fix(server): self-heal a non-executable bundled resource-monitor binary

[Exotic209093]

Summary

Fixes #7736. t3 serve on Linux/macOS logs `Resource monitor binary ... is not executable` and native process telemetry never starts. The published npm tarball ships `dist/resource-monitor/-/t3-resource-monitor` as `0644`.

The release workflow already runs `chmod +x` on these sidecars before publish (added 2026-07-29), so the CI-side fix in the issue's first suggestion is already in place — yet the published tarball still shows `0644`. That's because npm only preserves the executable bit for files listed in `package.json`'s `bin` field; any other file, including ours, gets re-packed without it regardless of its on-disk mode at pack time (the same class of issue as `node-pty`'s `spawn-helper`, referenced in the issue as #4924).

Fix

Since CI-side chmod can't survive npm's packing, this implements the issue's second suggested fix: `ResourceMonitorBinary.resolve` now repairs the executable bit at resolve time for binaries T3 bundles itself, instead of failing closed. A user-supplied override path (`T3CODE_RESOURCE_MONITOR_PATH` / config) is left untouched and still fails closed on a non-executable file — auto-chmod'ing an arbitrary path we didn't build isn't safe.

Test plan

• Added apps/server/src/resourceTelemetry/ResourceMonitorBinary.test.ts coverage that writes a bundled sidecar at 0644 and confirms resolve repairs it and returns the path.
• vp test run apps/server/src/resourceTelemetry — 50 passed (run under WSL/Linux; two pre-existing POSIX-mode tests in this suite don't reflect real chmod semantics on native Windows and were unaffected by this change).
• vp run --filter t3 typecheck — clean.
• vp lint on changed files — clean.

---

Note

Medium Risk
Adds a runtime chmod of bundled binaries on disk. Scope is limited to owned sidecar paths; overrides remain fail-closed, but this still mutates file modes at resolve time.

Overview
Fixes resource-monitor telemetry on Linux/macOS after npm packs bundled sidecars as 0644. ResourceMonitorBinary.resolve now chmods owned bundled binaries that lack the execute bit, then returns the path.

User-supplied override paths (T3CODE_RESOURCE_MONITOR_PATH / config) stay fail-closed so we never chmod an arbitrary file. Adds a test that writes a bundled sidecar at 0644 and asserts it is repaired.

^{Reviewed by Cursor Bugbot for commit 95949ed. Configure here.}

Note

Fix resourceMonitorBinary.make to self-heal non-executable bundled binary

Some npm package layouts strip the execute bit from the bundled resource-monitor binary, causing resolution to fail on Linux. When a bundled (owned) candidate exists but lacks any execute bit (mode & 0o111 == 0), the factory now chmods the file to add execute bits and succeeds, instead of returning ResourceMonitorBinaryNotExecutable.

• Candidate handling changed from string paths to objects { path, owned }, marking override candidates as owned: false and bundled candidates as owned: true
• Override candidates that lack the execute bit still fail with ResourceMonitorBinaryNotExecutable; only bundled binaries are auto-repaired
• Added a test in ResourceMonitorBinary.test.ts that writes a 0644 file and asserts resolve repairs the mode and returns the path
• Behavioral Change: previously a non-executable bundled binary returned an error; now it is silently chmod'd and succeeds. Only affects non-Windows platforms

^{Macroscope summarized 95949ed.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f78042c9-8a91-4579-8f8d-9aa9e0b0e070

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at 95949ed

Macroscope's review found this PR approvable — This is a straightforward bug fix that self-heals bundled binaries losing executable permissions during npm packaging. The change is well-scoped, includes proper security considerations (only modifying owned paths, not user-supplied ones), and has test coverage.

^{You can add or adjust custom eligibility rules. Learn more.}