@passioncode-ai/passioncode 0.2.48 → 0.2.49

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.49 - 2026-10-28
+
+### Fixed
+
+- On Windows the launcher makes its links (`current`, the skill hub and each agent's channel) as
+  junctions instead of symbolic links, so a member without an administrator session or Developer
+  Mode can install and update the skill set; a junction's target is read back in the same form the
+  launcher compares (PC-87).
+
 ## 0.2.48 - 2026-10-28
 
 ### Fixed

package/README.md

@@ -76,7 +76,8 @@ secret into a product's own hidden prompt, starting Docker for Fabric, and resta
   comes from it.
 - **Every other agent** (Cursor, Codex, Gemini, OpenCode, Kiro, Windsurf, Goose, …) gets
   the same skills through `~/.agents/skills`, linked from each channel that exists on
-  the machine.
+  the machine. On Windows these links (and `~/.passioncode/current`) are junctions, which
+  need neither an administrator session nor Developer Mode.
 - Updates create no skill copies in `~/.claude/skills`: a plain copy there shadows the plugin. Such
   copies, and hub entries that pointed at a repository's working tree, are moved into
   `~/.passioncode/quarantine/` — `npx @passioncode-ai/passioncode@latest restore` puts them back.

package/SECURITY.md

@@ -5,7 +5,7 @@ carries credentials or a working exploit.
 
 What `passioncode update` touches (setup and doctor: [below](#what-setup-and-doctor-touch)): `~/.passioncode/` (releases, state, quarantine,
 logs); Claude Code's plugin registry through the `claude plugin` CLI only;
-`~/.agents/skills/<member skill>` and `<agent channel>/<member skill>` links; and
+`~/.agents/skills/<member skill>` and `<agent channel>/<member skill>` links (junctions on Windows); and
 `~/.claude/skills/<member skill>`, which it moves into the quarantine once the plugin
 that replaces it is verified. For a member's old single-member marketplace
 (`legacyMarketplaces` in `family.json`), once that plugin is verified and nothing else

package/lib/launcher.js

@@ -55,7 +55,25 @@ function writeText(file, text) {
   fs.renameSync(tmp, file);
 }
 function lstat(p) { try { return fs.lstatSync(p); } catch (_) { return null; } }
-function linkTarget(p) { try { return fs.readlinkSync(p); } catch (_) { return null; } }
+/**
+ * A link's target as written. A Windows junction reads back absolute, sometimes behind `\\?\` or with a
+ * trailing separator, so there it is put in the form `path.resolve` gives (PC-87).
+ */
+function linkTarget(p) {
+  let target;
+  try { target = fs.readlinkSync(p); } catch (_) { return null; }
+  if (process.platform !== 'win32') return target;
+  target = target.replace(/^\\\\\?\\/, '');
+  return path.win32.isAbsolute(target) ? path.win32.resolve(target) : target;
+}
+/**
+ * Make a directory link. Windows makes a symbolic link only for an administrator or with Developer
+ * Mode on, so there it is a junction, which needs neither and always holds an absolute target (PC-87).
+ */
+function makeLink(target, at, { platform = process.platform, symlink = fs.symlinkSync } = {}) {
+  if (platform !== 'win32') return symlink(target, at);
+  return symlink(path.resolve(path.dirname(at), target), at, 'junction');
+}
 function pointsTo(at, target) { const link = linkTarget(at); return link !== null && path.resolve(path.dirname(at), link) === target; }
 function isDirectory(at) { try { return fs.statSync(at).isDirectory(); } catch (_) { return false; } }
 function readState(file, { tolerant = false } = {}) {
@@ -73,12 +91,13 @@ function readState(file, { tolerant = false } = {}) {
  * On Windows the swap is therefore not atomic: between the unlink and the rename `at` is absent,
  * and a run killed there leaves no `current` until the next update (status reports it missing).
  */
-function symlinkAtomic(target, at, { platform = process.platform, rename = fs.renameSync, unlink = fs.unlinkSync } = {}) {
+function symlinkAtomic(target, at, { platform = process.platform, rename = fs.renameSync, unlink = fs.unlinkSync, symlink = fs.symlinkSync } = {}) {
+  const link = (to, where) => makeLink(to, where, { platform, symlink });
   fs.mkdirSync(path.dirname(at), { recursive: true });
   const tmp = `${at}.${process.pid}.lnk`;
   const dropTmp = () => { try { fs.unlinkSync(tmp); } catch (_) { /* none */ } };
   dropTmp();
-  fs.symlinkSync(target, tmp);
+  link(target, tmp);
   try {
     rename(tmp, at);
   } catch (error) {
@@ -88,7 +107,7 @@ function symlinkAtomic(target, at, { platform = process.platform, rename = fs.re
     try { unlink(at); } catch (unlinkError) { dropTmp(); throw unlinkError; }
     try { rename(tmp, at); } catch (again) {
       dropTmp();
-      try { fs.symlinkSync(previous, at); } catch (back) { throw new Error(`${again.message}; and putting back ${at} → ${previous} failed (${back.message})`); }
+      try { link(previous, at); } catch (back) { throw new Error(`${again.message}; and putting back ${at} → ${previous} failed (${back.message})`); }
       throw again;
     }
   }
@@ -883,5 +902,5 @@ module.exports = {
   restore: (opts = {}) => withUpdateLock(opts.home, () => restore(opts)),
   uninstall: (opts = {}) => withUpdateLock(opts.home, () => uninstall(opts)),
   status, setConfig, paths, CHANNELS, MARKETPLACE, payloadManifest, marketplaceAddArg,
-  acquireUpdateLock, UpdateRunning, staleReleases, symlinkAtomic, claudeRunner, bundledMcpServers, mcpFileTargets, readSettings, tomlTableRange, tomlTableCommand, tomlTableArgs, tomlMentions,
+  acquireUpdateLock, UpdateRunning, staleReleases, symlinkAtomic, makeLink, linkTarget, claudeRunner, bundledMcpServers, mcpFileTargets, readSettings, tomlTableRange, tomlTableCommand, tomlTableArgs, tomlMentions,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Set up PassionCode.ai on a computer with one command — the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills — and check and repair it with the same command or `doctor`.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.2.48",
+      "version": "0.2.49",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,6 +1,6 @@
 {
   "family": "passioncode",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "release": true,
   "members": [
     {
@@ -62,9 +62,9 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.2.48",
+      "ref": "v0.2.49",
       "commit": null,
-      "version": "0.2.48",
+      "version": "0.2.49",
       "via": "this repository",
       "skills": [
         "setting-up-passioncode",
@@ -72,7 +72,7 @@
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:18c44b353312024f0735136631c2df0ac416bb8f3881406958e5aed0e710375a",
+      "contentHash": "sha256:f69e173ef90a590a533a71de1028073a785e59d917a03c1bc0516cdba17698e2",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",