crossbind 2.0.0-beta.53 → 2.0.0-beta.56

package/AGENTS.md

@@ -33,7 +33,7 @@ Side-quests:
 
 ## Public API contract
 
-Anything exported from `src/index.js` is consumed by `plugins/*` and a few CLI scripts (`scripts/check-*.js`). Treat its surface as semver-public — additive changes free, breaking changes need a beta bump and a CHANGELOG note.
+Anything exported from `src/index.js` is consumed by `plugins/*` and a few CLI scripts (`scripts/check-*.js`). Treat its surface as semver-public — additive changes free, breaking changes need a beta bump and a human-authored `releases/crossbind/<version>.md` note.
 
 Currently exported (snapshot):
 

package/README.md

@@ -87,7 +87,7 @@ adapters.
 ## Quick start
 
 Prefer to scaffold and configure the project yourself? You need
-[Node.js 22+](https://nodejs.org/) and
+[Node.js 24+](https://nodejs.org/) and
 [Docker](https://www.docker.com/). Docker carries the browser, Android, and
 WASI toolchains and is pulled automatically on the first build. iOS additionally
 requires macOS, CMake 3.28+, Xcode, and CocoaPods.

package/package.json

@@ -1,55 +1,52 @@
 {
-  "name": "crossbind",
-  "version": "2.0.0-beta.53",
-  "license": "MIT",
-  "homepage": "https://crossbind.dev",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/crossbind/crossbind.git"
-  },
-  "description": "Bind C++ to JavaScript without extra code. crossbind supports WebAssembly and React Native for cross-platform compatibility.",
-  "type": "module",
-  "engines": {
-    "node": ">=20"
-  },
-  "bin": {
-    "crossbind": "./src/bin.js"
-  },
-  "main": "src/index.js",
-  "devDependencies": {
-    "@vitest/coverage-v8": "^4.1.10",
-    "vitest": "^4.1.10"
-  },
-  "dependencies": {
-    "@rollup/plugin-commonjs": "^29.0.3",
-    "@rollup/plugin-json": "^6.1.0",
-    "@rollup/plugin-node-resolve": "^16.0.3",
-    "@rollup/plugin-virtual": "^3.0.2",
-    "comlink": "^4.4.2",
-    "commander": "^15.0.0",
-    "glob": "^13.0.6",
-    "log-update": "^8.0.0",
-    "picocolors": "^1.1.1",
-    "replace": "^1.2.2",
-    "rollup": "^4.62.4",
-    "spdx-expression-parse": "^5.0.0",
-    "upath": "^3.0.8"
-  },
-  "keywords": [
-    "webassembly",
-    "react-native",
-    "bind",
-    "c++",
-    "emscripten",
-    "embind",
-    "swig",
-    "android",
-    "ios",
-    "mobile"
-  ],
-  "scripts": {
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
-  }
-}
+    "name": "crossbind",
+    "version": "2.0.0-beta.56",
+    "license": "MIT",
+    "homepage": "https://crossbind.dev",
+    "repository": "https://github.com/crossbind/crossbind.git",
+    "description": "Bind C++ to JavaScript without extra code. crossbind supports WebAssembly and React Native for cross-platform compatibility.",
+    "type": "module",
+    "engines": {
+        "node": ">=24"
+    },
+    "bin": {
+        "crossbind": "./src/bin.js"
+    },
+    "main": "src/index.js",
+    "scripts": {
+        "test": "vitest run",
+        "test:watch": "vitest",
+        "test:coverage": "vitest run --coverage"
+    },
+    "devDependencies": {
+        "@vitest/coverage-v8": "^4.1.10",
+        "vitest": "^4.1.10"
+    },
+    "dependencies": {
+        "@rollup/plugin-commonjs": "^29.0.3",
+        "@rollup/plugin-json": "^6.1.0",
+        "@rollup/plugin-node-resolve": "^16.0.3",
+        "@rollup/plugin-virtual": "^3.0.2",
+        "comlink": "^4.4.2",
+        "commander": "^15.0.0",
+        "glob": "^13.0.6",
+        "log-update": "^8.0.0",
+        "picocolors": "^1.1.1",
+        "replace": "^1.2.2",
+        "rollup": "^4.62.4",
+        "spdx-expression-parse": "^5.0.0",
+        "upath": "^3.0.8"
+    },
+    "keywords": [
+        "webassembly",
+        "react-native",
+        "bind",
+        "c++",
+        "emscripten",
+        "embind",
+        "swig",
+        "android",
+        "ios",
+        "mobile"
+    ]
+}

package/src/actions/buildWasm.js

@@ -169,19 +169,19 @@ export default async function buildWasm(target, options = {}) {
         triggerExtensions('buildWasm', 'beforeBuildBrowser', [emccFlags]);
 
