fix: validate native bindings and preserve installer overrides

Author: fengmk2

.github/workflows/test.yml

@@ -156,6 +156,45 @@ jobs:
           fi
           exit "$failed"
 
+  test-reuse-installation-integrity:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    env:
+      VP_PR_VERSION: ""
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+
+      - name: Prepare an isolated global installation and project
+        run: node test/reuse-installation-integrity.mjs prepare
+
+      - name: Install Vite+
+        uses: ./
+        with:
+          version: "0.3.3"
+          run-install: false
+          cache: false
+
+      - name: Remove the active native binding and reproduce the CLI failure
+        run: node test/reuse-installation-integrity.mjs remove-binding
+
+      - name: Repair the incomplete installation
+        uses: ./
+        with:
+          version: "0.3.3"
+          run-install: false
+          cache: false
+
+      - name: Check that JavaScript CLI commands work again
+        run: node test/reuse-installation-integrity.mjs verify-repair
+
+      - name: Check combined and per-manager installer overrides on an existing installation
+        if: runner.os == 'Linux'
+        run: node test/reuse-installation-integrity.mjs manager-overrides
+
   test-reuse-restored-prepare:
     runs-on: ubuntu-latest
     timeout-minutes: 10

dist/index.mjs

@@ -14,6 +14,7 @@ let data: string;
 let bin: string;
 let config: string;
 let versionDir: string;
+let nativeFile: string;
 let version: string;
 let env: NodeJS.ProcessEnv;
 let platform: NodeJS.Platform;
@@ -63,6 +64,9 @@ function createInstallation({
     }),
   );
   write(join(packageDir, "dist", "bin.js"));
+  write(join(packageDir, "binding", "index.cjs"));
+  nativeFile = join(packageDir, "..", "@voidzero-dev", "vite-plus-native", "vite-plus.node");
+  write(nativeFile);
   write(
     join(packageDir, "..", "fixture-dep", "package.json"),
     '{"name":"fixture-dep","version":"1.0.0"}',
@@ -95,11 +99,12 @@ beforeEach(() => {
   env = { VP_HOME: data, HOME: join(root, "home"), USERPROFILE: join(root, "home") };
   platform = process.platform;
   version = "0.3.0";
-  vi.mocked(execFileSync).mockImplementation((_file, args) =>
-    (args as string[]).includes("--version")
+  vi.mocked(execFileSync).mockImplementation((file, args) => {
+    if (file === process.execPath) return JSON.stringify([nativeFile]);
+    return (args as string[]).includes("--version")
       ? `vp v${version}\nLocal vite-plus v9.9.9\n`
-      : dirsOutput(),
-  );
+      : dirsOutput();
+  });
 });
 
 afterEach(() => {
@@ -225,6 +230,7 @@ describe("findReusableVitePlus", () => {
     "package.json",
     "node_modules/vite-plus/package.json",
     "node_modules/vite-plus/dist/bin.js",
+    "node_modules/vite-plus/binding/index.cjs",
     "node_modules/.pnpm/vite-plus@0.3.0/node_modules/fixture-dep/package.json",
   ])("falls back when %s is missing", (file) => {
     createInstallation();
@@ -245,6 +251,59 @@ describe("findReusableVitePlus", () => {
     expect(reuse()).toBeUndefined();
   });
 
+  it.each(["package", "file"])(
+    "falls back when the loaded native binding %s is missing",
+    (target) => {
+      createInstallation();
+      rmSync(target === "package" ? dirname(nativeFile) : nativeFile, { recursive: true });
+      expect(reuse()).toBeUndefined();
+    },
+  );
+
+  it("probes the installed binding loader with the action's Node runtime", () => {
+    createInstallation();
+    expect(reuse()).toBe(bin);
+    expect(execFileSync).toHaveBeenCalledWith(
+      process.execPath,
+      ["--input-type=commonjs", "--eval", expect.any(String), expect.stringContaining("index.cjs")],
+      expect.objectContaining({
+        env: { ...env, NAPI_RS_ENFORCE_VERSION_CHECK: "1" },
+        cwd: tmpdir(),
+        timeout: 5000,
+      }),
+    );
+  });
+
+  it("falls back when the native loader fails", () => {
+    createInstallation();
+    vi.mocked(execFileSync)
+      .mockReturnValueOnce(dirsOutput())
+      .mockReturnValueOnce(`vp v${version}`)
+      .mockImplementationOnce(() => {
+        throw new Error("Cannot find native binding");
+      });
+    expect(reuse()).toBeUndefined();
+  });
+
+  it.each(["[]", "null", "invalid JSON"])(
+    "rejects a native probe without binding files: %s",
+    (output) => {
+      createInstallation();
+      vi.mocked(execFileSync)
+        .mockReturnValueOnce(dirsOutput())
+        .mockReturnValueOnce(`vp v${version}`)
+        .mockReturnValueOnce(output);
+      expect(reuse()).toBeUndefined();
+    },
+  );
+
+  it("does not accept a native binding from outside the active installation", () => {
+    createInstallation();
+    nativeFile = join(root, "other-installation", "vite-plus.node");
+    write(nativeFile);
+    expect(reuse()).toBeUndefined();
+  });
+
   it.each(["{", '{"name":"vp-global","version":"0.3.1","dependencies":{"vite-plus":"0.3.0"}}'])(
     "rejects invalid or mismatched wrapper metadata",
     (content) => {
@@ -323,11 +382,26 @@ describe("findReusableVitePlus", () => {
     expect(reuse()).toBe(bin);
   });
 
