@opengsd/gsd-path 1.3.0 → 1.4.0

package/scripts/guard_hook.py

@@ -25,6 +25,7 @@ import json
 import os
 import re
 import shlex
+import stat
 import subprocess
 import sys
 from pathlib import Path, PurePosixPath
@@ -474,6 +475,20 @@ def collect(
             )
 
 
+def is_link_like(path):
+    """A symlink, or on Windows any name-surrogate reparse point such as a junction.
+
+    Path.is_symlink() is false for a junction, which still redirects the path.
+    """
+    try:
+        status = os.lstat(path)
+    except OSError:
+        return False
+    return stat.S_ISLNK(status.st_mode) or bool(
+        getattr(status, "st_reparse_tag", 0) & 0x20000000  # IO_REPARSE_TAG name surrogate
+    )
+
+
 def normalize_posix(path):
     text = path.replace("\\", "/").strip()
     if not text:
@@ -536,7 +551,7 @@ def repository_root():
     result = subprocess.run(
         ["git", "rev-parse", "--show-toplevel"],
         cwd=candidate,
-        text=True,
+        encoding="utf-8", errors="replace",
         capture_output=True,
         check=False,
     )
@@ -544,7 +559,7 @@ def repository_root():
         state = candidate / ".project" / "STATE.md"
         if (
             candidate.is_dir()
-            and not candidate.is_symlink()
+            and not is_link_like(candidate)
             and os.path.lexists(state)
         ):
             return candidate
@@ -560,7 +575,7 @@ def project_status(repo):
     result = subprocess.run(
         [sys.executable, "-B", str(launcher), "--repo", str(repo)],
         cwd=repo,
-        text=True,
+        encoding="utf-8", errors="replace",
         capture_output=True,
         check=False,
     )
@@ -697,13 +712,29 @@ def valid_status_branch(value):
 
 def target_paths(path, working_directories, repo):
     repo = repo.resolve()
-    candidate = Path(path)
+    candidate = Path(native_path_text(path))
     if not candidate.is_absolute():
         base = Path(working_directories[0]) if working_directories else repo
         if not base.is_absolute():
             base = repo / base
         candidate = base / candidate
-    return Path(os.path.abspath(candidate)), candidate.resolve(strict=False)
+    return Path(os.path.abspath(candidate)), resolve_lenient(candidate)
+
+
+def resolve_lenient(path):
+    """Path.resolve(strict=False) that still follows links on Windows.
+
+    Python 3.9 raises OSError on Windows for names it cannot open (rep*) and
+    for some links to missing files; the archive checks must not skip those
+    (a symlinked archive path would be allowed), so fall back to
+    os.path.realpath, which resolves what it can and keeps the remainder.
+    """
+    try:
+        return path.resolve(strict=False)
+    except OSError:
+        if os.name != "nt":
+            raise
+        return Path(os.path.realpath(path))
 
 
 @lru_cache(maxsize=None)
@@ -712,7 +743,7 @@ def repository_control_roots(repo):
     result = subprocess.run(
         ["git", "rev-parse", "--git-common-dir"],
         cwd=repo,
-        text=True,
+        encoding="utf-8", errors="replace",
         capture_output=True,
         env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
         check=False,
@@ -789,6 +820,51 @@ def path_kind(candidate, repo, control_roots=()):
     return "product"
 
