Run the musl binary on musl hosts in npm wrapper

Yarn classic ignores the `libc` field, so on Alpine it installs both
the -gnu and the -musl platform package. The npm wrapper always took
the first package that resolved (-gnu), whose glibc binary cannot
start on musl, and then exited 1 without printing anything. Every
socket-patch command failed silently in yarn classic projects on
Alpine and in node:*-alpine CI images.

The wrapper now detects the host libc (Node's runtime report, then
the musl loader probe scripts/install.sh uses) and tries the -musl
package first on musl. If a binary cannot be spawned it tries the
next installed candidate, and if none can run it prints the spawn
error instead of exiting silently.

Fixes #974

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

npm/socket-patch/bin/socket-patch

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 const { spawnSync } = require("child_process");
+const fs = require("fs");
 const path = require("path");
 
 const PLATFORMS = {
@@ -15,32 +16,82 @@ const PLATFORMS = {
   "android arm64": ["@socketsecurity/socket-patch-android-arm64"],
 };
 
-const key = `${process.platform} ${process.arch}`;
-const candidates = PLATFORMS[key];
-if (!candidates) {
-  console.error(`Unsupported platform: ${key}`);
-  process.exit(1);
-}
-
-const exe = process.platform === "win32" ? "socket-patch.exe" : "socket-patch";
-let binPath;
-for (const pkg of candidates) {
+// Installers that ignore the `libc` field (yarn classic) install both the
+// -gnu and the -musl package on Linux, so the order above alone would run
+// the glibc binary on musl hosts (Alpine), where it cannot start.
+function detectLibc({
+  platform = process.platform,
+  getReport = () => process.report.getReport(),
+  listDir = (dir) => fs.readdirSync(dir),
+} = {}) {
+  if (platform !== "linux") return null;
+  try {
+    // Node reports the runtime glibc version only when it runs on glibc.
+    if (getReport().header.glibcVersionRuntime) return "glibc";
+  } catch {}
+  // Same probe as scripts/install.sh: musl's dynamic loader.
   try {
-    const pkgDir = path.dirname(require.resolve(`${pkg}/package.json`));
-    binPath = path.join(pkgDir, exe);
-    break;
+    if (listDir("/lib").some((name) => name.startsWith("ld-musl-"))) return "musl";
   } catch {}
+  return null;
 }
-if (!binPath) {
-  // Fallback: try local bin directory (for development or bundled installs)
-  const localBin = process.platform === "win32"
-    ? `socket-patch-${key.replace(" ", "-")}.exe`
-    : `socket-patch-${key.replace(" ", "-")}`;
-  binPath = path.join(__dirname, localBin);
+
+function orderCandidates(candidates, libc) {
+  if (libc !== "musl") return candidates;
+  const musl = candidates.filter((pkg) => pkg.endsWith("-musl"));
+  return [...musl, ...candidates.filter((pkg) => !pkg.endsWith("-musl"))];
 }
 
-const result = spawnSync(binPath, process.argv.slice(2), {
-  stdio: "inherit",
-  env: process.env,
-});
-process.exit(result.status ?? 1);
+// Spawn errors that mean "this binary cannot run here", so the next
+// installed candidate is worth trying.
+const UNRUNNABLE = new Set(["ENOENT", "EACCES", "ENOEXEC"]);
+
+function runFirstUsable(binPaths, args, {
+  spawn = (bin, argv) => spawnSync(bin, argv, { stdio: "inherit", env: process.env }),
+  log = (msg) => console.error(msg),
+} = {}) {
+  let lastError;
+  for (const bin of binPaths) {
+    const result = spawn(bin, args);
+    if (!result.error) return result.status ?? 1;
+    lastError = { bin, error: result.error };
+    if (!UNRUNNABLE.has(result.error.code)) break;
+  }
+  if (lastError) {
+    log(`socket-patch: failed to run ${lastError.bin}: ${lastError.error.message}`);
+  }
+  return 1;
+}
+
+function main() {
+  const key = `${process.platform} ${process.arch}`;
+  const candidates = PLATFORMS[key];
+  if (!candidates) {
+    console.error(`Unsupported platform: ${key}`);
+    process.exit(1);
+  }
+
+  const exe = process.platform === "win32" ? "socket-patch.exe" : "socket-patch";
+  const binPaths = [];
+  for (const pkg of orderCandidates(candidates, detectLibc())) {
+    try {
+      const pkgDir = path.dirname(require.resolve(`${pkg}/package.json`));
+      binPaths.push(path.join(pkgDir, exe));
+    } catch {}
+  }
+  if (binPaths.length === 0) {
+    // Fallback: try local bin directory (for development or bundled installs)
+    const localBin = process.platform === "win32"
+      ? `socket-patch-${key.replace(" ", "-")}.exe`
+      : `socket-patch-${key.replace(" ", "-")}`;
+    binPaths.push(path.join(__dirname, localBin));
+  }
+
+  process.exit(runFirstUsable(binPaths, process.argv.slice(2)));
+}
+
+if (require.main === module) {
+  main();
+} else {
+  module.exports = { PLATFORMS, detectLibc, orderCandidates, runFirstUsable };
+}

