@pnpm/global.commands 1100.0.29 → 1100.0.31

package/lib/binOwnership.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The set of bin names provided by global package groups *other* than those
+ * in `excludeHashes`.
+ *
+ * Used before unlinking a group's bins (on remove / update / replace) so
+ * that a bin name shared with — and owned by — another still-installed
+ * group is never removed. Without this, removing one group could delete a
+ * bin that actually belongs to a different global package.
+ */
+export declare function getBinNamesOfOtherGroups(globalDir: string, excludeHashes: Set<string>): Promise<Set<string>>;

package/lib/binOwnership.js

@@ -0,0 +1,21 @@
+import { getInstalledBinNames, scanGlobalPackages } from '@pnpm/global.packages';
+/**
+ * The set of bin names provided by global package groups *other* than those
+ * in `excludeHashes`.
+ *
+ * Used before unlinking a group's bins (on remove / update / replace) so
+ * that a bin name shared with — and owned by — another still-installed
+ * group is never removed. Without this, removing one group could delete a
+ * bin that actually belongs to a different global package.
+ */
+export async function getBinNamesOfOtherGroups(globalDir, excludeHashes) {
+    const others = scanGlobalPackages(globalDir).filter((pkg) => !excludeHashes.has(pkg.hash));
+    const names = new Set();
+    await Promise.all(others.map(async (pkg) => {
+        for (const name of await getInstalledBinNames(pkg)) {
+            names.add(name);
+        }
+    }));
+    return names;
+}
+//# sourceMappingURL=binOwnership.js.map

package/lib/checkGlobalBinConflicts.js

@@ -28,7 +28,7 @@ export async function checkGlobalBinConflicts(opts) {
     if (newBinOwners.size === 0)
         return binsToSkip;
     // Quick check: only investigate if a bin with the same name already exists
-    const conflicting = new Set([...newBinOwners.keys()].filter((name) => fs.existsSync(path.join(opts.globalBinDir, name))));
+    const conflicting = new Set([...newBinOwners.keys()].filter((name) => binSlotExists(opts.globalBinDir, name)));
     if (conflicting.size === 0)
         return binsToSkip;
     // Some bins already exist — find out if they belong to packages being replaced
@@ -72,4 +72,14 @@ export async function checkGlobalBinConflicts(opts) {
     }
     return binsToSkip;
 }
+// Whether a bin named `name` already occupies a slot in `globalBinDir`. On
+// Windows the `node` runtime bin is linked as `<name>.exe` (with no bare
+// `<name>` file), so that flavor is checked too — otherwise an existing
+// `node.exe` would not be detected as a conflict and could be silently
+// overwritten.
+function binSlotExists(globalBinDir, name) {
+    if (fs.existsSync(path.join(globalBinDir, name)))
+        return true;
+    return process.platform === 'win32' && fs.existsSync(path.join(globalBinDir, `${name}.exe`));
+}
 //# sourceMappingURL=checkGlobalBinConflicts.js.map

package/lib/globalAdd.js

@@ -7,6 +7,7 @@ import { cleanOrphanedInstallDirs, createGlobalCacheKey, createInstallDir, findG
 import { readPackageJsonFromDirRawSync } from '@pnpm/pkg-manifest.reader';
 import { isSubdir } from 'is-subdir';
 import { symlinkDir } from 'symlink-dir';
+import { getBinNamesOfOtherGroups } from './binOwnership.js';
 import { checkGlobalBinConflicts } from './checkGlobalBinConflicts.js';
 import { installGlobalPackages } from './installGlobalPackages.js';
 import { promptApproveGlobalBuilds } from './promptApproveGlobalBuilds.js';
@@ -181,10 +182,15 @@ async function removeExistingGlobalInstalls(globalDir, globalBinDir, aliases) {
             groupsToRemove.set(existing.hash, getInstalledBinNames(existing));
         }
     }
+    // Bins owned by groups that survive this replacement must not be
+    // unlinked, or we'd delete a different global package's bin.
+    const protectedBins = await getBinNamesOfOtherGroups(globalDir, new Set(groupsToRemove.keys()));
     // Remove all groups in parallel
     await Promise.all([...groupsToRemove.entries()].map(async ([hash, binNamesPromise]) => {
         const binNames = await binNamesPromise;
-        await Promise.all(binNames.map((binName) => removeBin(path.join(globalBinDir, binName))));
+        await Promise.all(binNames
+            .filter((binName) => !protectedBins.has(binName))
+            .map((binName) => removeBin(path.join(globalBinDir, binName))));
         // Remove both the hash symlink and the install dir it points to
         const hashLink = getHashLink(globalDir, hash);
         let installDir = null;

