From fbe8a069889b490891dffdda2555bd300dcb6ad3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 06:29:11 +0000
Subject: [PATCH 01/34] feat: add musl target support by disabling fspy-based
 input inference

fspy's LD_PRELOAD-based file tracking does not work with statically-linked
musl binaries. This disables fspy inference at execution time on musl targets
while keeping plan-level config consistent across all targets.

- Disable path_accesses tracking in execute_spawn when target_env is musl
- Add `requires_fspy` field to e2e test config to skip fspy-dependent tests
- Add dedicated musl test job (x86_64-unknown-linux-musl) in CI

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml                      | 28 +++++++++++++++++++
 crates/vite_task/src/session/execute/mod.rs   |  8 ++++--
 .../fixtures/input-cache-test/snapshots.toml  |  6 ++++
 .../snapshots.toml                            |  4 +++
 .../snapshots.toml                            |  4 +++
 .../fixtures/lint-dot-git/snapshots.toml      |  1 +
 .../vite_task_bin/tests/e2e_snapshots/main.rs |  9 ++++++
 7 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3f48649..2cd1acc9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -133,6 +133,33 @@ jobs:
       - run: cargo-zigbuild test --target x86_64-unknown-linux-gnu.2.17
         if: ${{ matrix.os == 'ubuntu-latest' }}
 
+  test-musl:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.code-changed == 'true'
+    name: Test (musl)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          submodules: true
+
+      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+        with:
+          save-cache: ${{ github.ref_name == 'main' }}
+          cache-key: test-musl
+
+      - run: rustup target add x86_64-unknown-linux-musl
+      - run: pip install cargo-zigbuild
+
+      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+
+      # `pnpm install` prepares test bins used in snapshot tests
+      # Must run after setup-node so correct native binaries are installed
+      - run: pnpm install
+
+      - run: cargo-zigbuild test --target x86_64-unknown-linux-musl
+
   fmt:
     name: Format and Check Deps
     runs-on: ubuntu-latest
@@ -168,6 +195,7 @@ jobs:
     needs:
       - clippy
       - test
+      - test-musl
       - fmt
     steps:
       - run: exit 1
diff --git a/crates/vite_task/src/session/execute/mod.rs b/crates/vite_task/src/session/execute/mod.rs
index c944f88d..07eefa75 100644
--- a/crates/vite_task/src/session/execute/mod.rs
+++ b/crates/vite_task/src/session/execute/mod.rs
@@ -316,10 +316,14 @@ pub async fn execute_spawn(
     //    - path_accesses: only tracked when includes_auto is true (fspy inference)
     let (mut std_outputs, mut path_accesses, cache_metadata_and_inputs) =
         cache_metadata.map_or((None, None, None), |cache_metadata| {
-            let path_accesses = if cache_metadata.input_config.includes_auto {
+            // On musl targets, fspy's LD_PRELOAD-based file tracking is not available
+            // because musl binaries are statically linked. Disable inference at execution
+            // time so that plan-level config (includes_auto) stays consistent across targets.
+            let fspy_available = !cfg!(target_env = "musl");
+            let path_accesses = if cache_metadata.input_config.includes_auto && fspy_available {
                 Some(TrackedPathAccesses::default())
             } else {
-                None // Skip fspy when inference is disabled
+                None // Skip fspy when inference is disabled or unavailable
             };
             (Some(Vec::new()), path_accesses, Some((cache_metadata, globbed_inputs)))
         });
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml
index 10294938..efc22a7c 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml
@@ -78,6 +78,7 @@ steps = [
 # - Files NOT read by the command do NOT trigger invalidation
 [[e2e]]
 name = "auto only - miss on inferred file change"
+requires_fspy = true
 steps = [
   # Initial run - reads src/main.ts
   "vt run auto-only",
@@ -89,6 +90,7 @@ steps = [
 
 [[e2e]]
 name = "auto only - hit on non-inferred file change"
+requires_fspy = true
 steps = [
   # Initial run - reads src/main.ts (NOT utils.ts)
   "vt run auto-only",
@@ -103,6 +105,7 @@ steps = [
 # - Files in excluded directories don't trigger invalidation even if read
 [[e2e]]
 name = "auto with negative - hit on excluded inferred file"
+requires_fspy = true
 steps = [
   # Initial run - reads both src/main.ts and dist/output.js
   "vt run auto-with-negative",
@@ -114,6 +117,7 @@ steps = [
 
 [[e2e]]
 name = "auto with negative - miss on non-excluded inferred file"
+requires_fspy = true
 steps = [
   # Initial run
   "vt run auto-with-negative",
@@ -139,6 +143,7 @@ steps = [
 
 [[e2e]]
 name = "positive auto negative - miss on inferred file"
+requires_fspy = true
 steps = [
   # Initial run
   "vt run positive-auto-negative",
@@ -189,6 +194,7 @@ steps = [
 # - FSPY is NOT set when fspy is disabled (explicit globs only)
 [[e2e]]
 name = "fspy env - set when auto inference enabled"
+requires_fspy = true
 steps = [
   # Run task with auto inference - should see FSPY=1
   "vt run check-fspy-env-with-auto",
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml
index fb3f32d2..44977481 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml
@@ -8,6 +8,7 @@
 # - Modifying dist/output.js should be a cache hit
 [[e2e]]
 name = "subpackage auto with negative - hit on excluded inferred file"
+requires_fspy = true
 steps = [
   # First run - reads both src/main.ts and dist/output.js
   "vt run sub-pkg#auto-with-negative",
@@ -19,6 +20,7 @@ steps = [
 
 [[e2e]]
 name = "subpackage auto with negative - miss on non-excluded inferred file"
+requires_fspy = true
 steps = [
   # First run
   "vt run sub-pkg#auto-with-negative",
@@ -79,6 +81,7 @@ steps = [
 # - Negative glob excludes sibling dist/ from inferred input
 [[e2e]]
 name = "dotdot auto negative - hit on excluded sibling inferred file"
+requires_fspy = true
 steps = [
   "vt run sub-pkg#dotdot-auto-negative",
   # Modify file in excluded sibling dist/
@@ -89,6 +92,7 @@ steps = [
 
 [[e2e]]
 name = "dotdot auto negative - miss on non-excluded sibling inferred file"
+requires_fspy = true
 steps = [
   "vt run sub-pkg#dotdot-auto-negative",
   # Modify non-excluded sibling file
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml
index 33301f5d..f0f1ef11 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml
@@ -4,22 +4,26 @@
 # Single rw-task: compact summary shows "not cached because it modified its input"
 [[e2e]]
 name = "single read-write task shows not cached message"
+requires_fspy = true
 cwd = "packages/rw-pkg"
 steps = ["vt run task", "vt run task"]
 
 # Multi-task (recursive): compact summary shows stats + InputModified notice
 [[e2e]]
 name = "multi task with read-write shows not cached in summary"
+requires_fspy = true
 steps = ["vt run -r task", "vt run -r task"]
 
 # Verbose: full summary shows the overlapping path
 [[e2e]]
 name = "verbose read-write task shows path in full summary"
+requires_fspy = true
 cwd = "packages/rw-pkg"
 steps = ["vt run -v task"]
 
 # Single O_RDWR open (touch-file) is also detected as read-write overlap
 [[e2e]]
 name = "single O_RDWR open is not cached"
+requires_fspy = true
 cwd = "packages/touch-pkg"
 steps = ["vt run task", "vt run task"]
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml
index 364c0dcc..f202b57f 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml
@@ -2,6 +2,7 @@
 
 [[e2e]]
 name = "lint dot git"
+requires_fspy = true
 steps = [
   "mkdir .git",
   "vt run lint # cache miss",
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/main.rs b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
index 47529395..734d8d59 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/main.rs
+++ b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
@@ -198,6 +198,9 @@ struct E2e {
     /// Optional platform filter: "unix" or "windows". If set, test only runs on that platform.
     #[serde(default)]
     pub platform: Option<Str>,
+    /// If true, the test requires fspy-based input inference and will be skipped on musl targets.
+    #[serde(default)]
+    pub requires_fspy: bool,
 }
 
 #[derive(serde::Deserialize, Default)]
@@ -313,6 +316,12 @@ fn run_case_inner(tmpdir: &AbsolutePath, fixture_path: &std::path::Path, fixture
             }
         }
 
+        // Skip fspy-dependent tests on musl targets where LD_PRELOAD-based tracking
+        // is not available.
+        if e2e.requires_fspy && cfg!(target_env = "musl") {
+            continue;
+        }
+
         let _info_guard = if e2e.cwd.as_str().is_empty() {
             None
         } else {

From 7501b6a9699d894dd845939ef44fc4285b30bd55 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 06:43:34 +0000
Subject: [PATCH 02/34] feat: add musl target support using seccomp-only
 tracking

On musl targets, LD_PRELOAD-based file tracking is not available because musl
does not support cdylib. Instead, always use seccomp+unotify for file access
tracking which works with all binary types.

- Exclude fspy_preload_unix from musl builds (cdylib not supported)
- Always use seccomp path in spawn/linux on musl (skip ELF/LD_PRELOAD check)
- Add dedicated test-musl CI job (x86_64-unknown-linux-musl)
- Temporarily disable other CI jobs for faster iteration

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml                      |  5 ++-
 crates/fspy/Cargo.toml                        |  4 +-
 crates/fspy/src/unix/mod.rs                   | 34 ++++++++++-----
 .../fspy_shared_unix/src/spawn/linux/mod.rs   | 42 +++++++++++--------
 4 files changed, 55 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cd1acc9..ffdc0df0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
 
   clippy:
     needs: detect-changes
-    if: needs.detect-changes.outputs.code-changed == 'true'
+    if: false # temporarily disabled
     name: Clippy
     runs-on: ubuntu-latest
     steps:
@@ -64,7 +64,7 @@ jobs:
 
   test:
     needs: detect-changes
-    if: needs.detect-changes.outputs.code-changed == 'true'
+    if: false # temporarily disabled
     name: Test
     strategy:
       fail-fast: false
@@ -161,6 +161,7 @@ jobs:
       - run: cargo-zigbuild test --target x86_64-unknown-linux-musl
 
   fmt:
+    if: false # temporarily disabled
     name: Format and Check Deps
     runs-on: ubuntu-latest
     steps:
diff --git a/crates/fspy/Cargo.toml b/crates/fspy/Cargo.toml
index 988a9888..abcc4b4c 100644
--- a/crates/fspy/Cargo.toml
+++ b/crates/fspy/Cargo.toml
@@ -28,8 +28,10 @@ fspy_seccomp_unotify = { workspace = true, features = ["supervisor"] }
 nix = { workspace = true, features = ["uio"] }
 tokio = { workspace = true, features = ["bytes"] }
 
-[target.'cfg(unix)'.dependencies]
+[target.'cfg(all(unix, not(target_env = "musl")))'.dependencies]
 fspy_preload_unix = { workspace = true }
+
+[target.'cfg(unix)'.dependencies]
 fspy_shared_unix = { workspace = true }
 nix = { workspace = true, features = ["fs", "process", "socket", "feature"] }
 
diff --git a/crates/fspy/src/unix/mod.rs b/crates/fspy/src/unix/mod.rs
index 96583f04..46b2e65f 100644
--- a/crates/fspy/src/unix/mod.rs
+++ b/crates/fspy/src/unix/mod.rs
@@ -36,25 +36,39 @@ pub struct SpyImpl {
     preload_path: Box<NativeStr>,
 }
 
+#[cfg(not(target_env = "musl"))]
 const PRELOAD_CDYLIB_BINARY: &[u8] = include_bytes!(env!("CARGO_CDYLIB_FILE_FSPY_PRELOAD_UNIX"));
 
 impl SpyImpl {
-    /// Initialize the fs access spy by writing the preload library on disk
+    /// Initialize the fs access spy by writing the preload library on disk.
+    ///
+    /// On musl targets, the preload library is not available (musl does not support cdylib),
+    /// so only seccomp-based tracking is used.
     pub fn init_in(dir: &Path) -> io::Result<Self> {
-        use const_format::formatcp;
-        use xxhash_rust::const_xxh3::xxh3_128;
+        #[cfg(not(target_env = "musl"))]
+        let preload_path = {
+            use const_format::formatcp;
+            use xxhash_rust::const_xxh3::xxh3_128;
 
-        use crate::artifact::Artifact;
+            use crate::artifact::Artifact;
 
-        const PRELOAD_CDYLIB: Artifact = Artifact {
-            name: "fspy_preload",
-            content: PRELOAD_CDYLIB_BINARY,
-            hash: formatcp!("{:x}", xxh3_128(PRELOAD_CDYLIB_BINARY)),
+            const PRELOAD_CDYLIB: Artifact = Artifact {
+                name: "fspy_preload",
+                content: PRELOAD_CDYLIB_BINARY,
+                hash: formatcp!("{:x}", xxh3_128(PRELOAD_CDYLIB_BINARY)),
+            };
+
+            let preload_cdylib_path = PRELOAD_CDYLIB.write_to(dir, ".dylib")?;
+            preload_cdylib_path.as_path().into()
         };
 
-        let preload_cdylib_path = PRELOAD_CDYLIB.write_to(dir, ".dylib")?;
+        // On musl, the preload cdylib is not compiled. Set an empty preload_path;
+        // fspy_shared_unix will detect musl and skip LD_PRELOAD injection.
+        #[cfg(target_env = "musl")]
+        let preload_path = Box::<NativeStr>::from("");
+
         Ok(Self {
-            preload_path: preload_cdylib_path.as_path().into(),
+            preload_path,
             #[cfg(target_os = "macos")]
             artifacts: {
                 let coreutils_path = macos_artifacts::COREUTILS_BINARY.write_to(dir, "")?;
diff --git a/crates/fspy_shared_unix/src/spawn/linux/mod.rs b/crates/fspy_shared_unix/src/spawn/linux/mod.rs
index 4d3faec7..502f5f0c 100644
--- a/crates/fspy_shared_unix/src/spawn/linux/mod.rs
+++ b/crates/fspy_shared_unix/src/spawn/linux/mod.rs
@@ -1,12 +1,14 @@
+#[cfg(not(target_env = "musl"))]
 use std::{ffi::OsStr, os::unix::ffi::OsStrExt as _, path::Path};
 
 use fspy_seccomp_unotify::{payload::SeccompPayload, target::install_target};
+#[cfg(not(target_env = "musl"))]
 use memmap2::Mmap;
 
+#[cfg(not(target_env = "musl"))]
+use crate::{elf, open_exec::open_executable};
 use crate::{
-    elf,
     exec::{Exec, ensure_env},
-    open_exec::open_executable,
     payload::{EncodedPayload, PAYLOAD_ENV_NAME},
 };
 
@@ -28,20 +30,26 @@ pub fn handle_exec(
     command: &mut Exec,
     encoded_payload: &EncodedPayload,
 ) -> nix::Result<Option<PreExec>> {
-    let executable_fd = open_executable(Path::new(OsStr::from_bytes(&command.program)))?;
-    // SAFETY: The file descriptor is valid and we only read from the mapping.
-    let executable_mmap = unsafe { Mmap::map(&executable_fd) }
-        .map_err(|io_error| nix::Error::try_from(io_error).unwrap_or(nix::Error::UnknownErrno))?;
-    if elf::is_dynamically_linked_to_libc(executable_mmap)? {
-        ensure_env(
-            &mut command.envs,
-            LD_PRELOAD,
-            encoded_payload.payload.preload_path.as_os_str().as_bytes(),
-        )?;
-        ensure_env(&mut command.envs, PAYLOAD_ENV_NAME, &encoded_payload.encoded_string)?;
-        Ok(None)
-    } else {
-        command.envs.retain(|(name, _)| name != LD_PRELOAD && name != PAYLOAD_ENV_NAME);
-        Ok(Some(PreExec(encoded_payload.payload.seccomp_payload.clone())))
+    // On musl targets, LD_PRELOAD is not available (cdylib not supported).
+    // Always use seccomp-based tracking instead.
+    #[cfg(not(target_env = "musl"))]
+    {
+        let executable_fd = open_executable(Path::new(OsStr::from_bytes(&command.program)))?;
+        // SAFETY: The file descriptor is valid and we only read from the mapping.
+        let executable_mmap = unsafe { Mmap::map(&executable_fd) }.map_err(|io_error| {
+            nix::Error::try_from(io_error).unwrap_or(nix::Error::UnknownErrno)
+        })?;
+        if elf::is_dynamically_linked_to_libc(executable_mmap)? {
+            ensure_env(
+                &mut command.envs,
+                LD_PRELOAD,
+                encoded_payload.payload.preload_path.as_os_str().as_bytes(),
+            )?;
+            ensure_env(&mut command.envs, PAYLOAD_ENV_NAME, &encoded_payload.encoded_string)?;
+            return Ok(None);
+        }
     }
+
+    command.envs.retain(|(name, _)| name != LD_PRELOAD && name != PAYLOAD_ENV_NAME);
+    Ok(Some(PreExec(encoded_payload.payload.seccomp_payload.clone())))
 }

From 16239f282862f28d7119d15a9cd5a8f6e4a5b0cb Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 07:09:51 +0000
Subject: [PATCH 03/34] feat: add musl target support using seccomp-only
 tracking

On musl targets, LD_PRELOAD-based file tracking is not available because musl
does not support cdylib. Instead, always use seccomp+unotify for file access
tracking which works with all binary types.