 
+def member_target_kind(candidate, repo):
+    """'product' when the path lies in a verified member of this coordinator.
+
+    A member follows its coordinator's phase. A stale member of this
+    coordinator raises MembersError, so the caller denies the write.
+    """
+    directory = candidate if candidate.is_dir() else candidate.parent
+    while not directory.is_dir() and directory != directory.parent:
+        directory = directory.parent
+    found = subprocess.run(
+        ["git", "-C", str(directory), "rev-parse", "--path-format=absolute",
+         "--show-toplevel", "--git-common-dir"],
+        encoding="utf-8", errors="replace", capture_output=True, check=False,
+        env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
+    )
+    lines = found.stdout.splitlines()
+    if found.returncode != 0:
+        if found.stderr.strip().startswith("fatal: not a git repository"):
+            return None
+        raise RuntimeError(found.stderr.strip() or "Git inspection failed")
+    if len(lines) != 2:
+        raise RuntimeError("Git inspection returned an unexpected result")
+    toplevel, common = Path(lines[0]), Path(lines[1])
+    if not os.path.lexists(common / "gsd-path" / "member.json"):
+        return None
+    import members  # the guard's runtime directory; only paths in a member need it
+    coordinator = members.marker_coordinator(toplevel)
+    if coordinator is None:
+        return None
+    if coordinator.resolve() != repo.resolve():
+        for member in members.read_members(repo):
+            try:
+                listed_common = members._common_dir(Path(member["checkout"]))
+            except (members.MembersError, OSError):
+                continue
+            if listed_common == common.resolve():
+                raise members.MembersError(
+                    "member marker names an old coordinator; "
+                    "run members.py repair --repo <coordinator>"
+                )
+        return None
+    members.member_role(toplevel)
+    return "product"
+
+
 def target_kind(path, working_directories, repo, control_roots=None):
     lexical, resolved = target_paths(path, working_directories, repo)
     repo = repo.resolve()
@@ -798,10 +874,21 @@ def target_kind(path, working_directories, repo, control_roots=None):
         _canonical_control_alias(lexical, repo, control_roots),
         _canonical_control_alias(resolved, repo, control_roots),
     )
-    kinds = {
+    resolved_kind = path_kind(resolved, repo, control_roots)
+    kinds = {resolved_kind} | {
         path_kind(candidate, repo, control_roots)
-        for candidate in (lexical, resolved, *aliases)
+        for candidate in (lexical, *aliases)
     }
+    if resolved_kind == "external" and "protected" not in kinds:
+        try:
+            member_kind = member_target_kind(resolved, repo)
+        except Exception as error:
+            deny(
+                f"member write refused: {error}; "
+                "run members.py repair --repo <coordinator>"
+            )
+        if member_kind:
+            kinds.add(member_kind)
     for kind in ("protected", "product", "artifact", "external"):
         if kind in kinds:
             return kind
@@ -824,12 +911,12 @@ def pipeline_target_kinds(targets):
 def closed_target_reason(targets):
     for path, working_directories in targets:
         for target in dict.fromkeys(target_paths(path, working_directories, repository_root())):
-            directory = target if target.is_dir() and not target.is_symlink() else target.parent
+            directory = target if target.is_dir() and not is_link_like(target) else target.parent
             while not directory.exists() and directory != directory.parent:
                 directory = directory.parent
             root = subprocess.run(
                 ["git", "-C", str(directory), "rev-parse", "--show-toplevel"],
-                capture_output=True, text=True,
+                capture_output=True, encoding="utf-8", errors="replace",
             )
             if root.returncode == 0:
                 reason = closed_milestone_reason(Path(root.stdout.strip()))
@@ -919,10 +1006,35 @@ def expansion_can_match_archive(path):
     )
 
 
+# Git Bash (Claude Code's shell on Windows) names drive C: as /c or /cygdrive/c.
+MSYS_DRIVE_PATH = re.compile(r"^/(?:cygdrive/)?([A-Za-z])(?=/|$)")
+
+
+def native_path_text(value):
+    """On Windows, the drive path that a Git Bash path such as /c/repo names.
+
+    Python reads /c/repo as a folder named c at the root of the current drive,
+    which would hide an archive from the containment checks.
+    """
+    if os.name != "nt":
+        return value
+    text = value.replace("\\", "/")
+    match = MSYS_DRIVE_PATH.match(text)
+    if match is None:
+        return value
+    return f"{match.group(1).upper()}:{text[match.end():] or '/'}"
+
+
 def path_values(value):
-    yield value
+    values = [value]
     if value.startswith("-") and "=" in value:
-        yield value.split("=", 1)[1]
+        values.append(value.split("=", 1)[1])
+    for candidate in values:
+        yield candidate
+        # Deny when either reading of an ambiguous Windows path reaches an archive.
+        native = native_path_text(candidate)
+        if native != candidate:
+            yield native
 
 
 def is_absolute_path(path):
@@ -932,7 +1044,7 @@ def is_absolute_path(path):
 
