iterate-skill-installer 3.1.0 → 3.2.1

package/lib/installer.js

@@ -47,6 +47,28 @@ const CHECKSUMS_ASSET_NAME = 'SHA256SUMS.txt';
 // must never hang the installer forever.
 const CURL_MAX_TIME_SECONDS = '120';
 
+// Byte caps so a misbehaving upstream can never exhaust disk or memory:
+// JSON API responses are tiny, checksums are a few KB, and the release
+// tarball is far smaller than the generous ceiling below.
+const JSON_MAX_BYTES = 10 * 1024 * 1024; // 10 MiB
+const CHECKSUMS_MAX_BYTES = 1 * 1024 * 1024; // 1 MiB
+const TARBALL_MAX_BYTES = 100 * 1024 * 1024; // 100 MiB
+
+// A strict upper bound for an interactive yes/no prompt. On EOF (piped stdin
+// that ends) or a TTY that stops responding, the prompt must fall back to the
+// default rather than hang the installer forever.
+const ASK_YES_NO_TIMEOUT_MS = 30_000;
+
+// SHA256 digests are exactly 64 lowercase/uppercase hex characters. Any other
+// value in a checksum file is corrupt or tampered and must fail closed rather
+// than feed a garbage hash into the integrity comparison.
+const SHA256_HEX_RE = /^[0-9a-fA-F]{64}$/;
+
+// Curl added --fail-with-body in 7.76. On older curl the installer must fall
+// back to plain --fail so the flag is never rejected by the system curl.
+const CURL_FAIL_WITH_BODY_MIN = { major: 7, minor: 76 };
+let CURL_SUPPORTS_FAIL_WITH_BODY = null; // lazily probed once
+
 // Package version read from package.json at runtime so the --version/-v flag
 // and the published npm version always stay in sync.
 const VERSION = require('../package.json').version;
@@ -133,11 +155,50 @@ function commandExists(bin) {
   return result.status === 0;
 }
 
