Skip to content

Copy real files when patching the bundled Undici proxy tree - #276

Open
francescovidaich964 wants to merge 1 commit into
advaitpaliwal:mainfrom
francescovidaich964:fix/undici-cpsync-dereference
Open

Copy real files when patching the bundled Undici proxy tree#276
francescovidaich964 wants to merge 1 commit into
advaitpaliwal:mainfrom
francescovidaich964:fix/undici-cpsync-dereference

Conversation

@francescovidaich964

@francescovidaich964 francescovidaich964 commented Sep 9, 2026

Copy link
Copy Markdown

Summary

Fixes #275. On Windows, cpSync at scripts/lib/pi-undici-proxy-patch.mjs:173 recreates the undici symlink (created by linkBundledPackage) instead of copying real files, because it defaults to dereference: false. Creating a dir symlink requires SeCreateSymbolicLinkPrivilege, which a non-elevated user does not hold — so every command fails with EPERM once any optional package is installed.

This change passes dereference: true, matching the precedent already in the repo at scripts/verify-stale-pi-upgrade.mjs:460.

Changes

  • scripts/lib/pi-undici-proxy-patch.mjs — add dereference: true to the cpSync call, with an explanatory comment.
  • tests/pi-undici-proxy-patch.test.ts — regression test asserting the patched undici tree contains real files (not a symlink).

Test coverage note

The regression test asserts isSymbolicLink() === false, which fails on Linux too (the unfixed code recreates the symlink there as well), so the existing ubuntu CI run catches regressions — no Windows-only test needed.

Verification

  • npm run typecheck — pass
  • npm run build — pass
  • Touched test file passes in full
  • The full suite on Windows has 109 pre-existing failures at clean main; the failing set on this branch is identical (2 additional failures were confirmed flaky)

CI status

  • The ubuntu npm test workflow has not run on this PR yet: fork workflow runs await maintainer approval. Once approved, the ubuntu run is the one that exercises the new regression test.
  • The Vercel check fails only because fork PRs need deploy authorization from a team member; it is not a build or test failure.
  • GitGuardian security checks pass.

Notes

This PR was prepared with AI assistance; the contributor verified the diff against the current source before opening.

On Windows, every `feynman` invocation failed with `EPERM: operation not
permitted, symlink` once an optional package was installed, including
`feynman --version`. Recovery required removing the package, enabling
Developer Mode, or running an elevated shell.

`safePackagePath` resolves to `node_modules/undici`, which the bundled
workspace exposes through a link created by `linkBundledPackage`. Because
`cpSync` defaults to `dereference: false`, it recreated that link at the
temporary path, and creating a symlink on Windows requires
`SeCreateSymbolicLinkPrivilege`, which a standard non-elevated process does
not hold unless Developer Mode is enabled.

Pass `dereference: true` so the real files are copied instead. This follows
existing precedent in the repo: `scripts/verify-stale-pi-upgrade.mjs`
already passes `dereference: true`, and `linkBundledPackage` already
prefers junctions on win32 because they require no privilege.

Add a regression test whose fixture reaches undici through a link. It
asserts the patched tree is not a symlink, so it fails before this change
on every platform rather than only on Windows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@vercel

vercel Bot commented Sep 9, 2026

Copy link
Copy Markdown

@francescovidaich964 is attempting to deploy a commit to the Advait Paliwal's projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

cpSync recreates a symlink when patching the bundled Undici proxy — every command fails with EPERM on Windows

1 participant