@rackbops/ac-agent 2.0.0-alpha.50 → 2.0.0-alpha.52

package/dist/ac-agent.mjs

@@ -47,7 +47,7 @@ function _mergeNamespaces(n, m) {
 }
 
 var name = "@rackbops/ac-agent";
-var version = "2.0.0-alpha.50";
+var version = "2.0.0-alpha.52";
 var type = "module";
 var description = "The per-machine host agent (installed with npx @rackbops/ac-agent): an HTTPS health server plus install/status/uninstall for a Windows logon task or a systemd user unit.";
 var bin = {
@@ -22412,7 +22412,8 @@ var index$3 = /*#__PURE__*/Object.freeze({
  * (`/run/user/<uid>/fnm_multishells/<pid>_<ts>/bin`) at the front of PATH -- `/run` is tmpfs,
  * torn down with the login session, so baking that verbatim produces a unit that works until the
  * next reboot and then can't find `node` at all. `bakePathEnv` swaps a recognized per-session
- * segment for that manager's durable alias before the text is ever built.
+ * segment for that manager's durable alias before the text is ever built, and drops what an npm/npx
+ * run added for itself plus any relative segment (#677).
  *
  * **`ExecStart=`'s four values are quoted (#237)**: found unquoted during #47's own review --
  * `systemd.service(5)` "Command Lines" splits `ExecStart=` on unquoted whitespace the same way a
@@ -22428,6 +22429,12 @@ const FNM_MULTISHELL_RE = /\/run\/user\/\d+\/fnm_multishells\/[^:]*/;
 // A version-manager "current version" style segment (nvm-family layouts that keep a `current`
 // pointer rather than fnm's per-shell dir); swapped the same way, for the same reason.
 const NVM_CURRENT_RE = /\.nvm\/versions\/[^:]*\/current[^:]*/;
+/** What npm/npx prepend to a script's PATH (#677): every ancestor `node_modules/.bin` of the cwd
+ *  (`cd /tmp && npx ./ac-agent-<v>.tgz install` gives `/tmp/node_modules/.bin`, in a world-writable
+ *  directory), the npx cache's own `.bin`, and npm's `node-gyp-bin`. They belong to that one npm run;
+ *  baked into the unit they would put a stale cache -- or a binary any local user planted in `/tmp`
+ *  -- ahead of the real `git`/`gh`/`node` for the life of the service. */
+const NPM_RUN_SEGMENT_RE = /(?:^|\/)node_modules\/\.bin\/?$|\/_npx\/|\/node-gyp-bin\/?$/;
 function bakePathEnv(rawPath, options) {
     const fnmStable = `${options.homedir}/.local/share/fnm/aliases/default/bin`;
     const nvmStable = `${options.homedir}/.nvm/alias/default/bin`;
@@ -22436,6 +22443,11 @@ function bakePathEnv(rawPath, options) {
     for (const segment of rawPath.split(":")) {
         if (segment === "")
             continue;
+        // A relative segment resolves against the service's cwd, not the installing shell's (#677).
+        if (!segment.startsWith("/"))
+            continue;
+        if (NPM_RUN_SEGMENT_RE.test(segment))
+            continue;
         let resolved = segment;
         if (FNM_MULTISHELL_RE.test(segment))
             resolved = fnmStable;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/ac-agent",
-  "version": "2.0.0-alpha.50",
+  "version": "2.0.0-alpha.52",
   "private": false,
   "type": "module",
   "description": "The per-machine host agent (installed with npx @rackbops/ac-agent): an HTTPS health server plus install/status/uninstall for a Windows logon task or a systemd user unit.",