[Banner-Keith]

Fix pnpm minimumReleaseAge across versions, Windows pnpm spawning, and Yarn edge cases

Thanks for the quick fix for #97 (24c624a). While testing it on Windows and against newer pnpm releases, I ran into a few follow-ups. Currently update-db doesn't run on windows. This should resolve that.

Sorry it took so long. I had to get some approvals and reviews done within my company to approve me pushing this change.

Background

pnpm 11 enabled minimumReleaseAge by default, and strict mode rejects pnpm up --no-save. 24c624a handles that by catching ERR_PNPM_STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE and falling back to temporary overrides pinned to the newest policy-compliant versions.

pnpm has changed again since then:

• pnpm 12.4.2+ (pnpm/pnpm#14835): up --no-save now resolves mature versions natively and succeeds, so the fallback is never reached. The existing "respects strict pnpm minimumReleaseAge" test assumed the 12.0–12.4.1 behavior and fails on 12.4.2+.
• Older pnpm releases report the same situation with different error codes, so the fallback wasn't triggered for them.

Changes

• pnpm: trigger the fallback on the pnpm 10 and 11 error codes as well. 12.4.2+ succeeds before reaching it.
• Windows: pnpm is a .cmd shim, which execFileSync can't launch without a shell (spawnSync pnpm ENOENT, as reported on 1.3.3). A small runPnpm helper uses a shell on win32 with argument quoting, and refuses args containing % or ! since cmd.exe expands them even inside quotes. Missing-binary detection also recognizes cmd.exe's "is not recognized" message.
• Yarn: a clear error when the lockfile is Yarn v1 but the installed Yarn is Berry (instead of an opaque failure), and CRLF lockfiles are normalized before parsing so versions are detected.

Tests

• Strict minimumReleaseAge test: it now asserts whichever path the installed pnpm takes. On 12.0.0–12.4.1 the fallback runs, with the same assertions as before. On other versions pnpm updates natively, so the test checks that the fallback did not run, package.json is untouched, and the lockfile moved off the old version. It doesn't assert the exact resolved version, since that depends on whether the registry serves per-version publish times (pnpm#13741).
• Tool detection: the 2>/dev/null probes are replaced with an isInstalled() helper using stdio: 'ignore'. On Windows, cmd.exe choked on the redirect and made installed tools look missing.
• Yarn lockfile checks: checkYarnLockfile normalizes CRLF, since Yarn Berry writes native line endings on Windows.
• New tests:
  • A v1 lockfile with a Yarn Berry binary reports the classic/Berry mismatch.
  • A package manager failure that mentions an unrelated "not recognized" command is rethrown instead of being reported as a missing binary.
• Existing "rethrows package manager errors" test: now uses a .cmd shim and path.delimiter on Windows, so it runs on both platforms.

Notes

• The Windows quoting is the part I'd most appreciate a careful look at.
• The CI jobs and the Yarn changes are independent of the pnpm fix and easy to drop or split out.
• I installed Bun, Deno, Yarn, and pnpm for local testing.
• I ran all CI tests and they passed

Windows CI Tests

I added Windows jobs so the shell/quoting test path is exercised. These can be left out of the PR if you don't want windows CI jobs. I have run them through GitHub actions and they did pass on my GitHub fork.

[ai]

Thanks. Released in 1.3.4.