buninu-linux 0.9.56 → 0.11.56

package/initramfs/lib/chroot-options.js

@@ -0,0 +1,69 @@
+import { realpathSync, statSync, lstatSync, readlinkSync } from 'node:fs';
+import { posix, resolve } from 'node:path';
+
+export function parseChrootArguments(argv, env = process.env) {
+  const options = { mount: true, keep: false, verbose: false, binds: [] };
+  let positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--') { positional = argv.slice(i + 1); break; }
+    if (arg === '-h' || arg === '--help') return { options, positional, help: true };
+    if (arg === '-n' || arg === '--no-mount') options.mount = false;
+    else if (arg === '-k' || arg === '--keep-mounts') options.keep = true;
+    else if (arg === '-v' || arg === '--verbose') options.verbose = true;
+    else if (arg === '-b' || arg === '--bind') {
+      if (++i >= argv.length || !argv[i] || argv[i].startsWith('-')) throw Error(`${arg} requires HOST[:GUEST]`);
+      options.binds.push(argv[i]);
+    } else if (arg.startsWith('--bind=')) {
+      if (!arg.slice(7)) throw Error('--bind requires HOST[:GUEST]');
+      options.binds.push(arg.slice(7));
+    } else if (arg === '--shared-tmp') {
+      if (!env.TMPDIR) throw Error('--shared-tmp requires TMPDIR to be set');
+      options.binds.push(`${env.TMPDIR}:/tmp`);
+    } else if (arg.startsWith('-') && arg.length > 1) throw Error(`unknown option ${arg}`);
+    else { positional = argv.slice(i); break; }
+  }
+  return { options, positional, help: false };
+}
+
+export function resolveBindings(specs, cwd = process.cwd()) {
+  const bindings = new Map();
+  for (const spec of specs) {
+    const colon = spec.indexOf(':');
+    const host = colon < 0 ? spec : spec.slice(0, colon);
+    const guest = colon < 0 ? resolve(cwd, host) : spec.slice(colon + 1);
+    if (!host || !guest || host.includes('\0') || guest.includes('\0')) throw Error(`invalid bind: ${spec}`);
+    if (!posix.isAbsolute(guest)) throw Error(`bind guest path must be absolute: ${guest}`);
+    const inside = posix.normalize(guest);
+    if (inside === '/') throw Error('bind destination must not replace the chroot root');
+    const source = realpathSync(resolve(cwd, host));
+    bindings.set(inside, { inside, source, file: !statSync(source).isDirectory() });
+  }
+  // Parents must be mounted before children. For a repeated destination, the
+  // last argument wins, including --shared-tmp versus an explicit /tmp bind.
+  return [...bindings.values()].sort((a, b) => a.inside.split('/').length - b.inside.split('/').length);
+}
+
+// Resolve guest symlinks as chroot would: absolute links start at NEWROOT,
+// never at the host's /. Missing suffixes are created by the mount caller.
+export function resolveGuestPath(root, inside) {
+  const todo = inside.split('/'), parts = [];
+  let links = 0;
+  while (todo.length) {
+    const part = todo.shift();
+    if (!part || part === '.') continue;
+    if (part === '..') { parts.pop(); continue; }
+    const candidate = `${root}/${[...parts, part].join('/')}`;
+    let entry;
+    try { entry = lstatSync(candidate); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (entry?.isSymbolicLink()) {
+      if (++links > 40) throw Error(`too many symlinks in bind destination: ${inside}`);
+      const target = readlinkSync(candidate);
+      if (target.startsWith('/')) parts.length = 0;
+      todo.unshift(...target.split('/'));
+    } else parts.push(part);
+  }
+  if (!parts.length) throw Error('bind destination resolves to the chroot root');
+  return '/' + parts.join('/');
+}

package/initramfs/usr/lib/bootstrap/1.prepare-rootfs.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env bun
+import { mkdtempSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import {
+  assertAbsent, cli, isBuninuLinux,
+  normalizeArch, options,
+} from "./lib/common.js";
+import {
+  installSources, localSeed,
+  releaseSeed, sourceArchives,
+  validateSeed, writeSeed,
+} from "./lib/seed.js";
+import { printEntry } from "./2.enter-rootfs.js";
+
+async function main(args) {
+  // Optional arguments: ARCH ROOTFS.
