@invarn/cibuild 2.4.2 → 2.4.4

package/dist/src/yaml/steps/render-post-processor.d.ts

@@ -52,12 +52,6 @@ export interface TrimDims {
 export interface TrimHelperInvocation {
     cmd: string;
     args: string[];
-    /** Child environment override. Set only for the pkg self-exec, where the
-     *  node-invoke sentinel (PKG_EXECPATH) must be stripped so the re-executed ci
-     *  binary runs its baked cli entrypoint (dispatching `fidelity-trim`) instead
-     *  of re-entering Node-emulation and treating it as a script path. Absent for
-     *  the other homes, which spawn with the inherited environment unchanged. */
-    env?: Record<string, string>;
 }
 /**
  * The platform-neutral helpers embedded in the trim-stage script.
@@ -79,14 +73,18 @@ export interface PostProcessorInternals {
 /**
  * Evaluates the embedded trim-stage source and returns its pure helpers, so
  * unit tests exercise exactly the code that ships inside the runtime script
- * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp` and
- * `process` are injectable so the invocation/spawn seams are testable; the
- * other trim-stage functions reference runtime globals (fs, path, ...) only
- * when called, so defining them here is harmless.
+ * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp`, `process`,
+ * `fs`, `os` and `path` are injectable so the invocation/spawn/copy seams are
+ * testable; at runtime the stage is spliced into the generated script where
+ * those names are `require`d globals. Uninjected deps only matter for branches
+ * that dereference them (the pkg copy path), so existing callers can omit them.
  */
 export declare function getPostProcessorInternals(overrides?: {
     cp?: unknown;
     processRef?: unknown;
+    fs?: unknown;
+    os?: unknown;
+    path?: unknown;
 }): PostProcessorInternals;
 /**
  * Resolves the on-disk JS entrypoint of this cibuild installation's CLI

package/dist/src/yaml/steps/render-post-processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-post-processor.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/render-post-processor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,MA6HtC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,YAAY,CAAC;IACxB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;iFAI6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1F;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE;IACpD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,sBAAsB,CASzB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAqBhD"}
+{"version":3,"file":"render-post-processor.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/render-post-processor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAuJtC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,YAAY,CAAC;IACxB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1F;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE;IACpD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GAAG,sBAAsB,CAkBzB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAqBhD"}