-  it.each(["no", "invalid"])("does not bypass VP_NODE_MANAGER=%s", (value) => {
-    createInstallation();
-    env.VP_NODE_MANAGER = value;
-    expect(reuse()).toBeUndefined();
-    expect(execFileSync).not.toHaveBeenCalled();
+  describe.each([
+    "VP_NODE_MANAGER",
+    "VP_PM_MANAGER",
+    "VP_NPM_MANAGER",
+    "VP_PNPM_MANAGER",
+    "VP_YARN_MANAGER",
+    "VP_BUN_MANAGER",
+  ])("%s installer override", (key) => {
+    it.each(["no", "invalid"])("leaves %s to the installer", (value) => {
+      createInstallation();
+      env[key] = value;
+      expect(reuse()).toBeUndefined();
+      expect(execFileSync).not.toHaveBeenCalled();
+    });
+
+    it.each(["yes", ""])("reuses managed installations for %s", (value) => {
+      createInstallation();
+      env[key] = value;
+      expect(reuse()).toBe(bin);
+    });
   });
 
   it("falls back when a required shim is missing", () => {

src/reuse-viteplus.test.ts

@@ -14,6 +14,14 @@ import type { VitePlusBinDirs, VitePlusDirs } from "./ci/vp-dirs.js";
 const EXACT_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 const COMMON_SHIMS = ["vp", "node", "npm", "npx", "vpx", "vpr"];
 const PACKAGE_MANAGER_SHIMS = ["pnpm", "pnpx", "yarn", "yarnpkg", "bun", "bunx"];
+const MANAGER_OVERRIDES = [
+  "VP_NODE_MANAGER",
+  "VP_PM_MANAGER",
+  "VP_NPM_MANAGER",
+  "VP_PNPM_MANAGER",
+  "VP_YARN_MANAGER",
+  "VP_BUN_MANAGER",
+];
 
 interface PackageJson {
   name?: string;
@@ -42,7 +50,7 @@ export function findReusableVitePlus(
     env.VP_LOCAL_TGZ ||
     env.VP_LOCAL_BINARY ||
     env.VP_SKIP_DEPS_INSTALL ||
-    (env.VP_NODE_MANAGER && env.VP_NODE_MANAGER !== "yes") ||
+    MANAGER_OVERRIDES.some((key) => env[key] && env[key] !== "yes") ||
     !hasValidDirOverrides(env)
   ) {
     return undefined;
@@ -81,6 +89,7 @@ export function findReusableVitePlus(
       if (parseInstalledVpVersion(versionOutput) !== version) continue;
       if (!hasManagedEnvironment(dirs.config, platform)) continue;
       if (!hasValidShims(dirs, binary, platform, layout, versionOutput)) continue;
+      if (!hasNativeBinding(versionDir, options)) continue;
 
       return getVitePlusBinDirs(dirs);
     } catch (error) {
@@ -148,6 +157,38 @@ function isInside(parent: string, child: string): boolean {
   return path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path);
 }
 
+function hasNativeBinding(
+  versionDir: string,
+  options: ExecFileSyncOptionsWithStringEncoding,
+): boolean {
+  const loader = realpathSync(
+    join(versionDir, "node_modules", "vite-plus", "binding", "index.cjs"),
+  );
+  if (!isInside(versionDir, loader) || !statSync(loader).isFile()) return false;
+
+  // Let the installed loader select the platform, architecture, and libc.
+  // A child process isolates native load failures from the action runtime.
+  const script = `
+require(process.argv[1]);
+process.stdout.write(JSON.stringify(Object.keys(require.cache).filter(file => file.endsWith('.node'))));
+`;
+  const files: unknown = JSON.parse(
+    execFileSync(process.execPath, ["--input-type=commonjs", "--eval", script, loader], {
+      ...options,
+      env: { ...options.env, NAPI_RS_ENFORCE_VERSION_CHECK: "1" },
+    }),
+  );
+  // A binding from another installation must not hide a damaged active one.
+  return (
+    Array.isArray(files) &&
+    files.length > 0 &&
+    files.every(
+      (file) =>
+        typeof file === "string" && isAbsolute(file) && isInside(versionDir, realpathSync(file)),
+    )
+  );
+}
+
 function hasManagedEnvironment(configDir: string, platform: NodeJS.Platform): boolean {
   const configFile = join(configDir, "config.json");
   const config = existsSync(configFile)

