Skip to content

fix(install): don't clobber an npm-managed CLI during --agents upgrade - #1039

Merged
codyde merged 2 commits into
masterfrom
fix/installer-npm-guard
Aug 3, 2026
Merged

fix(install): don't clobber an npm-managed CLI during --agents upgrade#1039
codyde merged 2 commits into
masterfrom
fix/installer-npm-guard

Conversation

@codyde

@codyde codyde commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

With an outdated npm install on PATH, command -v railway is a symlink into <prefix>/lib/node_modules/@railway/cli/bin/railway.js, so EXISTING_BIN_DIR became npm's bin dir and install.sh extracted a raw binary over npm's symlink.

npm still records the package as its own, so a later npm uninstall -g @railway/cli deletes the binary install.sh just installed — leaving no railway at all. npm install -g reverts it the other way.

Mirrors the existing Homebrew branch: detect npm-owned installs, warn, point at npm install -g @railway/cli@latest, and continue agent setup with the CLI already present. Refuse early for --remote, which needs a newer CLI.

Addresses suggested fix 4 in #990.

Verification

  • outdated npm install: npm symlink left intact, no ~/.railway/bin created
  • --remote + npm: refuses with exit 1
  • non-npm install: still upgrades in place

🤖 Generated with Claude Code

With an outdated npm install on PATH, `command -v railway` is a symlink into
<prefix>/lib/node_modules/@railway/cli/bin/railway.js, so EXISTING_BIN_DIR
became npm's bin dir and install.sh extracted a raw binary over npm's symlink.
npm still records the package as its own, so a later `npm uninstall -g
@railway/cli` deletes the binary install.sh just installed, leaving no railway
at all.

Detect npm-owned installs and mirror the existing Homebrew branch: warn, point
at `npm install -g @railway/cli@latest`, and continue agent setup with the CLI
that is already there. Refuse early for --remote, which needs a newer CLI.

Verified: npm symlink left intact and no ~/.railway/bin created; --remote
refuses with exit 1; non-npm installs still upgrade in place.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@codyde codyde added release/patch Author patch release release/skip Author no release and removed release/patch Author patch release labels Aug 3, 2026
pnpm's global bin entry is a /bin/sh shim, not a symlink into node_modules, so
the node_modules/.js checks alone missed it. Every release we publish is a
native executable, so treat any `railway` on PATH that starts with a shebang as
someone else's wrapper — which covers pnpm, and hand-rolled wrappers we equally
should not overwrite. Verified: npm, pnpm, yarn and bun are all detected, and a
real ELF/Mach-O install is not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@codyde
codyde merged commit 654c996 into master Aug 3, 2026
6 checks passed
@codyde
codyde deleted the fix/installer-npm-guard branch August 3, 2026 06:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release/skip Author no release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant