@gjsify/cli 0.26.1 → 0.27.0

package/lib/commands/install.js

@@ -124,8 +124,29 @@ export const installCommand = {
         description: 'Overall install wall-clock timeout in ms (default 1800000 = 30 min). On timeout, all in-flight registry fetches are aborted and the install exits non-zero with a clear "install timed out — likely a registry slowdown" message. Per-request timeouts in @gjsify/npm-registry (default 30s) still apply within this budget. Set to 0 to disable the overall budget.',
         type: 'number',
         default: DEFAULT_INSTALL_TIMEOUT_MS,
+    })
+        .option('os', {
+        description: 'Resolve/install for this OS instead of the running one (npm config key `os`, e.g. darwin, win32, linux). Affects which packages pass the os/cpu/libc compatibility check; the lockfile stays platform-independent either way.',
+        type: 'string',
+    })
+        .option('cpu', {
+        description: 'Resolve/install for this CPU architecture instead of the running one (npm config key `cpu`, e.g. x64, arm64).',
+        type: 'string',
+    })
+        .option('libc', {
+        description: 'Resolve/install for this libc family instead of probing the host (npm config key `libc`: glibc or musl). Only meaningful with --os=linux. A package declaring a libc is incompatible when the target libc is unknown.',
+        type: 'string',
+    })
+        .option('force', {
+        description: 'Install a REQUIRED dependency even when its os/cpu/libc excludes the target, instead of failing with EBADPLATFORM (npm config key `force`). Incompatible OPTIONAL dependencies stay skipped — npm ignores --force for those too, and a binary that cannot load is not worth downloading.',
+        type: 'boolean',
+        default: false,
     }),
     handler: async (args) => {
+        // Publish `--os/--cpu/--libc/--force` as npm CONFIG KEYS before anything
+        // resolves — see applyPlatformConfigFromFlags for why the environment is
+        // the right channel for them rather than a parameter.
+        applyPlatformConfigFromFlags(args);
         // --immutable is incompatible with explicit `<pkg>` adds and with
         // `--global` (which has no lockfile concept). Matches yarn's
         // behavior: `yarn add --immutable` is a hard error.
@@ -213,12 +234,15 @@ export const installCommand = {
                 // Do NOT assert a cause here — this timer cannot tell the
                 // two shapes apart, and claiming the rarer one sends the
                 // next reader after a bug that isn't there. Measured on a
-                // cold tree of this workspace: 1597 packages / ~4.8 GB
-                // extracted, of which ~3.4 GB are foreign-platform
-                // optional deps (`os`/`cpu` excludes the host) that npm
-                // would never place. That install was still making steady
-                // progress when the 30-min budget elapsed, and a re-run
-                // finished the remainder in ~2 min. Extraction also has
+                // cold tree of this workspace WHEN THIS TIMER WAS WRITTEN:
+                // 1597 packages / ~4.8 GB extracted, of which ~3.4 GB were
+                // foreign-platform optional deps (`os`/`cpu` excluding the
+                // host) that npm would never place. Those are no longer
+                // downloaded — the resolver now records `os`/`cpu`/`libc`
+                // and marks incompatible optional nodes inert
+                // (`utils/platform-check.ts` + `applyPlatformFilter`), which
+                // leaves ~1.4 GB of that same tree to extract. The budget
+                // still exists for the same reason: extraction has
                 // multi-second SYNCHRONOUS stretches (tar parse + file
                 // writes) and 16 run concurrently, so the clean abort path
                 // can easily miss the grace window with nothing wedged.
@@ -261,6 +285,43 @@ export const installCommand = {
         }
     },
 };
+/**
+ * Hand the platform target + force bypass to the install backend.
+ *
+ * `os`, `cpu`, `libc` and `force` are npm CONFIG KEYS, and npm's own transport
+ * for a config key is the environment: `--libc=musl` and `npm_config_libc=musl`
+ * are the same input, which is why supporting the flags gives users the env
+ * spelling for free. That is also why this is not threaded through as a
+ * parameter: the config channel is already what this installer reads
+ * (`loadNpmrc` honours `npm_config_registry` exactly so), one write reaches
+ * EVERY prefix an invocation may install into (project, workspace root, `-g`,
+ * the `dlx` cache) instead of one call site each, and a child process inherits
+ * it — so a nested install can't quietly resolve for a different machine than
+ * the run that spawned it.
+ *
+ * Empty/whitespace values are ignored rather than written as the empty string:
+ * `--os=` must not mean "the nameless platform" (`readPlatformOverrides` drops
+ * them on the read side too, so the two ends agree).
+ */
+function applyPlatformConfigFromFlags(args) {
+    const keys = [
+        ['os', 'npm_config_os'],
+        ['cpu', 'npm_config_cpu'],
+        ['libc', 'npm_config_libc'],
+    ];
+    for (const [flag, envKey] of keys) {
+        const value = args[flag];
+        if (typeof value !== 'string')
+            continue;
+        const trimmed = value.trim();
+        if (trimmed !== '')
+            process.env[envKey] = trimmed;
+    }
+    // Only ever SET: a `false` flag is the default, and clearing the key would
+    // override an `npm_config_force` the user deliberately exported.
+    if (args.force)
+        process.env.npm_config_force = 'true';
+}
 /**
  * Heuristic: was this error raised because the overall-install AbortSignal
  * fired? The signal's `reason` is the sentinel `Error('install-overall-timeout')`
@@ -376,6 +437,36 @@ function isWorkspaceRoot(cwd) {
         return false;
     return pkg.workspaces !== undefined;
 }
+/**
+ * Which dependency NAMES are optional across the given manifests.
+ *
+ * The specs handed to the install backend are flat `"<name>@<range>"` strings —
+ * `projectSpecsFromPackageJson` merges the three dependency blocks — so the kind
+ * has to travel beside them. It matters for exactly one decision: an
+ * incompatible `os`/`cpu`/`libc` skips an OPTIONAL dependency and fails a
+ * REQUIRED one (see `NativeInstallOptions.optionalSpecs`).
+ *
+ * REQUIRED WINS. In a workspace, the same package can be a plain dependency of
+ * one member and an optionalDependency of another; if anything is not allowed to
+ * be missing, the whole install is not allowed to silently miss it. Subtracting
+ * rather than "last block seen" also makes the answer independent of manifest
+ * iteration order.
+ */
+function optionalDependencyNames(manifests) {
+    const optional = new Set();
+    const required = new Set();
+    for (const manifest of manifests) {
+        for (const name of Object.keys(manifest.optionalDependencies ?? {}))
+            optional.add(name);
+        for (const kind of ['dependencies', 'devDependencies']) {
+            for (const name of Object.keys(manifest[kind] ?? {}))
+                required.add(name);
+        }
+    }
+    for (const name of required)
+        optional.delete(name);
+    return optional;
+}
 function depKindFromArgs(args) {
     if (args['save-dev'])
         return 'devDependencies';
@@ -469,7 +560,11 @@ async function projectInstallNative(args, signal) {
     // with ours. `installPackages` re-acquires the same lock re-entrantly.
     const lock = await acquireInstallLock(cwd, { signal });
     try {
-        const result = await installPackages({
+        // Typed as NativeInstallOptions so the native-backend-only
+        // `optionalSpecs` is CHECKED at this call site instead of being smuggled
+        // past an object-literal excess-property check; `installPackages`
+        // forwards the object to that backend unchanged.
+        const nativeOpts = {
             prefix: cwd,
             specs,
             verbose: args.verbose,
@@ -480,7 +575,15 @@ async function projectInstallNative(args, signal) {
             refreshLockfile: args['refresh-lockfile'],
             signal,
             progress,
-        });
+            // `gjsify install -O <pkg>` saves to optionalDependencies, but the
+            // manifest is only written AFTER this install — so the flag, not the
+            // manifest, is what makes this run treat the added specs as optional.
+            optionalSpecs: new Set([
+                ...optionalDependencyNames(pkg ? [pkg] : []),
+                ...(args['save-optional'] ? (args.packages ?? []).map((s) => parseSpec(s).name) : []),
+            ]),
+        };
+        const result = await installPackages(nativeOpts);
         // Update package.json only when the user passed explicit packages
         // (the `gjsify install <pkg>...` add-a-dep flow). The no-args refresh
         // flow doesn't mutate manifest entries.
@@ -844,7 +947,7 @@ async function workspaceInstallLocked(cwd, args, signal) {
         const progress = makeProgressReporter({
             enabled: !args.verbose && !args.quiet && args.progress !== false,
         });
-        await installPackages({
+        const rootOpts = {
             prefix: cwd,
             specs: [...externalSpecs],
             verbose: args.verbose,
@@ -860,7 +963,12 @@ async function workspaceInstallLocked(cwd, args, signal) {
             // npm and is pinned transitively in the lockfile).
             workspaceNames: new Set(byName.keys()),
             specOrigins: new Map([...specOrigins].map(([k, v]) => [k, [...v]])),
-        });
+            // Aggregated over EVERY member: the specs are aggregated the same
+            // way, so the optional-vs-required answer has to be too (a name that