Changes:
- Exclude fspy_preload_unix from musl builds (cdylib not supported)
- Remove preload_path field from Payload on musl
- Always use seccomp path in spawn/linux on musl (skip ELF/LD_PRELOAD check)
- Fix ioctl request type mismatch (c_ulong vs Ioctl) for musl compatibility
- Add statx, access, faccessat, faccessat2 syscall handlers to seccomp filter
  for complete file access tracking without LD_PRELOAD
- Add dedicated test-musl CI job (x86_64-unknown-linux-musl)

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml                      | 22 ++++++++++---
 crates/fspy/src/unix/mod.rs                   |  8 ++---
 crates/fspy/src/unix/syscall_handler/mod.rs   |  5 +++
 crates/fspy/src/unix/syscall_handler/stat.rs  | 33 +++++++++++++++++++
 crates/fspy_preload_unix/src/lib.rs           | 10 ++++--
 .../fspy_seccomp_unotify/src/bindings/mod.rs  |  2 +-
 .../src/supervisor/listener.rs                |  2 +-
 crates/fspy_shared_unix/src/payload.rs        |  1 +
 8 files changed, 69 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ffdc0df0..47172f3c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
 
   clippy:
     needs: detect-changes
-    if: false # temporarily disabled
+    if: needs.detect-changes.outputs.code-changed == 'true'
     name: Clippy
     runs-on: ubuntu-latest
     steps:
@@ -64,7 +64,7 @@ jobs:
 
   test:
     needs: detect-changes
-    if: false # temporarily disabled
+    if: needs.detect-changes.outputs.code-changed == 'true'
     name: Test
     strategy:
       fail-fast: false
@@ -158,10 +158,24 @@ jobs:
       # Must run after setup-node so correct native binaries are installed
       - run: pnpm install
 
-      - run: cargo-zigbuild test --target x86_64-unknown-linux-musl
+      # Exclude fspy's own integration tests (rust_std, node_fs) on musl.
+      # These tests spawn subprocess from the test binary itself which conflicts
+      # with seccomp supervisor when both parent and child are musl binaries.
+      # The e2e tests cover fspy tracking through the full vt CLI pipeline.
+      # Exclude fspy* crate unit tests on musl — their subprocess-based tests
+      # conflict with seccomp supervisor when parent and child are both musl
+      # binaries, and IPC shared memory tests use file locking that differs on musl.
+      # The vite_task e2e tests still exercise fspy tracking end-to-end.
+      - run: >-
+          cargo-zigbuild test --target x86_64-unknown-linux-musl
+          --workspace
+          --exclude fspy
+          --exclude fspy_shared
+          --exclude fspy_shared_unix
+          --exclude fspy_seccomp_unotify
+          --exclude fspy_e2e
 
   fmt:
-    if: false # temporarily disabled
     name: Format and Check Deps
     runs-on: ubuntu-latest
     steps:
diff --git a/crates/fspy/src/unix/mod.rs b/crates/fspy/src/unix/mod.rs
index 46b2e65f..f567b9c4 100644
--- a/crates/fspy/src/unix/mod.rs
+++ b/crates/fspy/src/unix/mod.rs
@@ -33,6 +33,7 @@ pub struct SpyImpl {
     #[cfg(target_os = "macos")]
     artifacts: Artifacts,
 
+    #[cfg(not(target_env = "musl"))]
     preload_path: Box<NativeStr>,
 }
 
@@ -62,12 +63,8 @@ impl SpyImpl {
             preload_cdylib_path.as_path().into()
         };
 
-        // On musl, the preload cdylib is not compiled. Set an empty preload_path;
-        // fspy_shared_unix will detect musl and skip LD_PRELOAD injection.
-        #[cfg(target_env = "musl")]
-        let preload_path = Box::<NativeStr>::from("");
-
         Ok(Self {
+            #[cfg(not(target_env = "musl"))]
             preload_path,
             #[cfg(target_os = "macos")]
             artifacts: {
@@ -94,6 +91,7 @@ impl SpyImpl {
             #[cfg(target_os = "macos")]
             artifacts: self.artifacts.clone(),
 
+            #[cfg(not(target_env = "musl"))]
             preload_path: self.preload_path.clone(),
 
             #[cfg(target_os = "linux")]
diff --git a/crates/fspy/src/unix/syscall_handler/mod.rs b/crates/fspy/src/unix/syscall_handler/mod.rs
index bfed7d94..4b6f7947 100644
--- a/crates/fspy/src/unix/syscall_handler/mod.rs
+++ b/crates/fspy/src/unix/syscall_handler/mod.rs
@@ -92,6 +92,11 @@ impl_handler!(
     #[cfg(target_arch = "x86_64")] lstat,
     #[cfg(target_arch = "x86_64")] newfstatat,
     #[cfg(target_arch = "aarch64")] fstatat,
+    statx,
+
+    #[cfg(target_arch = "x86_64")] access,
+    faccessat,
+    faccessat2,
 
     execve,
     execveat,
diff --git a/crates/fspy/src/unix/syscall_handler/stat.rs b/crates/fspy/src/unix/syscall_handler/stat.rs
index ae7da893..40d9f76f 100644
--- a/crates/fspy/src/unix/syscall_handler/stat.rs
+++ b/crates/fspy/src/unix/syscall_handler/stat.rs
@@ -32,4 +32,37 @@ impl SyscallHandler {
     ) -> io::Result<()> {
         self.handle_open(caller, dir_fd, path_ptr, libc::O_RDONLY)
     }
+
+    /// statx(2) — modern replacement for stat/fstatat used by newer glibc.
+    pub(super) fn statx(
+        &mut self,
+        caller: Caller,
+        (dir_fd, path_ptr): (Fd, CStrPtr),
+    ) -> io::Result<()> {
+        self.handle_open(caller, dir_fd, path_ptr, libc::O_RDONLY)
+    }
+
+    /// access(2) — check file accessibility (e.g. existsSync in Node.js).
+    #[cfg(target_arch = "x86_64")]
+    pub(super) fn access(&mut self, caller: Caller, (path,): (CStrPtr,)) -> io::Result<()> {
+        self.handle_open(caller, Fd::cwd(), path, libc::O_RDONLY)
+    }
+
+    /// faccessat(2) — check file accessibility relative to directory fd.
+    pub(super) fn faccessat(
+        &mut self,
+        caller: Caller,
+        (dir_fd, path_ptr): (Fd, CStrPtr),
+    ) -> io::Result<()> {
+        self.handle_open(caller, dir_fd, path_ptr, libc::O_RDONLY)
+    }
+
+    /// faccessat2(2) — extended faccessat with flags parameter.
+    pub(super) fn faccessat2(
+        &mut self,
+        caller: Caller,
+        (dir_fd, path_ptr): (Fd, CStrPtr),
+    ) -> io::Result<()> {
+        self.handle_open(caller, dir_fd, path_ptr, libc::O_RDONLY)
+    }
 }
diff --git a/crates/fspy_preload_unix/src/lib.rs b/crates/fspy_preload_unix/src/lib.rs
index 2e5a6b5b..8479df0d 100644
--- a/crates/fspy_preload_unix/src/lib.rs
+++ b/crates/fspy_preload_unix/src/lib.rs
@@ -1,8 +1,12 @@
-#![cfg(unix)]
-// required for defining inteposed `open`/`openat`(https://man7.org/linux/man-pages/man2/open.2.html)
-#![feature(c_variadic)]
+// On musl targets, fspy_preload_unix is not usable (musl does not support cdylib/LD_PRELOAD).
+// Compile as an empty crate to avoid build failures from missing libc symbols.
+#![cfg_attr(not(target_env = "musl"), feature(c_variadic))]
 
+#[cfg(all(unix, not(target_env = "musl")))]
 mod client;
+#[cfg(all(unix, not(target_env = "musl")))]
 mod interceptions;
+#[cfg(all(unix, not(target_env = "musl")))]
 mod libc;
+#[cfg(all(unix, not(target_env = "musl")))]
 mod macros;
diff --git a/crates/fspy_seccomp_unotify/src/bindings/mod.rs b/crates/fspy_seccomp_unotify/src/bindings/mod.rs
index cd8e7b2e..b6461a4f 100644
--- a/crates/fspy_seccomp_unotify/src/bindings/mod.rs
+++ b/crates/fspy_seccomp_unotify/src/bindings/mod.rs
@@ -45,7 +45,7 @@ pub fn notif_recv(
     notif_buf: &mut Alloced<libc::seccomp_notif>,
 ) -> nix::Result<()> {
     use std::os::fd::AsRawFd;
-    const SECCOMP_IOCTL_NOTIF_RECV: libc::c_ulong = 3_226_476_800;
+    const SECCOMP_IOCTL_NOTIF_RECV: libc::Ioctl = 3_226_476_800u64 as libc::Ioctl;
     // SAFETY: `notif_buf.zeroed()` returns a valid mutable pointer to a zeroed
     // `seccomp_notif` buffer with sufficient size for the kernel's notification struct
     let ret = unsafe {
diff --git a/crates/fspy_seccomp_unotify/src/supervisor/listener.rs b/crates/fspy_seccomp_unotify/src/supervisor/listener.rs
index 165949f2..0de6f89f 100644
--- a/crates/fspy_seccomp_unotify/src/supervisor/listener.rs
+++ b/crates/fspy_seccomp_unotify/src/supervisor/listener.rs
@@ -30,7 +30,7 @@ impl AsFd for NotifyListener {
     }
 }
 
-const SECCOMP_IOCTL_NOTIF_SEND: libc::c_ulong = 3_222_806_785;
+const SECCOMP_IOCTL_NOTIF_SEND: libc::Ioctl = 3_222_806_785u64 as libc::Ioctl;
 
 impl NotifyListener {
     /// Sends a `SECCOMP_USER_NOTIF_FLAG_CONTINUE` response for the given request ID.
diff --git a/crates/fspy_shared_unix/src/payload.rs b/crates/fspy_shared_unix/src/payload.rs
index d7369d0d..476fe8aa 100644
--- a/crates/fspy_shared_unix/src/payload.rs
+++ b/crates/fspy_shared_unix/src/payload.rs
@@ -9,6 +9,7 @@ use fspy_shared::ipc::{NativeStr, channel::ChannelConf};
 pub struct Payload {
     pub ipc_channel_conf: ChannelConf,
 
+    #[cfg(not(target_env = "musl"))]
     pub preload_path: Box<NativeStr>,
 
     #[cfg(target_os = "macos")]

From 2c4a29e2567b1b5c89a1205f28db7466e771f02e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 07:45:10 +0000
Subject: [PATCH 04/34] fix: run musl CI tests in Alpine container for native
 musl support

Use an Alpine Linux container for the musl test job so tests run with
musl as the native libc. This avoids cross-compilation issues with
static musl binaries where ctor's .init_array entries are dropped.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 41 +++++++++++++---------------------------
 1 file changed, 13 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 47172f3c..a7ba091c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -138,42 +138,27 @@ jobs:
     if: needs.detect-changes.outputs.code-changed == 'true'
     name: Test (musl)
     runs-on: ubuntu-latest
+    container: alpine:3.21
     steps:
+      - name: Install Alpine dependencies
+        run: apk add --no-cache bash curl git musl-dev gcc g++ nodejs npm python3
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           submodules: true
 
-      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
-        with:
-          save-cache: ${{ github.ref_name == 'main' }}
-          cache-key: test-musl
-
-      - run: rustup target add x86_64-unknown-linux-musl
-      - run: pip install cargo-zigbuild
-
-      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+      - name: Install Rust
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly-2026-03-05
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
-      # `pnpm install` prepares test bins used in snapshot tests
-      # Must run after setup-node so correct native binaries are installed
-      - run: pnpm install
+      - name: Install pnpm and Node tools
+        run: |
+          npm install -g pnpm
+          pnpm install
 
-      # Exclude fspy's own integration tests (rust_std, node_fs) on musl.
-      # These tests spawn subprocess from the test binary itself which conflicts
-      # with seccomp supervisor when both parent and child are musl binaries.
-      # The e2e tests cover fspy tracking through the full vt CLI pipeline.
-      # Exclude fspy* crate unit tests on musl — their subprocess-based tests
-      # conflict with seccomp supervisor when parent and child are both musl
-      # binaries, and IPC shared memory tests use file locking that differs on musl.
-      # The vite_task e2e tests still exercise fspy tracking end-to-end.
-      - run: >-
-          cargo-zigbuild test --target x86_64-unknown-linux-musl
-          --workspace
-          --exclude fspy
-          --exclude fspy_shared
-          --exclude fspy_shared_unix
-          --exclude fspy_seccomp_unotify
-          --exclude fspy_e2e
+      - run: cargo test
 
   fmt:
     name: Format and Check Deps

From cd6b0d37383f696d7ec25f81c078d8c57fdd8404 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 07:48:35 +0000
Subject: [PATCH 05/34] fix: use sh shell for Alpine apk install step (bash not
 yet available)

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7ba091c..887a6a94 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -141,6 +141,7 @@ jobs:
     container: alpine:3.21
     steps:
       - name: Install Alpine dependencies
+        shell: sh {0}
         run: apk add --no-cache bash curl git musl-dev gcc g++ nodejs npm python3
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

From 4662e4785b695d811ba81aa8cc00fa17729cba04 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 07:51:35 +0000
Subject: [PATCH 06/34] fix: override musl linker in Alpine container to use
 system cc

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 887a6a94..75dbe715 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -159,7 +159,11 @@ jobs:
           npm install -g pnpm
           pnpm install
 
+      # Override the musl linker from .cargo/config.toml — in Alpine, the system
+      # cc is already musl-based, so no zig wrapper is needed.
       - run: cargo test
+        env:
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: cc
 
   fmt:
     name: Format and Check Deps

From 6895766775420d2b7becbcf145954dea1e1e7117 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 07:54:56 +0000
Subject: [PATCH 07/34] fix: override musl rustflags to remove zig linker in
 Alpine

The .cargo/config.toml sets rustflags with a zig linker wrapper for musl
targets. Override via env var to use the system cc in Alpine.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 75dbe715..e567eb7c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -161,9 +161,10 @@ jobs:
 
       # Override the musl linker from .cargo/config.toml — in Alpine, the system
       # cc is already musl-based, so no zig wrapper is needed.
+      # Also include the build-level rustflags that get replaced by the override.
       - run: cargo test
         env:
-          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: cc
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS: --cfg tokio_unstable -D warnings
 
   fmt:
     name: Format and Check Deps

From c63e5b2bfd5367d823192ccb2f8b6e20eccf6e13 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 08:00:36 +0000
Subject: [PATCH 08/34] fix: remove zig linker config for native musl build in
 Alpine

Use sed to strip musl target linker config from .cargo/config.toml
since Alpine's system cc is already musl-based.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e567eb7c..ff2e72a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -159,12 +159,12 @@ jobs:
           npm install -g pnpm
           pnpm install
 
