@vantaloom/cli 0.3.4 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/cli",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "private": false,
   "type": "module",
   "description": "Vantaloom local runtime manager.",

package/src/cli.mjs

@@ -292,7 +292,10 @@ async function applyPackage(packageRoot, prefix, options) {
 async function syncFromNpmRegistry(options, action) {
   const prefix = safeDirectory(options.prefix ?? defaultPrefix())
   const installedConfig = readInstalledConfig(prefix)
-  const runtimePackage = options.runtimePackage || installedConfig.runtimePackage || runtimePackageName(platformId())
+  // Always derive runtimePackage from current platform — never trust stale config
+  // from a different platform (e.g. win32 config baked into a darwin package).
+  // Only explicit --runtime-package flag can override.
+  const runtimePackage = options.runtimePackage || runtimePackageName(platformId())
   const runtimeVersion = options.runtimeVersion || installedConfig.runtimeVersion || "latest"
   const explicitRegistry = options.npmRegistry || installedConfig.npmRegistry
   const registry = normalizeRegistry(explicitRegistry || detectNpmRegistry() || defaultNpmRegistry)
@@ -634,9 +637,9 @@ function mergeRuntimeConfig(packageConfig, existingConfig, overrides) {
   if (!merged.releaseTag) {
     merged.releaseTag = defaultReleaseTag
   }
-  if (!merged.runtimePackage) {
-    merged.runtimePackage = runtimePackageName(platformId())
-  }
+  // Always force runtimePackage to match the running platform — a cross-compiled
+  // package may carry a config for a different platform (e.g. win32 inside darwin).
+  merged.runtimePackage = runtimePackageName(platformId())
   if (!merged.runtimeVersion) {
     merged.runtimeVersion = "latest"
   }