         const data = Object.entries(getData('data', target)).map(([key, value]) => ['--preload-file', `${key.replaceAll('@', '@@')}@/crossbind/${value}`]).flat();
-        run('emcc', [
+        run('em++', [
             '-lembind',
             ...emccFlags,
             // '-lwebsocket.js', '-sPROXY_POSIX_SOCKETS', '-sWEBSOCKET_DEBUG=1', '-sJSPI', '-g', '-sWASMFS',
-            '-sWASM_BIGINT=1', '-s', 'FORCE_FILESYSTEM=1',
+            '-s', 'FORCE_FILESYSTEM=1',
             '-sEXPORT_NAME=Module2', // '-pthread', '-sPTHREAD_POOL_SIZE=5',
             ...linkLibs, ...rustSources, `${state.config.paths.cli}/assets/cpp-runtime/browser.cpp`,
             ...(isProd ? ['-O3'] : []),
             '-s', 'WASM=1', '-s', 'MODULARIZE=1', '-s', 'DYNAMIC_EXECUTION=0',
             '-s', 'RESERVED_FUNCTION_POINTERS=200', // '-s', 'FORCE_FILESYSTEM=1',
             '-s', 'ALLOW_MEMORY_GROWTH=1',
-            // emsdk 6 defaults GROWABLE_ARRAYBUFFERS=1; Firefox/WebKit TextDecoder rejects views
-            // over resizable ArrayBuffers, breaking every string crossing the wasm boundary.
+            // Keep this explicit: Firefox/WebKit TextDecoder rejects views over resizable
+            // ArrayBuffers, breaking every string crossing the wasm boundary.
             '-s', 'GROWABLE_ARRAYBUFFERS=0',
             '-s', 'WASMFS',
             '-s', 'ENVIRONMENT=web,webview,worker',
@@ -240,10 +240,9 @@ export default async function buildWasm(target, options = {}) {
         triggerExtensions('buildWasm', 'beforeBuildEdge', [emccFlags]);
 
         const data = Object.entries(getData('data', target)).map(([key, value]) => ['--preload-file', `${key.replaceAll('@', '@@')}@/crossbind/${value}`]).flat();
-        run('emcc', [
+        run('em++', [
             '-lembind',
             ...emccFlags,
-            '-sWASM_BIGINT=1',
             '-sEXPORT_NAME=Module2',
             // rustSources carries the embind-rust adapter TU (emval/json/tid hooks); without
             // it any linked Rust package archive fails with undefined crossbind_* symbols.
@@ -273,11 +272,11 @@ export default async function buildWasm(target, options = {}) {
 
         triggerExtensions('buildWasm', 'beforeBuildNodeJS', [emccFlags]);
 
-        run('emcc', [
+        run('em++', [
             '-lembind',
             ...emccFlags,
-            // '-s', 'FETCH', '-sJSPI', '-sWASM_BIGINT=1', '-pthread', '-sPTHREAD_POOL_SIZE=5',
-            '-sWASM_BIGINT=1', '-s', 'FORCE_FILESYSTEM=1',
+            // '-s', 'FETCH', '-sJSPI', '-pthread', '-sPTHREAD_POOL_SIZE=5',
+            '-s', 'FORCE_FILESYSTEM=1',
             ...linkLibs, ...rustSources, `${state.config.paths.cli}/assets/cpp-runtime/node.cpp`,
             ...(isProd ? ['-O3'] : []),
             '-s', 'WASM=1', '-s', 'MODULARIZE=1', '-s', 'DYNAMIC_EXECUTION=0',

package/src/actions/createLib.js

@@ -203,7 +203,7 @@ export default function createLib(target, fileType, options = {}) {
                 stageWasiStubs();
             }
             run(null, [
-                './configure',
+                state.config.build?.configureProgram || './configure',
                 ...buildParams,
                 `--prefix=${libdir}`,
             ], platformPrefix, target, buildEnv);

package/src/actions/run.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import pullDockerImage, { getDockerImage, getDockerContainerName, imageRoleFor } from '../utils/pullDockerImage.js';
 import getOsUserAndGroupId from '../utils/getOsUserAndGroupId.js';
 import replaceBasePathForDockerUtil from '../utils/replaceBasePathForDocker.js';
+import { DOCKER_RUN_SECURITY_ARGS } from '../utils/dockerSecurity.js';
 import state from '../state/index.js';
 import { wasiCFlags, wasiCxxFlags, resolveWasiSdkPath, WASI_TARGET_TRIPLE } from '../utils/wasiToolchain.js';
 
