ugly-app 0.1.425 → 0.1.426

package/dist/cli/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAOA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CA0F9C"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAOA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CA4F9C"}

package/dist/cli/build.js

@@ -44,7 +44,7 @@ export const buildId = '${buildId}';
         console.log('[Build] Bundling server...');
         const serverOutDir = path.join(distDir, 'server');
         fs.mkdirSync(serverOutDir, { recursive: true });
-        execSync(nodeBinCommand('esbuild', 'server/index.ts --bundle --platform=node --format=esm --outfile=dist/server/index.mjs --external:ugly-app --external:ugly-app/*'), { stdio: 'inherit', cwd: process.cwd() });
+        execSync(nodeBinCommand('esbuild', 'server/index.ts --bundle --platform=node --format=esm --outfile=dist/server/index.mjs --external:ugly-app --external:ugly-app/*', { anchors: ['cwd', 'ugly-app'] }), { stdio: 'inherit', cwd: process.cwd() });
     }
     // Bundle task.ts if it exists (for cron/worker/GPU tasks)
     const taskEntry = path.join(process.cwd(), 'server', 'task.ts');
@@ -62,7 +62,7 @@ export const buildId = '${buildId}';
             'mediasoup', 'mediasoup-client',
         ];
         const externalFlags = externals.map(e => `--external:${e}`).join(' ');
-        execSync(nodeBinCommand('esbuild', `server/task.ts --bundle --platform=node --format=esm --outfile=dist/tasks/task.js ${externalFlags}`), { stdio: 'inherit', cwd: process.cwd() });
+        execSync(nodeBinCommand('esbuild', `server/task.ts --bundle --platform=node --format=esm --outfile=dist/tasks/task.js ${externalFlags}`, { anchors: ['cwd', 'ugly-app'] }), { stdio: 'inherit', cwd: process.cwd() });
         console.log('[Build] Task bundle: dist/tasks/task.js');
     }
     // Run tsc for typecheck

package/dist/cli/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEnC,wBAAwB;IACxB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG;0BACD,OAAO;CAChC,CAAC;IAEA,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAE3C,8BAA8B;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,+DAA+D;IAC/D,oDAAoD;IACpD,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;QACxC,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC9F,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,QAAQ,CACN,cAAc,CACZ,SAAS,EACT,iIAAiI,CAClI,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,2EAA2E;QAC3E,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE,YAAY;YACxB,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI;YACtC,0BAA0B,EAAE,eAAe,EAAE,OAAO;YACpD,mBAAmB,EAAE,QAAQ;YAC7B,KAAK,EAAE,UAAU,EAAE,QAAQ;YAC3B,WAAW,EAAE,kBAAkB;SAChC,CAAC;QACF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,QAAQ,CACN,cAAc,CACZ,SAAS,EACT,qFAAqF,aAAa,EAAE,CACrG,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;QACxD,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,GAAG,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEnC,wBAAwB;IACxB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG;0BACD,OAAO;CAChC,CAAC;IAEA,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAE3C,8BAA8B;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,+DAA+D;IAC/D,oDAAoD;IACpD,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;QACxC,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC,CAAC;IAEH,oFAAoF;IACpF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC9F,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,QAAQ,CACN,cAAc,CACZ,SAAS,EACT,iIAAiI,EACjI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CACjC,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,2EAA2E;QAC3E,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE,YAAY;YACxB,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI;YACtC,0BAA0B,EAAE,eAAe,EAAE,OAAO;YACpD,mBAAmB,EAAE,QAAQ;YAC7B,KAAK,EAAE,UAAU,EAAE,QAAQ;YAC3B,WAAW,EAAE,kBAAkB;SAChC,CAAC;QACF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,QAAQ,CACN,cAAc,CACZ,SAAS,EACT,qFAAqF,aAAa,EAAE,EACpG,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CACjC,EACD,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;QACxD,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,GAAG,CAAC,CAAC;AACrD,CAAC"}

