riciplay 1.8.95 → 1.9.0

package/bin/riciplay

@@ -5,17 +5,85 @@
 //                       python3 -c "from riciplay_cli.main import app; app()"
 //
 // The Python package is installed by scripts/postinstall.js (pip install
-// riciplay-cli). When the pip console script exists on PATH, exec it
-// directly (identical behavior to a native install); otherwise invoke
-// the app entry through python3 with argv[0] normalized so the CLI's
-// own help/version output stays correct.
+// riciplay-cli). The real console script is resolved through PATH — the same
+// resolution the OS/shell performs — so a venv/pipx install
+// (<venv>/bin/riciplay) is found instead of silently falling back to the
+// system python3. Crucially, this wrapper's own file is explicitly excluded
+// as a candidate: an npm global install puts a symlink to this very script on
+// PATH (/usr/local/bin/riciplay), and matching it re-executed the wrapper
+// forever. Only when no other candidate exists do we fall back to
+// `python3 -m`, which is exactly the case the wrapper must never feed itself.
 
 const { spawn } = require('child_process');
-const { existsSync } = require('fs');
+const fs = require('fs');
 const path = require('path');
 const { EOL } = require('os');
 
-const args = process.argv.slice(2);
+function realpathSafe(p) {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+/**
+ * Filesystem identities of this wrapper, so it can never be selected as its
+ * own target. Both the symlinked invoke path (process.argv[1]) and the real
+ * module path (__filename) are registered: npm's global bin is a symlink to
+ * the latter, while a plain copy would match the former.
+ */
+function selfIdentities({ filename, argv1 }) {
+  const ids = new Set();
+  if (filename) {
+    ids.add(realpathSafe(filename));
+    ids.add(path.resolve(filename));
+  }
+  if (argv1) {
+    ids.add(realpathSafe(argv1));
+    ids.add(path.resolve(argv1));
+  }
+  return ids;
+}
+
+/**
+ * Resolve the installed `riciplay` console script via PATH.
+ *
+ * Returns the candidate path, or null when the only match on PATH is this
+ * wrapper itself (in which case the caller falls back to `python3 -m`).
+ */
+function resolveConsoleScript(options = {}) {
+  const platform = options.platform || process.platform;
+  const env = options.env || process.env;
+  const filename = options.filename || __filename;
+  const argv1 = 'argv1' in options ? options.argv1 : process.argv[1];
+  const isWin = platform === 'win32';
+
+  // Windows: pip installs `riciplay.exe`. npm's own shim is a .cmd/.ps1, so
+  // searching for the .exe cannot accidentally match the npm shim.
+  const name = isWin ? 'riciplay.exe' : 'riciplay';
+  const pathEnv = env.PATH || env.Path || '';
+  const sep = isWin ? ';' : ':';
+  const own = selfIdentities({ filename, argv1 });
+
+  for (const dir of pathEnv.split(sep)) {
+    if (!dir) continue;
+    const candidate = path.join(dir, name);
+    let st;
+    try {
+      st = fs.statSync(candidate); // follows symlinks
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    // Never re-exec this wrapper — by realpath (npm symlink) or by literal
+    // path (copied install).
+    if (own.has(realpathSafe(candidate)) || own.has(path.resolve(candidate))) continue;
+    if (!isWin && (st.mode & 0o111) === 0) continue; // not executable
+    return candidate;
+  }
+  return null;
+}
 
 function fail(msg) {
   process.stderr.write(`Error: ${msg}${EOL}`);
@@ -30,21 +98,25 @@ function run(cmd, argv) {
   proc.on('close', (code) => process.exit(code ?? 1));
 }
 
-// Prefer an installed console script (same PATH resolution pip used).
-const isWin = process.platform === 'win32';
-const exe = isWin ? 'riciplay.exe' : 'riciplay';
-for (const dir of ['/usr/local/bin', '/usr/bin', path.join(process.env.HOME || '', '.local', 'bin')]) {
-  const candidate = path.join(dir, exe);
-  if (existsSync(candidate)) {
-    run(candidate, args);
+function main(argv = process.argv.slice(2)) {
+  // Prefer an installed console script (same PATH resolution the OS used).
+  const candidate = resolveConsoleScript();
+  if (candidate) {
+    run(candidate, argv);
     return;
   }
+
+  // Module fallback — app() reads sys.argv; normalize argv[0] so usage
+  // strings and version output match the real console script.
+  run('python3', [
+    '-c',
+    "import sys; sys.argv[0] = 'riciplay'; from riciplay_cli.main import app; app()",
+    ...argv,
+  ]);
+}
+
+if (require.main === module) {
+  main();
 }
 
-// Module fallback — app() reads sys.argv; normalize argv[0] so usage
-// strings and version output match the real console script.
-run('python3', [
-  '-c',
-  "import sys; sys.argv[0] = 'riciplay'; from riciplay_cli.main import app; app()",
-  ...args,
-]);
+module.exports = { resolveConsoleScript, selfIdentities, main };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "riciplay",
-  "version": "1.8.95",
-  "description": "AI-powered bug bounty reconnaissance and penetration testing agent — browser, proxy interception, recon, and exploit workflows",
+  "version": "1.9.0",
+  "description": "AI-powered bug bounty reconnaissance and penetration testing agent \u2014 browser, proxy interception, recon, and exploit workflows",
   "main": "index.js",
   "bin": {
     "riciplay": "./bin/riciplay"