enola 0.4.4.1 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84ee668ecfaed2e6d8ebc55fe5054e1635300502f762887f2d7b96660beb908f
-  data.tar.gz: 2905c89cad26afb7f6226515c7b3620ed6e089c16ff5886398f4043deda50360
+  metadata.gz: 35717854ffb165b2d79fe06be0998d847a25a0ce10a2907ab155a39fd3119a75
+  data.tar.gz: 8940517eabb47871b5321fd23ed4f369cc7f31486f2f486096fdf78cd8e6cbcc
 SHA512:
-  metadata.gz: e8b8a19a54c9f13be8b2dd6a1d62b5cb999d14a7ff959f0771ca25cfc63b6fac3822bc31ccd676cc44c60e4106401c626f9fc1e7b2802a68d3f5f68a0c23c322
-  data.tar.gz: 42a9119e1b7d33d1a20b3e3d9f7a79f2c8199de3599365f6d13674db19a968aba0a749180014b061bb413940a17ae8212ebf63181ee40302acdcae20952c1bb5
+  metadata.gz: cd181d1618ba05ebea4a77136ed6fc5d3afd197978c955576e1c8554d374b7558c3b4b0bd12b87e14f4c88642ff55faa6a5e8ef35bf12e33963fe7345418a778
+  data.tar.gz: 89206de715d8b08d9b7138cf4400df93b9385cf8b45c94bb08aa7de7b90f01267398e4d5da1f1ed3a4e87cd58ad33cf1e5f7492a6480ccee647a9129806ec142

data/CHANGELOG.md

@@ -1,3 +1,23 @@
+## enola 0.5.1 (2026-08-23)
+
+The resolver no longer probes its own binstub. It read a candidate's first 512
+bytes looking for the marker RubyGems writes, and a real binstub carries a
+`/bin/sh` + `ruby -x` preamble holding the interpreter's absolute path, which puts
+that marker around byte 580 — outside the window. So the guard missed every
+RubyGems-generated binstub, the wrapper ran itself, and running itself has no
+bottom: `enola --version` on a cold cache spawned Ruby processes until it was
+killed. The whole file is read now, capped at 64 KiB so a released binary is never
+slurped only to be rejected, and `Gem.bin_path` is recognised beside
+`Gem.activate_bin_path`. A probe also marks its child's environment, and a resolver
+that sees the marker declines to look at PATH at all, so the recursion is bounded
+by construction rather than by how well a heuristic reads a file.
+
+The marker is written where it is spawned: every probe passes it into the child,
+so a wrapper reached under another name leaves PATH alone instead of probing in
+turn. That bound is what covers the wrappers the content check cannot see, a
+version manager's shim among them, which carries none of the markers a binstub
+does. Reported and fixed by dejo1307 in #1.
+
 ## munola 0.4.4.2 and munola-rb 0.4.4.2 (2026-08-23)
 
 munola follows the channel it drives. Its binary is now cut from the stable

data/LICENSE

@@ -187,7 +187,7 @@ APPENDIX: How to apply the Apache License to your work.
   same "printed page" as the copyright notice for easier
   identification within third-party archives.
 
-Copyright (c) 2026 Dejan Menges
+Copyright (c) 2026 Muhamed Isabegovic
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

data/README.md

@@ -11,8 +11,9 @@ once, in `enola-rb`, and the munola gems add only what is munola's own.
 
 ## `enola`
 
-The wrapper of the released enola. Its version is the upstream release it
-drives: `enola 0.4.4` runs enola-labs' v0.4.4.
+The wrapper of the released enola. The gem versions itself; the release it
+drives is `Enola::UPSTREAM_VERSION`, v0.4.4 as of `enola 0.5.0`, and every
+gemspec summary names it.
 
 ```ruby
 gem "enola"
@@ -44,7 +45,7 @@ This gem is not an enola-labs release; it runs theirs.
 
 ## `enola-rb`
 
-The Rails layer over `enola`. It depends on `enola` at the same version and on
+The Rails layer over `enola`. It depends on `enola` at the same minor and on
 [enola-guides](https://github.com/misabegovic/enola-guides), and adds nothing
 to the binary's surface.
 
@@ -73,10 +74,10 @@ remedy.
 
 One person's taste on top of enola: the same wrapper over another channel,
 the builds cut from [a fork of enola](https://github.com/misabegovic/enola),
-versioned as the upstream they are built on plus a fourth segment
-(`0.4.4.1` drives a build on v0.4.4), each release naming what differs from
-that upstream. It is offered upstream where it fits and is not positioned
-against it. What it adds is the channel and the catalogue.
+each release naming what differs from that upstream. The gem versions itself;
+the channel release it fetches is `Munola::CHANNEL_VERSION`, which carries the
+upstream it is built on plus a segment of its own (`0.4.4.2` on v0.4.4). It is
+offered upstream where it fits and is not positioned against it. What it adds is the channel and the catalogue.
 
 ```ruby
 gem "munola"
@@ -99,18 +100,19 @@ inflection table; it writes `mcp-arch.yaml` with both Ruby providers on by
 default, Prism through the script the `enola` gem carries and Rubydex built
 into the binary, and fetches the Rubydex library, a failed fetch reported as a
 named skip. It never asks a question. `munola --version` names the munola
-version, the upstream it is built on and which binary answered.
+version, the channel release and upstream it is built on, and which binary
+answered.
 