@@ -20,51 +21,70 @@ const iosSdkPath = `${iOSDevPath}/Platforms/iPhoneOS.platform/Developer/SDKs/iPh
 const iosSimSdkPath = `${iOSDevPath}/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk`;
 
 const androidParamsArm64 = [
-    '-e', `AR=${t}/llvm-ar`,
-    '-e', `AS=${t}/llvm-as`,
-    '-e', `CC=${t}/${CROSSCOMPILER_ARM64}-clang`,
-    '-e', `CXX=${t}/${CROSSCOMPILER_ARM64}-clang++`,
-    '-e', `LD=${t}/ld`,
-    '-e', `RANLIB=${t}/llvm-ranlib`,
-    '-e', `STRIP=${t}/llvm-strip`,
-    '-e', `NM=${t}/nm`,
-    '-e', `CFLAGS=--sysroot=${t2}/sysroot`,
+    '-e',
+    `AR=${t}/llvm-ar`,
+    '-e',
+    `AS=${t}/llvm-as`,
+    '-e',
+    `CC=${t}/${CROSSCOMPILER_ARM64}-clang`,
+    '-e',
+    `CXX=${t}/${CROSSCOMPILER_ARM64}-clang++`,
+    '-e',
+    `LD=${t}/ld`,
+    '-e',
+    `RANLIB=${t}/llvm-ranlib`,
+    '-e',
+    `STRIP=${t}/llvm-strip`,
+    '-e',
+    `NM=${t}/nm`,
+    '-e',
+    `CFLAGS=--sysroot=${t2}/sysroot`,
 ];
 
 const androidParamsX86_64 = [
-    '-e', `AR=${t}/llvm-ar`,
-    '-e', `AS=${t}/llvm-as`,
-    '-e', `CC=${t}/${CROSSCOMPILER_x86_64}-clang`,
-    '-e', `CXX=${t}/${CROSSCOMPILER_x86_64}-clang++`,
-    '-e', `LD=${t}/ld`,
-    '-e', `RANLIB=${t}/llvm-ranlib`,
-    '-e', `STRIP=${t}/llvm-strip`,
-    '-e', `NM=${t}/nm`,
-    '-e', `CFLAGS=--sysroot=${t2}/sysroot`,
+    '-e',
+    `AR=${t}/llvm-ar`,
+    '-e',
+    `AS=${t}/llvm-as`,
+    '-e',
+    `CC=${t}/${CROSSCOMPILER_x86_64}-clang`,
+    '-e',
+    `CXX=${t}/${CROSSCOMPILER_x86_64}-clang++`,
+    '-e',
+    `LD=${t}/ld`,
+    '-e',
+    `RANLIB=${t}/llvm-ranlib`,
+    '-e',
+    `STRIP=${t}/llvm-strip`,
+    '-e',
+    `NM=${t}/nm`,
+    '-e',
+    `CFLAGS=--sysroot=${t2}/sysroot`,
 ];
 
 const IOS_HOST_FLAGS = `-arch arm64 -isysroot ${iosSdkPath} -fembed-bitcode`;
 const IOS_SIM_HOST_FLAGS = `-arch arm64 -isysroot ${iosSimSdkPath} -fembed-bitcode`;
-const IOS_IPHONE_PARAMS = [
-    '-e', `CFLAGS="${IOS_HOST_FLAGS}"`,
-    '-e', `CXXFLAGS="${IOS_HOST_FLAGS}"`,
-    '-e', `LDFLAGS="${IOS_HOST_FLAGS}"`,
-];
-const IOS_SIM_PARAMS = [
-    '-e', `CFLAGS="${IOS_SIM_HOST_FLAGS}"`,
-    '-e', `CXXFLAGS="${IOS_SIM_HOST_FLAGS}"`,
-    '-e', `LDFLAGS="${IOS_SIM_HOST_FLAGS}"`,
-];
+const IOS_IPHONE_PARAMS = ['-e', `CFLAGS="${IOS_HOST_FLAGS}"`, '-e', `CXXFLAGS="${IOS_HOST_FLAGS}"`, '-e', `LDFLAGS="${IOS_HOST_FLAGS}"`];
+const IOS_SIM_PARAMS = ['-e', `CFLAGS="${IOS_SIM_HOST_FLAGS}"`, '-e', `CXXFLAGS="${IOS_SIM_HOST_FLAGS}"`, '-e', `LDFLAGS="${IOS_SIM_HOST_FLAGS}"`];
 const iosParams = [
-    '-e', `AR=${iosBinPath}/ar`,
-    '-e', `AS=${iosBinPath}/as`,
-    '-e', `CC=${iosBinPath}/clang`,
-    '-e', `CXX=${iosBinPath}/clang++`,
-    '-e', `CPP=${iosBinPath}/cpp`,
-    '-e', `LD=${iosBinPath}/ld`,
-    '-e', `RANLIB=${iosBinPath}/ranlib`,
-    '-e', `STRIP=${iosBinPath}/strip`,
-    '-e', `NM=${iosBinPath}/llvm-nm`,
+    '-e',
+    `AR=${iosBinPath}/ar`,
+    '-e',
+    `AS=${iosBinPath}/as`,
+    '-e',
+    `CC=${iosBinPath}/clang`,
+    '-e',
+    `CXX=${iosBinPath}/clang++`,
+    '-e',
+    `CPP=${iosBinPath}/cpp`,
+    '-e',
+    `LD=${iosBinPath}/ld`,
+    '-e',
+    `RANLIB=${iosBinPath}/ranlib`,
+    '-e',
+    `STRIP=${iosBinPath}/strip`,
+    '-e',
+    `NM=${iosBinPath}/llvm-nm`,
 ];
 
