Fix CRLF bin e2e failing under npm 11 on macOS - #1896

Problem

e2e-macos (macos-latest, e2e_redirect_npm_build, 1) has failed on every run since #1805 (b73b080) landed on 2026-10-29 13:29 UTC:

• Nightly on main, 2026-10-30: https://github.com/SocketDev/socket-patch/actions/runs/41009903891/job/123915858524
• Dispatch on Build: share one test env guard in core (#1889) #1891 (unrelated change), 2026-10-30: https://github.com/SocketDev/socket-patch/actions/runs/41020866014/job/123951101092
• Last green run: nightly 2026-10-29 05:43, before Fix npm bin shebang on unlinked bins (#1804) #1805 (https://github.com/SocketDev/socket-patch/actions/runs/40824880386)

Both failures are the same assertion:

npm_agent_keeps_crlf_shebang_of_bin_npm_did_not_link panicked at e2e_redirect_npm_build.rs:1388:
bin/cli.js: npm left the shebang alone
  left:  "#!/usr/bin/env node\n..."   (LF shebang)
  right: "#!/usr/bin/env node\r\n..." (CRLF shebang)

This leg doesn't run on PRs or in the merge queue, so it doesn't block merges. But it keeps the nightly and every workflow_dispatch run red (ci-ok (macos only)), which hides new macOS regressions.

Root cause

The test's second case installs a directories.bin-only package from a file: tarball and assumes npm won't link the bin, so the CRLF shebang survives. That holds for npm 10 but not npm 11, which links bin/cli.js into node_modules/.bin and rewrites its shebang the way fixBin does. The e2e_redirect_npm_build legs have no setup-node step, so they use the runner image's npm: npm 10 on the Ubuntu legs (which pass) and npm 11 on macos-latest (which fails).

I reproduced it on Linux:

Fix

Test-only change. The test now checks whether npm linked the bin (node_modules/.bin/<name> exists):

• Not linked: expects the untouched CRLF bytes, as before.
• Linked: expects npm's rewritten bytes (NPM_BIN_BEFORE/NPM_BIN_AFTER, the same constants npm_agent_patches_crlf_shebang_bin_npm_rewrote uses).

In both cases it still checks apply, apply --check and a byte-exact rollback. A new assertion fails if --no-bin-links ever links the bin, so the unlinked #1804 path stays covered on every npm version. If npm linked the bin without rewriting it, or rewrote it without linking it, the test still fails. No assertions were removed.

Proof

• cargo test -p socket-patch-cli --test e2e_redirect_npm_build -- --ignored crlf (all 3 CRLF tests) passes with npm 10.9.4 and with npm 11.21.1.
• Ran npm_agent_keeps_crlf… 10 times under each npm version: 0 failures out of 20.
• cargo clippy -p socket-patch-cli --test e2e_redirect_npm_build -- -D warnings reports no new warnings. The only errors are two duplicate_mod lints that already fire on main for this test target; CI's clippy job doesn't build test targets.
• rustfmt run on the touched file only.

The macOS leg only runs on nightly and workflow_dispatch, so the next nightly will confirm the fix in CI.

Where tests run

Nothing removed or moved. The test still runs on the e2e Ubuntu leg (npm 10) and the nightly e2e-macos leg (npm 11).

Generated by Claude Code

Generated by Claude Code