mirror of
https://github.com/block/buzz.git
synced 2026-11-13 21:01:53 +00:00
debff9f3d8
Add hermit-managed shim scripts for uv/uvx/npx/node that provide config-isolated toolchain execution for MCP servers, preventing ambient system toolchains from leaking user config into agent processes. Security hardening: - Private mktemp temp dir with cleanup trap (no predictable paths) - Lock mutual exclusion via kill-0 + /proc start-time verification - Atomic bootstrap recovery (staged download + validated mv) - Desktop fail-loud validation of shim resources before env export Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
9 lines
328 B
Bash
Executable File
9 lines
328 B
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "${SCRIPT_DIR}/setup-common.sh" node
|
|
export NPM_CONFIG_USERCONFIG="${BUZZ_MCP_HERMIT_DIR}/empty-user-npmrc"
|
|
export NPM_CONFIG_GLOBALCONFIG="${BUZZ_MCP_HERMIT_DIR}/empty-global-npmrc"
|
|
export NPM_CONFIG_LOCATION=global
|
|
exec node "$@"
|