feat: bundle private Windows runtimes with settings switches

scripts/runtime-transform.mjs

@@ -0,0 +1,33 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+// Deterministic extraction transforms. No native Windows programs run here.
+export async function transformRuntime(id, target) {
+  if (id === 'node') {
+    for (const name of ['npm.ps1', 'npx.ps1']) await fs.rm(path.join(target, name), { force: true })
+  }
+  if (id === 'python') {
+    await fs.mkdir(path.join(target, 'Scripts'), { recursive: true })
+    const wrapper = '@echo off\r\n"%~dp0..\\python.exe" -m pip %*\r\n'
+    for (const name of ['pip.cmd', 'pip3.cmd']) await fs.writeFile(path.join(target, 'Scripts', name), wrapper)
+  }
+  if (id === 'git') {
+    // PortableGit's 13-copy-dlls.post normally hardlinks these after extraction.
+    // Copies are relocation-safe and survive installer/archive packaging.
+    const bin = path.join(target, 'ucrt64/bin')
+    const exec = path.join(target, 'ucrt64/libexec/git-core')
+    for (const name of (await fs.readdir(bin)).filter(name => name.endsWith('.dll')).sort()) {
+      await fs.copyFile(path.join(bin, name), path.join(exec, name))
+    }
+    await fs.copyFile(path.join(bin, 'git.exe'), path.join(exec, 'dlls-copied'))
+    for (const name of ['shm', 'mqueue']) {
+      await fs.mkdir(path.join(target, 'dev', name), { recursive: true })
+      await fs.writeFile(path.join(target, 'dev', name, 'YCODE-KEEP.txt'), '')
+    }
+    const audit = path.join(target, 'ycode-upstream-post-install')
+    await fs.mkdir(audit, { recursive: true })
+    await fs.rename(path.join(target, 'etc/post-install'), path.join(audit, 'scripts'))
+    await fs.rename(path.join(target, 'post-install.bat'), path.join(audit, 'post-install.bat'))
+    // Do not snapshot build-host /etc or synthesize Windows MSYS symlinks on Linux.
+    // Upstream scripts are moved out of etc/post-install so login Bash cannot mutate resources.
+  }
+}