@lgtm-hq/lintro 0.160.2 → 0.160.3-rc.2

package/bin/lintro

@@ -10,12 +10,15 @@
  */
 
 const { execFileSync } = require("child_process");
-const { resolveBinary } = require("../lib/resolve.js");
+const { ensureExecutable, resolveBinary } = require("../lib/resolve.js");
 
 function main() {
   let binaryPath;
   try {
     binaryPath = resolveBinary();
+    // The published tarball may carry the binary without its exec bit (the
+    // publish pipeline's artifact handoff drops file modes); repair it.
+    ensureExecutable(binaryPath);
   } catch (err) {
     process.stderr.write(`${err.message}\n`);
     process.exit(1);

package/lib/resolve.js

@@ -131,6 +131,71 @@ function resolveBinary(requireFn, platform, arch) {
   return mod.path;
 }
 
+/**
+ * Make sure the platform binary carries its executable bit.
+ *
+ * The publish pipeline hands the staged package set between jobs as a
+ * workflow artifact, and that zip drops file modes: every file lands as
+ * 0644, so the tarball npm publishes can ship the binary without `+x`.
+ * npm only restores modes for a package's own `bin` entries, and the
+ * platform packages declare none, so the launcher repairs it here. A
+ * binary that is already executable is left untouched.
+ *
+ * @param {string} binaryPath - Absolute path to the platform binary.
+ * @param {typeof import('fs')} [fsModule] - Injectable `fs` (testing).
+ * @returns {boolean} `true` when the mode had to be repaired.
+ * @throws {Error} When the binary is not executable and cannot be made so.
+ */
+function ensureExecutable(binaryPath, fsModule) {
+  const fs = fsModule || require('fs');
+  try {
+    fs.accessSync(binaryPath, fs.constants.X_OK);
+    return false;
+  } catch {
+    // Not executable (or not accessible): fall through to the repair.
+  }
+  // Repair through a descriptor opened without following symlinks, so the
+  // mode change lands on the file that was inspected: a tampered platform
+  // package or a race cannot redirect it to another path.
+  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
+  let fd;
+  try {
+    fd = fs.openSync(binaryPath, flags);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      throw new Error(`lintro: the platform binary at "${binaryPath}" is missing`);
+    }
+    if (err.code === 'ELOOP') {
+      throw new Error(
+        `lintro: the platform binary at "${binaryPath}" is a symlink; ` +
+          'refusing to change its mode'
+      );
+    }
+    throw new Error(
+      `lintro: the platform binary at "${binaryPath}" could not be opened: ${err.message}`
+    );
+  }
+  try {
+    if (!fs.fstatSync(fd).isFile()) {
+      throw new Error(
+        `lintro: the platform binary at "${binaryPath}" is not a regular file; ` +
+          'refusing to change its mode'
+      );
+    }
+    try {
+      fs.fchmodSync(fd, 0o755);
+    } catch (err) {
+      throw new Error(
+        `lintro: the platform binary at "${binaryPath}" is not executable ` +
+          `and could not be made executable: ${err.message}`
+      );
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  return true;
+}
+
 module.exports = {
   PLATFORM_PACKAGES,
   UNSUPPORTED_PLATFORM_HINTS,
@@ -138,4 +203,5 @@ module.exports = {
   unsupportedPlatformHint,
   supportedPlatforms,
   resolveBinary,
+  ensureExecutable,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lgtm-hq/lintro",
-  "version": "0.160.2",
+  "version": "0.160.3-rc.2",
   "description": "A unified CLI for code formatting, linting, and quality assurance. Ships self-contained platform binaries — no Python required.",
   "keywords": [
     "lint",
@@ -30,9 +30,9 @@
     "lib/resolve.js"
   ],
   "optionalDependencies": {
-    "@lgtm-hq/lintro-darwin-arm64": "0.160.2",
-    "@lgtm-hq/lintro-linux-arm64": "0.160.2",
-    "@lgtm-hq/lintro-linux-x64": "0.160.2"
+    "@lgtm-hq/lintro-darwin-arm64": "0.160.3-rc.2",
+    "@lgtm-hq/lintro-linux-arm64": "0.160.3-rc.2",
+    "@lgtm-hq/lintro-linux-x64": "0.160.3-rc.2"
   },
   "engines": {
     "node": ">=18"