+async function supportsCurlFailWithBody() {
+  // Lazily probe ``curl --version`` once; the result is cached for the rest
+  // of the run. Falls back to the plain ``--fail`` flag (no probing) when
+  // curl itself cannot be invoked or its output is unexpected.
+  if (CURL_SUPPORTS_FAIL_WITH_BODY === null) {
+    try {
+      const versionOut = await runCommand('curl', ['--version']);
+      const match = versionOut.match(/curl (\d+)\.(\d+)\.\d+/);
+      if (!match) {
+        CURL_SUPPORTS_FAIL_WITH_BODY = false;
+      } else {
+        const major = Number(match[1]);
+        const minor = Number(match[2]);
+        CURL_SUPPORTS_FAIL_WITH_BODY =
+          major > CURL_FAIL_WITH_BODY_MIN.major ||
+          (major === CURL_FAIL_WITH_BODY_MIN.major &&
+            minor >= CURL_FAIL_WITH_BODY_MIN.minor);
+      }
+    } catch {
+      CURL_SUPPORTS_FAIL_WITH_BODY = false;
+    }
+  }
+  return CURL_SUPPORTS_FAIL_WITH_BODY;
+}
+
+function isGithubApiUrl(url) {
+  // True only for the GitHub API host. Release-asset and other URLs are
+  // public and must never receive the caller's PAT (credential surface
+  // minimalism) — mirrors scripts/install.py::_is_github_api_url.
+  let hostname = null;
+  try {
+    hostname = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return hostname === 'api.github.com' || hostname.endsWith('.api.github.com');
+}
+
 async function fetchJson(url, token) {
   // Prefer curl over Node.js fetch because curl uses the system CA store
   // and avoids Node-specific certificate issues in some environments.
-  const args = ['-sSL', '--fail-with-body', '--max-time', CURL_MAX_TIME_SECONDS, '-H', 'Accept: application/vnd.github+json', '-H', 'X-GitHub-Api-Version: 2022-11-28', '-H', 'User-Agent: iterate-skill-installer'];
-  if (token) {
+  const failFlag = (await supportsCurlFailWithBody()) ? '--fail-with-body' : '--fail';
+  const args = ['-sSL', failFlag, '--max-time', CURL_MAX_TIME_SECONDS, '--max-filesize', String(JSON_MAX_BYTES), '-H', 'Accept: application/vnd.github+json', '-H', 'X-GitHub-Api-Version: 2022-11-28', '-H', 'User-Agent: iterate-skill-installer'];
+  if (token && isGithubApiUrl(url)) {
     args.push('-H', `Authorization: Bearer ${token}`);
   }
   args.push(url);
@@ -152,14 +213,20 @@ async function fetchJson(url, token) {
 /**
  * Download a file with curl.
  *
+ * The caller's PAT is only attached for GitHub API hosts; release assets are
+ * public downloads and must not receive it. ``maxBytes`` is enforced with
+ * curl's ``--max-filesize`` so a misbehaving upstream is aborted rather than
+ * exhausting disk.
+ *
  * When ``progress`` is enabled (used for the tarball), curl's ``--progress-bar``
  * writes a live percentage bar straight to the terminal (stderr is inherited so
  * the bar is visible; stdout stays captured for non-progress downloads).
  */
-async function downloadFile(url, destPath, token, { progress = false } = {}) {
-  const args = ['-sSL', '--fail-with-body', '--max-time', CURL_MAX_TIME_SECONDS, '-o', destPath, '-H', 'User-Agent: iterate-skill-installer'];
+async function downloadFile(url, destPath, token, { progress = false, maxBytes = TARBALL_MAX_BYTES } = {}) {
+  const failFlag = (await supportsCurlFailWithBody()) ? '--fail-with-body' : '--fail';
+  const args = ['-sSL', failFlag, '--max-time', CURL_MAX_TIME_SECONDS, '--max-filesize', String(maxBytes), '-o', destPath, '-H', 'User-Agent: iterate-skill-installer'];
   if (progress) args.push('--progress-bar');
-  if (token) {
+  if (token && isGithubApiUrl(url)) {
     args.push('-H', `Authorization: Bearer ${token}`);
   }
   args.push(url);
@@ -185,20 +252,32 @@ function parseChecksums(text) {
   const map = new Map();
   for (const line of text.split(/\r?\n/)) {
     const trimmed = line.trim();
-    if (!trimmed) continue;
+    if (!trimmed || trimmed.startsWith('#')) continue;
     const parts = trimmed.split(/\s+/);
