[Bug]: updater fails to locate npm-cli.js when npm is managed by pnpm

[hjgyuhuk]

Product or interface

CLI - interactive TUI

Version

0.4.12

Platform

macOS

OS version and architecture

macOS 27 arm64

Issue area

Startup / install / update

Desktop log upload ID (optional)

No response

Steps to reproduce

MiniMax Code is installed successfully and runs normally:
curl -fsSL https://filecdn.minimax.chat/public/install.sh | bash

mcode --version
0.4.12

However, when the updater tries to update MiniMax Code, it fails with:

mcode update

Cannot locate npm-cli.js for the owned npm executable: /Volumes/KIOXIA/Applications/tools/.pnpm-home/npm
npm/pnpm layout

My npm executable is managed by pnpm and is located at:

/Volumes/KIOXIA/Applications/tools/.pnpm-home/npm

The npm executable is a shell shim generated by pnpm:

#!/bin/sh
basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")

if [ -x "$basedir/node" ]; then
  exec "$basedir/node" "$basedir/nodejs/26.3.1/lib/node_modules/npm/bin/npm-cli.js" "$@"
else
  exec node "$basedir/nodejs/26.3.1/lib/node_modules/npm/bin/npm-cli.js" "$@"
fi

The real npm CLI exists at:

/Volumes/KIOXIA/Applications/tools/.pnpm-home/nodejs/26.3.1/lib/node_modules/npm/bin/npm-cli.js

node -v
v26.3.1

npm -v
11.16.0

pnpm -v
10.32.1

Expected and actual behavior

The updater should either:

correctly resolve pnpm's npm shim to the real npm-cli.js, or
invoke the existing npm executable directly instead of assuming a particular npm filesystem layout.

Redacted error summary

Screenshots

No response

Before submitting

• I have searched existing issues.
• I have included my version and removed sensitive information.

[hetaoBackend]

Thanks for the concrete pnpm shim and filesystem layout. The current updater resolves npm through a small set of conventional npm-cli.js locations, which does not cover the versioned path in your example. I've started an isolated fix with regression coverage for that layout, while preserving the updater's Node/runtime binding. I'll link the PR here after local validation; no new release is available from this investigation yet.

[hetaoBackend]

The fix is now available for review in #177.

I reproduced the failure using synthetic directories matching the reported pnpm shim. The updater now reads the shim's literal, versioned npm CLI target without executing or sourcing the shell script, rejects ambiguous or escaping targets, and still invokes npm with the updater's selected Node. Existing ownership checks and conventional npm layouts are preserved.

Validation on commit 4547174aabbdb668914f21007c7ccae969d88f80: all 73 focused updater tests and the complete 14-gate pnpm verify full profile passed on macOS arm64 with Node 26.4.0 and pnpm 9.12.0. Tests include a synthetic npm CLI subprocess, regular symlinks, a Windows npm.cmd layout fixture, missing targets and symlink escapes.

This is not a release yet. I did not run a real product upgrade, live registry acceptance, the exact reported OS/Node/pnpm combination, or local Windows/Linux execution. The PR remains open for review.

[hetaoBackend]

CI update for PR #177 at 4547174aabbdb668914f21007c7ccae969d88f80: verification has now passed on Linux, macOS and Windows with Node 24, including the aggregate verification check. The Source verification run and Release audit run both completed successfully; CodeQL checks passed as well. Final PR status: 11 passed, 0 failed, 2 skipped (docs and [code]smith), nothing pending.

No additional code changes were needed. This adds cross-platform CI evidence; it does not establish a real product upgrade or live registry acceptance. The PR is still open and no release has been published.

[hetaoBackend]

Source update: #177 has now been merged as 63e8d578dfb9f4fa7d86bcdb53bb7618792473e3. The validated fix is in the default branch. This confirms source delivery, not that an installed npm package has been updated; the exact reporter environment and a real product upgrade remain outside the completed validation. Keeping this issue open for release/reporter follow-up.

[rishu685]

can i work on this issue now?