package/dist/cli/resolveBin.d.ts

@@ -1,23 +1,60 @@
+/**
+ * Anchors that can be used to resolve a package. `cwd` means resolve
+ * starting from the user project's `package.json`; `ugly-app` means
+ * resolve starting from this CLI's own location (so packages that are
+ * deps of `ugly-app` itself — like `esbuild` — are findable even when
+ * they aren't direct deps of the user's project).
+ */
+export type ResolveAnchor = 'cwd' | 'ugly-app';
+interface ResolveOpts {
+    binName?: string;
+    cwd?: string;
+    /**
+     * Ordered list of anchors to try. Defaults to `['cwd']` for backward
+     * compatibility. For ugly-app-owned tooling (esbuild, etc.), pass
+     * `['cwd', 'ugly-app']` so a missing dep in the user's project falls
+     * through to ugly-app's own copy instead of walking up parent dirs
+     * and surfacing a stray system-level install.
+     */
+    anchors?: ResolveAnchor[];
+}
 /**
  * Resolve a package's bin entry to an absolute path to the JS file —
  * using Node's module resolution (pnpm-strict-safe) rather than
  * assuming `node_modules/.bin/<name>` exists.
  *
- * Why this matters: `npx <bin>` fails with `Unknown command: <bin>`
- * inside a pnpm-style nested store because the binary lives in
- * `node_modules/.pnpm/...` and was never linked to the top-level
- * `.bin/`. Every `execSync('npx <x>')` call from this CLI broke
- * coding-agent sessions in pnpm-managed apps. Resolve the bin path
- * via require + package.json `bin` field instead.
+ * Why this matters:
+ *
+ * 1. `npx <bin>` fails with `Unknown command: <bin>` inside a
+ *    pnpm-style nested store because the binary lives in
+ *    `node_modules/.pnpm/...` and was never linked to the top-level
+ *    `.bin/`.
+ *
+ * 2. A naive `createRequire(cwd/package.json).resolve('<pkg>')` works
+ *    for *direct* deps of the user's project, but for transitive deps
+ *    (e.g. `esbuild`, which is a dep of `ugly-app` and not the user
+ *    project) Node's resolver walks UP parent directories until it
+ *    finds *any* `node_modules/<pkg>` — often a stray install in the
+ *    user's home or `Documents/GitHub`. We've seen that happen and
+ *    surface a Mach-O native binary as if it were a JS bin script.
+ *
+ * The fix: when the package is owned by `ugly-app` (esbuild and
+ * friends), pass `anchors: ['cwd', 'ugly-app']`. The `'ugly-app'`
+ * anchor resolves the package starting from this CLI's own location,
+ * so we always find ugly-app's own copy. We also reject any
+ * resolution that escapes both the cwd's `node_modules/` subtree and
+ * ugly-app's `node_modules/` subtree, so a stray ancestor install
+ * can't sneak in.
  *
  * Returns `null` when the package isn't installed or has no bin entry.
  */
-export declare function resolveBinJs(pkg: string, binName?: string, cwd?: string): string | null;
+export declare function resolveBinJs(pkg: string, binNameOrOpts?: string | ResolveOpts, cwd?: string): string | null;
 /**
  * Build a `node <abs.js> <args>` command string for execSync. The
  * binary is resolved via `resolveBinJs`; when it can't be found we
  * fall back to `npx <pkg> <args>` and let the user see the original
  * failure mode rather than a confusing error from this helper.
  */
-export declare function nodeBinCommand(pkg: string, args: string, binName?: string, cwd?: string): string;
+export declare function nodeBinCommand(pkg: string, args: string, binNameOrOpts?: string | ResolveOpts, cwd?: string): string;
+export {};
 //# sourceMappingURL=resolveBin.d.ts.map

