@calo-design/cli 0.4.7 → 0.4.8

package/bin/cli.js

@@ -55,8 +55,17 @@ const ok = (s) => log(`${c.g("✓")} ${s}`);
 const warn = (s) => log(`${c.y("!")} ${s}`);
 const tilde = (p) => p.replace(os.homedir(), "~");
 
+// npm/npx are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
@@ -68,7 +77,8 @@ function sleep(sec) {
 // races / rate limits) and recover on retry. Retry before giving up.
 function runWithRetry(bin, argv, tries = 3, opts = {}) {
   for (let i = 1; i <= tries; i++) {
-    const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+    const [b, a, shell] = winShell(bin, argv);
+    const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
     if (!r.error && r.status === 0) return r;
     if (i < tries) { warn(`install hiccup — retrying (${i}/${tries - 1})…`); sleep(3); }
   }

package/bin/mirror-push.js

@@ -50,14 +50,24 @@ const flag = (args, name, def) => {
 };
 const has = (args, name) => args.includes(name);
 
+// npm/npx/eas are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
 }
 function capture(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { encoding: "utf8", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, ...opts });
   return { status: r.status == null ? 1 : r.status, out: `${r.stdout || ""}${r.stderr || ""}` };
 }
 

package/bin/share.js

@@ -54,8 +54,17 @@ function readPkg(root) {
   try { return JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")); } catch { return null; }
 }
 
+// npm/npx/wrangler are .cmd shims on Windows, and Node >= 18.20.2 (CVE-2024-27980)
+// refuses to spawn .cmd files without shell:true. With shell:true cmd.exe
+// gets the args space-joined and unescaped, so quote anything with whitespace.
+function winShell(bin, argv) {
+  if (process.platform !== "win32") return [bin, argv, false];
+  const q = (s) => (/[ \t]/.test(s) ? `"${s}"` : s);
+  return [q(bin), argv.map(q), true];
+}
 function run(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { stdio: "inherit", shell, ...opts });
   if (r.error) throw r.error;
   if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
   return r;
@@ -63,7 +72,8 @@ function run(bin, argv, opts = {}) {
 
 // Run while capturing combined output (to parse the deploy URL) but still show it.
 function runCapture(bin, argv, opts = {}) {
-  const r = spawnSync(bin, argv, { encoding: "utf8", ...opts });
+  const [b, a, shell] = winShell(bin, argv);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, ...opts });
   if (r.error) throw r.error;
   const out = (r.stdout || "") + (r.stderr || "");
   process.stdout.write(out);
@@ -74,9 +84,9 @@ function runCapture(bin, argv, opts = {}) {
 // Prefer an installed wrangler (project-local, then global); else npx. Only used by
 // --direct — the default path needs no wrangler on this machine.
 function wranglerCmd(root) {
-  const local = path.join(root, "node_modules", ".bin", "wrangler");
+  const local = path.join(root, "node_modules", ".bin", process.platform === "win32" ? "wrangler.cmd" : "wrangler");
   if (fs.existsSync(local)) return [local, []];
-  const probe = spawnSync("wrangler", ["--version"], { stdio: "ignore" });
+  const probe = spawnSync("wrangler", ["--version"], { stdio: "ignore", shell: process.platform === "win32" });
   if (!probe.error && probe.status === 0) return ["wrangler", []];
   return ["npx", ["--yes", "wrangler@latest"]];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calo-design/cli",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "One-line setup for Calo design tooling: logs in with your Calo email and installs the calo-design skill + design-system packages. No GitHub account needed.",
   "bin": {
     "calo-design": "bin/cli.js"