fix: address PR review findings

- .lintstagedrc.mjs: match ignore patterns against a POSIX-normalized
  relative path so a Windows-style staged path can't bypass an
  oxlint-ignored directory; add -- before staged paths in both oxlint
  invocations so a path shaped like an oxlint flag (e.g.
  --config=...) can't be parsed as one; use string replacement and
  unicode-mode regexes for the escape step.
- preflight.ts: forward the selected update version to the Windows
  installer via a PYTHINKER_VERSION env override (install.ps1 already
  reads it) instead of always installing whatever the CDN currently
  reports as latest.
- install.ps1: only remove a previous update's stale backup once the
  current target is confirmed present, so an interrupted prior update
  can't lose its only runnable executable; initialize $extractDir
  before entering the try block so a failure before its first
  assignment can't resolve a same-named variable left over in the
  caller's iex-hosted scope during cleanup.
- README.md: restore the Node.js badge to 26+ to match package.json's
  actual >=26.4.0 engine requirement.

Author: elkaix

.lintstagedrc.mjs

@@ -16,21 +16,29 @@ const OXLINT_IGNORE_PATTERNS = [
 const ignoreRegexes = OXLINT_IGNORE_PATTERNS.map((pattern) => {
   const isDir = pattern.endsWith('/');
   const body = isDir ? pattern.slice(0, -1) : pattern;
-  const escaped = body.replaceAll(/[.+^${}()|[\]\\]/g, '\\$&').replaceAll(/\*/g, '[^/]*');
-  return isDir ? new RegExp(`(^|/)${escaped}(/|$)`) : new RegExp(`(^|/)${escaped}$`);
+  const escaped = body.replaceAll(/[.+^${}()|[\]\\]/gu, '\\$&').replaceAll('*', '[^/]*');
+  return isDir
+    ? new RegExp(`(^|/)${escaped}(/|$)`, 'u')
+    : new RegExp(`(^|/)${escaped}$`, 'u');
 });
 
+// files are absolute, native-separator paths; match on the POSIX-style
+// relative path but keep the native path for the command line below.
 function lintableFiles(files) {
-  return files
-    .map((file) => relative(process.cwd(), file))
-    .filter((file) => !ignoreRegexes.some((re) => re.test(file)));
+  return files.filter((file) => {
+    const posixRelative = relative(process.cwd(), file).replaceAll('\\', '/');
+    return !ignoreRegexes.some((re) => re.test(posixRelative));
+  });
 }
 
 export default {
   '*.{js,jsx,ts,tsx,mjs,cjs,mts,cts}': (files) => {
     const targets = lintableFiles(files);
     if (targets.length === 0) return [];
     const quoted = targets.map((f) => JSON.stringify(f)).join(' ');
-    return [`oxlint --fix --quiet ${quoted}`, `oxlint --type-aware --quiet ${quoted}`];
+    return [
+      `oxlint --fix --quiet -- ${quoted}`,
+      `oxlint --type-aware --quiet -- ${quoted}`,
+    ];
   },
 };

README.md

@@ -11,7 +11,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@pythoughts/pythinker-code?style=for-the-badge&logo=npm&logoColor=white&color=CB3837&label=pythinker-code)](https://www.npmjs.com/package/@pythoughts/pythinker-code)
 [![Downloads](https://img.shields.io/npm/dm/@pythoughts/pythinker-code?style=for-the-badge&logo=npm&logoColor=white&color=16a34a&label=downloads)](https://www.npmjs.com/package/@pythoughts/pythinker-code)
-[![Node.js](https://img.shields.io/badge/Node.js-24%2B-339933?style=for-the-badge&logo=nodedotjs&logoColor=white)](https://github.com/Pythoughts-labs/pythinker-code/blob/main/package.json)
+[![Node.js](https://img.shields.io/badge/Node.js-26%2B-339933?style=for-the-badge&logo=nodedotjs&logoColor=white)](https://github.com/Pythoughts-labs/pythinker-code/blob/main/package.json)
 [![License: MIT](https://img.shields.io/badge/License-MIT-16a34a.svg?style=for-the-badge)](https://github.com/Pythoughts-labs/pythinker-code/blob/main/LICENSE)
 [![CI](https://img.shields.io/github/actions/workflow/status/Pythoughts-labs/pythinker-code/ci.yml?branch=main&label=CI&style=for-the-badge&logo=githubactions&logoColor=white)](https://github.com/Pythoughts-labs/pythinker-code/actions/workflows/ci.yml?query=branch%3Amain)
 

apps/pythinker-code/src/cli/update/preflight.ts

@@ -128,6 +128,7 @@ export function automaticUpdateModeFor(
 interface SpawnCommand {
   readonly cmd: string;
   readonly args: readonly string[];
+  readonly env?: Readonly<Record<string, string>>;
 }
 
 export function spawnForSource(
@@ -148,9 +149,13 @@ export function spawnForSource(
       return { cmd: 'brew', args: ['upgrade', 'pythinker-code'] };
     case 'native':
       if (platform === 'win32') {
+        // install.ps1 reads $env:PYTHINKER_VERSION when set instead of
+        // fetching the CDN's current latest, so the version this preflight
+        // decided on is the one actually installed.
         return {
           cmd: 'powershell.exe',
           args: ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command', NATIVE_INSTALL_COMMAND_WIN],
+          env: { PYTHINKER_VERSION: version },
         };
       }
       // `curl … | bash` reports only the trailing bash's exit status, so a
@@ -558,9 +563,12 @@ export async function installUpdate(
   version: string,
   platform: NodeJS.Platform,
 ): Promise<void> {
-  const { cmd, args } = spawnForSource(source, version, platform);
+  const { cmd, args, env } = spawnForSource(source, version, platform);
   await new Promise<void>((resolve, reject) => {
-    const child = spawn(cmd, [...args], { stdio: 'inherit' });
+    const child = spawn(cmd, [...args], {
+      stdio: 'inherit',
+      env: env === undefined ? undefined : { ...process.env, ...env },
+    });
     child.once('error', reject);
     child.once('exit', (code, signal) => {
       if (code === 0) {
@@ -737,7 +745,7 @@ async function startBackgroundInstall(
       source,
     });
 
