@nubjs/nub 0.0.18 → 0.0.19

package/bin/launch.js

@@ -1,40 +1,127 @@
 "use strict";
 // Shared launcher used by bin/nub and bin/nubx.
 //
-// On POSIX, postinstall.js replaces bin/nub and bin/nubx with direct symlinks to
-// the platform binary, so this module never runs on the hot path — `nub`/`nubx`
-// exec the native Rust binary directly (no Node bootstrap, preserving cold-start).
-// It DOES run on Windows (npm's generated nub.cmd / nubx.cmd invoke `node bin/nub`
-// — there is no symlink fast path there) and as a fallback on any platform where
-// postinstall could not create the symlink.
+// bin/nub and bin/nubx ship as committed `#!/usr/bin/env node` shims because the
+// cross-platform @nubjs/nub package cannot ship a native binary (it doesn't know
+// the target platform at publish time). On Windows that is the whole story: npm's
+// generated nub.cmd / nubx.cmd invoke `node bin/nub`, which spawns the platform
+// .exe (no shebang/symlink fast path on Windows).
 //
-// The Rust CLI selects its verb from argv[0]'s basename (nub vs nubx vs node — see
-// crates/nub-cli/src/cli.rs Argv0::detect). spawnSync's `argv0` option sets that
-// basename for the child without changing process.execPath, so the binary still
-// resolves its sibling runtime/ directory by walking up from its real location.
+// On its FIRST POSIX invocation this launcher SELF-HEALS: it rewrites the on-PATH
+// entry that dispatched it — the package manager's bin shim (pnpm cmd-shim) or
+// symlink (npm/bun) — into a MINIMAL `#!/bin/sh` trampoline that exec's the native
+// binary directly. Every later call then resolves PATH -> that tiny sh trampoline
+// -> native, skipping Node entirely (~native cold-start; the sh hop is ~1-2ms on
+// Linux dash/busybox, ~4ms on macOS bash — vs ~50ms for this Node launcher).
+//
+// CRITICAL: the heal target is a minimal sh SCRIPT, never a native binary. A
+// script->binary swap has an irreducible TOCTOU race (the kernel reads `#!/bin/sh`
+// then `/bin/sh` reopens the path and finds a Mach-O -> "cannot execute binary
+// file"; ~24% under a concurrent burst). A script->script swap (both `#!/bin/sh`,
+// always valid scripts) is race-free by construction — a concurrent `/bin/sh`
+// reopening the entry mid-swap always reads a valid trampoline (measured 0/600 vs
+// 146/600). So the heal needs no lock: it is best-effort, atomic (write temp +
+// rename), verify-before-clobber, and a no-op on Windows.
+//
+// The native binary selects its verb from argv[0]'s basename (nub vs nubx); the
+// healed trampoline exec's bin/<verb> in the platform package (which ships both
+// names), so no argv0 override is needed past the heal.
 const { spawnSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
 const { platformPackage } = require("../platform.js");
 
-function resolveBinary() {
+function resolveBinary(verb) {
   const { key, pkg } = platformPackage();
   if (!pkg) {
     console.error(`@nubjs/nub: no prebuilt binary for ${key}`);
     process.exit(1);
   }
+  const ext = process.platform === "win32" ? ".exe" : "";
   try {
-    return require.resolve(`${pkg}/bin/nub${process.platform === "win32" ? ".exe" : ""}`);
+    return require.resolve(`${pkg}/bin/${verb}${ext}`);
   } catch {
-    console.error(`@nubjs/nub: the ${pkg} package is not installed. Try: npm rebuild @nubjs/nub`);
-    process.exit(1);
+    // bin/nubx may be absent on an older platform package; fall back to bin/nub.
+    try {
+      return require.resolve(`${pkg}/bin/nub${ext}`);
+    } catch {
+      console.error(`@nubjs/nub: the ${pkg} package is not installed. Try: npm rebuild @nubjs/nub`);
+      process.exit(1);
+    }
   }
 }
 