package/dist/cli/resolveBin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveBin.d.ts","sourceRoot":"","sources":["../../src/cli/resolveBin.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAmBf;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,CAOR"}
+{"version":3,"file":"resolveBin.d.ts","sourceRoot":"","sources":["../../src/cli/resolveBin.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,UAAU,CAAC;AAE/C,UAAU,WAAW;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,aAAa,CAAC,EAAE,MAAM,GAAG,WAAW,EACpC,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAsCf;AAgFD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GAAG,WAAW,EACpC,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,CASR"}

package/dist/cli/resolveBin.js

@@ -6,26 +6,81 @@ import path from 'path';
  * using Node's module resolution (pnpm-strict-safe) rather than
  * assuming `node_modules/.bin/<name>` exists.
  *
- * Why this matters: `npx <bin>` fails with `Unknown command: <bin>`
- * inside a pnpm-style nested store because the binary lives in
- * `node_modules/.pnpm/...` and was never linked to the top-level
- * `.bin/`. Every `execSync('npx <x>')` call from this CLI broke
- * coding-agent sessions in pnpm-managed apps. Resolve the bin path
- * via require + package.json `bin` field instead.
+ * Why this matters:
+ *
+ * 1. `npx <bin>` fails with `Unknown command: <bin>` inside a
+ *    pnpm-style nested store because the binary lives in
+ *    `node_modules/.pnpm/...` and was never linked to the top-level
+ *    `.bin/`.
+ *
+ * 2. A naive `createRequire(cwd/package.json).resolve('<pkg>')` works
+ *    for *direct* deps of the user's project, but for transitive deps
+ *    (e.g. `esbuild`, which is a dep of `ugly-app` and not the user
+ *    project) Node's resolver walks UP parent directories until it
+ *    finds *any* `node_modules/<pkg>` — often a stray install in the
+ *    user's home or `Documents/GitHub`. We've seen that happen and
+ *    surface a Mach-O native binary as if it were a JS bin script.
+ *
+ * The fix: when the package is owned by `ugly-app` (esbuild and
+ * friends), pass `anchors: ['cwd', 'ugly-app']`. The `'ugly-app'`
+ * anchor resolves the package starting from this CLI's own location,
+ * so we always find ugly-app's own copy. We also reject any
+ * resolution that escapes both the cwd's `node_modules/` subtree and
+ * ugly-app's `node_modules/` subtree, so a stray ancestor install
+ * can't sneak in.
  *
  * Returns `null` when the package isn't installed or has no bin entry.
  */
-export function resolveBinJs(pkg, binName, cwd) {
+export function resolveBinJs(pkg, binNameOrOpts, cwd) {
+    const opts = typeof binNameOrOpts === 'object' && binNameOrOpts !== null
+        ? binNameOrOpts
+        : {
+            ...(binNameOrOpts ? { binName: binNameOrOpts } : {}),
+            ...(cwd ? { cwd } : {}),
+        };
+    const projectCwd = opts.cwd ?? process.cwd();
+    const anchors = opts.anchors ?? ['cwd'];
+    const uglyAppPkgJson = findUglyAppPackageJson();
+    const acceptableRoots = [path.join(projectCwd, 'node_modules')];
+    if (uglyAppPkgJson) {
+        acceptableRoots.push(path.join(path.dirname(uglyAppPkgJson), 'node_modules'));
+        // pnpm: ugly-app's deps live as siblings under the same .pnpm
+        // store dir (e.g. `<store>/<ugly-app-id>/node_modules/ugly-app`
+        // and `<store>/<ugly-app-id>/node_modules/esbuild`). Accept the
+        // entire `.pnpm` subtree so transitive lookups don't get rejected.
+        const pnpmStore = findPnpmStoreRoot(path.dirname(uglyAppPkgJson));
+        if (pnpmStore)
+            acceptableRoots.push(pnpmStore);
+    }
+    for (const anchor of anchors) {
+        const anchorPkgJson = anchor === 'cwd'
+            ? path.join(projectCwd, 'package.json')