-      # Override the musl linker from .cargo/config.toml — in Alpine, the system
-      # cc is already musl-based, so no zig wrapper is needed.
-      # Also include the build-level rustflags that get replaced by the override.
+      # Remove the zig linker wrapper from .cargo/config.toml — in Alpine, the
+      # system cc is already musl-based, so no cross-compilation linker is needed.
+      - name: Remove zig linker config for native musl
+        run: sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
+
       - run: cargo test
-        env:
-          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS: --cfg tokio_unstable -D warnings
 
   fmt:
     name: Format and Check Deps

From a15de2d50935009051c27d1a060a8e2f350cbc6f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 08:08:29 +0000
Subject: [PATCH 09/34] fix: gate unused imports behind cfg(not(target_env =
 "musl"))

NativeStr and ensure_env are only used in the LD_PRELOAD code path.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 crates/fspy_shared_unix/src/payload.rs         | 4 +++-
 crates/fspy_shared_unix/src/spawn/linux/mod.rs | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/crates/fspy_shared_unix/src/payload.rs b/crates/fspy_shared_unix/src/payload.rs
index 476fe8aa..e23f7ce0 100644
--- a/crates/fspy_shared_unix/src/payload.rs
+++ b/crates/fspy_shared_unix/src/payload.rs
@@ -3,7 +3,9 @@ use std::os::unix::ffi::OsStringExt;
 use base64::{Engine as _, prelude::BASE64_STANDARD_NO_PAD};
 use bincode::{Decode, Encode, config::standard};
 use bstr::BString;
-use fspy_shared::ipc::{NativeStr, channel::ChannelConf};
+#[cfg(not(target_env = "musl"))]
+use fspy_shared::ipc::NativeStr;
+use fspy_shared::ipc::channel::ChannelConf;
 
 #[derive(Debug, Encode, Decode)]
 pub struct Payload {
diff --git a/crates/fspy_shared_unix/src/spawn/linux/mod.rs b/crates/fspy_shared_unix/src/spawn/linux/mod.rs
index 502f5f0c..0632999d 100644
--- a/crates/fspy_shared_unix/src/spawn/linux/mod.rs
+++ b/crates/fspy_shared_unix/src/spawn/linux/mod.rs
@@ -6,9 +6,9 @@ use fspy_seccomp_unotify::{payload::SeccompPayload, target::install_target};
 use memmap2::Mmap;
 
 #[cfg(not(target_env = "musl"))]
-use crate::{elf, open_exec::open_executable};
+use crate::{elf, exec::ensure_env, open_exec::open_executable};
 use crate::{
-    exec::{Exec, ensure_env},
+    exec::Exec,
     payload::{EncodedPayload, PAYLOAD_ENV_NAME},
 };
 

From 0f12daa7feedf27a09be747dea0f49fd8a5082bc Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 08:16:31 +0000
Subject: [PATCH 10/34] fix: gate artifact module and NativeStr import for musl

On musl, the artifact module (preload library writing) and NativeStr
import are unused since LD_PRELOAD is not available.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 crates/fspy/src/lib.rs      | 2 ++
 crates/fspy/src/unix/mod.rs | 6 ++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/crates/fspy/src/lib.rs b/crates/fspy/src/lib.rs
index cfcdb78c..918e1e35 100644
--- a/crates/fspy/src/lib.rs
+++ b/crates/fspy/src/lib.rs
@@ -2,6 +2,8 @@
 #![feature(once_cell_try)]
 
 // Persist the injected DLL/shared library somewhere in the filesystem.
+// Not needed on musl where LD_PRELOAD is unavailable (seccomp-only tracking).
+#[cfg(not(target_env = "musl"))]
 mod artifact;
 
 pub mod error;
diff --git a/crates/fspy/src/unix/mod.rs b/crates/fspy/src/unix/mod.rs
index f567b9c4..bfc4c0ec 100644
--- a/crates/fspy/src/unix/mod.rs
+++ b/crates/fspy/src/unix/mod.rs
@@ -8,7 +8,9 @@ use std::{io, path::Path};
 
 #[cfg(target_os = "linux")]
 use fspy_seccomp_unotify::supervisor::supervise;
-use fspy_shared::ipc::{NativeStr, PathAccess, channel::channel};
+#[cfg(not(target_env = "musl"))]
+use fspy_shared::ipc::NativeStr;
+use fspy_shared::ipc::{PathAccess, channel::channel};
 #[cfg(target_os = "macos")]
 use fspy_shared_unix::payload::Artifacts;
 use fspy_shared_unix::{
@@ -45,7 +47,7 @@ impl SpyImpl {
     ///
     /// On musl targets, the preload library is not available (musl does not support cdylib),
     /// so only seccomp-based tracking is used.
-    pub fn init_in(dir: &Path) -> io::Result<Self> {
+    pub fn init_in(#[cfg_attr(target_env = "musl", allow(unused))] dir: &Path) -> io::Result<Self> {
         #[cfg(not(target_env = "musl"))]
         let preload_path = {
             use const_format::formatcp;

From d204e1854802b1fb9a7deec9c8bd71789d7c05b5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 08:32:00 +0000
Subject: [PATCH 11/34] fix: replace ctor-in-macro with linkme + crate-level
 ctor for musl

The ctor crate's #[ctor] inside macro expansions doesn't work on musl
targets because the .init_array entry is dropped by the linker.

Replace with a two-part approach:
- Use linkme distributed_slice to register subprocess handlers (works
  reliably on all targets since it uses custom linker sections)
- Use a crate-level subprocess_dispatch_ctor!() macro that each test
  crate calls at crate scope (not inside a function) for the #[ctor]
  dispatcher

Each crate that uses command_for_fn! must now also call
subprocess_dispatch_ctor!() at crate scope.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 Cargo.lock                                  | 25 ++++++++
 Cargo.toml                                  |  1 +
 crates/fspy/Cargo.toml                      |  3 +-
 crates/fspy/tests/test_utils/mod.rs         |  2 +
 crates/fspy_shared/Cargo.toml               |  1 +
 crates/fspy_shared/src/ipc/channel/mod.rs   |  3 +
 crates/pty_terminal/Cargo.toml              |  3 +-
 crates/pty_terminal/tests/terminal.rs       |  2 +
 crates/pty_terminal_test/Cargo.toml         |  3 +-
 crates/pty_terminal_test/tests/milestone.rs |  2 +
 crates/subprocess_test/Cargo.toml           |  1 +
 crates/subprocess_test/src/lib.rs           | 67 +++++++++++++++++++--
 12 files changed, 105 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cc0b85be..e909a0af 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1166,6 +1166,7 @@ dependencies = [
  "fspy_test_bin",
  "futures-util",
  "libc",
+ "linkme",
  "nix 0.30.1",
  "ouroboros",
  "rand 0.9.2",
@@ -1262,6 +1263,7 @@ dependencies = [
  "bstr",
  "bytemuck",
  "ctor",
+ "linkme",
  "os_str_bytes",
  "rustc-hash",
  "shared_memory",
@@ -1749,6 +1751,26 @@ dependencies = [
  "bitflags 2.10.0",
 ]
 
+[[package]]
+name = "linkme"
+version = "0.3.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e3283ed2d0e50c06dd8602e0ab319bb048b6325d0bba739db64ed8205179898"
+dependencies = [
+ "linkme-impl",
+]
+
+[[package]]
+name = "linkme-impl"
+version = "0.3.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5cec0ec4228b4853bb129c84dbf093a27e6c7a20526da046defc334a1b017f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -2527,6 +2549,7 @@ dependencies = [
  "anyhow",
  "ctor",
  "ctrlc",
+ "linkme",
  "ntest",
  "portable-pty",
  "signal-hook",
@@ -2542,6 +2565,7 @@ dependencies = [
  "anyhow",
  "crossterm",
  "ctor",
+ "linkme",
  "ntest",
  "portable-pty",
  "pty_terminal",
@@ -3206,6 +3230,7 @@ dependencies = [
  "bincode",
  "ctor",
  "fspy",
+ "linkme",
  "portable-pty",
  "rustc-hash",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 624cf584..cf0917a2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -71,6 +71,7 @@ diff-struct = "0.5.3"
 directories = "6.0.0"
 elf = { version = "0.8.0", default-features = false }
 flate2 = "1.0.35"
+linkme = "0.3"
 fspy = { path = "crates/fspy" }
 fspy_detours_sys = { path = "crates/fspy_detours_sys" }
 fspy_preload_unix = { path = "crates/fspy_preload_unix", artifact = "cdylib" }
diff --git a/crates/fspy/Cargo.toml b/crates/fspy/Cargo.toml
index abcc4b4c..a17e9c0f 100644
--- a/crates/fspy/Cargo.toml
+++ b/crates/fspy/Cargo.toml
@@ -48,6 +48,7 @@ tempfile = { workspace = true }
 anyhow = { workspace = true }
 csv-async = { workspace = true }
 ctor = { workspace = true }
+linkme = { workspace = true }
 subprocess_test = { workspace = true, features = ["fspy"] }
 test-log = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "fs", "io-std"] }
@@ -71,4 +72,4 @@ workspace = true
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor", "fspy_test_bin"]
+ignored = ["ctor", "linkme", "fspy_test_bin"]
diff --git a/crates/fspy/tests/test_utils/mod.rs b/crates/fspy/tests/test_utils/mod.rs
index 20e7a2c4..4d4e9314 100644
--- a/crates/fspy/tests/test_utils/mod.rs
+++ b/crates/fspy/tests/test_utils/mod.rs
@@ -1,3 +1,5 @@
+subprocess_test::subprocess_dispatch_ctor!();
+
 use std::path::{Path, PathBuf, StripPrefixError};
 
 use fspy::{AccessMode, PathAccessIterable};
diff --git a/crates/fspy_shared/Cargo.toml b/crates/fspy_shared/Cargo.toml
index cc63d9cf..5eba127c 100644
--- a/crates/fspy_shared/Cargo.toml
+++ b/crates/fspy_shared/Cargo.toml
@@ -23,6 +23,7 @@ winapi = { workspace = true, features = ["std"] }
 [dev-dependencies]
 assert2 = { workspace = true }
 ctor = { workspace = true }
+linkme = { workspace = true }
 rustc-hash = { workspace = true }
 shared_memory = { workspace = true, features = ["logging"] }
 subprocess_test = { workspace = true }
diff --git a/crates/fspy_shared/src/ipc/channel/mod.rs b/crates/fspy_shared/src/ipc/channel/mod.rs
index 3e67cea8..d34ed73a 100644
--- a/crates/fspy_shared/src/ipc/channel/mod.rs
+++ b/crates/fspy_shared/src/ipc/channel/mod.rs
@@ -183,6 +183,9 @@ impl<'a> Deref for ReceiverLockGuard<'a> {
     }
 }
 
+#[cfg(test)]
+subprocess_test::subprocess_dispatch_ctor!();
+
 #[cfg(test)]
 mod tests {
     use std::{num::NonZeroUsize, str::from_utf8};
diff --git a/crates/pty_terminal/Cargo.toml b/crates/pty_terminal/Cargo.toml
index 7bec6fc9..2320ea30 100644
--- a/crates/pty_terminal/Cargo.toml
+++ b/crates/pty_terminal/Cargo.toml
@@ -15,6 +15,7 @@ vt100 = { workspace = true }
 [dev-dependencies]
 ctor = { workspace = true }
 ctrlc = { workspace = true }
+linkme = { workspace = true }
 ntest = "0.9.5"
 subprocess_test = { workspace = true, features = ["portable-pty"] }
 terminal_size = "0.4"
@@ -30,4 +31,4 @@ test = false
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor"]
+ignored = ["ctor", "linkme"]
diff --git a/crates/pty_terminal/tests/terminal.rs b/crates/pty_terminal/tests/terminal.rs
index 44489124..c91e459d 100644
--- a/crates/pty_terminal/tests/terminal.rs
+++ b/crates/pty_terminal/tests/terminal.rs
@@ -1,3 +1,5 @@
+subprocess_test::subprocess_dispatch_ctor!();
+
 use std::{
     io::{BufRead, BufReader, IsTerminal, Read, Write, stderr, stdin, stdout},
     time::{Duration, Instant},
diff --git a/crates/pty_terminal_test/Cargo.toml b/crates/pty_terminal_test/Cargo.toml
index a830d4b8..04b13d65 100644
--- a/crates/pty_terminal_test/Cargo.toml
+++ b/crates/pty_terminal_test/Cargo.toml
@@ -16,6 +16,7 @@ pty_terminal_test_client = { workspace = true }
 [dev-dependencies]
 crossterm = { workspace = true }
 ctor = { workspace = true }
+linkme = { workspace = true }
 ntest = "0.9.5"
 pty_terminal_test_client = { workspace = true, features = ["testing"] }
 subprocess_test = { workspace = true, features = ["portable-pty"] }
@@ -28,4 +29,4 @@ test = false
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor"]
+ignored = ["ctor", "linkme"]
diff --git a/crates/pty_terminal_test/tests/milestone.rs b/crates/pty_terminal_test/tests/milestone.rs
index e878e069..bbea8170 100644
--- a/crates/pty_terminal_test/tests/milestone.rs
+++ b/crates/pty_terminal_test/tests/milestone.rs
@@ -1,3 +1,5 @@
+subprocess_test::subprocess_dispatch_ctor!();
+
 use std::io::Write;
 
 use ntest::timeout;
diff --git a/crates/subprocess_test/Cargo.toml b/crates/subprocess_test/Cargo.toml
index 6d4f17fa..292a9a80 100644
--- a/crates/subprocess_test/Cargo.toml
+++ b/crates/subprocess_test/Cargo.toml
@@ -12,6 +12,7 @@ base64 = { workspace = true }
 bincode = { workspace = true }
 ctor = { workspace = true }
 fspy = { workspace = true, optional = true }
+linkme = { workspace = true }
 portable-pty = { workspace = true, optional = true }
 rustc-hash = { workspace = true }
 
diff --git a/crates/subprocess_test/src/lib.rs b/crates/subprocess_test/src/lib.rs
index ca418d77..86ddd324 100644
--- a/crates/subprocess_test/src/lib.rs
+++ b/crates/subprocess_test/src/lib.rs
@@ -48,10 +48,43 @@ impl From<Command> for portable_pty::CommandBuilder {
     }
 }
 
+/// Type for subprocess handler entries in the distributed slice.
+#[doc(hidden)]
+pub struct SubprocessHandler {
+    pub id: &'static str,
+    pub handler: fn(),
+}
+
+#[doc(hidden)]
+#[linkme::distributed_slice]
+pub static SUBPROCESS_HANDLERS: [SubprocessHandler];
+
+/// Checks if the process was spawned as a subprocess and dispatches to the
+/// matching handler. Called from the crate-level init function.
+#[doc(hidden)]
+pub fn subprocess_dispatch() {
+    let args: Vec<String> = std::env::args().collect();
+    // <test_binary> <expected_id> <arg_base64>
+    if args.len() < 3 {
+        return;
+    }
+    let current_id = &args[1];
+    for handler in SUBPROCESS_HANDLERS {
+        if handler.id == current_id {
+            (handler.handler)();
+            // handler calls std::process::exit(0) — unreachable
+        }
+    }
+}
+
 /// Creates a `subprocess_test::Command` that only executes the provided function.
 ///
 /// - $arg: The argument to pass to the function, must implement `Encode` and `Decode`.
 /// - $f: The function to run in the separate process, takes one argument of the type of $arg.
+///
+/// **Important:** Every crate that uses this macro must also invoke
+/// [`subprocess_dispatch_ctor!()`] once at crate scope (outside any function)
+/// to register the subprocess dispatcher.
 #[macro_export]
 macro_rules! command_for_fn {
     ($arg: expr, $f: expr) => {{
@@ -62,16 +95,37 @@ macro_rules! command_for_fn {
         fn assert_arg_type<A>(_arg: &A, _f: impl FnOnce(A)) {}
         assert_arg_type(&$arg, $f);
 
-        // Register an initializer that runs the provided function when the process is started
-        #[::ctor::ctor]
-        unsafe fn init() {
-            $crate::init_impl(ID, $f);
-        }
+        // Register a handler in the distributed slice.
+        #[::linkme::distributed_slice($crate::SUBPROCESS_HANDLERS)]
+        #[linkme(crate = ::linkme)]
+        static HANDLER: $crate::SubprocessHandler = $crate::SubprocessHandler {
+            id: ID,
+            handler: || {
+                $crate::init_impl(ID, $f);
+            },
+        };
+
         // Create the command
         $crate::create_command(ID, $arg)
     }};
 }
 