 /* const iosMetalParams = [
@@ -103,7 +123,7 @@ export default function run(program, params = [], platformPrefix = null, target
         switch (target.platform) {
             case 'wasm':
                 platformParams = ['-e', 'CXXFLAGS=-fwasm-exceptions', '-e', 'CFLAGS=-fwasm-exceptions'];
-                if (params[0].includes('configure')) dProgram = 'emconfigure';
+                if (params[0].toLowerCase().includes('configure')) dProgram = 'emconfigure';
                 else if (params[0] === 'make') dProgram = 'emmake';
                 else if (params[0] === 'cmake') dProgram = 'emcmake';
                 else if (params[0] === 'cc') dProgram = 'emcc';
@@ -111,23 +131,29 @@ export default function run(program, params = [], platformPrefix = null, target
             case 'wasi': {
                 const wasiSdk = wasiHostSdk || '/opt/wasi-sdk';
                 if (wasiHostSdk && !fs.existsSync(`${wasiHostSdk}/share/wasi-sysroot/lib/${WASI_TARGET_TRIPLE}`)) {
-                    throw new Error(`crossbind: the wasi-sdk at ${wasiHostSdk} has no ${WASI_TARGET_TRIPLE} sysroot. platform:'wasi' targets WASI 0.3 (p3) - upgrade to wasi-sdk >= 34.`);
+                    throw new Error(
+                        `crossbind: the wasi-sdk at ${wasiHostSdk} has no ${WASI_TARGET_TRIPLE} sysroot. platform:'wasi' targets WASI 0.3 (p3) - upgrade to wasi-sdk >= 34.`,
+                    );
                 }
                 [dProgram, ...dParams] = params;
                 platformParams = [
-                    '-e', `CC=${wasiSdk}/bin/clang`,
-                    '-e', `CXX=${wasiSdk}/bin/clang++`,
-                    '-e', `AR=${wasiSdk}/bin/ar`,
-                    '-e', `RANLIB=${wasiSdk}/bin/ranlib`,
-                    '-e', `NM=${wasiSdk}/bin/nm`,
-                    '-e', `CFLAGS=${wasiCFlags().join(' ')}`,
-                    '-e', `CXXFLAGS=${wasiCxxFlags().join(' ')}`,
+                    '-e',
+                    `CC=${wasiSdk}/bin/clang`,
+                    '-e',
+                    `CXX=${wasiSdk}/bin/clang++`,
+                    '-e',
+                    `AR=${wasiSdk}/bin/ar`,
+                    '-e',
+                    `RANLIB=${wasiSdk}/bin/ranlib`,
+                    '-e',
+                    `NM=${wasiSdk}/bin/nm`,
+                    '-e',
+                    `CFLAGS=${wasiCFlags().join(' ')}`,
+                    '-e',
+                    `CXXFLAGS=${wasiCxxFlags().join(' ')}`,
                 ];
                 if (dProgram === 'cmake' && dParams[0] !== '--build' && dParams[0] !== '--install') {
-                    dParams = [
-                        ...dParams,
-                        `-DCMAKE_TOOLCHAIN_FILE=${wasiSdk}/share/cmake/wasi-sdk-p3.cmake`,
-                    ];
+                    dParams = [...dParams, `-DCMAKE_TOOLCHAIN_FILE=${wasiSdk}/share/cmake/wasi-sdk-p3.cmake`];
                 } else if (dProgram === 'wasi-clang++') {
                     dProgram = `${wasiSdk}/bin/clang++`;
                     platformParams = [];
@@ -158,7 +184,8 @@ export default function run(program, params = [], platformPrefix = null, target
                     if (dParams[0] !== '--build' && dParams[0] !== '--install') {
                         dParams = [
                             ...dParams,
-                            '-G', 'Xcode',
+                            '-G',
+                            'Xcode',
                             '-DBUILD_SHARED_LIBS=OFF',
                             '-DFRAMEWORK=TRUE',
                             '-DCMAKE_OSX_DEPLOYMENT_TARGET=13.0',
@@ -170,7 +197,7 @@ export default function run(program, params = [], platformPrefix = null, target
                             '-DCMAKE_SYSTEM_PROCESSOR=arm64',
                             `-DCMAKE_C_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
                             `-DCMAKE_CXX_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
-                            '-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY=\'iPhone Developer\'',
+                            "-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY='iPhone Developer'",
                             `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM=${state.config.system.XCODE_DEVELOPMENT_TEAM}`,
                         ];
                     }
@@ -195,7 +222,7 @@ export default function run(program, params = [], platformPrefix = null, target
                             '-DCMAKE_SYSTEM_PROCESSOR=arm64',
                             `-DCMAKE_C_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
                             `-DCMAKE_CXX_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
-                            '-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY=\'iPhone Developer\'',
+                            "-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY='iPhone Developer'",
                             `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM=${state.config.system.XCODE_DEVELOPMENT_TEAM}`,
                         ];
                     }
@@ -207,14 +234,25 @@ export default function run(program, params = [], platformPrefix = null, target
 