+  // ARCH defaults to this Bun's CPU.
+  // ROOTFS defaults to roota / rootx
+  // in the current working directory.
+  const selected = options(args);
+  if (!selected) return;
+  const { arch, rootfs } = selected;
+  assertAbsent(rootfs);
+  const parent = statSync(
+    dirname(rootfs)
+  );
+  if (!parent.isDirectory()) {
+    throw new Error(
+      "ROOTFS parent must exist"
+    );
+  }
+
+  // Bundled musl 1.2.6 + TinyCC +
+  // overlay; verify before any writes.
+  // No musl-dev APK is required.
+  const archives = sourceArchives();
+  const work = mkdtempSync(
+    join(tmpdir(), "buninu-bootstrap-")
+  );
+  try {
+    // Local mode reads /etc/os-release
+    // ID=buninu-linux, then copies:
+    // /bin/bun, /lib/ld-musl-*.so.1,
+    // libgcc_s.so.1, libstdc++.so.6,
+    // resolv.conf, tar, unzip, env,
+    // their JS helpers and bunmsh.
+    // Resolve links to copy real data.
+    const local = isBuninuLinux()
+      && arch === normalizeArch(
+        process.arch
+      );
+    console.log(
+      "① Preparing runtime and tools " +
+      (local ? "from this Buninu Linux"
+        : "from buninu-linux@0.9.56")
+    );
+
+    // Otherwise fetch npm 0.9.56:
+    // native/<arch>/lib -> rootfs libs
+    // initramfs tools -> same paths.
+    // Fetch musl Bun 1.4.2 ZIP for
+    // the selected arch -> /bin/bun.
+    // URLs + SHA-256: downloads.md,
+    // parsed as YAML, like the repo's
+    // scripts/npm-packages.md.
+    const files = local
+      ? localSeed(arch)
+      : await releaseSeed(arch, work);
+    if (local) console.log(
+      "② Reusing system musl-bun"
+    );
+    validateSeed(files, arch);
+    writeSeed(
+      rootfs, arch, files,
+      local ? "local" : "npm@0.9.56"
+    );
+
+    // Extract musl and TinyCC into
+    // /bootstrap/src. The overlay
+    // adds build recipes and /bin/cc.
+    // Stage 3 already needs TinyCC
+    // source to generate CRT objects.
+    // Copy stages 1–12 and helpers to
+    // /bootstrap in rootfs.
+    console.log(
+      "③ Extracting musl, TinyCC " +
+      "and bootstrap overlay sources"
+    );
+    await installSources(
+      rootfs, archives
+    );
+    console.log(
+      `Prepared ${arch}: ${rootfs}`
+    );
+    printEntry(rootfs);
+  } finally {
+    // Preserve a partially written
+    // rootfs for inspection on error.
+    rmSync(work, {
+      recursive: true, force: true,
+    });
+  }
+}
+
+if (import.meta.main) await cli(main);

package/initramfs/usr/lib/bootstrap/10.build-m4.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env bun
+import { writeFileSync } from "node:fs";
+import { cli } from "./lib/common.js";
+import {
+  buildRoot, command, configure,
+  makeIn, ready, source, stage, tools,
+} from "./lib/build.js";
+
+async function main(args) {
+  const { triple } = stage(
+    10, "m4", args
+  );
+  const src = await source(
+    "m4@1.4.18", "m4-1.4.18"
+  );
+  const build = buildRoot + "/m4";
+  await configure(src, build, [
+    "--build=" + triple,
+    "--host=" + triple,
+    "--prefix=/bootstrap/toolchain",
+    "--disable-dependency-tracking",
+  ]);
+  await makeIn(build);
+  await makeIn(build, ["install"]);
+  writeFileSync(
+    build + "/verify.m4",
+    "define(`square',`eval($1*$1)')" +
+    "square(12)\n"
+  );
+  const output = await command(
+    [tools + "/m4", "verify.m4"],
+    build, {}, true
+  );
+  if (output.trim() !== "144") {
+    throw new Error("m4 check failed");
+  }
+  ready(10, "GNU m4 expansion");
+}
+
+if (import.meta.main) await cli(main);

package/initramfs/usr/lib/bootstrap/11.build-flex.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env bun
