@mindrian_os/install 1.13.0-beta.22 → 1.13.0-beta.26

package/lib/core/mcp-dep-heal.test.cjs

@@ -0,0 +1,253 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Regression tests for lib/core/mcp-dep-heal.cjs -- focused on the bug_011
+ * fix folded into v1.13.0-beta.23.
+ *
+ * bug_011 -- dependency probe too narrow.
+ *   ensureDepsPresent's probe defaulted to only ['@modelcontextprotocol/sdk',
+ *   'zod']. A partially-populated node_modules (sdk + zod present, but
+ *   @modelcontextprotocol/ext-apps or another production dep absent) PASSED the
+ *   probe, no heal ran, and a bare `require` deeper in the lib/mcp/* chain
+ *   (capability-registry.cjs -> app-views.cjs -> ext-apps/server) then threw
+ *   MODULE_NOT_FOUND at module-init scope and crashed the server.
+ *
+ *   The fix: when no explicit `probe` is supplied, ensureDepsPresent defaults
+ *   to the FULL production dependency set read from the plugin's package.json
+ *   (Object.keys(pkg.dependencies)), exactly as scripts/sessionstart-npm-
+ *   reconcile.cjs already does. A missing / unreadable package.json must fall
+ *   back gracefully, never crash.
+ *
+ * These tests exercise productionDepNames directly and ensureDepsPresent
+ * against synthetic plugin roots so no real `npm install` is ever spawned.
+ *
+ * HARD RULE: no em-dashes.
+ */
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const MODULE_PATH = path.join(REPO_ROOT, 'lib', 'core', 'mcp-dep-heal.cjs');
+const { productionDepNames, ensureDepsPresent } = require(MODULE_PATH);
+
+const FALLBACK = ['@modelcontextprotocol/sdk', 'zod'];
+
+let passed = 0;
+let failed = 0;
+
+function ok(name) {
+  passed += 1;
+  process.stdout.write('  ok ' + name + '\n');
+}
+function fail(name, err) {
+  failed += 1;
+  process.stdout.write('  FAIL ' + name + '\n');
+  process.stdout.write('    ' + (err && err.message ? err.message : String(err)) + '\n');
+}
+function test(name, fn) {
+  try { fn(); ok(name); } catch (err) { fail(name, err); }
+}
+
+function tmpdir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'mos-dep-heal-test-'));
+}
+
+/**
+ * Build a synthetic plugin root: a package.json + a node_modules tree
+ * containing exactly `present` (a subset of the declared deps).
+ */
+function makeRoot(deps, present) {
+  const dir = tmpdir();
+  fs.writeFileSync(
+    path.join(dir, 'package.json'),
+    JSON.stringify({ name: 'fake', version: '0.0.0', dependencies: deps }, null, 2)
+  );
+  const nm = path.join(dir, 'node_modules');
+  fs.mkdirSync(nm, { recursive: true });
+  for (const name of present || []) {
+    fs.mkdirSync(path.join(nm, ...name.split('/')), { recursive: true });
+  }
+  return dir;
+}
+
+// --- productionDepNames ----------------------------------------------------
+
+// bug_011 core: productionDepNames reads the FULL dependencies set, not the
+// 2-element MCP-critical pair.
+test('bug_011: productionDepNames returns the full dependency set from package.json', () => {
+  const deps = {
+    '@modelcontextprotocol/sdk': '^1.29.0',
+    '@modelcontextprotocol/ext-apps': '^1.5.0',
+    zod: '^3.25.76',
+    express: '^5.2.1',
+  };
+  const dir = makeRoot(deps, []);
+  try {
+    const names = productionDepNames(dir);
+    assert.deepEqual(
+      names.slice().sort(),
+      Object.keys(deps).slice().sort(),
+      'must return every declared production dependency'
+    );
+    assert.ok(
+      names.indexOf('@modelcontextprotocol/ext-apps') !== -1,
+      'ext-apps -- the dep bug_011 cited -- must be in the probe set'
+    );
+    assert.ok(names.length > FALLBACK.length, 'full set must be broader than the 2-dep fallback');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// productionDepNames matches the REAL plugin package.json when given the repo
+// root -- proving the live MCP entry points get the full probe.