+            // any member declares as a plain dependency stays required).
+            optionalSpecs: optionalDependencyNames(workspaces.map((w) => w.manifest)),
+        };
+        await installPackages(rootOpts);
     }
     else if (args.verbose) {
         console.log('gjsify install: no external deps to fetch');
@@ -876,7 +984,7 @@ async function workspaceInstallLocked(cwd, args, signal) {
         if (args.verbose) {
             console.log(`gjsify install: ${wsName} — installing ${specSet.size} scoped-override spec(s) into ${wsLocation}/node_modules/`);
         }
-        await installPackages({
+        const scopedOpts = {
             prefix: wsLocation,
             specs: [...specSet],
             verbose: args.verbose,
@@ -886,7 +994,12 @@ async function workspaceInstallLocked(cwd, args, signal) {
             frozen: args.immutable,
             signal,
             workspaceNames: new Set(byName.keys()),
-        });
+            // Same aggregated answer as the root install: these specs are a
+            // SUBSET of the root's, so classifying them differently here would
+            // make one dep optional at the root and required in a member.
+            optionalSpecs: optionalDependencyNames(workspaces.map((w) => w.manifest)),
+        };
+        await installPackages(scopedOpts);
     }
     // Re-wire workspace symlinks once more now that the external + scoped
     // installs are done. The EARLY pass above already created them so workspace
@@ -1080,11 +1193,47 @@ export function buildBinShim(wsLocation, nodeTarget, gjsTarget, nativePrebuildDi
         // package and oversubscribes CI's few cores. Verified: the faithful
         // `foreach build -tp --jobs 4` over @gjsify/* with a piped stdout
         // completes in ~83s under GJS (was a multi-hour hang).
-        return (`#!/bin/sh\n` +
-            `if command -v gjs >/dev/null 2>&1 && [ -f "${gjsAbs}" ]; then\n` +
+        // …EXCEPT on macOS and Windows, where the order is inverted — and not
+        // as a preference but as a capability. GJS is a GNOME-desktop host: on
+        // those two platforms it is at best a Homebrew/MSYS afterthought, while
+        // Node is what a developer already has. The tooling agrees:
+        //
+        //   - macOS: the only bundler engine under GJS is
+        //     `@gjsify/rolldown-native` (npm `rolldown` is a Rust napi crate
+        //     GJS cannot load), and it declares `linux-x64`/`linux-arm64` only.
+        //     So the gjs branch cannot run `gjsify build`, nor any script that
+        //     ends in one — it dies with "no usable bundler engine under GJS",
+        //     whose own closing line is "Running the build under Node also
+        //     works". Preferring gjs routed the user into a dead end the error
+        //     message tells them to leave while the shim offered no way out.
+        //     Measured on a cold macOS tree: root `build:infra` fails at the
+        //     first `gjsify build --library` (`@gjsify/utils`) with the
+        //     gjs-first shim and completes with this one.
+        //   - Windows: there is no prebuilt `libgjs` at all (see
+        //     `website/src/content/docs/platform-support.md`), so the gjs probe
+        //     can never succeed. This also makes the `sh` shim — the git-bash /
+        //     MSYS entry point — agree with the `.cmd`/`.ps1` companions
+        //     {@link buildLauncherShims} already writes as Node-only, instead
+        //     of leading with a branch that is dead by construction.
+        //
+        // The probe stays symmetric with the gjs one — `command -v node`, not a
+        // bare file test — so a host carrying the bundle but no Node still
+        // falls through to gjs and keeps every non-build command working. That
+        // is what keeps GJS on these platforms supported-and-tested rather than
+        // merely absent. Revert a platform to the shared gjs-first form once it
+        // has a working engine (macOS: status/open-todos.md,
+        // "@gjsify/rolldown-native's darwin-arm64 leg is PROVEN but not
+        // promoted").
+        const nodeFirstPlatform = platform === 'darwin' || platform === 'win32';
+        const gjsFirst = `if command -v gjs >/dev/null 2>&1 && [ -f "${gjsAbs}" ]; then\n` +
             `${gjsPreamble}exec gjs -m "${gjsAbs}" "$@"\n` +
             `fi\n` +
-            `exec node "${nodeAbs}" "$@"\n`);
+            `exec node "${nodeAbs}" "$@"\n`;
+        const nodeFirst = `if command -v node >/dev/null 2>&1 && [ -f "${nodeAbs}" ]; then\n` +
+            `exec node "${nodeAbs}" "$@"\n` +
+            `fi\n` +
+            `${gjsPreamble}exec gjs -m "${gjsAbs}" "$@"\n`;
+        return `#!/bin/sh\n` + (nodeFirstPlatform ? nodeFirst : gjsFirst);
     }
     if (nodeAbs)
         return `#!/bin/sh\nexec node "${nodeAbs}" "$@"\n`;