+import { writeFileSync } from "node:fs";
+import { cli } from "./lib/common.js";
+import {
+  buildRoot, command, configure,
+  makeIn, ready, source, stage, tools,
+} from "./lib/build.js";
+
+async function main(args) {
+  const { triple } = stage(
+    11, "flex", args
+  );
+  const src = await source(
+    "flex@2.6.4", "flex-2.6.4"
+  );
+  const build = buildRoot + "/flex";
+  const env = { M4: tools + "/m4" };
+  await configure(src, build, [
+    "--build=" + triple,
+    "--host=" + triple,
+    "--prefix=/bootstrap/toolchain",
+    "--disable-nls",
+    "--disable-dependency-tracking",
+    "--disable-shared",
+  ], env);
+  await makeIn(
+    build, ["-C", "src"], env
+  );
+  await makeIn(
+    build, ["-C", "src", "install"],
+    env
+  );
+  await verifyLexer(build, env);
+  ready(11, "Flex generated lexer");
+}
+
+async function verifyLexer(build, env) {
+  writeFileSync(build + "/verify.l", `%option noyywrap
+%%
+[0-9]+ return 7;
+. return 1;
+%%
+int main(void){yy_scan_string("123");return yylex()!=7;}
+`);
+  await command([tools + "/flex", "-o", "verify.c", "verify.l"], build, env);
+  await command([tools + "/cc", "verify.c", "-o", "verify-flex"], build, env);
+  await command([build + "/verify-flex"], build, env);
+}
+
+if (import.meta.main) await cli(main);

package/initramfs/usr/lib/bootstrap/12.build-gcc.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env bun
+import {
+  chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync,
+  readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync,
+} from "node:fs";
+import {
+  bootstrap, cli, sha256,
+} from "./lib/common.js";
+import {
+  buildRoot, command, configure,
+  makeIn, patch, deps, ready,
+  resultRoot, source, sourceRoot, stage, useLog,
+  toolchain, tools,
+} from "./lib/build.js";
+
+const gccCommit = "9d2b63d100ae7c99ee8b128fb41086fd85c8f57d";
+// GCC clears MAKEOVERRIDES. Preserve its normal explicit submake flags
+// and append our header-install selection to that forwarding list.
+const headerInstallFlags =
+  "FLAGS_TO_PASS=$(BASE_FLAGS_TO_PASS) $(EXTRA_HOST_FLAGS) " +
+  "INSTALL_HEADERS_DIR=install-include-dir";
+
+async function main(args) {
+  const { arch, triple } = stage(
+    12, "gcc", args
+  );
+  // GCC's ARM vendor 4.7 branch has
+  // both the ARM64 and x64 backends.
+  // Pin the full commit, not a branch.
+  const src = await source(
+    "gcc@4.7-9d2b63d",
+    "gcc-" + gccCommit
+  );
+  const build = buildRoot + "/gcc-4.7";
+  prepareGcc(src, arch);
+  // Install native assembler/linker
+  // before building target libgcc.
+  installBinutils();
+  await configure(src, build, [
+    "--build=" + triple,
+    "--host=" + triple,
+    "--target=" + triple,
+    "--prefix=" + resultRoot,
+    "--enable-languages=c",
+    "--disable-build-with-cxx",
+    "--disable-bootstrap",
+    "--disable-libquadmath",
+    "--disable-decimal-float",
+    "--disable-fixed-point",
+    "--disable-lto",
+    "--disable-libgomp",
+    "--disable-multilib",
+    "--disable-multiarch",
+    "--disable-libmudflap",
+    "--disable-libssp",
+    "--disable-libitm", "--disable-nls",
+    "--disable-werror",
+    "--with-gmp=" + deps,
+    "--with-mpfr=" + deps,
+    "--with-mpc=" + deps,
+    "--with-build-time-tools=" +
+      toolchain + "/bin",
+    "--with-as=" +
+      resultRoot + "/bin/as",
+    "--with-ld=" +
+      resultRoot + "/bin/ld",
+    "--with-native-system-header-dir=" +
+      "/usr/include",
+  ]);
+
+  // Explicit make assignments avoid
+  // cached missing-tool commands.