package/dist/src/yaml/steps/render-post-processor.js

@@ -72,14 +72,44 @@ function parseTrimDims(stdout) {
   return null;
 }
 
+// Lazily copy the pkg ci binary to a scratch path so the trim can invoke it
+// WITHOUT re-executing process.execPath. Under pkg the generated render script
+// runs as an app-mode child of the ci binary, so process.execPath IS the ci
+// binary -- but pkg refuses to let a binary re-invoke ITSELF as a subcommand:
+// spawning process.execPath forces the child into Node-emulation, where
+// 'fidelity-trim' is treated as a main-module script path ("Cannot find module
+// '<cwd>/fidelity-trim'") and the subcommand dispatch never runs, so the trim
+// silently no-ops and untrimmed renders ship. A COPY of the binary at a
+// different path is NOT seen as a self-exec, so it runs the baked cli entrypoint
+// normally (with the bundled pngjs). Copied once per run; returns null if the
+// copy can't be made, and the caller then degrades to a best-effort no-op trim.
+// Verified on the runner: a copy-spawn dispatches and emits TRIMDIMS, while an
+// execPath self-exec crashes with the module-not-found above.
+var ciTrimBinCopy;
+function ciBinaryCopyForTrim() {
+  if (typeof ciTrimBinCopy !== 'undefined') return ciTrimBinCopy;
+  try {
+    var dest = path.join(os.tmpdir(), 'ci-fidelity-trim-bin');
+    if (!fs.existsSync(dest)) {
+      fs.copyFileSync(process.execPath, dest);
+      fs.chmodSync(dest, 493); // 0o755
+    }
+    ciTrimBinCopy = dest;
+  } catch (copyErr) {
+    ciTrimBinCopy = null;
+  }
+  return ciTrimBinCopy;
+}
+
 // Resolve how to reach the ci CLI's fidelity-trim helper from inside this
 // generated script. Three homes, in order:
 //  1. CIBUILD_CLI_JS -- an explicit JS entrypoint (preview harnesses, tests),
 //     run under the same node executing this script.
-//  2. The pkg-built ci binary re-executing itself -- the production runner
-//     path, where this script runs under the pkg bootstrap and
-//     process.execPath IS the ci binary.
-//  3. A ci on PATH (brew/npm installs).
+//  2. Under pkg (the production runner path) process.execPath IS the ci binary,
+//     but pkg won't let it re-invoke itself as a subcommand, so spawn a COPY of
+//     it (see ciBinaryCopyForTrim). Fall back to the (best-effort) self-exec if
+//     the copy can't be made.
+//  3. A ci on PATH (brew/npm installs) when not running under pkg.
 function trimHelperInvocation(args) {
   if (process.env.CIBUILD_CLI_JS) {
     return {
@@ -88,22 +118,11 @@ function trimHelperInvocation(args) {
     };
   }
   if (process.pkg) {
-    // The runner spawns this script as 'node <script>', which the pkg binary
-    // intercepts and runs in Node-emulation mode -- so process.env carries
-    // pkg's node-invoke sentinel (PKG_EXECPATH). Re-execing process.execPath
-    // with it still set makes the child ci binary ALSO enter Node-emulation and
-    // treat 'fidelity-trim' as a main-module script path (Cannot find module
-    // '<cwd>/fidelity-trim'), never reaching the subcommand dispatch -- so the
-    // trim silently fails and untrimmed renders ship. Strip PKG_EXECPATH from
-    // the child env so the re-exec runs the baked cli entrypoint, which routes
-    // 'fidelity-trim' to the in-binary helper (with bundled pngjs).
-    var invocation = { cmd: process.execPath, args: ['fidelity-trim'].concat(args) };
-    if (process.env.PKG_EXECPATH !== undefined) {
-      var appEnv = Object.assign({}, process.env);
-      delete appEnv.PKG_EXECPATH;
-      invocation.env = appEnv;
-    }
-    return invocation;
+    var copy = ciBinaryCopyForTrim();
+    return {
+      cmd: copy === null ? process.execPath : copy,
+      args: ['fidelity-trim'].concat(args),
+    };
   }
   return { cmd: 'ci', args: ['fidelity-trim'].concat(args) };
 }
@@ -112,9 +131,16 @@ function trimHelperInvocation(args) {
 // stdout line, and exit codes are the retired CoreGraphics helper's contract).
 function runTrimHelper(args) {
   var invocation = trimHelperInvocation(args);
-  var options = { encoding: 'utf-8', maxBuffer: 16 * 1024 * 1024 };
-  if (invocation.env !== undefined) options.env = invocation.env;
-  var result = cp.spawnSync(invocation.cmd, invocation.args, options);
+  // Strip pkg's node-invoke sentinel (PKG_EXECPATH) from the child env as a
+  // belt-and-suspenders alongside the copy-binary indirection above, so the
+  // spawned ci runs its baked cli entrypoint and dispatches the subcommand.
+  var childEnv = Object.assign({}, process.env);
+  delete childEnv.PKG_EXECPATH;
+  var result = cp.spawnSync(invocation.cmd, invocation.args, {
+    encoding: 'utf-8',
+    maxBuffer: 16 * 1024 * 1024,
+    env: childEnv,
+  });
   if (result.stdout) process.stdout.write(result.stdout);
   if (result.stderr) process.stderr.write(result.stderr);
   if (result.error) {
@@ -170,16 +196,17 @@ function trimRenderedImage(entry, renderedPath) {
 /**
  * Evaluates the embedded trim-stage source and returns its pure helpers, so
  * unit tests exercise exactly the code that ships inside the runtime script
- * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp` and
- * `process` are injectable so the invocation/spawn seams are testable; the
- * other trim-stage functions reference runtime globals (fs, path, ...) only
- * when called, so defining them here is harmless.
+ * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp`, `process`,
+ * `fs`, `os` and `path` are injectable so the invocation/spawn/copy seams are
+ * testable; at runtime the stage is spliced into the generated script where
+ * those names are `require`d globals. Uninjected deps only matter for branches
+ * that dereference them (the pkg copy path), so existing callers can omit them.
  */
 export function getPostProcessorInternals(overrides) {
-    const factory = new Function('cp', 'process', RENDER_SCRIPT_TRIM_STAGE +
+    const factory = new Function('cp', 'process', 'fs', 'os', 'path', RENDER_SCRIPT_TRIM_STAGE +
         '\nreturn { parseTrimDims: parseTrimDims, roundTwo: roundTwo, ' +
         'trimHelperInvocation: trimHelperInvocation, runTrimHelper: runTrimHelper };');
-    return factory(overrides?.cp, overrides?.processRef ?? process);
+    return factory(overrides?.cp, overrides?.processRef ?? process, overrides?.fs, overrides?.os, overrides?.path);
 }
 /**
  * Resolves the on-disk JS entrypoint of this cibuild installation's CLI