+/// Register the subprocess dispatcher as a `#[ctor]` in the calling crate.
+///
+/// Must be invoked once at crate scope in every crate that uses
+/// [`command_for_fn!`]. This ensures the dispatcher's `.init_array` entry
+/// is linked into the final binary, which is required for musl targets
+/// where `#[ctor]` inside macro expansions may be dropped.
+#[macro_export]
+macro_rules! subprocess_dispatch_ctor {
+    () => {
+        #[::ctor::ctor]
+        fn __subprocess_dispatch() {
+            $crate::subprocess_dispatch();
+        }
+    };
+}
+
 #[doc(hidden)]
 pub fn init_impl<A: Decode<()>>(expected_id: &str, f: impl FnOnce(A)) {
     let mut args = ::std::env::args();
@@ -105,6 +159,9 @@ pub fn create_command(id: &str, arg: impl Encode) -> Command {
     Command { program, args, envs, cwd }
 }
 
+#[cfg(test)]
+subprocess_dispatch_ctor!();
+
 #[cfg(test)]
 mod tests {
     use std::str::from_utf8;

From ed764d357fbe6963820bd42682501404e3d88124 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 08:44:19 +0000
Subject: [PATCH 12/34] fix: add cargo-shear ignore for subprocess_test +
 seccomp unconfined

- Add cargo-shear ignore for ctor and linkme in subprocess_test
- Use --security-opt seccomp=unconfined for Alpine container since
  fspy uses seccomp user notifications

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml          | 5 ++++-
 crates/subprocess_test/Cargo.toml | 3 +++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ff2e72a7..dc17b19a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -138,7 +138,10 @@ jobs:
     if: needs.detect-changes.outputs.code-changed == 'true'
     name: Test (musl)
     runs-on: ubuntu-latest
-    container: alpine:3.21
+    container:
+      image: alpine:3.21
+      # fspy uses seccomp user notifications which require unconfined seccomp
+      options: --security-opt seccomp=unconfined
     steps:
       - name: Install Alpine dependencies
         shell: sh {0}
diff --git a/crates/subprocess_test/Cargo.toml b/crates/subprocess_test/Cargo.toml
index 292a9a80..f109c2c9 100644
--- a/crates/subprocess_test/Cargo.toml
+++ b/crates/subprocess_test/Cargo.toml
@@ -26,3 +26,6 @@ workspace = true
 
 [lib]
 doctest = false
+
+[package.metadata.cargo-shear]
+ignored = ["ctor", "linkme"]

From 7ac7d6b06b8e369302589398ed29b611b6cb50a9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 08:58:30 +0000
Subject: [PATCH 13/34] fix: resolve cargo-shear warnings for linkme/ctor
 dependencies

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 crates/fspy_shared/Cargo.toml     | 3 +++
 crates/subprocess_test/Cargo.toml | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/crates/fspy_shared/Cargo.toml b/crates/fspy_shared/Cargo.toml
index 5eba127c..8e572a92 100644
--- a/crates/fspy_shared/Cargo.toml
+++ b/crates/fspy_shared/Cargo.toml
@@ -33,3 +33,6 @@ workspace = true
 
 [lib]
 doctest = false
+
+[package.metadata.cargo-shear]
+ignored = ["linkme"]
diff --git a/crates/subprocess_test/Cargo.toml b/crates/subprocess_test/Cargo.toml
index f109c2c9..2bc2d407 100644
--- a/crates/subprocess_test/Cargo.toml
+++ b/crates/subprocess_test/Cargo.toml
@@ -28,4 +28,4 @@ workspace = true
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor", "linkme"]
+ignored = []

From 2957cf83af40c83958c53277065905efd60a8780 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 09:09:39 +0000
Subject: [PATCH 14/34] fix: increase shared memory size for fspy IPC tests in
 Docker

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc17b19a..6b92ff64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -141,7 +141,8 @@ jobs:
     container:
       image: alpine:3.21
       # fspy uses seccomp user notifications which require unconfined seccomp
-      options: --security-opt seccomp=unconfined
+      # fspy uses seccomp user notifications and shared memory IPC
+      options: --security-opt seccomp=unconfined --shm-size=256m
     steps:
       - name: Install Alpine dependencies
         shell: sh {0}

From 2659aad4d1baa51f2748e12021a72a226545aac1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 09:21:27 +0000
Subject: [PATCH 15/34] fix: use --no-fail-fast for musl tests to see full test
 results

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6b92ff64..34eec236 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -168,7 +168,7 @@ jobs:
       - name: Remove zig linker config for native musl
         run: sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
 
-      - run: cargo test
+      - run: cargo test --no-fail-fast
 
   fmt:
     name: Format and Check Deps

From 6d5dd4f39f396c04e7de3fb51e56c2ede53d21d0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 09:35:46 +0000
Subject: [PATCH 16/34] fix: downgrade ctor from 0.6 to 0.2 for musl
 compatibility

ctor 0.6 generates .init_array entries that get dropped by the linker
on musl targets. ctor 0.2 uses a different code generation approach
that works reliably across all targets.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 Cargo.lock                        | 29 ++++-------------------------
 Cargo.toml                        |  2 +-
 crates/subprocess_test/src/lib.rs | 21 ++++++++++++++++++---
 3 files changed, 23 insertions(+), 29 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e909a0af..2e5875c4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -728,20 +728,14 @@ dependencies = [
 
 [[package]]
 name = "ctor"
-version = "0.6.3"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "424e0138278faeb2b401f174ad17e715c829512d74f3d1e81eb43365c2e0590e"
+checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
 dependencies = [
- "ctor-proc-macro",
- "dtor",
+ "quote",
+ "syn 2.0.114",
 ]
 
-[[package]]
-name = "ctor-proc-macro"
-version = "0.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1"
-
 [[package]]
 name = "ctrlc"
 version = "3.5.2"
@@ -946,21 +940,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
-[[package]]
-name = "dtor"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "404d02eeb088a82cfd873006cb713fe411306c7d182c344905e101fb1167d301"
-dependencies = [
- "dtor-proc-macro",
-]
-
-[[package]]
-name = "dtor-proc-macro"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
-
 [[package]]
 name = "either"
 version = "1.15.0"
diff --git a/Cargo.toml b/Cargo.toml
index cf0917a2..ea67e45b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -64,7 +64,7 @@ cow-utils = "0.1.3"
 cp_r = "0.5.2"
 crossterm = { version = "0.29.0", features = ["event-stream"] }
 csv-async = { version = "1.3.1", features = ["tokio"] }
-ctor = "0.6"
+ctor = "0.2"
 ctrlc = "3.5.2"
 derive_more = "2.0.1"
 diff-struct = "0.5.3"
diff --git a/crates/subprocess_test/src/lib.rs b/crates/subprocess_test/src/lib.rs
index 86ddd324..1a9ddfc3 100644
--- a/crates/subprocess_test/src/lib.rs
+++ b/crates/subprocess_test/src/lib.rs
@@ -113,9 +113,9 @@ macro_rules! command_for_fn {
 /// Register the subprocess dispatcher as a `#[ctor]` in the calling crate.
 ///
 /// Must be invoked once at crate scope in every crate that uses
-/// [`command_for_fn!`]. This ensures the dispatcher's `.init_array` entry
-/// is linked into the final binary, which is required for musl targets
-/// where `#[ctor]` inside macro expansions may be dropped.
+/// [`command_for_fn!`]. On musl targets, `#[ctor]` may not work reliably
+/// in test binaries — use [`subprocess_dispatch()`] at the start of a
+/// custom test main instead.
 #[macro_export]
 macro_rules! subprocess_dispatch_ctor {
     () => {
@@ -126,6 +126,21 @@ macro_rules! subprocess_dispatch_ctor {
     };
 }
 
+/// Wrap the standard test runner with subprocess dispatch.
+///
+/// Use this at the top of custom test mains (`harness = false`) or
+/// invoke via the `subprocess_test_main!` macro for test crates that
+/// need subprocess support on musl.
+#[macro_export]
+macro_rules! subprocess_test_main {
+    ($body:expr) => {
+        fn main() {
+            $crate::subprocess_dispatch();
+            $body
+        }
+    };
+}
+
 #[doc(hidden)]
 pub fn init_impl<A: Decode<()>>(expected_id: &str, f: impl FnOnce(A)) {
     let mut args = ::std::env::args();

From b4b298b4fa23c8bce8f977b615b3e9387d889ab5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 09:46:29 +0000
Subject: [PATCH 17/34] revert: restore ctor 0.6 (0.2 didn't fix musl either)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ctor issue on musl is fundamental — neither v0.2 nor v0.6 works
in Alpine containers. The .init_array entries are dropped regardless
of ctor version.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index ea67e45b..cf0917a2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -64,7 +64,7 @@ cow-utils = "0.1.3"
 cp_r = "0.5.2"
 crossterm = { version = "0.29.0", features = ["event-stream"] }
 csv-async = { version = "1.3.1", features = ["tokio"] }
-ctor = "0.2"
+ctor = "0.6"
 ctrlc = "3.5.2"
 derive_more = "2.0.1"
 diff-struct = "0.5.3"

From 2ce1552a36aa556d9cecdd794d56759146d2562a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 10:24:13 +0000
Subject: [PATCH 18/34] fix: read args from /proc/self/cmdline during
 .init_array on musl

On musl targets, `std::env::args()` returns empty during `.init_array`
constructors because the Rust runtime hasn't initialized its argument
storage yet. This caused `subprocess_dispatch()` and `init_impl()` to
silently skip subprocess dispatch, making all subprocess-based tests
fail (fspy, pty_terminal, fspy_shared IPC tests).

Fix by falling back to reading `/proc/self/cmdline` directly via raw
libc calls when `std::env::args()` is empty. The libc-level open/read
calls work during `.init_array` even when the Rust runtime isn't ready.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 crates/subprocess_test/Cargo.toml |  1 +
 crates/subprocess_test/src/lib.rs | 78 +++++++++++++++++++++++++++++--
 2 files changed, 74 insertions(+), 5 deletions(-)

diff --git a/crates/subprocess_test/Cargo.toml b/crates/subprocess_test/Cargo.toml
index 2bc2d407..b3df106a 100644
--- a/crates/subprocess_test/Cargo.toml
+++ b/crates/subprocess_test/Cargo.toml
@@ -12,6 +12,7 @@ base64 = { workspace = true }
 bincode = { workspace = true }
 ctor = { workspace = true }
 fspy = { workspace = true, optional = true }
+libc = { workspace = true }
 linkme = { workspace = true }
 portable-pty = { workspace = true, optional = true }
 rustc-hash = { workspace = true }
diff --git a/crates/subprocess_test/src/lib.rs b/crates/subprocess_test/src/lib.rs
index 1a9ddfc3..821f8299 100644
--- a/crates/subprocess_test/src/lib.rs
+++ b/crates/subprocess_test/src/lib.rs
@@ -61,9 +61,12 @@ pub static SUBPROCESS_HANDLERS: [SubprocessHandler];
 
 /// Checks if the process was spawned as a subprocess and dispatches to the
 /// matching handler. Called from the crate-level init function.
+///
+/// Uses [`get_args`] to read arguments, which works even during `.init_array`
+/// on musl targets where `std::env::args()` is not yet initialized.
 #[doc(hidden)]
 pub fn subprocess_dispatch() {
-    let args: Vec<String> = std::env::args().collect();
+    let args = get_args();
     // <test_binary> <expected_id> <arg_base64>
     if args.len() < 3 {
         return;
@@ -77,6 +80,73 @@ pub fn subprocess_dispatch() {
     }
 }
 
+/// Read command-line arguments in a way that works during `.init_array`.
+///
+/// On Linux, `std::env::args()` may return empty during `.init_array`
+/// constructors (observed on musl targets) because the Rust runtime hasn't
+/// initialized its argument storage yet. We fall back to reading
+/// `/proc/self/cmdline` directly using raw syscalls that don't depend on
+/// the Rust runtime being initialized.
+fn get_args() -> Vec<String> {
+    let args: Vec<String> = std::env::args().collect();
+    if !args.is_empty() {
+        return args;
+    }
+
+    // Fallback: read /proc/self/cmdline using raw libc calls.
+    #[cfg(target_os = "linux")]
+    {
+        if let Some(args) = read_proc_cmdline() {
+            return args;
+        }
+    }
+
+    args
+}
+
+/// Read `/proc/self/cmdline` using raw libc calls that work before Rust
+/// runtime initialization (during `.init_array` constructors).
+#[cfg(target_os = "linux")]
+fn read_proc_cmdline() -> Option<Vec<String>> {
+    // SAFETY: opening a read-only procfs file with a static path
+    let fd =
+        unsafe { libc::open(c"/proc/self/cmdline".as_ptr(), libc::O_RDONLY | libc::O_CLOEXEC) };
+    if fd < 0 {
+        return None;
+    }
+
+    let mut buf = [0u8; 4096];
+    let mut total = 0usize;
+    loop {
+        // SAFETY: reading into a valid stack buffer from an open fd
+        let n = unsafe { libc::read(fd, buf[total..].as_mut_ptr().cast(), buf.len() - total) };
+        let Ok(n) = usize::try_from(n) else {
+            break;
+        };
+        if n == 0 {
+            break;
+        }
+        total += n;
+        if total >= buf.len() {
+            break;
+        }
+    }
+    // SAFETY: closing an fd we opened
+    unsafe { libc::close(fd) };
+
+    if total == 0 {
+        return None;
+    }
+
+    Some(
+        buf[..total]
+            .split(|&b| b == 0)
+            .filter(|s| !s.is_empty())
+            .filter_map(|s| std::str::from_utf8(s).ok().map(String::from))
+            .collect(),
+    )
+}
+
 /// Creates a `subprocess_test::Command` that only executes the provided function.
 ///
 /// - $arg: The argument to pass to the function, must implement `Encode` and `Decode`.
@@ -143,11 +213,9 @@ macro_rules! subprocess_test_main {
 
 #[doc(hidden)]
 pub fn init_impl<A: Decode<()>>(expected_id: &str, f: impl FnOnce(A)) {
-    let mut args = ::std::env::args();
+    let args = get_args();
     // <test_binary> <expected_id> <arg_base64>
-    let (Some(_program), Some(current_id), Some(arg_base64)) =
-        (args.next(), args.next(), args.next())
-    else {
+    let (Some(current_id), Some(arg_base64)) = (args.get(1), args.get(2)) else {
         return;
     };
     if current_id != expected_id {

From c60305dada9e98f0c9bc4b49067f4693585043f4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 10:35:10 +0000
Subject: [PATCH 19/34] chore: update Cargo.lock for subprocess_test libc
 dependency

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 Cargo.lock | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2e5875c4..e1f9facb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -728,14 +728,20 @@ dependencies = [
 
 [[package]]
 name = "ctor"
-version = "0.2.9"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
+checksum = "424e0138278faeb2b401f174ad17e715c829512d74f3d1e81eb43365c2e0590e"
 dependencies = [
- "quote",
- "syn 2.0.114",
+ "ctor-proc-macro",
+ "dtor",
 ]
 
+[[package]]
+name = "ctor-proc-macro"
+version = "0.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1"
+
 [[package]]
 name = "ctrlc"
 version = "3.5.2"
@@ -940,6 +946,21 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
+[[package]]
+name = "dtor"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "404d02eeb088a82cfd873006cb713fe411306c7d182c344905e101fb1167d301"
+dependencies = [
+ "dtor-proc-macro",
+]
+
+[[package]]
+name = "dtor-proc-macro"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
+
 [[package]]
 name = "either"
 version = "1.15.0"
@@ -3209,6 +3230,7 @@ dependencies = [
  "bincode",
  "ctor",
  "fspy",
+ "libc",
  "linkme",
  "portable-pty",
  "rustc-hash",

From 15e328a9ef8ac1afd80e3ad937cc310c948fad8e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 10:54:07 +0000
Subject: [PATCH 20/34] fix: preserve empty args when reading
 /proc/self/cmdline

The previous implementation filtered out empty strings from cmdline
args, but empty args are valid (e.g., `()` encodes to empty base64).
This caused subprocess dispatch to fail for tests using unit arg type
because the arg count dropped below 3.

