@invarn/cibuild 2.4.3 → 2.4.4

package/dist/src/yaml/steps/render-post-processor.d.ts

@@ -73,14 +73,18 @@ export interface PostProcessorInternals {
 /**
  * Evaluates the embedded trim-stage source and returns its pure helpers, so
  * unit tests exercise exactly the code that ships inside the runtime script
- * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp` and
- * `process` are injectable so the invocation/spawn seams are testable; the
- * other trim-stage functions reference runtime globals (fs, path, ...) only
- * when called, so defining them here is harmless.
+ * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp`, `process`,
+ * `fs`, `os` and `path` are injectable so the invocation/spawn/copy seams are
+ * testable; at runtime the stage is spliced into the generated script where
+ * those names are `require`d globals. Uninjected deps only matter for branches
+ * that dereference them (the pkg copy path), so existing callers can omit them.
  */
 export declare function getPostProcessorInternals(overrides?: {
     cp?: unknown;
     processRef?: unknown;
+    fs?: unknown;
+    os?: unknown;
+    path?: unknown;
 }): PostProcessorInternals;
 /**
  * Resolves the on-disk JS entrypoint of this cibuild installation's CLI

package/dist/src/yaml/steps/render-post-processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-post-processor.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/render-post-processor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAiItC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,YAAY,CAAC;IACxB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1F;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE;IACpD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,sBAAsB,CASzB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAqBhD"}
+{"version":3,"file":"render-post-processor.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/render-post-processor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAuJtC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,YAAY,CAAC;IACxB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1F;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE;IACpD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GAAG,sBAAsB,CAkBzB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAqBhD"}

