golem15/msd-core
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(#2775): verify gsd-sdk on PATH before reporting SDK ready (#2777)

Browse Source 
* fix(#2775): verify gsd-sdk on PATH before reporting SDK ready

`npx get-shit-done-cc@latest` printed `✓ GSD SDK ready` even though
`gsd-sdk` was not callable. Root cause: npx only links the package's
primary bin (`get-shit-done-cc`); secondary bins like `gsd-sdk` are not
materialized into a PATH directory. The installer asserted the weaker
invariant "sdk/dist/cli.js exists on disk" and treated it as proof of
the stronger invariant "command -v gsd-sdk resolves" — they aren't the
same.

Fix tightens the gate in installSdkIfNeeded:

  1. After confirming the dist is present, walk PATH for an executable
     `gsd-sdk` shim (isGsdSdkOnPath, no spawn).
  2. If absent, attempt to materialize the shim via symlink at
     `~/.local/bin/gsd-sdk` (or the first HOME-rooted PATH dir we can
     write to), falling back to a copy on filesystems that reject
     symlinks (trySelfLinkGsdSdk).
  3. Re-probe PATH after linking. Only print `✓ GSD SDK ready` when the
     probe succeeds; otherwise emit a clear ⚠ + remediation.

Also strips the misleading "or `npx get-shit-done-cc`" clause from the
shim header (it never linked the secondary bin).

Closes #2775

* test(#2775): use centralized helpers from helpers.cjs per CONTRIBUTING

* fix(#2775): wrapper script in symlink fallback to preserve __dirname resolution

CodeRabbit follow-up on PR #2777. The previous symlink-fallback in
trySelfLinkGsdSdk used fs.copyFileSync(shimSrc, target), but
bin/gsd-sdk.js resolves the CLI via path.resolve(__dirname, '..',
'sdk', 'dist', 'cli.js'). After a copy, __dirname becomes the link
directory (e.g. ~/.local/bin), so the resolved CLI path was broken
(~/.local/sdk/dist/cli.js) — and isGsdSdkOnPath() only checked file
existence + execute bit, so the success line still printed over a
broken install.

Replace the copy with a tiny wrapper script that require()s the real
shim by absolute path. This preserves __dirname inside bin/gsd-sdk.js
because the require runs against shimSrc's own location.

Also fixes the PATH restoration nit in the regression test (was
coercing undefined to the string "undefined" if PATH was unset).

Adds a behavioral fallback test that mocks fs.symlinkSync to throw,
exercises the fallback path, and asserts the resulting target is a
require()-wrapper (not a verbatim copy) and is executable.

* fix(#2775): PATH-backed dir ordering + tighten captureConsole + drop tautological assertion (CodeRabbit follow-up)
This commit is contained in:
Tom Boucher
2026-04-27 12:31:21 -04:00
committed by GitHub
parent 290c8b2909
commit 6a293cfc2a
3 changed files with 380 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
bin/gsd-sdk.js
View File

@@ -2,11 +2,16 @@
/**
* bin/gsd-sdk.js — back-compat shim for external callers of `gsd-sdk`.
*
* When the parent package is installed globally (`npm install -g get-shit-done-cc`
* or `npx get-shit-done-cc`), npm creates a `gsd-sdk` symlink in the global bin
* directory pointing at this file. npm correctly chmods bin entries from a tarball,
* so the execute-bit problem that afflicted the sub-install approach (issue #2453)
* cannot occur here.
* When the parent package is installed globally (`npm install -g get-shit-done-cc`)
* npm creates a `gsd-sdk` symlink in the global bin directory pointing at this
* file. npm correctly chmods bin entries from a tarball, so the execute-bit
* problem that afflicted the sub-install approach (issue #2453) cannot occur here.
*
* NOTE (#2775): `npx get-shit-done-cc` does NOT link this shim — npx only
* exposes the package's primary bin (`get-shit-done-cc`). For npx-based usage,
* the installer (`bin/install.js#installSdkIfNeeded`) self-symlinks `gsd-sdk`
* into `~/.local/bin` when needed and verifies PATH callability before
* reporting `✓ GSD SDK ready`.
*
* This shim resolves sdk/dist/cli.js relative to its own location and delegates
* to it via `node`, so `gsd-sdk <args>` behaves identically to