Now only removes the trailing empty string from the final null
terminator instead of all empty strings.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 crates/subprocess_test/src/lib.rs | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/crates/subprocess_test/src/lib.rs b/crates/subprocess_test/src/lib.rs
index 821f8299..ea698e56 100644
--- a/crates/subprocess_test/src/lib.rs
+++ b/crates/subprocess_test/src/lib.rs
@@ -138,13 +138,18 @@ fn read_proc_cmdline() -> Option<Vec<String>> {
         return None;
     }
 
-    Some(
-        buf[..total]
-            .split(|&b| b == 0)
-            .filter(|s| !s.is_empty())
-            .filter_map(|s| std::str::from_utf8(s).ok().map(String::from))
-            .collect(),
-    )
+    // /proc/self/cmdline has null-separated args with a trailing null.
+    // We must preserve empty args (e.g., empty base64 for `()` arg) but
+    // remove the trailing empty entry from the final null terminator.
+    let mut args: Vec<String> = buf[..total]
+        .split(|&b| b == 0)
+        .filter_map(|s| std::str::from_utf8(s).ok().map(String::from))
+        .collect();
+    // Remove trailing empty string from the final null byte
+    if args.last().is_some_and(String::is_empty) {
+        args.pop();
+    }
+    Some(args)
 }
 
 /// Creates a `subprocess_test::Command` that only executes the provided function.

From 934c0c74bf8ea030e695952c6c3ed974e437822d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 11:10:59 +0000
Subject: [PATCH 21/34] fix: detect O_DIRECTORY flag in seccomp open handler
 for READ_DIR

On musl/seccomp targets, `std::fs::read_dir()` opens the directory
with `O_DIRECTORY` but doesn't call `getdents64` until the iterator
is consumed. The seccomp handler only set READ_DIR on `getdents64`
notifications, so lazy `read_dir()` calls were tracked as READ
instead of READ_DIR.

Fix by detecting the `O_DIRECTORY` flag in the open/openat handler
and adding `READ_DIR` to the access mode. This matches the behavior
of the LD_PRELOAD interceptor on glibc targets.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 crates/fspy/src/unix/syscall_handler/mod.rs | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/crates/fspy/src/unix/syscall_handler/mod.rs b/crates/fspy/src/unix/syscall_handler/mod.rs
index 4b6f7947..cf762784 100644
--- a/crates/fspy/src/unix/syscall_handler/mod.rs
+++ b/crates/fspy/src/unix/syscall_handler/mod.rs
@@ -57,14 +57,15 @@ impl SyscallHandler {
             }
             path = Cow::Owned(resolved_path);
         }
-        self.arena.add(PathAccess {
-            mode: match flags & libc::O_ACCMODE {
-                libc::O_RDWR => AccessMode::READ | AccessMode::WRITE,
-                libc::O_WRONLY => AccessMode::WRITE,
-                _ => AccessMode::READ,
-            },
-            path: path.as_os_str().into(),
-        });
+        let mut mode = match flags & libc::O_ACCMODE {
+            libc::O_RDWR => AccessMode::READ | AccessMode::WRITE,
+            libc::O_WRONLY => AccessMode::WRITE,
+            _ => AccessMode::READ,
+        };
+        if flags & libc::O_DIRECTORY != 0 {
+            mode.insert(AccessMode::READ_DIR);
+        }
+        self.arena.add(PathAccess { mode, path: path.as_os_str().into() });
         Ok(())
     }
 

From 125fdd0ba609e205a5de96a5e852e9e6291a396a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 12:13:44 +0000
Subject: [PATCH 22/34] fix: enable fspy seccomp tracing on musl and fix musl
 test failures

Root cause: vite_task explicitly disabled fspy on musl targets
(`!cfg!(target_env = "musl")`), not realizing that seccomp unotify
provides equivalent file access tracing to LD_PRELOAD. This caused
all cache invalidation to fail on musl since file accesses were
never recorded.

Additional fixes:
- Set CC env vars for musl cross-compilation so cc-rs can find the
  zig CC wrapper (fixes stackalloc build failure)
- Use openat(AT_FDCWD) instead of open() in seccomp arg_types test
  because musl's open() uses the native `open` syscall on x86_64,
  which isn't intercepted by the test's openat-only handler
- Refactor shm_io test to use subprocess_test infrastructure instead
  of raw #[ctor] (fixes musl args unavailability during .init_array)
- Add required-features to fspy_seccomp_unotify arg_types test so
  it only compiles when supervisor+target features are available

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .cargo/config.toml                            |  6 +++
 crates/fspy_seccomp_unotify/Cargo.toml        |  4 ++
 .../fspy_seccomp_unotify/tests/arg_types.rs   |  5 +-
 crates/fspy_shared/src/ipc/channel/shm_io.rs  | 47 +++++++------------
 crates/vite_task/src/session/execute/mod.rs   |  8 ++--
 .../vite_task_bin/tests/e2e_snapshots/main.rs | 10 ++--
 6 files changed, 38 insertions(+), 42 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index b52768ea..24da6d86 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -11,3 +11,9 @@ rustflags = ["-C", "linker=.cargo/zigcc-x86_64-unknown-linux-musl"]
 
 [target.aarch64-unknown-linux-musl]
 rustflags = ["-C", "linker=.cargo/zigcc-aarch64-unknown-linux-musl"]
+
+# CC wrappers for crates with C build scripts (e.g. stackalloc via cc-rs).
+# The linker flags above only cover rustc linking; cc-rs needs its own compiler.
+[env]
+CC_x86_64_unknown_linux_musl = { value = ".cargo/zigcc-x86_64-unknown-linux-musl", relative = true }
+CC_aarch64_unknown_linux_musl = { value = ".cargo/zigcc-aarch64-unknown-linux-musl", relative = true }
diff --git a/crates/fspy_seccomp_unotify/Cargo.toml b/crates/fspy_seccomp_unotify/Cargo.toml
index be581839..9a4a2a08 100644
--- a/crates/fspy_seccomp_unotify/Cargo.toml
+++ b/crates/fspy_seccomp_unotify/Cargo.toml
@@ -33,3 +33,7 @@ workspace = true
 [lib]
 test = false
 doctest = false
+
+[[test]]
+name = "arg_types"
+required-features = ["supervisor", "target"]
diff --git a/crates/fspy_seccomp_unotify/tests/arg_types.rs b/crates/fspy_seccomp_unotify/tests/arg_types.rs
index 50aa83a5..6a9771c5 100644
--- a/crates/fspy_seccomp_unotify/tests/arg_types.rs
+++ b/crates/fspy_seccomp_unotify/tests/arg_types.rs
@@ -90,7 +90,10 @@ async fn run_in_pre_exec(
 async fn fd_and_path() -> Result<(), Box<dyn Error>> {
     let syscalls = run_in_pre_exec(|| {
         set_current_dir("/")?;
-        let home_fd = nix::fcntl::open(c"/home", OFlag::O_PATH, Mode::empty())?;
+        // Use openat(AT_FDCWD, ...) instead of open() because musl's open()
+        // uses the native `open` syscall on x86_64, which isn't intercepted by
+        // the test's openat-only seccomp handler.
+        let home_fd = openat(AT_FDCWD, c"/home", OFlag::O_PATH, Mode::empty())?;
         let _ = openat(home_fd, c"open_at_home", OFlag::O_RDONLY, Mode::empty());
         let _ = openat(AT_FDCWD, c"openat_cwd", OFlag::O_RDONLY, Mode::empty());
         Ok(())
diff --git a/crates/fspy_shared/src/ipc/channel/shm_io.rs b/crates/fspy_shared/src/ipc/channel/shm_io.rs
index 3c6b8f3d..39a490d1 100644
--- a/crates/fspy_shared/src/ipc/channel/shm_io.rs
+++ b/crates/fspy_shared/src/ipc/channel/shm_io.rs
@@ -323,7 +323,6 @@ impl<M: AsRef<[u8]>> ShmReader<M> {
 #[cfg(test)]
 mod tests {
     use std::{
-        env::current_exe,
         process::{Child, Command},
         sync::Arc,
         thread,
@@ -669,43 +668,31 @@ mod tests {
     #[cfg(not(miri))]
     fn real_shm_across_processes() {
         use shared_memory::ShmemConf;
+        use subprocess_test::command_for_fn;
 
-        const CHILD_PROCESS_ENV: &str = "FSPY_SHM_IO_TEST_CHILD_PROCESS";
         const CHILD_COUNT: usize = 12;
         const FRAME_COUNT_EACH_CHILD: usize = 100;
 
-        #[ctor::ctor]
-        fn child_process() {
-            if std::env::var_os(CHILD_PROCESS_ENV).is_none() {
-                return;
-            }
-            let mut args = std::env::args_os();
-            args.next().unwrap(); // exe path
-            let shm_name = args.next().expect("shm name arg").into_string().unwrap();
-            let child_index = args.next().expect("child name").into_string().unwrap();
-
-            let shm = ShmemConf::new().os_id(shm_name).open().unwrap();
-            // SAFETY: `shm` is a freshly opened shared memory region with a valid pointer and size.
-            // Concurrent write access is safe because `ShmWriter` uses atomic operations.
-            let writer = unsafe { ShmWriter::new(shm) };
-            for i in 0..FRAME_COUNT_EACH_CHILD {
-                let frame_data = format!("{child_index} {i}");
-                assert!(writer.try_write_frame(frame_data.as_bytes()));
-            }
-            std::process::exit(0);
-        }
-
         let shm = ShmemConf::new().size(1024 * 1024).create().unwrap();
-        let shm_name = shm.get_os_id();
+        let shm_name = shm.get_os_id().to_owned();
 
         let children: Vec<Child> = (0..CHILD_COUNT)
             .map(|child_index| {
-                Command::new(current_exe().unwrap())
-                    .env(CHILD_PROCESS_ENV, "1")
-                    .arg(shm_name)
-                    .arg(child_index.to_string())
-                    .spawn()
-                    .unwrap()
+                let cmd = command_for_fn!(
+                    (shm_name.clone(), child_index),
+                    |(shm_name, child_index): (String, usize)| {
+                        let shm = ShmemConf::new().os_id(shm_name).open().unwrap();
+                        // SAFETY: `shm` is a freshly opened shared memory region with a valid
+                        // pointer and size. Concurrent write access is safe because `ShmWriter`
+                        // uses atomic operations.
+                        let writer = unsafe { ShmWriter::new(shm) };
+                        for i in 0..FRAME_COUNT_EACH_CHILD {
+                            let frame_data = std::format!("{child_index} {i}");
+                            assert!(writer.try_write_frame(frame_data.as_bytes()));
+                        }
+                    }
+                );
+                Command::from(cmd).spawn().unwrap()
             })
             .collect();
 
diff --git a/crates/vite_task/src/session/execute/mod.rs b/crates/vite_task/src/session/execute/mod.rs
index 07eefa75..bbacf80f 100644
--- a/crates/vite_task/src/session/execute/mod.rs
+++ b/crates/vite_task/src/session/execute/mod.rs
@@ -316,11 +316,9 @@ pub async fn execute_spawn(
     //    - path_accesses: only tracked when includes_auto is true (fspy inference)
     let (mut std_outputs, mut path_accesses, cache_metadata_and_inputs) =
         cache_metadata.map_or((None, None, None), |cache_metadata| {
-            // On musl targets, fspy's LD_PRELOAD-based file tracking is not available
-            // because musl binaries are statically linked. Disable inference at execution
-            // time so that plan-level config (includes_auto) stays consistent across targets.
-            let fspy_available = !cfg!(target_env = "musl");
-            let path_accesses = if cache_metadata.input_config.includes_auto && fspy_available {
+            // On musl targets, LD_PRELOAD-based tracking is unavailable but seccomp
+            // unotify provides equivalent file access tracing.
+            let path_accesses = if cache_metadata.input_config.includes_auto {
                 Some(TrackedPathAccesses::default())
             } else {
                 None // Skip fspy when inference is disabled or unavailable
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/main.rs b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
index 734d8d59..58fd397b 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/main.rs
+++ b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
@@ -198,7 +198,8 @@ struct E2e {
     /// Optional platform filter: "unix" or "windows". If set, test only runs on that platform.
     #[serde(default)]
     pub platform: Option<Str>,
-    /// If true, the test requires fspy-based input inference and will be skipped on musl targets.
+    /// Deprecated: fspy now works on musl via seccomp unotify.
+    /// Kept for backwards compatibility with existing snapshots.toml files.
     #[serde(default)]
     pub requires_fspy: bool,
 }
@@ -316,11 +317,8 @@ fn run_case_inner(tmpdir: &AbsolutePath, fixture_path: &std::path::Path, fixture
             }
         }
 
-        // Skip fspy-dependent tests on musl targets where LD_PRELOAD-based tracking
-        // is not available.
-        if e2e.requires_fspy && cfg!(target_env = "musl") {
-            continue;
-        }
+        // fspy works on musl via seccomp unotify — no tests need to be skipped.
+        let _ = e2e.requires_fspy;
 
         let _info_guard = if e2e.cwd.as_str().is_empty() {
             None

From 1019416e75f412e3964e72db700e0f6576891af5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 12:37:51 +0000
Subject: [PATCH 23/34] fix: CI failures from musl config and unused dep
 detection

- Strip [env] section in CI musl job alongside [target.*musl] sections,
  since the CC_*_musl env vars point to the zigcc wrapper which isn't
  available on native Alpine (system gcc is used instead)
- Add ctor to cargo-shear ignored list in fspy_shared since it's used
  transitively through the subprocess_dispatch_ctor!() macro

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml      | 8 +++++---
 crates/fspy_shared/Cargo.toml | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 34eec236..dfb31190 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -163,10 +163,12 @@ jobs:
           npm install -g pnpm
           pnpm install
 
-      # Remove the zig linker wrapper from .cargo/config.toml — in Alpine, the
-      # system cc is already musl-based, so no cross-compilation linker is needed.
+      # Remove the zig cross-compilation config from .cargo/config.toml — in Alpine,
+      # the system cc is already musl-based, so no cross-compilation linker or CC is needed.
       - name: Remove zig linker config for native musl
-        run: sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
+        run: |
+          sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
+          sed -i '/\[env\]/,/^$/d' .cargo/config.toml
 
       - run: cargo test --no-fail-fast
 
diff --git a/crates/fspy_shared/Cargo.toml b/crates/fspy_shared/Cargo.toml
index 8e572a92..9f3f7448 100644
--- a/crates/fspy_shared/Cargo.toml
+++ b/crates/fspy_shared/Cargo.toml
@@ -35,4 +35,4 @@ workspace = true
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["linkme"]
+ignored = ["ctor", "linkme"]

From e2345880079503ef29b90552427171170b60afaa Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 12:45:56 +0000
Subject: [PATCH 24/34] fix: enable Node.js TypeScript strip types on Alpine
 musl CI

Alpine's Node.js 22.15.1 package doesn't enable TypeScript type
stripping by default, causing ERR_UNKNOWN_FILE_EXTENSION errors
when running the .ts test tool scripts. Set NODE_OPTIONS to enable
--experimental-strip-types explicitly.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dfb31190..eb914038 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -170,7 +170,11 @@ jobs:
           sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
           sed -i '/\[env\]/,/^$/d' .cargo/config.toml
 
+      # Alpine's Node.js package doesn't enable TypeScript type stripping by default.
+      # The test tool scripts (packages/tools/src/*.ts) need it.
       - run: cargo test --no-fail-fast
+        env:
+          NODE_OPTIONS: '--experimental-strip-types'
 
   fmt:
     name: Format and Check Deps

From c224568dee7e74fb0ac8dd5b3c64c7d4f3efac9b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 12:52:20 +0000
Subject: [PATCH 25/34] fix: pass NODE_OPTIONS through to E2E test subprocesses

The E2E test harness clears env vars and only passes PATH, NO_COLOR,
TERM. On Alpine musl CI, NODE_OPTIONS=--experimental-strip-types is
needed for .ts test tools. Inherit NODE_OPTIONS when present.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 crates/vite_task_bin/tests/e2e_snapshots/main.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crates/vite_task_bin/tests/e2e_snapshots/main.rs b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
index 58fd397b..7c190eba 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/main.rs
+++ b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
@@ -353,6 +353,11 @@ fn run_case_inner(tmpdir: &AbsolutePath, fixture_path: &std::path::Path, fixture
                 cmd.env("PATHEXT", pathext);
             }
 
+            // Inherit NODE_OPTIONS for TypeScript strip-types support on Alpine musl
+            if let Ok(node_options) = std::env::var("NODE_OPTIONS") {
+                cmd.env("NODE_OPTIONS", node_options);
+            }
+
             let terminal = TestTerminal::spawn(SCREEN_SIZE, cmd).unwrap();
             let mut killer = terminal.child_handle.clone();
             let interactions = step.interactions().to_vec();

From 6165dded1424ee82729a67779cd48d22d2bd4f11 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 12:59:56 +0000
Subject: [PATCH 26/34] fix: use official Node.js binary on Alpine for
 TypeScript support

Alpine's Node.js package (v22.15.1) is compiled without TypeScript
type-stripping support (ERR_NO_TYPESCRIPT). Install the official
Node.js musl binary from unofficial-builds.nodejs.org which includes
full TypeScript support needed by the test tool scripts (.ts files).