package/dist/src/yaml/steps/render-post-processor.js

@@ -72,19 +72,44 @@ function parseTrimDims(stdout) {
   return null;
 }
 
+// Lazily copy the pkg ci binary to a scratch path so the trim can invoke it
+// WITHOUT re-executing process.execPath. Under pkg the generated render script
+// runs as an app-mode child of the ci binary, so process.execPath IS the ci
+// binary -- but pkg refuses to let a binary re-invoke ITSELF as a subcommand:
+// spawning process.execPath forces the child into Node-emulation, where
+// 'fidelity-trim' is treated as a main-module script path ("Cannot find module
+// '<cwd>/fidelity-trim'") and the subcommand dispatch never runs, so the trim
+// silently no-ops and untrimmed renders ship. A COPY of the binary at a
+// different path is NOT seen as a self-exec, so it runs the baked cli entrypoint
+// normally (with the bundled pngjs). Copied once per run; returns null if the
+// copy can't be made, and the caller then degrades to a best-effort no-op trim.
+// Verified on the runner: a copy-spawn dispatches and emits TRIMDIMS, while an
+// execPath self-exec crashes with the module-not-found above.
+var ciTrimBinCopy;
+function ciBinaryCopyForTrim() {
+  if (typeof ciTrimBinCopy !== 'undefined') return ciTrimBinCopy;
+  try {
+    var dest = path.join(os.tmpdir(), 'ci-fidelity-trim-bin');
+    if (!fs.existsSync(dest)) {
+      fs.copyFileSync(process.execPath, dest);
+      fs.chmodSync(dest, 493); // 0o755
+    }
+    ciTrimBinCopy = dest;
+  } catch (copyErr) {
+    ciTrimBinCopy = null;
+  }
+  return ciTrimBinCopy;
+}
+
 // Resolve how to reach the ci CLI's fidelity-trim helper from inside this
 // generated script. Three homes, in order:
 //  1. CIBUILD_CLI_JS -- an explicit JS entrypoint (preview harnesses, tests),
 //     run under the same node executing this script.
-//  2. process.execPath re-executing the pkg binary. NOTE: gated on process.pkg,
-//     which is NOT set under pkg Node-emulation (pkg's bootstrap defines it only
-//     AFTER its node-invoke early return), so on the runner this branch does not
-//     fire -- the generated script runs as 'node the-script' in Node-emulation.
-//  3. A ci on PATH (brew/npm installs) -- the ACTUAL production runner path,
-//     precisely because process.pkg is undefined under Node-emulation.
-// Whichever home resolves, runTrimHelper strips PKG_EXECPATH from the child env
-// so the spawned pkg binary dispatches the subcommand instead of re-entering
-// Node-emulation. See runTrimHelper.
+//  2. Under pkg (the production runner path) process.execPath IS the ci binary,
+//     but pkg won't let it re-invoke itself as a subcommand, so spawn a COPY of
+//     it (see ciBinaryCopyForTrim). Fall back to the (best-effort) self-exec if
+//     the copy can't be made.
+//  3. A ci on PATH (brew/npm installs) when not running under pkg.
 function trimHelperInvocation(args) {
   if (process.env.CIBUILD_CLI_JS) {
     return {
@@ -93,7 +118,11 @@ function trimHelperInvocation(args) {
     };
   }
   if (process.pkg) {
-    return { cmd: process.execPath, args: ['fidelity-trim'].concat(args) };
+    var copy = ciBinaryCopyForTrim();
+    return {
+      cmd: copy === null ? process.execPath : copy,
+      args: ['fidelity-trim'].concat(args),
+    };
   }
   return { cmd: 'ci', args: ['fidelity-trim'].concat(args) };
 }
@@ -102,16 +131,9 @@ function trimHelperInvocation(args) {
 // stdout line, and exit codes are the retired CoreGraphics helper's contract).
 function runTrimHelper(args) {
   var invocation = trimHelperInvocation(args);
-  // This script runs under the pkg binary in Node-emulation mode (the runner
-  // spawns it as 'node <script>'), so process.env carries pkg's node-invoke
-  // sentinel PKG_EXECPATH. Every home above spawns the pkg binary (process.execPath
-  // or a 'ci' resolved on PATH); a child that inherits PKG_EXECPATH re-enters
-  // Node-emulation and treats 'fidelity-trim' as a main-module script path
-  // ("Cannot find module '<cwd>/fidelity-trim'") instead of dispatching the
-  // subcommand -- so the trim silently no-ops and untrimmed renders ship. Strip
-  // PKG_EXECPATH from the child env so the binary runs its baked cli entrypoint
-  // (verified: 'env -u PKG_EXECPATH ci fidelity-trim' dispatches; inheriting
-  // PKG_INVOKE_NODEJS reproduces the crash).
+  // Strip pkg's node-invoke sentinel (PKG_EXECPATH) from the child env as a
+  // belt-and-suspenders alongside the copy-binary indirection above, so the
+  // spawned ci runs its baked cli entrypoint and dispatches the subcommand.
   var childEnv = Object.assign({}, process.env);
   delete childEnv.PKG_EXECPATH;
   var result = cp.spawnSync(invocation.cmd, invocation.args, {
@@ -174,16 +196,17 @@ function trimRenderedImage(entry, renderedPath) {
 /**
  * Evaluates the embedded trim-stage source and returns its pure helpers, so
  * unit tests exercise exactly the code that ships inside the runtime script
- * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp` and
- * `process` are injectable so the invocation/spawn seams are testable; the
- * other trim-stage functions reference runtime globals (fs, path, ...) only
- * when called, so defining them here is harmless.
+ * (mirrors getRenderScriptInternals in ui-fidelity-render.ts). `cp`, `process`,
+ * `fs`, `os` and `path` are injectable so the invocation/spawn/copy seams are
+ * testable; at runtime the stage is spliced into the generated script where
+ * those names are `require`d globals. Uninjected deps only matter for branches
+ * that dereference them (the pkg copy path), so existing callers can omit them.
  */
 export function getPostProcessorInternals(overrides) {
-    const factory = new Function('cp', 'process', RENDER_SCRIPT_TRIM_STAGE +
+    const factory = new Function('cp', 'process', 'fs', 'os', 'path', RENDER_SCRIPT_TRIM_STAGE +
         '\nreturn { parseTrimDims: parseTrimDims, roundTwo: roundTwo, ' +
         'trimHelperInvocation: trimHelperInvocation, runTrimHelper: runTrimHelper };');
-    return factory(overrides?.cp, overrides?.processRef ?? process);
+    return factory(overrides?.cp, overrides?.processRef ?? process, overrides?.fs, overrides?.os, overrides?.path);
 }
 /**
  * Resolves the on-disk JS entrypoint of this cibuild installation's CLI

