agent-yes 1.300.3 → 1.300.4

package/ts/remoteCache.spec.ts

@@ -0,0 +1,191 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtemp, readdir, readFile, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import path from "path";
+import {
+  cacheAgeLabel,
+  hhmm,
+  humanizeAge,
+  isStale,
+  jsonRemote,
+  noteSnapshotResult,
+  parseWaitFor,
+  readRemoteSnapshot,
+  remoteCachePath,
+  writeRemoteSnapshot,
+  type RemoteSnapshot,
+} from "./remoteCache.ts";
+
+const T = 1_800_000_000_000;
+const rows = [{ pid: 1111, cli: "claude", status: "active" }];
+const good: RemoteSnapshot = {
+  version: 1,
+  alias: "alpha",
+  fetchedAt: T,
+  records: rows,
+  error: null,
+};
+
+describe("noteSnapshotResult", () => {
+  it("a success replaces the rows, stamps fetchedAt and clears the error", () => {
+    const prev: RemoteSnapshot = {
+      ...good,
+      fetchedAt: T - 60_000,
+      records: [],
+      error: { message: "x", since: T - 30_000, lastTriedAt: T - 1 },
+    };
+    expect(noteSnapshotResult(prev, "alpha", { ok: true, records: rows }, T)).toEqual(good);
+  });
+
+  it("a failure keeps the last good rows and preserves when the streak began", () => {
+    const first = noteSnapshotResult(good, "alpha", { ok: false, message: "timeout" }, T + 1000);
+    expect(first.records).toBe(rows);
+    expect(first.fetchedAt).toBe(T);
+    expect(first.error).toEqual({ message: "timeout", since: T + 1000, lastTriedAt: T + 1000 });
+    const second = noteSnapshotResult(first, "alpha", { ok: false, message: "refused" }, T + 5000);
+    expect(second.error).toEqual({ message: "refused", since: T + 1000, lastTriedAt: T + 5000 });
+  });
+
+  it("a first-ever failure has no rows and starts the streak now", () => {
+    const s = noteSnapshotResult(null, "beta", { ok: false, message: "dns" }, T);
+    expect(s).toEqual({
+      version: 1,
+      alias: "beta",
+      fetchedAt: null,
+      records: [],
+      error: { message: "dns", since: T, lastTriedAt: T },
+    });
+  });
+});
+
+describe("isStale", () => {
+  it("treats no snapshot, never-fetched, old, and clock-backwards as stale", () => {
+    expect(isStale(null, T)).toBe(true);
+    expect(isStale({ ...good, fetchedAt: null }, T)).toBe(true);
+    expect(isStale(good, T + 30_000)).toBe(true);
+    expect(isStale(good, T - 1)).toBe(true);
+  });
+  it("serves fresh rows as-is", () => {
+    expect(isStale(good, T + 29_999)).toBe(false);
+    expect(isStale(good, T + 5_000, 1_000)).toBe(true);
+  });
+});
+
+describe("labels", () => {
+  it("humanizeAge keeps the table vocabulary", () => {
+    expect(humanizeAge(500)).toBe("0s");
+    expect(humanizeAge(59_000)).toBe("59s");
+    expect(humanizeAge(60_000)).toBe("1m");
+    expect(humanizeAge(3_600_000)).toBe("1h");
+    expect(humanizeAge(2 * 86_400_000)).toBe("2d");
+  });
+
+  it("hhmm is zero-padded local wall-clock", () => {
+    const d = new Date(2026, 0, 1, 9, 5);
+    expect(hhmm(d.getTime())).toBe("09:05");
+  });
+
+  it("cacheAgeLabel says where the rows came from and never hides an outage", () => {
+    expect(cacheAgeLabel(good, T + 180_000, true)).toBe("cached 3m ago, refreshing…");
+    expect(cacheAgeLabel(good, T + 180_000, false)).toBe("cached 3m ago");
+    expect(cacheAgeLabel(null, T, true)).toBe("no cache yet, refreshing…");
+    const since = new Date(2026, 0, 1, 14, 2).getTime();
+    const down: RemoteSnapshot = { ...good, error: { message: "x", since, lastTriedAt: since } };
+    expect(cacheAgeLabel(down, T + 720_000, true)).toBe("cached 12m ago, unreachable since 14:02");
+  });
+});
+
+describe("parseWaitFor", () => {
+  const aliases = ["alpha", "beta"];
