@vantaloom/runtime-darwin-arm64 0.3.1 → 0.3.3

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/cli",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "private": false,
   "type": "module",
   "description": "Vantaloom local runtime manager.",

package/cli/src/cli.mjs

@@ -24,10 +24,35 @@ const fallbackNpmRegistries = [
   "https://registry.npmmirror.com",
 ]
 
+// Inherit strict-ssl=false from npm/npx config, or respect NODE_TLS_REJECT_UNAUTHORIZED.
+// When npm runs us via npx with strict-ssl disabled, it sets npm_config_strict_ssl="false".
+// Also check user .npmrc for strict-ssl=false (common in China behind proxies).
+function shouldDisableTLS() {
+  if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0") return true
+  if (process.env.npm_config_strict_ssl === "false") return true
+  if (process.env.npm_config_strict_ssl === "") return true
+  try {
+    const npmrcPath = path.join(os.homedir(), ".npmrc")
+    if (existsSync(npmrcPath)) {
+      const content = readFileSync(npmrcPath, "utf8")
+      if (/^\s*strict-ssl\s*=\s*false/m.test(content)) return true
+    }
+  } catch {}
+  return false
+}
+if (shouldDisableTLS()) {
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
+}
+
 export async function main(argv) {
   const command = argv[0] ?? "help"
   const options = parseOptions(argv.slice(1))
 
+  // --no-strict-ssl flag disables TLS certificate verification for fetch calls
+  if (options.noStrictSsl) {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
+  }
+
   switch (command) {
     case "install":
       if (options.package) {
@@ -202,6 +227,15 @@ async function applyPackage(packageRoot, prefix, options) {
     })
   }
 
+  // Ensure binaries are executable on Unix (cross-compiled from Windows they lose +x)
+  if (process.platform !== "win32") {
+    const binDir = path.join(prefix, "bin")
+    for (const entry of readdirSync(binDir)) {
+      const binPath = path.join(binDir, entry)
+      try { chmodSync(binPath, 0o755) } catch {}
+    }
+  }
+
   await writeLauncher(prefix)
   await writeText(path.join(prefix, "cli", "config.json"), `${JSON.stringify(mergedConfig, null, 2)}\n`)
   await writeText(path.join(prefix, "VERSION"), `${version}\n`)
@@ -402,28 +436,46 @@ async function resolveNpmPackageWithFallback({ registries, name, version }) {
       const result = await resolveNpmPackage({ registry, name, version })
       return { ...result, registry }
     } catch (error) {
-      const isNetworkError = error?.cause?.code === "ECONNREFUSED"
-        || error?.cause?.code === "ENOTFOUND"
-        || error?.cause?.code === "ETIMEDOUT"
-        || error?.cause?.code === "ECONNRESET"
-        || error?.cause?.code === "UND_ERR_CONNECT_TIMEOUT"
+      const causeCode = error?.cause?.code || ""
+      const isNetworkError = causeCode === "ECONNREFUSED"
+        || causeCode === "ENOTFOUND"
+        || causeCode === "ETIMEDOUT"
+        || causeCode === "ECONNRESET"
+        || causeCode === "UND_ERR_CONNECT_TIMEOUT"
         || (error instanceof TypeError && error.message === "fetch failed")
-      errors.push({ registry, error, isNetworkError })
-
-      if (isNetworkError && registries.length > 1) {
-        console.error(`vantaloom: ${registry} unreachable, trying next registry...`)
+      const isSslError = causeCode === "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
+        || causeCode === "CERT_HAS_EXPIRED"
+        || causeCode === "DEPTH_ZERO_SELF_SIGNED_CERT"
+        || causeCode === "SELF_SIGNED_CERT_IN_CHAIN"
+        || causeCode === "ERR_TLS_CERT_ALTNAME_INVALID"
+      const isRetryable = isNetworkError || isSslError
+      errors.push({ registry, error, isRetryable, isSslError })
+
+      if (isRetryable && registries.length > 1) {
+        const hint = isSslError ? " (SSL certificate error)" : ""
+        console.error(`vantaloom: ${registry} unreachable${hint}, trying next registry...`)
         continue
       }
+      if (isSslError) {
+        throw new Error(
+          `SSL certificate error connecting to ${registry}: ${causeCode}\n` +
+          `  Fix: run with --no-strict-ssl, or set npm config: npm config set strict-ssl false`
+        )
+      }
       // Non-network error (404, parse error, etc.) — don't try fallbacks
       throw error
     }
   }
 
-  // All registries failed with network errors
+  // All registries failed
+  const hasSslError = errors.some((e) => e.isSslError)
   const tried = errors.map((e) => e.registry).join(", ")
+  const sslHint = hasSslError
+    ? `\n  SSL fix: run with --no-strict-ssl, or set npm config: npm config set strict-ssl false`
+    : ""
   throw new Error(
     `all registries unreachable (tried: ${tried}). ` +
-    `Check your network or specify --npm-registry <url>`
+    `Check your network or specify --npm-registry <url>${sslHint}`
   )
 }
 
@@ -440,9 +492,10 @@ async function resolveNpmPackage({ registry, name, version }) {
     })
   } catch (error) {
     if (error instanceof TypeError && error.message === "fetch failed") {
-      const cause = error.cause ? ` (${error.cause.code || error.cause.message || error.cause})` : ""
+      const causeCode = error.cause?.code || ""
+      const causeMsg = causeCode || error.cause?.message || String(error.cause || "")
       throw Object.assign(
-        new Error(`cannot reach registry ${registry}${cause}`),
+        new Error(`cannot reach registry ${registry} (${causeMsg})`),
         { cause: error.cause }
       )
     }
@@ -870,6 +923,9 @@ function parseOptions(args) {
       case "local":
         options.local = true
         break
+      case "no-strict-ssl":
+        options.noStrictSsl = true
+        break
       default:
         throw new Error(`unknown option --${key}`)
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/runtime-darwin-arm64",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "private": false,
   "description": "Vantaloom local runtime for darwin-arm64.",
   "type": "module",