@pnpm/global.commands 1100.0.30 → 1100.0.32

package/lib/binOwnership.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The set of bin names provided by global package groups *other* than those
+ * in `excludeHashes`.
+ *
+ * Used before unlinking a group's bins (on remove / update / replace) so
+ * that a bin name shared with — and owned by — another still-installed
+ * group is never removed. Without this, removing one group could delete a
+ * bin that actually belongs to a different global package.
+ */
+export declare function getBinNamesOfOtherGroups(globalDir: string, excludeHashes: Set<string>): Promise<Set<string>>;

package/lib/binOwnership.js

@@ -0,0 +1,21 @@
+import { getInstalledBinNames, scanGlobalPackages } from '@pnpm/global.packages';
+/**
+ * The set of bin names provided by global package groups *other* than those
+ * in `excludeHashes`.
+ *
+ * Used before unlinking a group's bins (on remove / update / replace) so
+ * that a bin name shared with — and owned by — another still-installed
+ * group is never removed. Without this, removing one group could delete a
+ * bin that actually belongs to a different global package.
+ */
+export async function getBinNamesOfOtherGroups(globalDir, excludeHashes) {
+    const others = scanGlobalPackages(globalDir).filter((pkg) => !excludeHashes.has(pkg.hash));
+    const names = new Set();
+    await Promise.all(others.map(async (pkg) => {
+        for (const name of await getInstalledBinNames(pkg)) {
+            names.add(name);
+        }
+    }));
+    return names;
+}
+//# sourceMappingURL=binOwnership.js.map

package/lib/checkGlobalBinConflicts.js

@@ -28,7 +28,7 @@ export async function checkGlobalBinConflicts(opts) {
     if (newBinOwners.size === 0)
         return binsToSkip;
     // Quick check: only investigate if a bin with the same name already exists
-    const conflicting = new Set([...newBinOwners.keys()].filter((name) => fs.existsSync(path.join(opts.globalBinDir, name))));
+    const conflicting = new Set([...newBinOwners.keys()].filter((name) => binSlotExists(opts.globalBinDir, name)));
     if (conflicting.size === 0)
         return binsToSkip;
     // Some bins already exist — find out if they belong to packages being replaced
@@ -72,4 +72,14 @@ export async function checkGlobalBinConflicts(opts) {
     }
     return binsToSkip;
 }
+// Whether a bin named `name` already occupies a slot in `globalBinDir`. On
+// Windows the `node` runtime bin is linked as `<name>.exe` (with no bare
+// `<name>` file), so that flavor is checked too — otherwise an existing
+// `node.exe` would not be detected as a conflict and could be silently
+// overwritten.
+function binSlotExists(globalBinDir, name) {
+    if (fs.existsSync(path.join(globalBinDir, name)))
+        return true;
+    return process.platform === 'win32' && fs.existsSync(path.join(globalBinDir, `${name}.exe`));
+}
 //# sourceMappingURL=checkGlobalBinConflicts.js.map

package/lib/globalAdd.d.ts

@@ -1,4 +1,5 @@
 import type { CommandHandlerMap } from '@pnpm/cli.command';
+import { type GlobalPackageInfo } from '@pnpm/global.packages';
 import type { CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import { type ResolutionPolicyViolation } from './installGlobalPackages.js';
 export type GlobalAddOptions = CreateStoreControllerOptions & {
@@ -17,3 +18,5 @@ export type GlobalAddOptions = CreateStoreControllerOptions & {
     updateResolutionPolicyManifest?: (violations: readonly ResolutionPolicyViolation[], dir: string) => Promise<void>;
 };
 export declare function handleGlobalAdd(opts: GlobalAddOptions, params: string[], commands: CommandHandlerMap): Promise<void>;
+export declare function getReplacementAliases(aliases: string[]): string[];
+export declare function shouldReplaceExistingGlobalInstall(pkg: GlobalPackageInfo, aliases: string[], replacementAliases: string[]): boolean;