+  it("expands all / local, and accepts a comma list of configured aliases", () => {
+    expect(parseWaitFor("all", aliases)).toEqual({ local: true, remotes: ["alpha", "beta"] });
+    expect(parseWaitFor("local", aliases)).toEqual({ local: true, remotes: [] });
+    expect(parseWaitFor("beta", aliases)).toEqual({ local: false, remotes: ["beta"] });
+    expect(parseWaitFor(" alpha, beta ,alpha", aliases)).toEqual({
+      local: false,
+      remotes: ["alpha", "beta"],
+    });
+  });
+  it("refuses an unknown alias or an empty value rather than waiting for nothing", () => {
+    expect(parseWaitFor("gamma", aliases)).toMatchObject({
+      error: expect.stringContaining("gamma"),
+    });
+    expect(parseWaitFor("", aliases)).toMatchObject({
+      error: expect.stringContaining("--waitFor"),
+    });
+    expect(parseWaitFor("x", [])).toMatchObject({ error: expect.stringContaining("none") });
+  });
+});
+
+describe("jsonRemote", () => {
+  it("exposes fetchedAt, stale and age so a parser can decide", () => {
+    expect(jsonRemote(good, T + 1000)).toEqual({
+      fetchedAt: T,
+      stale: false,
+      ageMs: 1000,
+      error: null,
+      records: rows,
+    });
+    expect(jsonRemote(null, T)).toEqual({
+      fetchedAt: null,
+      stale: true,
+      ageMs: null,
+      error: null,
+      records: [],
+    });
+  });
+});
+
+describe("snapshot files", () => {
+  let home: string;
+  const prev = process.env.AGENT_YES_HOME;
+  beforeEach(async () => {
+    home = await mkdtemp(path.join(tmpdir(), "ay-remote-cache-"));
+    process.env.AGENT_YES_HOME = home;
+  });
+  afterEach(async () => {
+    if (prev === undefined) delete process.env.AGENT_YES_HOME;
+    else process.env.AGENT_YES_HOME = prev;
+    await rm(home, { recursive: true, force: true });
+  });
+
+  it("round-trips, encodes an unsafe alias into the file name, and leaves no temp file", async () => {
+    const snap: RemoteSnapshot = { ...good, alias: "a/b c" };
+    await writeRemoteSnapshot(snap);
+    expect(remoteCachePath("a/b c")).toBe(path.join(home, "remotes", "a%2Fb%20c.cache.json"));
+    expect(await readRemoteSnapshot("a/b c")).toEqual(snap);
+    expect(await readdir(path.join(home, "remotes"))).toEqual(["a%2Fb%20c.cache.json"]);
+    expect(JSON.parse(await readFile(remoteCachePath("a/b c"), "utf-8")).version).toBe(1);
+  });
+
+  it("reads a missing, corrupt, or foreign file as a cold cache", async () => {
+    expect(await readRemoteSnapshot("none")).toBeNull();
+    await writeRemoteSnapshot(good);
+    await writeFile(remoteCachePath("alpha"), "{not json");
+    expect(await readRemoteSnapshot("alpha")).toBeNull();
+    await writeFile(remoteCachePath("alpha"), JSON.stringify({ version: 2, records: [] }));
+    expect(await readRemoteSnapshot("alpha")).toBeNull();
+    await writeFile(remoteCachePath("alpha"), JSON.stringify([1, 2]));
+    expect(await readRemoteSnapshot("alpha")).toBeNull();
+  });
+
+  it("tolerates a half-valid error object and a bad fetchedAt", async () => {
+    await writeFile(
+      remoteCachePath("alpha"),
+      JSON.stringify({ version: 1, fetchedAt: "soon", records: rows, error: { message: "x" } }),
+    ).catch(async () => {
+      await writeRemoteSnapshot(good); // ensure the dir exists, then overwrite
+      await writeFile(
+        remoteCachePath("alpha"),
+        JSON.stringify({ version: 1, fetchedAt: "soon", records: rows, error: { message: "x" } }),
+      );
+    });
+    expect(await readRemoteSnapshot("alpha")).toEqual({
+      version: 1,
+      alias: "alpha",
+      fetchedAt: null,
+      records: rows,
+      error: null,
+    });
+  });
+});