-    if (parts.length >= 2) {
-      // Normalize the filename the same way scripts/install.py does
-      // (_parse_checksum): strip all leading GNU tar binary-mode markers a la
-      // Python's name.lstrip("*") (ONE '*', or several in a malformed entry —
-      // strip them all so the two parsers can never disagree), then strip the
-      // './' prefix, then match on the basename so entries with a subpath or
-      // versioned component (e.g. "dist/iterate-skill.tar.gz" or
-      // "./iterate-skill.tar.gz") still resolve to the expected asset.
-      const normalized = parts[1].replace(/^\*+/, '').replace(/^\.\//, '');
-      const basename = normalized.split('/').pop();
-      map.set(basename, parts[0]);
+    if (parts.length < 2) continue;
+    // Reject any entry whose digest is not a 64-char hex string so a corrupt
+    // or tampered checksum file fails closed: a missing asset ("not found")
+    // aborts the install, whereas a garbage digest would masquerade as a
+    // valid expected hash.
+    if (!SHA256_HEX_RE.test(parts[0])) continue;
+    // Normalize the filename the same way scripts/install.py does
+    // (_parse_checksum): strip all leading GNU tar binary-mode markers a la
+    // Python's name.lstrip("*") (ONE '*', or several in a malformed entry —
+    // strip them all so the two parsers can never disagree), then strip the
+    // './' prefix, then match on the basename so entries with a subpath or
+    // versioned component (e.g. "dist/iterate-skill.tar.gz" or
+    // "./iterate-skill.tar.gz") still resolve to the expected asset.
+    const normalized = parts[1].replace(/^\*+/, '').replace(/^\.\//, '');
+    const basename = normalized.split('/').pop();
+    // A duplicate basename carrying a *different* digest is a red flag (the
+    // file is hand-corrupted or two sources disagree); refuse the whole file
+    // instead of silently letting one value win.
+    if (map.has(basename) && map.get(basename) !== parts[0]) {
+      throw new InstallerError(
+        `Duplicate checksum entry for ${basename} with a different value — refusing to proceed.`,
+      );
     }
+    map.set(basename, parts[0]);
   }
   return map;
 }
@@ -406,18 +485,32 @@ async function installCli(pythonBin, sourceDir) {
  *
  * Used to decide whether the current directory should be treated as the
  * target project when the installer is launched from a non-home directory.
- * Falls back to ``defaultNo`` if the input is unrecognized.
+ * Falls back to ``defaultNo`` if the input is unrecognized, on EOF (piped
+ * stdin that ends without an answer) or after a timeout, so a non-interactive
+ * or hung invocation resolves instead of blocking forever.
  */
 function askYesNo(question, defaultNo = false) {
   return new Promise((resolve) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const hint = defaultNo ? '[y/N]' : '[Y/n]';
-    rl.question(`\x1b[36m◆\x1b[0m  ${question} ${hint} `, (answer) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
       rl.close();
+      resolve(value);
+    };
+    // EOF (stdin is a closed pipe, or the terminal disappears) never invokes
+    // rl.question's callback; the interface 'close' event is the signal that
+    // no answer is coming, so fall back to the default instead of hanging.
+    rl.on('close', () => finish(defaultNo));
+    const timer = setTimeout(() => finish(defaultNo), ASK_YES_NO_TIMEOUT_MS);
+    rl.question(`\x1b[36m◆\x1b[0m  ${question} ${hint} `, (answer) => {
       const a = answer.trim().toLowerCase();
-      if (a === 'y' || a === 'yes') resolve(true);
-      else if (a === 'n' || a === 'no') resolve(false);
-      else resolve(defaultNo);
+      if (a === 'y' || a === 'yes') finish(true);
+      else if (a === 'n' || a === 'no') finish(false);
+      else finish(defaultNo);
     });
   });
 }
@@ -512,6 +605,18 @@ function parseArgs(argv) {
     const arg = argv[i];
     const next = argv[i + 1];
 
