native) + reporter
linux-arm64	me (Docker+QEMU) + reporter (Ubuntu ARM VM)
macos-arm64	reporter (macOS Tahoe 26.4.1)
win-x64	reporter (Windows 11 x64)

When the reporter built the same targets on their macOS arm64 host with this PR applied, all four targets (incl. Linux/Windows cross-builds) segfaulted at node::sea::LoadSingleExecutableApplication with v8::ToLocalChecked Empty MaybeLocal. Since the blob generator, postject invocation, and sign step all run on the build host, this pinned the regression to the one pipeline step that differs between hosts.

The culprit

bake() in lib/sea.ts called codesign --remove-signature on the downloaded Node binary before postject injection, but only when process.platform === 'darwin'. On Linux/Windows hosts we skipped that call entirely — and those builds work. On macOS Tahoe (26.x) the pre-strip leaves the Mach-O in a state that survives postject but produces a SEA blob that node::sea::LoadSingleExecutableApplication can't deserialize.

The fix

a24854e drops the pre-strip. signMacOSIfNeeded → codesign -f --sign - already force-replaces any existing signature after postject injection, so the pre-strip was redundant to begin with — the Node.js SEA docs recommend it, but with postject's current Mach-O injection path on recent macOS it's actively harmful for non-trivial payloads.

Net PR state

1. (existing) 3d932d0 — skip patchMachOExecutable __LINKEDIT extension for SEA. Still needed: postject creates a proper NODE_SEA LC_SEGMENT_64, patching __LINKEDIT on top corrupts the layout.
2. (existing) 2952a91 — collapse signMacOS{,Sea}IfNeeded behind isSea flag.
3. (new) a24854e — drop redundant codesign --remove-signature pre-strip. The actual fix for the macOS-host regression.

Waiting for @julianpoemp to re-test a macOS-host build of the NestJS repro against the updated branch to fully close the loop.

[Copilot]

Pull request overview

Fixes SEA startup crashes caused by generating SEA prep blobs with a Node binary whose patch-version header layout doesn’t match the injected target Node binary, and streamlines macOS signing behavior for SEA outputs.

Changes:

• Reworked SEA blob-generator selection to prefer host-runnable, version-matched downloaded target binaries and add safer fallbacks.
• Adjusted macOS signing flow for SEA builds (skip Mach-O __LINKEDIT patching for SEA; remove redundant signature stripping).
• Added a focused unit test for the host/target matching helper used by the new picker logic.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
test/test-00-sea-picker/main.js	Adds a unit test for host platform/arch target matching used by SEA blob-generator selection.
lib/sea.ts	Implements new blob-generator selection strategy; refactors macOS signing to optionally skip Mach-O patching for SEA.
lib/mach-o.ts	Removes now-unused Mach-O signature removal helper and narrows exports.