     const env = {};
     let runner = 'DOCKER';
-    if (((target?.platform === 'ios' || (target?.platform === 'wasi' && wasiHostSdk)) && program === null) || state.config.system.RUNNER === 'LOCAL') {
+    if (
+        ((target?.platform === 'ios' || (target?.platform === 'wasi' && wasiHostSdk)) && program === null) ||
+        state.config.system.RUNNER === 'LOCAL'
+    ) {
         runner = 'LOCAL';
     }
 
     if (runner === 'LOCAL') {
         const allowedEnv = [
-            '^PWD$', '^SHELL$', '^LC_CTYPE$', '^PATH$', '^HOME$', '^TMPDIR$', '^USER$',
-            '^PODS_*', '^CONFIGURATION_BUILD_DIR$', '^UNLOCALIZED_RESOURCES_FOLDER_PATH$',
+            '^PWD$',
+            '^SHELL$',
+            '^LC_CTYPE$',
+            '^PATH$',
+            '^HOME$',
+            '^TMPDIR$',
+            '^USER$',
+            '^PODS_*',
+            '^CONFIGURATION_BUILD_DIR$',
+            '^UNLOCALIZED_RESOURCES_FOLDER_PATH$',
         ];
         Object.entries(process.env).forEach(([key, value]) => {
             if (allowedEnv.some((e) => key.match(e))) {
@@ -230,7 +268,7 @@ export default function run(program, params = [], platformPrefix = null, target
             const value = rest.join('=');
             if (['CFLAGS', 'CXXFLAGS', 'CPPFLAGS', 'LDFLAGS'].includes(key)) {
                 let v = value;
-                if (v.startsWith('\'') || v.startsWith('"')) {
+                if (v.startsWith("'") || v.startsWith('"')) {
                     v = v.substring(1, v.length - 1);
                 }
                 if (env[key]) env[key] += ` ${v}`;
@@ -264,7 +302,7 @@ export default function run(program, params = [], platformPrefix = null, target
         const role = imageRoleFor(target);
         if (state.config.system.RUNNER === 'DOCKER_RUN') {
             imageOrContainer = getDockerImage(role);
-            runnerParams = ['run', '--rm', '-v', `${state.config.paths.base}:/tmp/crossbind/live`];
+            runnerParams = ['run', '--rm', ...DOCKER_RUN_SECURITY_ARGS, '-v', `${state.config.paths.base}:/tmp/crossbind/live`];
             if (target?.platform === 'android') {
                 // Google ships the linux NDK for x86_64 only; use the amd64 leaf ref (classic store holds one platform per digest).
                 pullDockerImage(role, 'linux/amd64');
@@ -280,8 +318,10 @@ export default function run(program, params = [], platformPrefix = null, target
 
         const args = [
             ...runnerParams,
-            '--user', getOsUserAndGroupId(),
-            '--workdir', replaceBasePathForDocker(dockerOptions.workdir || buildPath),
+            '--user',
+            getOsUserAndGroupId(),
+            '--workdir',
+            replaceBasePathForDocker(dockerOptions.workdir || buildPath),
             ...replaceBasePathForDocker(dockerEnv),
             // '-e', replaceBasePathForDocker(`CCACHE_DIR=${state.config.paths.build}/ccache`),
             imageOrContainer,

package/src/assets/toolchain-digests.json

@@ -0,0 +1,36 @@
+{
+    "version": "1.0.3",
+    "registry": "ghcr.io/crossbind",
+    "toolchains": {
+        "rust": "1.98.1"
+    },
+    "images": {
+        "rust-sysroot": {
+            "index": "sha256:6a5db2ecf54398d837fdbbd8c1f2cdaafd14fd486ac3af4206d21bc9fe66e923",
+            "platforms": {
+                "linux/arm64": "sha256:b5dbd8b4f233f5d6c0cfe7554b95b412e0e3396d4d4847facf116c155251b0b7",
+                "linux/amd64": "sha256:1989d0ab32d2372a2086efe50e33dbb861fa903e451b891f30004e0f172a1a9a"
+            }
+        },
+        "base": {
+            "index": "sha256:c9b501dca53bc2e51dddd1af64ede75220792e66a47ed488ad6172b58bee1b37",
+            "platforms": {
+                "linux/arm64": "sha256:edf01f0c4d7fc551e18775e76b2a6c2b9b54075b59f21f7635ccecaebcc6c282",
+                "linux/amd64": "sha256:debea6ee164eeba49155ad59365313a9dd291491b3339491a780b46d1b5b96f4"
+            }
+        },
+        "web": {
+            "index": "sha256:633da840658f12f291c17c3305adf265c7d52307b3b61b84156d5f85f3121779",
+            "platforms": {
+                "linux/arm64": "sha256:a5fe9f3693d789f04490963afbe80fa71a8ff0d0cc6e442b76ca37492fbf3221",
+                "linux/amd64": "sha256:65abff12143740d4557e9cbfd923b6fd6c5d01f25e96a1d27bbad5e083bb9f74"
+            }
+        },
+        "android": {
+            "index": "sha256:1f415db57ccb57c8850ad4498d9fead35f5104099fd355c067208b2e53c25b23",
+            "platforms": {
+                "linux/amd64": "sha256:38d7a10c233cfab13adb110383e386e2a649364a8285d6b3ad0696e1e343b58a"
+            }
+        }
+    }
+}

