refactor(build-infra): remove build-exec and use spawn directly

- Replace all exec/execCapture calls with direct spawn usage
- Add WIN32 and spawn imports to all affected files
- Remove build-exec.mjs dependency from build-infra helpers

Files updated:
- build-helpers.mjs: 5 exec/execCapture → spawn replacements
- cmake-builder.mjs: 3 exec → spawn replacements
- emscripten-builder.mjs: imports updated
- rust-builder.mjs: imports updated
- tool-installer.mjs: imports updated

Author: jdalton

packages/build-infra/lib/build-helpers.mjs

@@ -10,7 +10,9 @@ import path from 'node:path'
 
 import { whichBinSync } from '@socketsecurity/lib/bin'
 
-import { exec, execCapture } from './build-exec.mjs'
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
+import { spawn } from '@socketsecurity/lib/spawn'
+
 import { printError, printStep, printWarning } from './build-output.mjs'
 
 /**
@@ -24,8 +26,12 @@ export async function checkDiskSpace(dir, requiredGB = 5) {
   printStep('Checking disk space')
 
   try {
-    const { stdout } = await execCapture(`df -k "${dir}"`)
-    const lines = stdout.trim().split('\n')
+    const result = await spawn(`df -k "${dir}"`, [], {
+      shell: WIN32,
+      stdio: 'pipe',
+      stdioString: true,
+    })
+    const lines = (result.stdout ?? '').trim().split('\n')
     if (lines.length < 2) {
       printWarning('Could not determine disk space')
       return { availableGB: null, sufficient: true }
@@ -83,10 +89,12 @@ export async function checkPythonVersion(minVersion = '3.6') {
   printStep('Checking Python version')
 
   try {
-    const { stdout } = await execCapture(
-      'python3 -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')"'
+    const result = await spawn(
+      'python3 -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')"',
+      [],
+      { shell: WIN32, stdio: 'pipe', stdioString: true }
     )
-    const version = stdout.trim()
+    const version = (result.stdout ?? '').trim()
     const [major, minor] = version.split('.').map(Number)
     const [minMajor, minMinor] = minVersion.split('.').map(Number)
 
@@ -159,9 +167,13 @@ export async function smokeTestBinary(binaryPath, args = ['--version']) {
 
   try {
     await fs.access(binaryPath)
-    const { code } = await execCapture(`${binaryPath} ${args.join(' ')}`)
+    const result = await spawn(`${binaryPath} ${args.join(' ')}`, [], {
+      shell: WIN32,
+      stdio: 'pipe',
+      stdioString: true,
+    })
 
-    if (code !== 0) {
+    if ((result.status ?? 0) !== 0) {
       printError(`Binary failed smoke test: ${binaryPath}`)
       return false
     }
@@ -303,11 +315,13 @@ export async function cleanCheckpoint(buildDir) {
 export async function checkNetworkConnectivity() {
   try {
     // Try to reach GitHub (where we clone from).
-    const result = await execCapture(
-      'curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 https://github.com'
+    const result = await spawn(
+      'curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 https://github.com',
+      [],
+      { shell: WIN32, stdio: 'pipe', stdioString: true }
     )
 
-    const statusCode = result.stdout.trim()
+    const statusCode = (result.stdout ?? '').trim()
     return {
       connected:
         statusCode === '200' || statusCode === '301' || statusCode === '302',
@@ -326,12 +340,14 @@ export async function checkNetworkConnectivity() {
  */
 export async function verifyGitTag(version) {
   try {
-    const result = await execCapture(
-      `git ls-remote --tags https://github.com/nodejs/node.git ${version}`
+    const result = await spawn(
+      `git ls-remote --tags https://github.com/nodejs/node.git ${version}`,
+      [],
+      { shell: WIN32, stdio: 'pipe', stdioString: true }
     )
 
     return {
-      exists: result.stdout.includes(version),
+      exists: (result.stdout ?? '').includes(version),
       output: result.stdout,
     }
   } catch {

packages/build-infra/lib/cmake-builder.mjs

@@ -6,7 +6,9 @@
 
 import { cpus } from 'node:os'
 
-import { exec } from './build-exec.mjs'
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
+import { spawn } from '@socketsecurity/lib/spawn'
+
 import { printStep } from './build-output.mjs'
 
 export class CMakeBuilder {
@@ -28,9 +30,10 @@ export class CMakeBuilder {
       .map(([key, value]) => `-D${key}=${value}`)
       .join(' ')
 
-    await exec(
+    await spawn(
       `cmake -S ${this.sourceDir} -B ${this.buildDir} ${cmakeArgs}`,
-      { stdio: 'inherit' }
+      [],
+      { shell: WIN32, stdio: 'inherit' }
     )
   }
 
@@ -46,9 +49,10 @@ export class CMakeBuilder {
     printStep('Building with CMake')
 
     const jobs = parallel ? cpus().length : 1
-    await exec(
+    await spawn(
       `cmake --build ${this.buildDir} --target ${target} -j ${jobs}`,
-      { stdio: 'inherit' }
+      [],
+      { shell: WIN32, stdio: 'inherit' }
     )
   }
 