npm/socket-patch/bin/socket-patch.test.mjs

@@ -1,6 +1,9 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 
@@ -71,3 +74,133 @@ describe("npm platform dispatch", () => {
     }
   });
 });
+
+// Regression tests for #974: installers that ignore `libc` (yarn classic)
+// install both the -gnu and -musl packages, so the wrapper must pick the
+// one that can run on this host and must never exit silently.
+
+const wrapperPath = join(__dirname, "socket-patch");
+const wrapper = createRequire(import.meta.url)(wrapperPath);
+
+describe("npm wrapper libc selection (#974)", () => {
+  it("does not run the CLI when required as a module", () => {
+    assert.equal(typeof wrapper.orderCandidates, "function");
+    assert.equal(typeof wrapper.detectLibc, "function");
+    assert.equal(typeof wrapper.runFirstUsable, "function");
+  });
+
+  it("detects musl when the Node runtime reports no glibc", () => {
+    const libc = wrapper.detectLibc({
+      platform: "linux",
+      getReport: () => ({ header: {} }),
+      listDir: () => ["ld-musl-x86_64.so.1", "libc.musl-x86_64.so.1"],
+    });
+    assert.equal(libc, "musl");
+  });
+
+  it("detects glibc from the runtime report even if a musl loader exists", () => {
+    const libc = wrapper.detectLibc({
+      platform: "linux",
+      getReport: () => ({ header: { glibcVersionRuntime: "2.36" } }),
+      listDir: () => ["ld-musl-x86_64.so.1"],
+    });
+    assert.equal(libc, "glibc");
+  });
+
+  it("returns null off Linux", () => {
+    assert.equal(
+      wrapper.detectLibc({
+        platform: "darwin",
+        getReport: () => ({ header: {} }),
+        listDir: () => [],
+      }),
+      null,
+    );
+  });
+
+  for (const key of ["linux x64", "linux arm64", "linux arm", "linux ia32"]) {
+    it(`prefers the musl package on a musl host (${key})`, () => {
+      const ordered = wrapper.orderCandidates(PLATFORMS[key], "musl");
+      assert.match(ordered[0], /-musl$/);
+      assert.match(ordered[1], /-gnu$/);
+    });
+
+    it(`keeps gnu first on a glibc host (${key})`, () => {
+      assert.deepEqual(wrapper.orderCandidates(PLATFORMS[key], "glibc"), PLATFORMS[key]);
+    });
+  }
+
+  it("falls back to the next binary when the first cannot be spawned", () => {
+    const calls = [];
+    const enoent = Object.assign(new Error("spawnSync gnu ENOENT"), { code: "ENOENT" });
+    const status = wrapper.runFirstUsable(["/gnu", "/musl"], ["--version"], {
+      spawn: (bin) => {
+        calls.push(bin);
+        return bin === "/gnu" ? { status: null, error: enoent } : { status: 0 };
+      },
+      log: () => {},
+    });
+    assert.equal(status, 0);
+    assert.deepEqual(calls, ["/gnu", "/musl"]);
+  });
+
+  it("prints why it failed instead of exiting silently", () => {
+    const logs = [];
+    const enoent = Object.assign(new Error("spawnSync /gnu ENOENT"), { code: "ENOENT" });
+    const status = wrapper.runFirstUsable(["/gnu"], [], {
+      spawn: () => ({ status: null, error: enoent }),
+      log: (msg) => logs.push(msg),
+    });
+    assert.equal(status, 1);
+    assert.equal(logs.length, 1);
+    assert.match(logs[0], /\/gnu/);
+    assert.match(logs[0], /ENOENT/);
+  });
+
+  it("propagates the exit status of a binary that ran", () => {
+    const status = wrapper.runFirstUsable(["/gnu", "/musl"], [], {
+      spawn: () => ({ status: 3 }),
+      log: () => {},
+    });
+    assert.equal(status, 3);
+  });
+
+  // End to end: a node_modules tree like yarn classic leaves on Alpine,
+  // with both platform packages installed and the gnu binary unable to
+  // start. The wrapper must run the musl binary instead of exiting 1
+  // with no output.
+  it(
+    "runs the musl binary when the gnu one cannot start (yarn classic layout)",
+    { skip: process.platform !== "linux" || !PLATFORMS[`linux ${process.arch}`] },
+    () => {
+      const root = mkdtempSync(join(tmpdir(), "sp-wrapper-"));
+      try {
+        const scope = join(root, "node_modules", "@socketsecurity");
+        const binDir = join(scope, "socket-patch", "bin");
+        mkdirSync(binDir, { recursive: true });
+        writeFileSync(join(binDir, "socket-patch"), readFileSync(wrapperPath));
+        for (const pkg of PLATFORMS[`linux ${process.arch}`]) {
+          const dir = join(root, "node_modules", pkg);
+          mkdirSync(dir, { recursive: true });
+          writeFileSync(join(dir, "package.json"), JSON.stringify({ name: pkg, version: "0.0.0" }));
+          const exe = join(dir, "socket-patch");
+          if (pkg.endsWith("-gnu")) {
+            // A binary whose ELF interpreter is missing fails exactly like
+            // a glibc binary on musl: spawn reports ENOENT.
+            writeFileSync(exe, "#!/nonexistent/ld-linux.so.2\n");
+          } else {
+            writeFileSync(exe, "#!/bin/sh\necho \"musl-binary $*\"\n");
+          }
+          chmodSync(exe, 0o755);
+        }
+        const result = spawnSync(process.execPath, [join(binDir, "socket-patch"), "--version"], {
+          encoding: "utf8",
+        });
+        assert.equal(result.status, 0, `stderr: ${result.stderr}`);
+        assert.equal(result.stdout.trim(), "musl-binary --version");
+      } finally {
+        rmSync(root, { recursive: true, force: true });
+      }
+    },
+  );
+});