fix(cli): run bundled wrangler binary instead of npx

[stordahl]

Fixes #256

Problem

Running npx @counterscale/cli@latest install fails with:

✘ [ERROR] Processing /var/folders/.../counterscale-XXXX/wrangler.json configuration:
    - "assets.bucket" is a required field.

Root cause

The CLI spawned bare npx wrangler for every wrangler invocation (whoami, secret list, secret put, deploy). npx resolves wrangler from the user's environment — the npx cache entry keyed by the bare wrangler spec (which is never auto-upgraded once cached), PATH, or a parent node_modules — not the wrangler bundled with @counterscale/cli.

When that resolution lands on wrangler < 3.78.10, it misinterprets the modern assets: { directory } config in packages/server/wrangler.json as legacy Workers Sites config and throws exactly this error (documented in Cloudflare's troubleshooting docs).

Verified by running wrangler 3.60.0 against a CLI-staged config (reproduces the exact error), while the wrangler bundled with the CLI (4.x) parses the same config fine.

Fix

• Add getBundledWranglerBinPath() which resolves bin/wrangler.js inside the CLI's own pinned wrangler@^4.23.0 dependency (via createRequire(...).resolve("wrangler/package.json"), which wrangler's exports map allows)
• All spawn sites now run node <bundled-bin> via wranglerArgv(), falling back to the old npx wrangler behavior only if resolution fails
• The fallback is no longer silent: a console.warn explains which wrangler is being used if the bundled binary can't be resolved; the resolved path is memoized
• Note: wrangler 4.x requires Node 18+, so node <bin> implicitly raises the runtime floor — @counterscale/cli already requires Node >= 20 (engines field), so this is a non-issue in practice

Testing

• Reproduced the reported error with a real old wrangler against a CLI-staged config; confirmed the bundled wrangler parses it successfully
• 6 new tests in cloudflare.test.ts covering bundled-binary resolution, memoization, the argv used by whoami / secret list, the npx fallback, and the resolution-failure warnings
• @counterscale/cli: 109/109 tests pass, typecheck clean

Follow-up

• fix(cli): avoid piping secrets through echo when using wrangler secret put #267 — secrets are currently piped through echo into wrangler secret put; special characters (newlines, $, backticks) can be mangled. Worth switching to stdin piping without a shell pipeline.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.68%. Comparing base (fe226f6) to head (fb6195f).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #265      +/-   ##
==========================================
- Coverage   83.90%   82.68%   -1.22%     
==========================================
  Files          55       56       +1     
  Lines        1882     2010     +128     
  Branches      518      539      +21     
==========================================
+ Hits         1579     1662      +83     
- Misses        267      310      +43     
- Partials       36       38       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.