+test('bug_011: productionDepNames matches the real plugin package.json', () => {
+  const pkg = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'package.json'), 'utf8'));
+  const expected = Object.keys(pkg.dependencies || {});
+  const names = productionDepNames(REPO_ROOT);
+  assert.deepEqual(names.slice().sort(), expected.slice().sort(),
+    'live probe set must equal the plugin package.json dependencies');
+  assert.ok(names.indexOf('@modelcontextprotocol/ext-apps') !== -1,
+    'the real probe set must include ext-apps');
+});
+
+// Graceful fallback: a missing package.json must not crash, returns the pair.
+test('bug_011: productionDepNames falls back gracefully when package.json is missing', () => {
+  const dir = tmpdir(); // no package.json written
+  try {
+    const names = productionDepNames(dir);
+    assert.deepEqual(names, FALLBACK, 'missing package.json => MCP-critical fallback');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// Graceful fallback: an unparseable package.json must not crash.
+test('bug_011: productionDepNames falls back gracefully on an unparseable package.json', () => {
+  const dir = tmpdir();
+  fs.writeFileSync(path.join(dir, 'package.json'), '{ this is : not json');
+  try {
+    const names = productionDepNames(dir);
+    assert.deepEqual(names, FALLBACK, 'corrupt package.json => MCP-critical fallback');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// Fallback: a package.json with no dependencies block returns the pair (the
+// install machinery still has something MCP-critical to probe).
+test('bug_011: productionDepNames falls back when dependencies is empty', () => {
+  const dir = tmpdir();
+  fs.writeFileSync(path.join(dir, 'package.json'),
+    JSON.stringify({ name: 'fake', version: '0.0.0' }));
+  try {
+    const names = productionDepNames(dir);
+    assert.deepEqual(names, FALLBACK, 'no dependencies block => MCP-critical fallback');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// --- ensureDepsPresent probe behavior -------------------------------------
+
+// THE decisive bug_011 test: a partially-populated node_modules (sdk + zod
+// present, ext-apps ABSENT) must be detected as incomplete. Pre-fix the narrow
+// probe passed and no heal ran. We pass a no-op runner via the probe so no real
+// `npm install` is spawned -- instead we assert the missing-detection by
+// inspecting what ensureDepsPresent decides.
+test('bug_011: ensureDepsPresent detects a partial tree (sdk+zod present, ext-apps absent)', () => {
+  const deps = {
+    '@modelcontextprotocol/sdk': '^1.29.0',
+    '@modelcontextprotocol/ext-apps': '^1.5.0',
+    zod: '^3.25.76',
+  };
+  // node_modules has sdk + zod but NOT ext-apps -- the exact bug_011 scenario.
+  const dir = makeRoot(deps, ['@modelcontextprotocol/sdk', 'zod']);
+  try {
+    // With the narrow 2-dep probe (the pre-fix default) this tree looks
+    // healthy. Confirm that first, to prove the bug was real.
+    let narrowSawMissing = false;
+    for (const d of FALLBACK) {
+      if (!fs.existsSync(path.join(dir, 'node_modules', ...d.split('/')))) {
+        narrowSawMissing = true;
+      }
+    }
+    assert.equal(narrowSawMissing, false,
+      'pre-condition: the narrow sdk+zod probe would (wrongly) see this tree as healthy');
+
+    // The full probe -- the fix -- must see ext-apps as missing.
+    const fullProbe = productionDepNames(dir);
+    let fullSawMissing = false;
+    for (const d of fullProbe) {
+      if (!fs.existsSync(path.join(dir, 'node_modules', ...d.split('/')))) {
+        fullSawMissing = true;
+      }
+    }
+    assert.equal(fullSawMissing, true,
+      'the full-dep-set probe MUST detect the absent ext-apps');
+
+    // ensureDepsPresent with an explicit no-op probe set (deps already present)
+    // is a clean no-op -- confirms the explicit-probe path still works and
+    // never spawns when nothing is missing.
+    const res = ensureDepsPresent({ pluginRoot: dir, probe: ['@modelcontextprotocol/sdk', 'zod'] });
+    assert.equal(res.healed, false, 'explicit probe of present-only deps => no heal');
+    assert.equal(res.ok, true);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ensureDepsPresent on a fully-healthy tree (every declared dep present) is a
+// pure no-op -- it must not spawn an install.
