balladeer 0.0.4 → 0.0.5

package/bin/balladeer.js

@@ -12,7 +12,7 @@
 const { createHash } = require("node:crypto");
 const { existsSync, mkdtempSync, writeFileSync, rmSync } = require("node:fs");
 const { tmpdir } = require("node:os");
-const { join } = require("node:path");
+const { join, sep } = require("node:path");
 const { spawnSync } = require("node:child_process");
 const readline = require("node:readline");
 
@@ -82,17 +82,34 @@ async function main() {
     return;
   }
 
-  // Volta prepends its real-node bin dir to a child tool's PATH, so a bare `npm` spawned from
-  // here resolves to the RAW npm inside the node image and installs into that image's globals,
-  // while the `balladeer` on the user's PATH stays Volta's shim serving THIS bootstrapper — a
-  // split-brain where every run is the installer again. Route the install through Volta's own
-  // npm shim so its interception updates the package image the shim actually serves.
-  const voltaNpm = process.env.VOLTA_HOME ? join(process.env.VOLTA_HOME, "bin", "npm") : null;
+  // Volta, two traps (both hit live on a Volta machine): (1) it prepends its real-node bin dir
+  // to a child tool's PATH, so a bare `npm` here is the RAW npm that installs into the node
+  // image's globals — while the user's `balladeer` stays Volta's shim serving THIS bootstrapper
+  // (split-brain: every run is the installer again); (2) it stamps _VOLTA_TOOL_RECURSION into a
+  // shimmed tool's env, and the shim npm passes straight through to the raw npm when it sees it,
+  // so merely routing through $VOLTA_HOME/bin/npm changes nothing. Fix: spawn Volta's npm shim
+  // WITH the recursion guard scrubbed, so its global-install interception updates the package
+  // image the user's shim actually serves.
+  const childEnv = { ...process.env };
+  delete childEnv._VOLTA_TOOL_RECURSION;
+  // Volta detection cannot rely on env: inside a shimmed tool VOLTA_HOME is absent (the env
+  // carries only _VOLTA_TOOL_RECURSION). Our own node binary IS Volta's
+  // (<volta>/tools/image/node/<v>/bin/node), so derive the root from execPath, honoring
+  // VOLTA_HOME when it is set (custom install locations).
+  const voltaMarker = `${sep}.volta${sep}`;
+  const voltaRoot =
+    process.env.VOLTA_HOME ??
+    (process.execPath.includes(voltaMarker)
+      ? process.execPath.slice(0, process.execPath.indexOf(voltaMarker) + voltaMarker.length - 1)
+      : null);
+  const voltaBin = voltaRoot ? join(voltaRoot, "bin") : null;
+  const voltaNpm = voltaBin ? join(voltaBin, "npm") : null;
   const npmCmd = voltaNpm && existsSync(voltaNpm) ? voltaNpm : "npm";
   // --ignore-scripts: the client has no install hooks, and this keeps a hostile tarball from
   // running code at install time (the same flag the script installer passes).
   const r = spawnSync(npmCmd, ["install", "-g", "--ignore-scripts", file], {
     stdio: "inherit",
+    env: childEnv,
     shell: process.platform === "win32",
   });
   try {
@@ -102,9 +119,17 @@ async function main() {
     fail(`error: npm install -g failed (exit ${r.status ?? "?"}). Fix the npm error above and re-run \`balladeer\`.`, r.status ?? 1);
   }
 
-  // Never report success on npm's exit code alone: prove the world changed. If `balladeer` still
-  // resolves to this installer (or to nothing), say so honestly instead of claiming victory.
-  const probe = spawnSync("balladeer", ["--version"], { encoding: "utf8", shell: process.platform === "win32" });
+  // Never report success on npm's exit code alone: prove the world changed — AS THE USER'S SHELL
+  // SEES IT. Probe the Volta shim by absolute path when Volta is present (this process's PATH has
+  // Volta's image dirs prepended, so a bare probe can hit a copy the user's shell never resolves),
+  // with the recursion guard scrubbed so the shim re-resolves instead of echoing this bootstrapper.
+  const voltaShim = voltaBin ? join(voltaBin, "balladeer") : null;
+  const probeCmd = voltaShim && existsSync(voltaShim) ? voltaShim : "balladeer";
+  const probe = spawnSync(probeCmd, ["--version"], {
+    encoding: "utf8",
+    env: childEnv,
+    shell: process.platform === "win32",
+  });
   const probedVersion = (probe.stdout ?? "").trim();
   if (probe.status !== 0 || !/^\d+\.\d+\.\d+/.test(probedVersion)) {
     fail(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "balladeer",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Installer for the Balladeer client (decision memory for engineering teams and their AI agents): downloads the sha256-verified client from get.balladeer.ai and installs it globally.",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://balladeer.ai",