 def contains_existing_archive(path, working_directories):
     try:
-        target = Path(path).resolve(strict=False)
+        target = resolve_lenient(Path(path))
     except (OSError, RuntimeError):
         return False
     search_paths = [target, Path.cwd(), *(Path(value) for value in working_directories)]
@@ -940,7 +1052,7 @@ def contains_existing_archive(path, working_directories):
         if os.name != "nt" and re.match(r"^[A-Za-z]:[/\\]", str(search_path)):
             continue
         try:
-            resolved = search_path.resolve(strict=False)
+            resolved = resolve_lenient(search_path)
         except (OSError, RuntimeError):
             continue
         for parent in (resolved, *resolved.parents):
@@ -973,7 +1085,7 @@ def path_in_archive(path, working_directories=(), ancestors=True):
             if os.name != "nt" and re.match(r"^[A-Za-z]:[/\\]", combined):
                 continue
             try:
-                resolved = Path(combined).resolve(strict=False)
+                resolved = resolve_lenient(Path(combined))
             except (OSError, RuntimeError):
                 continue
             if in_archive(resolved.as_posix()) or (
@@ -997,7 +1109,7 @@ def working_directory_in_archive(path):
         if os.name != "nt" and re.match(r"^[A-Za-z]:[/\\]", value):
             continue
         try:
-            resolved = Path(value).resolve(strict=False)
+            resolved = resolve_lenient(Path(value))
         except (OSError, RuntimeError):
             continue
         if in_archive(resolved.as_posix()):
@@ -1159,7 +1271,7 @@ def copy_destinations(arguments, directories, assignments=None):
         lexical, source_path = target_paths(source, directories, repository_root())
         if source_path.is_dir():
             # ponytail: reject ambiguous directory links instead of emulating cp flags.
-            if lexical.is_symlink():
+            if is_link_like(lexical):
                 raise ValueError("cp directory source is a symlink; pass a literal directory")
 
             def unreadable(error):
@@ -1168,7 +1280,7 @@ def copy_destinations(arguments, directories, assignments=None):
             for root, folders, files in os.walk(source_path, onerror=unreadable):
                 for name in folders + files:
                     entry = Path(root) / name
-                    if entry.is_symlink() and entry.is_dir():
+                    if is_link_like(entry) and entry.is_dir():
                         raise ValueError("cp source contains a directory symlink; copy it separately")
                     for output in outputs:
                         yield str(output / entry.relative_to(source_path))
@@ -1648,7 +1760,7 @@ def has_short_option(arguments, option):
 def git_alias(command, git_options):
     result = subprocess.run(
         ["git", *git_options, "config", "--get", f"alias.{command}"],
-        text=True,
+        encoding="utf-8", errors="replace",
         capture_output=True,
         check=False,
     )
@@ -1791,13 +1903,13 @@ def closed_milestone_reason(repo=None):
     repo = repo or repository_root()
     branch = subprocess.run(
         ["git", "-C", str(repo), "branch", "--show-current"],
-        capture_output=True, text=True,
+        capture_output=True, encoding="utf-8", errors="replace",
     )
     if not re.fullmatch(r"gsd-path/M\d{3,}", branch.stdout.strip()):
         return None
     result = subprocess.run(
         [sys.executable, "-B", str(Path(__file__).with_name("git_guard.py")),
-         "closed-milestone"], cwd=repo, capture_output=True, text=True,
+         "closed-milestone"], cwd=repo, capture_output=True, encoding="utf-8", errors="replace",
     )
     if result.returncode:
         return result.stderr.strip() or "closed milestone inspection failed"
@@ -1807,7 +1919,7 @@ def closed_milestone_reason(repo=None):
 def bundled_helper_invocation(command, tokens, working_directories, helpers=PIPELINE_HELPERS):
     """Allow one plain ``python[3] [-B] <script>`` from the guard-owned runtime.
 