-// argv0Name: the basename the child should see as argv[0] ("nub" or "nubx"). When
-// omitted the child sees the binary path, whose basename is "nub" — the default verb.
+// POSIX single-quote a string for safe embedding in the sh trampoline.
+function shq(s) { return `'${String(s).replace(/'/g, "'\\''")}'`; }
+
+// Verify a PATH entry demonstrably resolves to OUR launcher before replacing it —
+// never clobber an unrelated `nub` (there is an unrelated nub@1.0.0 on npm). For a
+// symlink, realpath(entry) must equal our launcher's realpath. For a pnpm cmd-shim
+// (a regular #!/bin/sh file), every quoted path it references is $basedir-resolved
+// and realpath'd; one must equal our launcher. Comparing realpaths (not substrings)
+// matches pnpm's fresh AND regenerated shim forms and rejects comment-only mentions.
+function leadsToUs(entry, st, ourReal) {
+  try {
+    if (st.isSymbolicLink()) {
+      try { return fs.realpathSync(entry) === ourReal; } catch { return false; }
+    }
+    if (st.isFile()) {
+      const body = fs.readFileSync(entry, "utf8");
+      const basedir = path.dirname(entry);
+      const quoted = body.match(/"([^"]+)"/g) || [];
+      for (const q of quoted) {
+        let p = q.slice(1, -1).replace(/\$\{?basedir\}?/g, basedir);
+        if (!p.includes("/")) continue;
+        if (!path.isAbsolute(p)) p = path.join(basedir, p);
+        try { if (fs.realpathSync(p) === ourReal) return true; } catch {}
+      }
+    }
+  } catch {}
+  return false;
+}
+
+// Best-effort, never throws. Rewrite the on-PATH `<verb>` entry that dispatched us
+// into a minimal sh trampoline -> the native binary. POSIX only.
+function healPathEntry(verb, nativePath) {
+  if (process.platform === "win32") return;
+  try {
+    const ourBin = path.join(__dirname, verb); // .../@nubjs/nub/bin/<verb>
+    let ourReal; try { ourReal = fs.realpathSync(ourBin); } catch { ourReal = ourBin; }
+    let nativeReal; try { nativeReal = fs.realpathSync(nativePath); } catch { nativeReal = nativePath; }
+    const content = `#!/bin/sh\nexec ${shq(nativeReal)} "$@"\n`;
+
+    for (const dir of (process.env.PATH || "").split(path.delimiter)) {
+      if (!dir) continue;
+      const entry = path.join(dir, verb);
+      let st;
+      try { st = fs.lstatSync(entry); } catch { continue; }
+      if (!leadsToUs(entry, st, ourReal)) continue;
+      // Atomic replace: write a unique temp in the SAME dir, then rename over the
+      // entry (rename is atomic on POSIX; script->script means no exec-format race).
+      const tmp = path.join(dir, `.${verb}.nub.${process.pid}.${Date.now()}.tmp`);
+      try {
+        fs.writeFileSync(tmp, content, { mode: 0o755 });
+        fs.chmodSync(tmp, 0o755);
+        fs.renameSync(tmp, entry);
+      } catch {
+        try { fs.unlinkSync(tmp); } catch {}
+      }
+      break; // the first matching PATH entry is the one that dispatched us
+    }
+  } catch {}
+}
+
+// argv0Name: the verb this stub represents ("nubx" for bin/nubx; undefined => nub).
 module.exports = function launch(argv0Name) {
-  const binPath = resolveBinary();
+  const verb = argv0Name || "nub";
+  const binPath = resolveBinary(verb);
+  // Self-heal the PATH entry on first POSIX call so later calls skip Node entirely.
+  healPathEntry(verb, binPath);
+  // This call still runs through Node; spawn the native binary. argv0 basename of
+  // binPath is the verb (bin/nub or bin/nubx), so the Rust CLI dispatches correctly
+  // without an argv0 override.
   const opts = { stdio: "inherit", windowsHide: true };
-  if (argv0Name) opts.argv0 = argv0Name;
+  if (argv0Name) opts.argv0 = argv0Name; // belt-and-suspenders for the bin/nub fallback path
   const result = spawnSync(binPath, process.argv.slice(2), opts);
   if (result.error) {
     console.error(`@nubjs/nub: failed to launch ${binPath}: ${result.error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nubjs/nub",
-  "version": "0.0.18",
+  "version": "0.0.19",
   "description": "TypeScript-first developer supertool — a fast script runner and TS runtime powered by Node.js",
   "license": "MIT",
   "repository": "https://github.com/nubjs/nub",
@@ -11,20 +11,16 @@
   },
   "files": [
     "bin",
-    "platform.js",
-    "postinstall.js"
+    "platform.js"
   ],
-  "scripts": {
-    "postinstall": "node postinstall.js"
-  },
   "optionalDependencies": {
-    "@nubjs/nub-darwin-arm64": "0.0.18",
-    "@nubjs/nub-darwin-x64": "0.0.18",
-    "@nubjs/nub-linux-x64": "0.0.18",
-    "@nubjs/nub-linux-x64-musl": "0.0.18",
-    "@nubjs/nub-linux-arm64": "0.0.18",
-    "@nubjs/nub-linux-arm64-musl": "0.0.18",
-    "@nubjs/nub-win32-x64": "0.0.18",
-    "@nubjs/nub-win32-arm64": "0.0.18"
+    "@nubjs/nub-darwin-arm64": "0.0.19",
+    "@nubjs/nub-darwin-x64": "0.0.19",
+    "@nubjs/nub-linux-x64": "0.0.19",
+    "@nubjs/nub-linux-x64-musl": "0.0.19",
+    "@nubjs/nub-linux-arm64": "0.0.19",
+    "@nubjs/nub-linux-arm64-musl": "0.0.19",
+    "@nubjs/nub-win32-x64": "0.0.19",
+    "@nubjs/nub-win32-arm64": "0.0.19"
   }
 }

