@atbash/cli 0.5.15 → 0.6.1-dev.2

package/dist/shared/win-exec.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isWindowsShim = isWindowsShim;
+exports.quoteArg = quoteArg;
+exports.escapeForCmd = escapeForCmd;
+exports.cmdLineFor = cmdLineFor;
+exports.spawnPortable = spawnPortable;
+exports.pickExecutable = pickExecutable;
+/**
+ * Launching an npm-installed CLI on Windows, without opening a shell seam.
+ *
+ * `openclaw`, `hermes`, `npm` and every other Node CLI arrive on Windows as a
+ * `.cmd` shim, and a `.cmd` is not an executable — CreateProcess cannot run one.
+ * Node used to paper over that; since 18.20.2 / 20.12.2 (the CVE-2024-27980 fix)
+ * it refuses outright, and `spawnSync("openclaw.cmd", …)` fails with EINVAL
+ * unless the call goes through a shell. That is why every `openclaw` probe
+ * answered "could not run" on Windows while working everywhere else: detection
+ * did not misread the machine, it never reached the binary at all.
+ *
+ * ⚠️ THE OBVIOUS REPAIR, `shell: true`, IS THE WRONG ONE HERE. It concatenates
+ * the command and its arguments into ONE string for `cmd.exe` to re-parse, so a
+ * `&`, `|` or `%VAR%` anywhere in an argument — or in the install path, which is
+ * read off `where` and was never written by us — stops being data and becomes
+ * another command. This tool governs whether an agent's actions are allowed to
+ * happen; it does not get to introduce shell injection into its own probe path.
+ *
+ * So a shim is routed through `cmd.exe /d /s /c` explicitly, with the command
+ * line built here: each token is quoted for the child's own CRT parser and then
+ * caret-escaped for the `cmd.exe` pass that happens first. `shell: true` skips
+ * that second step, which is exactly the part that matters.
+ *
+ * Everything off Windows, and every real `.exe`, is spawned directly as before.
+ */
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+/** Batch shims — the two extensions `cmd.exe` must interpret for us. */
+const SHIM = /\.(cmd|bat)$/i;
+/**
+ * What `cmd.exe` acts on before the child ever sees the line.
+ *
+ * `%` is in here because `%FOO%` is expanded during that pass, which would
+ * otherwise substitute an environment variable into an argument — or blank it.
+ */
+const CMD_META = /[()%!^"<>&|]/g;
+/** Does this command need `cmd.exe` to run at all? */
+function isWindowsShim(command) {
+    return process.platform === "win32" && SHIM.test(command);
+}
+/**
+ * Quote one token the way the child's C runtime will parse it back.
+ *
+ * The backslash rule is the unobvious half: a backslash is literal EXCEPT in the
+ * run immediately before a quote, where each one must be doubled. `C:\dir\` as
+ * the last token would otherwise end `"C:\dir\"` — an escaped quote, which
+ * swallows the rest of the line.
+ */
+function quoteArg(arg) {
+    if (arg === "")
+        return '""';
+    if (!/[\s"\\]/.test(arg))
+        return arg;
+    const escaped = arg
+        .replace(/(\\*)"/g, '$1$1\\"') // double the run before a real quote, then escape it
+        .replace(/(\\*)$/, "$1$1"); // and the run before the quote we are about to add
+    return `"${escaped}"`;
+}
+/**
+ * Caret-escape a token for the `cmd.exe` parse.
+ *
+ * The quotes added by {@link quoteArg} are escaped too, deliberately. An escaped
+ * quote is literal text to `cmd.exe`, so it does not open a quoted section
+ * there, and arrives at the child as the plain `"` its CRT is expecting.
+ */
+function escapeForCmd(token) {
+    return token.replace(CMD_META, "^$&");
+}
+/** Build the full `cmd.exe` command line for a shim and its arguments. */
+function cmdLineFor(command, args) {
+    return [command, ...args].map((a) => escapeForCmd(quoteArg(a))).join(" ");
+}
+/**
+ * `spawnSync`, but a Windows `.cmd`/`.bat` shim actually runs.
+ *
+ * Identical to `spawnSync` in every other case — same arguments, same return —
+ * so it is a drop-in at the call sites that probe an external CLI.
+ */
+function spawnPortable(command, args, options = {}) {
+    if (process.platform !== "win32") {
+        return (0, child_process_1.spawnSync)(command, args, options);
+    }
+    // A bare name like `openclaw` or `hermes` hides the problem rather than
+    // avoiding it: the PATH search resolves it to the same `.cmd`, and the launch
+    // fails just as hard, only without an extension to recognize it by. Resolve
+    // first, then decide.