 The binary comes from the fork's releases the way `enola`'s comes from
 upstream's, fetched on first use and verified against the sha256 the release
 publishes; `MUNOLA_BINARY=/path/to/enola` names one to drive instead, and
-every command says which answered. `munola` depends on `enola` at its upstream
-version and on `enola-guides` 0.3.1 or later; requiring it loads no Rails.
+every command says which answered. `munola` depends on `enola` at the same
+minor and on `enola-guides` 0.3.1 or later; requiring it loads no Rails.
 
 ## `munola-rb`
 
 The Rails layer over `munola`, what `enola-rb` is to `enola`. It depends on
-both at their own versions and adds one generator.
+both at the same minor and adds one generator.
 
 ```ruby
 gem "munola-rb"

data/lib/enola/probe.rb

@@ -6,12 +6,18 @@ module Enola
   class Probe
     SURFACES = %w[constraints providers check plan hook].freeze
 
+    # A probed binary may be this wrapper wearing another name. The marker
+    # travels into the child, where the resolver reads it and leaves PATH
+    # alone, so a probe cannot start another one.
+    PROBE_ENV = "ENOLA_RESOLVER_PROBE"
+    CHILD_ENV = {PROBE_ENV => "1"}.freeze
+
     def initialize(binary)
       @binary = binary
     end
 
     def version
-      out, status = Open3.capture2e(@binary, "--version")
+      out, status = Open3.capture2e(CHILD_ENV, @binary, "--version")
       return nil unless status.success?
 
       out[/\d+\.\d+\.\d+(?:[.-][\w.]+)?/]
@@ -23,7 +29,7 @@ module Enola
     # for --help); one it lacks is refused by the top-level dispatch by name.
     def capabilities
       SURFACES.to_h do |surface|
-        out, = Open3.capture2e(@binary, surface, "--help")
+        out, = Open3.capture2e(CHILD_ENV, @binary, surface, "--help")
         [surface.to_sym, !out.include?("unknown command \"#{surface}\"")]
       rescue SystemCallError
         [surface.to_sym, false]

data/lib/enola/resolver.rb

@@ -25,9 +25,19 @@ module Enola
 
     EXECUTABLE = File.expand_path("../../exe/enola", __dir__)
 
+    # A binstub is a script; the released binary is megabytes. The cap keeps the
+    # whole-file read cheap and means a real binary is never slurped to be rejected.
+    MAX_SCRIPT_BYTES = 64 * 1024
+
     private
 
     def matching_path_binary
+      # A probe runs the candidate, and the candidate may be this wrapper wearing
+      # another name. The marker travels into that child, and a resolver that finds
+      # it declines to look at PATH — so the recursion is bounded by construction
+      # rather than by how well the check below reads a file.
+      return [nil, nil] if ENV[Probe::PROBE_ENV]
+
       candidate = @path.split(File::PATH_SEPARATOR).map { |dir| File.join(dir, "enola") }
                        .find { |bin| File.executable?(bin) && !wrapper?(bin) }
       return [nil, nil] unless candidate
@@ -39,11 +49,18 @@ module Enola
     # Bundler puts this gem's own exe on PATH, and a rubygems binstub for the
     # gem looks like a binary too; probing either would run the wrapper inside
     # itself without end.
+    #
+    # The whole file is read, not a fixed head. RubyGems writes a /bin/sh + `ruby -x`
+    # polyglot preamble carrying the interpreter's absolute path, so the marker sits
+    # ~580 bytes in — past the 512 this used to read, which made the guard miss every
+    # real binstub and the wrapper probe itself without end.
     def wrapper?(bin)
       return true if File.realpath(bin) == File.realpath(EXECUTABLE)
+      return false if File.size(bin) > MAX_SCRIPT_BYTES
 
-      head = File.binread(bin, 512)
-      head.include?("Gem.activate_bin_path") || head.include?('require "enola"')
+      body = File.binread(bin)
+      body.include?("Gem.activate_bin_path") || body.include?("Gem.bin_path") ||
+        body.include?('require "enola"')
     rescue SystemCallError
       true
     end

data/lib/enola/version.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 module Enola
-  # The release this wrapper drives. VERSION carries a patch segment for
-  # wrapper-only fixes, so what to fetch is stated separately.
+  # The gem versions itself. UPSTREAM_VERSION names the enola release it
+  # fetches and drives.
   UPSTREAM_VERSION = "0.4.4"
-  VERSION = "#{UPSTREAM_VERSION}.1"
+  VERSION = "0.5.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: enola
 version: !ruby/object:Gem::Version
-  version: 0.4.4.1
+  version: 0.5.1
 platform: ruby
 authors:
 - Muhamed Isabegovic
@@ -26,8 +26,9 @@ dependencies:
         version: '1.3'
 description: |
   A pure-Ruby wrapper around enola, the architecture-graph tool by enola-labs.
-  The gem's version is the upstream release it drives. The binary is not in
-  the gem: the first command that needs it downloads the release for your
+  The gem versions itself; the enola release it drives is named in its
+  UPSTREAM_VERSION, 0.4.4 here. The binary is not in the
+  gem: the first command that needs it downloads the release for your
   platform, verifies it against the checksum the release publishes, and keeps
   it in a per-user cache. Every command and exit code is forwarded unchanged.
   This gem is not an enola-labs release.
@@ -79,6 +80,6 @@ requirements: []
 rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
-summary: 'Runs the released enola from Ruby: fetched on first use, verified, pinned
-  to this gem''s version.'
+summary: 'Runs the released enola from Ruby: fetched on first use, verified, cached.
+  This release drives enola 0.4.4.'
 test_files: []