0xrsydn/idx-cli
1
mirror of https://github.com/0xrsydn/idx-cli.git synced 2026-11-07 09:45:36 +00:00
Code Issues Projects Releases 1 Packages Wiki Activity

fix(npm): no cache fallback without an absolute home directory

Browse source 
The release-gate Codex review found the relative-path fix incomplete:
with XDG_CACHE_HOME unset and HOME empty or relative, the fallback was
`.cache/...` under the current directory, so a checkout could plant the
binary the launcher runs. Use the home cache only when the home path is
absolute; otherwise the package's bin/ is the only location. npm smoke
plants such a binary and checks it is never run (it was, before this).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh
This commit is contained in:
hermes 2026-10-16 09:47:51 +00:00
commit d2cd7115f1
3 changed files with 44 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

47
scripts/install.js
View file

@ -23,22 +23,37 @@ const binaryName = process.platform === "win32" ? `${nativeBinary}.exe` : native
// (a root-owned global install whose postinstall npm 12 skipped), in a
// per-user cache. scripts/idx.js looks in both, in this order.
const packageBinaryPath = path.join(packageRoot, "bin", binaryName);
// A relative XDG_CACHE_HOME is invalid per the XDG spec, and would make the
// launcher run a binary from the current directory: ignore it.
const xdgCacheHome = process.env.XDG_CACHE_HOME;
const cacheBinaryPath = path.join(
xdgCacheHome && path.isAbsolute(xdgCacheHome)
? xdgCacheHome
: process.platform === "darwin"
? path.join(os.homedir(), "Library", "Caches")
: path.join(os.homedir(), ".cache"),
packageName,
packageManifest.version,
// A home directory shared across machines must not mix architectures.
`${process.platform}-${process.arch}`,
binaryName,
);
const binaryLocations = [packageBinaryPath, cacheBinaryPath];
// The cache root must be absolute: a relative one (an XDG_CACHE_HOME that the
// XDG spec calls invalid, or an empty or relative HOME) would make the
// launcher run a binary from the current directory. Without one there is no
// cache fallback.
function cacheRoot() {
const xdgCacheHome = process.env.XDG_CACHE_HOME;
if (xdgCacheHome && path.isAbsolute(xdgCacheHome)) {
return xdgCacheHome;
}
const home = os.homedir();
if (!home || !path.isAbsolute(home)) {
return null;
}
return process.platform === "darwin"
? path.join(home, "Library", "Caches")
: path.join(home, ".cache");
}
const cacheDirectory = cacheRoot();
const binaryLocations = [packageBinaryPath];
if (cacheDirectory) {
binaryLocations.push(
path.join(
cacheDirectory,
packageName,
packageManifest.version,
// A home directory shared across machines must not mix architectures.
`${process.platform}-${process.arch}`,
binaryName,
),
);
}
let binaryPath = packageBinaryPath;
const githubRepository = "0xrsydn/idx-cli";
const maxRedirects = 5;