package/ts/remoteCache.ts

@@ -0,0 +1,193 @@
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import path from "path";
+import { agentYesHome } from "./agentYesHome.ts";
+
+/**
+ * Cached-first `ay ls` across remotes.
+ *
+ * Every `ay ls` used to probe every configured remote before printing a single
+ * row, so one slow or unreachable machine (a WebRTC remote costs up to 25 s to
+ * give up on) held the whole fleet view hostage. The listing is read far more
+ * often than the fleet changes, so the trade is clear: print the LAST KNOWN
+ * rows for each remote at once, say how old they are, and refresh in the
+ * background so the next call is fresh. Nothing stale may ever look live —
+ * every cached row and section carries its age — and `--waitFor` is the
+ * explicit way to pay for fresh data when a decision needs it.
+ *
+ * One snapshot file per alias under `$AGENT_YES_HOME/remotes/`, beside the
+ * health file (ts/remoteHealth.ts) and like it derived, disposable data:
+ * deleting one costs a single "no cache yet" listing.
+ */
+
+/** The current failure streak of a remote, kept alongside its last good rows. */
+export interface RemoteCacheError {
+  message: string;
+  /** When the current run of failures began (unchanged by later failures). */
+  since: number;
+  lastTriedAt: number;
+}
+
+export interface RemoteSnapshot {
+  version: 1;
+  alias: string;
+  /** Time of the last SUCCESSFUL fetch; null when the remote has never answered. */
+  fetchedAt: number | null;
+  /** The `/api/ls` rows from that fetch (kept across later failures). */
+  records: any[];
+  error: RemoteCacheError | null;
+}
+
+/** Rows younger than this are served as-is without kicking a refresh. */
+export const REMOTE_CACHE_FRESH_MS = 30_000;
+
+export function remoteCachePath(alias: string): string {
+  return path.join(agentYesHome(), "remotes", `${encodeURIComponent(alias)}.cache.json`);
+}
+
+/** The persisted snapshot, or null for missing/corrupt — a cold cache, never an error. */
+export async function readRemoteSnapshot(alias: string): Promise<RemoteSnapshot | null> {
+  try {
+    const parsed = JSON.parse(await readFile(remoteCachePath(alias), "utf-8")) as unknown;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const s = parsed as Partial<RemoteSnapshot>;
+    if (s.version !== 1 || !Array.isArray(s.records)) return null;
+    const fetchedAt =
+      typeof s.fetchedAt === "number" && Number.isFinite(s.fetchedAt) ? s.fetchedAt : null;
+    const e = s.error;
+    const error =
+      e && typeof e === "object" && typeof e.message === "string" && typeof e.since === "number"
+        ? { message: e.message, since: e.since, lastTriedAt: Number(e.lastTriedAt) || e.since }
+        : null;
+    return { version: 1, alias, fetchedAt, records: s.records, error };
+  } catch {
+    return null;
+  }
+}
+
+/** tmp + rename, like the health file: a concurrent reader never sees a torn file. */
+export async function writeRemoteSnapshot(snap: RemoteSnapshot): Promise<void> {
+  const dest = remoteCachePath(snap.alias);
+  await mkdir(path.dirname(dest), { recursive: true });
+  const tmp = `${dest}.${process.pid}.tmp`;
+  await writeFile(tmp, JSON.stringify(snap));
+  await rename(tmp, dest);
+}
+
+export type FetchOutcome = { ok: true; records: any[] } | { ok: false; message: string };
+
+/**
+ * Fold one fetch into the snapshot. Success replaces the rows and clears the
+ * error; failure keeps the last good rows and extends the streak, preserving
+ * `since` so the operator sees "unreachable since 14:02", not "since now".