140
bin/install.js
View File

@@ -7427,14 +7427,49 @@ function installSdkIfNeeded(opts) {
// `node sdkCliPath` invocation in bin/gsd-sdk.js.
}
console.log(` ${green}✓${reset} GSD SDK ready (sdk/dist/cli.js)`);
// #2775: do not assert "GSD SDK ready" until `gsd-sdk` actually resolves on
// PATH. `npx get-shit-done-cc` only links the package's primary bin; the
// secondary `gsd-sdk` shim is left dangling under the npx cache and is NOT
// callable as a bare command. The previous file-presence-only check was a
// strictly weaker invariant than the one workflows depend on
// (`command -v gsd-sdk` resolving), and led to a false ✓ in npx-cache
// installs (issue #2775).
const shimSrc = path.resolve(__dirname, 'gsd-sdk.js');
let onPath = isGsdSdkOnPath();
if (!onPath) {
// Try to materialize the shim into a user-writable PATH location so the
// installer can deliver on the success message without requiring the user
// to run `npm install -g` separately. Picks the first PATH entry that
// looks like a user-owned bin dir; falls back to ~/.local/bin even if
// it's not on PATH (then a follow-up suggestion is printed).
const linked = trySelfLinkGsdSdk(shimSrc);
if (linked) {
onPath = isGsdSdkOnPath();
if (onPath) {
console.log(` ${dim}↪ linked gsd-sdk → ${linked}${reset}`);
}
}
}
if (onPath) {
console.log(` ${green}✓${reset} GSD SDK ready (sdk/dist/cli.js)`);
} else {
console.log('');
console.log(` ${yellow}⚠${reset} GSD SDK files are present but ${bold}gsd-sdk${reset} is not on your PATH.`);
console.log(` Workflows that call ${cyan}gsd-sdk query …${reset} will fail with "command not found".`);
console.log(` Install globally to materialize the bin symlink:`);
console.log(` ${cyan}npm install -g get-shit-done-cc${reset}`);
console.log(` Or add a directory containing the shim to your PATH manually.`);
console.log('');
}
// #2620: warn if npm's global bin is not on PATH, suppressing the
// absolute-path suggestion when the user's rc already covers it via
// a HOME-relative entry (e.g. `export PATH="$HOME/.npm-global/bin:$PATH"`).
try {
const { execSync } = require('child_process');
const npmPrefix = execSync('npm prefix -g', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
const cp = require('child_process');
const npmPrefix = cp.execSync('npm prefix -g', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
if (npmPrefix) {
// On Windows npm prefix IS the bin dir; on POSIX it's `${prefix}/bin`.
const globalBin = process.platform === 'win32' ? npmPrefix : path.join(npmPrefix, 'bin');
@@ -7445,6 +7480,105 @@ function installSdkIfNeeded(opts) {
}
}
/**
* #2775 helper: check whether a callable `gsd-sdk` exists on the current PATH.
*
* Pure PATH walk (no spawn) — we look for a regular file or symlink named
* `gsd-sdk` (or `gsd-sdk.cmd`/`.exe` on Windows) in any directory on PATH and
* verify it carries the execute bit on POSIX. Avoids paying spawn cost and
* avoids the chicken-and-egg of needing to run the not-yet-installed binary.
*/
function isGsdSdkOnPath() {
const path = require('path');
const fs = require('fs');
const pathEnv = process.env.PATH || '';
const exts = process.platform === 'win32' ? ['.cmd', '.exe', '.bat', ''] : [''];
for (const seg of pathEnv.split(path.delimiter)) {
if (!seg) continue;
for (const ext of exts) {
const candidate = path.join(seg, `gsd-sdk${ext}`);
try {
const st = fs.statSync(candidate);
if (st.isFile()) {
if (process.platform === 'win32') return true;
if ((st.mode & 0o111) !== 0) return true;
}
} catch {
// missing / EACCES on dir — keep scanning.
}
}
}
return false;
}
/**
* #2775 helper: attempt to materialize the `gsd-sdk` shim at a user-writable
* PATH location. Returns the absolute path created on success, or null if no
* suitable location was usable.
*
* Strategy (POSIX): prefer ~/.local/bin (creating it if absent — many distros
* already have it on PATH via .profile). Fall back to the first PATH entry
* under HOME we can write to. Skip on Windows (npm install -g is the right
* primitive there; we don't try to fabricate a .cmd shim).
*/
function trySelfLinkGsdSdk(shimSrc) {
if (process.platform === 'win32') return null;
const path = require('path');
const fs = require('fs');
const home = os.homedir();
if (!home) return null;
const localBin = path.join(home, '.local', 'bin');
const pathCandidates = [];
const pathEnv = process.env.PATH || '';
for (const seg of pathEnv.split(path.delimiter)) {
if (!seg) continue;
const abs = path.resolve(seg);
if (abs.startsWith(home + path.sep) && !pathCandidates.includes(abs)) {
pathCandidates.push(abs);
}
}
// If ~/.local/bin is already on PATH, keep it first (preserves existing UX
// for the common case). Otherwise prefer PATH-backed HOME dirs first so we
// self-link somewhere actually on PATH, falling back to ~/.local/bin only
// when no on-PATH HOME dir is writable. (#2775 CodeRabbit follow-up)
const candidates = pathCandidates.includes(localBin)
? [localBin, ...pathCandidates.filter((dir) => dir !== localBin)]
: [...pathCandidates, localBin];
for (const dir of candidates) {
try {
fs.mkdirSync(dir, { recursive: true });
const target = path.join(dir, 'gsd-sdk');
// Replace any existing entry — it may be stale (prior install of an
// older version pointing at a now-absent shim).
try { fs.unlinkSync(target); } catch {}
try {
fs.symlinkSync(shimSrc, target);
} catch {
// Filesystems that don't support symlinks (some FUSE mounts): write a
// tiny wrapper that `require()`s the real shim by absolute path. We
// cannot copyFileSync(shimSrc, target) — bin/gsd-sdk.js resolves the
// CLI via `path.resolve(__dirname, '..', 'sdk', 'dist', 'cli.js')`,
// and after a copy `__dirname` would be the link directory (e.g.
// ~/.local/bin), causing the resolved CLI path to be broken
// (~/.local/sdk/dist/cli.js). Wrapping via require() preserves
// __dirname resolution because the require runs against shimSrc's
// own location. (#2775 CodeRabbit follow-up)
fs.writeFileSync(
target,
`#!/usr/bin/env node\nrequire(${JSON.stringify(shimSrc)});\n`,
);
try { fs.chmodSync(target, 0o755); } catch {}
}
return target;
} catch {
// permission / EROFS — try next candidate.
}
}
return null;
}
/**
* Install GSD for all selected runtimes
*/