package/src/utils/binTools.js

@@ -74,3 +74,8 @@ export function renderDispatcher(bin) {
         '',
     ].join('\n');
 }
+
+// Under the target build tree, never os.tmpdir(): the containerized compiler only sees paths.base.
+export function multitoolWorkRoot(buildPath, platformPrefix, targetPath) {
+    return `${buildPath}/${platformPrefix}/${targetPath}`;
+}

package/src/utils/dockerSecurity.js

@@ -0,0 +1,4 @@
+// Compilation executes project build scripts and third-party toolchains. These flags do not turn
+// Docker into a sandbox, but they remove privileges a compiler does not need. Keep the list shared
+// so the generic command runner and the dedicated cargo runner cannot drift.
+export const DOCKER_RUN_SECURITY_ARGS = Object.freeze(['--cap-drop', 'ALL', '--security-opt', 'no-new-privileges=true']);

package/src/utils/overrideDependency.js

@@ -1,7 +1,7 @@
 import { getContentHash } from './hash.js';
 
 const REPLACE_RECIPE_KEYS = [
-    'buildType', 'getURL', 'env', 'copyToSource', 'copyToDist',
+    'buildType', 'configureProgram', 'getURL', 'env', 'copyToSource', 'copyToDist',
     'beforeRun', 'useIOSCMake', 'sourceReplaceList', 'getExtraLibs',
 ];
 

package/src/utils/pullDockerImage.js

@@ -1,27 +1,21 @@
 import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 import { getContentHash } from './hash.js';
 
-// Digest-pinned so a re-pushed tag can't swap the compiler; IMAGE_VERSION only names containers
-// and records which release these digests came from - bump every pin via scripts/pin-docker-image.js.
-const REGISTRY = 'ghcr.io/crossbind';
-const IMAGE_VERSION = '1.0.2';
-
-// One entry per role in the image family. `ref` is the multi-arch index, which a native pull
-// resolves per platform; `amd64` is that index's linux/amd64 leaf, needed wherever the CLI forces
-// a platform, because the classic image store holds one platform per digest reference. The android
-// image is amd64-only - Google ships the linux NDK host tools for x86_64 alone - so its index
-// carries a single leaf and both of its refs resolve to the same platform.
-// Generated by scripts/pin-docker-image.js from a release digest table; do not edit by hand.
-const IMAGES = {
-    web: {
-        ref: `${REGISTRY}/web@sha256:c1d1d81a4775871cd90c8ac980e0a5f87cb7890822117f77be1c8345f51b1f47`,
-        amd64: `${REGISTRY}/web@sha256:9010948430c95120b8c19f73377f8684bc6b54e03537790f465237225e48dae2`,
-    },
-    android: {
-        ref: `${REGISTRY}/android@sha256:a3facbf2181f568f12a9fe89054188895665a63e2c147b790fd7e25f3e128ac8`,
-        amd64: `${REGISTRY}/android@sha256:4694c6210379a87d8cf0e7f8b56a76a9c74a8724a1aff037c943dcdb521f4de1`,
-    },
-};
+// This committed JSON is the one digest table for the CLI, release manifests and release assets.
+// scripts/pin-docker-image.js replaces it from the image workflow's verified `digests` artifact.
+const table = createRequire(import.meta.url)('../assets/toolchain-digests.json');
+const REGISTRY = table.registry;
+const IMAGE_VERSION = table.version;
+const IMAGES = Object.fromEntries(
+    ['web', 'android'].map((role) => [
+        role,
+        {
+            ref: `${REGISTRY}/${role}@${table.images[role].index}`,
+            amd64: `${REGISTRY}/${role}@${table.images[role].platforms['linux/amd64']}`,
+        },
+    ]),
+);
 
 const OVERRIDE_KEYS = { web: 'CROSSBIND_IMAGE_WEB', android: 'CROSSBIND_IMAGE_ANDROID' };
 

package/src/utils/runCargo.js

@@ -6,6 +6,7 @@ import state from '../state/index.js';
 import getOsUserAndGroupId from './getOsUserAndGroupId.js';
 import replaceBasePathForDockerUtil, { DOCKER_BASE } from './replaceBasePathForDocker.js';
 import pullDockerImage, { getDockerImage, getDockerContainerName, imageRoleFor } from './pullDockerImage.js';
+import { DOCKER_RUN_SECURITY_ARGS } from './dockerSecurity.js';
 