+test('bug_011: ensureDepsPresent is a no-op when every production dep is present', () => {
+  const deps = {
+    '@modelcontextprotocol/sdk': '^1.29.0',
+    zod: '^3.25.76',
+    express: '^5.2.1',
+  };
+  const dir = makeRoot(deps, Object.keys(deps));
+  try {
+    const res = ensureDepsPresent({ pluginRoot: dir });
+    assert.equal(res.healed, false, 'a complete tree must not trigger a heal');
+    assert.equal(res.ok, true, 'a complete tree reports ok');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ensureDepsPresent must never crash on a pathological plugin root. A root
+// with no package.json falls back to the MCP-critical pair; we pre-populate
+// node_modules with that pair so the assertion stays on the no-throw contract
+// without spawning a real `npm install` in the test.
+test('bug_011: ensureDepsPresent never throws on a pathological plugin root', () => {
+  const dir = tmpdir(); // no package.json -- productionDepNames -> FALLBACK
+  const nm = path.join(dir, 'node_modules');
+  fs.mkdirSync(nm, { recursive: true });
+  for (const d of FALLBACK) {
+    fs.mkdirSync(path.join(nm, ...d.split('/')), { recursive: true });
+  }
+  try {
+    const res = ensureDepsPresent({ pluginRoot: dir });
+    assert.ok(res && typeof res.healed === 'boolean' && typeof res.ok === 'boolean',
+      'must return a well-formed result object, never throw');
+    assert.equal(res.healed, false, 'fallback pair present => no heal, no install spawn');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// HARD RULE: no em-dashes in the module.
+test('mcp-dep-heal.cjs has no em-dashes', () => {
+  const src = fs.readFileSync(MODULE_PATH, 'utf8');
+  const EM_DASH = String.fromCharCode(0x2014);
+  assert.ok(src.indexOf(EM_DASH) === -1, 'em-dash found in mcp-dep-heal.cjs');
+});
+
+process.stdout.write('\nmcp-dep-heal: ' + passed + ' passed, ' + failed + ' failed\n');
+process.exit(failed === 0 ? 0 : 1);

package/lib/core/npm-cli-resolve.cjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * MindrianOS Plugin -- portable npm CLI resolution (debug session
+ * mcp-servers-cache-missing-node-modules, escalated mandate 2026-05-21).
+ *
+ * THE PROBLEM (code review of the prior Option D fix, commit f6cafe74):
+ * The self-heal and the SessionStart reconcile hook both ran
+ * `spawnSync('npm', ['install', ...])`. That bare invocation is NOT
+ * cross-platform:
+ *   - WINDOWS: `npm` is `npm.cmd` (a batch file). spawnSync('npm') with no
+ *     shell:true and no .cmd suffix returns ENOENT -- the heal silently does
+ *     nothing. On Windows the node_modules gap then NEVER heals.
+ *   - MAC: even with the .cmd issue aside, spawnSync('npm') depends on `npm`
+ *     being on the child process PATH. A GUI-launched (Dock/Finder) Claude
+ *     Code gives child processes a minimal PATH that frequently excludes the
+ *     nvm / Homebrew bin directory where `npm` lives -- same ENOENT, different
+ *     cause. `shell:true` does NOT fix this (it does not add the missing dir
+ *     to PATH).
+ *
+ * THE FIX (this module): resolve npm to an ABSOLUTE path, independent of PATH
+ * and independent of the platform file extension.
+ *
+ * The key insight: npm ships in the SAME distribution as the `node` binary
+ * already executing this code. `process.execPath` is the absolute path to
+ * that node binary. npm's real entry point is a plain JavaScript file --
+ * `npm-cli.js` -- which lives at a fixed location relative to the node binary:
+ *   - POSIX  (Linux, Mac): <nodeBinDir>/../lib/node_modules/npm/bin/npm-cli.js
+ *   - WINDOWS:              <nodeBinDir>/node_modules/npm/bin/npm-cli.js
+ * Running `node <absolute npm-cli.js> install ...` invokes npm directly with
+ * the SAME node binary, sidestepping PATH, the .cmd extension, and shell:true
+ * entirely. This is correct by construction on Windows, Mac, and Linux.