+ */
+export function noteSnapshotResult(
+  prev: RemoteSnapshot | null,
+  alias: string,
+  result: FetchOutcome,
+  now: number,
+): RemoteSnapshot {
+  if (result.ok) return { version: 1, alias, fetchedAt: now, records: result.records, error: null };
+  return {
+    version: 1,
+    alias,
+    fetchedAt: prev?.fetchedAt ?? null,
+    records: prev?.records ?? [],
+    error: { message: result.message, since: prev?.error?.since ?? now, lastTriedAt: now },
+  };
+}
+
+/** Whether the rows are old enough to warrant a refresh. Fails open to "stale". */
+export function isStale(
+  snap: RemoteSnapshot | null,
+  now: number,
+  freshMs = REMOTE_CACHE_FRESH_MS,
+): boolean {
+  if (!snap || snap.fetchedAt === null) return true;
+  const age = now - snap.fetchedAt;
+  return age < 0 || age >= freshMs;
+}
+
+/** "0s", "42s", "3m", "5h", "2d" — the table's AGE column vocabulary. */
+export function humanizeAge(ms: number): string {
+  if (ms < 1000) return "0s";
+  const s = Math.floor(ms / 1000);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  if (h < 24) return `${h}h`;
+  const d = Math.floor(h / 24);
+  return `${d}d`;
+}
+
+/** Local wall-clock HH:MM, for "unreachable since 14:02". */
+export function hhmm(ts: number): string {
+  const d = new Date(ts);
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+
+/**
+ * The per-remote tag printed beside its section: where the rows came from and
+ * how old they are. `refreshing` says a background refresh was just kicked.
+ */
+export function cacheAgeLabel(
+  snap: RemoteSnapshot | null,
+  now: number,
+  refreshing: boolean,
+): string {
+  const base =
+    snap && snap.fetchedAt !== null
+      ? `cached ${humanizeAge(now - snap.fetchedAt)} ago`
+      : "no cache yet";
+  if (snap?.error) return `${base}, unreachable since ${hhmm(snap.error.since)}`;
+  return refreshing ? `${base}, refreshing…` : base;
+}
+
+/** What `--waitFor` asked to block on. */
+export interface WaitFor {
+  local: boolean;
+  /** Configured aliases to refresh in the foreground before printing. */
+  remotes: string[];
+}
+
+/**
+ * `--waitFor=all|local|<alias>[,<alias>…]`. Unknown aliases are an error
+ * rather than silently waited-for-nothing: the flag exists so a caller can
+ * trust the rows it gets, and a typo must not become a false "fresh".
+ */
+export function parseWaitFor(value: string, aliases: string[]): WaitFor | { error: string } {
+  const v = value.trim();
+  if (!v) return { error: "--waitFor needs a value: all, local, or an alias list" };
+  if (v === "all") return { local: true, remotes: [...aliases] };
+  if (v === "local") return { local: true, remotes: [] };
+  const want = v
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const unknown = want.filter((a) => !aliases.includes(a));
+  if (unknown.length)
+    return {
+      error: `--waitFor: unknown remote ${unknown.join(", ")} (configured: ${aliases.join(", ") || "none"})`,
+    };
+  return { local: false, remotes: [...new Set(want)] };
+}
+
+/** The `--json` shape for one remote: additive, so a parser can decide on staleness. */
+export function jsonRemote(
+  snap: RemoteSnapshot | null,
+  now: number,
+): {
+  fetchedAt: number | null;
+  stale: boolean;
+  ageMs: number | null;
+  error: RemoteCacheError | null;
+  records: any[];
+} {
+  return {
+    fetchedAt: snap?.fetchedAt ?? null,
+    stale: isStale(snap, now),
+    ageMs: snap && snap.fetchedAt !== null ? now - snap.fetchedAt : null,
+    error: snap?.error ?? null,
+    records: snap?.records ?? [],
+  };
+}