-    The interpreter token must be exactly python or python3, and the script
+    The interpreter must be exactly python, python3, or py -3, and the script
     operand is the exact parsed token, with expansions and parent traversal refused.
     The resolved helper must be a regular file inside runtime/ beside this guard,
     or beside the guard itself in the repository layout. Resolve only in supplied
@@ -1826,9 +1938,12 @@ def bundled_helper_invocation(command, tokens, working_directories, helpers=PIPE
     _, substitutions = split_command_substitutions(command)
     if substitutions or wrapped_command_tokens(segments[0]) is not None:
         return False
-    if tokens[0] not in ("python", "python3"):
+    if tokens[:2] == ["py", "-3"]:
+        rest = tokens[2:]
+    elif tokens[0] in ("python", "python3"):
+        rest = tokens[1:]
+    else:
         return False
-    rest = tokens[1:]
     if rest[:1] == ["-B"]:
         rest = rest[1:]
     if not rest:
@@ -1853,7 +1968,8 @@ def bundled_helper_invocation(command, tokens, working_directories, helpers=PIPE
     runtime = runtime.resolve()
     for base in working_directories or [os.getcwd()]:
         try:
-            script = (Path(base) / operand).resolve()
+            # A Git Bash /c/... operand names the C: drive, not a folder named c.
+            script = (Path(base) / native_path_text(operand)).resolve()
             if (
                 script.name in helpers
                 and (script.is_relative_to(runtime) or (
@@ -2035,7 +2151,7 @@ def closed_shell_execution_reason(command, tokens, working_directories):
                 for directory in directories:
                     result = subprocess.run(
                         ["git", *options, "rev-parse", "--show-toplevel", "--absolute-git-dir"],
-                        cwd=directory, capture_output=True, text=True,
+                        cwd=directory, capture_output=True, encoding="utf-8", errors="replace",
                     )
                     if result.returncode:
                         raise ValueError("git target repository cannot be resolved")
@@ -2068,8 +2184,8 @@ def command_denial(command, working_directories, allow_destructive=True):
     try:
         tokens = shell_tokens(outer)
         if tokens in (
-            [interpreter, "-B", "-c", "import sys; raise SystemExit(sys.version_info < (3, 9))"]
-            for interpreter in ("python3", "python")
+            [*interpreter.split(), "-B", "-c", "import sys; raise SystemExit(sys.version_info < (3, 9))"]
+            for interpreter in ("python3", "python", "py -3")
         ):
             return None
         destructive = list(destructive_shell_invocations(tokens))
@@ -2116,8 +2232,14 @@ def allow(event):
 
 
 def main():
+    # Hosts exchange hook input and output as UTF-8; a Windows pipe would
+    # default to cp1252. In-process callers may substitute text streams.
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="replace")
     try:
-        event = json.load(sys.stdin)
+        stdin = getattr(sys.stdin, "buffer", None)
+        event = json.loads(stdin.read().decode("utf-8") if stdin is not None else sys.stdin.read())
         if not isinstance(event, dict):
             raise ValueError("hook event must be an object")
         evaluate(event)

package/scripts/install.mjs

@@ -14,32 +14,12 @@ export const CLAUDE_BRIDGE = "@../AGENTS.md\n@../WORKFLOW.md\n";
 export const HOOKS_DIRECTORY = ".gsd-path";
 export const GUARD_SCRIPTS = ["guard_hook.py", "git_guard.py"];
 export const GUARD_MARKER = "gsd-path guard";
-export const PROJECT_RUNTIME_SCRIPTS = [
-  "pipeline_state.py",
-  "roadmap.py",
-  "check_handoffs.py",
-  "check_task_briefs.py",
-  "isolation.py",
-  "discussion_records.py",
-  "pipeline_git.py",
-  "promote_lookahead.py",
-  "detect_project.py",
-  "pipeline_diagnose.py",
-  "pipeline_undo.py",
-  "archive_milestone.py",
-  "review_panel.py",
-  "_common.py",
-  "worktree_paths.py",
-  "build_recovery.py",
-  "state_checkpoint.py",
-  "state_promote.py",
-  "discussion_validate.py",
-  "integration.py",
-];
 export const PROJECT_RUNTIME_MARKER = "gsd-path project runtime";
 export const PROJECT_STATUS_LAUNCHER = "status_runtime.py";
 export const PROJECT_STATUS_MARKER = "gsd-path project status launcher";
 const INSTALL_LOCK_NAME = ".gsd-path-install-lock";
+const LOCAL_EDITS_NOTE =
+  "; local edits inside these skills are not carried forward (see UPDATE.md#local-additions)";
 const INSTALL_LOCK_OWNER = "owner.json";
 const INSTALL_LOCK_SCHEMA = "gsd-path/install-lock/v2";
 export const CLAUDE_MATCHER = ".*";
@@ -151,15 +131,22 @@ export const GIT_HOOKS = [
 ];
 export const GIT_HOOK_NAMES = GIT_HOOKS.map(([name]) => name);
 
