balladeer 0.0.3 → 0.0.4

package/bin/balladeer.js

@@ -10,7 +10,7 @@
  * Flags: --yes/-y skip the prompt; --download-only fetch + verify, print the path.
  */
 const { createHash } = require("node:crypto");
-const { mkdtempSync, writeFileSync, rmSync } = require("node:fs");
+const { existsSync, mkdtempSync, writeFileSync, rmSync } = require("node:fs");
 const { tmpdir } = require("node:os");
 const { join } = require("node:path");
 const { spawnSync } = require("node:child_process");
@@ -82,9 +82,16 @@ async function main() {
     return;
   }
 
+  // Volta prepends its real-node bin dir to a child tool's PATH, so a bare `npm` spawned from
+  // here resolves to the RAW npm inside the node image and installs into that image's globals,
+  // while the `balladeer` on the user's PATH stays Volta's shim serving THIS bootstrapper — a
+  // split-brain where every run is the installer again. Route the install through Volta's own
+  // npm shim so its interception updates the package image the shim actually serves.
+  const voltaNpm = process.env.VOLTA_HOME ? join(process.env.VOLTA_HOME, "bin", "npm") : null;
+  const npmCmd = voltaNpm && existsSync(voltaNpm) ? voltaNpm : "npm";
   // --ignore-scripts: the client has no install hooks, and this keeps a hostile tarball from
   // running code at install time (the same flag the script installer passes).
-  const r = spawnSync("npm", ["install", "-g", "--ignore-scripts", file], {
+  const r = spawnSync(npmCmd, ["install", "-g", "--ignore-scripts", file], {
     stdio: "inherit",
     shell: process.platform === "win32",
   });
@@ -95,6 +102,19 @@ async function main() {
     fail(`error: npm install -g failed (exit ${r.status ?? "?"}). Fix the npm error above and re-run \`balladeer\`.`, r.status ?? 1);
   }
 
+  // Never report success on npm's exit code alone: prove the world changed. If `balladeer` still
+  // resolves to this installer (or to nothing), say so honestly instead of claiming victory.
+  const probe = spawnSync("balladeer", ["--version"], { encoding: "utf8", shell: process.platform === "win32" });
+  const probedVersion = (probe.stdout ?? "").trim();
+  if (probe.status !== 0 || !/^\d+\.\d+\.\d+/.test(probedVersion)) {
+    fail(
+      `error: npm reported success, but \`balladeer\` on your PATH is not the client yet.\n` +
+        `Your npm setup may install globals somewhere this shell does not look, or a version\n` +
+        `manager may be serving a stale copy. Try a fresh shell and \`balladeer --version\`,\n` +
+        `or use the script installer:\n\n  curl -fsSL ${BASE} | sh\n`,
+    );
+  }
+
   // Plain `balladeer login` (the client defaults to hosted central). BASE is the INSTALL host
   // (get.balladeer.ai), an alias that exists only for downloading — teaching it as --server
   // would store it as the machine's permanent server URL. A custom BALLADEER_INSTALL_BASE
@@ -105,7 +125,7 @@ async function main() {
       ? "balladeer login"
       : "balladeer login --server <your central server URL>";
   console.error(
-    `\n✓ Balladeer client installed.\n\n` +
+    `\n✓ Balladeer client installed (${probedVersion}).\n\n` +
       `  next   ${pairHint}     # approve in your browser; no token to copy\n` +
       `  then   your coding agent gains get_context / consult / propose_decision\n` +
       `  agent  or let your agent finish the wiring: paste into it -> Read ${BASE}/agent and follow it.\n\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "balladeer",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "Installer for the Balladeer client (decision memory for engineering teams and their AI agents): downloads the sha256-verified client from get.balladeer.ai and installs it globally.",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://balladeer.ai",