+    // -h/--help and -v/--version short-circuit parsing: later arguments (even
+    // malformed or value-consuming flags) must not turn `--help`/`--version`
+    // into an error exit. bin/cli.js exits 0 on these modes before installing.
+    if (arg === '--help' || arg === '-h') {
+      options.mode = 'help';
+      break;
+    }
+    if (arg === '--version' || arg === '-v') {
+      options.mode = 'version';
+      break;
+    }
+
     switch (arg) {
       case '--ai':
         if (!next || next.startsWith('-')) {
@@ -550,16 +655,6 @@ function parseArgs(argv) {
         // user who only wants the skill is not surprised by a global install.
         options.noCli = true;
         break;
-      case '--help':
-      case '-h':
-        // Show usage and exit 0 (handled by bin/cli.js).
-        options.mode = 'help';
-        break;
-      case '--version':
-      case '-v':
-        // Print the package version and exit 0 (handled by bin/cli.js).
-        options.mode = 'version';
-        break;
       case '--token':
         if (!next || next.startsWith('-')) {
           console.error('Error: --token requires a value (a flag was found instead)');
@@ -651,7 +746,9 @@ async function main(options = {}) {
     await downloadFile(tarballAsset.browser_download_url, tarballPath, token, { progress: true });
 
     info('Downloading checksums...');
-    await downloadFile(checksumAsset.browser_download_url, checksumPath, token);
+    await downloadFile(checksumAsset.browser_download_url, checksumPath, token, {
+      maxBytes: CHECKSUMS_MAX_BYTES,
+    });
 
     info('Verifying checksum...');
     const checksums = parseChecksums(fs.readFileSync(checksumPath, 'utf8'));
@@ -661,7 +758,17 @@ async function main(options = {}) {
       return 1;
     }
     const actualHash = await sha256File(tarballPath);
-    if (actualHash.toLowerCase() !== expectedHash.toLowerCase()) {
+    // Constant-time compare (timingSafeEqual): the expected hash travels
+    // over the network with the tarball, so an early-exit string inequality
+    // would leak prefix information usable to forge a checksum. The length
+    // guard keeps timingSafeEqual from throwing on mismatched lengths.
+    const actualBuf = Buffer.from(actualHash.toLowerCase(), 'utf8');
+    const expectedBuf = Buffer.from(expectedHash.toLowerCase(), 'utf8');
+    const hashMatches =
+      actualBuf.length === expectedBuf.length &&
+      actualBuf.length > 0 &&
+      crypto.timingSafeEqual(actualBuf, expectedBuf);
+    if (!hashMatches) {
       error('Checksum mismatch — refusing to install.');
       return 1;
     }
@@ -752,4 +859,6 @@ module.exports = {
   parseChecksums,
   extractTarball,
   rejectLinkEntries,
+  isGithubApiUrl,
+  supportsCurlFailWithBody,
 };