package/lib/globalRemove.js

@@ -4,6 +4,7 @@ import { removeBin } from '@pnpm/bins.remover';
 import { PnpmError } from '@pnpm/error';
 import { findGlobalPackage, getHashLink, getInstalledBinNames, } from '@pnpm/global.packages';
 import { isSubdir } from 'is-subdir';
+import { getBinNamesOfOtherGroups } from './binOwnership.js';
 export async function handleGlobalRemove(opts, params) {
     const globalDir = opts.globalPkgDir;
     const globalBinDir = opts.bin;
@@ -16,10 +17,15 @@ export async function handleGlobalRemove(opts, params) {
         }
         groupsToRemove.set(pkg.hash, pkg);
     }
+    // Bins shared with (and owned by) groups that survive this removal must
+    // not be unlinked, or we'd delete another global package's bin.
+    const protectedBins = await getBinNamesOfOtherGroups(globalDir, new Set(groupsToRemove.keys()));
     // Remove bins, hash symlinks, and install dirs for all affected groups in parallel
     await Promise.all([...groupsToRemove.entries()].map(async ([hash, pkg]) => {
         const binNames = await getInstalledBinNames(pkg);
-        await Promise.all(binNames.map((binName) => removeBin(path.join(globalBinDir, binName))));
+        await Promise.all(binNames
+            .filter((binName) => !protectedBins.has(binName))
+            .map((binName) => removeBin(path.join(globalBinDir, binName))));
         await fs.promises.rm(getHashLink(globalDir, hash), { force: true });
         if (isSubdir(globalDir, pkg.installDir)) {
             await fs.promises.rm(pkg.installDir, { recursive: true, force: true });

package/lib/globalUpdate.js

@@ -6,6 +6,7 @@ import { summaryLogger } from '@pnpm/core-loggers';
 import { cleanOrphanedInstallDirs, createInstallDir, getHashLink, getInstalledBinNames, scanGlobalPackages, } from '@pnpm/global.packages';
 import { isSubdir } from 'is-subdir';
 import { symlinkDir } from 'symlink-dir';
+import { getBinNamesOfOtherGroups } from './binOwnership.js';
 import { checkGlobalBinConflicts } from './checkGlobalBinConflicts.js';
 import { installGlobalPackages } from './installGlobalPackages.js';
 import { promptApproveGlobalBuilds } from './promptApproveGlobalBuilds.js';
@@ -91,9 +92,13 @@ async function updateGlobalPackageGroup(opts, globalDir, globalBinDir, pkg, comm
         await fs.promises.rm(installDir, { recursive: true, force: true });
         throw err;
     }
-    // Remove stale bins from old installation before swapping
+    // Remove stale bins from old installation before swapping, but keep any
+    // bin owned by a different global group (don't delete another package's bin).
+    const protectedBins = await getBinNamesOfOtherGroups(globalDir, new Set([pkg.hash]));
     const oldBinNames = await getInstalledBinNames(pkg);
-    await Promise.all(oldBinNames.map((binName) => removeBin(path.join(globalBinDir, binName))));
+    await Promise.all(oldBinNames
+        .filter((binName) => !protectedBins.has(binName))
+        .map((binName) => removeBin(path.join(globalBinDir, binName))));
     // Swap hash symlink to new install dir, then clean up old one
     const hashLink = getHashLink(globalDir, pkg.hash);
     const oldInstallDir = pkg.installDir;

package/lib/readInstalledPackages.js

@@ -1,8 +1,9 @@
 import path from 'node:path';
+import { isValidGlobalDependencyAlias } from '@pnpm/global.packages';
 import { readPackageJsonFromDir, readPackageJsonFromDirRawSync } from '@pnpm/pkg-manifest.reader';
 export async function readInstalledPackages(installDir) {
     const pkgJson = readPackageJsonFromDirRawSync(installDir);
-    const depNames = Object.keys(pkgJson.dependencies ?? {});
+    const depNames = Object.keys(pkgJson.dependencies ?? {}).filter(isValidGlobalDependencyAlias);
     const manifests = await Promise.all(depNames.map((depName) => readPackageJsonFromDir(path.join(installDir, 'node_modules', depName))));
     return depNames.map((depName, i) => ({
         manifest: manifests[i],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/global.commands",
-  "version": "1100.0.29",
+  "version": "1100.0.31",
   "description": "Global package command handlers for pnpm",
   "keywords": [
     "pnpm",
@@ -11,9 +11,9 @@
   "funding": "https://opencollective.com/pnpm",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pnpm/pnpm/tree/main/global/commands"
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/global/commands"
   },
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/global/commands#readme",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/global/commands#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -31,25 +31,25 @@
     "@pnpm/util.lex-comparator": "^4.0.1",
     "is-subdir": "^2.0.0",
     "symlink-dir": "^10.0.1",
-    "@pnpm/bins.remover": "1100.0.10",
-    "@pnpm/cli.command": "1100.0.1",
-    "@pnpm/bins.linker": "1100.0.15",
-    "@pnpm/cli.utils": "1101.0.12",
+    "@pnpm/bins.remover": "1100.0.12",
+    "@pnpm/bins.linker": "1100.0.16",
     "@pnpm/bins.resolver": "1100.0.8",
-    "@pnpm/config.reader": "1101.10.0",
-    "@pnpm/error": "1100.0.0",
-    "@pnpm/types": "1101.3.2",
-    "@pnpm/store.connection-manager": "1100.3.1",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/cli.utils": "1101.0.13",
     "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/installing.deps-installer": "1102.1.0",
-    "@pnpm/deps.inspection.list": "1100.0.19",
-    "@pnpm/global.packages": "1100.0.8",
-    "@pnpm/core-loggers": "1100.2.1"
+    "@pnpm/config.reader": "1101.11.0",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/global.packages": "1100.0.10",
+    "@pnpm/deps.inspection.list": "1100.0.21",
+    "@pnpm/installing.deps-installer": "1102.2.0",
+    "@pnpm/store.connection-manager": "1100.3.3",
+    "@pnpm/pkg-manifest.reader": "1100.0.9",
+    "@pnpm/types": "1101.3.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/global.commands": "1100.0.29"
+    "@pnpm/global.commands": "1100.0.31"
   },
   "engines": {
     "node": ">=22.13"