-// Every interpreter a managed hook may legitimately be pinned to.
-const INTERPRETER_CANDIDATES = ["python3", "python"];
+// Every interpreter a managed hook may legitimately be pinned to. Each is a
+// command prefix: python.org Windows installs may put only `py` on PATH.
+const INTERPRETER_CANDIDATES = ["python3", "python", "py -3"];
+
+// Run a Python interpreter command prefix (for example "py -3") with args.
+function spawnPython(interpreter, args, options) {
+  const [command, ...prefix] = interpreter.split(" ");
+  return spawnSync(command, [...prefix, ...args], options);
+}
 
-// Probe for a runnable Python interpreter (python3, then python) so emitted
-// hooks never hard-code an interpreter that does not exist on this machine
-// (python3 is typically absent on Windows).
+// Probe for a runnable Python interpreter (python3, then python, then py -3)
+// so emitted hooks never hard-code an interpreter that does not exist on this
+// machine (python3 is typically absent on Windows).
 export function detectPythonInterpreter() {
   for (const candidate of INTERPRETER_CANDIDATES) {
-    const result = spawnSync(
+    const result = spawnPython(
       candidate,
       ["-B", "-c", "import sys; raise SystemExit(sys.version_info < (3, 9))"],
       { stdio: "ignore" }
@@ -475,12 +462,17 @@ function materializedResourceBytes(source, destination) {
   return Buffer.from(rewriteRouterAliasSkill(data.toString("utf8"), alias, canonical));
 }
 
+// The JavaScript realpath keeps Windows 8.3 short names (C:\Users\LONGNA~1);
+// Python's resolve() expands them, and both installers must hash one lock
+// identity per target, so Windows asks the OS for the final path as Python does.
+const realpath = process.platform === "win32" ? fs.realpathSync.native : fs.realpathSync;
+
 function resolveNonStrict(value) {
   let prefix = path.resolve(value);
   const suffix = [];
   for (;;) {
     try {
-      return path.join(fs.realpathSync(prefix), ...suffix);
+      return path.join(realpath(prefix), ...suffix);
     } catch {
       const parent = path.dirname(prefix);
       if (parent === prefix) return path.join(prefix, ...suffix);
@@ -1090,7 +1082,7 @@ function rollbackTarget(transaction) {
     removePath(destination);
   }
   for (const [original, stored] of [...transaction.moved].reverse()) {
-    if (lexists(stored)) fs.renameSync(stored, original);
+    if (lexists(stored)) renameRetrying(stored, original);
   }
   if (transaction.backup !== null) {
     try {
@@ -1314,13 +1306,34 @@ function plannedBackupRoots(legacyRoot, deployments) {
   return planned;
 }
 
