@bobfrankston/npmglobalize 1.0.206 → 1.0.208

package/lib.d.ts

@@ -287,6 +287,26 @@ export type UnpublishedDep = {
     path: string;
     reason: 'new' | 'update';
 };
+/** Vet the casing of every `file:` dependency path, in BOTH places it is recorded:
+ *  the spec in package.json and the junction npm created in node_modules.
+ *
+ *  npm resolves a `file:` spec by string concatenation against the cwd and writes
+ *  the result as the link target — it never canonicalizes case, and never checks
+ *  that the target exists. On Windows that rots invisibly: `projects/nodejs/x`
+ *  resolves fine when the directory is really `projects/NodeJS/x`, so nothing
+ *  complains until the path reaches somewhere case matters. Two places it does:
+ *  WSL and Linux deploys can't resolve it at all, and npm's own arborist keys
+ *  nodes by path string, so one directory reached under two spellings becomes two
+ *  nodes and tree loading dies with "Cannot read properties of null".
+ *
+ *  Both records must be repaired together. Fixing only the manifest leaves the
+ *  stale junction in place (npm will not recreate a link it thinks is satisfied);
+ *  fixing only the junction lets the next `npm install` write the bad case back. */
+export declare function verifyDepPathCase(cwd: string, pkg: any): {
+    specs: string[];
+    links: string[];
+    missing: string[];
+};
 export declare function transformDeps(pkg: any, baseDir: string, verbose?: boolean, forcePublish?: boolean): {
     transformed: boolean;
     unpublished: UnpublishedDep[];

package/lib.js

@@ -1320,6 +1320,125 @@ function hasLocalChanges(packageName, version, targetPath, verbose) {
         return false;
     }
 }
+/** The canonical on-disk spelling of `target`, or null if it does not exist.
+ *  Windows answers path queries case-insensitively, so the only way to learn how
+ *  a directory is really spelled is to ask its parent to list it — a segment at a
+ *  time, from the root down. */
+function canonicalCase(target) {
+    const full = path.resolve(target);
+    if (!fs.existsSync(full))
+        return null;
+    const parsed = path.parse(full);
+    const parts = full.slice(parsed.root.length).split(/[\\/]/).filter(Boolean);
+    let cur = parsed.root.toUpperCase();
+    for (const part of parts) {
+        let entries;
+        try {
+            entries = fs.readdirSync(cur);
+        }
+        catch {
+            return null;
+        }
+        const real = entries.find(e => e.toLowerCase() === part.toLowerCase());
+        if (!real)
+            return null;
+        cur = path.join(cur, real);
+    }
+    return cur;
+}
+/** True when two paths name the same place but are spelled with different case
+ *  in a directory name. A bare drive-letter difference (`y:` vs `Y:`) doesn't
+ *  count — it resolves identically everywhere, including WSL's /mnt/y. */
+function caseDiffers(a, b) {
+    const strip = (p) => p.replace(/[\\/]+$/, '').slice(path.parse(p).root.length);
+    return strip(a) !== strip(b);
+}
+/** Vet the casing of every `file:` dependency path, in BOTH places it is recorded:
+ *  the spec in package.json and the junction npm created in node_modules.
+ *
+ *  npm resolves a `file:` spec by string concatenation against the cwd and writes
+ *  the result as the link target — it never canonicalizes case, and never checks
+ *  that the target exists. On Windows that rots invisibly: `projects/nodejs/x`
+ *  resolves fine when the directory is really `projects/NodeJS/x`, so nothing
+ *  complains until the path reaches somewhere case matters. Two places it does:
+ *  WSL and Linux deploys can't resolve it at all, and npm's own arborist keys
+ *  nodes by path string, so one directory reached under two spellings becomes two
+ *  nodes and tree loading dies with "Cannot read properties of null".
+ *
+ *  Both records must be repaired together. Fixing only the manifest leaves the
+ *  stale junction in place (npm will not recreate a link it thinks is satisfied);
+ *  fixing only the junction lets the next `npm install` write the bad case back. */
+export function verifyDepPathCase(cwd, pkg) {
+    const specs = [];
+    const links = [];
+    const missing = [];
+    for (const bucket of ['dependencies', 'devDependencies', '.dependencies']) {
+        const deps = pkg?.[bucket];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [name, spec] of Object.entries(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const abs = path.resolve(cwd, spec.slice('file:'.length));
+            const canonical = canonicalCase(abs);
+            if (!canonical) {
+                missing.push(`${name} -> ${spec} (no such directory)`);
+                continue;
+            }
+            if (!caseDiffers(abs, canonical))
+                continue;
+            // Keep the spec relative, the way it was written.
