javi-forge 1.10.0 → 1.10.1

package/dist/commands/ci.js

@@ -83,13 +83,13 @@ async function buildCICommands(stack, buildTool, projectDir) {
         case "java-gradle":
             return {
                 lintCmd: "./gradlew spotlessCheck --no-daemon",
-                compileCmd: "./gradlew clean classes testClasses --no-daemon && chown -R runner:runner build/ .gradle/ 2>/dev/null || true",
+                compileCmd: "./gradlew clean classes testClasses --no-daemon",
                 testCmd: "./gradlew test --no-daemon",
             };
         case "java-maven":
             return {
                 lintCmd: "./mvnw spotless:check",
-                compileCmd: "./mvnw clean compile test-compile && chown -R runner:runner target/ .mvn/ 2>/dev/null || true",
+                compileCmd: "./mvnw clean compile test-compile",
                 testCmd: "./mvnw test",
             };
         case "node": {
@@ -101,14 +101,14 @@ async function buildCICommands(stack, buildTool, projectDir) {
             catch {
                 /* no package.json */
             }
-            // Clean dist/ before build and chown after so tests (as runner) can access output.
-            // Runs as root inside the container to handle host-owned output dirs.
+            // Clean dist/ before build so a stale directory never masks a broken
+            // build. The container runs as the host uid (see runInContainer,
+            // ENV-1), so output lands host-owned — no chown needed.
             const buildPrefix = "rm -rf dist/ && ";
-            const buildSuffix = " && chown -R runner:runner dist/ 2>/dev/null || true";
             return {
                 lintCmd: pkgContent.includes('"lint"') ? `${buildTool} run lint` : null,
                 compileCmd: pkgContent.includes('"build"')
-                    ? `${buildPrefix}${buildTool} run build${buildSuffix}`
+                    ? `${buildPrefix}${buildTool} run build`
                     : null,
                 testCmd: pkgContent.includes('"test"')
                     ? `${buildTool} ${buildTool === "npm" ? "test" : "run test"}`
@@ -124,13 +124,13 @@ async function buildCICommands(stack, buildTool, projectDir) {
         case "go":
             return {
                 lintCmd: "golangci-lint run",
-                compileCmd: "go clean -cache && go build ./... && chown -R runner:runner . 2>/dev/null || true",
+                compileCmd: "go clean -cache && go build ./...",
                 testCmd: "go test ./...",
             };
         case "rust":
             return {
                 lintCmd: "cargo clippy -- -D warnings",
-                compileCmd: "cargo clean && cargo build && chown -R runner:runner target/ 2>/dev/null || true",
+                compileCmd: "cargo clean && cargo build",
                 testCmd: "cargo test",
             };
         default:
@@ -565,7 +565,6 @@ async function runRunner(runner, ctx) {
             id: "compile",
             label: "Compile",
             cmds: runner.compileCmds,
-            user: "root",
             skip: false,
         },
         {

package/dist/lib/docker.js

@@ -189,6 +189,20 @@ export async function runInContainer(options) {
     // detection happens on this path — ever.
     const imageName = image;
     const isInteractive = process.stdin.isTTY && stream;
+    // ENV-1: match the container process to the HOST user. The images bake a
+    // `runner` user whose uid depends on the base (1001 on node:22-slim, where
+    // uid 1000 is already `node`). When that uid differs from the host uid,
+    // everything the container writes to the bind-mounted workspace (dist/,
+    // node_modules/.vite-temp, build output) lands owned by the wrong user,
+    // and the host's local vitest then fails with EACCES. Running as the host
+    // uid:gid makes artifacts host-owned — no chown dance, ever. An explicit
+    // `user` override still wins (e.g. a caller that needs root). getuid/getgid
+    // are undefined on non-POSIX platforms (Windows); there we omit the flag
+    // and keep the image default.
+    const uid = process.getuid?.();
+    const gid = process.getgid?.();
+    const runAsUser = user ??
+        (uid !== undefined && gid !== undefined ? `${uid}:${gid}` : undefined);
     // Use --mount instead of -v: the -v form parses the value as a single
     // "src:dst[:opt]" colon-separated string, which breaks (and could be
     // hijacked) when projectDir itself contains a colon. --mount takes
@@ -201,7 +215,7 @@ export async function runInContainer(options) {
         "30",
         "--entrypoint",
         "",
-        ...(user ? ["--user", user] : []),
+        ...(runAsUser ? ["--user", runAsUser] : []),
         "--mount",
         `type=bind,source=${projectDir},target=/home/runner/work`,
         "-e",
@@ -237,6 +251,11 @@ export async function runInContainer(options) {
  */
 export async function openShell(projectDir, image) {
     const imageName = image;
+    // ENV-1: run the interactive shell as the host user too, so anything
+    // written from the debug shell stays host-owned. See runInContainer.
+    const uid = process.getuid?.();
+    const gid = process.getgid?.();
+    const runAsUser = uid !== undefined && gid !== undefined ? `${uid}:${gid}` : undefined;
     await new Promise((resolve, reject) => {
         const proc = spawn("docker", [
             "run",
@@ -244,6 +263,7 @@ export async function openShell(projectDir, image) {
             "-it",
             "--entrypoint",
             "",
+            ...(runAsUser ? ["--user", runAsUser] : []),
             // --mount is colon-safe; see runInContainer for the rationale.
             "--mount",
             `type=bind,source=${projectDir},target=/home/runner/work`,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.10.0",
+	"version": "1.10.1",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {