@edspencer/paddock 0.82.0 → 0.82.1

package/packages/server/dist/cli/update/lock.js

@@ -1,108 +1,74 @@
-/**
- * `<home>/update.lock` — one update at a time (CLI contract SPEC §5 step 1).
- *
- * Two concurrent updates is not a theoretical race. The second one stops the
- * service the first just started, or installs an older target over a newer one,
- * and the loser's rollback then "restores" a version nobody asked for. It is
- * also easy to cause: an Ansible run and a person at a terminal, or a scheduler
- * firing twice.
- *
- * So: `O_EXCL` create, holding the pid. A lock whose pid is alive refuses with
- * exit 1. A lock whose pid is gone — a crashed or killed update — is stale and
- * is removed, because the alternative is an install that can never update
- * itself again without someone finding out about a file they have never heard
- * of.
- *
- * Generic: wave C4 lifts this into `reference/lock.ts`. Node built-ins only.
- */
-import fs from "node:fs";
-import path from "node:path";
-export const LOCK_FILE = "update.lock";
+// From edspencer/cli-contract reference/lock.ts @ 0.2; local changes: `.ts` import specifiers → `.js`, and `exit-codes`, `output` and `runtime-file` imported from where Paddock keeps them (`../`, `../../`).
+// `<home>/update.lock`: one update at a time (SPEC §5 step 1). Two at once is easy to cause (an Ansible run and a
+// person at a terminal) and bad: the second stops the service the first just started, or installs an older target
+// over a newer one, and the loser's rollback "restores" a version nobody asked for.
+//
+// So the lock is an `O_EXCL` create holding the pid. A live holder refuses with exit 1; a dead one (a crashed or
+// killed update) is stale and is removed, or the install could never update itself again. Node built-ins only.
+import fs from 'node:fs';
+import path from 'node:path';
+import { isPidAlive } from '../../runtime-file.js';
+export const LOCK_FILE = 'update.lock';
 export function lockPath(home) {
     return path.join(home, LOCK_FILE);
 }
-/** The lock is held by a live process. Carries its pid so the caller can say so. */
+/** Another live process holds the lock. */
 export class LockHeldError extends Error {
+    name = 'LockHeldError';
     holder;
     path;
     constructor(file, holder) {
-        super(`another update is already running (pid ${holder.pid}, started ${holder.startedAt})\n` +
-            `         If that is wrong, remove ${file} and try again.`);
+        super(`another update is already running (pid ${holder.pid}, started ${holder.startedAt}). If that's wrong, remove ${file} and try again.`);
         this.holder = holder;
         this.path = file;
     }
 }
 /**
- * Take the lock, or throw {@link LockHeldError}.
- *
- * The retry is deliberately ONCE. After removing a stale lock the create is
- * attempted again, and a second `EEXIST` means another process won the same
- * race in that microsecond — which is a genuine holder, not a stale file, so it
- * refuses. Looping instead would be a way to spin forever against a lock being
- * recreated as fast as it is deleted.
+ * Takes the lock, or throws `LockHeldError`. After removing a stale lock it tries once more, and only once: a second
+ * `EEXIST` means another process won the same race just now, which is a real holder.
  */
 export function acquireLock(o) {
     const file = lockPath(o.home);
     const pid = o.pid ?? process.pid;
-    const isAlive = o.isAlive ?? defaultIsAlive;
+    const isAlive = o.isAlive ?? isPidAlive;
     const body = {
         pid,
         startedAt: (o.now ?? (() => new Date()))().toISOString(),
         ...(o.command !== undefined ? { command: o.command } : {}),
     };
     fs.mkdirSync(o.home, { recursive: true });
-    for (let attempt = 0; attempt < 2; attempt++) {
+    for (let attempt = 0;; attempt++) {
         try {
-            // 'wx' is O_CREAT|O_EXCL|O_WRONLY: the create is the lock, in one
-            // syscall, so there is no window between "is it there?" and "make it".
-            fs.writeFileSync(file, `${JSON.stringify(body, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+            // 'wx' is O_CREAT | O_EXCL: the create is the lock, in one call.
+            fs.writeFileSync(file, `${JSON.stringify(body, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
             return { path: file, release: () => releaseLock(file, pid) };
         }
         catch (err) {
-            if (err.code !== "EEXIST")
+            if (err.code !== 'EEXIST')
                 throw err;
             const holder = readLock(file);
-            // An unreadable or pid-less lock file counts as stale: it is either
-            // half-written or from a version that wrote something else, and either
-            // way nobody can prove a process is holding it.
-            if (holder !== null && isAlive(holder.pid) && holder.pid !== pid) {
-                throw new LockHeldError(file, holder);
-            }
-            if (attempt === 1) {
-                throw new LockHeldError(file, holder ?? { pid: 0, startedAt: "unknown" });
+            // A lock with no readable pid counts as stale: nobody can show a process holds it.
+            if ((holder !== null && holder.pid !== pid && isAlive(holder.pid)) || attempt > 0) {
+                throw new LockHeldError(file, holder ?? { pid: 0, startedAt: 'unknown' });
             }
             fs.rmSync(file, { force: true });
         }
     }
-    // Unreachable: both branches of the loop above either return or throw.
-    throw new LockHeldError(file, { pid: 0, startedAt: "unknown" });
 }
 export function readLock(file) {
     try {
-        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
-        if (Number.isInteger(raw.pid) && typeof raw.startedAt === "string")
+        const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (Number.isInteger(raw.pid) && typeof raw.startedAt === 'string')
             return raw;
     }
     catch {
-        /* missing, half-written, or not ours */
+        // missing, half-written, or not a lock
     }
     return null;
 }
-/** Remove the lock only when it still names `pid`: never delete somebody else's. */
+/** Removes the lock only if it names `pid`, or names nothing: never somebody else's. */
 export function releaseLock(file, pid) {
     const holder = readLock(file);
     if (holder === null || holder.pid === pid)
         fs.rmSync(file, { force: true });
 }
-function defaultIsAlive(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        // EPERM means the process exists and is not ours, which still counts.
-        return err.code === "EPERM";
-    }
-}

package/packages/server/dist/cli/update/package-manager.d.ts

@@ -1,109 +1,74 @@
-import type { PackageManager } from "./install-method.js";
+import type { PackageManager } from './install-method.js';
 export interface RunResult {
     status: number | null;
     stdout: string;
     stderr: string;
 }
-/** Run a command; never throws for a non-zero exit. Injected everywhere, for tests. */
+/** Runs a command to completion; never throws for a non-zero exit. Injected everywhere, for tests. */
 export type Spawn = (cmd: string, args: string[], opts?: {
     env?: NodeJS.ProcessEnv;
     shell?: boolean;
     timeoutMs?: number;
 }) => RunResult;
 export declare const spawnSyncRunner: Spawn;
-/**
- * The npm that belongs to the Node running us.
- *
- * `<dirname(execPath)>/npm` on POSIX; on Windows the sibling is `npm.cmd`.
- * Falls back to the bare name — if the sibling is not there (a distro that
- * splits node and npm into separate packages), PATH is the only answer left and
- * is better than failing.
- */
-export declare function npmBeside(execPath?: string, platform?: NodeJS.Platform): string;
+/** How long an install may take. */
+export declare const INSTALL_TIMEOUT_MS: number;
 export interface NpmContext {
     spawn?: Spawn;
     env?: NodeJS.ProcessEnv;
     execPath?: string;
     platform?: NodeJS.Platform;
+    /** Injected for tests: does this file exist? */
+    exists?: (p: string) => boolean;
+    realpath?: (p: string) => string;
 }
-/** Run npm with no shell (except on Windows, where `npm.cmd` needs one). */
-export declare function runNpm(args: string[], ctx?: NpmContext): RunResult;
-/** `npm root -g`, or undefined when npm could not answer. */
+/**
+ * How to run the npm that belongs to this Node: `[execPath, npm-cli.js]`, found beside it (`<dir>/npm` is a symlink
+ * to it on POSIX; on Windows it's `<dir>/node_modules/npm/bin/npm-cli.js`). Falls back to `npm` on the PATH, for a
+ * distribution that packages npm separately.