+// Access denied and busy: on Windows a scanner or indexer that briefly opens a
+// freshly written file blocks moving it or the directory holding it.
+const WINDOWS_BUSY_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const RENAME_ATTEMPTS = 20;
+
+function renameRetrying(from, to) {
+  if (process.platform !== "win32") return fs.renameSync(from, to);
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return fs.renameSync(from, to);
+    } catch (error) {
+      // A directory moved onto an existing directory also reports EPERM; that
+      // is not transient, so never retry it.
+      if (!WINDOWS_BUSY_CODES.has(error.code)
+          || fs.lstatSync(to, { throwIfNoEntry: false })?.isDirectory()
+          || attempt === RENAME_ATTEMPTS - 1) throw error;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(10 * 2 ** attempt, 250));
+    }
+  }
+}
+
 // Test-injection points; production callers never touch these.
 export const hooks = {
   mismatches,
   applyTarget,
-  rename: fs.renameSync.bind(fs),
+  rename: renameRetrying,
   renameInstallLock: fs.renameSync.bind(fs),
-  renameInstallStage: fs.renameSync.bind(fs),
+  renameInstallStage: renameRetrying,
   processIdentity,
   reserveDirectory,
   reserveFile,
@@ -1332,7 +1345,7 @@ export const hooks = {
 // Project installation already requires Python; keep runtime lifecycle ownership there.
 function projectAdapter(source, project, action, payload = {}, env = process.env) {
   const interpreter = requiredPythonRuntime("project runtime");
-  const result = spawnSync(interpreter, ["-B", path.join(SCRIPT_DIRECTORY, "install.py"), "--adapter-request"], {
+  const result = spawnPython(interpreter, ["-B", path.join(SCRIPT_DIRECTORY, "install.py"), "--adapter-request"], {
     input: JSON.stringify({ source, project, action, ...payload }), encoding: "utf8", env: { ...process.env, ...env },
   });
   if (result.error || result.status !== 0) {
@@ -1484,7 +1497,7 @@ export async function install(sourceRoot, plans, options = {}) {
         if (legacyTransaction.backup !== null) {
           results.push(
             `codex-legacy: backed up ${legacyTransaction.moved.length} entries to ` +
-              `${legacyTransaction.backup}`
+              `${legacyTransaction.backup}${LOCAL_EDITS_NOTE}`
           );
         }
       }
@@ -1503,7 +1516,7 @@ export async function install(sourceRoot, plans, options = {}) {
         if (transaction.backup !== null) {
           results.push(
             `${plan.targets.join("+")}: backed up ${transaction.moved.length} entries ` +
-              `to ${transaction.backup}`
+              `to ${transaction.backup}${LOCAL_EDITS_NOTE}`
           );
         }
       }
@@ -1559,6 +1572,7 @@ export function parseCli(argv) {
     "dry-run": { type: "boolean", default: false },
     local: { type: "boolean", default: false },
     project: { type: "string" },
+    "member-of": { type: "string" },
     doctor: { type: "boolean", default: false },
     hooks: { type: "boolean", default: false },
     "hooks-init": { type: "boolean", default: false },
@@ -1653,9 +1667,10 @@ function usage() {
     "  --doctor              read-only health check of installs, hooks, and state\n" +
     "  --hooks               with --project: install guard hooks (see HOOKS.md)\n" +
     "  --hooks-init          add guards to an existing project without changing its contracts\n" +
+    "  --member-of PATH      with --project: install member git hooks that run PATH's guard\n" +
     "  --runtime-restore     restore the exact declared runtime from --source-root\n" +
     "  --runtime-upgrade     explicitly select the supplied package runtime\n" +
-    "  --runtime-migrate     migrate a tracked legacy runtime for review; add --update to continue upgrading\n" +
+    "  --runtime-migrate     migrate a legacy runtime for review; add --update to continue upgrading\n" +
     "  --hooks-refresh       validate the selected runtime; keep its version\n" +
     "  --hooks-refresh-full  refresh native settings/git hooks; target flags create missing configs\n" +
     "  --dry-run             preview without writing\n" +
@@ -1702,9 +1717,10 @@ export async function main(argv, env = process.env) {
     ui.error("--runtime-migrate --update requires --project and cannot be combined with another runtime, doctor, or hook operation");
     return 2;
   }
-  if (!migrateAndUpdate && ["runtime-restore", "runtime-upgrade", "runtime-migrate"].some(name => values[name])) {
+  if (!migrateAndUpdate && (values["member-of"] !== undefined
+      || ["runtime-restore", "runtime-upgrade", "runtime-migrate"].some(name => values[name]))) {
     const interpreter = requiredPythonRuntime("project runtime");
-    const result = spawnSync(interpreter, ["-B", path.join(SCRIPT_DIRECTORY, "install.py"),
+    const result = spawnPython(interpreter, ["-B", path.join(SCRIPT_DIRECTORY, "install.py"),
       ...argv.filter(arg => arg !== "--no-color")], { stdio: "inherit", env });
     return result.status ?? 1;
   }
@@ -1809,7 +1825,7 @@ export async function main(argv, env = process.env) {
   }
   if (migrateAndUpdate) {
     const interpreter = requiredPythonRuntime("project runtime");
-    const migration = spawnSync(interpreter, ["-B", path.join(SCRIPT_DIRECTORY, "install.py"),
+    const migration = spawnPython(interpreter, ["-B", path.join(SCRIPT_DIRECTORY, "install.py"),
       "--runtime-migrate", "--project", project, "--source-root", sourceRoot,
       ...(values["dry-run"] ? ["--dry-run"] : [])], { stdio: "inherit", env });
     if (migration.error || migration.status !== 0) {