postinstall uses POSIX `rm`, breaking `npm install` on Windows without Git Unix tools on PATH (4.9.0+)

[jyoung15]

I have checked that the SDK documentation doesn't solve my issue.

• Yes I've checked them.

I have checked that the API documentation doesn't solve my issue.

• Yes I've checked them.

I have checked that the Box Developer Forums doesn't solve my issue.

• Yes I've checked them.

I have searched Issues in this repo and my issue isn't already reported.

• Yes I've checked them.

Describe the bug

@box/cli@4.9.0 added a postinstall script that uses a POSIX-only command:

"postinstall": "rm -rf ./node_modules/@github/keytar/build"

npm executes lifecycle scripts on Windows through cmd.exe, which has no rm. On a Windows machine that does not have Git for Windows' Unix tools directory (C:\Program Files\Git\usr\bin) on PATH, installing any of 4.9.0 / 4.9.1 / 4.9.2 fails:

npm error command failed
npm error command C:\Windows\system32\cmd.exe /d /s /c rm -rf ./node_modules/@github/keytar/build
npm error 'rm' is not recognized as an internal or external command,
npm error operable program or batch file.

Why your Windows CI is green: the GitHub Actions windows-latest image installs Git for Windows with /o:PathOption=CmdTools (see images/windows/scripts/build/Install-Git.ps1 in actions/runner-images). That installer option adds C:\Program Files\Git\usr\bin — which contains GNU rm.exe — to the machine PATH. So the "Node XX on windows-latest" jobs execute the postinstall successfully, and this regression is structurally invisible to CI. A stock Windows box with only Node.js installed fails.

The script appears to have been introduced alongside the keytar → @github/keytar switch (#688) and first shipped in 4.9.0 (2026-06-01). Every release through 4.8.2 has no install hooks and installs cleanly in the same environment.

Suggested fix — portable and dependency-free (Node ≥ 14.14):

"postinstall": "node -e \"require('fs').rmSync('node_modules/@github/keytar/build',{recursive:true,force:true})\""

rimraf or shx rm -rf would also work, at the cost of adding a dependency to every consumer install.

Workarounds for affected users until a fix ships: install @box/cli@4.8.2, or prepend C:\Program Files\Git\usr\bin to PATH for the install session.

Note: the failure happens during package installation, before any authentication occurs, so the auth method and app access level selected below are not relevant to reproducing it.

Disclosure: this report was prepared with AI assistance (Anthropic's Claude). The failure was observed firsthand on my machine; the version history, the introduction of the postinstall in 4.9.0, and the runner-image PATH behavior were checked against the npm registry, actions/runner-images, and the Git for Windows installer source (build-extra/installer/install.iss).

Expected behavior

npm install -g @box/cli completes on a stock Windows machine with only Node.js installed. Lifecycle scripts in a published CLI should not depend on Git for Windows' optional Unix tools being on PATH — the package declares no os restriction and Windows is a supported platform.

Steps to reproduce

On any Windows machine where GNU coreutils are not on PATH — the default unless Git for Windows was installed with the non-default "Use Git and optional Unix tools from the Command Prompt" option:

1. Confirm the environment:

   where rm
   INFO: Could not find files for the given pattern(s).

2. Run:

   npm install -g @box/cli@4.9.2

3. The install fails during @box/cli@4.9.2 postinstall with 'rm' is not recognized as an internal or external command, and npm rolls back.

Local (non-global) install reproduces identically:

mkdir repro && cd repro && npm init -y && npm install @box/cli@4.9.2

Control: npm install -g @box/cli@4.8.2 succeeds in the identical environment.

Authentication method used in your application

User Authentication (OAuth 2.0)

App Access Level

App Access Only

What is Box CLI Version and Node used?

@box/cli@4.9.2 (install fails, so box --version is unavailable); Node v26.7.0, npm 11.19.0

What is your Operating System Version?

Microsoft Windows [Version 10.0.26200.9168]