package/lib/globalAdd.js

@@ -7,6 +7,7 @@ import { cleanOrphanedInstallDirs, createGlobalCacheKey, createInstallDir, findG
 import { readPackageJsonFromDirRawSync } from '@pnpm/pkg-manifest.reader';
 import { isSubdir } from 'is-subdir';
 import { symlinkDir } from 'symlink-dir';
+import { getBinNamesOfOtherGroups } from './binOwnership.js';
 import { checkGlobalBinConflicts } from './checkGlobalBinConflicts.js';
 import { installGlobalPackages } from './installGlobalPackages.js';
 import { promptApproveGlobalBuilds } from './promptApproveGlobalBuilds.js';
@@ -87,6 +88,7 @@ async function installGroup(ctx, commands) {
     // Read resolved aliases from the installed package.json
     const pkgJson = readPackageJsonFromDirRawSync(installDir);
     const aliases = Object.keys(pkgJson.dependencies ?? {});
+    const replacementAliases = getReplacementAliases(aliases);
     // Check for bin name conflicts with other global packages
     // (must happen before removeExistingGlobalInstalls so we don't lose existing packages on failure)
     const pkgs = await readInstalledPackages(installDir);
@@ -96,7 +98,7 @@ async function installGroup(ctx, commands) {
             globalDir,
             globalBinDir,
             newPkgs: pkgs,
-            shouldSkip: (pkg) => aliases.some((alias) => alias in pkg.dependencies),
+            shouldSkip: (pkg) => shouldReplaceExistingGlobalInstall(pkg, aliases, replacementAliases),
         });
     }
     catch (err) {
@@ -104,7 +106,7 @@ async function installGroup(ctx, commands) {
         throw err;
     }
     // Remove any existing global installations of these aliases
-    await removeExistingGlobalInstalls(globalDir, globalBinDir, aliases);
+    await removeExistingGlobalInstalls({ globalDir, globalBinDir, aliases, replacementAliases });
     // Compute cache key and create hash symlink pointing to install dir
     const cacheHash = createGlobalCacheKey({
         aliases,
@@ -116,6 +118,21 @@ async function installGroup(ctx, commands) {
     await linkBinsOfPackages(pkgs, globalBinDir, { excludeBins: binsToSkip });
     await opts.updateResolutionPolicyManifest?.(resolutionPolicyViolations, globalDir);
 }
+const PNPM_CLI_PACKAGE_ALIASES = ['pnpm', '@pnpm/exe'];
+export function getReplacementAliases(aliases) {
+    if (!aliases.some((alias) => PNPM_CLI_PACKAGE_ALIASES.includes(alias)))
+        return aliases;
+    return [...new Set([...aliases, ...PNPM_CLI_PACKAGE_ALIASES])];
+}
+export function shouldReplaceExistingGlobalInstall(pkg, aliases, replacementAliases) {
+    if (aliases.some((alias) => alias in pkg.dependencies))
+        return true;
+    return isPnpmCliOnlyGroup(pkg) && replacementAliases.some((alias) => alias in pkg.dependencies);
+}
+function isPnpmCliOnlyGroup(pkg) {
+    const aliases = Object.keys(pkg.dependencies);
+    return aliases.length > 0 && aliases.every((alias) => PNPM_CLI_PACKAGE_ALIASES.includes(alias));
+}
 function splitCommaSeparated(param, baseDir) {
     if (!param.includes(','))
         return [param];
@@ -172,19 +189,27 @@ function resolveLocalParam(param, baseDir) {
     }
     return param;
 }
-async function removeExistingGlobalInstalls(globalDir, globalBinDir, aliases) {
+async function removeExistingGlobalInstalls(opts) {
+    const { globalDir, globalBinDir, aliases, replacementAliases } = opts;
     // Collect unique groups to remove (dedup by hash)
     const groupsToRemove = new Map();
-    for (const alias of aliases) {
+    for (const alias of replacementAliases) {
         const existing = findGlobalPackage(globalDir, alias);
-        if (existing && !groupsToRemove.has(existing.hash)) {
+        if (existing &&
+            shouldReplaceExistingGlobalInstall(existing, aliases, replacementAliases) &&
+            !groupsToRemove.has(existing.hash)) {
             groupsToRemove.set(existing.hash, getInstalledBinNames(existing));
         }
     }
+    // Bins owned by groups that survive this replacement must not be
+    // unlinked, or we'd delete a different global package's bin.
+    const protectedBins = await getBinNamesOfOtherGroups(globalDir, new Set(groupsToRemove.keys()));
     // Remove all groups in parallel
     await Promise.all([...groupsToRemove.entries()].map(async ([hash, binNamesPromise]) => {
         const binNames = await binNamesPromise;
-        await Promise.all(binNames.map((binName) => removeBin(path.join(globalBinDir, binName))));
+        await Promise.all(binNames
+            .filter((binName) => !protectedBins.has(binName))
+            .map((binName) => removeBin(path.join(globalBinDir, binName))));
         // Remove both the hash symlink and the install dir it points to
         const hashLink = getHashLink(globalDir, hash);
         let installDir = null;

package/lib/globalRemove.js

@@ -4,6 +4,7 @@ import { removeBin } from '@pnpm/bins.remover';
 import { PnpmError } from '@pnpm/error';
 import { findGlobalPackage, getHashLink, getInstalledBinNames, } from '@pnpm/global.packages';
 import { isSubdir } from 'is-subdir';
+import { getBinNamesOfOtherGroups } from './binOwnership.js';
 export async function handleGlobalRemove(opts, params) {
     const globalDir = opts.globalPkgDir;
     const globalBinDir = opts.bin;
@@ -16,10 +17,15 @@ export async function handleGlobalRemove(opts, params) {
         }
         groupsToRemove.set(pkg.hash, pkg);
     }
+    // Bins shared with (and owned by) groups that survive this removal must
+    // not be unlinked, or we'd delete another global package's bin.
+    const protectedBins = await getBinNamesOfOtherGroups(globalDir, new Set(groupsToRemove.keys()));
     // Remove bins, hash symlinks, and install dirs for all affected groups in parallel
     await Promise.all([...groupsToRemove.entries()].map(async ([hash, pkg]) => {
         const binNames = await getInstalledBinNames(pkg);
-        await Promise.all(binNames.map((binName) => removeBin(path.join(globalBinDir, binName))));
+        await Promise.all(binNames
+            .filter((binName) => !protectedBins.has(binName))
+            .map((binName) => removeBin(path.join(globalBinDir, binName))));
         await fs.promises.rm(getHashLink(globalDir, hash), { force: true });
         if (isSubdir(globalDir, pkg.installDir)) {
             await fs.promises.rm(pkg.installDir, { recursive: true, force: true });