+            : uglyAppPkgJson;
+        if (!anchorPkgJson)
+            continue;
+        if (!fs.existsSync(anchorPkgJson))
+            continue;
+        const resolved = tryResolveFrom(anchorPkgJson, pkg, opts.binName);
+        if (!resolved)
+            continue;
+        if (!isPathInsideAny(resolved, acceptableRoots))
+            continue;
+        return resolved;
+    }
+    return null;
+}
+function tryResolveFrom(fromPkgJson, pkg, binName) {
     try {
-        const fromCwd = path.join(cwd ?? process.cwd(), 'package.json');
-        const req = createRequire(fromCwd);
+        const req = createRequire(fromPkgJson);
         const pkgJsonPath = req.resolve(`${pkg}/package.json`);
         const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
         const pkgDir = path.dirname(pkgJsonPath);
         const binField = pkgJson.bin;
         if (!binField)
             return null;
-        const rel = typeof binField === 'string' ? binField : binField[binName ?? pkgJson.name];
+        const rel = typeof binField === 'string'
+            ? binField
+            : binField[binName ?? pkgJson.name];
         if (!rel)
             return null;
         return path.join(pkgDir, rel);
@@ -34,18 +89,71 @@ export function resolveBinJs(pkg, binName, cwd) {
         return null;
     }
 }
+function isPathInsideAny(target, roots) {
+    const resolvedTarget = path.resolve(target);
+    for (const root of roots) {
+        const resolvedRoot = path.resolve(root);
+        const rel = path.relative(resolvedRoot, resolvedTarget);
+        if (rel && !rel.startsWith('..') && !path.isAbsolute(rel))
+            return true;
+    }
+    return false;
+}
+/**
+ * Find ugly-app's own `package.json` by walking up from this file.
+ * Cached after first lookup.
+ */
+let cachedUglyAppPkgJson;
+function findUglyAppPackageJson() {
+    if (cachedUglyAppPkgJson !== undefined)
+        return cachedUglyAppPkgJson;
+    let dir = path.dirname(new URL(import.meta.url).pathname);
+    for (let i = 0; i < 8; i += 1) {
+        const candidate = path.join(dir, 'package.json');
+        if (fs.existsSync(candidate)) {
+            try {
+                const json = JSON.parse(fs.readFileSync(candidate, 'utf-8'));
+                if (json.name === 'ugly-app') {
+                    cachedUglyAppPkgJson = candidate;
+                    return candidate;
+                }
+            }
+            catch {
+                // ignore
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    cachedUglyAppPkgJson = null;
+    return null;
+}
+/**
+ * From a directory inside `node_modules/.pnpm/<id>/node_modules/ugly-app/`,
+ * return the `node_modules/.pnpm/` root; otherwise return null.
+ */
+function findPnpmStoreRoot(uglyAppDir) {
+    const marker = `${path.sep}node_modules${path.sep}.pnpm${path.sep}`;
+    const idx = uglyAppDir.indexOf(marker);
+    if (idx < 0)
+        return null;
+    return uglyAppDir.slice(0, idx + marker.length - 1);
+}
 /**
  * Build a `node <abs.js> <args>` command string for execSync. The
  * binary is resolved via `resolveBinJs`; when it can't be found we
  * fall back to `npx <pkg> <args>` and let the user see the original
  * failure mode rather than a confusing error from this helper.
  */
-export function nodeBinCommand(pkg, args, binName, cwd) {
-    const bin = resolveBinJs(pkg, binName, cwd);
+export function nodeBinCommand(pkg, args, binNameOrOpts, cwd) {
+    const bin = resolveBinJs(pkg, binNameOrOpts, cwd);
     const q = (s) => `"${s.replace(/"/g, '\\"')}"`;
     if (bin) {
         return `${q(process.execPath)} ${q(bin)} ${args}`;
     }
+    const binName = typeof binNameOrOpts === 'string' ? binNameOrOpts : binNameOrOpts?.binName;
     return `npx ${binName ?? pkg} ${args}`;
 }
 //# sourceMappingURL=resolveBin.js.map

