GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #974

Summary

On Alpine/musl, a yarn classic install of @socketsecurity/socket-patch puts both the -gnu and -musl platform packages in node_modules, because yarn 1 ignores libc. The npm wrapper always ran the -gnu binary, which can't start on musl, and then exited 1 with no output. With this fix the wrapper runs the binary that works on the host, and it reports any spawn failure instead of exiting silently.

Root cause

npm/socket-patch/bin/socket-patch picked the first platform package that require.resolved. On Linux that is always -gnu before -musl, and the wrapper never checked libc. It also ignored result.error: when the spawn failed (ENOENT, because the glibc ELF interpreter is missing), it ran process.exit(result.status ?? 1) without printing anything.

Fix

• detectLibc(): returns glibc when Node's runtime report has glibcVersionRuntime. Otherwise it returns musl when /lib/ld-musl-* exists, which is the same probe scripts/install.sh uses. The runtime report is checked first so that a glibc host that also has the musl loader installed (Debian musl package) keeps using -gnu.
• orderCandidates(): on musl, the -musl package goes first. On glibc or an unknown libc the order stays as before.
• runFirstUsable(): when a spawn fails with ENOENT/EACCES/ENOEXEC, the wrapper tries the next installed candidate. If none can run, it prints socket-patch: failed to run <bin>: <error> and exits 1.
• The CLI now runs only when the file is executed directly (require.main === module). When the file is required it exports the helpers, so the tests can call them. The PLATFORMS table is unchanged.

The Python and gem distributions have no equivalent multi-candidate wrapper in this repo, so nothing parallel needed changing.

Ported main CI fix

162befe cherry-picks #878 (Route Gradle digests through utils::digest). Without it, utils::digest::tests::production_digests_go_through_the_helpers fails coverage/test on every PR against current main. It touches no wrapper code, and it becomes a no-op once #878 merges.

Test evidence

node --test npm/socket-patch/bin/socket-patch.test.mjs

• Before the fix: the new suite fails (# pass 0, # fail 1). Requiring the wrapper ran the CLI, and the new helpers didn't exist.
• After the fix: # pass 20, # fail 0.

Regression tests for #974:

• musl is detected when the runtime reports no glibc. glibc wins even when a musl loader is also present. Off Linux the result is null.
• On a musl host the -musl package comes first for linux x64, arm64, arm and ia32. On glibc, -gnu stays first.
• The wrapper falls back to the next binary when the first can't be spawned.
• A spawn failure prints the binary path and the error. It no longer exits silently.
• End to end: a yarn-classic-style node_modules holds both packages, and the gnu binary can't start (missing ELF interpreter, so spawn gives ENOENT, the same failure a glibc binary hits on musl). The wrapper exits 0 and runs the musl binary.

Manual checks:

• On the same layout, the main wrapper exits 1 with no output, and the fixed wrapper prints musl-binary --version and exits 0. When only an unrunnable -gnu is installed, it now prints socket-patch: failed to run …/socket-patch-linux-x64-gnu/socket-patch: spawnSync … ENOENT.
• With the real published @socketsecurity/socket-patch-linux-x64-{gnu,musl}@4.0.0 installed side by side on a glibc host, the fixed wrapper prints socket-patch 4.0.0 and exits 0. A real Alpine container couldn't be run here (no Docker daemon in the sandbox).

Rust (local):

• cargo test -p socket-patch-core --lib production_digests_go_through_the_helpers fails on 26aad6f and passes on 162befe.
• The full cargo test -p socket-patch-core --lib run gives 5246 passed and 4 failed. All 4 are permission-denial tests that can't trigger when running as root, which this sandbox does (uid 0); CI runs as non-root.
• Local cargo fmt --check reports diffs only in files this PR doesn't touch, from a local rustfmt version mismatch. CI's fmt check is the authority.

🤖 Generated with Claude Code

Generated by Claude Code