package/lib/globalUpdate.js

@@ -6,6 +6,7 @@ import { summaryLogger } from '@pnpm/core-loggers';
 import { cleanOrphanedInstallDirs, createInstallDir, getHashLink, getInstalledBinNames, scanGlobalPackages, } from '@pnpm/global.packages';
 import { isSubdir } from 'is-subdir';
 import { symlinkDir } from 'symlink-dir';
+import { getBinNamesOfOtherGroups } from './binOwnership.js';
 import { checkGlobalBinConflicts } from './checkGlobalBinConflicts.js';
 import { installGlobalPackages } from './installGlobalPackages.js';
 import { promptApproveGlobalBuilds } from './promptApproveGlobalBuilds.js';
@@ -91,9 +92,13 @@ async function updateGlobalPackageGroup(opts, globalDir, globalBinDir, pkg, comm
         await fs.promises.rm(installDir, { recursive: true, force: true });
         throw err;
     }
-    // Remove stale bins from old installation before swapping
+    // Remove stale bins from old installation before swapping, but keep any
+    // bin owned by a different global group (don't delete another package's bin).
+    const protectedBins = await getBinNamesOfOtherGroups(globalDir, new Set([pkg.hash]));
     const oldBinNames = await getInstalledBinNames(pkg);
-    await Promise.all(oldBinNames.map((binName) => removeBin(path.join(globalBinDir, binName))));
+    await Promise.all(oldBinNames
+        .filter((binName) => !protectedBins.has(binName))
+        .map((binName) => removeBin(path.join(globalBinDir, binName))));
     // Swap hash symlink to new install dir, then clean up old one
     const hashLink = getHashLink(globalDir, pkg.hash);
     const oldInstallDir = pkg.installDir;

package/lib/readInstalledPackages.js

@@ -1,8 +1,9 @@
 import path from 'node:path';
+import { isValidGlobalDependencyAlias } from '@pnpm/global.packages';
 import { readPackageJsonFromDir, readPackageJsonFromDirRawSync } from '@pnpm/pkg-manifest.reader';
 export async function readInstalledPackages(installDir) {
     const pkgJson = readPackageJsonFromDirRawSync(installDir);
-    const depNames = Object.keys(pkgJson.dependencies ?? {});
+    const depNames = Object.keys(pkgJson.dependencies ?? {}).filter(isValidGlobalDependencyAlias);
     const manifests = await Promise.all(depNames.map((depName) => readPackageJsonFromDir(path.join(installDir, 'node_modules', depName))));
     return depNames.map((depName, i) => ({
         manifest: manifests[i],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/global.commands",
-  "version": "1100.0.30",
+  "version": "1100.0.32",
   "description": "Global package command handlers for pnpm",
   "keywords": [
     "pnpm",
@@ -32,24 +32,24 @@
     "is-subdir": "^2.0.0",
     "symlink-dir": "^10.0.1",
     "@pnpm/bins.linker": "1100.0.16",
+    "@pnpm/bins.remover": "1100.0.12",
     "@pnpm/cli.command": "1100.0.1",
-    "@pnpm/bins.resolver": "1100.0.8",
-    "@pnpm/cli.utils": "1101.0.13",
-    "@pnpm/config.matcher": "1100.0.1",
-    "@pnpm/bins.remover": "1100.0.11",
+    "@pnpm/config.reader": "1101.11.1",
     "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/config.reader": "1101.10.1",
+    "@pnpm/deps.inspection.list": "1100.0.22",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/global.packages": "1100.0.10",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/global.packages": "1100.0.9",
-    "@pnpm/installing.deps-installer": "1102.1.1",
-    "@pnpm/deps.inspection.list": "1100.0.20",
     "@pnpm/pkg-manifest.reader": "1100.0.9",
-    "@pnpm/store.connection-manager": "1100.3.2",
-    "@pnpm/types": "1101.3.2"
+    "@pnpm/cli.utils": "1101.0.13",
+    "@pnpm/installing.deps-installer": "1102.2.1",
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/store.connection-manager": "1100.3.4",
+    "@pnpm/bins.resolver": "1100.0.8"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/global.commands": "1100.0.30"
+    "@pnpm/global.commands": "1100.0.32"
   },
   "engines": {
     "node": ">=22.13"