Skip to content

fix(config): discover npm/bun IaC runner bin symlinks - #1033

Open
UrbanChrisy wants to merge 1 commit into
railwayapp:masterfrom
UrbanChrisy:fix/iac-runner-bin-symlink-permissions
Open

fix(config): discover npm/bun IaC runner bin symlinks#1033
UrbanChrisy wants to merge 1 commit into
railwayapp:masterfrom
UrbanChrisy:fix/iac-runner-bin-symlink-permissions

Conversation

@UrbanChrisy

Copy link
Copy Markdown

Summary

  • railway config plan/apply looks up the TypeScript IaC runner at node_modules/.bin/railway-iac-ts, then rejects candidates that appear "writable by others".
  • Package managers install those bins as 0777 symlinks (and often ship the target script as 0777 too). On Unix those mode bits are not a substitution risk — replacing a path component requires a writable directory.
  • The check therefore rejected every normal local railway SDK install, fell through to PATH railway-iac-ts, and failed with ENOENT for users running the globally installed CLI.

Test plan

  • cargo test runner_discovery_tests (4 passed), including new regression for permissive .bin symlink + 0777 target
  • With a project that has railway installed and .railway/railway.ts, run the global CLI (~/.railway/bin/railway config plan) without node_modules/.bin on PATH and confirm it finds the project runner

Package managers install node_modules/.bin entries as 0777 symlinks
(and often the target script as 0777). The project-runner trust check
treated those mode bits as "writable by others" and rejected every
local railway SDK install, so `railway config plan/apply` fell through
to PATH and failed with ENOENT for global CLI users.

Only treat group/world-writable *directories* as an untrusted path.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant