@whobot/cli 2.0.3 → 2.0.4

package/bin/install.mjs

@@ -226,7 +226,38 @@ export async function runPostinstall(env) {
   }
 }
 
-export function whichCommand(name, env, ignoreRealpath = "") {
+// npxLauncherIgnore names the command entries of the npx copy at root, which
+// npx puts first on PATH. POSIX npm links them to run.mjs; Windows npm writes
+// cmd-shim files into the same node_modules/.bin, so a realpath alone cannot
+// recognize them. Outside an npx copy nothing is ignored.
+export function npxLauncherIgnore(root) {
+  if (!isNpxPath(root)) {
+    return {};
+  }
+  const ignore = { realpath: realpathSync(path.join(root, "bin", "run.mjs")) };
+  let modules = root;
+  while (path.basename(modules) !== "node_modules") {
+    const parent = path.dirname(modules);
+    if (parent === modules) {
+      return ignore;
+    }
+    modules = parent;
+  }
+  const binDir = path.join(modules, ".bin");
+  try {
+    ignore.binDir = realpathSync(binDir);
+  } catch {
+    // No .bin directory: no PATH entry can be inside it.
+    ignore.binDir = binDir;
+  }
+  return ignore;
+}
+
+function samePath(a, b) {
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+export function whichCommand(name, env, ignore = {}) {
   const pathEnv = env.PATH || env.Path || "";
   const exts = process.platform === "win32" ? [".cmd", ".exe", ".bat", ""] : [""];
   for (const dir of pathEnv.split(path.delimiter)) {
@@ -237,7 +268,8 @@ export function whichCommand(name, env, ignoreRealpath = "") {
       const candidate = path.join(dir, name + ext);
       try {
         accessSync(candidate, constants.X_OK);
-        if (ignoreRealpath && realpathSync(candidate) === ignoreRealpath) continue;
+        if (ignore.realpath && realpathSync(candidate) === ignore.realpath) continue;
+        if (ignore.binDir && samePath(realpathSync(dir), ignore.binDir)) continue;
         return candidate;
       } catch {
         // try next
@@ -625,7 +657,7 @@ async function repairAndVerifyNative(native, version, env) {
   }
 }
 
-export async function verifyInstalledCLI(tools, npmEnv, prefix, version, env, ignoreLauncher = "") {
+export async function verifyInstalledCLI(tools, npmEnv, prefix, version, env, ignoreLauncher = {}) {
   const registered = readGlobalPackageVersion(tools, npmEnv);
   if (registered !== version) {
     throw new InstallerError(`npm registered version ${registered} does not match ${version}`, "UPDATE_VERIFY_FAILED");
@@ -696,7 +728,7 @@ export async function runExplicitInstall(argv, env) {
       npmInstallGlobalFrom(tools, pkgRoot, npmEnv);
     }
     // Ignore this npx cache launcher only, not other stale host PATH entries.
-    const ignoreLauncher = isNpxPath(pkgRoot) ? realpathSync(path.join(pkgRoot, "bin", "run.mjs")) : "";
+    const ignoreLauncher = npxLauncherIgnore(pkgRoot);
     const installed = await verifyInstalledCLI(tools, npmEnv, prefix, pkg.version, env, ignoreLauncher);
     runInstallPhase(installed.native, updateArgs, env, "verify", registered);
     await prepared.discard();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whobot/cli",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Whobot CLI: npm-managed JS launcher that runs the in-package Go binary.",
   "type": "module",
   "bin": {