balladeer 0.0.3 → 0.0.5

package/bin/balladeer.js

@@ -10,9 +10,9 @@
  * Flags: --yes/-y skip the prompt; --download-only fetch + verify, print the path.
  */
 const { createHash } = require("node:crypto");
-const { mkdtempSync, writeFileSync, rmSync } = require("node:fs");
+const { existsSync, mkdtempSync, writeFileSync, rmSync } = require("node:fs");
 const { tmpdir } = require("node:os");
-const { join } = require("node:path");
+const { join, sep } = require("node:path");
 const { spawnSync } = require("node:child_process");
 const readline = require("node:readline");
 
@@ -82,10 +82,34 @@ async function main() {
     return;
   }
 
+  // Volta, two traps (both hit live on a Volta machine): (1) it prepends its real-node bin dir
+  // to a child tool's PATH, so a bare `npm` here is the RAW npm that installs into the node
+  // image's globals — while the user's `balladeer` stays Volta's shim serving THIS bootstrapper
+  // (split-brain: every run is the installer again); (2) it stamps _VOLTA_TOOL_RECURSION into a
+  // shimmed tool's env, and the shim npm passes straight through to the raw npm when it sees it,
+  // so merely routing through $VOLTA_HOME/bin/npm changes nothing. Fix: spawn Volta's npm shim
+  // WITH the recursion guard scrubbed, so its global-install interception updates the package
+  // image the user's shim actually serves.
+  const childEnv = { ...process.env };
+  delete childEnv._VOLTA_TOOL_RECURSION;
+  // Volta detection cannot rely on env: inside a shimmed tool VOLTA_HOME is absent (the env
+  // carries only _VOLTA_TOOL_RECURSION). Our own node binary IS Volta's
+  // (<volta>/tools/image/node/<v>/bin/node), so derive the root from execPath, honoring
+  // VOLTA_HOME when it is set (custom install locations).
+  const voltaMarker = `${sep}.volta${sep}`;
+  const voltaRoot =
+    process.env.VOLTA_HOME ??
+    (process.execPath.includes(voltaMarker)
+      ? process.execPath.slice(0, process.execPath.indexOf(voltaMarker) + voltaMarker.length - 1)
+      : null);
+  const voltaBin = voltaRoot ? join(voltaRoot, "bin") : null;
+  const voltaNpm = voltaBin ? join(voltaBin, "npm") : null;
+  const npmCmd = voltaNpm && existsSync(voltaNpm) ? voltaNpm : "npm";
   // --ignore-scripts: the client has no install hooks, and this keeps a hostile tarball from
   // running code at install time (the same flag the script installer passes).
-  const r = spawnSync("npm", ["install", "-g", "--ignore-scripts", file], {
+  const r = spawnSync(npmCmd, ["install", "-g", "--ignore-scripts", file], {
     stdio: "inherit",
+    env: childEnv,
     shell: process.platform === "win32",
   });
   try {
@@ -95,6 +119,27 @@ async function main() {
     fail(`error: npm install -g failed (exit ${r.status ?? "?"}). Fix the npm error above and re-run \`balladeer\`.`, r.status ?? 1);
   }
 
+  // Never report success on npm's exit code alone: prove the world changed — AS THE USER'S SHELL
+  // SEES IT. Probe the Volta shim by absolute path when Volta is present (this process's PATH has
+  // Volta's image dirs prepended, so a bare probe can hit a copy the user's shell never resolves),
+  // with the recursion guard scrubbed so the shim re-resolves instead of echoing this bootstrapper.
+  const voltaShim = voltaBin ? join(voltaBin, "balladeer") : null;
+  const probeCmd = voltaShim && existsSync(voltaShim) ? voltaShim : "balladeer";
+  const probe = spawnSync(probeCmd, ["--version"], {
+    encoding: "utf8",
+    env: childEnv,
+    shell: process.platform === "win32",
+  });
+  const probedVersion = (probe.stdout ?? "").trim();
+  if (probe.status !== 0 || !/^\d+\.\d+\.\d+/.test(probedVersion)) {
+    fail(
+      `error: npm reported success, but \`balladeer\` on your PATH is not the client yet.\n` +
+        `Your npm setup may install globals somewhere this shell does not look, or a version\n` +
+        `manager may be serving a stale copy. Try a fresh shell and \`balladeer --version\`,\n` +
+        `or use the script installer:\n\n  curl -fsSL ${BASE} | sh\n`,
+    );
+  }
+
   // Plain `balladeer login` (the client defaults to hosted central). BASE is the INSTALL host
   // (get.balladeer.ai), an alias that exists only for downloading — teaching it as --server
   // would store it as the machine's permanent server URL. A custom BALLADEER_INSTALL_BASE
@@ -105,7 +150,7 @@ async function main() {
       ? "balladeer login"
       : "balladeer login --server <your central server URL>";
   console.error(
-    `\n✓ Balladeer client installed.\n\n` +
+    `\n✓ Balladeer client installed (${probedVersion}).\n\n` +
       `  next   ${pairHint}     # approve in your browser; no token to copy\n` +
       `  then   your coding agent gains get_context / consult / propose_decision\n` +
       `  agent  or let your agent finish the wiring: paste into it -> Read ${BASE}/agent and follow it.\n\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "balladeer",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Installer for the Balladeer client (decision memory for engineering teams and their AI agents): downloads the sha256-verified client from get.balladeer.ai and installs it globally.",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://balladeer.ai",