 // Every cargo invocation crossbind makes goes through here.
 //
@@ -28,14 +29,26 @@ const RUSTFLAGS_SEPARATOR = String.fromCharCode(0x1f);
 // the compiler - RUSTC_WRAPPER, CARGO_BUILD_RUSTC, CARGO_TARGET_<TRIPLE>_LINKER, RUSTFLAGS,
 // RUSTUP_TOOLCHAIN, RUSTC_BOOTSTRAP - cannot reach cargo from the caller's environment.
 const ALLOWED_ENV = [
-    /^PATH$/, /^HOME$/, /^USER$/, /^LOGNAME$/, /^SHELL$/, /^TERM$/,
-    /^TMPDIR$/, /^TEMP$/, /^TMP$/,
-    /^LANG$/, /^LC_[A-Z_]+$/,
+    /^PATH$/,
+    /^HOME$/,
+    /^USER$/,
+    /^LOGNAME$/,
+    /^SHELL$/,
+    /^TERM$/,
+    /^TMPDIR$/,
+    /^TEMP$/,
+    /^TMP$/,
+    /^LANG$/,
+    /^LC_[A-Z_]+$/,
     /^RUSTUP_HOME$/,
     /^SSH_AUTH_SOCK$/, // git dependencies over ssh
-    /^CARGO_NET_/, /^CARGO_REGISTRIES_/, // offline/vendored builds and private registries
+    /^CARGO_NET_/,
+    /^CARGO_REGISTRIES_/, // offline/vendored builds and private registries
     /^(HTTP|HTTPS|ALL|NO)_PROXY$/i,
-    /^SYSTEMROOT$/i, /^WINDIR$/i, /^USERPROFILE$/i, /^PROGRAMDATA$/i, // windows cannot spawn without these
+    /^SYSTEMROOT$/i,
+    /^WINDIR$/i,
+    /^USERPROFILE$/i,
+    /^PROGRAMDATA$/i, // windows cannot spawn without these
 ];
 
 // Recent cargo applies config.toml only, but the extensionless name is still read by older
@@ -76,14 +89,18 @@ export function assertCleanConfigChain(home, cwd) {
     for (const name of CONFIG_NAMES) {
         const file = path.join(home, name);
         if (fs.existsSync(file)) {
-            throw new Error(`crossbind: unexpected cargo config at ${file} - crossbind owns this CARGO_HOME and never writes one. Remove it and build again.`);
+            throw new Error(
+                `crossbind: unexpected cargo config at ${file} - crossbind owns this CARGO_HOME and never writes one. Remove it and build again.`,
+            );
         }
     }
     for (let dir = cwd; ; dir = path.dirname(dir)) {
         for (const name of CONFIG_NAMES) {
             const file = path.join(dir, '.cargo', name);
             if (fs.existsSync(file)) {
-                throw new Error(`crossbind: ${file} would apply to this build - cargo discovers config by walking up from the working directory. crossbind builds from a neutral directory to avoid that; move the file or report this.`);
+                throw new Error(
+                    `crossbind: ${file} would apply to this build - cargo discovers config by walking up from the working directory. crossbind builds from a neutral directory to avoid that; move the file or report this.`,
+                );
             }
         }
         if (path.dirname(dir) === dir) return;
@@ -106,9 +123,7 @@ function allowedEnv() {
     return env;
 }
 
-function cargoEnv({
-    home, rustflags, panic, allowUnstable,
-}) {
+function cargoEnv({ home, rustflags, panic, allowUnstable }) {
     const env = { CARGO_HOME: home };
     // Depth defence: -Z fails with E0554 instead of quietly enabling unstable behaviour. The value
     // -1 disables unstable features on EVERY channel, nightly included, so the one caller that
@@ -131,6 +146,7 @@ function createHint(name, base, home, image) {
     return [
         'Create it with:',
         `  docker run -d --name ${name} \\`,
+        `    ${DOCKER_RUN_SECURITY_ARGS.join(' ')} \\`,
         `    -v ${base}:${DOCKER_BASE} \\`,
         `    -v ${home}:${CONTAINER_CARGO_HOME} \\`,
         `    ${image} sleep infinity`,
@@ -138,7 +154,13 @@ function createHint(name, base, home, image) {
 }
 
 function samePath(a, b) {
-    const real = (p) => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+    const real = (p) => {
+        try {
+            return fs.realpathSync(p);
+        } catch {
+            return path.resolve(p);
+        }
+    };
     return real(a) === real(b);
 }
 
