From ea86f2a304c098d3b1e152c15f279fd69a5ccadf Mon Sep 17 00:00:00 2001
From: dtzp555 <dtzp555@gmail.com>
Date: Mon, 11 May 2026 06:54:12 +1000
Subject: [PATCH] fix(scripts): CLI entrypoint guard resilient to symlinked
 install paths
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug found via integration test on MacBook Pro (macOS /tmp → /private/tmp):
`import.meta.url === \`file://\${process.argv[1]}\`` evaluates false when
the install path traverses a symlink, because import.meta.url is canonicalised
but process.argv[1] is not. Result: ./ocp doctor (and ./ocp update via
upgrade.mjs) exit silently with code 0 and no output, instead of running.

Fix: use fileURLToPath + realpathSync on both sides of the comparison.
Affects any install at a symlinked path (/tmp, NFS mounts, /var/ paths,
docker bind mounts, etc.). Normal ~/ocp installs were unaffected.

No cli.js citation needed: this is OCP-internal CLI dispatch with no
corresponding cli.js operation.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 scripts/doctor.mjs  | 13 +++++++++++--
 scripts/upgrade.mjs | 12 ++++++++++--
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/scripts/doctor.mjs b/scripts/doctor.mjs
index 04ffd83..737bce1 100644
--- a/scripts/doctor.mjs
+++ b/scripts/doctor.mjs
@@ -178,8 +178,17 @@ export async function runDoctor(opts = {}) {
   };
 }
 
-// CLI entrypoint
-if (import.meta.url === `file://${process.argv[1]}`) {
+// CLI entrypoint — use fileURLToPath + realpath to handle symlinked install paths
+// (e.g. /tmp/ → /private/tmp/ on macOS would otherwise miss the guard).
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+function _isMain() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch { return false; }
+}
+if (_isMain()) {
   const wantJson = process.argv.includes("--json");
   const result = await runDoctor();
   if (wantJson) {
diff --git a/scripts/upgrade.mjs b/scripts/upgrade.mjs
index dea84bf..bc321a9 100644
--- a/scripts/upgrade.mjs
+++ b/scripts/upgrade.mjs
@@ -280,8 +280,16 @@ async function runRollback(opts) {
   return { path: "rollback", executed: true, changed: true, target: target.path, phases };
 }
 
-// CLI entrypoint
-if (import.meta.url === `file://${process.argv[1]}`) {
+// CLI entrypoint — use fileURLToPath + realpath to handle symlinked install paths.
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+function _isMain() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch { return false; }
+}
+if (_isMain()) {
   const args = process.argv.slice(2);
   const dryRun = args.includes("--dry-run");
   const yes = args.includes("--yes");