nuwax-codex 0.17.8 → 0.18.0

package/bin/nuwax-codex.js

@@ -4,7 +4,7 @@
 // run and caches it locally. No platform-specific npm packages needed.
 
 import { spawnSync } from "node:child_process";
-import { createWriteStream, existsSync, mkdirSync, chmodSync } from "node:fs";
+import { createWriteStream, existsSync, mkdirSync, chmodSync, renameSync, rmSync, cpSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { familySync } from "detect-libc";
@@ -24,10 +24,16 @@ function getTargetTriple() {
     return a === "arm64" ? "aarch64-apple-darwin" : "x86_64-apple-darwin";
   }
   if (p === "linux") {
-    if (a !== "x64") throw new Error(`Unsupported Linux arch: ${a}`);
-    return familySync() === "musl"
-      ? "x86_64-unknown-linux-musl"
-      : "x86_64-unknown-linux-gnu";
+    const musl = familySync() === "musl";
+    if (a === "x64") {
+      return musl ? "x86_64-unknown-linux-musl" : "x86_64-unknown-linux-gnu";
+    }
+    if (a === "arm64") {
+      // Release builds aarch64-unknown-linux-musl; glibc arm64 maps to it
+      // (static musl binaries run on glibc hosts).
+      return "aarch64-unknown-linux-musl";
+    }
+    throw new Error(`Unsupported Linux arch: ${a}`);
   }
   if (p === "win32") {
     return a === "arm64" ? "aarch64-pc-windows-msvc" : "x86_64-pc-windows-msvc";
@@ -46,7 +52,9 @@ function getBinaryName() {
 // -- download & cache -------------------------------------------------------
 
 function cacheDir() {
-  return join(homedir(), ".nuwax-codex-cache", VERSION);
+  // Include the target triple: sharing HOME across glibc/musl containers
+  // or architectures would otherwise execute the wrong binary.
+  return join(homedir(), ".nuwax-codex-cache", VERSION, getTargetTriple());
 }
 
 function cachedBinaryPath() {
@@ -67,6 +75,12 @@ async function downloadBinary(url, outPath) {
   let downloaded = 0;
   const reader = res.body.getReader();
   const ws = createWriteStream(outPath);
+  // Surface write errors (EACCES/ENOSPC/EMFILE) as promise rejections
+  // instead of unhandled 'error' events that kill the process before the
+  // outer catch can make the install fault-tolerant.
+  const writeFailed = new Promise((_, reject) => {
+    ws.on("error", reject);
+  });
   const logInterval = setInterval(() => {
     if (total > 0) {
       process.stderr.write(
@@ -81,6 +95,11 @@ async function downloadBinary(url, outPath) {
       if (done) break;
       ws.write(value);
       downloaded += value.length;
+      // A failed write rejects `writeFailed`; race so it escapes as a
+      // normal rejection the outer catch can tolerate.
+      await Promise.race([writeFailed.then(() => {}, () => {
+        throw new Error(`Failed to write ${outPath} (disk full or permission denied)`);
+      }), Promise.resolve()]);
     }
   } finally {
     clearInterval(logInterval);
@@ -161,16 +180,47 @@ async function ensureBinary() {
   console.error(`  ${url}`);
 
   const dir = cacheDir();
-  mkdirSync(dir, { recursive: true });
-  const archivePath = join(dir, `nuwax-codex.${ext}`);
 
-  await downloadBinary(url, archivePath);
+  // Atomic install (#38): download+extract into unique staging, verify,
+  // then rename into final cache. A crash mid-extract leaves only the
+  // staging dir; the cache never holds a partial install.
+  const lockDir = `${dir}.lock-${process.pid}-${Date.now()}`;
+  mkdirSync(lockDir, { recursive: true });
+  const stagingDir = join(lockDir, "stage");
+  mkdirSync(stagingDir, { recursive: true });
+  const archivePath = join(lockDir, `nuwax-codex.${ext}`);
+
+  try {
+    await downloadBinary(url, archivePath);
+
+    console.error("  Extracting …");
+    if (ext === "tar.gz") {
+      await extractTarGz(archivePath, stagingDir);
+    } else {
+      await extractZip(archivePath, stagingDir);
+    }
+
+    const stagedBinary = join(stagingDir, getBinaryName());
+    if (!existsSync(stagedBinary)) {
+      throw new Error(
+        `Extraction completed but ${getBinaryName()} not found in staging directory`,
+      );
+    }
 