package/lib/commands/onboard.js

@@ -24,7 +24,7 @@
 //
 // Re-running when everything is already published + trusted does nothing and
 // exits 0. `--dry-run` reports the plan and changes nothing.
-import { spawn, spawnSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import { DEFAULT_REGISTRY, whoami } from '@gjsify/npm-registry';
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
 import { mergePublishables } from '../utils/publishable-packages.js';
@@ -34,6 +34,7 @@ import { publishWorkspace } from './publish.js';
 import { createTrustRequester } from './trust.js';
 import { runLogin, LoginError } from './login.js';
 import { detectPackageManager } from './workspace.js';
+import { spawnToCompletion } from '../utils/spawn.js';
 import { findWorkspaceRoot } from '../utils/workspace-root.js';
 import { githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, validateRepository, } from '../utils/trust-registry.js';
 import { DEFAULT_PROBE_CONCURRENCY, probeAllTrustStates } from '../utils/onboard-probe.js';
@@ -379,20 +380,22 @@ async function buildIfPresent(ws, log) {
     const pm = detectPackageManager();
     const argv = ['run', 'build'];
     log(`  $ ${pm} ${argv.join(' ')}`);
-    await new Promise((resolve, reject) => {
-        const child = spawn(pm, argv, {
-            cwd: ws.location,
-            stdio: 'inherit',
-            env: { ...process.env },
-        });
-        child.on('close', (code) => {
-            if (code === 0)
-                resolve();
-            else
-                reject(new Error(`build exited with code ${code}`));
-        });
-        child.on('error', reject);
+    // Through `spawnToCompletion`, which resolves the package manager the way
+    // the rest of the CLI does. `detectPackageManager()` returns `npm` on every
+    // non-GJS host, and a bare `spawn('npm', …)` is ENOENT on Windows — npm is
+    // a `.cmd` shim that `CreateProcess` never finds (see
+    // utils/win32-command.ts). This is the pre-publish build, so the break
+    // landed between "about to publish" and the publish itself.
+    //
+    // `completion: 'return'` — this resolves to a caller that goes on to
+    // publish, so under GJS it must not leave a main loop armed.
+    const { code } = await spawnToCompletion(pm, argv, {
+        completion: 'return',
+        cwd: ws.location,
+        env: { ...process.env },
     });
+    if (code !== 0)
+        throw new Error(`build exited with code ${code}`);
 }
 /** Human-readable reason for a failed publish outcome. */
 function describePublishFailure(pub) {

