@nubjs/nub 0.0.25 → 0.0.27

package/bin/launch.js

@@ -28,7 +28,8 @@
 // The native binary selects its verb from argv[0]'s basename (nub vs nubx); the
 // healed trampoline exec's bin/<verb> in the platform package (which ships both
 // names), so no argv0 override is needed past the heal.
-const { spawnSync } = require("child_process");
+const { spawn } = require("child_process");
+const os = require("os");
 const fs = require("fs");
 const path = require("path");
 const { platformPackage } = require("../platform.js");
@@ -140,13 +141,35 @@ module.exports = function launch(argv0Name) {
   healPathEntry(verb, binPath);
   // This call still runs through Node; spawn the native binary. argv0 basename of
   // binPath is the verb (bin/nub or bin/nubx), so the Rust CLI dispatches correctly
-  // without an argv0 override.
+  // without an argv0 override. We use async `spawn` (not `spawnSync`) ONLY so this
+  // Node launcher can forward terminating signals to the native child: `spawnSync`
+  // blocks the event loop, so a SIGTERM (docker stop on a `nub run` entrypoint whose
+  // first-ever call hasn't been healed to the sh trampoline yet) would terminate
+  // this launcher and orphan the workload. With async spawn we relay SIGTERM/INT/HUP
+  // to the child — which then relays to its own subtree — and mirror its exit
+  // status. (Subsequent calls skip Node entirely via the healed trampoline's `exec`,
+  // where signals reach the binary directly.)
   const opts = { stdio: "inherit", windowsHide: true };
   if (argv0Name) opts.argv0 = argv0Name; // belt-and-suspenders for the bin/nub fallback path
-  const result = spawnSync(binPath, process.argv.slice(2), opts);
-  if (result.error) {
-    console.error(`@nubjs/nub: failed to launch ${binPath}: ${result.error.message}`);
+  const child = spawn(binPath, process.argv.slice(2), opts);
+  let forwarding = true;
+  const forward = (sig) => {
+    if (forwarding && child.pid) {
+      try { process.kill(child.pid, sig); } catch {}
+    }
+  };
+  for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(sig, () => forward(sig));
+  child.on("error", (err) => {
+    console.error(`@nubjs/nub: failed to launch ${binPath}: ${err.message}`);
     process.exit(1);
-  }
-  process.exit(result.status == null ? 1 : result.status);
+  });
+  child.on("exit", (code, signal) => {
+    forwarding = false;
+    if (signal) {
+      // Mirror death-by-signal as 128+signo, matching the native binary and a shell.
+      const signo = (os.constants && os.constants.signals && os.constants.signals[signal]) || 0;
+      process.exit(signo ? 128 + signo : 1);
+    }
+    process.exit(code == null ? 1 : code);
+  });
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nubjs/nub",
-  "version": "0.0.25",
+  "version": "0.0.27",
   "description": "TypeScript-first developer supertool — a fast script runner and TS runtime powered by Node.js",
   "license": "MIT",
   "repository": "https://github.com/nubjs/nub",
@@ -9,18 +9,22 @@
     "nub": "bin/nub",
     "nubx": "bin/nubx"
   },
+  "scripts": {
+    "postinstall": "node postinstall.js"
+  },
   "files": [
     "bin",
-    "platform.js"
+    "platform.js",
+    "postinstall.js"
   ],
   "optionalDependencies": {
-    "@nubjs/nub-darwin-arm64": "0.0.25",
-    "@nubjs/nub-darwin-x64": "0.0.25",
-    "@nubjs/nub-linux-x64": "0.0.25",
-    "@nubjs/nub-linux-x64-musl": "0.0.25",
-    "@nubjs/nub-linux-arm64": "0.0.25",
-    "@nubjs/nub-linux-arm64-musl": "0.0.25",
-    "@nubjs/nub-win32-x64": "0.0.25",
-    "@nubjs/nub-win32-arm64": "0.0.25"
+    "@nubjs/nub-darwin-arm64": "0.0.27",
+    "@nubjs/nub-darwin-x64": "0.0.27",
+    "@nubjs/nub-linux-x64": "0.0.27",
+    "@nubjs/nub-linux-x64-musl": "0.0.27",
+    "@nubjs/nub-linux-arm64": "0.0.27",
+    "@nubjs/nub-linux-arm64-musl": "0.0.27",
+    "@nubjs/nub-win32-x64": "0.0.27",
+    "@nubjs/nub-win32-arm64": "0.0.27"
   }
 }

package/postinstall.js

@@ -0,0 +1,56 @@
+"use strict";
+// Set the execute bit on the platform binary at INSTALL time.
+//
+// npm normalizes file modes on extract: a file referenced by a package's `bin`
+// field lands 0o755, everything else 0o644. The platform packages
+// (`@nubjs/nub-<platform>`) deliberately declare NO `bin` field — they're carriers
+// selected by npm's os/cpu filters — so their `bin/nub` / `bin/nubx` extract 0o644
+// (no +x). Something must add it back.
+//
+// `bin/launch.js` also chmods at runtime, but that runs as the END user and chmod
+// only succeeds for the file's OWNER. The canonical container/CI pattern installs
+// as root (`RUN npm i -g`) then drops to a non-root user (`USER app`); that user's
+// first `nub` can't chmod a root-owned 0o644 binary and dies EACCES. THIS script
+// runs as the INSTALLER (root, during the image build), so it sets the bit for
+// everyone before any privilege drop. The launcher chmod stays as the fallback for
+// PMs that skip postinstall — it just can't cover the non-owner case, which is why
+// this exists. (Same shape as esbuild / @swc / @biomejs install-time chmod.)
+//
+// Best-effort and silent: a missing/already-executable binary, an unsupported
+// platform, or a PM that ran us in a sandbox are all non-fatal — the launcher's
+// runtime chmod is the second line of defense.
+
+const fs = require("fs");
+const path = require("path");
+
+function chmodExecutable() {
+  let platformPackage;
+  try {
+    ({ platformPackage } = require("./platform.js"));
+  } catch {
+    return; // platform.js absent (shouldn't happen) — let the launcher handle it.
+  }
+
+  const { pkg } = platformPackage();
+  if (!pkg) return; // unsupported platform — nothing to chmod.
+
+  const ext = process.platform === "win32" ? ".exe" : "";
+  for (const verb of ["nub", "nubx"]) {
+    let binPath;
+    try {
+      binPath = require.resolve(`${pkg}/bin/${verb}${ext}`);
+    } catch {
+      continue; // an older platform package may not ship bin/nubx.
+    }
+    try {
+      // Preserve read/write bits, add execute for user/group/other (umask-free —
+      // an install-time binary should be runnable by whoever the image runs as).
+      const mode = fs.statSync(binPath).mode;
+      fs.chmodSync(binPath, mode | 0o111);
+    } catch {
+      // Not the owner, read-only store, etc. — the launcher chmod is the fallback.
+    }
+  }
+}
+
+chmodExecutable();