-  console.error("  Extracting …");
-  if (ext === "tar.gz") {
-    await extractTarGz(archivePath, dir);
-  } else {
-    await extractZip(archivePath, dir);
+    mkdirSync(dirname(dir), { recursive: true });
+    try {
+      renameSync(stagingDir, dir);
+    } catch (e) {
+      if (e.code === "ENOTEMPTY" || e.code === "EEXIST") {
+        if (!existsSync(cached)) throw e;
+      } else if (e.code === "EXDEV") {
+        cpSync(stagingDir, dir, { recursive: true });
+      } else {
+        throw e;
+      }
+    }
+  } finally {
+    rmSync(lockDir, { recursive: true, force: true });
   }
 
   if (!existsSync(cached)) {
@@ -183,9 +233,13 @@ async function ensureBinary() {
 
 function run() {
   ensureBinary().then((binaryPath) => {
+    // Tag the child as installed via the nuwax npm package so codex's
+    // update flow targets nuwax-codex (not upstream @openai/codex).
+    const env = { ...process.env, CODEX_INSTALL_SOURCE: "npm_nuwax" };
     const result = spawnSync(binaryPath, process.argv.slice(2), {
       stdio: "inherit",
       windowsHide: true,
+      env,
     });
     if (result.error) {
       console.error(`Failed to execute ${binaryPath}:`, result.error);

package/bin/postinstall.js

@@ -2,7 +2,7 @@
 // Postinstall script: pre-downloads the native `nuwax-codex` binary from
 // Alibaba Cloud OSS so the first CLI invocation is instant.
 
-import { createWriteStream, existsSync, mkdirSync, chmodSync } from "node:fs";
+import { createWriteStream, existsSync, mkdirSync, chmodSync, renameSync, rmSync, cpSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { createRequire } from "node:module";
@@ -43,7 +43,9 @@ function getBinaryName() {
 }
 
 function cacheDir() {
-  return join(homedir(), ".nuwax-codex-cache", VERSION);
+  // Include the target triple: sharing HOME across glibc/musl containers
+  // or architectures would otherwise execute the wrong binary.
+  return join(homedir(), ".nuwax-codex-cache", VERSION, getTargetTriple());
 }
 
 function cachedBinaryPath() {
@@ -66,6 +68,12 @@ async function downloadBinary(url, outPath) {
   let downloaded = 0;
   const reader = res.body.getReader();
   const ws = createWriteStream(outPath);
+  // Surface write errors (EACCES/ENOSPC/EMFILE) as promise rejections
+  // instead of unhandled 'error' events that kill the process before the
+  // outer catch can make the install fault-tolerant.
+  const writeFailed = new Promise((_, reject) => {
+    ws.on("error", reject);
+  });
   const logInterval = setInterval(() => {
     if (total > 0) {
       process.stderr.write(
@@ -79,6 +87,11 @@ async function downloadBinary(url, outPath) {
       if (done) break;
       ws.write(value);
       downloaded += value.length;
+      // A failed write rejects `writeFailed`; race so it escapes as a
+      // normal rejection the outer catch can tolerate.
+      await Promise.race([writeFailed.then(() => {}, () => {
+        throw new Error(`Failed to write ${outPath} (disk full or permission denied)`);
+      }), Promise.resolve()]);
     }
   } finally {
     clearInterval(logInterval);
@@ -165,16 +178,43 @@ async function main() {
   process.stderr.write(`  ${url}\n`);
 
   const dir = cacheDir();
-  mkdirSync(dir, { recursive: true });
-  const archivePath = join(dir, `nuwax-codex.${ext}`);
 
-  await downloadBinary(url, archivePath);
+  // Atomic install (#38): staging directory + verify + rename commit.
+  const lockDir = `${dir}.lock-${process.pid}-${Date.now()}`;
+  mkdirSync(lockDir, { recursive: true });
+  const stagingDir = join(lockDir, "stage");
+  mkdirSync(stagingDir, { recursive: true });
+  const archivePath = join(lockDir, `nuwax-codex.${ext}`);
 
-  process.stderr.write("  Extracting …\n");
-  if (ext === "tar.gz") {
-    await extractTarGz(archivePath, dir);
-  } else {
-    await extractZip(archivePath, dir);
+  try {
+    await downloadBinary(url, archivePath);
+
+    process.stderr.write("  Extracting …\n");
+    if (ext === "tar.gz") {
+      await extractTarGz(archivePath, stagingDir);
+    } else {
+      await extractZip(archivePath, stagingDir);
+    }
+
+    const stagedBinary = join(stagingDir, getBinaryName());
+    if (!existsSync(stagedBinary)) {
+      throw new Error(`Extraction completed but ${getBinaryName()} not found in staging`);
+    }
+
+    mkdirSync(dirname(dir), { recursive: true });
+    try {
+      renameSync(stagingDir, dir);
+    } catch (e) {
+      if (e.code === "ENOTEMPTY" || e.code === "EEXIST") {
+        if (!existsSync(cached)) throw e;
+      } else if (e.code === "EXDEV") {
+        cpSync(stagingDir, dir, { recursive: true });
+      } else {
+        throw e;
+      }
+    }
+  } finally {
+    rmSync(lockDir, { recursive: true, force: true });
   }
 
   if (existsSync(cached)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuwax-codex",
-  "version": "0.17.8",
+  "version": "0.18.0",
   "type": "module",
   "description": "Fork of OpenAI Codex CLI with domestic (Chinese) LLM support via genai",
   "license": "Apache-2.0",