package/dist/src/yaml/steps/render-post-processor.test.js

@@ -76,18 +76,52 @@ describe('trim stage — helper invocation resolution', () => {
             args: ['/opt/cibuild/cli.cjs', 'fidelity-trim', 'in.png', 'out.png'],
         });
     });
-    test('under the pkg bootstrap the ci binary re-executes itself', () => {
-        const { trimHelperInvocation } = internalsWith({
-            env: {},
-            pkg: {},
-            execPath: '/opt/homebrew/bin/ci',
+    // Under pkg (the production runner path — process.pkg IS set, verified on the
+    // runner), process.execPath IS the ci binary, and pkg REFUSES to let a binary
+    // re-invoke itself as a subcommand: spawning process.execPath forces the child
+    // into Node-emulation, where 'fidelity-trim' becomes a main-module script path
+    // ("Cannot find module '<cwd>/fidelity-trim'") and the dispatch never runs —
+    // the trim silently no-ops and untrimmed renders ship. A COPY of the binary at
+    // a different path is not a self-exec, so it runs the baked cli entrypoint.
+    // (Verified on the runner: copy-spawn dispatches + emits TRIMDIMS.)
+    function pkgInternals(opts) {
+        const copyCalls = [];
+        const fakeFs = {
+            existsSync: () => false,
+            copyFileSync: (src, dest) => {
+                copyCalls.push([src, dest]);
+                if (opts?.copyThrows)
+                    throw new Error('EACCES');
+            },
+            chmodSync: () => { },
+        };
+        const fakeOs = { tmpdir: () => '/scratch' };
+        const fakePath = { join: (...parts) => parts.join('/') };
+        const internals = getPostProcessorInternals({
+            processRef: { env: {}, pkg: {}, execPath: '/opt/homebrew/bin/ci' },
+            fs: fakeFs,
+            os: fakeOs,
+            path: fakePath,
         });
-        expect(trimHelperInvocation(['in.png', 'out.png', 'aligned.png', 'ref.png'])).toEqual({
-            cmd: '/opt/homebrew/bin/ci',
+        return { internals, copyCalls };
+    }
+    test('under pkg it spawns a COPY of the binary (not process.execPath)', () => {
+        const { internals, copyCalls } = pkgInternals();
+        expect(internals.trimHelperInvocation(['in.png', 'out.png', 'aligned.png', 'ref.png'])).toEqual({
+            cmd: '/scratch/ci-fidelity-trim-bin',
             args: ['fidelity-trim', 'in.png', 'out.png', 'aligned.png', 'ref.png'],
         });
+        // The copy is made once, from process.execPath.
+        expect(copyCalls).toEqual([['/opt/homebrew/bin/ci', '/scratch/ci-fidelity-trim-bin']]);
+    });
+    test('under pkg it degrades to process.execPath when the binary copy fails', () => {
+        const { internals } = pkgInternals({ copyThrows: true });
+        expect(internals.trimHelperInvocation(['in.png', 'out.png'])).toEqual({
+            cmd: '/opt/homebrew/bin/ci',
+            args: ['fidelity-trim', 'in.png', 'out.png'],
+        });
     });
-    test('falls back to a ci on PATH', () => {
+    test('falls back to a ci on PATH when not running under pkg', () => {
         const { trimHelperInvocation } = internalsWith({
             env: {},
             execPath: '/usr/local/bin/node',
@@ -97,31 +131,11 @@ describe('trim stage — helper invocation resolution', () => {
             args: ['fidelity-trim', 'in.png', 'out.png'],
         });
     });
-    // The production runner spawns the render step as `node <script>`, which the
-    // pkg-built ci binary intercepts and runs in Node-emulation mode — so the