@@ -59,6 +63,10 @@ export class CMakeBuilder {
    */
   async clean() {
     printStep('Cleaning CMake build')
-    await exec(`cmake --build ${this.buildDir} --target clean`)
+    await spawn(
+      `cmake --build ${this.buildDir} --target clean`,
+      [],
+      { shell: WIN32, stdio: 'inherit' }
+    )
   }
 }

packages/build-infra/lib/emscripten-builder.mjs

@@ -7,7 +7,9 @@
 import { cpus } from 'node:os'
 import path from 'node:path'
 
-import { exec } from './build-exec.mjs'
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
+import { spawn } from '@socketsecurity/lib/spawn'
+// Removed exec from './build-exec.mjs'
 import { printStep } from './build-output.mjs'
 
 /**

packages/build-infra/lib/rust-builder.mjs

@@ -7,7 +7,9 @@
 import { cpus } from 'node:os'
 import path from 'node:path'
 
-import { exec } from './build-exec.mjs'
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
+import { spawn } from '@socketsecurity/lib/spawn'
+// Removed exec from './build-exec.mjs'
 import { printStep } from './build-output.mjs'
 
 /**

packages/build-infra/lib/tool-installer.mjs

@@ -9,7 +9,9 @@ import { WIN32 } from '@socketsecurity/lib/constants/platform'
 import { whichBinSync } from '@socketsecurity/lib/bin'
 import { spawn } from '@socketsecurity/lib/spawn'
 
-import { execCapture } from './build-exec.mjs'
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
+import { spawn } from '@socketsecurity/lib/spawn'
+// Removed execCapture from './build-exec.mjs'
 import { printError, printStep, printSubstep, printWarning } from './build-output.mjs'
 
 /**

packages/cli/package.json

@@ -75,6 +75,10 @@
     "wasm:download": "node scripts/wasm.mjs --download"
   },
   "devDependencies": {
+    "@babel/generator": "^7.28.5",
+    "@babel/parser": "7.28.4",
+    "@babel/traverse": "7.28.4",
+    "@babel/types": "^7.28.5",
     "@rollup/plugin-babel": "6.0.4",
     "@rollup/plugin-commonjs": "28.0.6",
     "@rollup/plugin-json": "6.1.0",

packages/cli/scripts/extract-yoga-wasm.mjs

@@ -24,10 +24,10 @@ const outputPath = path.join(rootPath, 'build/yoga-sync.mjs')
 
 // Source files from custom yoga-layout package.
 const yogaPackageRoot = path.join(rootPath, '../yoga-layout')
-const yogaWasmFile = path.join(yogaPackageRoot, 'build/yoga.wasm')
-const yogaJsFile = path.join(yogaPackageRoot, 'build/yoga.js')
+const yogaWasmFile = path.join(yogaPackageRoot, 'build/wasm/yoga.wasm')
+const yogaJsFile = path.join(yogaPackageRoot, 'build/wasm/yoga.js')
 
-// Check if extraction needed (hash ALL source files).
+// Check if extraction needed (hash both files).
 if (!await shouldExtract({
   sourcePaths: [yogaWasmFile, yogaJsFile],
   outputPath,
@@ -42,29 +42,51 @@ if (!await shouldExtract({
 const wasmBinary = readFileSync(yogaWasmFile)
 const base64Data = wasmBinary.toString('base64')
 
-// Compute source hash for cache validation (hashes all source files).
-const sourceHashComment = await generateHashComment([
-  yogaWasmFile,
-  yogaJsFile,
-])
+// Read our custom Emscripten loader (generated by our build).
+const yogaJsContent = readFileSync(yogaJsFile, 'utf-8')
+
+// Compute source hash for cache validation.
+const sourceHashComment = await generateHashComment([yogaWasmFile, yogaJsFile])
 
 logger.log(
   `✓ Extracted ${wasmBinary.length} bytes of WASM data from custom yoga-layout`,
 )
 
-// For now, just create a stub that will be replaced when yoga-layout is properly rebuilt with sync mode.
-// TODO: Once yoga-layout is rebuilt with WASM_ASYNC_COMPILATION=0, inline the synchronous loader.
+// Generate yoga-sync.mjs using OUR custom loader with OUR custom WASM.
 const yogaSyncContent = `/**
- * Synchronous yoga-layout stub.
+ * Synchronous yoga-layout with embedded WASM binary.
  *
  * This file is AUTO-GENERATED by scripts/extract-yoga-wasm.mjs
  * DO NOT EDIT MANUALLY - changes will be overwritten on next build.
  *
+ * Uses custom-built yoga-layout with Emscripten loader.
+ * Built with WASM_ASYNC_COMPILATION=0 for synchronous instantiation.
+ *
  * ${sourceHashComment}
  */
 
