@camunda8/cli 3.4.0-alpha.1 → 3.4.0-alpha.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/plugins.d.ts.map +1 -1
- package/dist/commands/plugins.js +20 -14
- package/dist/commands/plugins.js.map +1 -1
- package/dist/commands/process-instances.d.ts.map +1 -1
- package/dist/commands/process-instances.js +38 -26
- package/dist/commands/process-instances.js.map +1 -1
- package/dist/commands/run.d.ts.map +1 -1
- package/dist/commands/run.js +9 -2
- package/dist/commands/run.js.map +1 -1
- package/dist/commands/search.d.ts.map +1 -1
- package/dist/commands/search.js +7 -0
- package/dist/commands/search.js.map +1 -1
- package/dist/core/logger.d.ts.map +1 -1
- package/dist/core/logger.js +5 -3
- package/dist/core/logger.js.map +1 -1
- package/dist/framework/command-registry.d.ts +121 -69
- package/dist/framework/command-registry.d.ts.map +1 -1
- package/dist/framework/command-registry.js +96 -66
- package/dist/framework/command-registry.js.map +1 -1
- package/dist/framework/ui/completion.d.ts.map +1 -1
- package/dist/framework/ui/completion.js +15 -2
- package/dist/framework/ui/completion.js.map +1 -1
- package/dist/utils/index.d.ts +1 -0
- package/dist/utils/index.d.ts.map +1 -1
- package/dist/utils/index.js +1 -0
- package/dist/utils/index.js.map +1 -1
- package/dist/utils/shared/ignore.d.ts.map +1 -1
- package/dist/utils/shared/ignore.js +6 -3
- package/dist/utils/shared/ignore.js.map +1 -1
- package/dist/utils/shared/npm-exec.d.ts +70 -0
- package/dist/utils/shared/npm-exec.d.ts.map +1 -0
- package/dist/utils/shared/npm-exec.js +103 -0
- package/dist/utils/shared/npm-exec.js.map +1 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ignore.js","sourceRoot":"","sources":["../../../src/utils/shared/ignore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,
|
|
1
|
+
{"version":3,"file":"ignore.js","sourceRoot":"","sources":["../../../src/utils/shared/ignore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EACN,OAAO,EACP,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,OAAO,EACP,GAAG,GACH,MAAM,WAAW,CAAC;AAEnB,MAAM,gBAAgB,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE/D,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAYtC;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,YAAY,CAAC,GAAW;IAChC,2EAA2E;IAC3E,iEAAiE;IACjE,uCAAuC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAE1D,yDAAyD;IACzD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAExE,IAAI,KAAe,CAAC;IACpB,IAAI,OAAO,EAAE,CAAC;QACb,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,KAAK,GAAG,QAAQ;YACf,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC;YACnB,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,sEAAsE;QACtE,kCAAkC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACrB,qEAAqE;QACrE,sCAAsC;QACtC,KAAK,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACP,+DAA+D;QAC/D,sEAAsE;QACtE,KAAK,GAAG,CAAC,OAAO,EAAE,MAAM,OAAO,EAAE,EAAE,GAAG,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAAyB;IAEzB,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,KAAK,EAAiB,EAAE,EAAE,CAC1D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzC,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,IAAY,EAAW,EAAE,CAC9D,GAAG;SACD,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CAAC,CAAC,CAAC;SACR,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QAClB,MAAM,QAAQ,GAAG,GAAG,GAAG;aACrB,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;aACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACf,OAAO,QAAQ;aACb,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;aACd,MAAM,CACN,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAC5D,KAAK,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,GAAW,EAAW,EAAE,CAC/B,QAAQ,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACd,iEAAiE;YACjE,8DAA8D;YAC9D,kDAAkD;YAClD,OAAO,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC;IAEpC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK;SACpB,GAAG,CAAC,YAAY,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAEhD,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACxB,EAAU,EACV,QAAgB,EAChB,OAAe;IAEf,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,4CAA4C;IAC5C,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACjB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,0CAA0C;IAC1C,kEAAkE;IAClE,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAe;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC;YACJ,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACR,+CAA+C;YAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACF,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtC,gDAAgD;IAChD,gEAAgE;IAChE,sDAAsD;IACtD,MAAM,QAAQ,GACb,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;QAChC,CAAC,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM;QACP,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEvD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAoB,EAAE,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAC1D,CAAC"}
|
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Cross-platform npm invocation.
