Fix Windows installation: complete PHP distribution, adm-zip extraction, and safe file stream handling

[Copilot]

Windows installs failed because the tool invoked unzip (not available on Windows), used a bare php binary path, and the custom php-win.zip only contained a 178 KB thin php.exe launcher stub without php8.dll — the actual PHP engine required to run.

Changes

• PHP binary extraction: Replaced unzip shell command with adm-zip for .zip archives on Windows — no system dependency required.

• PHP_BIN path: Added IS_WINDOWS flag; PHP_BIN now resolves to php.exe on Windows so execSync can actually run it:

  const IS_WINDOWS = os.platform() === "win32";
  const PHP_BIN = path.join(BIN_DIR, IS_WINDOWS ? "php.exe" : "php");

• Official PHP Windows distribution: Added PHP_WIN_URL pointing to the official windows.php.net release which bundles php.exe, php8.dll, and all required runtime DLLs. The custom php-win.zip in souravdutt/php-binaries only ships the thin launcher without php8.dll, causing php.exe -v to fail immediately:

  const PHP_WIN_URL = `https://windows.php.net/downloads/releases/php-${RELEASE}-nts-Win32-vs17-x64.zip`;

  setupBinaries() now uses this URL on Windows instead of the incomplete custom binary.

• phpFile exact match on Windows: Changed the PHP binary finder from .endsWith(".exe") to f === "php.exe" to prevent accidentally selecting phpdbg.exe from the official distribution.

• downloadFile redirect handling: The original code opened a WriteStream then immediately called downloadFile recursively on redirect without closing the first handle. On Windows, open handles are exclusively locked — this would cause the second write to fail. Fixed by closing the stream in a callback before recursing:

  if (response.statusCode === 301 || response.statusCode === 302) {
    file.close(() => {
      downloadFile(response.headers.location, dest, label).then(resolve).catch(reject);
    });
    return;
  }

• HTTP error detection: downloadFile now rejects immediately on non-200 responses (with cleanup inside the file.close() callback) to prevent a 404 HTML page from being silently saved as a zip and failing extraction later.

• fs.unlinkSync safety: Error handler now closes the stream first (with reject inside the callback) and guards with fs.existsSync before unlinking, ensuring cleanup completes before the promise rejects and preventing a throw when the connection fails before any bytes are written.

• Skip redundant rename: fs.renameSync is now skipped when source and destination paths are identical (e.g. php.exe → php.exe on Windows).

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Unable to install in windows</issue_title>
<issue_description>```
PS C:\Users\DELL> npm create s6-app@latest my-app

npx
create-s6-app my-app

⠋ Setting up Laravel environment...
⚙️ Setting up Laravel installer...
⬇️ Downloading PHP binary for win...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 0
100 9.23M 100 9.23M 0 0 3.71M 0 00:02 00:02 3.25M
📦 Extracting PHP binary...
'unzip' is not recognized as an internal or external command,
operable program or batch file.
✖ Setup failed.
Error: Command failed: unzip -o C:\Users\DELL\bin\php-win.zip -d C:\Users\DELL\bin
at genericNodeError (node:internal/errors:983:15)
at wrappedFn (node:internal/errors:537:14)
at checkExecSyncError (node:child_process:916:11)
at execSync (node:child_process:988:15)
at run (file:///C:/Users/DELL/AppData/Local/npm-cache/_npx/46fda8635afc74d6/node_modules/create-s6-app/src/setupLaravel.js:32:3)
at setupBinaries (file:///C:/Users/DELL/AppData/Local/npm-cache/_npx/46fda8635afc74d6/node_modules/create-s6-app/src/setupLaravel.js:66:7)
at setupLaravel (file:///C:/Users/DELL/AppData/Local/npm-cache/_npx/46fda8635afc74d6/node_modules/create-s6-app/src/setupLaravel.js:134:9)
at main (file:///C:/Users/DELL/AppData/Local/npm-cache/_npx/46fda8635afc74d6/node_modules/create-s6-app/src/index.js:198:56)
at file:///C:/Users/DELL/AppData/Local/npm-cache/_npx/46fda8635afc74d6/node_modules/create-s6-app/bin/cli.js:4:1
at ModuleJob.run (node:internal/modules/esm/module_job:343:25) {
status: 1,
signal: null,
output: [ null, null, null ],
pid: 6972,
stdout: null,
stderr: null
}
npm error code 1
npm error path C:\Users\DELL
npm error command failed
npm error command C:\WINDOWS\system32\cmd.exe /d /s /c create-s6-app my-app
npm error A complete log of this run can be found in: C:\Users\DELL\AppData\Local\npm-cache_logs\2026-03-13T13_57_29_049Z-debug-0.log

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes Unable to install in windows #2

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

[souravdutt]

@copilot
PS C:\Users\DELL\Desktop\create-s6-app> npm run test

create-s6-app@1.2.3 test
node bin/cli.js test-s6-app

✔ Downloading PHP binary for win complete!
✔ PHP binary extracted!
✔ Composer binary already exists
❌ PHP runtime test failed. Check downloaded binary.

[Copilot]

@copilot
PS C:\Users\DELL\Desktop\create-s6-app> npm run test

...

The PHP runtime failure was caused by the php-win.zip in souravdutt/php-binaries only containing a 178 KB thin launcher php.exe — without php8.dll (the actual PHP engine). Without it, php.exe -v exits immediately with a missing-DLL error.

Fixed in commit a43ad47 by switching the Windows PHP download to the official windows.php.net distribution (php-8.4.14-nts-Win32-vs17-x64.zip) which bundles php.exe, php8.dll, and all required runtime DLLs. Three additional hardening changes were included:

• phpFile finder now matches php.exe exactly on Windows (previously endsWith(".exe") could match phpdbg.exe)
• downloadFile now rejects immediately on non-200 HTTP responses (prevents a corrupt file from being silently saved and then failing extraction)
• Cleanup (unlinkSync) is now done inside file.close() callbacks so it completes before the promise rejects

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/souravdutt/php-binaries/releases/tags/8.4.14
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• windows.php.net
  • Triggering command: `/usr/bin/python3 python3 -c
    import urllib.request

Test if official PHP windows download is accessible and what URL format works

url = 'REDACTED'
try:
response = urllib.request.urlopen(url, timeout=15)
content = response.read().decode('ut` (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)