Local-first
Walks node_modules from the current directory upward, then the global root. The nearest install
satisfying the range wins, and upx spawns its binary directly.
upx
Run a CLI from the copy already on the machine. Fall back to npx only when there isn't one.
npm i -g @repobuddy/upx
upx semver@^7 --coerce v1.2Ranges, not pins
Matching ^1 rather than 1.2.3 is the point — one global install serves every caller on that
major.
Transparent
The child owns stdout, stderr, and the exit code. upx never wraps or reformats output, and
installs nothing.
Honest about cost
It is a latency fix, not a correctness fix. The tradeoffs are documented as carefully as the wins.