fix(packaging): skip filesystem links during mode normalization

[luvs01]

Summary

• Inspect release-package entries without following filesystem links before applying file modes, including both launchers and the built dashboard output tree.
• Route the real preparation entrypoint through an import-safe normalizePackageModes(root) helper while preserving compatibility-manifest generation.
• Add focused regressions for a linked output root (Windows junction/POSIX symlink), nested links, direct launcher links, and ordinary-entry normalization.

Verification

• Base: dev at a1e5192b75edbf6dcacae51a30912fab93906f87; exact head: 233fe5f00dba457847d9a08102ca812b8ef039f0.
• Bun 1.3.14: focused install-script test 8 pass, 1 platform skip; typecheck passed; package preparation command passed.
• Bun 1.4.0-canary.1: focused install-script test 8 pass, 1 platform skip; typecheck passed; package preparation command passed.
• Windows junction regression executed locally. The POSIX-only direct/nested symlink case is left to Linux/macOS CI.
• Privacy scan and git diff --check passed.
• The stable patch id remained 6f0cc13886979653e77b34ddada344e73b398f6c across the rebase; an independent exact-head review found no actionable P0-P2 issue.
• Bun 1.3.14 bun run prepush passed typecheck and entered the full suite, then its runtime crashed after 282 seconds with an internal assertion in unrelated tests/api-storage-policy-put-race.test.ts (exit 3). The isolated same-file run also crashed on Bun 1.3.14, while Bun 1.4.0-canary.1 passed it 1/1; prepush is therefore recorded as blocked/red rather than green.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. No command, configuration, or API contract changed, so no docs update is required.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Independent review found no P0/P1/P2 issue; the remaining lstat-to-chmod race requires same-user concurrent workspace mutation authority.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Package preparation now safely handles symbolic links without following or modifying them.
  • File permissions are normalized more reliably for package binaries, directories, and linked output paths.
  • Importing package preparation utilities no longer triggers packaging or permission changes automatically.

• Tests

  • Added coverage for nested and direct symbolic links, regular files, directories, and linked output roots.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 445f0e65-dd6a-4356-9f04-0db725d3da88

📥 Commits

Reviewing files that changed from the base of the PR and between 027a993 and c2175ac.

📒 Files selected for processing (2)

• scripts/prepare-package.ts
• tests/install-scripts.test.ts

---

📝 Walkthrough

Walkthrough

The package preparation script now normalizes file modes without following symbolic links. It exposes normalizePackageModes, runs preparation actions only as the main module, and adds POSIX and cross-platform filesystem tests.

Changes

Package mode safety

Layer / File(s)	Summary
Symlink-safe normalization workflow scripts/prepare-package.ts	lstatSync detects symbolic links without following them. Mode changes skip links and use shared best-effort chmodSync handling. normalizePackageModes normalizes binaries and gui/dist. Manifest generation and normalization run only when import.meta.main is true.
Filesystem behavior validation tests/install-scripts.test.ts	Tests verify that regular files and directories receive normalized modes while direct links, nested links, and linked output roots remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: 🟡 Moderate · up to c2175

The packaging change is localized and its focused checks pass, but the PR is still explicitly marked draft with all required readiness conditions unchecked, so it is not merge-ready until those conditions are completed or explicitly accepted.

Suggested reviewers: wibias, ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: skipping filesystem links during packaging mode normalization.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: scripts/prepare-package.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: scripts/prepare-package.ts.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[lidge-jun]

scripts/prepare-package.ts:12-35 correctly replaces target-following statSync() with lstatSync() and exits before mode normalization or recursion when the package entry is a symbolic link. The extracted normalizePackageModes() makes the behavior directly testable, while import.meta.main preserves the real bun scripts/prepare-package.ts entrypoint used by prepack and build:gui.

tests/install-scripts.test.ts:141-225 is meaningful focused coverage: it proves direct launcher links, nested directory links, and a linked gui/dist root leave external modes unchanged while normal package entries receive the required modes. CodeRabbit found no substantive code defect.

Blocking release-readiness items:

• scripts/prepare-package.ts is a protected release/packaging surface. The current hygiene check fails with unsponsored_surface; this needs maintainer security review and sponsorship before merge.
• Rebase onto current dev; this branch has diverged.
• Run exact-head maintained packaging/release CI after the rebase. The contributor's focused results are useful, but there is no green maintained build/test run on this head and it remains draft.

DISPOSITION: NEEDS-CHANGE

[luvs01]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

No files to review.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[lidge-jun]

[Repository bug audit · 2026-08-14]

The lstat-based normalization and import-safe helper correctly avoid following direct, nested, and output-root links. The ordinary-entry mode assertions are appropriate; the remaining same-user lstat→chmod race is not a merge blocker for this packaging step.

Rebase onto current dev and require Linux/macOS exact-head CI to execute the POSIX symlink cases, plus the Windows junction case. If those pass, this can merge independently as packaging hardening.

[lidge-jun]

Cherry-picked onto dev as part of the bug resolution campaign (commit-and-merge loop). Changes verified with typecheck and focused tests.