+            const rel = path.relative(cwd, canonical).split(path.sep).join('/');
+            deps[name] = `file:${rel}`;
+            specs.push(`${name}: ${spec} -> file:${rel}`);
+        }
+    }
+    // The junction npm already made from the old spelling.
+    for (const bucket of ['dependencies', 'devDependencies', '.dependencies']) {
+        const deps = pkg?.[bucket];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [name, spec] of Object.entries(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const linkPath = path.join(cwd, 'node_modules', ...name.split('/'));
+            let stat;
+            try {
+                stat = fs.lstatSync(linkPath);
+            }
+            catch {
+                continue;
+            }
+            if (!stat.isSymbolicLink())
+                continue;
+            let current;
+            try {
+                current = fs.readlinkSync(linkPath).replace(/[\\/]+$/, '');
+            }
+            catch {
+                continue;
+            }
+            const canonical = canonicalCase(current);
+            if (!canonical || !caseDiffers(current, canonical))
+                continue;
+            try {
+                // On Windows a directory junction is removed with rmdir, not unlink,
+                // and neither follows the link — which matters, because deleting
+                // through it would take the real package tree with it.
+                if (process.platform === 'win32')
+                    fs.rmdirSync(linkPath);
+                else
+                    fs.unlinkSync(linkPath);
+                fs.symlinkSync(canonical, linkPath, process.platform === 'win32' ? 'junction' : 'dir');
+                links.push(`${name}: ${current} -> ${canonical}`);
+            }
+            catch (error) {
+                missing.push(`${name}: could not repair link (${error.message})`);
+            }
+        }
+    }
+    return { specs, links, missing };
+}
 export function transformDeps(pkg, baseDir, verbose = false, forcePublish = false) {
     let transformed = false;
     const unpublished = [];
@@ -4180,6 +4299,56 @@ async function waitForNpmVersionInWsl(spec, maxWaitMs = 180000) {
     process.stdout.write(' timed out\n');
     return false;
 }
+/** After a global WSL install, confirm a NON-interactive shell actually resolves
+ *  the binaries we just installed, rather than older copies of them.
+ *
+ *  WSL's npm prefix is per-user (~/.npm-global), and that directory reaches PATH
+ *  only via ~/.bashrc — which returns immediately when the shell is not
+ *  interactive. Every `wsl <cmd>` is non-interactive, so it searches the default
+ *  PATH from /etc/environment instead, where a stale /usr/local/bin entry left by
+ *  an earlier root-prefix install keeps winning. The install genuinely succeeds
+ *  and the version reported by `wsl <tool>` is genuinely stale, which is exactly
+ *  why this went unnoticed for four months. Repair with a symlink rather than a
+ *  copy, so it tracks later installs on its own. */
+async function verifyWslGlobalBins(cwd) {
+    let names = [];
+    try {
+        const pkg = readPackageJson(cwd);
+        if (typeof pkg?.bin === 'string')
+            names = [String(pkg.name || '').split('/').pop()].filter(Boolean);
+        else if (pkg?.bin && typeof pkg.bin === 'object')
+            names = Object.keys(pkg.bin);
+    }
+    catch {
+        return;
+    }
+    if (!names.length)
+        return;
+    const prefixResult = await runCommandAsync('wsl', ['npm', 'config', 'get', 'prefix'], { silent: true });
+    const prefix = (prefixResult.output || '').trim();
+    if (!prefixResult.success || !prefix.startsWith('/'))
+        return;
+    for (const name of names) {
+        const expected = `${prefix}/bin/${name}`;
+        // `bash -c` is non-interactive — the same shape as a bare `wsl <cmd>`,
+        // which is the case that breaks. A login shell would mask the problem.
+        const lookup = await runCommandAsync('wsl', ['bash', '-c', `command -v ${name} || true`], { silent: true });
+        const found = (lookup.output || '').trim();
+        if (!found || found === expected)
+            continue;
+        console.log(colors.yellow(`  WSL resolves ${name} to ${found}, not the copy just installed at ${expected}`));
+        if (!found.startsWith('/usr/local/bin/')) {
+            recordBuildIssue(name, 'warning', `WSL resolves ${name} to ${found} instead of ${expected}, so scripts run a different version than an interactive shell does. Left alone: only /usr/local/bin shadows are repaired automatically.`);
+            continue;
+        }
+        const repair = await runCommandAsync('wsl', ['bash', '-c', `sudo -n rm -f ${found} && sudo -n ln -s ${expected} ${found}`], { silent: true });
+        if (repair.success) {
+            console.log(colors.green(`  ✓ Repaired WSL shadow: ${found} -> ${expected}`));
+            continue;
+        }
+        recordBuildIssue(name, 'warning', `WSL resolves ${name} to a stale ${found}. Repair with: wsl sudo rm ${found} && wsl sudo ln -s ${expected} ${found}`);
+    }
+}
 export async function installInWsl(wslArgs, opts = {}) {
     // Same trust rule as the Windows installs: allow our own packages'
     // install scripts, leave third-party ones gated. Probed against WSL's
@@ -4198,9 +4367,16 @@ export async function installInWsl(wslArgs, opts = {}) {
             process.stderr.write(r.stderr);
         return r;
     };
+    // Every success path leaves through here, so the shadow check cannot be
+    // skipped by whichever retry happened to be the one that worked.