|
|
3
|
+
*
|
|
4
|
+
* On POSIX, `npm` is a real executable on PATH and can be spawned directly.
|
|
5
|
+
* On Windows, `npm` is a `npm.cmd` batch shim, and neither of the obvious
|
|
6
|
+
* approaches works on the Node versions this CLI supports:
|
|
7
|
+
*
|
|
8
|
+
* - bare `"npm"` -> ENOENT (spawn does not apply PATHEXT resolution)
|
|
9
|
+
* - `"npm.cmd"` alone -> EINVAL (the CVE-2024-27980 hardening in Node
|
|
10
|
+
* 18.20.2 / 20.12.2 / 21.7.3+ refuses to spawn a
|
|
11
|
+
* `.bat`/`.cmd` file without `shell: true`)
|
|
12
|
+
*
|
|
13
|
+
* So on Windows the shim is run through `cmd.exe` via `execSync(commandString)`.
|
|
14
|
+
* Using `execFileSync(cmd, args, { shell: true })` would achieve the same effect
|
|
15
|
+
* but triggers Node's DEP0190 deprecation warning (passing an args array with
|
|
16
|
+
* `shell: true` is deprecated as of Node ≥ 22). `execSync` takes a pre-built
|
|
17
|
+
* command string instead of an args array and is not subject to DEP0190.
|
|
18
|
+
*
|
|
19
|
+
* Because `cmd.exe` receives the arguments as a single command line, every
|
|
20
|
+
* argument must be quoted — plugin directories on Windows routinely contain
|
|
21
|
+
* spaces (`C:\Users\First Last\AppData\Roaming\c8ctl\plugins`).
|
|
22
|
+
*
|
|
23
|
+
* Double quoting is sound on Windows because `"`, `<`, `>` and `|` are illegal
|
|
24
|
+
* in filenames and `cmd.exe` does not interpret `&`, `^` or `|` inside double
|
|
25
|
+
* quotes. Arguments still originate from user input (plugin names, URLs), so
|
|
26
|
+
* the two constructs that survive double quotes — an embedded `"` and a
|
|
27
|
+
* `%VAR%` environment-variable reference — are rejected outright rather than
|
|
28
|
+
* escaped.
|
|
29
|
+
*/
|
|
30
|
+
import { type ExecFileSyncOptions } from "node:child_process";
|
|
31
|
+
export interface NpmInvocation {
|
|
32
|
+
/** Executable to spawn. */
|
|
33
|
+
command: string;
|
|
34
|
+
/** Arguments, quoted when `shell` is true. */
|
|
35
|
+
args: string[];
|
|
36
|
+
/** Whether the invocation must go through a shell. */
|
|
37
|
+
shell: boolean;
|
|
38
|
+
}
|
|
39
|
+
export interface NpmResult {
|
|
40
|
+
stdout?: string;
|
|
41
|
+
}
|
|
42
|
+
interface NpmArgs {
|
|
43
|
+
args: readonly string[];
|
|
44
|
+
}
|
|
45
|
+
interface NpmArgsWithOutput extends NpmArgs {
|
|
46
|
+
stdout: true;
|
|
47
|
+
}
|
|
48
|
+
interface NpmArgsWithoutOutput extends NpmArgs {
|
|
49
|
+
stdio?: ExecFileSyncOptions["stdio"];
|
|
50
|
+
stdout?: false;
|
|
51
|
+
}
|
|
52
|
+
/**
|
|
53
|
+
* Resolve how npm has to be spawned on the given platform.
|
|
54
|
+
*
|
|
55
|
+
* Exported for unit testing: pass an explicit `platform` to exercise the
|
|
56
|
+
* Windows branch from a POSIX host.
|
|
57
|
+
*/
|
|
58
|
+
export declare function buildNpmInvocation({ args, platform, }: {
|
|
59
|
+
args: readonly string[];
|
|
60
|
+
platform?: NodeJS.Platform;
|
|
61
|
+
}): NpmInvocation;
|
|
62
|
+
/**
|
|
63
|
+
* Run npm through the platform-aware wrapper.
