@venn-lang/cli 0.1.1 → 0.1.3

package/dist/cli.mjs

@@ -1454,11 +1454,27 @@ function readBare(cur) {
 	const num = Number(raw);
 	return raw !== "" && !Number.isNaN(num) ? num : raw;
 }
+/**
+* An empty table for a manifest to fill.
+*
+* Made without a prototype, so a key read from the file is a key and nothing
+* else. Assigning `__proto__` onto an ordinary object changes how every object
+* in the process behaves, and a manifest arrives with somebody else's project:
+* a `venn.toml` holding `[package.__proto__]` was enough to put a property on
+* `Object.prototype`.
+*
+* Refusing that one name would have closed that one door. Having no prototype
+* to reach removes the question, and the table is read with `Object.keys` and
+* `Object.entries`, which do not care that it has none.
+*/
+function emptyTable() {
+	return Object.create(null);
+}
 /** The table `[path]` names, created along the way if it is not there yet. */
 function enterSection(root, path) {
 	let node = root;
 	for (const key of keysOf$1(path)) {
-		node[key] ??= {};
+		node[key] ??= emptyTable();
 		node = node[key];
 	}
 	return node;
@@ -1476,7 +1492,7 @@ function enterTableArray(root, path) {
 	const parent = enterSection(root, keys.join("."));
 	const found = Array.isArray(parent[last]) ? parent[last] : [];
 	parent[last] = found;
-	const table = {};
+	const table = emptyTable();
 	found.push(table);
 	return table;
 }
@@ -1494,7 +1510,7 @@ function keysOf$1(path) {
 * @returns the root table. Malformed lines are skipped, never thrown on.
 */
 function parseToml(content) {
-	const root = {};
+	const root = emptyTable();
 	let section = root;
 	for (const raw of content.split(/\r?\n/)) {
 		const line = stripComment(raw).trim();
@@ -1627,7 +1643,7 @@ function join$2(...parts) {
 * directory it was written against; stopping short of it would leave a walk up
 * from `packages/api` never reaching the workspace root beside it.
 */
-function parentOf(path) {
+function parentOf$1(path) {
 	const flat = normalise$1(path);
 	if (flat === "" || flat === "/") return void 0;
 	const slash = flat.lastIndexOf("/");
@@ -1642,7 +1658,7 @@ function parentOf(path) {
 */
 function ancestors(path) {
 	const found = [];
-	for (let at = normalise$1(path); at !== void 0; at = parentOf(at)) found.push(at);
+	for (let at = normalise$1(path); at !== void 0; at = parentOf$1(at)) found.push(at);
 	return found;
 }
 /** Whether `path` is `base` or sits inside it. */
@@ -55669,9 +55685,12 @@ function crashed(error) {
 //#region src/upgrade/install-site.ts
 /**
 * Where each manager keeps what it installed for the user rather than for a
-* project. A copy sitting under one of these is global wherever it was invoked
-* from, which matters because several of them live under the home directory:
-* running from `~` would otherwise make a global install look like a local one.
+* project. A copy under one of these is global wherever it was invoked from,
+* which matters because several live under the home directory: running from `~`
+* would otherwise make a global install look like a project's.
+*
+* The list cannot be complete on its own, since npm follows wherever a version
+* manager puts node. {@link isBesideNode} covers what it cannot name.
 */
 const GLOBAL_ROOTS = [
 	"/pnpm/global/",
@@ -55689,13 +55708,11 @@ const GLOBAL_ROOTS = [
 * running, and is empty when the binary is invoked directly, which is every
 * time anyone actually uses it.
 *
-* Each manager keeps its global root somewhere unmistakable, so the path is
-* enough to tell them apart on all three operating systems.
-*
 * @param path Where the running CLI lives. Must be a plain path: pass
 * `fileURLToPath(import.meta.url)`, since a `file:///` URL would be read as
 * living outside every project.
 * @param cwd The directory the user invoked it from.
