fix(npm): prevent fork bomb when binary missing

The wrapper script was spawning itself infinitely when the Rust binary
wasn't downloaded. Fixed by:

- Rename binary to claudev-bin (wrapper stays claudev)
- Add size check to detect invalid/missing binary
- postinstall.js now renames downloaded binary

Closes the infinite spawn loop that consumed 42GB of swap.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: 0xrinegade

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "claudev"
-version = "0.5.0"
+version = "0.5.1"
 edition = "2021"
 description = "Analyze AI coding assistant usage patterns, costs, and productivity"
 license = "MIT"

bin/claudev

@@ -5,11 +5,22 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
-const BINARY_NAME = 'claudev' + (os.platform() === 'win32' ? '.exe' : '');
+// Binary has different name to avoid spawning this wrapper script
+const BINARY_NAME = 'claudev-bin' + (os.platform() === 'win32' ? '.exe' : '');
 const binaryPath = path.join(__dirname, BINARY_NAME);
 
+// Prevent fork bomb: check if binary exists AND is not this script
+const thisScript = __filename;
 if (!fs.existsSync(binaryPath)) {
-  console.error('claudev: Binary not found. Run: npm install -g claudev');
+  console.error('claudev: Binary not found at', binaryPath);
+  console.error('claudev: Run: npm install -g claudev (or cargo install claudev)');
+  process.exit(1);
+}
+
+// Extra safety: verify it's actually an executable, not a script
+const stats = fs.statSync(binaryPath);
+if (stats.size < 10000) {
+  console.error('claudev: Binary appears invalid (too small). Reinstall with: npm install -g claudev');
   process.exit(1);
 }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudev",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Analyze AI coding assistant usage patterns, costs, and productivity",
   "keywords": [
     "ai",

scripts/postinstall.js

@@ -13,7 +13,8 @@ const { execFileSync } = require('child_process');
 
 const PACKAGE_VERSION = require('../package.json').version;
 const REPO = 'openSVM/vibedev';
-const BINARY_NAME = 'claudev';
+const BINARY_NAME = 'claudev';           // Name in GitHub releases
+const LOCAL_BINARY_NAME = 'claudev-bin'; // Local name to avoid fork bomb with wrapper
 const DOWNLOAD_TIMEOUT = 60000; // 60 seconds
 
 // Map Node.js platform/arch to Rust target triples
@@ -126,9 +127,10 @@ async function main() {
   }
 
   const binDir = path.join(__dirname, '..', 'bin');
-  const binaryPath = path.join(binDir, BINARY_NAME + getBinaryExtension());
+  const downloadedPath = path.join(binDir, BINARY_NAME + getBinaryExtension());
+  const localBinaryPath = path.join(binDir, LOCAL_BINARY_NAME + getBinaryExtension());
 
-  if (fs.existsSync(binaryPath)) {
+  if (fs.existsSync(localBinaryPath)) {
     console.log('claudev: Binary exists, skipping download');
     return;
   }
@@ -149,8 +151,13 @@ async function main() {
       extractTarGz(buffer, binDir);
     }
 
+    // Rename to local binary name to avoid fork bomb with wrapper script
+    if (fs.existsSync(downloadedPath)) {
+      fs.renameSync(downloadedPath, localBinaryPath);
+    }
+
     if (os.platform() !== 'win32') {
-      fs.chmodSync(binaryPath, 0o755);
+      fs.chmodSync(localBinaryPath, 0o755);
     }
 
     console.log('claudev: Installed successfully!');