|
|
64
|
+
*/
|
|
65
|
+
export declare function npm(options: NpmArgsWithOutput): {
|
|
66
|
+
stdout: string;
|
|
67
|
+
};
|
|
68
|
+
export declare function npm(options: NpmArgsWithoutOutput): undefined;
|
|
69
|
+
export {};
|
|
70
|
+
//# sourceMappingURL=npm-exec.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"npm-exec.d.ts","sourceRoot":"","sources":["../../../src/utils/shared/npm-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACN,KAAK,mBAAmB,EAGxB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,aAAa;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,OAAO;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACxB;AAED,UAAU,iBAAkB,SAAQ,OAAO;IAC1C,MAAM,EAAE,IAAI,CAAC;CACb;AAED,UAAU,oBAAqB,SAAQ,OAAO;IAC7C,KAAK,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,KAAK,CAAC;CACf;AAqBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAClC,IAAI,EACJ,QAA2B,GAC3B,EAAE;IACF,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,GAAG,aAAa,CAuBhB;AAED;;GAEG;AACH,wBAAgB,GAAG,CAAC,OAAO,EAAE,iBAAiB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACpE,wBAAgB,GAAG,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC"}
|
|
@@ -0,0 +1,103 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Cross-platform npm invocation.
|
|
3
|
+
*
|
|
4
|
+
* On POSIX, `npm` is a real executable on PATH and can be spawned directly.
|
|
5
|
+
* On Windows, `npm` is a `npm.cmd` batch shim, and neither of the obvious
|
|
6
|
+
* approaches works on the Node versions this CLI supports:
|
|
7
|
+
*
|
|
8
|
+
* - bare `"npm"` -> ENOENT (spawn does not apply PATHEXT resolution)
|
|
9
|
+
* - `"npm.cmd"` alone -> EINVAL (the CVE-2024-27980 hardening in Node
|
|
10
|
+
* 18.20.2 / 20.12.2 / 21.7.3+ refuses to spawn a
|
|
11
|
+
* `.bat`/`.cmd` file without `shell: true`)
|
|
12
|
+
*
|
|
13
|
+
* So on Windows the shim is run through `cmd.exe` via `execSync(commandString)`.
|
|
14
|
+
* Using `execFileSync(cmd, args, { shell: true })` would achieve the same effect
|
|
15
|
+
* but triggers Node's DEP0190 deprecation warning (passing an args array with
|
|
16
|
+
* `shell: true` is deprecated as of Node ≥ 22). `execSync` takes a pre-built
|
|
17
|
+
* command string instead of an args array and is not subject to DEP0190.
|
|
18
|
+
*
|
|
19
|
+
* Because `cmd.exe` receives the arguments as a single command line, every
|
|
20
|
+
* argument must be quoted — plugin directories on Windows routinely contain
|
|
21
|
+
* spaces (`C:\Users\First Last\AppData\Roaming\c8ctl\plugins`).
|
|
22
|
+
*
|
|
23
|
+
* Double quoting is sound on Windows because `"`, `<`, `>` and `|` are illegal
|
|
24
|
+
* in filenames and `cmd.exe` does not interpret `&`, `^` or `|` inside double
|
|
25
|
+
* quotes. Arguments still originate from user input (plugin names, URLs), so
|
|
26
|
+
* the two constructs that survive double quotes — an embedded `"` and a
|
|
27
|
+
* `%VAR%` environment-variable reference — are rejected outright rather than
|
|
28
|
+
* escaped.
|
|
29
|
+
*/
|
|
30
|
+
import { execFileSync, execSync, } from "node:child_process";
|
|
31
|
+
/** Characters that cannot be represented inside a double-quoted cmd.exe argument: quotes, line breaks and NUL. */
|
|
32
|
+
const WINDOWS_UNQUOTABLE = /["\r\n\0]/;
|
|
33
|
+
/** A cmd.exe `%VAR%` environment-variable reference, which cmd.exe expands even inside double quotes.
|
|
34
|
+
* Requires the name to start with a letter or underscore so that percent-encoded URL sequences
|
|
35
|
+
* (which start with hex digits like `%20`) are not mistakenly treated as variable references.
|
|
36
|
+
* Parentheses are allowed to cover names like `%ProgramFiles(x86)%`. */
|
|
37
|
+
const WINDOWS_CMD_VARIABLE = /%[A-Z_][^%]*?%/i;
|
|
38
|
+
/**
|
|
39
|
+
* Quote a single argument for a verbatim Windows command line.
|
|
40
|
+
*
|
|
41
|
+
* Trailing backslashes are doubled so that `C:\dir\` does not turn the closing
|
|
42
|
+
* quote into an escaped literal quote.
|
|
43
|
+
*/
|
|
44
|
+
function quoteWindowsArg(arg) {
|
|
45
|
+
return `"${arg.replace(/(\\+)$/, "$1$1")}"`;
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Resolve how npm has to be spawned on the given platform.