package/dist/cli/resolveBin.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveBin.js","sourceRoot":"","sources":["../../src/cli/resolveBin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,OAAgB,EAChB,GAAY;IAEZ,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAG/D,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GACP,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,IAAY,EACZ,OAAgB,EAChB,GAAY;IAEZ,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IACvD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,OAAO,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"resolveBin.js","sourceRoot":"","sources":["../../src/cli/resolveBin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,IAAI,MAAM,MAAM,CAAC;AAwBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,aAAoC,EACpC,GAAY;IAEZ,MAAM,IAAI,GACR,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;QACzD,CAAC,CAAC,aAAa;QACf,CAAC,CAAC;YACE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxB,CAAC;IACR,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;IAEhD,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IAChE,IAAI,cAAc,EAAE,CAAC;QACnB,eAAe,CAAC,IAAI,CAClB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CACxD,CAAC;QACF,8DAA8D;QAC9D,gEAAgE;QAChE,gEAAgE;QAChE,mEAAmE;QACnE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAClE,IAAI,SAAS;YAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,aAAa,GACjB,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC;YACvC,CAAC,CAAC,cAAc,CAAC;QACrB,IAAI,CAAC,aAAa;YAAE,SAAS;QAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,SAAS;QAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC;YAAE,SAAS;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,WAAmB,EACnB,GAAW,EACX,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAG/D,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GACP,OAAO,QAAQ,KAAK,QAAQ;YAC1B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,KAAe;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACxD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,IAAI,oBAA+C,CAAC;AACpD,SAAS,sBAAsB;IAC7B,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC;IACpE,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAE1D,CAAC;gBACF,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC7B,oBAAoB,GAAG,SAAS,CAAC;oBACjC,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,oBAAoB,GAAG,IAAI,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;IACpE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,IAAY,EACZ,aAAoC,EACpC,GAAY;IAEZ,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IACvD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GACX,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC;IAC7E,OAAO,OAAO,OAAO,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC"}

package/dist/cli/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.1.425";
+export declare const CLI_VERSION = "0.1.426";
 //# sourceMappingURL=version.d.ts.map

package/dist/cli/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.425";
+export const CLI_VERSION = "0.1.426";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ugly-app",
-  "version": "0.1.425",
+  "version": "0.1.426",
   "type": "module",
   "main": "./dist/server/index.js",
   "exports": {

package/src/cli/build.ts

@@ -56,6 +56,7 @@ export const buildId = '${buildId}';
       nodeBinCommand(
         'esbuild',
         'server/index.ts --bundle --platform=node --format=esm --outfile=dist/server/index.mjs --external:ugly-app --external:ugly-app/*',
+        { anchors: ['cwd', 'ugly-app'] },
       ),
       { stdio: 'inherit', cwd: process.cwd() },
     );
@@ -81,6 +82,7 @@ export const buildId = '${buildId}';
       nodeBinCommand(
         'esbuild',
         `server/task.ts --bundle --platform=node --format=esm --outfile=dist/tasks/task.js ${externalFlags}`,
+        { anchors: ['cwd', 'ugly-app'] },
       ),
       { stdio: 'inherit', cwd: process.cwd() },
     );

package/src/cli/resolveBin.ts

@@ -2,28 +2,109 @@ import fs from 'fs';
 import { createRequire } from 'module';
 import path from 'path';
 
