probbit 0.8.0 → 0.8.1

package/README.md

@@ -11,7 +11,7 @@ probbit stats --pretty
 ```
 
 The install step fetches the release archive for your platform from GitHub Releases (macOS arm64 and x86_64, Linux
-x86_64 with glibc, Windows x86_64), checks it against the `.sha256` file published beside it and keeps the binary inside
+x86_64 with glibc or musl, Linux ARM64 static musl, Windows x86_64), checks it against the `.sha256` file published beside it and keeps the binary inside
 this package. No dependencies; Node >= 18. If the install step could not run (`--ignore-scripts`, offline), the first
 `probbit` call fetches the binary. A checksum mismatch fails the install and installs nothing.
 

package/bin/probbit.js

@@ -16,15 +16,16 @@ async function main() {
   }
   const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' });
   const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'].filter((s) => process.platform !== 'win32' || s !== 'SIGHUP');
-  const forward = (s) => { try { child.kill(s); } catch (e) { /* already gone */ } };
-  for (const s of signals) process.on(s, forward);
+  // Node's signal events carry no argument. Bind each signal explicitly instead of accidentally forwarding SIGTERM.
+  const handlers = new Map(signals.map(s => [s, () => { try { child.kill(s); } catch (e) { /* already gone */ } }]));
+  for (const [s, handler] of handlers) process.on(s, handler);
   child.on('error', (e) => {
     process.stderr.write(`probbit: cannot run ${bin}: ${e.message}\n`);
     process.exit(127);
   });
   child.on('exit', (code, signal) => {
     if (signal) {
-      for (const s of signals) process.removeListener(s, forward);
+      for (const [s, handler] of handlers) process.removeListener(s, handler);
       process.exitCode = 128 + (os.constants.signals[signal] || 0); // if the signal is ignored here (SIGPIPE)
       process.kill(process.pid, signal); // die the same way, so the shell sees 128 + n
       return;

package/install.js

@@ -22,6 +22,7 @@ const TARGETS = {
   'darwin-arm64': 'aarch64-apple-darwin',
   'darwin-x64': 'x86_64-apple-darwin',
   'linux-x64': 'x86_64-unknown-linux-gnu',
+  'linux-arm64': 'aarch64-unknown-linux-musl',
   'win32-x64': 'x86_64-pc-windows-msvc',
   'win32-arm64': 'x86_64-pc-windows-msvc', // x64 emulation on Windows on Arm
 };
@@ -34,7 +35,7 @@ function binaryPath() {
 class ChecksumError extends Error {}
 
 async function get(url) {
-  const res = await fetch(url, { redirect: 'follow' });
+  const res = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30000) });
   if (!res.ok) throw new Error(`GET ${url}: HTTP ${res.status}`);
   return Buffer.from(await res.arrayBuffer());
 }
@@ -49,7 +50,8 @@ function place(src, dest) {
     fs.renameSync(tmp, dest);
   } catch (e) {
     fs.rmSync(tmp, { force: true });
-    if (!fs.existsSync(dest)) throw e; // another process put it there first
+    // Only forgive an actual identical concurrent install, not an old binary left behind by a permission/rename error.
+    if (!fs.existsSync(dest) || !fs.readFileSync(src).equals(fs.readFileSync(dest))) throw e;
   }
 }
 
@@ -62,13 +64,18 @@ async function install(log = (m) => process.stderr.write(`${m}\n`)) {
     log(`probbit: using ${src} (PROBBIT_BINARY)`);
     return dest;
   }
-  const target = env.PROBBIT_TARGET || TARGETS[`${process.platform}-${process.arch}`];
+  const glibc = process.platform === 'linux' && process.report && process.report.getReport().header.glibcVersionRuntime;
+  const detected = process.platform === 'linux' && process.arch === 'x64' && !glibc
+    ? 'x86_64-unknown-linux-musl' : TARGETS[`${process.platform}-${process.arch}`];
+  const target = env.PROBBIT_TARGET || detected;
   if (!target) {
     throw new Error(`no prebuilt probbit for ${process.platform}-${process.arch}; build one (cargo build --release -p probbit-cli) `
       + 'and reinstall with PROBBIT_BINARY=/path/to/probbit');
   }
   let tag = env.PROBBIT_VERSION || `v${pkg.version}`;
   if (!tag.startsWith('v')) tag = `v${tag}`;
+  if (!/^v[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(tag)) throw new Error(`invalid release version: ${tag}`);
+  if (!/^[A-Za-z0-9_-]+$/.test(target)) throw new Error(`invalid target: ${target}`);
   const base = (env.PROBBIT_DOWNLOAD_BASE || `https://github.com/${REPO}/releases/download`).replace(/\/+$/, '');
   const zip = target.includes('windows');
   const name = `probbit-${tag}-${target}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "probbit",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "probbit, a virtual p-bit processor for joint decisions under hard rules: installs the prebuilt probbit CLI (JSON in, JSON out).",
   "license": "Apache-2.0",
   "repository": {