+    const resolved = resolveOnWindows(command);
+    if (!isWindowsShim(resolved)) {
+        return (0, child_process_1.spawnSync)(resolved, args, options);
+    }
+    // `/d` skips AutoRun commands from the registry — someone else's startup script
+    // has no business running inside a read-only probe. `/s` fixes the quote rule to
+    // "strip the first and last", which is what makes the wrapping pair below safe.
+    const comspec = process.env.ComSpec || process.env.COMSPEC || "cmd.exe";
+    return (0, child_process_1.spawnSync)(comspec, ["/d", "/s", "/c", `"${cmdLineFor(resolved, args)}"`], {
+        ...options,
+        // Node must pass our line through untouched — it is already quoted correctly,
+        // and a second round of Node's own quoting would break the escaping above.
+        windowsVerbatimArguments: true,
+    });
+}
+/**
+ * Turn a bare command name into the file Windows will actually launch.
+ *
+ * Anything already carrying a path is left alone — the caller has resolved it,
+ * and re-resolving could pick a different install off PATH than the one they
+ * meant. A name with no path goes through `where`, which is the same lookup the
+ * shell would do, so the answer matches what the operator sees.
+ */
+function resolveOnWindows(command) {
+    if (path_1.default.isAbsolute(command) || command.includes("\\") || command.includes("/"))
+        return command;
+    const where = (0, child_process_1.spawnSync)("where", [command], { encoding: "utf8" });
+    if (where.status !== 0)
+        return command;
+    return pickExecutable((where.stdout ?? "").split(/\r?\n/)) ?? command;
+}
+/**
+ * Pick the runnable match out of `where` output.
+ *
+ * `where openclaw` lists BOTH the extensionless POSIX-style script npm writes for
+ * Git Bash and the `openclaw.cmd` Windows actually uses, in that order. Taking
+ * the first line — which is what this did — hands back the one file on the list
+ * that Windows cannot execute.
+ */
+function pickExecutable(lines) {
+    const found = lines.map((l) => l.trim()).filter(Boolean);
+    if (found.length === 0)
+        return undefined;
+    const runnable = (process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD")
+        .split(";")
+        .map((e) => e.trim().toLowerCase())
+        .filter(Boolean);
+    return found.find((f) => runnable.some((ext) => f.toLowerCase().endsWith(ext))) ?? found[0];
+}
+//# sourceMappingURL=win-exec.js.map

package/dist/shared/win-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"win-exec.js","sourceRoot":"","sources":["../../src/shared/win-exec.ts"],"names":[],"mappings":";;;;;AAwCA,sCAEC;AAUD,4BAOC;AASD,oCAEC;AAGD,gCAEC;AAQD,sCA0BC;AAyBD,wCAQC;AA9ID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,iDAAwF;AACxF,gDAAwB;AAExB,wEAAwE;AACxE,MAAM,IAAI,GAAG,eAAe,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,sDAAsD;AACtD,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,QAAQ,CAAC,GAAW;IAClC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,qDAAqD;SACnF,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,mDAAmD;IACjF,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,SAAgB,UAAU,CAAC,OAAe,EAAE,IAAuB;IACjE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,OAAe,EACf,IAAuB,EACvB,UAA4B,EAAE;IAE9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAA,yBAAS,EAAC,OAAO,EAAE,IAAgB,EAAE,OAAO,CAA6B,CAAC;IACnF,CAAC;IACD,wEAAwE;IACxE,8EAA8E;IAC9E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAA,yBAAS,EAAC,QAAQ,EAAE,IAAgB,EAAE,OAAO,CAA6B,CAAC;IACpF,CAAC;IACD,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAChF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IACxE,OAAO,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QAC/E,GAAG,OAAO;QACV,8EAA8E;QAC9E,2EAA2E;QAC3E,wBAAwB,EAAE,IAAI;KAC/B,CAA6B,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,cAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAChG,MAAM,KAAK,GAAG,IAAA,yBAAS,EAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC;AACxE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,KAAe;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;SAC5D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/cli",
-  "version": "0.5.15",
+  "version": "0.6.1-dev.2",
   "description": "Atbash CLI — control boundary before the last irreversible step in an agent workflow",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://atbash.ai",
@@ -26,13 +26,14 @@
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "npm run clean && tsc",
-    "test": "node -r ts-node/register --test test/*.test.js",
+    "typecheck": "tsc --noEmit",
+    "test": "node scripts/run-tests.mjs",
     "dev": "ts-node src/bin/atbash.ts",
     "release": "npm version patch --no-git-tag-version && npm run build && npx npm@10 publish --access public",
     "release:dev": "npm version prerelease --preid dev --no-git-tag-version && npm run build && npx npm@10 publish --tag dev --access public"
   },
   "dependencies": {
-    "@atbash/sdk": "^0.7.1",
+    "@atbash/sdk": "0.13.0-dev.0",
     "@iarna/toml": "2.2.5",
     "chalk": "^4.1.2",
     "commander": "^12.0.0",