+ */
+export declare function npmCommand(ctx?: NpmContext): {
+    cmd: string;
+    pre: string[];
+    shell: boolean;
+};
+/** Runs this Node's npm. */
+export declare function runNpm(args: string[], ctx?: NpmContext, timeoutMs?: number): RunResult;
+/** `npm root -g`, or undefined when npm can't answer. */
 export declare function npmGlobalRoot(ctx?: NpmContext): string | undefined;
-/** `npm config get <key>`, or undefined. Used to resolve the registry (SPEC §5 step 3). */
+/** `npm config get <key>`, or undefined. */
 export declare function npmConfigGet(key: string, ctx?: NpmContext): string | undefined;
 /**
- * Really writable? (SPEC §5 step 5.)
- *
- * `access(W_OK)` alone is not enough and the difference is the whole point of
- * this check. It consults the mode bits, which say yes for root and say
- * nothing about a read-only mount, an immutable flag, or an ACL — the usual
- * shapes of "npm install -g needs sudo". So the directory is probed by
- * CREATING something in it and removing it again, which is the same syscall
- * npm is about to make.
- *
- * A missing directory walks up to its nearest existing parent: npm would create
- * it, and whether it can is the parent's question.
+ * Whether `dir` is really writable (SPEC §5 step 5): a folder is created in it and removed again, the same call npm
+ * is about to make. `access(W_OK)` alone says yes to root on a read-only mount, and nothing about ACLs or immutable
+ * flags. A folder that doesn't exist yet asks its nearest existing parent, since npm would create it.
  */
 export declare function isWritable(dir: string): boolean;
 /**
- * Where a package manager would put the package, so {@link isWritable} has a
- * directory to ask about.
- *
- * Only npm can be asked properly (`npm root -g`). For the others the install
- * command's own target is a good enough proxy — and if it is wrong, the install
- * fails with that manager's own message and the rollback runs, which is a worse
- * experience than the sudo hint but not a worse outcome.
+ * Where a manager would install, for `isWritable` to ask about. Only npm can be asked (`npm root -g`). For the others
+ * there's no answer, and an install that can't write fails with that manager's own message, and rolls back.
  */
 export declare function globalRootFor(manager: PackageManager, ctx?: NpmContext): string | undefined;
-export interface InstallInput {
-    manager: PackageManager;
-    packageName: string;
-    version: string;
-    spawn?: Spawn;
-    env?: NodeJS.ProcessEnv;
-    execPath?: string;
-    platform?: NodeJS.Platform;
-}
-/** The argv for a global install, per SPEC §6's last column. */
+/** The global install command, per SPEC §6's last column. */
 export declare function installArgs(manager: PackageManager, spec: string): {
     cmd: string;
     args: string[];
 };
+/** Installs `<name>@<version>` with the manager this install came from. pnpm, bun and volta come from the PATH. */
+export declare function installPackage(o: NpmContext & {
+    manager: PackageManager;
+    packageName: string;
+    version: string;
+}): RunResult;
 /**
- * Install `<name>@<version>` with the manager this install came from.
- *
- * npm goes through {@link runNpm}, so it is the npm beside this Node. The other
- * three are looked up on PATH, which is the only place they are: pnpm, bun and
- * volta are not installed beside node.
- */
-export declare function installPackage(o: InstallInput): RunResult;
-/**
- * `npm cache add <name>@<version>` — fetch before stopping anything
- * (SPEC §5 step 8).
- *
- * Both the target and the CURRENT version are cached, and caching the current
- * one is the half that is easy to leave out and expensive to miss: it is what
- * gives the rollback a package to reinstall when the reason the update failed
- * was the network. Done while the old version is still serving, so a failure
- * here costs nothing but a message.
- *
- * `npm cache add` is used whatever the manager is, because every one of these
- * layouts has an npm available (it ships with Node) and the point is only to
- * have the tarball on the machine. A failure is reported and not fatal — the
- * install below may still succeed from the network.
+ * `npm cache add <name>@<version>` (SPEC §5 step 8), for the target and for the current version, while the old one
+ * still serves. Caching the current one is what lets a rollback reinstall it when the network is what failed. npm
+ * is used whatever the manager: it ships with Node, and the point is only to have the tarball on the machine.
  */
 export declare function cacheAdd(packageName: string, version: string, ctx?: NpmContext): RunResult;
 /**
- * Ask a CLI what version it is, by running it (`node <cli> --version`).