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml                         | 13 ++++++++-----
 crates/vite_task_bin/tests/e2e_snapshots/main.rs |  5 -----
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eb914038..8bfe46e0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -146,7 +146,14 @@ jobs:
     steps:
       - name: Install Alpine dependencies
         shell: sh {0}
-        run: apk add --no-cache bash curl git musl-dev gcc g++ nodejs npm python3
+        run: apk add --no-cache bash curl git musl-dev gcc g++ python3
+
+      # Alpine's Node.js package is compiled without TypeScript type-stripping.
+      # Install the official Node.js musl binary which includes full TypeScript support.
+      - name: Install Node.js from official distribution
+        run: |
+          NODE_VERSION=22
+          curl -fsSL "https://unofficial-builds.nodejs.org/download/release/latest-v${NODE_VERSION}.x/node-latest-v${NODE_VERSION}.x-linux-x64-musl.tar.gz" | tar -xz -C /usr/local --strip-components=1
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -170,11 +177,7 @@ jobs:
           sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
           sed -i '/\[env\]/,/^$/d' .cargo/config.toml
 
-      # Alpine's Node.js package doesn't enable TypeScript type stripping by default.
-      # The test tool scripts (packages/tools/src/*.ts) need it.
       - run: cargo test --no-fail-fast
-        env:
-          NODE_OPTIONS: '--experimental-strip-types'
 
   fmt:
     name: Format and Check Deps
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/main.rs b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
index 7c190eba..58fd397b 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/main.rs
+++ b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
@@ -353,11 +353,6 @@ fn run_case_inner(tmpdir: &AbsolutePath, fixture_path: &std::path::Path, fixture
                 cmd.env("PATHEXT", pathext);
             }
 
-            // Inherit NODE_OPTIONS for TypeScript strip-types support on Alpine musl
-            if let Ok(node_options) = std::env::var("NODE_OPTIONS") {
-                cmd.env("NODE_OPTIONS", node_options);
-            }
-
             let terminal = TestTerminal::spawn(SCREEN_SIZE, cmd).unwrap();
             let mut killer = terminal.child_handle.clone();
             let interactions = step.interactions().to_vec();

From af7f2dab22269e225f8ddcc4a46e5bc164d29ada Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 13:06:56 +0000
Subject: [PATCH 27/34] fix: use versioned URL for Node.js musl binary download

The 'latest-v22.x' URL pattern doesn't exist on unofficial-builds.
Query the index.json to find the latest v22 version and use the
specific version URL to download the musl binary.

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8bfe46e0..932ad284 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -152,8 +152,8 @@ jobs:
       # Install the official Node.js musl binary which includes full TypeScript support.
       - name: Install Node.js from official distribution
         run: |
-          NODE_VERSION=22
-          curl -fsSL "https://unofficial-builds.nodejs.org/download/release/latest-v${NODE_VERSION}.x/node-latest-v${NODE_VERSION}.x-linux-x64-musl.tar.gz" | tar -xz -C /usr/local --strip-components=1
+          NODE_VERSION=$(curl -fsSL https://unofficial-builds.nodejs.org/download/release/index.json | python3 -c "import sys,json; print(next(d['version'] for d in json.load(sys.stdin) if d['version'].startswith('v22.')))")
+          curl -fsSL "https://unofficial-builds.nodejs.org/download/release/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64-musl.tar.gz" | tar -xz -C /usr/local --strip-components=1
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

From 8ecc331c6bf46ac3c1a161b788ecced74a35adb8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 19 Mar 2026 13:45:46 +0000
Subject: [PATCH 28/34] refactor: address PR review comments

- Remove speculative seccomp comment from CI workflow
- Use .node-version file for Node.js version in Alpine CI
- Remove [env] CC wrapper vars from .cargo/config.toml and CI sed
- Revert O_DIRECTORY check in seccomp handler; instead consume a dir
  entry in the rust_std test so getdents64 fires
- Fix misleading "musl does not support cdylib" comment; update fspy
  README with musl section
- Revert to plain #[ctor::ctor] in command_for_fn! macro; remove
  linkme distributed slice infrastructure and subprocess_dispatch_ctor
- Keep /proc/self/cmdline fallback for musl arg reading in init_impl
- Remove all requires_fspy from snapshot toml files and Rust code

https://claude.ai/code/session_01Cqj3gbQjb7yFe49f1tfwYv
---
 .cargo/config.toml                            |   6 -
 .github/workflows/ci.yml                      |  20 ++--
 Cargo.lock                                    |  25 ----
 Cargo.toml                                    |   1 -
 crates/fspy/Cargo.toml                        |   3 +-
 crates/fspy/README.md                         |   6 +-
 crates/fspy/src/unix/mod.rs                   |   4 +-
 crates/fspy/src/unix/syscall_handler/mod.rs   |  17 ++-
 crates/fspy/tests/rust_std.rs                 |   3 +-
 crates/fspy/tests/test_utils/mod.rs           |   2 -
 crates/fspy_shared/Cargo.toml                 |   3 +-
 crates/fspy_shared/src/ipc/channel/mod.rs     |   3 -
 crates/pty_terminal/Cargo.toml                |   3 +-
 crates/pty_terminal/tests/terminal.rs         |   2 -
 crates/pty_terminal_test/Cargo.toml           |   3 +-
 crates/pty_terminal_test/tests/milestone.rs   |   2 -
 crates/subprocess_test/Cargo.toml             |   4 -
 crates/subprocess_test/src/lib.rs             | 113 +++---------------
 .../fixtures/input-cache-test/snapshots.toml  |   6 -
 .../snapshots.toml                            |   4 -
 .../snapshots.toml                            |   4 -
 .../fixtures/lint-dot-git/snapshots.toml      |   1 -
 .../vite_task_bin/tests/e2e_snapshots/main.rs |   7 --
 23 files changed, 48 insertions(+), 194 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index 24da6d86..b52768ea 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -11,9 +11,3 @@ rustflags = ["-C", "linker=.cargo/zigcc-x86_64-unknown-linux-musl"]
 
 [target.aarch64-unknown-linux-musl]
 rustflags = ["-C", "linker=.cargo/zigcc-aarch64-unknown-linux-musl"]
-
-# CC wrappers for crates with C build scripts (e.g. stackalloc via cc-rs).
-# The linker flags above only cover rustc linking; cc-rs needs its own compiler.
-[env]
-CC_x86_64_unknown_linux_musl = { value = ".cargo/zigcc-x86_64-unknown-linux-musl", relative = true }
-CC_aarch64_unknown_linux_musl = { value = ".cargo/zigcc-aarch64-unknown-linux-musl", relative = true }
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 932ad284..b69ddd1f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -140,26 +140,24 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: alpine:3.21
-      # fspy uses seccomp user notifications which require unconfined seccomp
-      # fspy uses seccomp user notifications and shared memory IPC
       options: --security-opt seccomp=unconfined --shm-size=256m
     steps:
       - name: Install Alpine dependencies
         shell: sh {0}
         run: apk add --no-cache bash curl git musl-dev gcc g++ python3
 
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          submodules: true
+
       # Alpine's Node.js package is compiled without TypeScript type-stripping.
       # Install the official Node.js musl binary which includes full TypeScript support.
       - name: Install Node.js from official distribution
         run: |
-          NODE_VERSION=$(curl -fsSL https://unofficial-builds.nodejs.org/download/release/index.json | python3 -c "import sys,json; print(next(d['version'] for d in json.load(sys.stdin) if d['version'].startswith('v22.')))")
+          NODE_VERSION=v$(cat .node-version)
           curl -fsSL "https://unofficial-builds.nodejs.org/download/release/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64-musl.tar.gz" | tar -xz -C /usr/local --strip-components=1
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          submodules: true
-
       - name: Install Rust
         run: |
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly-2026-03-05
@@ -171,11 +169,9 @@ jobs:
           pnpm install
 
       # Remove the zig cross-compilation config from .cargo/config.toml — in Alpine,
-      # the system cc is already musl-based, so no cross-compilation linker or CC is needed.
+      # the system cc is already musl-based, so no cross-compilation linker is needed.
       - name: Remove zig linker config for native musl
-        run: |
-          sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
-          sed -i '/\[env\]/,/^$/d' .cargo/config.toml
+        run: sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
 
       - run: cargo test --no-fail-fast
 
diff --git a/Cargo.lock b/Cargo.lock
index e1f9facb..ec08ca98 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1166,7 +1166,6 @@ dependencies = [
  "fspy_test_bin",
  "futures-util",
  "libc",
- "linkme",
  "nix 0.30.1",
  "ouroboros",
  "rand 0.9.2",
@@ -1263,7 +1262,6 @@ dependencies = [
  "bstr",
  "bytemuck",
  "ctor",
- "linkme",
  "os_str_bytes",
  "rustc-hash",
  "shared_memory",
@@ -1751,26 +1749,6 @@ dependencies = [
  "bitflags 2.10.0",
 ]
 
-[[package]]
-name = "linkme"
-version = "0.3.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e3283ed2d0e50c06dd8602e0ab319bb048b6325d0bba739db64ed8205179898"
-dependencies = [
- "linkme-impl",
-]
-
-[[package]]
-name = "linkme-impl"
-version = "0.3.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5cec0ec4228b4853bb129c84dbf093a27e6c7a20526da046defc334a1b017f7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.11.0"
@@ -2549,7 +2527,6 @@ dependencies = [
  "anyhow",
  "ctor",
  "ctrlc",
- "linkme",
  "ntest",
  "portable-pty",
  "signal-hook",
@@ -2565,7 +2542,6 @@ dependencies = [
  "anyhow",
  "crossterm",
  "ctor",
- "linkme",
  "ntest",
  "portable-pty",
  "pty_terminal",
@@ -3231,7 +3207,6 @@ dependencies = [
  "ctor",
  "fspy",
  "libc",
- "linkme",
  "portable-pty",
  "rustc-hash",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index cf0917a2..624cf584 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -71,7 +71,6 @@ diff-struct = "0.5.3"
 directories = "6.0.0"
 elf = { version = "0.8.0", default-features = false }
 flate2 = "1.0.35"
-linkme = "0.3"
 fspy = { path = "crates/fspy" }
 fspy_detours_sys = { path = "crates/fspy_detours_sys" }
 fspy_preload_unix = { path = "crates/fspy_preload_unix", artifact = "cdylib" }
diff --git a/crates/fspy/Cargo.toml b/crates/fspy/Cargo.toml
index a17e9c0f..abcc4b4c 100644
--- a/crates/fspy/Cargo.toml
+++ b/crates/fspy/Cargo.toml
@@ -48,7 +48,6 @@ tempfile = { workspace = true }
 anyhow = { workspace = true }
 csv-async = { workspace = true }
 ctor = { workspace = true }
-linkme = { workspace = true }
 subprocess_test = { workspace = true, features = ["fspy"] }
 test-log = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "fs", "io-std"] }
@@ -72,4 +71,4 @@ workspace = true
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor", "linkme", "fspy_test_bin"]
+ignored = ["ctor", "fspy_test_bin"]
diff --git a/crates/fspy/README.md b/crates/fspy/README.md
index c671d73c..cf7fcba0 100644
--- a/crates/fspy/README.md
+++ b/crates/fspy/README.md
@@ -2,7 +2,7 @@
 
 Run a command and capture all the paths it tries to access.
 
-## macOS/Linux implementation
+## macOS/Linux (glibc) implementation
 
 It uses `DYLD_INSERT_LIBRARIES` on macOS and `LD_PRELOAD` on Linux to inject a shared library that intercepts file system calls.
 The injection process is almost identical on both platforms other than the environment variable name. The implementation is in `src/unix`.
@@ -11,6 +11,10 @@ The injection process is almost identical on both platforms other than the envir
 
 For fully static binaries (such as `esbuild`), `LD_PRELOAD` does not work. In this case, `seccomp_unotify` is used to intercept direct system calls. The handler is implemented in `src/unix/syscall_handler`.
 
+## Linux musl implementation
+
+On musl targets, only `seccomp_unotify`-based tracking is used (no preload library).
+
 ## Windows implementation
 
 It uses [Detours](https://github.com/microsoft/Detours) to intercept file system calls. The implementation is in `src/windows`.
diff --git a/crates/fspy/src/unix/mod.rs b/crates/fspy/src/unix/mod.rs
index bfc4c0ec..6e77f9cb 100644
--- a/crates/fspy/src/unix/mod.rs
+++ b/crates/fspy/src/unix/mod.rs
@@ -45,8 +45,8 @@ const PRELOAD_CDYLIB_BINARY: &[u8] = include_bytes!(env!("CARGO_CDYLIB_FILE_FSPY
 impl SpyImpl {
     /// Initialize the fs access spy by writing the preload library on disk.
     ///
-    /// On musl targets, the preload library is not available (musl does not support cdylib),
-    /// so only seccomp-based tracking is used.
+    /// On musl targets, we don't build a preload library —
+    /// only seccomp-based tracking is used.
     pub fn init_in(#[cfg_attr(target_env = "musl", allow(unused))] dir: &Path) -> io::Result<Self> {
         #[cfg(not(target_env = "musl"))]
         let preload_path = {
diff --git a/crates/fspy/src/unix/syscall_handler/mod.rs b/crates/fspy/src/unix/syscall_handler/mod.rs
index cf762784..4b6f7947 100644
--- a/crates/fspy/src/unix/syscall_handler/mod.rs
+++ b/crates/fspy/src/unix/syscall_handler/mod.rs
@@ -57,15 +57,14 @@ impl SyscallHandler {
             }
             path = Cow::Owned(resolved_path);
         }
-        let mut mode = match flags & libc::O_ACCMODE {
-            libc::O_RDWR => AccessMode::READ | AccessMode::WRITE,
-            libc::O_WRONLY => AccessMode::WRITE,
-            _ => AccessMode::READ,
-        };
-        if flags & libc::O_DIRECTORY != 0 {
-            mode.insert(AccessMode::READ_DIR);
-        }
-        self.arena.add(PathAccess { mode, path: path.as_os_str().into() });
+        self.arena.add(PathAccess {
+            mode: match flags & libc::O_ACCMODE {
+                libc::O_RDWR => AccessMode::READ | AccessMode::WRITE,
+                libc::O_WRONLY => AccessMode::WRITE,
+                _ => AccessMode::READ,
+            },
+            path: path.as_os_str().into(),
+        });
         Ok(())
     }
 
diff --git a/crates/fspy/tests/rust_std.rs b/crates/fspy/tests/rust_std.rs
index e16b6e25..7c5ed30a 100644
--- a/crates/fspy/tests/rust_std.rs
+++ b/crates/fspy/tests/rust_std.rs
@@ -52,7 +52,8 @@ async fn readdir() -> anyhow::Result<()> {
 
     let accesses = track_fn!(tmpdir_path.to_str().unwrap().to_owned(), |tmpdir_path: String| {
         std::env::set_current_dir(tmpdir_path).unwrap();
-        let _ = std::fs::read_dir("hello_dir");
+        // Consume at least one entry so that getdents64 fires on seccomp targets.
+        let _ = std::fs::read_dir("hello_dir").unwrap().next();
     })
     .await?;
     assert_contains(&accesses, tmpdir_path.join("hello_dir").as_path(), AccessMode::READ_DIR);
diff --git a/crates/fspy/tests/test_utils/mod.rs b/crates/fspy/tests/test_utils/mod.rs
index 4d4e9314..20e7a2c4 100644
--- a/crates/fspy/tests/test_utils/mod.rs
+++ b/crates/fspy/tests/test_utils/mod.rs
@@ -1,5 +1,3 @@
-subprocess_test::subprocess_dispatch_ctor!();
-
 use std::path::{Path, PathBuf, StripPrefixError};
 
 use fspy::{AccessMode, PathAccessIterable};
diff --git a/crates/fspy_shared/Cargo.toml b/crates/fspy_shared/Cargo.toml
index 9f3f7448..756e4512 100644
--- a/crates/fspy_shared/Cargo.toml
+++ b/crates/fspy_shared/Cargo.toml
@@ -23,7 +23,6 @@ winapi = { workspace = true, features = ["std"] }
 [dev-dependencies]
 assert2 = { workspace = true }
 ctor = { workspace = true }
-linkme = { workspace = true }
 rustc-hash = { workspace = true }
 shared_memory = { workspace = true, features = ["logging"] }
 subprocess_test = { workspace = true }
@@ -35,4 +34,4 @@ workspace = true
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor", "linkme"]
+ignored = ["ctor"]
diff --git a/crates/fspy_shared/src/ipc/channel/mod.rs b/crates/fspy_shared/src/ipc/channel/mod.rs
index d34ed73a..3e67cea8 100644
--- a/crates/fspy_shared/src/ipc/channel/mod.rs
+++ b/crates/fspy_shared/src/ipc/channel/mod.rs
@@ -183,9 +183,6 @@ impl<'a> Deref for ReceiverLockGuard<'a> {
     }
 }
 
