fix(npm): preserve occ executable permissions

Author: pRizz

.github/workflows/publish-npm.yml

@@ -98,6 +98,9 @@ jobs:
           chmod +x packages/cli-node-linux-x64-musl/bin/occ
           chmod +x packages/cli-node-linux-arm64-musl/bin/occ
 
+      - name: Verify packaged binary permissions
+        run: bash scripts/verify-cli-node-pack-perms.sh
+
       - name: Build Node packages
         run: |
           pnpm -C packages/cli-node build

packages/cli-node-darwin-arm64/package.json

@@ -12,6 +12,9 @@
   "homepage": "https://github.com/pRizz/opencode-cloud",
   "os": ["darwin"],
   "cpu": ["arm64"],
+  "publishConfig": {
+    "executableFiles": ["bin/occ"]
+  },
   "files": ["bin"],
   "main": "index.js"
 }

packages/cli-node-darwin-x64/package.json

@@ -12,6 +12,9 @@
   "homepage": "https://github.com/pRizz/opencode-cloud",
   "os": ["darwin"],
   "cpu": ["x64"],
+  "publishConfig": {
+    "executableFiles": ["bin/occ"]
+  },
   "files": ["bin"],
   "main": "index.js"
 }

packages/cli-node-linux-arm64-musl/package.json

@@ -13,6 +13,9 @@
   "os": ["linux"],
   "cpu": ["arm64"],
   "libc": ["musl"],
+  "publishConfig": {
+    "executableFiles": ["bin/occ"]
+  },
   "files": ["bin"],
   "main": "index.js"
 }

packages/cli-node-linux-arm64/package.json

@@ -13,6 +13,9 @@
   "os": ["linux"],
   "cpu": ["arm64"],
   "libc": ["glibc"],
+  "publishConfig": {
+    "executableFiles": ["bin/occ"]
+  },
   "files": ["bin"],
   "main": "index.js"
 }

packages/cli-node-linux-x64-musl/package.json

@@ -13,6 +13,9 @@
   "os": ["linux"],
   "cpu": ["x64"],
   "libc": ["musl"],
+  "publishConfig": {
+    "executableFiles": ["bin/occ"]
+  },
   "files": ["bin"],
   "main": "index.js"
 }

packages/cli-node-linux-x64/package.json

@@ -13,6 +13,9 @@
   "os": ["linux"],
   "cpu": ["x64"],
   "libc": ["glibc"],
+  "publishConfig": {
+    "executableFiles": ["bin/occ"]
+  },
   "files": ["bin"],
   "main": "index.js"
 }

packages/cli-node/src/index.ts

@@ -11,6 +11,7 @@ import { existsSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { createRequire } from 'module';
+import { ensureExecutable } from './permissions.js';
 
 const require = createRequire(import.meta.url);
 const scriptDir = dirname(fileURLToPath(import.meta.url));
@@ -101,6 +102,8 @@ if (!binaryPath) {
   process.exit(1);
 }
 
+ensureExecutable(binaryPath);
+
 const child = spawn(binaryPath, process.argv.slice(2), {
   stdio: 'inherit',
 });
@@ -109,8 +112,13 @@ child.on('close', (code: number | null) => {
   process.exit(code ?? 1);
 });
 
-child.on('error', (err: Error) => {
+child.on('error', (err: NodeJS.ErrnoException) => {
   console.error(`Error: Failed to spawn binary at ${binaryPath}`);
+  if (err.code === 'EACCES') {
+    console.error(
+      `Permission denied executing binary. Try: chmod +x ${binaryPath}\n`
+    );
+  }
   console.error(`Error: ${err.message}\n`);
   console.error('Try reinstalling: npm install opencode-cloud');
   process.exit(1);

packages/cli-node/src/permissions.test.ts

@@ -0,0 +1,53 @@
+import * as fs from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { describe, expect, it } from 'vitest';
+import { ensureExecutable } from './permissions.js';
+
+function makeTempBinary(mode: number): { dir: string; path: string } {
+  const dir = fs.mkdtempSync(join(tmpdir(), 'occ-permissions-'));
+  const path = join(dir, 'occ');
+  fs.writeFileSync(path, '#!/usr/bin/env sh\necho ok\n', 'utf8');
+  fs.chmodSync(path, mode);
+  return { dir, path };
+}
+
+describe('ensureExecutable', () => {
+  it('sets execute permissions when the file is not executable', () => {
+    const tmp = makeTempBinary(0o644);
+
+    ensureExecutable(tmp.path);
+
+    const mode = fs.statSync(tmp.path).mode & 0o777;
+    expect(mode & 0o111).not.toBe(0);
+
+    fs.rmSync(tmp.dir, { recursive: true, force: true });
+  });
+
+  it('keeps executable files executable', () => {
+    const tmp = makeTempBinary(0o755);
+
+    ensureExecutable(tmp.path);
+
+    const mode = fs.statSync(tmp.path).mode & 0o777;
+    expect(mode & 0o111).not.toBe(0);
+
+    fs.rmSync(tmp.dir, { recursive: true, force: true });
+  });
+
+  it('does not throw when chmod fails', () => {
+    const tmp = makeTempBinary(0o644);
+    const throwingFs = {
+      statSync: (filePath: string) => fs.statSync(filePath),
+      chmodSync: () => {
+        throw new Error('chmod failed');
+      },
+    };
+
+    expect(() => ensureExecutable(tmp.path, throwingFs)).not.toThrow();
+    const mode = fs.statSync(tmp.path).mode & 0o777;
+    expect(mode & 0o111).toBe(0);
+
+    fs.rmSync(tmp.dir, { recursive: true, force: true });
+  });
+});

packages/cli-node/src/permissions.ts

@@ -0,0 +1,24 @@
+import * as fs from 'fs';
+
+type PermissionFs = {
+  statSync: (filePath: string) => { mode: number };
+  chmodSync: (filePath: string, mode: number) => void;
+};
+
+/**
+ * Best-effort permission fix for packaged binaries.
+ * If execute bits are missing, attempt to restore them.
+ */
+export function ensureExecutable(
+  filePath: string,
+  fileSystem: PermissionFs = fs
+): void {
+  try {
+    const mode = fileSystem.statSync(filePath).mode;
+    if ((mode & 0o111) === 0) {
+      fileSystem.chmodSync(filePath, 0o755);
+    }
+  } catch {
+    // Do not hard-fail here; spawn() will report a concrete error.
+  }
+}