- *
- * This is how `update` proves that the install actually replaced the files
- * before it hands over to the new CLI. The alternative — reading the
- * `package.json` next to it — answers a different question: npm writes the
- * manifest and the files in one operation, but a partially-updated global
- * folder, a stale symlink, or a pnpm layout whose versioned realpath moved all
- * show up here and not there.
+ * A CLI's version, by running it: `node <cli> --version`. This is how `update` shows the install replaced the files
+ * before it hands over. A `package.json` beside it answers a different question: a stale symlink, or a pnpm layout
+ * whose versioned path moved, shows up here and not there.
  */
 export declare function cliVersion(cliPath: string, ctx?: NpmContext): string | undefined;
-/** A throwaway directory, for callers that need one (the writability probe's sibling). */
-export declare function tmpDir(prefix: string): string;

package/packages/server/dist/cli/update/package-manager.js

@@ -1,107 +1,95 @@
-/**
- * Running the package manager (CLI contract SPEC §5 steps 8 and 10, §6, §7).
- *
- * Three jobs, all of them small and all of them easy to get subtly wrong:
- *
- * - **Find npm.** SPEC §6 and §10 both say the `npm` next to
- *   `process.execPath`, not whatever is on PATH. Under nvm, fnm or volta those
- *   are routinely different npms belonging to different Nodes, and asking the
- *   wrong one `npm root -g` gets a global folder this install is not in — which
- *   would report a perfectly ordinary global install as a `dependency` and
- *   refuse to update it.
- * - **No shell.** `spawnSync(npm, args)` with the default `shell: false`, so a
- *   package name or a path with a space in it cannot become two arguments.
- *   Windows is the exception and has to be: `npm` there is `npm.cmd`, which
- *   Node refuses to spawn without a shell since its fix for CVE-2024-27980
- *   (SPEC §7). That path quotes its arguments itself.
- * - **Can we write there?** SPEC §5 step 5. Asked before anything is stopped,
- *   and answered by actually creating a file rather than by `access()` alone —
- *   see {@link isWritable}.
- *
- * Generic: wave C4 lifts this into `reference/`. Node built-ins only.
- */
-import { spawnSync } from "node:child_process";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
+// From edspencer/cli-contract reference/package-manager.ts @ 0.2; local changes: `.ts` import specifiers → `.js`, and `exit-codes`, `output` and `runtime-file` imported from where Paddock keeps them (`../`, `../../`).
+// Running the package manager (SPEC §5 steps 5, 8 and 10, §6, §7). Node built-ins only.
+//
+// - **npm is the one beside `process.execPath`**, run as `node <npm-cli.js>`, never whichever `npm` is first on PATH.
+//   Under nvm, fnm or volta those are different npms for different Nodes, and the wrong one's `npm root -g` is a
+//   global folder this install isn't in: an ordinary global install would read as a dependency and refuse to update.
+//   Running `npm-cli.js` with this Node also needs no shell on Windows, where `npm.cmd` would (CVE-2024-27980).
+// - **No shell otherwise**, so a path or a name with a space in it can't become two arguments. pnpm, bun and volta on
+//   Windows are `.cmd` files and do need one; their arguments are quoted for `cmd.exe` here.
+// - **Writable means a file can be created**, not just that `access()` says yes (`isWritable`).
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
 export const spawnSyncRunner = (cmd, args, opts = {}) => {
     const r = spawnSync(cmd, args, {
-        encoding: "utf8",
+        encoding: 'utf8',
         ...(opts.env !== undefined ? { env: opts.env } : {}),
         ...(opts.shell === true ? { shell: true } : {}),
         ...(opts.timeoutMs !== undefined ? { timeout: opts.timeoutMs } : {}),
         maxBuffer: 32 * 1024 * 1024,
+        windowsHide: true,
     });
-    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+    return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? (r.error ? String(r.error.message) : '') };
 };
+/** How long an install may take. */
+export const INSTALL_TIMEOUT_MS = 15 * 60 * 1000;
 /**
- * The npm that belongs to the Node running us.
- *
- * `<dirname(execPath)>/npm` on POSIX; on Windows the sibling is `npm.cmd`.
- * Falls back to the bare name — if the sibling is not there (a distro that
- * splits node and npm into separate packages), PATH is the only answer left and
- * is better than failing.