package/ts/rustBinary.bun.spec.ts

@@ -1,8 +1,8 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { gcOldBinaryDirs } from "./rustBinary.ts";
+import { chmodExtractedBinaries, ensureExecutable, gcOldBinaryDirs } from "./rustBinary.ts";
 import { _setInstalledPackageForTesting } from "./versionChecker.ts";
 
 // Startup GC for the versioned binary download cache (PERFORMANCE-EVENT
@@ -79,3 +79,40 @@ describe("gcOldBinaryDirs", () => {
     }
   });
 });
+
+// A release bundle arrives with whatever modes the packaging pipeline kept —
+// in practice none. Only the main binary used to be chmod'ed, so ayrs was left
+// non-executable and the daemon died with EACCES on every supervisor restart.
+describe("chmodExtractedBinaries", () => {
+  it("marks every extracted regular file executable and skips archives and dirs", async () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "ay-bin-"));
+    try {
+      writeFileSync(path.join(dir, "agent-yes-linux-x64"), "#!/bin/sh\n", { mode: 0o644 });
+      writeFileSync(path.join(dir, "ayrs"), "#!/bin/sh\n", { mode: 0o644 });
+      writeFileSync(path.join(dir, "temp.tar.gz"), "x");
+      mkdirSync(path.join(dir, "sub"));
+      const fixed = await chmodExtractedBinaries(dir);
+      expect(fixed.sort()).toEqual(["agent-yes-linux-x64", "ayrs"]);
+      if (process.platform !== "win32") {
+        expect(statSync(path.join(dir, "ayrs")).mode & 0o111).toBe(0o111);
+        expect(statSync(path.join(dir, "temp.tar.gz")).mode & 0o111).toBe(0);
+      }
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("ensureExecutable", () => {
+  it("repairs a present-but-not-executable binary and returns its path", () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "ay-bin-"));
+    try {
+      const p = path.join(dir, "ayrs");
+      writeFileSync(p, "#!/bin/sh\n", { mode: 0o644 });
+      expect(ensureExecutable(p)).toBe(p);
+      if (process.platform !== "win32") expect(statSync(p).mode & 0o111).toBe(0o111);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/ts/rustBinary.spec.ts

@@ -1,8 +1,22 @@
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { devBuildInfo, gcOldBinaryDirs, hasValidMacSignature } from "./rustBinary.ts";
+import {
+  chmodExtractedBinaries,
+  devBuildInfo,
+  ensureExecutable,
+  gcOldBinaryDirs,
+  hasValidMacSignature,
+} from "./rustBinary.ts";
 import { _setInstalledPackageForTesting } from "./versionChecker.ts";
 