package/lib/commands/publish.js

@@ -34,6 +34,7 @@
 // and npm's @npmcli/registry-fetch internals — verified against npm's
 // in-the-wild publish payloads.
 import { readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { DEFAULT_REGISTRY, registryFor } from '@gjsify/npm-registry';
 import { buildPublishHeaders, escapePackageName } from '../utils/publish-headers.js';
@@ -477,7 +478,12 @@ async function packWorkspaceToBytes(wsDir) {
     // scripts are already run by the outer publish flow's first pack
     // call — passing `[]` here skips re-running them (idempotent for
     // most projects but a needless cost otherwise).
-    const tmp = `/tmp/gjsify-publish-${process.pid}-${Date.now()}`;
+    // `tmpdir()`, not a literal `/tmp`. `pack` resolves its destination and
+    // creates it recursively, so on Windows the literal produced `C:\tmp\…` at
+    // the DRIVE ROOT — created on every publish, and only the inner directory
+    // was removed afterwards, so `C:\tmp` was left behind for good. On an image
+    // where the drive root is not writable it failed outright.
+    const tmp = join(tmpdir(), `gjsify-publish-${process.pid}-${Date.now()}`);
     const res = await packWorkspace(wsDir, {
         destination: tmp,
         dryRun: false,
@@ -504,9 +510,14 @@ async function loadRewrittenManifest(wsDir, pkg) {
     // Pack + re-read the tarball's package.json. Easier than duplicating the
     // rewrite logic — pack already does it correctly, including handling
     // workspace:^ patterns we'd otherwise have to reimplement here.
-    const tmp = `/tmp/gjsify-publish-manifest-${process.pid}-${Date.now()}.tgz`;
+    // Only the DIRECTORY is passed to pack, so build it directly instead of
+    // composing a filename and slicing it back off at the last `/` — which on
+    // Windows found no separator in `C:\Users\…\gjsify-publish-manifest-…` and
+    // handed pack a truncated path. Same `/tmp`-at-the-drive-root problem as
+    // above on top of it.
+    const dest = join(tmpdir(), `gjsify-publish-manifest-${process.pid}-${Date.now()}`);
     const res = await packWorkspace(wsDir, {
-        destination: tmp.substring(0, tmp.lastIndexOf('/')),
+        destination: dest,
         dryRun: false,
     });
     const { rmSync } = await import('node:fs');
@@ -514,7 +525,10 @@ async function loadRewrittenManifest(wsDir, pkg) {
         throw new Error('gjsify publish: pack did not produce a file');
     const { gunzip, parseTar } = await import('@gjsify/tar');
     const bytes = new Uint8Array(readFileSync(res.absolutePath));
-    rmSync(res.absolutePath);
+    // The whole per-call directory, not just the tarball inside it — the
+    // destination is now unique per invocation, so leaving it behind would grow
+    // the temp directory once per publish.
+    rmSync(dest, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
     const tar = await gunzip(bytes);
     for (const entry of parseTar(tar)) {
         if (entry.name === 'package/package.json' && entry.body) {