+* @param nodePath The node binary running this, from `process.execPath`.
 * @returns The manager and whether the install is global, or `unknown` when the
 * path matches nothing recognisable.
 */
@@ -55708,7 +55725,11 @@ function installSiteOf(args) {
 	};
 	return {
 		manager,
-		global: isGlobal(path, normalise(args.cwd))
+		global: isGlobal({
+			path,
+			cwd: normalise(args.cwd),
+			node: normalise(args.nodePath)
+		})
 	};
 }
 function normalise(path) {
@@ -55722,19 +55743,38 @@ function managerOf(path) {
 }
 /**
 * A copy under the working directory belongs to that project, not to the user,
-* unless it sits in a global root that happens to be an ancestor of it.
+* unless it sits somewhere only a global install can be.
 *
 * Upgrading a copy the project owns would move a version its manifest still
 * pins, so the next install would put the old one back and the user would be
 * left wondering which of the two is running.
 */
-function isGlobal(path, cwd) {
-	if (isGlobalRoot(path)) return true;
-	return !path.startsWith(`${cwd}/`);
+function isGlobal(args) {
+	if (GLOBAL_ROOTS.some((root) => args.path.includes(root))) return true;
+	if (args.path.includes("/yarn/") && args.path.includes("/global/")) return true;
+	if (isBesideNode(args.path, args.node)) return true;
+	return !args.path.startsWith(`${args.cwd}/`);
 }
-function isGlobalRoot(path) {
-	if (GLOBAL_ROOTS.some((root) => path.includes(root))) return true;
-	return path.includes("/yarn/") && path.includes("/global/");
+/**
+* npm keeps its global packages beside the node binary: alongside it on
+* Windows, under a sibling `lib` elsewhere.
+*
+* Asked of node rather than matched against a list of directory names, because
+* a version manager puts node wherever it likes and the global root follows it
+* there. `C:\nvm4w\nodejs` is a link to `AppData\Local\nvm\v24.17.0`, which
+* node resolves before anything here sees it, and no list would have had that
+* name in it. The upgrade then read every global install as a project's and
+* refused to touch it.
+*/
+function isBesideNode(path, node) {
+	const directory = parentOf(node);
+	if (directory === "") return false;
+	if (path.startsWith(`${directory}/node_modules/`)) return true;
+	return path.startsWith(`${parentOf(directory)}/lib/node_modules/`);
+}
+function parentOf(path) {
+	const at = path.lastIndexOf("/");
+	return at === -1 ? "" : path.slice(0, at);
 }
 //#endregion
 //#region src/upgrade/upgrade-plan.ts
@@ -55895,7 +55935,8 @@ async function upgradeCommand(args) {
 function currentSite() {
 	return installSiteOf({
 		path: fileURLToPath(import.meta.url),
-		cwd: process.cwd()
+		cwd: process.cwd(),
+		nodePath: process.execPath
 	});
 }
 function fail(message) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venn-lang/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "The venn binary: one command for starting, checking, running and testing a Venn project.",
   "keywords": [
     "venn",
@@ -41,17 +41,17 @@
   },
   "dependencies": {
     "citty": "^0.2.2",
-    "@venn-lang/assert": "0.1.1",
-    "@venn-lang/contracts": "0.1.1",
-    "@venn-lang/core": "0.1.1",
-    "@venn-lang/dts": "0.1.1",
-    "@venn-lang/http": "0.1.1",
-    "@venn-lang/io": "0.1.1",
-    "@venn-lang/project": "0.1.1",
-    "@venn-lang/runtime": "0.1.1",
-    "@venn-lang/sdk": "0.1.1",
-    "@venn-lang/stdlib": "0.1.1",
-    "@venn-lang/types": "0.1.1"
+    "@venn-lang/assert": "0.1.3",
+    "@venn-lang/contracts": "0.1.3",
+    "@venn-lang/dts": "0.1.3",
+    "@venn-lang/core": "0.1.3",
+    "@venn-lang/http": "0.1.3",
+    "@venn-lang/project": "0.1.3",
+    "@venn-lang/runtime": "0.1.3",
+    "@venn-lang/sdk": "0.1.3",
+    "@venn-lang/stdlib": "0.1.3",
+    "@venn-lang/types": "0.1.3",
+    "@venn-lang/io": "0.1.3"
   },
   "devDependencies": {
     "@types/node": "^24",