+/**
+ * Anchors that can be used to resolve a package. `cwd` means resolve
+ * starting from the user project's `package.json`; `ugly-app` means
+ * resolve starting from this CLI's own location (so packages that are
+ * deps of `ugly-app` itself — like `esbuild` — are findable even when
+ * they aren't direct deps of the user's project).
+ */
+export type ResolveAnchor = 'cwd' | 'ugly-app';
+
+interface ResolveOpts {
+  binName?: string;
+  cwd?: string;
+  /**
+   * Ordered list of anchors to try. Defaults to `['cwd']` for backward
+   * compatibility. For ugly-app-owned tooling (esbuild, etc.), pass
+   * `['cwd', 'ugly-app']` so a missing dep in the user's project falls
+   * through to ugly-app's own copy instead of walking up parent dirs
+   * and surfacing a stray system-level install.
+   */
+  anchors?: ResolveAnchor[];
+}
+
 /**
  * Resolve a package's bin entry to an absolute path to the JS file —
  * using Node's module resolution (pnpm-strict-safe) rather than
  * assuming `node_modules/.bin/<name>` exists.
  *
- * Why this matters: `npx <bin>` fails with `Unknown command: <bin>`
- * inside a pnpm-style nested store because the binary lives in
- * `node_modules/.pnpm/...` and was never linked to the top-level
- * `.bin/`. Every `execSync('npx <x>')` call from this CLI broke
- * coding-agent sessions in pnpm-managed apps. Resolve the bin path
- * via require + package.json `bin` field instead.
+ * Why this matters:
+ *
+ * 1. `npx <bin>` fails with `Unknown command: <bin>` inside a
+ *    pnpm-style nested store because the binary lives in
+ *    `node_modules/.pnpm/...` and was never linked to the top-level
+ *    `.bin/`.
+ *
+ * 2. A naive `createRequire(cwd/package.json).resolve('<pkg>')` works
+ *    for *direct* deps of the user's project, but for transitive deps
+ *    (e.g. `esbuild`, which is a dep of `ugly-app` and not the user
+ *    project) Node's resolver walks UP parent directories until it
+ *    finds *any* `node_modules/<pkg>` — often a stray install in the
+ *    user's home or `Documents/GitHub`. We've seen that happen and
+ *    surface a Mach-O native binary as if it were a JS bin script.
+ *
+ * The fix: when the package is owned by `ugly-app` (esbuild and
+ * friends), pass `anchors: ['cwd', 'ugly-app']`. The `'ugly-app'`
+ * anchor resolves the package starting from this CLI's own location,
+ * so we always find ugly-app's own copy. We also reject any
+ * resolution that escapes both the cwd's `node_modules/` subtree and
+ * ugly-app's `node_modules/` subtree, so a stray ancestor install
+ * can't sneak in.
  *
  * Returns `null` when the package isn't installed or has no bin entry.
  */
 export function resolveBinJs(
   pkg: string,
-  binName?: string,
+  binNameOrOpts?: string | ResolveOpts,
   cwd?: string,
+): string | null {
+  const opts: ResolveOpts =
+    typeof binNameOrOpts === 'object' && binNameOrOpts !== null
+      ? binNameOrOpts
+      : {
+          ...(binNameOrOpts ? { binName: binNameOrOpts } : {}),
+          ...(cwd ? { cwd } : {}),
+        };
+  const projectCwd = opts.cwd ?? process.cwd();
+  const anchors = opts.anchors ?? ['cwd'];
+  const uglyAppPkgJson = findUglyAppPackageJson();
+
+  const acceptableRoots = [path.join(projectCwd, 'node_modules')];
+  if (uglyAppPkgJson) {
+    acceptableRoots.push(
+      path.join(path.dirname(uglyAppPkgJson), 'node_modules'),
+    );
+    // pnpm: ugly-app's deps live as siblings under the same .pnpm
+    // store dir (e.g. `<store>/<ugly-app-id>/node_modules/ugly-app`
+    // and `<store>/<ugly-app-id>/node_modules/esbuild`). Accept the
+    // entire `.pnpm` subtree so transitive lookups don't get rejected.
+    const pnpmStore = findPnpmStoreRoot(path.dirname(uglyAppPkgJson));
+    if (pnpmStore) acceptableRoots.push(pnpmStore);
+  }
+
+  for (const anchor of anchors) {
+    const anchorPkgJson =
+      anchor === 'cwd'
+        ? path.join(projectCwd, 'package.json')
+        : uglyAppPkgJson;
+    if (!anchorPkgJson) continue;
+    if (!fs.existsSync(anchorPkgJson)) continue;
+    const resolved = tryResolveFrom(anchorPkgJson, pkg, opts.binName);
+    if (!resolved) continue;
+    if (!isPathInsideAny(resolved, acceptableRoots)) continue;
+    return resolved;
+  }
+  return null;
+}
+
+function tryResolveFrom(
+  fromPkgJson: string,
+  pkg: string,
+  binName?: string,
 ): string | null {
   try {
-    const fromCwd = path.join(cwd ?? process.cwd(), 'package.json');
-    const req = createRequire(fromCwd);
+    const req = createRequire(fromPkgJson);
     const pkgJsonPath = req.resolve(`${pkg}/package.json`);
     const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')) as {
       name: string;
@@ -33,7 +114,9 @@ export function resolveBinJs(
     const binField = pkgJson.bin;
     if (!binField) return null;
     const rel =
-      typeof binField === 'string' ? binField : binField[binName ?? pkgJson.name];
+      typeof binField === 'string'
+        ? binField
+        : binField[binName ?? pkgJson.name];
     if (!rel) return null;
     return path.join(pkgDir, rel);
   } catch {
@@ -41,6 +124,58 @@ export function resolveBinJs(
   }
 }
 