-    const { cmd, args } = spawnForSource(source, target.version, platform);
+    const { cmd, args, env } = spawnForSource(source, target.version, platform);
     // The child can exit before the pid-persist below finishes, so buffer
     // the terminal outcome until the handler is "ready".
     let ready = false;
@@ -802,7 +810,11 @@ async function startBackgroundInstall(
       }
     };
 
-    const child = spawn(cmd, [...args], { detached: true, stdio: 'ignore' });
+    const child = spawn(cmd, [...args], {
+      detached: true,
+      stdio: 'ignore',
+      env: env === undefined ? undefined : { ...process.env, ...env },
+    });
     child.once('error', () => { void finish(false); });
     child.once('exit', (code) => { void finish(code === 0); });
     if (child.pid !== undefined && child.pid > 0) {

apps/pythinker-code/test/cli/update/preflight.test.ts

@@ -574,7 +574,11 @@ describe('runUpdatePreflight', () => {
           '-Command',
           'irm https://code.pythinker.com/pythinker-code/install.ps1 | iex',
         ],
-        { detached: true, stdio: 'ignore' },
+        {
+          detached: true,
+          stdio: 'ignore',
+          env: expect.objectContaining({ PYTHINKER_VERSION: '0.5.0' }),
+        },
       );
     } finally {
       Object.defineProperty(process, 'platform', { value: originalPlatform });
@@ -1506,7 +1510,7 @@ describe('spawnForSource native', () => {
   });
 
   it('win32: powershell.exe with -ExecutionPolicy Bypass and the irm|iex install command', () => {
-    const { cmd, args } = spawnForSource('native', '0.5.0', 'win32');
+    const { cmd, args, env } = spawnForSource('native', '0.5.0', 'win32');
     expect(cmd).toBe('powershell.exe');
     expect(args).toEqual([
       '-NoProfile',
@@ -1515,6 +1519,14 @@ describe('spawnForSource native', () => {
       '-Command',
       'irm https://code.pythinker.com/pythinker-code/install.ps1 | iex',
     ]);
+    // install.ps1 reads $env:PYTHINKER_VERSION instead of fetching the CDN's
+    // current latest, so the selected update version is the one installed.
+    expect(env).toEqual({ PYTHINKER_VERSION: '0.5.0' });
+  });
+
+  it('darwin/linux: no version env override (install.sh has no such hook)', () => {
+    const { env } = spawnForSource('native', '0.5.0', 'darwin');
+    expect(env).toBeUndefined();
   });
 });
 

apps/pythinker-web/public/install.ps1

@@ -494,6 +494,15 @@ New-Item -ItemType Directory -Path $tempDir | Out-Null
 $installerPath = Join-Path $tempDir $asset
 $shaPath = "$installerPath.sha256"
 
+# This script runs via `irm ... | iex`, which dot-sources it into the
+# caller's scope rather than a fresh function scope. If $extractDir were
+# only ever assigned inside the try block, a failure before that
+# assignment (e.g. a SHA mismatch) could leave the `finally` block
+# resolving a same-named variable left over in the caller's session and
+# recursively deleting it. Initialize it here so `finally` always sees
+# this script's own value.
+$extractDir = $null
+
 try {
   Download-WithProgress $installerUrl $installerPath
   Invoke-WebRequest -UseBasicParsing -Uri $shaUrl -OutFile $shaPath
@@ -524,9 +533,14 @@ try {
   # the running parent process or an AV scan.
   $target = Join-Path $installDir "pythinker.exe"
   $stale = "$target.old"
-  # Opportunistic cleanup of a previous update's leftover (may be locked; ignore).
-  if (Test-Path $stale) { Remove-Item -LiteralPath $stale -Force -ErrorAction SilentlyContinue }
   if (Test-Path $target) {
+    # A prior backup is obsolete only while the current target remains
+    # available. If $target is missing (a previous update was interrupted
+    # after the rename but before Move-Item), $stale is the only runnable
+    # executable — keep it until a replacement actually succeeds below.
+    if (Test-Path $stale) {
+      Remove-Item -LiteralPath $stale -Force -ErrorAction SilentlyContinue
+    }
     try {
       Rename-Item -LiteralPath $target -NewName "pythinker.exe.old" -Force -ErrorAction Stop
     } catch {
@@ -564,7 +578,7 @@ try {
 } finally {
   Write-Host -NoNewline $SHOW
   Remove-Item -Recurse -Force $tempDir -ErrorAction SilentlyContinue
-  if ($extractDir) {
-    Remove-Item -Recurse -Force $extractDir -ErrorAction SilentlyContinue
+  if ($null -ne $extractDir) {
+    Remove-Item -LiteralPath $extractDir -Recurse -Force -ErrorAction SilentlyContinue
   }
 }