Fix Windows auto-upgrade for local CLI installs

[alfonso-noriega]

WHY are these changes introduced?

Reported by Nick Wesselman in #shopify-cli: on Windows, running shopify app dev (or any command) in a project where @shopify/cli is a project-local dependency still triggers the global auto-upgrade flow — it runs npm install -g @shopify/cli@latest after every command. Confirmed working correctly on macOS + Linux.

Root-cause analysis by River:

currentProcessIsGlobal() in packages/cli-kit/src/public/node/is-global.ts decides between global and local installs by comparing the project root against process.argv[1]:

const isLocal = binDir.startsWith(projectDir.trim())

• projectDir flows through getProjectDir → findPathUpSync → normalizePath (pathe). Pathe always normalizes to forward slashes on every platform → C:/Users/me/proj.
• process.argv[1] arrives in OS-native form. On Windows that's backslash-separated → C:\Users\me\proj\node_modules\@shopify\cli\bin\run.js.
• binDir.startsWith(projectDir) → false.
• The local install is classified as global → runCLIUpgrade() takes the global branch → npm install -g @shopify/cli@latest.

macOS + Linux are unaffected because their native argv[1] already uses /.

WHAT is this pull request doing?

Two-line behavioural fix + a regression test:

• packages/cli-kit/src/public/node/is-global.ts — replace the raw startsWith with isSubpath(projectDir, binDir), which goes through pathe.relative and tolerates either separator. Also bail early if argv[1] is empty so we don't accidentally classify "no script path" as "inside any directory".

• packages/cli-kit/src/public/node/is-global.test.ts — new test that constructs the exact Windows shape (projectDir = 'C:/Users/me/project', argv[1] = 'C:\\Users\\me\\project\\…'). The existing POSIX-shaped tests happened to agree on slashes when CI runs on Linux, which is why this slipped through.

• .changeset/fix-windows-autoupgrade-local-dep.md — patch on @shopify/cli-kit.

Scenario	OLD (startsWith)	NEW (isSubpath)	Expected
Windows local dep	❌ false	✅ true	local
macOS local dep	✅ true	✅ true	local
POSIX global	✅ false	✅ false	global
Windows global	✅ false	✅ false	global

How to test your changes?

cd packages/cli-kit
pnpm vitest run src/public/node/is-global.test.ts   # 18/18 ✓
pnpm type-check
pnpm lint

End-to-end, on Windows, in a project that has @shopify/cli declared in package.json:

$env:SHOPIFY_CLI_FORCE_AUTO_UPGRADE=1; npm run shopify -- version

Before: a global npm install -g @shopify/cli@latest runs after the command.
After: no global install runs — the project-local code path is taken (which, for now, also short-circuits per the auto-upgrade-skip-local change).

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows) — fix is specifically cross-platform; new test pins Windows shape
• I've considered possible documentation changes — N/A
• I've considered analytics changes to measure impact — none required
• The change is user-facing — patch-level changeset added on @shopify/cli-kit

Credit: bug reported by @nickwesselman; root-cause + suggested fix by River.

[alfonso-noriega]

/snapit

[github-actions]

🫰✨ Thanks @alfonso-noriega! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260515092709

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.