baychat 0.32.2 → 0.33.1

package/dist/self-upgrade.js

@@ -42,6 +42,7 @@ exports.upgradePackage = upgradePackage;
 exports.lookupLatest = lookupLatest;
 exports.installRelease = installRelease;
 exports.describeOutcome = describeOutcome;
+exports.npmCommand = npmCommand;
 exports.realNpm = realNpm;
 exports.readPackageVersion = readPackageVersion;
 exports.packageEntry = packageEntry;
@@ -249,6 +250,30 @@ function npmFailure(r) {
     const lines = r.stderr.split("\n").map((l) => l.trim()).filter(Boolean);
     return lines.slice(-3).join(" ") || `npm exited with ${r.status}`;
 }
+/**
+ * Which npm to run, and the PATH to run it with: the npm installed beside the Node running this
+ * code, when there is one — else plain `npm` from PATH.
+ *
+ * A relay under systemd or launchd does not read a shell profile, so with Node from nvm (or any
+ * version manager) its PATH holds no npm at all: every automatic update on such a computer failed
+ * with "npm was not found on PATH" (Karmen's PC, 2026-10-21: 11 failed checks, never one update).
+ * The Node that is running is the Node that installed this copy, and its npm sits next to it. That
+ * directory also goes first on the child's PATH, because npm itself starts with
+ * `#!/usr/bin/env node`, which must find a node too.
+ *
+ * Which global folder that npm calls its own (Volta, asdf, a custom `prefix`) does not matter:
+ * installRelease always passes `--prefix <the running copy's prefix>`, which npm puts above its
+ * own config (checked 2026-10-21 with npm_config_prefix pointing elsewhere: the install landed in
+ * `--prefix`), and then believes only the version on disk there.
+ */
+function npmCommand(execPath, platform, pathEnv, exists) {
+    const dir = path.dirname(execPath);
+    const beside = path.join(dir, platform === "win32" ? "npm.cmd" : "npm");
+    if (!exists(beside))
+        return { command: "npm", path: pathEnv };
+    const sep = platform === "win32" ? ";" : ":";
+    return { command: beside, path: pathEnv ? `${dir}${sep}${pathEnv}` : dir };
+}
 /** Run npm for real, without blocking the event loop (the relay keeps serving while npm runs).
  *  Windows' npm is a `.cmd` shim, which Node will only start through a shell, so every argument
  *  is first checked against what cmd.exe could misread and then quoted. */
@@ -257,8 +282,20 @@ function realNpm(args, timeoutMs) {
     if (windows && args.some((a) => commands_1.WINDOWS_UNSAFE.test(a))) {
         return Promise.resolve({ status: null, stdout: "", stderr: "", error: new Error("a path npm needs cannot be passed safely through cmd.exe") });
     }
+    const found = npmCommand(process.execPath, process.platform, process.env.PATH, fs.existsSync);
+    // A Node directory cmd.exe could misread is not run through it: PATH's npm then, as before.
+    const npm = windows && commands_1.WINDOWS_UNSAFE.test(found.command) ? { command: "npm", path: process.env.PATH } : found;
+    // Through cmd.exe the command is a string too: a path with spaces must arrive as one word.
+    const command = windows && npm.command !== "npm" ? (0, commands_1.quoteForCmd)(npm.command) : npm.command;
     return new Promise((resolve) => {
-        (0, child_process_1.execFile)("npm", windows ? args.map(commands_1.quoteForCmd) : args, { encoding: "utf8", timeout: timeoutMs, shell: windows, windowsHide: true, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(command, windows ? args.map(commands_1.quoteForCmd) : args, {
+            encoding: "utf8",
+            timeout: timeoutMs,
+            shell: windows,
+            windowsHide: true,
+            maxBuffer: 16 * 1024 * 1024,
+            env: { ...process.env, ...(npm.path !== undefined ? { PATH: npm.path } : {}) },
+        }, (err, stdout, stderr) => {
             if (!err)
                 return resolve({ status: 0, stdout, stderr });
             const code = err.code;