@@ -152,13 +174,20 @@ function assertExecContainer(name, base, home, image) {
         throw new Error(`crossbind: RUNNER=DOCKER_EXEC needs a container named '${name}', which does not exist.\n${hint}`);
     }
     if (!info?.State?.Running) {
-        throw new Error(`crossbind: the container '${name}' exists but is not running. Start it with \`docker start ${name}\`, or recreate it.\n${hint}`);
+        throw new Error(
+            `crossbind: the container '${name}' exists but is not running. Start it with \`docker start ${name}\`, or recreate it.\n${hint}`,
+        );
     }
-    for (const [destination, source] of [[DOCKER_BASE, base], [CONTAINER_CARGO_HOME, home]]) {
+    for (const [destination, source] of [
+        [DOCKER_BASE, base],
+        [CONTAINER_CARGO_HOME, home],
+    ]) {
         const mount = (info.Mounts ?? []).find((m) => m.Destination === destination);
         if (!mount || !samePath(mount.Source, source)) {
             const found = mount ? ` - it mounts ${mount.Source} there` : '';
-            throw new Error(`crossbind: the container '${name}' does not mount ${source} at ${destination}${found}. It predates the cargo mount, so recreate it.\n${hint}`);
+            throw new Error(
+                `crossbind: the container '${name}' does not mount ${source} at ${destination}${found}. It predates the cargo mount, so recreate it.\n${hint}`,
+            );
         }
     }
     // `docker run --workdir` creates the directory; `docker exec --workdir` does not, and cargo
@@ -170,9 +199,7 @@ function assertExecContainer(name, base, home, image) {
     }
 }
 
-export default function runCargo(args, {
-    cwd, rustflags = [], panic, capture = false, maxBuffer, allowUnstable = false, target,
-} = {}) {
+export default function runCargo(args, { cwd, rustflags = [], panic, capture = false, maxBuffer, allowUnstable = false, target } = {}) {
     const home = cargoHome();
     const workdir = cwd ?? neutralCwd();
     fs.mkdirSync(home, { recursive: true });
@@ -200,7 +227,10 @@ export default function runCargo(args, {
     // Only what cargo needs travels in: the image already carries PATH, RUSTUP_HOME and the
     // toolchain, and the host's PATH would be meaningless there.
     const env = cargoEnv({
-        home: CONTAINER_CARGO_HOME, rustflags, panic, allowUnstable,
+        home: CONTAINER_CARGO_HOME,
+        rustflags,
+        panic,
+        allowUnstable,
     });
     const envArgs = Object.entries(env).flatMap(([key, value]) => ['-e', `${key}=${value}`]);
 
@@ -208,20 +238,25 @@ export default function runCargo(args, {
     if (runner === 'DOCKER_EXEC') {
         const name = getDockerContainerName(base, role);
         assertExecContainer(name, base, home, getDockerImage(role, platform));
-        runnerArgs = ['exec', ...envArgs,
-            '--user', getOsUserAndGroupId(),
-            '--workdir', CONTAINER_CWD,
-            name];
+        runnerArgs = ['exec', ...envArgs, '--user', getOsUserAndGroupId(), '--workdir', CONTAINER_CWD, name];
     } else {
         pullDockerImage(role, platform);
-        runnerArgs = ['run', '--rm',
+        runnerArgs = [
+            'run',
+            '--rm',
             ...(platform ? ['--platform', platform] : []),
-            '-v', `${base}:${DOCKER_BASE}`,
-            '-v', `${home}:${CONTAINER_CARGO_HOME}`,
+            ...DOCKER_RUN_SECURITY_ARGS,
+            '-v',
+            `${base}:${DOCKER_BASE}`,
+            '-v',
+            `${home}:${CONTAINER_CARGO_HOME}`,
             ...envArgs,
-            '--user', getOsUserAndGroupId(),
-            '--workdir', CONTAINER_CWD,
-            getDockerImage(role, platform)];
+            '--user',
+            getOsUserAndGroupId(),
+            '--workdir',
+            CONTAINER_CWD,
+            getDockerImage(role, platform),
+        ];
     }
 
     return spawnSync('docker', [...runnerArgs, 'cargo', ...replaceBasePathForDockerUtil(args, base)], options);

package/src/utils/rustSysrootPin.js

@@ -1,11 +1,14 @@
-// Generated by scripts/pin-rust-sysroot.js - do not edit by hand.
-//
 // The published sysroot image a host build (RUNNER=LOCAL) reads its Rust sysroots out of - the same
 // object the web image embeds, not a repackaged copy, so the two channels cannot drift. The index
 // digest is the whole contract: the loader verifies the index body against it, then each descriptor
 // inside a verified body authenticates the next fetch, down to the layer.
+import { createRequire } from 'node:module';
+
+const table = createRequire(import.meta.url)('../assets/toolchain-digests.json');
+const sysroot = table.images['rust-sysroot'];
+
 export default {
-    version: '1.0.2',
-    image: 'ghcr.io/crossbind/rust-sysroot',
-    index: 'sha256:0ab2e522b1b09b2af7f312d4b940ab92ee470e8165df4b563e274a4eb2fdb903',
+    version: table.version,
+    image: `${table.registry}/rust-sysroot`,
+    index: sysroot.index,
 };