package/src/commands/upgrade.ts

@@ -40,7 +40,11 @@ export async function upgradeCommand(args: {
  * every install inside a project look global.
  */
 function currentSite(): InstallSite {
-  return installSiteOf({ path: fileURLToPath(import.meta.url), cwd: process.cwd() });
+  return installSiteOf({
+    path: fileURLToPath(import.meta.url),
+    cwd: process.cwd(),
+    nodePath: process.execPath,
+  });
 }
 
 function fail(message: string): number {

package/src/upgrade/install-site.ts

@@ -2,9 +2,12 @@ import type { InstallSite, PackageManager } from "./upgrade.types.js";
 
 /**
  * Where each manager keeps what it installed for the user rather than for a
- * project. A copy sitting under one of these is global wherever it was invoked
- * from, which matters because several of them live under the home directory:
- * running from `~` would otherwise make a global install look like a local one.
+ * project. A copy under one of these is global wherever it was invoked from,
+ * which matters because several live under the home directory: running from `~`
+ * would otherwise make a global install look like a project's.
+ *
+ * The list cannot be complete on its own, since npm follows wherever a version
+ * manager puts node. {@link isBesideNode} covers what it cannot name.
  */
 const GLOBAL_ROOTS: readonly string[] = [
   "/pnpm/global/",
@@ -23,21 +26,21 @@ const GLOBAL_ROOTS: readonly string[] = [
  * running, and is empty when the binary is invoked directly, which is every
  * time anyone actually uses it.
  *
- * Each manager keeps its global root somewhere unmistakable, so the path is
- * enough to tell them apart on all three operating systems.
- *
  * @param path Where the running CLI lives. Must be a plain path: pass
  * `fileURLToPath(import.meta.url)`, since a `file:///` URL would be read as
  * living outside every project.
  * @param cwd The directory the user invoked it from.
+ * @param nodePath The node binary running this, from `process.execPath`.
  * @returns The manager and whether the install is global, or `unknown` when the
  * path matches nothing recognisable.
  */
-export function installSiteOf(args: { path: string; cwd: string }): InstallSite {
+export function installSiteOf(args: { path: string; cwd: string; nodePath: string }): InstallSite {
   const path = normalise(args.path);
   const manager = managerOf(path);
   if (!manager) return { manager: "unknown", global: false };
-  return { manager, global: isGlobal(path, normalise(args.cwd)) };
+  const cwd = normalise(args.cwd);
+  const node = normalise(args.nodePath);
+  return { manager, global: isGlobal({ path, cwd, node }) };
 }
 
 function normalise(path: string): string {
@@ -53,18 +56,38 @@ function managerOf(path: string): PackageManager | undefined {
 
 /**
  * A copy under the working directory belongs to that project, not to the user,
- * unless it sits in a global root that happens to be an ancestor of it.
+ * unless it sits somewhere only a global install can be.
  *
  * Upgrading a copy the project owns would move a version its manifest still
  * pins, so the next install would put the old one back and the user would be
  * left wondering which of the two is running.
  */
-function isGlobal(path: string, cwd: string): boolean {
-  if (isGlobalRoot(path)) return true;
-  return !path.startsWith(`${cwd}/`);
+function isGlobal(args: { path: string; cwd: string; node: string }): boolean {
+  if (GLOBAL_ROOTS.some((root) => args.path.includes(root))) return true;
+  if (args.path.includes("/yarn/") && args.path.includes("/global/")) return true;
+  if (isBesideNode(args.path, args.node)) return true;
+  return !args.path.startsWith(`${args.cwd}/`);
+}
+
+/**
+ * npm keeps its global packages beside the node binary: alongside it on
+ * Windows, under a sibling `lib` elsewhere.
+ *
+ * Asked of node rather than matched against a list of directory names, because
+ * a version manager puts node wherever it likes and the global root follows it
+ * there. `C:\nvm4w\nodejs` is a link to `AppData\Local\nvm\v24.17.0`, which
+ * node resolves before anything here sees it, and no list would have had that
+ * name in it. The upgrade then read every global install as a project's and
+ * refused to touch it.
+ */
+function isBesideNode(path: string, node: string): boolean {
+  const directory = parentOf(node);
+  if (directory === "") return false;
+  if (path.startsWith(`${directory}/node_modules/`)) return true;
+  return path.startsWith(`${parentOf(directory)}/lib/node_modules/`);
 }
 
-function isGlobalRoot(path: string): boolean {
-  if (GLOBAL_ROOTS.some((root) => path.includes(root))) return true;
-  return path.includes("/yarn/") && path.includes("/global/");
+function parentOf(path: string): string {
+  const at = path.lastIndexOf("/");
+  return at === -1 ? "" : path.slice(0, at);
 }