@aedis/cli 0.1.3 → 0.1.4

package/README.md

@@ -6,9 +6,9 @@ before any file is written, npm dependencies are pinned to exact versions at lea
 script runs.
 
 ```bash
-npx @aedis/cli@0.1.3 init
-npx @aedis/cli@0.1.3 add button approval-card
-npx @aedis/cli@0.1.3 diff
+npx @aedis/cli@0.1.4 init
+npx @aedis/cli@0.1.4 add button approval-card
+npx @aedis/cli@0.1.4 diff
 ```
 
 Always pin the version, as above. Never run `npx aedis`: the unscoped `aedis` package on npm is not this one.

package/dist/aedis.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { verify } from "sigstore";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { gunzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
 //#region ../../apps/www/lib/untrusted.ts
 /**
 * Invisible code points that carry no visible text but can hide instructions from the person reading while an
@@ -1588,7 +1588,7 @@ function planFiles(items, config, root) {
 }
 //#endregion
 //#region src/cli.ts
-const VERSION = "0.1.3";
+const VERSION = "0.1.4";
 /** What `aedis init` installs: config, theme tokens, cn and the security primitives. */
 const INIT_ITEMS = [
 	"theme",
@@ -1752,7 +1752,7 @@ async function run(argv, io) {
 		}
 		if (!existsSync(path.join(root, "package.json"))) throw new Error(`${root} has no package.json; run inside your app`);
 		if (command === "init") {
-			const config = readConfig(root) ?? defaultConfig(root, flags.release ?? `v0.1.3`);
+			const config = readConfig(root) ?? defaultConfig(root, flags.release ?? `v0.1.4`);
 			if (!isRelease(config.release)) throw new Error(`invalid release ${config.release}`);
 			const decoded = flags.preset === void 0 ? null : decodePreset(flags.preset);
 			if (decoded && !decoded.ok) throw new Error(`preset refused: ${decoded.error}`);
@@ -1788,7 +1788,7 @@ ${themeToCss(theme)}
 		}
 		if (command === "theme" && args[0] === "import") {
 			if (!args[1]) throw new Error("theme import: give the theme's JSON file");
-			const config = readConfig(root) ?? defaultConfig(root, `v0.1.3`);
+			const config = readConfig(root) ?? defaultConfig(root, `v0.1.4`);
 			const input = insideProject(root, path.relative(root, path.resolve(io.cwd, args[1])));
 			const result = themeImport(readFileSync(input, "utf8"), path.basename(input));
 			if (!result.ok) {
@@ -1812,20 +1812,43 @@ ${themeToCss(theme)}
 	}
 }
 //#endregion
-//#region src/main.ts
-const code = await run(process.argv.slice(2), {
-	cwd: process.cwd(),
-	fetcher: fetch,
-	check: (bundle, options) => verify(bundle, options),
-	spawn: (command, args, { cwd, env }) => spawnSync(command, args, {
+//#region src/spawn.ts
+const PLAIN = /^[\w@./:=~-]+$/;
+/**
+* Runs a package manager without `shell: true` (Node's DEP0190). On Windows npm, pnpm and yarn are .cmd shims that
+* only cmd.exe can start (Node refuses to spawn a .cmd directly), so cmd.exe is spawned explicitly, and only with
+* arguments that hold no metacharacter; elsewhere the command is spawned directly.
+*/
+function runPackageManager(command, args, { cwd, env }, spawn = spawnSync, platform = process.platform) {
+	let file = command;
+	let argv = args;
+	if (platform === "win32") {
+		for (const arg of [command, ...args]) if (!PLAIN.test(arg)) throw new Error(`refusing to pass ${JSON.stringify(arg)} to cmd.exe`);
+		file = process.env.ComSpec ?? "cmd.exe";
+		argv = [
+			"/d",
+			"/c",
+			command,
+			...args
+		];
+	}
+	return spawn(file, argv, {
 		cwd,
 		env: {
 			...process.env,
 			...env
 		},
 		stdio: "inherit",
-		shell: process.platform === "win32"
-	}).status ?? 1,
+		windowsHide: true
+	}).status ?? 1;
+}
+//#endregion
+//#region src/main.ts
+const code = await run(process.argv.slice(2), {
+	cwd: process.cwd(),
+	fetcher: fetch,
+	check: (bundle, options) => verify(bundle, options),
+	spawn: runPackageManager,
 	confirm: async (question) => {
 		if (!process.stdin.isTTY) return false;
 		const rl = createInterface({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aedis/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Add Aedis UI components to your app with verified provenance: signed releases, exact and aged dependencies, no install scripts.",
   "keywords": [
     "aedis",