-#[cfg(test)]
-subprocess_test::subprocess_dispatch_ctor!();
-
 #[cfg(test)]
 mod tests {
     use std::{num::NonZeroUsize, str::from_utf8};
diff --git a/crates/pty_terminal/Cargo.toml b/crates/pty_terminal/Cargo.toml
index 2320ea30..7bec6fc9 100644
--- a/crates/pty_terminal/Cargo.toml
+++ b/crates/pty_terminal/Cargo.toml
@@ -15,7 +15,6 @@ vt100 = { workspace = true }
 [dev-dependencies]
 ctor = { workspace = true }
 ctrlc = { workspace = true }
-linkme = { workspace = true }
 ntest = "0.9.5"
 subprocess_test = { workspace = true, features = ["portable-pty"] }
 terminal_size = "0.4"
@@ -31,4 +30,4 @@ test = false
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor", "linkme"]
+ignored = ["ctor"]
diff --git a/crates/pty_terminal/tests/terminal.rs b/crates/pty_terminal/tests/terminal.rs
index c91e459d..44489124 100644
--- a/crates/pty_terminal/tests/terminal.rs
+++ b/crates/pty_terminal/tests/terminal.rs
@@ -1,5 +1,3 @@
-subprocess_test::subprocess_dispatch_ctor!();
-
 use std::{
     io::{BufRead, BufReader, IsTerminal, Read, Write, stderr, stdin, stdout},
     time::{Duration, Instant},
diff --git a/crates/pty_terminal_test/Cargo.toml b/crates/pty_terminal_test/Cargo.toml
index 04b13d65..a830d4b8 100644
--- a/crates/pty_terminal_test/Cargo.toml
+++ b/crates/pty_terminal_test/Cargo.toml
@@ -16,7 +16,6 @@ pty_terminal_test_client = { workspace = true }
 [dev-dependencies]
 crossterm = { workspace = true }
 ctor = { workspace = true }
-linkme = { workspace = true }
 ntest = "0.9.5"
 pty_terminal_test_client = { workspace = true, features = ["testing"] }
 subprocess_test = { workspace = true, features = ["portable-pty"] }
@@ -29,4 +28,4 @@ test = false
 doctest = false
 
 [package.metadata.cargo-shear]
-ignored = ["ctor", "linkme"]
+ignored = ["ctor"]
diff --git a/crates/pty_terminal_test/tests/milestone.rs b/crates/pty_terminal_test/tests/milestone.rs
index bbea8170..e878e069 100644
--- a/crates/pty_terminal_test/tests/milestone.rs
+++ b/crates/pty_terminal_test/tests/milestone.rs
@@ -1,5 +1,3 @@
-subprocess_test::subprocess_dispatch_ctor!();
-
 use std::io::Write;
 
 use ntest::timeout;
diff --git a/crates/subprocess_test/Cargo.toml b/crates/subprocess_test/Cargo.toml
index b3df106a..63dcb9da 100644
--- a/crates/subprocess_test/Cargo.toml
+++ b/crates/subprocess_test/Cargo.toml
@@ -13,7 +13,6 @@ bincode = { workspace = true }
 ctor = { workspace = true }
 fspy = { workspace = true, optional = true }
 libc = { workspace = true }
-linkme = { workspace = true }
 portable-pty = { workspace = true, optional = true }
 rustc-hash = { workspace = true }
 
@@ -27,6 +26,3 @@ workspace = true
 
 [lib]
 doctest = false
-
-[package.metadata.cargo-shear]
-ignored = []
diff --git a/crates/subprocess_test/src/lib.rs b/crates/subprocess_test/src/lib.rs
index ea698e56..23aced68 100644
--- a/crates/subprocess_test/src/lib.rs
+++ b/crates/subprocess_test/src/lib.rs
@@ -48,36 +48,28 @@ impl From<Command> for portable_pty::CommandBuilder {
     }
 }
 
-/// Type for subprocess handler entries in the distributed slice.
-#[doc(hidden)]
-pub struct SubprocessHandler {
-    pub id: &'static str,
-    pub handler: fn(),
-}
+/// Creates a `subprocess_test::Command` that only executes the provided function.
+///
+/// - $arg: The argument to pass to the function, must implement `Encode` and `Decode`.
+/// - $f: The function to run in the separate process, takes one argument of the type of $arg.
+#[macro_export]
+macro_rules! command_for_fn {
+    ($arg: expr, $f: expr) => {{
+        // Generate a unique ID for every invocation of this macro.
+        const ID: &str =
+            ::core::concat!(::core::file!(), ":", ::core::line!(), ":", ::core::column!());
 
-#[doc(hidden)]
-#[linkme::distributed_slice]
-pub static SUBPROCESS_HANDLERS: [SubprocessHandler];
+        fn assert_arg_type<A>(_arg: &A, _f: impl FnOnce(A)) {}
+        assert_arg_type(&$arg, $f);
 
-/// Checks if the process was spawned as a subprocess and dispatches to the
-/// matching handler. Called from the crate-level init function.
-///
-/// Uses [`get_args`] to read arguments, which works even during `.init_array`
-/// on musl targets where `std::env::args()` is not yet initialized.
-#[doc(hidden)]
-pub fn subprocess_dispatch() {
-    let args = get_args();
-    // <test_binary> <expected_id> <arg_base64>
-    if args.len() < 3 {
-        return;
-    }
-    let current_id = &args[1];
-    for handler in SUBPROCESS_HANDLERS {
-        if handler.id == current_id {
-            (handler.handler)();
-            // handler calls std::process::exit(0) — unreachable
+        // Register an initializer that runs the provided function when the process is started
+        #[::ctor::ctor]
+        unsafe fn init() {
+            $crate::init_impl(ID, $f);
         }
-    }
+        // Create the command
+        $crate::create_command(ID, $arg)
+    }};
 }
 
 /// Read command-line arguments in a way that works during `.init_array`.
@@ -152,70 +144,6 @@ fn read_proc_cmdline() -> Option<Vec<String>> {
     Some(args)
 }
 
-/// Creates a `subprocess_test::Command` that only executes the provided function.
-///
-/// - $arg: The argument to pass to the function, must implement `Encode` and `Decode`.
-/// - $f: The function to run in the separate process, takes one argument of the type of $arg.
-///
-/// **Important:** Every crate that uses this macro must also invoke
-/// [`subprocess_dispatch_ctor!()`] once at crate scope (outside any function)
-/// to register the subprocess dispatcher.
-#[macro_export]
-macro_rules! command_for_fn {
-    ($arg: expr, $f: expr) => {{
-        // Generate a unique ID for every invocation of this macro.
-        const ID: &str =
-            ::core::concat!(::core::file!(), ":", ::core::line!(), ":", ::core::column!());
-
-        fn assert_arg_type<A>(_arg: &A, _f: impl FnOnce(A)) {}
-        assert_arg_type(&$arg, $f);
-
-        // Register a handler in the distributed slice.
-        #[::linkme::distributed_slice($crate::SUBPROCESS_HANDLERS)]
-        #[linkme(crate = ::linkme)]
-        static HANDLER: $crate::SubprocessHandler = $crate::SubprocessHandler {
-            id: ID,
-            handler: || {
-                $crate::init_impl(ID, $f);
-            },
-        };
-
-        // Create the command
-        $crate::create_command(ID, $arg)
-    }};
-}
-
-/// Register the subprocess dispatcher as a `#[ctor]` in the calling crate.
-///
-/// Must be invoked once at crate scope in every crate that uses
-/// [`command_for_fn!`]. On musl targets, `#[ctor]` may not work reliably
-/// in test binaries — use [`subprocess_dispatch()`] at the start of a
-/// custom test main instead.
-#[macro_export]
-macro_rules! subprocess_dispatch_ctor {
-    () => {
-        #[::ctor::ctor]
-        fn __subprocess_dispatch() {
-            $crate::subprocess_dispatch();
-        }
-    };
-}
-
-/// Wrap the standard test runner with subprocess dispatch.
-///
-/// Use this at the top of custom test mains (`harness = false`) or
-/// invoke via the `subprocess_test_main!` macro for test crates that
-/// need subprocess support on musl.
-#[macro_export]
-macro_rules! subprocess_test_main {
-    ($body:expr) => {
-        fn main() {
-            $crate::subprocess_dispatch();
-            $body
-        }
-    };
-}
-
 #[doc(hidden)]
 pub fn init_impl<A: Decode<()>>(expected_id: &str, f: impl FnOnce(A)) {
     let args = get_args();
@@ -247,9 +175,6 @@ pub fn create_command(id: &str, arg: impl Encode) -> Command {
     Command { program, args, envs, cwd }
 }
 
-#[cfg(test)]
-subprocess_dispatch_ctor!();
-
 #[cfg(test)]
 mod tests {
     use std::str::from_utf8;
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml
index efc22a7c..10294938 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-cache-test/snapshots.toml
@@ -78,7 +78,6 @@ steps = [
 # - Files NOT read by the command do NOT trigger invalidation
 [[e2e]]
 name = "auto only - miss on inferred file change"
-requires_fspy = true
 steps = [
   # Initial run - reads src/main.ts
   "vt run auto-only",
@@ -90,7 +89,6 @@ steps = [
 
 [[e2e]]
 name = "auto only - hit on non-inferred file change"
-requires_fspy = true
 steps = [
   # Initial run - reads src/main.ts (NOT utils.ts)
   "vt run auto-only",
@@ -105,7 +103,6 @@ steps = [
 # - Files in excluded directories don't trigger invalidation even if read
 [[e2e]]
 name = "auto with negative - hit on excluded inferred file"
-requires_fspy = true
 steps = [
   # Initial run - reads both src/main.ts and dist/output.js
   "vt run auto-with-negative",
@@ -117,7 +114,6 @@ steps = [
 
 [[e2e]]
 name = "auto with negative - miss on non-excluded inferred file"
-requires_fspy = true
 steps = [
   # Initial run
   "vt run auto-with-negative",
@@ -143,7 +139,6 @@ steps = [
 
 [[e2e]]
 name = "positive auto negative - miss on inferred file"
-requires_fspy = true
 steps = [
   # Initial run
   "vt run positive-auto-negative",
@@ -194,7 +189,6 @@ steps = [
 # - FSPY is NOT set when fspy is disabled (explicit globs only)
 [[e2e]]
 name = "fspy env - set when auto inference enabled"
-requires_fspy = true
 steps = [
   # Run task with auto inference - should see FSPY=1
   "vt run check-fspy-env-with-auto",
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml
index 44977481..fb3f32d2 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-negative-glob-subpackage/snapshots.toml
@@ -8,7 +8,6 @@
 # - Modifying dist/output.js should be a cache hit
 [[e2e]]
 name = "subpackage auto with negative - hit on excluded inferred file"
-requires_fspy = true
 steps = [
   # First run - reads both src/main.ts and dist/output.js
   "vt run sub-pkg#auto-with-negative",
@@ -20,7 +19,6 @@ steps = [
 
 [[e2e]]
 name = "subpackage auto with negative - miss on non-excluded inferred file"
-requires_fspy = true
 steps = [
   # First run
   "vt run sub-pkg#auto-with-negative",
@@ -81,7 +79,6 @@ steps = [
 # - Negative glob excludes sibling dist/ from inferred input
 [[e2e]]
 name = "dotdot auto negative - hit on excluded sibling inferred file"
-requires_fspy = true
 steps = [
   "vt run sub-pkg#dotdot-auto-negative",
   # Modify file in excluded sibling dist/
@@ -92,7 +89,6 @@ steps = [
 
 [[e2e]]
 name = "dotdot auto negative - miss on non-excluded sibling inferred file"
-requires_fspy = true
 steps = [
   "vt run sub-pkg#dotdot-auto-negative",
   # Modify non-excluded sibling file
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml
index f0f1ef11..33301f5d 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/input-read-write-not-cached/snapshots.toml
@@ -4,26 +4,22 @@
 # Single rw-task: compact summary shows "not cached because it modified its input"
 [[e2e]]
 name = "single read-write task shows not cached message"
-requires_fspy = true
 cwd = "packages/rw-pkg"
 steps = ["vt run task", "vt run task"]
 
 # Multi-task (recursive): compact summary shows stats + InputModified notice
 [[e2e]]
 name = "multi task with read-write shows not cached in summary"
-requires_fspy = true
 steps = ["vt run -r task", "vt run -r task"]
 
 # Verbose: full summary shows the overlapping path
 [[e2e]]
 name = "verbose read-write task shows path in full summary"
-requires_fspy = true
 cwd = "packages/rw-pkg"
 steps = ["vt run -v task"]
 
 # Single O_RDWR open (touch-file) is also detected as read-write overlap
 [[e2e]]
 name = "single O_RDWR open is not cached"
-requires_fspy = true
 cwd = "packages/touch-pkg"
 steps = ["vt run task", "vt run task"]
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml
index f202b57f..364c0dcc 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml
+++ b/crates/vite_task_bin/tests/e2e_snapshots/fixtures/lint-dot-git/snapshots.toml
@@ -2,7 +2,6 @@
 
 [[e2e]]
 name = "lint dot git"
-requires_fspy = true
 steps = [
   "mkdir .git",
   "vt run lint # cache miss",
diff --git a/crates/vite_task_bin/tests/e2e_snapshots/main.rs b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
index 58fd397b..47529395 100644
--- a/crates/vite_task_bin/tests/e2e_snapshots/main.rs
+++ b/crates/vite_task_bin/tests/e2e_snapshots/main.rs
@@ -198,10 +198,6 @@ struct E2e {
     /// Optional platform filter: "unix" or "windows". If set, test only runs on that platform.
     #[serde(default)]
     pub platform: Option<Str>,
-    /// Deprecated: fspy now works on musl via seccomp unotify.
-    /// Kept for backwards compatibility with existing snapshots.toml files.
-    #[serde(default)]
-    pub requires_fspy: bool,
 }
 
 #[derive(serde::Deserialize, Default)]
@@ -317,9 +313,6 @@ fn run_case_inner(tmpdir: &AbsolutePath, fixture_path: &std::path::Path, fixture
             }
         }
 
-        // fspy works on musl via seccomp unotify — no tests need to be skipped.
-        let _ = e2e.requires_fspy;
-
         let _info_guard = if e2e.cwd.as_str().is_empty() {
             None
         } else {

From e52ccb962420ba295bb5e9691be24257c1a67c4d Mon Sep 17 00:00:00 2001
From: branchseer <dk4rest@gmail.com>
Date: Fri, 20 Mar 2026 09:17:27 +0800
Subject: [PATCH 29/34] refactor: remove unnecessary seccomp=unconfined from
 Alpine CI container

