@companion-ai/feynman 0.2.60 → 0.2.61

package/RELEASES.md

@@ -4,6 +4,20 @@ This file is the public release history for Feynman. Keep entries user-facing: w
 
 GitHub release notes are generated from the matching `## vX.Y.Z` section in this file.
 
+## v0.2.61 - 2026-06-11
+
+### Windows
+
+- Fixed bundled-package setup failing on every launch (#177, #170). Two root causes found by running the published package on real Windows runners: GNU tar (Git for Windows) treats the workspace archive's absolute `C:\...` path as a remote host spec ("Cannot connect ... resolve failed"), and the npm fallback spawned bare `npm` without a shell, which Windows rejects with EINVAL. The archive now extracts with relative paths, and npm is invoked through `npm-cli.js` with the running Node executable.
+
+### Runtime Reliability
+
+- The bundled workspace's alpha-hub copy now receives the same launch-time patches as the package-local copy, so the #167 search fix applies regardless of which copy resolves.
+
+### Validation
+
+- The multi-OS end-to-end workflow now verifies install, update, patch application, and live model + subagent smokes on Windows, Linux, and macOS at Node 24 and 25.
+
 ## v0.2.60 - 2026-06-11
 
 ### Node Support

package/dist/pi/package-ops.js

@@ -3,7 +3,9 @@ import { cpSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, re
 import { fileURLToPath } from "node:url";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { DefaultPackageManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { resolveAdjacentNpmCommand } from "../../scripts/lib/npm-command.mjs";
 import { NATIVE_PACKAGE_SOURCES, supportsNativePackageSources } from "./package-presets.js";
+export { resolveAdjacentNpmCommand };
 import { applyFeynmanPackageManagerEnv, getFeynmanNpmPrefixPath } from "./runtime.js";
 import { getPathWithCurrentNode, resolveExecutable } from "../system/executables.js";
 const FILTERED_INSTALL_OUTPUT_PATTERNS = [
@@ -160,19 +162,6 @@ function ensureProjectInstallRoot(workingDir) {
     }
     return installRoot;
 }
-export function resolveAdjacentNpmCommand(nodeExecutablePath = process.execPath, platform = process.platform) {
-    const executableDir = dirname(nodeExecutablePath);
-    if (platform === "win32") {
-        const npmCliPath = resolve(executableDir, "node_modules", "npm", "bin", "npm-cli.js");
-        if (existsSync(npmCliPath)) {
-            return { command: nodeExecutablePath, args: [npmCliPath] };
-        }
-        const npmCmdPath = resolve(executableDir, "npm.cmd");
-        return existsSync(npmCmdPath) ? { command: npmCmdPath, args: [], shell: true } : undefined;
-    }
-    const candidate = resolve(executableDir, "npm");
-    return existsSync(candidate) ? { command: candidate, args: [] } : undefined;
-}
 function resolvePackageManagerCommand(settingsManager) {
     const configured = settingsManager.getNpmCommand();
     if (!configured || configured.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companion-ai/feynman",
-  "version": "0.2.60",
+  "version": "0.2.61",
   "description": "Research-first CLI agent built on Pi and alphaXiv",
   "license": "MIT",
   "type": "module",

package/scripts/lib/npm-command.d.mts

@@ -0,0 +1,10 @@
+export type PackageManagerCommand = {
+	command: string;
+	args: string[];
+	shell?: boolean;
+};
+
+export declare function resolveAdjacentNpmCommand(
+	nodeExecutablePath?: string,
+	platform?: NodeJS.Platform,
+): PackageManagerCommand | undefined;

package/scripts/lib/npm-command.mjs

@@ -0,0 +1,21 @@
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+// Windows cannot spawn `npm`/`npm.cmd` without a shell (EINVAL since the
+// CVE-2024-27980 hardening), and shell spawns with an args array trip
+// DEP0190. Preferring the npm-cli.js entry point next to the running Node
+// executable avoids both: it is a plain Node script spawn on every platform.
+export function resolveAdjacentNpmCommand(nodeExecutablePath = process.execPath, platform = process.platform) {
+	const executableDir = dirname(nodeExecutablePath);
+	if (platform === "win32") {
+		const npmCliPath = resolve(executableDir, "node_modules", "npm", "bin", "npm-cli.js");
+		if (existsSync(npmCliPath)) {
+			return { command: nodeExecutablePath, args: [npmCliPath] };
+		}
+		const npmCmdPath = resolve(executableDir, "npm.cmd");
+		return existsSync(npmCmdPath) ? { command: npmCmdPath, args: [], shell: true } : undefined;
+	}
+
+	const candidate = resolve(executableDir, "npm");
+	return existsSync(candidate) ? { command: candidate, args: [] } : undefined;
+}