+  await makeIn(build, [
+    "M4=" + tools + "/m4",
+    "FLEX=" + tools + "/flex", "all",
+  ]);
+  // Install compiler, headers, CRT
+  // support and libgcc into result.
+  // Create include directories via
+  // Make; copy headers with JS below.
+  // No tar pipe or cp -p -r needed.
+  await makeIn(build, [
+    headerInstallFlags, "install-gcc",
+  ]);
+  await makeIn(build, [
+    "install-target-libgcc",
+  ]);
+  // libgcc installs unwind.h too.
+  // Copy headers last to remove links
+  // back into the source tree.
+  installCompilerHeaders(
+    src, build, triple
+  );
+  // Test with all intermediate trees
+  // hidden, then restore them.
+  await verifyGcc(arch, triple);
+  ready(
+    12, "GCC 4.7 C compiler + libgcc"
+  );
+  console.log(
+    "Compiler: " +
+    resultRoot + "/bin/gcc"
+  );
+  console.log(
+    "Stop: GCC 4.7 milestone reached."
+  );
+}
+
+function prepareGcc(src, arch) {
+  const header = "bootstrap-musl.h";
+  const text = `/* Local ordinary Linux-musl bootstrap target settings. */
+#undef GNU_USER_DYNAMIC_LINKER
+#define GNU_USER_DYNAMIC_LINKER "/lib/ld-musl-${arch}.so.1"
+#undef GNU_USER_DYNAMIC_LINKER64
+#define GNU_USER_DYNAMIC_LINKER64 "/lib/ld-musl-${arch}.so.1"
+#undef OPTION_GLIBC
+#define OPTION_GLIBC 0
+#undef TARGET_C99_FUNCTIONS
+#define TARGET_C99_FUNCTIONS 1
+#undef TARGET_HAS_SINCOS
+#define TARGET_HAS_SINCOS 1
+#undef INT_FAST16_TYPE
+#define INT_FAST16_TYPE "int"
+#undef INT_FAST32_TYPE
+#define INT_FAST32_TYPE "int"
+#undef UINT_FAST16_TYPE
+#define UINT_FAST16_TYPE "unsigned int"
+#undef UINT_FAST32_TYPE
+#define UINT_FAST32_TYPE "unsigned int"
+`;
+  writeFileSync(src + "/gcc/config/" + header, text);
+  const path = src + "/gcc/config.gcc";
+  const config = readFileSync(path, "utf8");
+  const marker = "# Buninu native musl bootstrap";
+  if (!config.includes(marker)) writeFileSync(path, config + `\n${marker}\ncase $target in\n  aarch64-*-linux-musl*|x86_64-*-linux-musl*) tm_file="$tm_file ${header}" ;;\nesac\n`);
+  patch(src + "/libiberty/regex.c", "# ifdef REGEX_MALLOC\n", "/* TinyCC: use the existing heap allocation path. */\n# if defined __TINYC__ && !defined REGEX_MALLOC\n#  define REGEX_MALLOC 1\n# endif\n# ifdef REGEX_MALLOC\n");
+  patch(src + "/libiberty/argv.c", '#include "libiberty.h"', '#include <stdlib.h>\n#include "libiberty.h"');
+}
+
+function verificationSource(arch) {
+  return  `#include <stdint.h>
+#include <stdio.h>
+#include <unwind.h>
+#ifdef __gnu_linux__
+#error musl must not claim glibc
+#endif
+#if !defined(__linux__) || !defined(${arch === "aarch64" ? "__aarch64__" : "__x86_64__"})
+#error unexpected target
+#endif
+typedef char fast16[__builtin_types_compatible_p(__INT_FAST16_TYPE__,int_fast16_t)?1:-1];
+typedef char fast32[__builtin_types_compatible_p(__UINT_FAST32_TYPE__,uint_fast32_t)?1:-1];
+static volatile unsigned __int128 large=((unsigned __int128)1<<100)+123,divisor=7;
+int main(void){unsigned __int128 a=large,b=divisor,q=a/b,r=a%b;
+if(q*b+r!=a||r>=b)return 1;
+puts("GCC 4.7 C and libgcc runtime verified");return 0;}
+`;
+}
+
+function installCompilerHeaders(src, build, triple) {
+  const version = readFileSync(src + "/gcc/BASE-VER", "utf8").trim();
+  if (!/^4\.7\.\d+$/.test(version)) throw new Error(`Unexpected GCC version: ${version}`);
+  const destination = `${resultRoot}/lib/gcc/${triple}/${version}`;
+  for (const name of ["include", "include-fixed"]) {
+    const source = `${build}/gcc/${name}`;
+    if (!statSync(source).isDirectory()) throw new Error(`Missing GCC headers: ${source}`);
+    const target = `${destination}/${name}`;
+    // Replace only the generated private header directory. Dereference
+    // unwind.h and other source/build links so result survives their removal.