 // Startup GC for the versioned binary download cache (PERFORMANCE-EVENT
@@ -135,3 +149,40 @@ describe("hasValidMacSignature", () => {
     expect(hasValidMacSignature(path.join(root, "does-not-exist"))).toBe(true);
   });
 });
+
+// A release bundle arrives with whatever modes the packaging pipeline kept —
+// in practice none. Only the main binary used to be chmod'ed, so ayrs was left
+// non-executable and the daemon died with EACCES on every supervisor restart.
+describe("chmodExtractedBinaries", () => {
+  it("marks every extracted regular file executable and skips archives and dirs", async () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "ay-bin-"));
+    try {
+      writeFileSync(path.join(dir, "agent-yes-linux-x64"), "#!/bin/sh\n", { mode: 0o644 });
+      writeFileSync(path.join(dir, "ayrs"), "#!/bin/sh\n", { mode: 0o644 });
+      writeFileSync(path.join(dir, "temp.tar.gz"), "x");
+      mkdirSync(path.join(dir, "sub"));
+      const fixed = await chmodExtractedBinaries(dir);
+      expect(fixed.sort()).toEqual(["agent-yes-linux-x64", "ayrs"]);
+      if (process.platform !== "win32") {
+        expect(statSync(path.join(dir, "ayrs")).mode & 0o111).toBe(0o111);
+        expect(statSync(path.join(dir, "temp.tar.gz")).mode & 0o111).toBe(0);
+      }
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("ensureExecutable", () => {
+  it("repairs a present-but-not-executable binary and returns its path", () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "ay-bin-"));
+    try {
+      const p = path.join(dir, "ayrs");
+      writeFileSync(p, "#!/bin/sh\n", { mode: 0o644 });
+      expect(ensureExecutable(p)).toBe(p);
+      if (process.platform !== "win32") expect(statSync(p).mode & 0o111).toBe(0o111);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/ts/rustBinary.ts

@@ -3,7 +3,17 @@
  */
 
 import { execFileSync } from "child_process";
-import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync } from "fs";
+import {
+  accessSync,
+  chmodSync,
+  constants as fsConstants,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+} from "fs";
 import { chmod, copyFile } from "fs/promises";
 import path from "path";
 import { compareVersions, getInstalledPackage } from "./versionChecker.ts";
@@ -251,11 +261,57 @@ export function findAyrsBinary(): string | undefined {
     Bun.which("ayrs") ?? "",
   ];
   for (const p of searchPaths) {
-    if (p && existsSync(p)) return p;
+    if (p && existsSync(p)) return ensureExecutable(p);
   }
   return undefined;
 }
 
+/**
+ * Repair a binary that is present but not executable (POSIX only; Windows has
+ * no exec bit). A release bundle that lost its modes in transit, or a cache
+ * written by an older fetcher that only chmod'ed the main binary, leaves
+ * `ayrs` as a plain file: the daemon then dies with EACCES on every restart
+ * and the supervisor loops forever. Best effort — a read-only cache keeps
+ * failing, and the caller's spawn reports that.
+ */
+export function ensureExecutable(p: string): string {
+  if (process.platform === "win32") return p;
+  try {
+    accessSync(p, fsConstants.X_OK);
+  } catch {
+    try {
+      chmodSync(p, 0o755);
+    } catch {
+      /* read-only cache — leave the spawn to report it */
+    }
+  }
+  return p;
+}
+
+/**
+ * Mark every regular file a release bundle extracted into `dir` executable.
+ * The tarball carries ayrs (and friends) next to the main binary; the modes
+ * they arrive with are whatever the packaging pipeline preserved, which has
+ * been "none" (CI artifacts drop Unix permissions). Chmod'ing the main binary
+ * alone (the old behaviour) left ayrs non-executable — see ensureExecutable.
+ */
+export async function chmodExtractedBinaries(dir: string): Promise<string[]> {
+  const fixed: string[] = [];
+  for (const name of readdirSync(dir)) {
+    const p = path.join(dir, name);
+    let isFile = false;
+    try {
+      isFile = statSync(p).isFile();
+    } catch {
+      continue;
+    }
+    if (!isFile || /\.(tar\.gz|zip|json|txt|md)$/i.test(name)) continue;
+    await chmod(p, 0o755);
+    fixed.push(name);
+  }
+  return fixed;
+}
+
 /**
  * Get GitHub release download URL for the binary
  */
@@ -351,7 +407,9 @@ export async function downloadBinary(verbose = false): Promise<string> {
       unlinkSync(tarPath);
     } catch {}
 
-    // Make executable
+    // Make everything the bundle shipped executable — ayrs and the other
+    // helpers alongside the main binary, not just binaryPath.
+    await chmodExtractedBinaries(binDir);
     await chmod(binaryPath, 0o755);
   }