package/postinstall.js

@@ -1,55 +0,0 @@
-const { platform } = process;
-const { mkdirSync, unlinkSync, symlinkSync, copyFileSync, chmodSync } = require("fs");
-const { join } = require("path");
-const { platformPackage } = require("./platform.js");
-
-const { key, pkg } = platformPackage();
-
-if (!pkg) {
-  console.error(`@nubjs/nub: no prebuilt binary for ${key}`);
-  process.exit(0);
-}
-
-// Windows: there is no symlink fast path. npm's generated nub.cmd / nubx.cmd invoke
-// the JS launchers (bin/nub, bin/nubx), which resolve and spawn the platform .exe at
-// runtime. Nothing to do at install time — leave the launchers in place.
-if (platform === "win32") {
-  process.exit(0);
-}
-
-let binSrc;
-try {
-  binSrc = require.resolve(`${pkg}/bin/nub`);
-} catch {
-  // optionalDependency not installed (wrong platform) — leave the JS launchers as a
-  // fallback; they print an actionable error if invoked.
-  process.exit(0);
-}
-
-// POSIX fast path: replace each JS launcher with a direct symlink to the platform
-// binary, so `nub` and `nubx` exec the native Rust binary with no Node bootstrap.
-// Both names point at the SAME binary; the Rust CLI selects its verb from argv[0]'s
-// basename (nub vs nubx — see crates/nub-cli/src/cli.rs Argv0::detect), and
-// process.execPath still resolves to the platform binary so the sibling runtime/
-// directory is found by walking up.
-const binDir = join(__dirname, "bin");
-mkdirSync(binDir, { recursive: true });
-for (const name of ["nub", "nubx"]) {
-  const dest = join(binDir, name);
-  try { unlinkSync(dest); } catch {}
-  try {
-    symlinkSync(binSrc, dest);
-    chmodSync(dest, 0o755);
-  } catch {
-    // Fallback: copy if symlink fails (e.g. cross-device). Slower path resolution
-    // but correct — argv[0] still resolves to a binary named nub/nubx.
-    try {
-      copyFileSync(binSrc, dest);
-      chmodSync(dest, 0o755);
-    } catch (err) {
-      console.error(`@nubjs/nub: failed to install ${name} binary: ${err.message}`);
-      process.exit(0);
-    }
-  }
-}
-chmodSync(binSrc, 0o755);