package/lib/commands/storybook.js

@@ -107,7 +107,11 @@ export const storybookCommand = {
         type: 'boolean',
         default: false,
     })
-        .option('build-only', { description: 'Build the bundle but do not launch it', type: 'boolean', default: false }),
+        .option('build-only', {
+        description: 'Build the bundle but do not launch it',
+        type: 'boolean',
+        default: false,
+    }),
     handler: async (args) => {
         const cwd = process.cwd();
         const pkg = readPackage(cwd);

package/lib/commands/test.js

@@ -8,6 +8,8 @@
 import { existsSync, statSync, readdirSync } from 'node:fs';
 import { join, dirname, resolve, relative } from 'node:path';
 import { spawn } from 'node:child_process';
+import { isRuntimeAvailable, RUNTIMES } from '../utils/runtimes.js';
+import { nodeBinary } from '../utils/run-node.js';
 import { Config } from '../config.js';
 import { BuildAction } from '../actions/build.js';
 import { runGjsBundle } from '../utils/run-gjs.js';
@@ -64,6 +66,16 @@ export const testCommand = {
             // handler would try to build the missing entry anyway.
             return process.exit(1);
         }
+        // EXPLICIT (`--runtime node`) vs DEFAULT (`all`, or a package's declared
+        // set) is the whole distinction here, and it decides what an absent
+        // runtime means. Asked for by name, its absence is the answer to the
+        // question and must fail loudly. Reached only because it is in the
+        // default set, its absence is a fact about the host — and failing there
+        // reports a PASSING suite as a failed run: on a Node-less GJS host
+        // (postmarketOS/aarch64, gjs 1.88, no node) `gjsify test` printed
+        // `✅ gjs (267ms)  ❌ node (27ms) — spawn node ENOENT` for a suite whose
+        // every assertion passed.
+        const explicit = args.runtime === 'gjs' || args.runtime === 'node';
         const requested = args.runtime === 'gjs'
             ? ['gjs']
             : args.runtime === 'node'
@@ -71,8 +83,19 @@ export const testCommand = {
                 : testCfg.runtimes && testCfg.runtimes.length > 0
                     ? testCfg.runtimes
                     : ['gjs', 'node'];
+        // Skipping is NOT silent — a skipped runtime is reported, so "tests
+        // passed" never quietly means "on fewer runtimes than you think".
+        const runnable = explicit ? requested : requested.filter((rt) => isRuntimeAvailable(rt));
+        for (const rt of requested.filter((rt) => !runnable.includes(rt))) {
+            console.log(`[gjsify test] skipping ${rt} — no \`${RUNTIMES[rt].probe}\` on PATH (not requested explicitly)`);
+        }
+        if (runnable.length === 0) {
+            console.error(`[gjsify test] none of the default runtimes (${requested.join(', ')}) is available on this host.\n` +
+                `  Install one, or pin the set: \`gjsify test --runtime <rt>\` / \`gjsify.test.runtimes\` in package.json.`);
+            return process.exit(1);
+        }
         const results = [];
-        for (const runtime of requested) {
+        for (const runtime of runnable) {
             const outfile = join(outdir, `test.${runtime}.mjs`);
             // Build stage (skip if --no-build OR (not --rebuild AND outfile fresher than src)).
             if (args.build !== false) {
@@ -171,7 +194,11 @@ async function runTestBundle(outfile, runtime) {
         return;
     }
     await new Promise((resolvePromise, reject) => {
-        const child = spawn('node', [outfile], { stdio: 'inherit' });
+        // `nodeBinary()`, never a bare `'node'`: under the committed GJS bundle
+        // `process.execPath` is the bundle itself, and on a host without Node a
+        // bare literal dies `spawn node ENOENT` — which is how a fully passing
+        // GJS suite was reported as a failed run.
+        const child = spawn(nodeBinary(), [outfile], { stdio: 'inherit' });
         child.on('error', reject);
         child.on('exit', (code) => {
             if (code === 0)

