make node shim set ELECTRON_RUN_AS_NODE itself

Author: charlesvien

packages/workspace-server/src/services/agent/agent.ts

@@ -1,4 +1,4 @@
-import fs, { mkdirSync, symlinkSync } from "node:fs";
+import fs from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import {
@@ -87,6 +87,7 @@ import {
   AGENT_REPO_FILES,
   AGENT_SLEEP_COORDINATOR,
 } from "./identifiers";
+import { ensureNodeShim } from "./node-shim";
 import type {
   AgentLogger,
   AgentMcpApps,
@@ -1560,19 +1561,7 @@ For git operations while detached:
     const mockNodeDir = getMockNodeDir();
     if (!this.mockNodeReady) {
       try {
-        mkdirSync(mockNodeDir, { recursive: true });
-        const nodeSymlinkPath = join(mockNodeDir, "node");
-        try {
-          symlinkSync(process.execPath, nodeSymlinkPath);
-        } catch (err) {
-          if (
-            !(err instanceof Error) ||
-            !("code" in err) ||
-            err.code !== "EEXIST"
-          ) {
-            throw err;
-          }
-        }
+        ensureNodeShim(mockNodeDir, process.execPath);
         this.mockNodeReady = true;
       } catch (err) {
         this.log.warn("Failed to setup mock node environment", err);

packages/workspace-server/src/services/agent/node-shim.test.ts

@@ -0,0 +1,109 @@
+import {
+  lstatSync,
+  mkdtempSync,
+  readFileSync,
+  readlinkSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { buildNodeShimScript, ensureNodeShim } from "./node-shim";
+
+const EXEC_PATH = "/Applications/PostHog Code.app/Contents/MacOS/PostHog Code";
+
+describe("ensureNodeShim", () => {
+  const dirs: string[] = [];
+
+  function makeDir(): string {
+    const dir = mkdtempSync(join(tmpdir(), "node-shim-test-"));
+    dirs.push(dir);
+    return join(dir, "shim");
+  }
+
+  afterEach(() => {
+    while (dirs.length > 0) {
+      const dir = dirs.pop();
+      if (dir) rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("writes an executable wrapper that sets ELECTRON_RUN_AS_NODE itself", () => {
+    const dir = makeDir();
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+
+    const shim = join(dir, "node");
+    const content = readFileSync(shim, "utf-8");
+    expect(content).toContain("#!/bin/sh");
+    expect(content).toContain("export ELECTRON_RUN_AS_NODE=1");
+    expect(content).toContain(`exec "${EXEC_PATH}" "$@"`);
+    expect(statSync(shim).mode & 0o111).not.toBe(0);
+  });
+
+  it("escapes shell-special characters in the binary path", () => {
+    expect(buildNodeShimScript('/odd/pa"th/$app`bin\\x')).toContain(
+      'exec "/odd/pa\\"th/\\$app\\`bin\\\\x" "$@"',
+    );
+  });
+
+  it("replaces a legacy symlink shim with the wrapper script", () => {
+    const dir = makeDir();
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+    const shim = join(dir, "node");
+    rmSync(shim);
+    symlinkSync(EXEC_PATH, shim);
+
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+
+    expect(lstatSync(shim).isSymbolicLink()).toBe(false);
+    expect(readFileSync(shim, "utf-8")).toBe(buildNodeShimScript(EXEC_PATH));
+  });
+
+  it("rewrites the wrapper when the binary path changes", () => {
+    const dir = makeDir();
+    ensureNodeShim(dir, "/old/location/App", "darwin");
+
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+
+    expect(readFileSync(join(dir, "node"), "utf-8")).toBe(
+      buildNodeShimScript(EXEC_PATH),
+    );
+  });
+
+  it("leaves an up-to-date wrapper untouched", () => {
+    const dir = makeDir();
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+    const shim = join(dir, "node");
+    const past = new Date("2020-01-01T00:00:00Z");
+    utimesSync(shim, past, past);
+
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+
+    expect(statSync(shim).mtimeMs).toBe(past.getTime());
+  });
+
+  it("replaces a corrupt shim that is not the expected script", () => {
+    const dir = makeDir();
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+    const shim = join(dir, "node");
+    writeFileSync(shim, "not a shim");
+
+    ensureNodeShim(dir, EXEC_PATH, "darwin");
+
+    expect(readFileSync(shim, "utf-8")).toBe(buildNodeShimScript(EXEC_PATH));
+  });
+
+  it("keeps the symlink behavior on windows and tolerates an existing link", () => {
+    const dir = makeDir();
+    ensureNodeShim(dir, EXEC_PATH, "win32");
+    ensureNodeShim(dir, EXEC_PATH, "win32");
+
+    const shim = join(dir, "node");
+    expect(lstatSync(shim).isSymbolicLink()).toBe(true);
+    expect(readlinkSync(shim)).toBe(EXEC_PATH);
+  });
+});

packages/workspace-server/src/services/agent/node-shim.ts

@@ -0,0 +1,71 @@
+import {
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+
+function isErrnoException(err: unknown): err is NodeJS.ErrnoException {
+  return err instanceof Error && "code" in err;
+}
+
+function escapeForDoubleQuotes(path: string): string {
+  return path.replace(/([$`"\\])/g, "\\$1");
+}
+
+export function buildNodeShimScript(execPath: string): string {
+  return [
+    "#!/bin/sh",
+    "export ELECTRON_RUN_AS_NODE=1",
+    `exec "${escapeForDoubleQuotes(execPath)}" "$@"`,
+    "",
+  ].join("\n");
+}
+
+/**
+ * Writes the `node` shim agents resolve via PATH. On POSIX this is a wrapper
+ * script that sets ELECTRON_RUN_AS_NODE itself before exec'ing the app binary,
+ * so the shim stays a node runtime even when a layer in between (user dotfiles,
+ * direnv/flox, shell snapshots, MCP clients with cleaned envs) strips the var.
+ * A bare symlink relied on every descendant preserving the env and booted the
+ * full desktop app whenever one didn't. Replaces a stale legacy symlink or a
+ * wrapper pointing at a moved binary; no-op when already current.
+ */
+export function ensureNodeShim(
+  mockNodeDir: string,
+  execPath: string,
+  platform: NodeJS.Platform = process.platform,
+): void {
+  mkdirSync(mockNodeDir, { recursive: true });
+  const shimPath = join(mockNodeDir, "node");
+
+  if (platform === "win32") {
+    try {
+      symlinkSync(execPath, shimPath);
+    } catch (err) {
+      if (!isErrnoException(err) || err.code !== "EEXIST") throw err;
+    }
+    return;
+  }
+
+  const script = buildNodeShimScript(execPath);
+  if (currentShimContent(shimPath) === script) return;
+
+  const tmpPath = `${shimPath}.${process.pid}.tmp`;
+  writeFileSync(tmpPath, script);
+  chmodSync(tmpPath, 0o755);
+  renameSync(tmpPath, shimPath);
+}
+
+function currentShimContent(shimPath: string): string | null {
+  try {
+    if (lstatSync(shimPath).isSymbolicLink()) return null;
+    return readFileSync(shimPath, "utf-8");
+  } catch {
+    return null;
+  }
+}