-    // running script's process.env carries pkg's node-invoke sentinel
-    // (PKG_EXECPATH). If the trim re-exec inherits it, the child ci binary ALSO
-    // enters Node-emulation and treats 'fidelity-trim' as a main-module script
-    // path ("Cannot find module '<cwd>/fidelity-trim'") instead of dispatching
-    // the subcommand — the exact failure observed in production, which silently
-    // ships untrimmed renders. The re-exec must clear PKG_EXECPATH so the binary
-    // runs its baked cli entrypoint.
-    test('under pkg node-emulation the re-exec clears PKG_EXECPATH so the binary runs its app entrypoint', () => {
-        const { trimHelperInvocation } = internalsWith({
-            env: { PKG_EXECPATH: 'PKG_INVOKE_NODEJS', PATH: '/usr/bin:/bin' },
-            pkg: {},
-            execPath: '/opt/homebrew/bin/ci',
-        });
-        const invocation = trimHelperInvocation(['in.png', 'out.png']);
-        expect(invocation.cmd).toBe('/opt/homebrew/bin/ci');
-        expect(invocation.args).toEqual(['fidelity-trim', 'in.png', 'out.png']);
-        // A child env is supplied with the node-invoke sentinel removed, but the
-        // rest of the environment (PATH, etc.) preserved.
-        expect(invocation.env).toBeDefined();
-        expect(invocation.env?.PKG_EXECPATH).toBeUndefined();
-        expect(invocation.env?.PATH).toBe('/usr/bin:/bin');
-    });
-    test('runTrimHelper spawns the pkg re-exec with a PKG_EXECPATH-cleared env', () => {
+    // runTrimHelper strips pkg's node-invoke sentinel (PKG_EXECPATH) from the child
+    // env as belt-and-suspenders alongside the copy-binary indirection, so the
+    // spawned ci runs its baked cli entrypoint rather than re-entering
+    // Node-emulation. (Exercised here via the non-pkg `ci` home for a simple seam.)
+    test('runTrimHelper strips PKG_EXECPATH from the child env', () => {
         const calls = [];
         const fakeCp = {
             spawnSync: (...args) => {
@@ -132,9 +146,9 @@ describe('trim stage — helper invocation resolution', () => {
         const { runTrimHelper } = getPostProcessorInternals({
             cp: fakeCp,
             processRef: {
-                env: { PKG_EXECPATH: 'PKG_INVOKE_NODEJS', FOO: 'bar' },
-                pkg: {},
-                execPath: '/opt/homebrew/bin/ci',
+                // Node-emulation shape: the sentinel is set but process.pkg is NOT.
+                env: { PKG_EXECPATH: 'PKG_INVOKE_NODEJS', PATH: '/usr/bin:/bin', FOO: 'bar' },
+                execPath: '/usr/local/bin/node',
                 stdout: { write: () => true },
                 stderr: { write: () => true },
             },
@@ -142,9 +156,12 @@ describe('trim stage — helper invocation resolution', () => {
         runTrimHelper(['in.png', 'out.png']);
         expect(calls).toHaveLength(1);
         const [cmd, , options] = calls[0];
-        expect(cmd).toBe('/opt/homebrew/bin/ci');
+        // process.pkg undefined → resolves to `ci` on PATH (the real runner path).
+        expect(cmd).toBe('ci');
+        // The child env must have the node-invoke sentinel removed, the rest kept.
         expect(options.env).toBeDefined();
         expect(options.env?.PKG_EXECPATH).toBeUndefined();
+        expect(options.env?.PATH).toBe('/usr/bin:/bin');
         expect(options.env?.FOO).toBe('bar');
     });
     test('runTrimHelper reports a spawn error as status 127 with the message appended', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",