package/lib/commands/uninstall.js

@@ -14,7 +14,7 @@
 // <pkg>` without -g) is a separate workstream — it needs to rewrite
 // package.json + refresh the lockfile, which install -g doesn't touch.
 import { existsSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
+import { isAbsolute, join, relative, sep } from 'node:path';
 import { defaultGlobalLayout, specToPackageName } from '../utils/install-global.js';
 export const uninstallCommand = {
     command: 'uninstall <packages..>',
@@ -109,7 +109,42 @@ export const uninstallCommand = {
  * string in the file, which with the preamble is the prebuild dir list) and
  * check whether it's under `pkgDir`. Non-shim files (e.g. unrelated binaries
  * the user installed via `npm install -g`) are skipped silently.
+ *
+ * WINDOWS
+ *
+ * `linkGlobalBins` writes THREE files there — the `sh` launcher above plus the
+ * `.cmd` and `.ps1` siblings cmd.exe and pwsh need, because Windows runs neither
+ * an extension-less file nor a `#!` line. Two bugs stacked on that:
+ *
+ *   • the containment test was `target.startsWith(pkgDir + '/')`, while both
+ *     `pkgDir` and the baked `targetAbs` use `\` there — so the sh launcher
+ *     never matched either;
+ *   • nothing looked for the `.cmd`/`.ps1` siblings at all — they do not begin
+ *     `#!/bin/sh`, so the scan above skips them by construction.
+ *
+ * Net: `gjsify uninstall -g <pkg>` on Windows deleted the package and left all
+ * three launchers pointing at a deleted path. The user then got a crash rather
+ * than "command not found", and a later install of a different package with the
+ * same bin name stayed shadowed by the stale `.cmd`.
+ *
+ * The sh launcher stays the ANCHOR — it is written on every platform, so it is
+ * the one shape worth parsing — and its siblings are collected by name. That
+ * avoids teaching this function to read batch and PowerShell as well.
  */
+/**
+ * Is `target` `dir` itself, or under it?
+ *
+ * Asked through `path.relative` rather than a string prefix, so it holds
+ * whatever separator either side happens to be spelled with — the string form
+ * was `\`-vs-`/` blind on Windows. It also stops `/opt/foo-backup` from reading
+ * as inside `/opt/foo`, which a bare `startsWith(dir)` would have allowed.
+ */
+function isInside(dir, target) {
+    const rel = relative(dir, target);
+    if (rel === '')
+        return true;
+    return rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
 function findBinShimsForPackage(binDir, pkgDir, verbose) {
     if (!existsSync(binDir))
         return [];
@@ -140,8 +175,15 @@ function findBinShimsForPackage(binDir, pkgDir, verbose) {
             if (!m)
                 continue;
             const target = m[1];
-            if (target.startsWith(pkgDir + '/') || target === pkgDir) {
+            if (isInside(pkgDir, target)) {
                 matches.push(fullPath);
+                // The Windows companions, when present. `existsSync` rather
+                // than a platform check: what decides is whether they were
+                // written, and a tree can be inspected from another OS.
+                for (const ext of ['.cmd', '.ps1']) {
+                    if (existsSync(fullPath + ext))
+                        matches.push(fullPath + ext);
+                }
             }
         }
         catch (err) {

package/lib/commands/upgrade.js

@@ -448,10 +448,7 @@ function printTable(candidates) {
         'kind' +
         ANSI.reset;
     console.log(head);
-    console.log(' '.repeat(idxW + 2) +
-        ANSI.dim +
-        '─'.repeat(nameW + fanW + curW + newW + 16) +
-        ANSI.reset);
+    console.log(' '.repeat(idxW + 2) + ANSI.dim + '─'.repeat(nameW + fanW + curW + newW + 16) + ANSI.reset);
     for (let i = 0; i < candidates.length; i++) {
         const c = candidates[i];
         const idx = `${i + 1}.`.padEnd(idxW);