windsurf-ls-release: a language server binary mirror for WindsurfAPI

windsurf-ls-release is a language server binary mirror repo I built for my other project, WindsurfAPI. WindsurfAPI needs a language server binary to run, and this pile of language_server_* files lives inside Devin Desktop’s official desktop package, where the location, version, and structure can change without warning. I didn’t want users pointing install-ls.sh straight at an upstream that can move at any time, so I split off this mirror.

Every day on a schedule it pulls the latest binaries out of upstream and republishes them as a GitHub Release to act as a fallback. The installer just points here:

https://github.com/dwgx/windsurf-ls-release/releases/latest/download

To be clear: what gets published are binaries extracted directly from the upstream package, not something I compiled. I’m just a middle layer that moves and verifies them.

At the core is a GitHub Actions workflow, cron: "17 3 * * *", that runs every day in the early morning. Three steps map to three pure-Python scripts. discover_release.py scrapes docs.devin.ai, parses out the JSON/MDX blocks on the page, and takes the latest version from both the stable and next channels to assemble a manifest. build_assets.py downloads the official archives per the manifest, .tar.gz on Linux and .zip on mac/Win, and extracts language_server_* from them; the unpacking step has path-traversal protection added, because you can’t trust what’s in the archive, and who knows if there’s a ../../ in there trying to write outside. render_release_notes.py renders the release notes, along with release-manifest.json and SHA256SUMS.

A few things I care about. stable publishes as Latest, next publishes as prerelease, so /releases/latest/download/ always points only at the stable version and never gets bumped by next to break users. Fail closed: if the upstream structure changes, the script exits immediately and never silently ships the wrong thing. The worst thing a mirror can do is quietly publish the wrong version. Non-default branches only verify and don’t publish; actual publishing only happens on the default branch, with stable tagged v<version> and next tagged next-v<version>. Among platforms, only Linux x64 is marked as must-succeed; the rest are best-effort.

While I was at it I wrote tools/update_ls_linux_x64.sh, a standalone POSIX shell updater. It prefers the ghfast.top proxy, falls back to a direct connection if the proxy is down, verifies SHA256 after downloading and before swapping in the file. Proxy fallback is a hard requirement when pulling from GitHub inside China.

LS_CHANNEL=stable ./tools/update_ls_linux_x64.sh

The whole project uses only the Python 3.12 standard library, zero third-party dependencies, with tests in unittest. For a job that’s just download, unpack, verify, I didn’t want to pip install a bunch of stuff first. The thinner the better. Now it quietly runs once a day, staying alive as the public binary source for WindsurfAPI.