The seccomp override is no longer needed since fspy seccomp tracing
was fixed for musl in a prior commit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b69ddd1f..e34f9cd7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -140,7 +140,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: alpine:3.21
-      options: --security-opt seccomp=unconfined --shm-size=256m
+      options: --shm-size=256m # shm_io tests need bigger shared memory
     steps:
       - name: Install Alpine dependencies
         shell: sh {0}

From 82464f9e5deb436f3dbce9e855067187763a0f27 Mon Sep 17 00:00:00 2001
From: branchseer <dk4rest@gmail.com>
Date: Fri, 20 Mar 2026 09:44:27 +0800
Subject: [PATCH 30/34] refactor: simplify Alpine CI with node image, corepack,
 and smart linker scripts

- Use node:22-alpine3.21 image instead of alpine:3.21 to get Node.js
  with TypeScript support pre-installed
- Use corepack to install pnpm, respecting packageManager in package.json
- Update .cargo linker scripts to detect Linux hosts and use system cc
  directly, removing the need for the sed workaround in CI
- Split Rust setup into rustup install + toolchain install from
  rust-toolchain.toml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .cargo/config.toml                      |  4 ++--
 .cargo/zigcc-aarch64-unknown-linux-musl |  5 +++++
 .cargo/zigcc-x86_64-unknown-linux-musl  |  5 +++++
 .github/workflows/ci.yml                | 23 +++++++----------------
 4 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index b52768ea..e9ac52c2 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -4,8 +4,8 @@ rustflags = ["--cfg", "tokio_unstable", "-D", "warnings"]
 [unstable]
 bindeps = true
 
-# Linker wrappers for cross-compiling bindep targets (fspy_test_bin) via cargo-zigbuild.
-# On native Linux the system linker can handle musl targets; these are needed on non-Linux hosts.
+# Linker wrappers for musl targets. On Linux hosts these use the system cc directly;
+# on non-Linux hosts (macOS, Windows) they cross-compile via cargo-zigbuild.
 [target.x86_64-unknown-linux-musl]
 rustflags = ["-C", "linker=.cargo/zigcc-x86_64-unknown-linux-musl"]
 
diff --git a/.cargo/zigcc-aarch64-unknown-linux-musl b/.cargo/zigcc-aarch64-unknown-linux-musl
index 2c638a92..6dba882b 100755
--- a/.cargo/zigcc-aarch64-unknown-linux-musl
+++ b/.cargo/zigcc-aarch64-unknown-linux-musl
@@ -1,2 +1,7 @@
 #!/bin/sh
+# Linker wrapper for aarch64-unknown-linux-musl targets.
+# On Linux, use the system cc directly. On other hosts, cross-compile via cargo-zigbuild.
+if [ "$(uname -s)" = "Linux" ]; then
+  exec cc "$@"
+fi
 exec cargo-zigbuild zig cc -- -fno-sanitize=all -target aarch64-linux-musl "$@"
diff --git a/.cargo/zigcc-x86_64-unknown-linux-musl b/.cargo/zigcc-x86_64-unknown-linux-musl
index 51e21946..c7e04fda 100755
--- a/.cargo/zigcc-x86_64-unknown-linux-musl
+++ b/.cargo/zigcc-x86_64-unknown-linux-musl
@@ -1,2 +1,7 @@
 #!/bin/sh
+# Linker wrapper for x86_64-unknown-linux-musl targets.
+# On Linux, use the system cc directly. On other hosts, cross-compile via cargo-zigbuild.
+if [ "$(uname -s)" = "Linux" ]; then
+  exec cc "$@"
+fi
 exec cargo-zigbuild zig cc -- -fno-sanitize=all -target x86_64-linux-musl "$@"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e34f9cd7..37a921d4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -139,7 +139,7 @@ jobs:
     name: Test (musl)
     runs-on: ubuntu-latest
     container:
-      image: alpine:3.21
+      image: node:22-alpine3.21
       options: --shm-size=256m # shm_io tests need bigger shared memory
     steps:
       - name: Install Alpine dependencies
@@ -151,28 +151,19 @@ jobs:
           persist-credentials: false
           submodules: true
 
-      # Alpine's Node.js package is compiled without TypeScript type-stripping.
-      # Install the official Node.js musl binary which includes full TypeScript support.
-      - name: Install Node.js from official distribution
+      - name: Install rustup
         run: |
-          NODE_VERSION=v$(cat .node-version)
-          curl -fsSL "https://unofficial-builds.nodejs.org/download/release/${NODE_VERSION}/node-${NODE_VERSION}-linux-x64-musl.tar.gz" | tar -xz -C /usr/local --strip-components=1
-
-      - name: Install Rust
-        run: |
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly-2026-03-05
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
+      - name: Install Rust toolchain
+        run: rustup show
+
       - name: Install pnpm and Node tools
         run: |
-          npm install -g pnpm
+          corepack enable
           pnpm install
 
-      # Remove the zig cross-compilation config from .cargo/config.toml — in Alpine,
-      # the system cc is already musl-based, so no cross-compilation linker is needed.
-      - name: Remove zig linker config for native musl
-        run: sed -i '/\[target.*musl\]/,/^$/d' .cargo/config.toml
-
       - run: cargo test --no-fail-fast
 
   fmt:

From 6cfce38c787fbbd9ce30e628db76c4e31e5cf44d Mon Sep 17 00:00:00 2001
From: branchseer <dk4rest@gmail.com>
Date: Fri, 20 Mar 2026 09:55:16 +0800
Subject: [PATCH 31/34] fix: use cargo linker config key instead of rustflags
 for path resolution

The linker path specified via rustflags (-C linker=...) is passed to
rustc which doesn't resolve it relative to the config file. Using
Cargo's native `linker` key resolves relative paths correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .cargo/config.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index e9ac52c2..91d7ff89 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -7,7 +7,7 @@ bindeps = true
 # Linker wrappers for musl targets. On Linux hosts these use the system cc directly;
 # on non-Linux hosts (macOS, Windows) they cross-compile via cargo-zigbuild.
 [target.x86_64-unknown-linux-musl]
-rustflags = ["-C", "linker=.cargo/zigcc-x86_64-unknown-linux-musl"]
+linker = ".cargo/zigcc-x86_64-unknown-linux-musl"
 
 [target.aarch64-unknown-linux-musl]
-rustflags = ["-C", "linker=.cargo/zigcc-aarch64-unknown-linux-musl"]
+linker = ".cargo/zigcc-aarch64-unknown-linux-musl"

From 1a8f44937c883b67aa6b57aadf2cd439b229ac6e Mon Sep 17 00:00:00 2001
From: branchseer <dk4rest@gmail.com>
Date: Fri, 20 Mar 2026 10:40:52 +0800
Subject: [PATCH 32/34] chore: add changelog and clean up comments

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml                       | 2 +-
 CHANGELOG.md                                   | 3 +++
 crates/fspy/src/lib.rs                         | 2 +-
 crates/fspy_preload_unix/src/lib.rs            | 2 +-
 crates/fspy_seccomp_unotify/tests/arg_types.rs | 3 ---
 5 files changed, 6 insertions(+), 6 deletions(-)
 create mode 100644 CHANGELOG.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 37a921d4..ebcfafd5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -164,7 +164,7 @@ jobs:
           corepack enable
           pnpm install
 
-      - run: cargo test --no-fail-fast
+      - run: cargo test
 
   fmt:
     name: Format and Check Deps
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..a6e6b32c
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,3 @@
+# Changelog
+
+- [Added] Musl (Alpine Linux) target support (#273)
diff --git a/crates/fspy/src/lib.rs b/crates/fspy/src/lib.rs
index 918e1e35..8a25ca06 100644
--- a/crates/fspy/src/lib.rs
+++ b/crates/fspy/src/lib.rs
@@ -2,7 +2,7 @@
 #![feature(once_cell_try)]
 
 // Persist the injected DLL/shared library somewhere in the filesystem.
-// Not needed on musl where LD_PRELOAD is unavailable (seccomp-only tracking).
+// Not needed on musl (seccomp-only tracking).
 #[cfg(not(target_env = "musl"))]
 mod artifact;
 
diff --git a/crates/fspy_preload_unix/src/lib.rs b/crates/fspy_preload_unix/src/lib.rs
index 8479df0d..9728cd98 100644
--- a/crates/fspy_preload_unix/src/lib.rs
+++ b/crates/fspy_preload_unix/src/lib.rs
@@ -1,4 +1,4 @@
-// On musl targets, fspy_preload_unix is not usable (musl does not support cdylib/LD_PRELOAD).
+// On musl targets, fspy_preload_unix is not needed since we can track accesses via seccomp-only.
 // Compile as an empty crate to avoid build failures from missing libc symbols.
 #![cfg_attr(not(target_env = "musl"), feature(c_variadic))]
 
diff --git a/crates/fspy_seccomp_unotify/tests/arg_types.rs b/crates/fspy_seccomp_unotify/tests/arg_types.rs
index 6a9771c5..810dd478 100644
--- a/crates/fspy_seccomp_unotify/tests/arg_types.rs
+++ b/crates/fspy_seccomp_unotify/tests/arg_types.rs
@@ -90,9 +90,6 @@ async fn run_in_pre_exec(
 async fn fd_and_path() -> Result<(), Box<dyn Error>> {
     let syscalls = run_in_pre_exec(|| {
         set_current_dir("/")?;
-        // Use openat(AT_FDCWD, ...) instead of open() because musl's open()
-        // uses the native `open` syscall on x86_64, which isn't intercepted by
-        // the test's openat-only seccomp handler.
         let home_fd = openat(AT_FDCWD, c"/home", OFlag::O_PATH, Mode::empty())?;
         let _ = openat(home_fd, c"open_at_home", OFlag::O_RDONLY, Mode::empty());
         let _ = openat(AT_FDCWD, c"openat_cwd", OFlag::O_RDONLY, Mode::empty());

From 995fa54eda7090be17fdd9bcb8aabe234a2c3063 Mon Sep 17 00:00:00 2001
From: branchseer <dk4rest@gmail.com>
Date: Fri, 20 Mar 2026 10:54:17 +0800
Subject: [PATCH 33/34] refactor: use nix instead of raw libc in
 subprocess_test, remove CI env override
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace raw libc::open/read/close with safe nix equivalents in
  read_proc_cmdline
- Remove CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS env var from
  Alpine CI — the linker scripts detect Linux and use system cc directly
- Revert linker config to rustflags (needed for cargo-zigbuild bindeps)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .cargo/config.toml                |  4 ++--
 .github/workflows/ci.yml          |  5 ++++
 Cargo.lock                        |  1 -
 crates/subprocess_test/Cargo.toml |  1 -
 crates/subprocess_test/src/lib.rs | 40 ++++++-------------------------
 5 files changed, 14 insertions(+), 37 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index 91d7ff89..e9ac52c2 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -7,7 +7,7 @@ bindeps = true
 # Linker wrappers for musl targets. On Linux hosts these use the system cc directly;
 # on non-Linux hosts (macOS, Windows) they cross-compile via cargo-zigbuild.
 [target.x86_64-unknown-linux-musl]
-linker = ".cargo/zigcc-x86_64-unknown-linux-musl"
+rustflags = ["-C", "linker=.cargo/zigcc-x86_64-unknown-linux-musl"]
 
 [target.aarch64-unknown-linux-musl]
-linker = ".cargo/zigcc-aarch64-unknown-linux-musl"
+rustflags = ["-C", "linker=.cargo/zigcc-aarch64-unknown-linux-musl"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ebcfafd5..106a3440 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -141,6 +141,11 @@ jobs:
     container:
       image: node:22-alpine3.21
       options: --shm-size=256m # shm_io tests need bigger shared memory
+    env:
+      # Override all rustflags to skip the zig cross-linker from .cargo/config.toml.
+      # Alpine's cc is already musl-native, so no custom linker is needed.
+      # Must mirror [build].rustflags from .cargo/config.toml.
+      RUSTFLAGS: --cfg tokio_unstable -D warnings
     steps:
       - name: Install Alpine dependencies
         shell: sh {0}
diff --git a/Cargo.lock b/Cargo.lock
index ec08ca98..cc0b85be 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3206,7 +3206,6 @@ dependencies = [
  "bincode",
  "ctor",
  "fspy",
- "libc",
  "portable-pty",
  "rustc-hash",
 ]
diff --git a/crates/subprocess_test/Cargo.toml b/crates/subprocess_test/Cargo.toml
index 63dcb9da..6d4f17fa 100644
--- a/crates/subprocess_test/Cargo.toml
+++ b/crates/subprocess_test/Cargo.toml
@@ -12,7 +12,6 @@ base64 = { workspace = true }
 bincode = { workspace = true }
 ctor = { workspace = true }
 fspy = { workspace = true, optional = true }
-libc = { workspace = true }
 portable-pty = { workspace = true, optional = true }
 rustc-hash = { workspace = true }
 
diff --git a/crates/subprocess_test/src/lib.rs b/crates/subprocess_test/src/lib.rs
index 23aced68..c4d2bcd4 100644
--- a/crates/subprocess_test/src/lib.rs
+++ b/crates/subprocess_test/src/lib.rs
@@ -77,15 +77,14 @@ macro_rules! command_for_fn {
 /// On Linux, `std::env::args()` may return empty during `.init_array`
 /// constructors (observed on musl targets) because the Rust runtime hasn't
 /// initialized its argument storage yet. We fall back to reading
-/// `/proc/self/cmdline` directly using raw syscalls that don't depend on
-/// the Rust runtime being initialized.
+/// `/proc/self/cmdline` directly.
 fn get_args() -> Vec<String> {
     let args: Vec<String> = std::env::args().collect();
     if !args.is_empty() {
         return args;
     }
 
-    // Fallback: read /proc/self/cmdline using raw libc calls.
+    // Fallback: read /proc/self/cmdline directly.
     #[cfg(target_os = "linux")]
     {
         if let Some(args) = read_proc_cmdline() {
@@ -96,44 +95,19 @@ fn get_args() -> Vec<String> {
     args
 }
 
-/// Read `/proc/self/cmdline` using raw libc calls that work before Rust
-/// runtime initialization (during `.init_array` constructors).
+/// Read `/proc/self/cmdline` as a fallback that works before Rust runtime
+/// initialization (during `.init_array` constructors).
 #[cfg(target_os = "linux")]
 fn read_proc_cmdline() -> Option<Vec<String>> {
-    // SAFETY: opening a read-only procfs file with a static path
-    let fd =
-        unsafe { libc::open(c"/proc/self/cmdline".as_ptr(), libc::O_RDONLY | libc::O_CLOEXEC) };
-    if fd < 0 {
-        return None;
-    }
-
-    let mut buf = [0u8; 4096];
-    let mut total = 0usize;
-    loop {
-        // SAFETY: reading into a valid stack buffer from an open fd
-        let n = unsafe { libc::read(fd, buf[total..].as_mut_ptr().cast(), buf.len() - total) };
-        let Ok(n) = usize::try_from(n) else {
-            break;
-        };
-        if n == 0 {
-            break;
-        }
-        total += n;
-        if total >= buf.len() {
-            break;
-        }
-    }
-    // SAFETY: closing an fd we opened
-    unsafe { libc::close(fd) };
-
-    if total == 0 {
+    let buf = std::fs::read("/proc/self/cmdline").ok()?;
+    if buf.is_empty() {
         return None;
     }
 
     // /proc/self/cmdline has null-separated args with a trailing null.
     // We must preserve empty args (e.g., empty base64 for `()` arg) but
     // remove the trailing empty entry from the final null terminator.
-    let mut args: Vec<String> = buf[..total]
+    let mut args: Vec<String> = buf
         .split(|&b| b == 0)
         .filter_map(|s| std::str::from_utf8(s).ok().map(String::from))
         .collect();

From 29bfaa09ab09b29fdf08d92a697a01a1058752bf Mon Sep 17 00:00:00 2001
From: branchseer <dk4rest@gmail.com>
Date: Fri, 20 Mar 2026 11:48:40 +0800
Subject: [PATCH 34/34] chore: remove changelog

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md | 3 ---
 1 file changed, 3 deletions(-)
 delete mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
deleted file mode 100644
index a6e6b32c..00000000
--- a/CHANGELOG.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Changelog
-
-- [Added] Musl (Alpine Linux) target support (#273)