fix(cli): sign every install on upgrade

Installer needs a direct signer because reshim drops nvm.exe errors.

Refs #1412

Co-authored-by: Cursor 

Author: coreybutler

src/cmd/main.go

@@ -102,6 +102,14 @@ func main() {
 			os.Exit(1)
 		}
 		return
+	case "--sign-installed-versions":
+		// Installer upgrade from 2.0.0: backfill script trust for every installs\v*.
+		settings.Load()
+		if err := verifycache.PrewarmVerifyCache(true); err != nil {
+			fmt.Fprint(os.Stderr, err.Error())
+			os.Exit(1)
+		}
+		return
 	case "--sign-version-scripts":
 		// Invoked by detached reshim after global package installs so proxy
 		// can trust newly written .cmd/.bat launchers without executing them first.

src/commands/env.go

@@ -577,7 +577,7 @@ func untrustedHandlerLabel(raw string) string {
 // summarizeTrustedModules returns "ALL" when everything is trusted, otherwise
 // the count of positive (allow) TrustedModules patterns.
 func summarizeTrustedModules(entries []string) string {
-	rules := modulefirewall.NormalizeList(entries, modulefirewall.DefaultTrustedWhenEmpty)
+	rules := modulefirewall.NormalizeTrustedModules(entries)
 	if endpoint, ok := modulefirewall.ExtractHTTPSURL(rules); ok {
 		return endpoint
 	}

src/commands/env_test.go

@@ -12,7 +12,7 @@ func TestSummarizeTrustedModules(t *testing.T) {
 		entries []string
 		want    string
 	}{
-		{name: "empty defaults to zero", entries: nil, want: "0"},
+		{name: "empty defaults to npm and npx", entries: nil, want: "2"},
 		{name: "not all alone", entries: []string{"NOT ALL"}, want: "0"},
 		{name: "all", entries: []string{"ALL"}, want: "ALL"},
 		{name: "exceptions", entries: []string{"NOT ALL", "opencode", "porthog"}, want: "2"},