+    rmSync(target, { recursive: true, force: true });
+    cpSync(source, target, { recursive: true, dereference: true, preserveTimestamps: true });
+  }
+}
+
+function installBinutils() {
+  mkdirSync(resultRoot + "/bin", { recursive: true });
+  rmSync(resultRoot + "/verified.json", { force: true });
+  for (const name of ["as", "ld", "ar", "ranlib", "nm", "objcopy", "objdump", "readelf", "strip", "size", "strings", "addr2line", "c++filt"]) {
+    // Copy bytes, not symlinks into the intermediate toolchain tree.
+    const target = resultRoot + "/bin/" + name;
+    copyFileSync(toolchain + "/bin/" + name, target);
+    chmodSync(target, 0o755);
+  }
+  const notices = resultRoot + "/share/licenses/bootstrap";
+  mkdirSync(notices, { recursive: true });
+  copyFileSync(bootstrap + "/NOTICE.md", notices + "/NOTICE.md");
+  copyFileSync(bootstrap + "/LICENSE", notices + "/LICENSE");
+  cpSync(bootstrap + "/LICENSES", notices + "/LICENSES", { recursive: true });
+  // Keep notices with the installed binaries, including static dependencies.
+  for (const directory of ["gcc-" + gccCommit, "binutils-2.39", "gmp-4.3.2", "mpfr-2.4.2", "mpc-0.8.1"]) {
+    const target = resultRoot + "/share/licenses/" + directory;
+    mkdirSync(target, { recursive: true });
+    for (const name of readdirSync(sourceRoot + "/" + directory)) {
+      if (/^(COPYING|COPYRIGHT|LICENSE)/.test(name) && statSync(sourceRoot + "/" + directory + "/" + name).isFile()) {
+        copyFileSync(sourceRoot + "/" + directory + "/" + name, target + "/" + name);
+      }
+    }
+  }
+}
+
+async function verifyGcc(arch, triple) {
+  const gcc = resultRoot + "/bin/gcc";
+  const work = mkdtempSync("/tmp/bootstrap-result-check-");
+  const hidden = [];
+  // No compiler search-path overrides: exercise the installed defaults.
+  const env = {
+    PATH: resultRoot + "/bin:/bin:/usr/bin",
+    SHELL: "/bin/sh", CONFIG_SHELL: "/bin/sh", CC: gcc,
+    LD_LIBRARY_PATH: resultRoot + "/lib:" + resultRoot + "/lib64",
+  };
+  useLog(resultRoot + "/verification.log");
+  try {
+    for (const path of [sourceRoot, deps, toolchain, buildRoot]) {
+      const backup = path + ".verification-hidden";
+      if (existsSync(backup)) throw new Error(`Restore interrupted verification directory first: ${backup} -> ${path}`);
+      renameSync(path, backup);
+      hidden.push([path, backup]);
+    }
+    const version = (await command([gcc, "-dumpversion"], work, env, true)).trim();
+    if (!/^4\.7\./.test(version)) throw new Error(`Unexpected GCC version: ${version}`);
+    for (const name of ["libgcc.a", "libgcc_s.so.1", "crtbegin.o", "crtend.o", "crtbeginS.o", "crtendS.o"]) {
+      const path = (await command([gcc, "-print-file-name=" + name], work, env, true)).trim();
+      if (!path.startsWith(resultRoot + "/") || !existsSync(path)) throw new Error(`Missing installed support file: ${name}: ${path}`);
+      if (name === "libgcc_s.so.1") env.LD_LIBRARY_PATH = path.slice(0, path.lastIndexOf("/")) + ":" + env.LD_LIBRARY_PATH;
+    }
+    writeFileSync(work + "/verify.c", verificationSource(arch));
+    for (const optimization of ["-O0", "-O2"]) {
+      await command([gcc, optimization, "verify.c", "-o", "verify-gcc"], work, env);
+      const headers = await command([resultRoot + "/bin/readelf", "-l", "verify-gcc"], work, env, true);
+      if (!headers.includes(`/lib/ld-musl-${arch}.so.1`)) throw new Error("Wrong musl interpreter");
+      await command([work + "/verify-gcc"], work, env);
+    }
+    // Exercise installed crtbeginS/crtendS and shared libgcc, too.