+ * How to run the npm that belongs to this Node: `[execPath, npm-cli.js]`, found beside it (`<dir>/npm` is a symlink
+ * to it on POSIX; on Windows it's `<dir>/node_modules/npm/bin/npm-cli.js`). Falls back to `npm` on the PATH, for a
+ * distribution that packages npm separately.
  */
-export function npmBeside(execPath = process.execPath, platform = process.platform) {
+export function npmCommand(ctx = {}) {
+    const execPath = ctx.execPath ?? process.execPath;
+    const platform = ctx.platform ?? process.platform;
+    const exists = ctx.exists ?? ((p) => fs.existsSync(p));
+    const realpath = ctx.realpath ?? ((p) => fs.realpathSync(p));
     const dir = path.dirname(execPath);
-    const candidate = path.join(dir, platform === "win32" ? "npm.cmd" : "npm");
-    try {
-        if (fs.existsSync(candidate))
-            return candidate;
+    const candidates = platform === 'win32'
+        ? [path.join(dir, 'node_modules', 'npm', 'bin', 'npm-cli.js')]
+        : [path.join(dir, 'npm'), path.join(dir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js')];
+    for (const c of candidates) {
+        if (!exists(c))
+            continue;
+        let real = c;
+        try {
+            real = realpath(c);
+        }
+        catch {
+            // keep the candidate
+        }
+        if (real.endsWith('.js'))
+            return { cmd: execPath, pre: [real], shell: false };
     }
-    catch {
-        /* fall through */
-    }
-    return platform === "win32" ? "npm.cmd" : "npm";
+    return platform === 'win32' ? { cmd: 'npm.cmd', pre: [], shell: true } : { cmd: 'npm', pre: [], shell: false };
 }
-/** Run npm with no shell (except on Windows, where `npm.cmd` needs one). */
-export function runNpm(args, ctx = {}) {
-    const platform = ctx.platform ?? process.platform;
-    const cmd = npmBeside(ctx.execPath ?? process.execPath, platform);
+/** Quotes each word for `cmd.exe`, for the one case that needs a shell. */
+function cmdLine(cmd, args) {
+    const q = (a) => (/^[\w@./:=+-]+$/.test(a) ? a : `"${a.replace(/"/g, '""')}"`);
+    return { cmd: [cmd, ...args].map(q).join(' '), args: [] };
+}
+function runWith(cmd, args, shell, ctx, timeoutMs) {
     const run = ctx.spawn ?? spawnSyncRunner;
-    return run(cmd, args, {
-        ...(ctx.env !== undefined ? { env: ctx.env } : {}),
-        // The ONE place a shell is used, and only where Node leaves no choice. The
-        // arguments passed through here are package specs and npm flags we build
-        // ourselves, never user text.
-        ...(platform === "win32" ? { shell: true } : {}),
-        timeoutMs: 15 * 60 * 1000,
-    });
+    const line = shell ? cmdLine(cmd, args) : { cmd, args };
+    return run(line.cmd, line.args, { ...(ctx.env !== undefined ? { env: ctx.env } : {}), ...(shell ? { shell: true } : {}), timeoutMs });
 }
-/** `npm root -g`, or undefined when npm could not answer. */
-export function npmGlobalRoot(ctx = {}) {
-    const r = runNpm(["root", "-g"], ctx);
+/** Runs this Node's npm. */
+export function runNpm(args, ctx = {}, timeoutMs = INSTALL_TIMEOUT_MS) {
+    const { cmd, pre, shell } = npmCommand(ctx);
+    return runWith(cmd, [...pre, ...args], shell, ctx, timeoutMs);
+}
+const lastLine = (r) => {
     if (r.status !== 0)
         return undefined;
-    const out = r.stdout.trim().split("\n").at(-1)?.trim();
-    return out !== undefined && out !== "" ? out : undefined;
+    const out = r.stdout.trim().split(/\r?\n/).at(-1)?.trim();
+    return out !== undefined && out !== '' && out !== 'undefined' && out !== 'null' ? out : undefined;
+};
+/** `npm root -g`, or undefined when npm can't answer. */
+export function npmGlobalRoot(ctx = {}) {
+    return lastLine(runNpm(['root', '-g'], ctx, 60_000));
 }
-/** `npm config get <key>`, or undefined. Used to resolve the registry (SPEC §5 step 3). */
+/** `npm config get <key>`, or undefined. */
 export function npmConfigGet(key, ctx = {}) {
-    const r = runNpm(["config", "get", key], ctx);
-    if (r.status !== 0)
-        return undefined;
-    const out = r.stdout.trim().split("\n").at(-1)?.trim();
-    return out !== undefined && out !== "" && out !== "undefined" && out !== "null" ? out : undefined;
+    return lastLine(runNpm(['config', 'get', key], ctx, 60_000));
 }
 /**
- * Really writable? (SPEC §5 step 5.)