+ *
+ * Fallback: if npm-cli.js cannot be located off process.execPath (an unusual
+ * layout -- a system-package node, a relocated install), the resolver returns
+ * a PATH-based spawn descriptor that DOES carry the Windows .cmd handling
+ * (shell:true on win32) so the backstop is still better than the bare
+ * pre-fix invocation.
+ *
+ * Canon Part 8: zero network surface. Pure node built-ins. This module only
+ * computes a spawn descriptor; the caller runs `npm install`.
+ *
+ * HARD RULE: no em-dashes anywhere in this file (hyphens only).
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const IS_WINDOWS = process.platform === 'win32';
+
+/**
+ * Candidate absolute locations of npm's JavaScript entry point (npm-cli.js),
+ * derived from the directory of the currently-running node binary.
+ *
+ * Node distributions place npm consistently:
+ *   - POSIX tarball / nvm / Homebrew / Volta:
+ *       bin/node  +  lib/node_modules/npm/bin/npm-cli.js
+ *   - Windows zip / installer:
+ *       node.exe  +  node_modules/npm/bin/npm-cli.js   (same dir as node.exe)
+ *
+ * Both layouts are probed on every platform (a defensive superset) so a
+ * non-standard packaging still resolves if npm is present anywhere npm
+ * normally ships.
+ *
+ * @param {string} [execPath] - override for process.execPath (tests)
+ * @returns {string[]} absolute candidate paths, most-likely first
+ */
+function npmCliCandidates(execPath) {
+  const nodeBin = path.dirname(execPath || process.execPath);
+  return [
+    // Windows-style: npm sits beside node.exe.
+    path.join(nodeBin, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    // POSIX-style: npm sits one level up under lib/.
+    path.join(nodeBin, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    // Some Windows installs nest under a node_modules/npm with a lib prefix.
+    path.join(nodeBin, '..', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+  ];
+}
+
+/**
+ * Resolve a portable, absolute spawn descriptor for `npm install`.
+ *
+ * Preferred result (strategy 'node-npm-cli'):
+ *   { command: process.execPath, baseArgs: [<abs npm-cli.js>], shell: false }
+ * Run npm by feeding its JS entry point to the current node binary. No PATH
+ * dependency, no .cmd extension, no shell. Correct on Windows, Mac, Linux.
+ *
+ * Fallback result (strategy 'path-npm'):
+ *   { command: 'npm', baseArgs: [], shell: true on win32 else false }
+ * Used only when npm-cli.js is not found off process.execPath. shell:true is
+ * set on Windows so the OS resolves `npm` -> `npm.cmd` (still better than the
+ * pre-fix bare spawn, though it remains PATH-dependent).
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.execPath] - override process.execPath (tests)
+ * @returns {{command:string, baseArgs:string[], shell:boolean, strategy:string, npmCli:(string|null)}}
+ */
+function resolveNpmCli(opts) {
+  opts = opts || {};
+  const candidates = npmCliCandidates(opts.execPath);
+  for (const candidate of candidates) {
+    try {
+      if (fs.existsSync(candidate)) {
+        return {
+          command: opts.execPath || process.execPath,
+          baseArgs: [candidate],
+          shell: false,
+          strategy: 'node-npm-cli',
+          npmCli: candidate,
+        };
+      }
+    } catch (_) {
+      // stat failure on a candidate -- try the next one.
+    }
+  }
+  // Fallback: npm-cli.js not locatable. PATH-based spawn, with Windows .cmd
+  // handling via shell:true. Still an improvement over the bare pre-fix call.
+  return {
+    command: 'npm',
+    baseArgs: [],
+    shell: IS_WINDOWS,
+    strategy: 'path-npm',
+    npmCli: null,
+  };
+}
+
+/**
+ * Build the full argv for `npm install` (production-safe, quiet, no scripts
+ * surprises) given a resolved descriptor from resolveNpmCli().
+ *
+ * @param {{baseArgs:string[]}} descriptor
+ * @param {string[]} [installArgs] - npm args after `install`; defaults to the
+ *                                   quiet production set used by the heal path.
