0xrsydn/idx-cli
1
mirror of https://github.com/0xrsydn/idx-cli.git synced 2026-11-07 09:45:36 +00:00
Code Issues Projects Releases 1 Packages Wiki Activity

fix(npm): no cache fallback without an absolute home directory

Browse source 
The release-gate Codex review found the relative-path fix incomplete:
with XDG_CACHE_HOME unset and HOME empty or relative, the fallback was
`.cache/...` under the current directory, so a checkout could plant the
binary the launcher runs. Use the home cache only when the home path is
absolute; otherwise the package's bin/ is the only location. npm smoke
plants such a binary and checks it is never run (it was, before this).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh
This commit is contained in:
hermes 2026-10-16 09:47:51 +00:00
commit d2cd7115f1
3 changed files with 44 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/NPM_DISTRIBUTION.md
View file

@ -56,7 +56,8 @@ The binary goes in the package's `bin/`, or, when that is not writable (a
root-owned `sudo npm install -g` whose postinstall npm 12 skipped), in a
per-user cache: `$XDG_CACHE_HOME` (if absolute), else `~/.cache`
(`~/Library/Caches` on macOS), under `<package>/<version>/<platform>-<arch>/`.
The launcher looks in both. A
The launcher looks in both. With no absolute cache root (an empty or relative
`HOME`) there is no fallback, so nothing under the current directory is run. A
termination signal during that first-run download stops the installer too,
and it removes its partial file.