+function isPathInsideAny(target: string, roots: string[]): boolean {
+  const resolvedTarget = path.resolve(target);
+  for (const root of roots) {
+    const resolvedRoot = path.resolve(root);
+    const rel = path.relative(resolvedRoot, resolvedTarget);
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) return true;
+  }
+  return false;
+}
+
+/**
+ * Find ugly-app's own `package.json` by walking up from this file.
+ * Cached after first lookup.
+ */
+let cachedUglyAppPkgJson: string | null | undefined;
+function findUglyAppPackageJson(): string | null {
+  if (cachedUglyAppPkgJson !== undefined) return cachedUglyAppPkgJson;
+  let dir = path.dirname(new URL(import.meta.url).pathname);
+  for (let i = 0; i < 8; i += 1) {
+    const candidate = path.join(dir, 'package.json');
+    if (fs.existsSync(candidate)) {
+      try {
+        const json = JSON.parse(fs.readFileSync(candidate, 'utf-8')) as {
+          name?: string;
+        };
+        if (json.name === 'ugly-app') {
+          cachedUglyAppPkgJson = candidate;
+          return candidate;
+        }
+      } catch {
+        // ignore
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  cachedUglyAppPkgJson = null;
+  return null;
+}
+
+/**
+ * From a directory inside `node_modules/.pnpm/<id>/node_modules/ugly-app/`,
+ * return the `node_modules/.pnpm/` root; otherwise return null.
+ */
+function findPnpmStoreRoot(uglyAppDir: string): string | null {
+  const marker = `${path.sep}node_modules${path.sep}.pnpm${path.sep}`;
+  const idx = uglyAppDir.indexOf(marker);
+  if (idx < 0) return null;
+  return uglyAppDir.slice(0, idx + marker.length - 1);
+}
+
 /**
  * Build a `node <abs.js> <args>` command string for execSync. The
  * binary is resolved via `resolveBinJs`; when it can't be found we
@@ -50,13 +185,15 @@ export function resolveBinJs(
 export function nodeBinCommand(
   pkg: string,
   args: string,
-  binName?: string,
+  binNameOrOpts?: string | ResolveOpts,
   cwd?: string,
 ): string {
-  const bin = resolveBinJs(pkg, binName, cwd);
+  const bin = resolveBinJs(pkg, binNameOrOpts, cwd);
   const q = (s: string) => `"${s.replace(/"/g, '\\"')}"`;
   if (bin) {
     return `${q(process.execPath)} ${q(bin)} ${args}`;
   }
+  const binName =
+    typeof binNameOrOpts === 'string' ? binNameOrOpts : binNameOrOpts?.binName;
   return `npx ${binName ?? pkg} ${args}`;
 }

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.425";
+export const CLI_VERSION = "0.1.426";