+ * @returns {string[]} argv to pass as the second arg of spawnSync(command, argv)
+ */
+function buildInstallArgs(descriptor, installArgs) {
+  const tail = Array.isArray(installArgs) && installArgs.length
+    ? installArgs
+    : ['--no-audit', '--no-fund', '--silent'];
+  return descriptor.baseArgs.concat(['install'], tail);
+}
+
+module.exports = {
+  resolveNpmCli,
+  buildInstallArgs,
+  npmCliCandidates,
+  IS_WINDOWS,
+};

package/lib/core/npm-cli-resolve.test.cjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Regression tests for lib/core/npm-cli-resolve.cjs -- portable npm CLI
+ * resolution (debug session mcp-servers-cache-missing-node-modules, escalated
+ * mandate 2026-05-21).
+ *
+ * The prior Option D fix (commit f6cafe74) ran a bare `spawnSync('npm', ...)`
+ * that was DEAD on Windows (npm is npm.cmd) and FRAGILE on Mac (PATH gap for
+ * GUI-launched Claude Code). These tests lock the cross-platform contract:
+ *
+ *   Test 1: resolveNpmCli on the test host returns the 'node-npm-cli' strategy
+ *           and the resolved npm-cli.js actually exists.
+ *   Test 2: the resolved command equals process.execPath (the current node
+ *           binary) -- NOT the literal string 'npm'. This is what makes it
+ *           PATH-independent.
+ *   Test 3: WINDOWS layout -- npmCliCandidates for a win32-style execPath puts
+ *           `<nodeBinDir>/node_modules/npm/bin/npm-cli.js` first (where the
+ *           Windows node installer ships npm). No `.cmd` anywhere in the argv.
+ *   Test 4: buildInstallArgs produces `[<npm-cli.js>] install --no-audit
+ *           --no-fund --silent` for the node-npm-cli strategy.
+ *   Test 5: the fallback descriptor (path-npm) sets shell:true ONLY on win32,
+ *           so even the fallback carries Windows .cmd handling.
+ *   Test 6: no em-dashes in npm-cli-resolve.cjs (HARD RULE).
+ *   Test 7: the argv never contains the bare token 'npm' as command on the
+ *           node-npm-cli strategy -- proves PATH is not relied upon.
+ *
+ * HARD RULE: no em-dashes.
+ */
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const MODULE_PATH = path.join(REPO_ROOT, 'lib', 'core', 'npm-cli-resolve.cjs');
+const { resolveNpmCli, buildInstallArgs, npmCliCandidates } = require(MODULE_PATH);
+
+let passed = 0;
+let failed = 0;
+
+function ok(name) {
+  passed += 1;
+  process.stdout.write('  ok ' + name + '\n');
+}
+function fail(name, err) {
+  failed += 1;
+  process.stdout.write('  FAIL ' + name + '\n');
+  process.stdout.write('    ' + (err && err.message ? err.message : String(err)) + '\n');
+}
+function test(name, fn) {
+  try { fn(); ok(name); } catch (err) { fail(name, err); }
+}
+
+// Test 1 -- node-npm-cli strategy on the test host, npm-cli.js exists.
+test('resolveNpmCli returns node-npm-cli strategy with a real npm-cli.js', () => {
+  const r = resolveNpmCli();
+  assert.equal(r.strategy, 'node-npm-cli', 'expected node-npm-cli strategy on a normal node install');
+  assert.ok(r.npmCli, 'npmCli path should be set');
+  assert.ok(fs.existsSync(r.npmCli), 'resolved npm-cli.js must exist on disk: ' + r.npmCli);
+});
+
+// Test 2 -- command is the node binary, not the literal 'npm'.
+test('resolveNpmCli command is process.execPath (PATH-independent)', () => {
+  const r = resolveNpmCli();
+  assert.equal(r.command, process.execPath, 'command must be the current node binary');
+  assert.notEqual(r.command, 'npm', 'command must NOT be the bare PATH-dependent string npm');
+  assert.equal(r.shell, false, 'node-npm-cli strategy needs no shell');
+});
+
+// Test 3 -- Windows layout: npm-cli.js beside node.exe is the first candidate.
+test('npmCliCandidates puts the Windows-layout path first', () => {
+  // path.win32 mirrors what require('path') resolves to on a real Windows host.