package/package.json

@@ -1,11 +1,17 @@
 {
   "name": "iterate-skill-installer",
-  "version": "3.1.0",
+  "version": "3.2.1",
   "description": "One-command installer for iterate-skill across AI coding assistants",
   "main": "lib/installer.js",
+  "files": [
+    "bin/",
+    "lib/",
+    "LICENSE",
+    "README.md",
+    "README.zh-CN.md"
+  ],
   "bin": {
-    "iterate-skill-installer": "bin/cli.js",
-    "iterate-skill": "bin/cli.js"
+    "iterate-skill-installer": "bin/cli.js"
   },
   "scripts": {
     "test": "node --check bin/cli.js && node --check lib/installer.js && node test/mode.test.js"

package/test/mode.test.js

@@ -1,220 +0,0 @@
-/**
- * Unit tests for resolveInstallMode() — the global vs project install-mode
- * decision — and parseChecksums() — the SHA256SUMS.txt parser — in the npx
- * installer. Uses node:assert so no extra test runner is required; run via
- * `npm test`.
- */
-
-const assert = require('node:assert');
-const fs = require('node:fs');
-const path = require('node:path');
-const os = require('node:os');
-const { resolveInstallMode, parseChecksums, parseArgs, buildPythonInstallArgs } = require('../lib/installer');
-
-const originalCwd = process.cwd();
-const originalHome = os.homedir;
-
-/**
- * Temporarily set the home directory and chdir into a fresh temp directory
- * (the "current working directory"), then run fn(cwd). Always restores state.
- */
-function withHomeAndCwd(home, fn) {
-  return (async () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'iterate-mode-'));
-    os.homedir = () => home;
-    process.chdir(cwd);
-    try {
-      return await fn(cwd);
-    } finally {
-      os.homedir = originalHome;
-      process.chdir(originalCwd);
-      fs.rmSync(cwd, { recursive: true, force: true });
-    }
-  })();
-}
-
-async function run() {
-  // 1) Explicit --target is honored without asking.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: '/x', targetExplicit: true, globalExplicit: false };
-    const ask = () => { throw new Error('should not ask'); };
-    const out = await resolveInstallMode(opts, ask);
-    assert.strictEqual(out.target, '/x', 'target should be preserved');
-    assert.strictEqual(out.global, true, 'global should be left untouched for explicit target');
-  });
-
-  // 2) Explicit --global is honored without asking.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: true };
-    const ask = () => { throw new Error('should not ask'); };
-    const out = await resolveInstallMode(opts, ask);
-    assert.strictEqual(out.global, true, 'global should be preserved');
-    assert.strictEqual(out.target, null, 'target should stay null');
-  });
-
-  // 3) cwd === home: no ask, stays global.
-  await withHomeAndCwd('/home/u', async () => {
-    // Use process.cwd() (the resolved path) so home matches cwd exactly,
-    // avoiding macOS /var -> /private/var symlink mismatches.
-    os.homedir = () => process.cwd();
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: false };
-    const ask = () => { throw new Error('should not ask when cwd is home'); };
-    const out = await resolveInstallMode(opts, ask);
-    assert.strictEqual(out.global, true, 'should stay global when cwd is home');
-  });
-
-  // 4) cwd !== home and user says yes -> project-level install into cwd.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: false };
-    const out = await resolveInstallMode(opts, async () => true);
-    assert.strictEqual(out.global, false, 'should switch to project mode');
-    assert.strictEqual(out.target, process.cwd(), 'target should be cwd');
-  });
-
-  // 5) cwd !== home and user says no -> stays global.
-  await withHomeAndCwd('/home/u', async () => {
-    const opts = { global: true, target: null, targetExplicit: false, globalExplicit: false };
-    const out = await resolveInstallMode(opts, async () => false);
-    assert.strictEqual(out.global, true, 'should stay global when user declines');
-    assert.strictEqual(out.target, null, 'target should stay null');
-  });
-
-  console.log('mode.test.js: all resolveInstallMode tests passed');
-
-  // parseChecksums: must strip the GNU tar binary-mode marker ('*') so both
-  // "HASH  name" and "HASH *name" formats resolve, matching the Python side.
-  const plain = parseChecksums('abc123  iterate-skill.tar.gz\n');
-  assert.strictEqual(plain.get('iterate-skill.tar.gz'), 'abc123', 'plain format should parse');
-
-  const starred = parseChecksums('def456 *iterate-skill.tar.gz\n');
-  assert.strictEqual(starred.get('iterate-skill.tar.gz'), 'def456', 'starred format should strip the * marker');
-
-  const crlf = parseChecksums('abc123  iterate-skill.tar.gz\r\n');
-  assert.strictEqual(crlf.get('iterate-skill.tar.gz'), 'abc123', 'CRLF line endings should parse');
-
-  const multi = parseChecksums('aa  a.txt\nbb  b.txt\n');
-  assert.strictEqual(multi.get('a.txt'), 'aa');
-  assert.strictEqual(multi.get('b.txt'), 'bb');
-
-  // './' prefix and subpath/basename matching must resolve like the Python
-  // side (scripts/install.py _parse_checksum), which matches on basename.
-  const dotSlash = parseChecksums('abc123  ./iterate-skill.tar.gz\n');
-  assert.strictEqual(dotSlash.get('iterate-skill.tar.gz'), 'abc123', './ prefix should parse');
-
-  const subpath = parseChecksums('abc123  dist/iterate-skill.tar.gz\n');
-  assert.strictEqual(subpath.get('iterate-skill.tar.gz'), 'abc123', 'subpath entries should match by basename');
-
-  const starredSubpath = parseChecksums('abc123  *./release/iterate-skill-1.2.3.tar.gz\n');
-  assert.strictEqual(starredSubpath.get('iterate-skill-1.2.3.tar.gz'), 'abc123', '*./ and versioned subpath should match by basename');
-
-  // Multiple leading '*' markers must be stripped like Python's lstrip("*")