-// Stub - will be replaced with actual synchronous WASM wrapper once yoga-layout is rebuilt.
-export default {}
+// Inlined base64 WASM from custom yoga-layout (extracted at build time).
+const base64Wasm = '${base64Data}'
+
+// Decode base64 to Uint8Array.
+const wasmBinary = Uint8Array.from(atob(base64Wasm), c => c.charCodeAt(0))
+
+// Inlined Emscripten loader from custom yoga-layout build (no export statement).
+${yogaJsContent}
+
+// Synchronously initialize yoga with embedded WASM.
+const yoga = Module({
+  wasmBinary,
+  instantiateWasm(imports, successCallback) {
+    // Synchronously instantiate WASM module.
+    const module = new WebAssembly.Module(wasmBinary)
+    const instance = new WebAssembly.Instance(module, imports)
+    successCallback(instance, module)
+    return instance.exports
+  }
+})
+
+export default yoga
 `
 
 ensureOutputDir(outputPath)

packages/yoga-layout/scripts/build.mjs

@@ -131,21 +131,21 @@ async function configure() {
   ]
 
   const linkerFlags = [
-    '--closure 1', // Google Closure Compiler (aggressive minification).
+    '--closure=1', // Google Closure Compiler (aggressive minification).
     '--gc-sections', // Garbage collect unused sections.
     '-flto=thin',
     '-Oz',
-    '-s ALLOW_MEMORY_GROWTH=1', // Dynamic memory.
-    '-s ASSERTIONS=0', // No runtime assertions (smaller, faster).
-    '-s EXPORT_ES6=1', // ES6 module export.
-    '-s FILESYSTEM=0', // No filesystem support (smaller).
-    '-s INITIAL_MEMORY=64KB', // Minimal initial memory.
-    '-s MALLOC=emmalloc', // Smaller allocator.
-    '-s MODULARIZE=1', // Modular output.
-    '-s NO_EXIT_RUNTIME=1', // Keep runtime alive (needed for WASM).
-    '-s STACK_SIZE=16KB', // Small stack.
-    '-s SUPPORT_LONGJMP=0', // No longjmp (smaller).
-    '-s WASM_ASYNC_COMPILATION=0', // CRITICAL: Synchronous instantiation for bundling.
+    '-sALLOW_MEMORY_GROWTH=1', // Dynamic memory.
+    '-sASSERTIONS=0', // No runtime assertions (smaller, faster).
+    '-sEXPORT_ES6=1', // ES6 module export.
+    '-sFILESYSTEM=0', // No filesystem support (smaller).
+    '-sINITIAL_MEMORY=64KB', // Minimal initial memory.
+    '-sMALLOC=emmalloc', // Smaller allocator.
+    '-sMODULARIZE=1', // Modular output.
+    '-sNO_EXIT_RUNTIME=1', // Keep runtime alive (needed for WASM).
+    '-sSTACK_SIZE=16KB', // Small stack.
+    '-sSUPPORT_LONGJMP=0', // No longjmp (smaller).
+    '-sWASM_ASYNC_COMPILATION=0', // CRITICAL: Synchronous instantiation for bundling.
   ]
 
   const cmakeArgs = [
@@ -210,20 +210,20 @@ async function build() {
   ]
 
   const linkerFlags = [
-    '--closure 1',
+    '--closure=1',
     '-Wl,--gc-sections',
     '-flto=thin',
     '-Oz',
-    '-s ALLOW_MEMORY_GROWTH=1',
-    '-s ASSERTIONS=0',
-    '-s EXPORT_ES6=1',
-    '-s FILESYSTEM=0',
-    '-s INITIAL_MEMORY=64KB',
-    '-s MALLOC=emmalloc',
-    '-s MODULARIZE=1',
-    '-s NO_EXIT_RUNTIME=1',
-    '-s STACK_SIZE=16KB',
-    '-s SUPPORT_LONGJMP=0',
+    '-sALLOW_MEMORY_GROWTH=1',
+    '-sASSERTIONS=0',
+    '-sEXPORT_ES6=1',
+    '-sFILESYSTEM=0',
+    '-sINITIAL_MEMORY=64KB',
+    '-sMALLOC=emmalloc',
+    '-sMODULARIZE=1',
+    '-sNO_EXIT_RUNTIME=1',
+    '-sSTACK_SIZE=16KB',
+    '-sSUPPORT_LONGJMP=0',
     '--bind',
   ]
 
@@ -369,9 +369,12 @@ async function exportWasm() {
   // Copy WASM file.
   await fs.copyFile(wasmFile, outputWasm)
 
-  // Copy JS glue code if exists.
+  // Copy JS glue code and strip export statement.
   if (await fs.access(jsFile).then(() => true).catch(() => false)) {
-    await fs.copyFile(jsFile, outputJs)
+    const jsContent = await fs.readFile(jsFile, 'utf-8')
+    // Strip the export statement at the end of the file.
+    const withoutExport = jsContent.replace(/;?\s*export\s+default\s+\w+\s*;\s*$/, '')
+    await fs.writeFile(outputJs, withoutExport, 'utf-8')
     printStep(`JS: ${outputJs}`)
   }