+    const succeed = async (fixed) => {
+        if (opts.cwd && wslArgs.includes('-g'))
+            await verifyWslGlobalBins(opts.cwd);
+        return { success: true, fixed };
+    };
     let result = await runOnce();
     if (result.success)
-        return { success: true, fixed: false };
+        return await succeed(false);
     let combined = (result.output || '') + '\n' + (result.stderr || '');
     // EACCES on a root-owned npm prefix → switch to a user prefix and retry.
     if (/EACCES/.test(combined) && /\/usr\/(?:local\/)?lib\/node_modules/.test(combined)) {
@@ -4216,7 +4392,7 @@ export async function installInWsl(wslArgs, opts = {}) {
         console.log(colors.green('✓ WSL npm prefix set to ~/.npm-global; PATH appended to ~/.bashrc'));
         result = await runOnce();
         if (result.success)
-            return { success: true, fixed: true };
+            return await succeed(true);
         combined = (result.output || '') + '\n' + (result.stderr || '');
     }
     // E404 on a scoped package has TWO causes, and npm gives the same error for
@@ -4233,7 +4409,7 @@ export async function installInWsl(wslArgs, opts = {}) {
                 console.log(colors.green('✓ Synced npm token to WSL'));
                 result = await runOnce();
                 if (result.success)
-                    return { success: true, fixed: true };
+                    return await succeed(true);
             }
             else {
                 console.error(colors.yellow('  Could not authenticate WSL npm. Run `wsl npm login` (or sync your ~/.npmrc token) and retry.'));
@@ -4245,7 +4421,7 @@ export async function installInWsl(wslArgs, opts = {}) {
             if (await waitForNpmVersionInWsl(spec)) {
                 result = await runOnce();
                 if (result.success)
-                    return { success: true, fixed: true };
+                    return await succeed(true);
             }
             else {
                 console.error(colors.yellow(`  ${spec} still not visible to WSL's npm after waiting — try the WSL install again shortly.`));
@@ -6601,6 +6777,23 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             }
         }
     }
+    // Vet file: path casing before transformDeps swaps the specs out — this is the
+    // last moment the real paths are still in hand. Repairs the manifest and the
+    // node_modules junction together; fixing either alone is undone by the other.
+    const caseCheck = verifyDepPathCase(cwd, pkg);
+    if (caseCheck.specs.length || caseCheck.links.length) {
+        for (const fix of caseCheck.specs)
+            console.log(colors.green(`  ✓ Corrected file: path case in package.json — ${fix}`));
+        for (const fix of caseCheck.links)
+            console.log(colors.green(`  ✓ Corrected node_modules link case — ${fix}`));
+        if (caseCheck.specs.length)
+            writePackageJson(cwd, pkg);
+        recordBuildIssue(pkg.name || path.basename(cwd), 'warning', `Corrected ${caseCheck.specs.length} file: path spec(s) and ${caseCheck.links.length} node_modules link(s) whose letter case did not match the directory on disk. npm does not canonicalize these, and the wrong case breaks WSL, Linux deploys, and npm's own tree loading.`);
+    }
+    for (const gone of caseCheck.missing) {
+        console.error(colors.red(`  ✗ file: dependency path does not exist — ${gone}`));
+        recordBuildIssue(pkg.name || path.basename(cwd), 'error', `file: dependency path does not exist — ${gone}`);
+    }
     // Transform dependencies
     if (verbose) {
         console.log('Transforming file: dependencies...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.206",
+  "version": "1.0.208",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@bobfrankston/freezepak": "^0.1.9",
     "@bobfrankston/importgen": "^0.1.40",
-    "@bobfrankston/themecolors": "^0.1.8",
+    "@bobfrankston/themecolors": "^0.1.9",
     "@bobfrankston/userconfig": "^1.0.11",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
@@ -61,7 +61,7 @@
     "dependencies": {
       "@bobfrankston/freezepak": "^0.1.9",
       "@bobfrankston/importgen": "^0.1.40",
-      "@bobfrankston/themecolors": "^0.1.8",
+      "@bobfrankston/themecolors": "^0.1.9",
       "@bobfrankston/userconfig": "^1.0.11",
       "@npmcli/package-json": "^7.0.4",
       "json5": "^2.2.3",