ci fixes + #86

this should closes #86 [sic]

done

Author: jhheider

.github/workflows/ci.yml

@@ -75,7 +75,9 @@ jobs:
       - run: ./pkgm.ts update
       - run: if pkgx semverator satisfies '>=1.19' "$(hyperfine --version | cut -f 2 -d ' ')"; then false; fi
       # …until the pin is widened to `*`, after which `update` tracks latest.
-      - run: sed -i'' 's/= "~1.18"/= "*"/' "${XDG_CONFIG_HOME:-$HOME/.config}/pkgm/manifest.toml"
+      # `-i.bak` (not bare `-i`) so it's portable: GNU and BSD/macOS sed both
+      # take the suffix here; the leftover .bak file is harmless.
+      - run: sed -i.bak 's/= "~1.18"/= "*"/' "${XDG_CONFIG_HOME:-$HOME/.config}/pkgm/manifest.toml"
       - run: ./pkgm.ts outdated | grep hyperfine
       - run: ./pkgm.ts update
       - run: pkgx semverator satisfies '>=1.19' "$(hyperfine --version | cut -f 2 -d ' ')"
@@ -130,6 +132,13 @@ jobs:
       - name: sudo install drops privileges and overrides HOME
         run: |
           set -eux
+          # The pkgm.ts shebang makes pkgx fetch a private deno (and unzip, to
+          # unpack deno’s .zip) the first time it runs. Under sudo that bootstrap
+          # is the kernel-invoked `pkgx … deno run` executing as root with
+          # HOME=/root, so it lands in /root/.pkgx before any pkgm code runs —
+          # pkgm can’t relocate it. Warm it before the marker so the checks below
+          # scope only to what the install itself creates.
+          sudo ./pkgm.ts --version
           # marker to scope ownership checks to files created by this install
           touch /tmp/pkgm-sudo-marker
           sudo ./pkgm.ts i hyperfine
@@ -233,7 +242,9 @@ jobs:
           ./pkgm.ts i uv
           out=$(./pkgm.ts outdated 2>&1 || true)
           echo "$out"
-          echo "$out" | (! grep -q "Uncaught")
+          if echo "$out" | grep -q "Uncaught"; then
+            echo "outdated raised an uncaught exception"; exit 1
+          fi
       - name: uv then node keeps outdated/update alive
         run: |
           set -eux
@@ -242,7 +253,9 @@ jobs:
           ./pkgm.ts i node
           out=$(./pkgm.ts outdated 2>&1 || true)
           echo "$out"
-          echo "$out" | (! grep -q "Uncaught")
+          if echo "$out" | grep -q "Uncaught"; then
+            echo "outdated raised an uncaught exception"; exit 1
+          fi
 
       # #88 root cause: a later install must resolve against the whole requested
       # set (via the manifest), so python's strict zlib pin (pulled in by uv)

pkgm.ts

@@ -96,6 +96,7 @@ if (parsedArgs.help || parsedArgs._[0] == "help") {
     case "li":
       if (install_prefix().string != "/usr/local") {
         const dst = Path.home().join(".local");
+        assert_manifest_resolved(dst);
         await install(await combined_specs(dst, args), dst.string);
         await record_install(dst, args);
       } else {
@@ -329,7 +330,8 @@ async function query_pkgx(
   const needs_sudo_backwards = install_prefix().string == "/usr/local";
   let cmd = needs_sudo_backwards ? "/usr/bin/sudo" : pkgx;
   if (needs_sudo_backwards) {
-    if (!Deno.env.get("SUDO_USER")) {
+    const sudo_user = Deno.env.get("SUDO_USER");
+    if (!sudo_user) {
       if (Deno.uid() == 0) {
         console.error(
           "%cwarning",
@@ -338,8 +340,18 @@ async function query_pkgx(
         );
       }
       cmd = pkgx;
+    } else if (reachable_as(pkgx, sudo_user)) {
+      // drop privileges so pkgx writes its cache as the invoking user, and point
+      // HOME at their home so it doesn’t cache back under /root/ where they
+      // couldn’t reach it on the next invocation.
+      const home = user_home(sudo_user);
+      if (home) env.HOME = home;
+      args.unshift("-u", sudo_user, pkgx);
     } else {
-      args.unshift("-u", Deno.env.get("SUDO_USER")!, pkgx);
+      // pkgx lives somewhere the unprivileged user can’t execute it (e.g. only
+      // under /root/.pkgx). dropping privileges would abort with “Permission
+      // denied”, so run it as root instead (pkgxdev/pkgm#68).
+      cmd = pkgx;
     }
   }
 