package/scripts/patch-embedded-pi.mjs

@@ -9,6 +9,7 @@ import { patchAlphaHubAuthSource } from "./lib/alpha-hub-auth-patch.mjs";
 import { patchAlphaHubSearchResultsSource, patchAlphaHubSearchSource } from "./lib/alpha-hub-search-patch.mjs";
 import { patchPiAgentCoreSource } from "./lib/pi-agent-core-patch.mjs";
 import { patchPiExtensionLoaderSource } from "./lib/pi-extension-loader-patch.mjs";
+import { resolveAdjacentNpmCommand } from "./lib/npm-command.mjs";
 import { patchPiModelRegistrySource } from "./lib/pi-model-registry-patch.mjs";
 import { patchPiPackageManagerSource } from "./lib/pi-package-manager-patch.mjs";
 import { patchPiEditorSource, patchPiInteractiveThemeSource, patchPiTuiSource } from "./lib/pi-tui-patch.mjs";
@@ -192,6 +193,18 @@ function resolvePackageManager() {
 	return null;
 }
 
+function resolvePackageManagerInvocation(packageManager) {
+	if (packageManager === "npm") {
+		const adjacent = resolveAdjacentNpmCommand();
+		if (adjacent) return adjacent;
+	}
+	const resolved = resolveExecutable(packageManager);
+	if (!resolved) return null;
+	// Windows cannot spawn .cmd/.bat shims without a shell (EINVAL).
+	const needsShell = process.platform === "win32" && /\.(cmd|bat)$/i.test(resolved);
+	return { command: resolved, args: [], shell: needsShell };
+}
+
 function installWorkspacePackages(packageSpecs) {
 	const packageManager = resolvePackageManager();
 	if (!packageManager) {
@@ -201,8 +214,14 @@ function installWorkspacePackages(packageSpecs) {
 		return false;
 	}
 
-	const result = spawnSync(packageManager, createInstallCommand(packageManager, packageSpecs), {
+	const invocation = resolvePackageManagerInvocation(packageManager);
+	if (!invocation) {
+		process.stderr.write(`[feynman] could not resolve ${packageManager} executable for bundled package setup.\n`);
+		return false;
+	}
+	const result = spawnSync(invocation.command, [...invocation.args, ...createInstallCommand(packageManager, packageSpecs)], {
 		cwd: workspaceDir,
+		shell: invocation.shell,
 		stdio: ["ignore", "pipe", "pipe"],
 		timeout: 300000,
 		env: {
@@ -419,7 +438,11 @@ function restorePackagedWorkspace(packageSpecs) {
 	rmSync(workspaceDir, { recursive: true, force: true });
 	mkdirSync(resolve(appRoot, ".feynman"), { recursive: true });
 
-	const result = spawnSync("tar", ["-xzf", workspaceArchivePath, "-C", resolve(appRoot, ".feynman")], {
+	// Run tar from .feynman with relative paths: GNU tar (Git for Windows)
+	// treats absolute paths with a drive-letter colon ("C:\...") as remote
+	// host specs and fails with "Cannot connect ... resolve failed".
+	const result = spawnSync("tar", ["-xzf", "runtime-workspace.tgz", "-C", "."], {
+		cwd: resolve(appRoot, ".feynman"),
 		stdio: ["ignore", "ignore", "pipe"],
 		timeout: 300000,
 	});
@@ -855,6 +878,23 @@ if (alphaHubIndexPath && existsSync(alphaHubIndexPath)) {
 	}
 }
 
+// The bundled workspace carries its own alpha-hub copy; patch it the same way
+// so search fixes apply regardless of which copy resolves at runtime.
+const workspaceAlphaHubLib = resolve(workspaceRoot, "@companion-ai", "alpha-hub", "src", "lib");
+for (const [fileName, patchFn] of [
+	["auth.js", patchAlphaHubAuthSource],
+	["alphaxiv.js", patchAlphaHubSearchSource],
+	["index.js", patchAlphaHubSearchResultsSource],
+]) {
+	const filePath = resolve(workspaceAlphaHubLib, fileName);
+	if (!existsSync(filePath)) continue;
+	const source = readFileSync(filePath, "utf8");
+	const patched = patchFn(source);
+	if (patched !== source) {
+		writeFileSync(filePath, patched, "utf8");
+	}
+}
+
 if (existsSync(piMemoryPath)) {
 	let source = readFileSync(piMemoryPath, "utf8");
 	const memoryOriginal = 'const MEMORY_DIR = join(homedir(), ".pi", "memory");';