|
|
49
|
+
*
|
|
50
|
+
* Exported for unit testing: pass an explicit `platform` to exercise the
|
|
51
|
+
* Windows branch from a POSIX host.
|
|
52
|
+
*/
|
|
53
|
+
export function buildNpmInvocation({ args, platform = process.platform, }) {
|
|
54
|
+
if (platform !== "win32") {
|
|
55
|
+
return { command: "npm", args: [...args], shell: false };
|
|
56
|
+
}
|
|
57
|
+
for (const arg of args) {
|
|
58
|
+
if (WINDOWS_UNQUOTABLE.test(arg)) {
|
|
59
|
+
throw new Error(`Refusing to run npm: argument contains a quote or line break that cannot be passed safely to cmd.exe: ${JSON.stringify(arg)}`);
|
|
60
|
+
}
|
|
61
|
+
if (WINDOWS_CMD_VARIABLE.test(arg)) {
|
|
62
|
+
throw new Error(`Refusing to run npm: argument contains a cmd.exe environment variable reference: ${JSON.stringify(arg)}`);
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
return {
|
|
66
|
+
command: "npm.cmd",
|
|
67
|
+
args: args.map(quoteWindowsArg),
|
|
68
|
+
shell: true,
|
|
69
|
+
};
|
|
70
|
+
}
|
|
71
|
+
export function npm({ args, ...opts }) {
|
|
72
|
+
const { command, args: resolvedArgs, shell } = buildNpmInvocation({ args });
|
|
73
|
+
// On Windows, `shell` is true because npm is a .cmd shim that requires cmd.exe.
|
|
74
|
+
// execFileSync(command, args, { shell: true }) triggers DEP0190 in Node ≥ 22 when
|
|
75
|
+
// an args array is combined with shell: true. execSync(commandString) takes a
|
|
76
|
+
// pre-built string instead of an array, so it is not subject to DEP0190.
|
|
77
|
+
// On POSIX, shell is false and execFileSync is used directly (no change).
|
|
78
|
+
if (shell) {
|
|
79
|
+
const cmdLine = [command, ...resolvedArgs].join(" ");
|
|
80
|
+
if (opts.stdout) {
|
|
81
|
+
return {
|
|
82
|
+
stdout: execSync(cmdLine, {
|
|
83
|
+
stdio: ["ignore", "pipe", "pipe"],
|
|
84
|
+
encoding: "utf-8",
|
|
85
|
+
}),
|
|
86
|
+
};
|
|
87
|
+
}
|
|
88
|
+
execSync(cmdLine, { stdio: opts.stdio });
|
|
89
|
+
return undefined;
|
|
90
|
+
}
|
|
91
|
+
if (opts.stdout) {
|
|
92
|
+
return {
|
|
93
|
+
stdout: execFileSync(command, resolvedArgs, {
|
|
94
|
+
stdio: ["ignore", "pipe", "pipe"],
|
|
95
|
+
encoding: "utf-8",
|
|
96
|
+
shell: false,
|
|
97
|
+
}),
|
|
98
|
+
};
|
|
99
|
+
}
|
|
100
|
+
execFileSync(command, resolvedArgs, { stdio: opts.stdio, shell: false });
|
|
101
|
+
return undefined;
|
|
102
|
+
}
|
|
103
|
+
//# sourceMappingURL=npm-exec.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"npm-exec.js","sourceRoot":"","sources":["../../../src/utils/shared/npm-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAEN,YAAY,EACZ,QAAQ,GACR,MAAM,oBAAoB,CAAC;AA4B5B,kHAAkH;AAClH,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC;;;yEAGyE;AACzE,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAW;IACnC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAClC,IAAI,EACJ,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAI3B;IACA,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,yGAAyG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAC9H,CAAC;QACH,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACd,oFAAoF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO;QACN,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/B,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,GAAG,CAAC,EACnB,IAAI,EACJ,GAAG,IAAI,EACmC;IAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,gFAAgF;IAChF,kFAAkF;IAClF,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;gBACN,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE;oBACzB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;oBACjC,QAAQ,EAAE,OAAO;iBACjB,CAAC;aACF,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACN,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE;gBAC3C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,KAAK;aACZ,CAAC;SACF,CAAC;IACH,CAAC;IACD,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,OAAO,SAAS,CAAC;AAClB,CAAC"}
|