@@ -379,6 +391,34 @@ async function query_pkgx(
   ];
 }
 
+// home directory of the invoking (pre-sudo) user, so pkgx caches under their
+// tree rather than /root/. getent is the portable lookup on Linux; on macOS it
+// is absent, but the /root/.pkgx scenario this guards against doesn’t arise
+// there in practice, so a missing home (→ no override) is fine.
+function user_home(user: string): string | undefined {
+  try {
+    const out = new Deno.Command("/usr/bin/getent", {
+      args: ["passwd", user],
+    }).outputSync();
+    if (!out.success) return undefined;
+    const fields = new TextDecoder().decode(out.stdout).trim().split(":");
+    return fields[5] || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// can `user` execute the binary at `p`? private home dirs are typically mode
+// 700, so a path under another user’s home is unreachable; system paths and the
+// user’s own home are assumed reachable. used to decide whether dropping
+// privileges to `user` would leave pkgx unrunnable (pkgxdev/pkgm#68).
+function reachable_as(p: string, user: string): boolean {
+  if (p.startsWith("/root/")) return user === "root";
+  const m = p.match(/^\/home\/([^/]+)\//);
+  if (m) return m[1] === user;
+  return true;
+}
+
 async function mirror_directory(dst: string, src: string, prefix: string) {
   let warned_copy_fallback = false;
   await processEntry(join(src, prefix), join(dst, prefix));
@@ -794,6 +834,14 @@ async function update() {
     }
   }
 
+  // nothing satisfies a newer in-range version: everything’s current. return
+  // before calling install(), which treats an empty arg list as a usage error
+  // ("no packages specified") and exits non-zero.
+  if (update_list.length == 0) {
+    console.error("everything is up-to-date");
+    return;
+  }
+
   for (const pkgspec of update_list) {
     const pkg = utils.pkg.parse(pkgspec);
     console.log(
@@ -858,7 +906,22 @@ function manifest_entry_kind(value: string): ManifestEntryKind {
 // finished. no manifest at all → legacy behavior (see hydrate_graph), so
 // existing installs keep working untouched.
 function assert_manifest_resolved(prefix = install_prefix()) {
-  const manifest = read_manifest(prefix);
+  let manifest;
+  try {
+    manifest = read_manifest(prefix);
+  } catch (err) {
+    // invalid TOML (e.g. a partially-finished hand-edit) must block commands
+    // with a clear message, not crash with an uncaught parse stack trace.
+    console.error(
+      "%cerror",
+      "color:red",
+      `could not parse ${manifest_path(prefix)}: ${
+        err instanceof Error ? err.message : err
+      }`,
+    );
+    console.error("fix the TOML syntax and re-run");
+    Deno.exit(1);
+  }
   if (!manifest) return;
   const unresolved = Object.entries(manifest)
     .filter(([, value]) => manifest_entry_kind(value) == "unresolved")
@@ -1039,9 +1102,10 @@ async function combined_specs(prefix: Path, args: string[]): Promise<string[]> {
 }
 
 // map each requested arg to its canonical project and the constraint you asked
-// for. a bare name (`node`) yields `*` — track latest; a versioned spec
-// (`node@22`) yields its range (`^22`). pantry hiccups are non-fatal: the
-// package will still be picked up as a pin by record_install’s tree walk.
+// for. a bare name (`node`) yields `*` here, which record_install then
+// major-locks to the installed version (`^<installed>`); a versioned spec
+// (`node@22`) yields its range (`^22`) verbatim. pantry hiccups are non-fatal:
+// the package will still be picked up as a pin by record_install’s tree walk.
 async function requested_constraints(
   args: string[],
 ): Promise<Record<string, string>> {