fix(build): stamp .version files from a script, not Bun-hostile subshell redirects

package.json

@@ -9,7 +9,7 @@
     "make-pdf": "./make-pdf/dist/pdf"
   },
   "scripts": {
-    "build": "bun run vendor:xterm && bun run gen:skill-docs --host all; bun build --compile browse/src/cli.ts --outfile browse/dist/browse && bun build --compile browse/src/find-browse.ts --outfile browse/dist/find-browse && bun build --compile design/src/cli.ts --outfile design/dist/design && bun build --compile make-pdf/src/cli.ts --outfile make-pdf/dist/pdf && bun build --compile bin/gstack-global-discover.ts --outfile bin/gstack-global-discover && bash browse/scripts/build-node-server.sh && ( git rev-parse HEAD 2>/dev/null || true ) > browse/dist/.version && ( git rev-parse HEAD 2>/dev/null || true ) > design/dist/.version && ( git rev-parse HEAD 2>/dev/null || true ) > make-pdf/dist/.version && chmod +x browse/dist/browse browse/dist/find-browse design/dist/design make-pdf/dist/pdf bin/gstack-global-discover && (rm -f .*.bun-build || true)",
+    "build": "bun run vendor:xterm && bun run gen:skill-docs --host all; bun build --compile browse/src/cli.ts --outfile browse/dist/browse && bun build --compile browse/src/find-browse.ts --outfile browse/dist/find-browse && bun build --compile design/src/cli.ts --outfile design/dist/design && bun build --compile make-pdf/src/cli.ts --outfile make-pdf/dist/pdf && bun build --compile bin/gstack-global-discover.ts --outfile bin/gstack-global-discover && bash browse/scripts/build-node-server.sh && bun run scripts/gen-version-files.ts && chmod +x browse/dist/browse browse/dist/find-browse design/dist/design make-pdf/dist/pdf bin/gstack-global-discover && (rm -f .*.bun-build || true)",
     "vendor:xterm": "mkdir -p extension/lib && cp node_modules/xterm/lib/xterm.js extension/lib/xterm.js && cp node_modules/xterm/css/xterm.css extension/lib/xterm.css && cp node_modules/xterm-addon-fit/lib/xterm-addon-fit.js extension/lib/xterm-addon-fit.js",
     "dev:make-pdf": "bun run make-pdf/src/cli.ts",
     "dev:design": "bun run design/src/cli.ts",

scripts/gen-version-files.ts

@@ -0,0 +1,39 @@
+#!/usr/bin/env bun
+// gen-version-files — stamp the current git SHA into each dist/.version file.
+//
+// This exists because Bun's shell (which runs npm scripts on Windows, where
+// there is no /bin/sh) cannot parse `( cmd ) > file`: it errors with
+// "Subshells with redirections are currently not supported" on every Bun
+// version (oven-sh/bun#11124, open). The build script previously stamped the
+// three .version files with `( git rev-parse HEAD 2>/dev/null || true ) >
+// path`, so `bun run build` aborted at parse time on Windows and blocked
+// `/gstack-upgrade` for every Windows user (gstack#1537). Doing the writes
+// from a Bun script sidesteps the shell entirely and is platform-agnostic.
+//
+// Semantics preserved from the old shell form: on success each file holds
+// the HEAD SHA, newline-terminated, byte-identical to `git rev-parse HEAD`;
+// if git is absent or this is not a repo, the file is created empty (the
+// old `2>/dev/null || true` discarded the error and produced an empty file).
+
+const TARGETS = [
+  "browse/dist/.version",
+  "design/dist/.version",
+  "make-pdf/dist/.version",
+];
+
+function gitHead(): string {
+  try {
+    const r = Bun.spawnSync(["git", "rev-parse", "HEAD"], {
+      stdout: "pipe",
+      stderr: "ignore",
+    });
+    return r.exitCode === 0 ? r.stdout.toString().trim() : "";
+  } catch {
+    return "";
+  }
+}
+
+const sha = gitHead();
+const content = sha ? `${sha}\n` : "";
+
+await Promise.all(TARGETS.map((target) => Bun.write(target, content)));

test/build-script-shell-compat.test.ts

@@ -13,9 +13,9 @@ function stripSingleQuoted(s: string): string {
   return s.replace(/'[^']*'/g, "''");
 }
 
-describe('package.json build scripts — POSIX shell compat (D-1460)', () => {
-  // Bun's Windows shell parser doesn't grok bash brace groups `{ cmd; }`.
-  // Subshells `( cmd )` are POSIX-universal. This test prevents regression.
+describe('package.json build scripts — Bun shell compat (D-1460, #11124)', () => {
+  // Bun's shell parser (used by `bun run <script>`) does not grok bash brace
+  // groups `{ cmd; }`. This test prevents regression.
   test('no bash brace groups in any npm script', () => {
     const offending: { script: string; pattern: string }[] = [];
     for (const [name, body] of Object.entries(PKG.scripts)) {
@@ -28,13 +28,30 @@ describe('package.json build scripts — POSIX shell compat (D-1460)', () => {
     expect(offending).toEqual([]);
   });
 
-  test('every `> path/.version` redirect is preceded by a subshell, not a brace group', () => {
-    // The original PR #1460 target: package.json line 12 had three of these.
+  // The original D-1460 fix assumed `( cmd ) > file` subshell redirects were
+  // the Bun-Windows-safe form and replaced brace groups with them. They are
+  // NOT: Bun's shell rejects redirections on subshells too — "Subshells with
+  // redirections are currently not supported" (oven-sh/bun#11124, still open
+  // on every Bun version). `bun run build` aborted at parse time on Windows
+  // because setup.sh runs the build through Bun's shell. The correct fix is
+  // to keep ALL command-output-to-.version redirects out of the build script
+  // and stamp the files from scripts/gen-version-files.ts (no shell at all).
+  test('build script has no shell redirect into a .version file', () => {
     const build = PKG.scripts.build ?? '';
-    const versionRedirects = [...build.matchAll(/(\([^)]*\)|\{[^}]*\})\s*>\s*\S+\/\.version/g)];
-    expect(versionRedirects.length).toBeGreaterThan(0);
-    for (const m of versionRedirects) {
-      expect(m[1].startsWith('(')).toBe(true);
+    const redirects = [...build.matchAll(/(\([^)]*\)|\{[^}]*\})\s*>\s*\S+\/\.version/g)];
+    expect(redirects.map((m) => m[0])).toEqual([]);
+    // A bare `cmd > path/.version` (no subshell/brace) would also be fragile
+    // once chained with `2>/dev/null`; nothing should redirect into .version.
+    expect(/>\s*\S*\/\.version/.test(build)).toBe(false);
+  });
+
+  test('build delegates .version stamping to the gen-version-files script', () => {
+    const build = PKG.scripts.build ?? '';
+    expect(build).toContain('bun run scripts/gen-version-files.ts');
+    expect(fs.existsSync(path.join(ROOT, 'scripts/gen-version-files.ts'))).toBe(true);
+    const script = fs.readFileSync(path.join(ROOT, 'scripts/gen-version-files.ts'), 'utf-8');
+    for (const t of ['browse/dist/.version', 'design/dist/.version', 'make-pdf/dist/.version']) {
+      expect(script).toContain(t);
     }
   });
 });