+  const winExec = 'C:\\Program Files\\nodejs\\node.exe';
+  const cands = npmCliCandidates(winExec);
+  assert.ok(Array.isArray(cands) && cands.length >= 3, 'expected >= 3 candidates');
+  // The first candidate is the <nodeBinDir>/node_modules/npm/bin/npm-cli.js
+  // layout -- exactly where the Windows node installer ships npm.
+  assert.ok(
+    cands[0].indexOf('node_modules') !== -1 && cands[0].indexOf('npm-cli.js') !== -1,
+    'first candidate must target node_modules/npm/bin/npm-cli.js'
+  );
+  // No candidate is a .cmd file -- we always run the JS entry point directly.
+  for (const c of cands) {
+    assert.ok(c.indexOf('.cmd') === -1, 'no candidate may be a .cmd batch file: ' + c);
+  }
+});
+
+// Test 4 -- buildInstallArgs argv shape for the node-npm-cli strategy.
+test('buildInstallArgs produces [npm-cli.js] install ...quiet-flags', () => {
+  const r = resolveNpmCli();
+  const argv = buildInstallArgs(r);
+  assert.equal(argv[0], r.npmCli, 'first arg must be the npm-cli.js path');
+  assert.equal(argv[1], 'install', 'second arg must be install');
+  assert.deepEqual(
+    argv.slice(2),
+    ['--no-audit', '--no-fund', '--silent'],
+    'default install args must be the quiet production set'
+  );
+  // A custom install-args override is honored.
+  const custom = buildInstallArgs(r, ['--omit=dev']);
+  assert.deepEqual(custom.slice(1), ['install', '--omit=dev']);
+});
+
+// Test 5 -- fallback descriptor: shell:true only on Windows.
+test('path-npm fallback sets shell:true only on win32', () => {
+  // Force the fallback by pointing execPath at a freshly-created EMPTY temp
+  // directory tree deep enough that none of the candidate paths (including the
+  // `../lib/node_modules/...` POSIX-layout candidate) can escape onto a real
+  // system npm. The temp dir is isolated and known to contain no node_modules.
+  const os = require('node:os');
+  const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'mos-npm-resolve-test-'));
+  try {
+    // <tmpRoot>/x/y/z/bin/node -- candidates resolve under <tmpRoot>/x/y/z,
+    // which is empty, so resolveNpmCli must fall through to path-npm.
+    const fakeBin = path.join(tmpRoot, 'x', 'y', 'z', 'bin');
+    fs.mkdirSync(fakeBin, { recursive: true });
+    const r = resolveNpmCli({ execPath: path.join(fakeBin, 'node') });
+    assert.equal(r.strategy, 'path-npm', 'expected the path-npm fallback in an isolated empty tree');
+    assert.equal(r.command, 'npm', 'fallback command is the bare npm');
+    assert.equal(r.npmCli, null, 'fallback has no npmCli path');
+    assert.equal(
+      r.shell,
+      process.platform === 'win32',
+      'fallback shell must be true on Windows (npm.cmd handling) and false elsewhere'
+    );
+  } finally {
+    fs.rmSync(tmpRoot, { recursive: true, force: true });
+  }
+});
+
+// Test 6 -- HARD RULE: no em-dashes. The em-dash is referenced via its Unicode
+// code point (U+2014) so this test file itself stays em-dash-clean.
+test('npm-cli-resolve.cjs has no em-dashes', () => {
+  const src = fs.readFileSync(MODULE_PATH, 'utf8');
+  const EM_DASH = String.fromCharCode(0x2014);
+  assert.ok(src.indexOf(EM_DASH) === -1, 'em-dash found in npm-cli-resolve.cjs');
+});
+
+// Test 7 -- the node-npm-cli argv never relies on a bare 'npm' token.
+test('node-npm-cli argv does not depend on PATH resolution of npm', () => {
+  const r = resolveNpmCli();
+  const fullArgv = [r.command].concat(buildInstallArgs(r));
+  assert.notEqual(fullArgv[0], 'npm', 'command position must not be the bare npm token');
+  // The npm-cli.js path is absolute -- not resolved against PATH or cwd.
+  assert.ok(path.isAbsolute(r.npmCli), 'npm-cli.js path must be absolute');
+});
+
+process.stdout.write('\nnpm-cli-resolve: ' + passed + ' passed, ' + failed + ' failed\n');
+process.exit(failed === 0 ? 0 : 1);