package/dist/src/yaml/steps/render-post-processor.test.js

@@ -76,18 +76,52 @@ describe('trim stage — helper invocation resolution', () => {
             args: ['/opt/cibuild/cli.cjs', 'fidelity-trim', 'in.png', 'out.png'],
         });
     });
-    test('under the pkg bootstrap the ci binary re-executes itself', () => {
-        const { trimHelperInvocation } = internalsWith({
-            env: {},
-            pkg: {},
-            execPath: '/opt/homebrew/bin/ci',
+    // Under pkg (the production runner path — process.pkg IS set, verified on the
+    // runner), process.execPath IS the ci binary, and pkg REFUSES to let a binary
+    // re-invoke itself as a subcommand: spawning process.execPath forces the child
+    // into Node-emulation, where 'fidelity-trim' becomes a main-module script path
+    // ("Cannot find module '<cwd>/fidelity-trim'") and the dispatch never runs —
+    // the trim silently no-ops and untrimmed renders ship. A COPY of the binary at
+    // a different path is not a self-exec, so it runs the baked cli entrypoint.
+    // (Verified on the runner: copy-spawn dispatches + emits TRIMDIMS.)
+    function pkgInternals(opts) {
+        const copyCalls = [];
+        const fakeFs = {
+            existsSync: () => false,
+            copyFileSync: (src, dest) => {
+                copyCalls.push([src, dest]);
+                if (opts?.copyThrows)
+                    throw new Error('EACCES');
+            },
+            chmodSync: () => { },
+        };
+        const fakeOs = { tmpdir: () => '/scratch' };
+        const fakePath = { join: (...parts) => parts.join('/') };
+        const internals = getPostProcessorInternals({
+            processRef: { env: {}, pkg: {}, execPath: '/opt/homebrew/bin/ci' },
+            fs: fakeFs,
+            os: fakeOs,
+            path: fakePath,
         });
-        expect(trimHelperInvocation(['in.png', 'out.png', 'aligned.png', 'ref.png'])).toEqual({
-            cmd: '/opt/homebrew/bin/ci',
+        return { internals, copyCalls };
+    }
+    test('under pkg it spawns a COPY of the binary (not process.execPath)', () => {
+        const { internals, copyCalls } = pkgInternals();
+        expect(internals.trimHelperInvocation(['in.png', 'out.png', 'aligned.png', 'ref.png'])).toEqual({
+            cmd: '/scratch/ci-fidelity-trim-bin',
             args: ['fidelity-trim', 'in.png', 'out.png', 'aligned.png', 'ref.png'],
         });
+        // The copy is made once, from process.execPath.
+        expect(copyCalls).toEqual([['/opt/homebrew/bin/ci', '/scratch/ci-fidelity-trim-bin']]);
+    });
+    test('under pkg it degrades to process.execPath when the binary copy fails', () => {
+        const { internals } = pkgInternals({ copyThrows: true });
+        expect(internals.trimHelperInvocation(['in.png', 'out.png'])).toEqual({
+            cmd: '/opt/homebrew/bin/ci',
+            args: ['fidelity-trim', 'in.png', 'out.png'],
+        });
     });
-    test('falls back to a ci on PATH', () => {
+    test('falls back to a ci on PATH when not running under pkg', () => {
         const { trimHelperInvocation } = internalsWith({
             env: {},
             execPath: '/usr/local/bin/node',
@@ -97,21 +131,11 @@ describe('trim stage — helper invocation resolution', () => {
             args: ['fidelity-trim', 'in.png', 'out.png'],
         });
     });
-    // Production path + the load-bearing fix. The runner spawns the render step as
-    // `node <script>`, which the pkg-built ci binary runs in Node-emulation mode.
-    // In that mode pkg's bootstrap returns BEFORE it defines process.pkg, so
-    // process.pkg is UNDEFINED here and the resolution above lands on `ci` on PATH
-    // (NOT the process.pkg self-exec branch). The script's env still carries pkg's
-    // node-invoke sentinel (PKG_EXECPATH=PKG_INVOKE_NODEJS); whichever home is
-    // spawned is the pkg binary, and a child that inherits PKG_EXECPATH re-enters
-    // Node-emulation and treats 'fidelity-trim' as a main-module script path
-    // ("Cannot find module '<cwd>/fidelity-trim'") instead of dispatching the
-    // subcommand — the exact production failure, which silently ships untrimmed
-    // renders. runTrimHelper must strip PKG_EXECPATH from the child env
-    // regardless of which home resolved, so the binary runs its baked cli
-    // entrypoint. (Verified out-of-band: `env -u PKG_EXECPATH ci fidelity-trim`
-    // dispatches; inheriting PKG_INVOKE_NODEJS reproduces the crash.)
-    test('runTrimHelper strips PKG_EXECPATH from the child env so the ci re-exec dispatches', () => {
+    // runTrimHelper strips pkg's node-invoke sentinel (PKG_EXECPATH) from the child
+    // env as belt-and-suspenders alongside the copy-binary indirection, so the
+    // spawned ci runs its baked cli entrypoint rather than re-entering
+    // Node-emulation. (Exercised here via the non-pkg `ci` home for a simple seam.)
+    test('runTrimHelper strips PKG_EXECPATH from the child env', () => {
         const calls = [];
         const fakeCp = {
             spawnSync: (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",