- *
- * `access(W_OK)` alone is not enough and the difference is the whole point of
- * this check. It consults the mode bits, which say yes for root and say
- * nothing about a read-only mount, an immutable flag, or an ACL — the usual
- * shapes of "npm install -g needs sudo". So the directory is probed by
- * CREATING something in it and removing it again, which is the same syscall
- * npm is about to make.
- *
- * A missing directory walks up to its nearest existing parent: npm would create
- * it, and whether it can is the parent's question.
+ * Whether `dir` is really writable (SPEC §5 step 5): a folder is created in it and removed again, the same call npm
+ * is about to make. `access(W_OK)` alone says yes to root on a read-only mount, and nothing about ACLs or immutable
+ * flags. A folder that doesn't exist yet asks its nearest existing parent, since npm would create it.
  */
 export function isWritable(dir) {
     let probe = dir;
-    for (;;) {
-        if (fs.existsSync(probe))
-            break;
+    while (!fs.existsSync(probe)) {
         const parent = path.dirname(probe);
         if (parent === probe)
             return false;
@@ -109,13 +97,7 @@ export function isWritable(dir) {
     }
     try {
         fs.accessSync(probe, fs.constants.W_OK);
-    }
-    catch {
-        return false;
-    }
-    try {
-        const tmp = fs.mkdtempSync(path.join(probe, ".update-probe-"));
-        fs.rmSync(tmp, { recursive: true, force: true });
+        fs.rmSync(fs.mkdtempSync(path.join(probe, '.update-probe-')), { recursive: true, force: true });
         return true;
     }
     catch {
@@ -123,99 +105,52 @@ export function isWritable(dir) {
     }
 }
 /**
- * Where a package manager would put the package, so {@link isWritable} has a
- * directory to ask about.
- *
- * Only npm can be asked properly (`npm root -g`). For the others the install
- * command's own target is a good enough proxy — and if it is wrong, the install
- * fails with that manager's own message and the rollback runs, which is a worse
- * experience than the sudo hint but not a worse outcome.
+ * Where a manager would install, for `isWritable` to ask about. Only npm can be asked (`npm root -g`). For the others
+ * there's no answer, and an install that can't write fails with that manager's own message, and rolls back.
  */
 export function globalRootFor(manager, ctx = {}) {
-    if (manager === "npm")
-        return npmGlobalRoot(ctx);
-    return undefined;
+    return manager === 'npm' ? npmGlobalRoot(ctx) : undefined;
 }
-/** The argv for a global install, per SPEC §6's last column. */
+/** The global install command, per SPEC §6's last column. */
 export function installArgs(manager, spec) {
     switch (manager) {
-        case "npm":
-            // `--no-audit --no-fund` keeps the output to the point; `--global` is
-            // spelled out rather than `-g` so a log of what ran reads plainly.
-            return { cmd: "npm", args: ["install", "--global", "--no-audit", "--no-fund", spec] };
-        case "pnpm":
-            return { cmd: "pnpm", args: ["add", "-g", spec] };
-        case "bun":
-            return { cmd: "bun", args: ["add", "-g", spec] };
-        case "volta":
-            return { cmd: "volta", args: ["install", spec] };
+        case 'npm':
+            return { cmd: 'npm', args: ['install', '--global', '--no-audit', '--no-fund', spec] };
+        case 'pnpm':
+            return { cmd: 'pnpm', args: ['add', '-g', spec] };
+        case 'bun':
+            return { cmd: 'bun', args: ['add', '-g', spec] };
+        case 'volta':
+            return { cmd: 'volta', args: ['install', spec] };
     }
 }
-/**
- * Install `<name>@<version>` with the manager this install came from.