src/reuse-viteplus.ts

@@ -0,0 +1,101 @@
+import assert from "node:assert/strict";
+import { execFileSync, spawnSync } from "node:child_process";
+import { appendFileSync, mkdirSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(process.env.RUNNER_TEMP, "setup-vp-reuse-integrity");
+const project = join(root, "project");
+const home = join(root, "installation");
+const vp = join(home, "bin", process.platform === "win32" ? "vp.exe" : "vp");
+const bundle = fileURLToPath(new URL("../dist/index.mjs", import.meta.url));
+const managers = ["npm", "pnpm", "yarn", "bun"];
+const overrides = ["VP_PM_MANAGER", ...managers.map((name) => `VP_${name.toUpperCase()}_MANAGER`)];
+
+function runVp(args) {
+  return execFileSync(vp, args, { cwd: project, encoding: "utf8" });
+}
+
+switch (process.argv[2]) {
+  case "prepare": {
+    mkdirSync(project, { recursive: true });
+    writeFileSync(join(project, "package.json"), '{"private":true}');
+    writeFileSync(join(project, "review.js"), "console.log('binding works');\n");
+    appendFileSync(process.env.GITHUB_ENV, `VP_HOME=${home}\n`);
+    break;
+  }
+
+  case "remove-binding": {
+    runVp(["lint", "review.js"]);
+    const packageDir = realpathSync(join(home, "current", "node_modules", "vite-plus"));
+    // Load in a child so Windows releases the native library before we move it.
+    const files = JSON.parse(
+      execFileSync(
+        process.execPath,
+        [
+          "--input-type=commonjs",
+          "--eval",
+          "require(process.argv[1]); console.log(JSON.stringify(Object.keys(require.cache).filter(file => file.endsWith('.node'))));",
+          join(packageDir, "binding", "index.cjs"),
+        ],
+        { cwd: project, encoding: "utf8" },
+      ),
+    );
+    const nativeFile = files.find((file) => file.includes("vite-plus"));
+    assert.ok(nativeFile, "The global CLI must load its native binding");
+    // Moving a single pnpm link is insufficient: another link can still resolve it.
+    renameSync(dirname(realpathSync(nativeFile)), join(root, "removed-native-package"));
+    runVp(["--version"]);
+    const broken = spawnSync(vp, ["lint", "review.js"], { cwd: project, encoding: "utf8" });
+    assert.notEqual(broken.status, 0);
+    assert.match(broken.stderr, /Cannot find native binding/);
+    console.log("Native version probe succeeds, but the JavaScript CLI has a missing binding.");
+    break;
+  }
+
+  case "verify-repair": {
+    runVp(["lint", "review.js"]);
+    console.log("The action repaired the missing native binding.");
+    break;
+  }
+
+  case "manager-overrides": {
+    for (const override of overrides) {
+      runVp(["env", "on"]);
+      const env = {
+        ...process.env,
+        INPUT_VERSION: "0.3.3",
+        "INPUT_RUN-INSTALL": "false",
+        INPUT_CACHE: "false",
+        "INPUT_CACHE-SAVE": "false",
+        INPUT_SFW: "false",
+      };
+      for (const key of overrides) delete env[key];
+      env[override] = "no";
+      const output = execFileSync(process.execPath, [bundle], {
+        cwd: project,
+        env,
+        encoding: "utf8",
+        timeout: 180_000,
+      });
+      assert.doesNotMatch(output, /Reusing Vite\+/);
+      for (const manager of managers) {
+        const { package_manager: current } = JSON.parse(
+          runVp(["env", "current", manager, "--json"]),
+        );
+        const disabled =
+          override === "VP_PM_MANAGER" || override === `VP_${manager.toUpperCase()}_MANAGER`;
+        assert.equal(
+          current.mode,
+          disabled ? "system_first" : "managed",
+          `${override}: ${manager}`,
+        );
+      }
+      console.log(`${override}=no applies the installer package-manager settings.`);
+    }
+    break;
+  }
+
+  default:
+    throw new Error(`Unknown integrity check: ${process.argv[2]}`);
+}