Summary: PRs #858 and #866 fixed the prebuilds/darwin-{arm64,x64}/spawn-helper exec-bit packaging defect (tracked in #850), but the fix has only shipped in the 1.2.0-beta.* channel. The latest dist-tag on npm is still 1.1.0, which ships the broken tarball. Stable consumers on node-pty@^1.1.0 continue to hit the bug on a fresh install — including in environments that don't run install scripts (pnpm by default).
Reproduction (verified just now against the npm registry):
$ npm pack node-pty@1.1.0
$ tar -tvf node-pty-1.1.0.tgz | grep spawn-helper
-rw-r--r-- 0 0 0 50480 ... package/prebuilds/darwin-arm64/spawn-helper
-rw-r--r-- 0 0 0 9248 ... package/prebuilds/darwin-x64/spawn-helper
$ npm pack node-pty@1.2.0-beta.9
$ tar -tvf node-pty-1.2.0-beta.9.tgz | grep spawn-helper
-rwxr-xr-x 0 0 0 50480 ... package/prebuilds/darwin-arm64/spawn-helper
-rwxr-xr-x 0 0 0 9248 ... package/prebuilds/darwin-x64/spawn-helper
$ npm pack node-pty@1.2.0-beta.12
$ tar -tvf node-pty-1.2.0-beta.12.tgz | grep spawn-helper
-rwxr-xr-x 0 0 0 50480 ... package/prebuilds/darwin-arm64/spawn-helper
-rwxr-xr-x 0 0 0 9248 ... package/prebuilds/darwin-x64/spawn-helper
Current dist-tags:
$ npm view node-pty dist-tags
{ ..., latest: '1.1.0', beta: '1.2.0-beta.12' }
Ask: Cut a 1.1.1 patch release containing #858 and #866 so stable consumers no longer have to opt into a beta (or maintain a postinstall chmod +x shim, which is a no-op under pnpm's default-secure install policy) for a packaging fix.
Workarounds available today:
- Pin to
1.2.0-beta.12 (we're doing this in our repo, dev-only consumer).
- Postinstall
chmod +x (doesn't help pnpm).
- In-test or in-runtime self-heal that
chmods the helper after require.resolve().
Happy to test against an RC.
Summary: PRs #858 and #866 fixed the
prebuilds/darwin-{arm64,x64}/spawn-helperexec-bit packaging defect (tracked in #850), but the fix has only shipped in the1.2.0-beta.*channel. Thelatestdist-tag on npm is still1.1.0, which ships the broken tarball. Stable consumers onnode-pty@^1.1.0continue to hit the bug on a fresh install — including in environments that don't run install scripts (pnpm by default).Reproduction (verified just now against the npm registry):
Current dist-tags:
Ask: Cut a
1.1.1patch release containing #858 and #866 so stable consumers no longer have to opt into abeta(or maintain a postinstallchmod +xshim, which is a no-op under pnpm's default-secure install policy) for a packaging fix.Workarounds available today:
1.2.0-beta.12(we're doing this in our repo, dev-only consumer).chmod +x(doesn't help pnpm).chmods the helper afterrequire.resolve().Happy to test against an RC.