-  // (a malformed entry must never leave a leading '*' in the basename).
-  const multiStar = parseChecksums('abc123  **iterate-skill.tar.gz\n');
-  assert.strictEqual(multiStar.get('iterate-skill.tar.gz'), 'abc123', 'all leading * markers should strip (lstrip matching)');
-
-  console.log('mode.test.js: all parseChecksums tests passed');
-
-  // parseArgs: --no-cli must toggle skill-only mode, and default to off.
-  assert.strictEqual(parseArgs([]).noCli, false, 'noCli should default to false');
-  assert.strictEqual(parseArgs(['--no-cli']).noCli, true, '--no-cli should set noCli');
-  assert.strictEqual(parseArgs(['--no-cli', '--force', '--global']).noCli, true, 'noCli persists with other flags');
-  assert.strictEqual(parseArgs(['--global']).noCli, false, 'unrelated flags do not set noCli');
-
-  // parseArgs: unrelated flag surface is preserved (target/global/ai/force).
-  const combo = parseArgs(['--ai', 'trae', '--target', '/proj', '--force']);
-  assert.strictEqual(combo.ai, 'trae', 'ai should parse');
-  assert.strictEqual(combo.target, '/proj', 'target should parse');
-  assert.strictEqual(combo.force, true, 'force should parse');
-  assert.strictEqual(combo.global, false, 'target forces project mode');
-
-  // parseArgs: --version/-v/--help/-h must set the corresponding mode instead
-  // of falling through to the unknown-option error.
-  assert.strictEqual(parseArgs([]).mode, null, 'mode should default to null');
-  assert.strictEqual(parseArgs(['--version']).mode, 'version', '--version should set version mode');
-  assert.strictEqual(parseArgs(['-v']).mode, 'version', '-v should set version mode');
-  assert.strictEqual(parseArgs(['--help']).mode, 'help', '--help should set help mode');
-  assert.strictEqual(parseArgs(['-h']).mode, 'help', '-h should set help mode');
-
-  // parseArgs: value-consuming flags must reject a following flag as their
-  // value instead of silently swallowing it (regression: `--ai --force`
-  // previously set ai='--force' and misled the Python side with an invalid
-  // choice). process.exit is stubbed so the error path is assertable.
-  const origExit = process.exit;
-  process.exit = (code) => {
-    throw new Error(`exit(${code})`);
-  };
-  try {
-    assert.throws(() => parseArgs(['--ai', '--force']), /exit\(1\)/, '--ai must reject a flag as its value');
-    assert.throws(() => parseArgs(['--target', '--global']), /exit\(1\)/, '--target must reject a flag as its value');
-    assert.throws(() => parseArgs(['--token', '--yes']), /exit\(1\)/, '--token must reject a flag as its value');
-    assert.throws(() => parseArgs(['--ai']), /exit\(1\)/, '--ai without a value must error');
-    assert.throws(() => parseArgs(['--token']), /exit\(1\)/, '--token without a value must error');
-  } finally {
-    process.exit = origExit;
-  }
-
-  // parseArgs: a bare positional argument must produce a warning instead of
-  // being silently ignored (fix: typos like "npx iterate-skill-installer trae").
-  const origLog = console.log;
-  const warnings = [];
-  console.log = (msg) => { warnings.push(msg); };
-  try {
-    const opts = parseArgs(['trae', '--force']);
-    assert.strictEqual(opts.force, true, 'known flags still parse alongside positionals');
-    assert.ok(
-      warnings.some((w) => w.includes('Ignoring unexpected positional argument: trae')),
-      `positional arg should warn, got: ${JSON.stringify(warnings)}`,
-    );
-  } finally {
-    console.log = origLog;
-  }
-
-  // parseArgs: --global + --target together must warn that the later flag wins.
-  const conflictLogs = [];
-  console.log = (msg) => { conflictLogs.push(msg); };
-  try {
-    const targetThenGlobal = parseArgs(['--target', '/proj', '--global']);
-    assert.strictEqual(targetThenGlobal.global, true, 'later --global wins');
-    assert.strictEqual(targetThenGlobal.target, null, 'later --global clears the target');
-    assert.ok(
-      conflictLogs.some((w) => w.includes('--global overrides --target')),
-      `conflict should warn, got: ${JSON.stringify(conflictLogs)}`,
-    );
-    const globalThenTarget = parseArgs(['--global', '--target', '/proj']);
-    assert.strictEqual(globalThenTarget.global, false, 'later --target wins');
-    assert.strictEqual(globalThenTarget.target, '/proj', 'later --target is kept');
-    assert.ok(
-      conflictLogs.some((w) => w.includes('--target overrides --global')),
-      `conflict should warn, got: ${JSON.stringify(conflictLogs)}`,
-    );
-  } finally {
-    console.log = origLog;
-  }
-
-  console.log('mode.test.js: all parseArgs tests passed');
-
-  // buildPythonInstallArgs: a relative --target must be resolved against the
-  // current working directory (the Python installer runs with a different
-  // cwd, so the raw relative path would point at the wrong place).
-  const resolved = buildPythonInstallArgs({ ai: 'trae', target: 'rel/sub', force: true, globalInstall: false });
-  assert.deepStrictEqual(
-    resolved,
-    ['--ai', 'trae', '--target', path.resolve('rel/sub'), '--force'],
-    'relative --target should be resolved against cwd',
-  );
-  const globalArgs = buildPythonInstallArgs({ ai: null, target: null, force: false, globalInstall: true });
-  assert.deepStrictEqual(globalArgs, ['--global'], 'global flag should be forwarded');
-  assert.deepStrictEqual(
-    buildPythonInstallArgs({ ai: null, target: '/abs/target', force: false, globalInstall: false }),
-    ['--target', '/abs/target'],
-    'absolute --target is passed through unchanged',
-  );
-  assert.deepStrictEqual(buildPythonInstallArgs({ ai: null, target: null, force: false, globalInstall: false }), [], 'no flags -> empty argv');
-
-  console.log('mode.test.js: all buildPythonInstallArgs tests passed');
-}
-
-run().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});