+    writeFileSync(work + "/shared.c", "__int128 divide(__int128 a,__int128 b){return a/b;}\n");
+    writeFileSync(work + "/shared-main.c", "extern __int128 divide(__int128,__int128);int main(void){return divide(((__int128)1<<100)+1,7)!=(((__int128)1<<100)+1)/7;}\n");
+    await command([gcc, "-shared", "-fPIC", "-shared-libgcc", "shared.c", "-o", "libverify.so"], work, env);
+    await command([gcc, "shared-main.c", "-L.", "-lverify", "-Wl,-rpath,$ORIGIN", "-o", "verify-shared"], work, env);
+    await command([work + "/verify-shared"], work, env);
+    const files = [];
+    function inventory(directory, prefix = "") {
+      for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        const path = prefix + entry.name;
+        if (entry.isDirectory()) inventory(directory + "/" + entry.name, path + "/");
+        else if (statSync(directory + "/" + entry.name).isFile() && !["verified.json", "verification.log"].includes(path)) {
+          const bytes = readFileSync(directory + "/" + entry.name);
+          files.push({ path, bytes: bytes.length, sha256: sha256(bytes) });
+        }
+      }
+    }
+    inventory(resultRoot);
+    writeFileSync(resultRoot + "/verified.json", JSON.stringify({
+      version, arch, triple, compiler: gcc, independentOf: hidden.map(([path]) => path),
+      requires: ["/usr/include", "/usr/lib", "/lib"], files,
+    }, null, 2) + "\n");
+  } finally {
+    // Restore in reverse order even when a compiler check fails.
+    for (const [path, backup] of hidden.reverse()) renameSync(backup, path);
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) await cli(main);

package/initramfs/usr/lib/bootstrap/2.enter-rootfs.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env bun
+import {
+  cli, isBuninuLinux, options, quote,
+} from "./lib/common.js";
+
+const archAlias = /^(x|x64|x86_64|x86-64|a|arm64|aarch64)$/;
+
+export function printEntry(rootfs = "/path/to/your/rootfs") {
+  console.log("\nEnter the rootfs:");
+  console.log(isBuninuLinux()
+    ? `  chroot ${quote(rootfs)} /bin/sh`
+    : `  bun x bunproot -koe -r ${quote(rootfs)}`);
+  console.log("Then run inside it:");
+  console.log("  cd /bootstrap");
+  console.log("  bun 3.gen-musl-dev.js");
+  console.log("  bun 4.build-tcc.js");
+}
+
+async function main(args) {
+  // Print instructions only. No
+  // rootfs or marker file is read.
+  if (!args.length) {
+    printEntry();
+    return;
+  }
+  if (args.includes("--help") ||
+      args.includes("-h")) {
+    console.log(
+      "Usage: bun 2.enter-rootfs.js " +
+      "[ARCH] [ROOTFS]"
+    );
+    console.log(
+      "No ROOTFS: print commands " +
+      "using /path/to/your/rootfs."
+    );
+    return;
+  }
+  // Keep stage 1's argument aliases,
+  // but never infer roota or rootx.
+  const archOnly = args.length === 1
+    && archAlias.test(args[0]);
+  const selected = options(archOnly
+    ? [...args, "/path/to/your/rootfs"]
+    : args);
+  if (!selected) return;
+  printEntry(selected.rootfs);
+}
+
+if (import.meta.main) await cli(main);