- *
- * npm goes through {@link runNpm}, so it is the npm beside this Node. The other
- * three are looked up on PATH, which is the only place they are: pnpm, bun and
- * volta are not installed beside node.
- */
+/** Installs `<name>@<version>` with the manager this install came from. pnpm, bun and volta come from the PATH. */
 export function installPackage(o) {
-    const spec = `${o.packageName}@${o.version}`;
-    const { cmd, args } = installArgs(o.manager, spec);
-    if (o.manager === "npm") {
-        return runNpm(args, {
-            ...(o.spawn !== undefined ? { spawn: o.spawn } : {}),
-            ...(o.env !== undefined ? { env: o.env } : {}),
-            ...(o.execPath !== undefined ? { execPath: o.execPath } : {}),
-            ...(o.platform !== undefined ? { platform: o.platform } : {}),
-        });
-    }
-    const run = o.spawn ?? spawnSyncRunner;
-    return run(cmd, args, {
-        ...(o.env !== undefined ? { env: o.env } : {}),
-        ...((o.platform ?? process.platform) === "win32" ? { shell: true } : {}),
-        timeoutMs: 15 * 60 * 1000,
-    });
+    const { cmd, args } = installArgs(o.manager, `${o.packageName}@${o.version}`);
+    if (o.manager === 'npm')
+        return runNpm(args, o);
+    return runWith(cmd, args, (o.platform ?? process.platform) === 'win32', o, INSTALL_TIMEOUT_MS);
 }
 /**
- * `npm cache add <name>@<version>` — fetch before stopping anything
- * (SPEC §5 step 8).
- *
- * Both the target and the CURRENT version are cached, and caching the current
- * one is the half that is easy to leave out and expensive to miss: it is what
- * gives the rollback a package to reinstall when the reason the update failed
- * was the network. Done while the old version is still serving, so a failure
- * here costs nothing but a message.
- *
- * `npm cache add` is used whatever the manager is, because every one of these
- * layouts has an npm available (it ships with Node) and the point is only to
- * have the tarball on the machine. A failure is reported and not fatal — the
- * install below may still succeed from the network.
+ * `npm cache add <name>@<version>` (SPEC §5 step 8), for the target and for the current version, while the old one
+ * still serves. Caching the current one is what lets a rollback reinstall it when the network is what failed. npm
+ * is used whatever the manager: it ships with Node, and the point is only to have the tarball on the machine.
  */
 export function cacheAdd(packageName, version, ctx = {}) {
-    return runNpm(["cache", "add", `${packageName}@${version}`], ctx);
+    return runNpm(['cache', 'add', `${packageName}@${version}`], ctx);
 }
 /**
- * Ask a CLI what version it is, by running it (`node <cli> --version`).
- *
- * This is how `update` proves that the install actually replaced the files
- * before it hands over to the new CLI. The alternative — reading the
- * `package.json` next to it — answers a different question: npm writes the
- * manifest and the files in one operation, but a partially-updated global
- * folder, a stale symlink, or a pnpm layout whose versioned realpath moved all
- * show up here and not there.
+ * A CLI's version, by running it: `node <cli> --version`. This is how `update` shows the install replaced the files
+ * before it hands over. A `package.json` beside it answers a different question: a stale symlink, or a pnpm layout
+ * whose versioned path moved, shows up here and not there.
  */
 export function cliVersion(cliPath, ctx = {}) {
-    const run = ctx.spawn ?? spawnSyncRunner;
-    const r = run(ctx.execPath ?? process.execPath, [cliPath, "--version"], {
+    const r = (ctx.spawn ?? spawnSyncRunner)(ctx.execPath ?? process.execPath, [cliPath, '--version'], {
         ...(ctx.env !== undefined ? { env: ctx.env } : {}),
         timeoutMs: 60_000,
     });
     if (r.status !== 0)
         return undefined;
-    const line = r.stdout.trim().split("\n")[0]?.trim();
+    const line = r.stdout.trim().split(/\r?\n/)[0]?.trim();
     return line !== undefined && /^\d+\.\d+\.\d+/.test(line) ? line : undefined;
 }
-/** A throwaway directory, for callers that need one (the writability probe's sibling). */
-export function tmpDir(prefix) {
-    return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-}