@contentful/experience-design-system-generation 2.34.1-dev-build-928f202.0 → 2.34.1-dev-build-1576344.0

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentful/experience-design-system-generation",
-  "version": "2.34.1-dev-build-928f202.0",
+  "version": "2.34.1-dev-build-1576344.0",
   "description": "Agent-invocation and skill-prompt engine for the Contentful Experience Design System SDK",
   "license": "MIT",
   "type": "module",

package/dist/src/agent-runner.js

@@ -1,5 +1,4 @@
-import { spawn } from 'node:child_process';
-import { findBinary, resolveSpawn, spawnSpec } from './lib/binary-launch.js';
+import { findBinary, spawnBinary } from './lib/binary-launch.js';
 export { AGENT_NAMES, DEFAULT_AGENT_NAME, isAgentName } from './agent-names.js';
 const VALID_SELECT_TOOL_NAMES = new Set(['select_component', 'reject_component']);
 function findJsonObjectEnd(line) {
@@ -472,14 +471,8 @@ export async function runAgent(options) {
     });
     return new Promise((resolve) => {
         const bedrockEnv = bedrock ? BEDROCK_ENV_BY_AGENT[agent] : undefined;
-        // On Windows the agent CLIs are `.cmd` shims, which spawn can neither find
-        // (libuv ignores PATHEXT) nor start directly (EINVAL). Resolve and wrap.
-        // Falling back to the bare name keeps the existing 'error' handling path,
-        // which reports a missing binary far better than throwing from here.
-        const launch = resolveSpawn(binary, args) ?? { command: binary, args };
-        const child = spawn(launch.command, launch.args, {
+        const child = spawnBinary(binary, args, {
             stdio: ['pipe', 'pipe', 'pipe'],
-            ...(launch.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
             ...(bedrockEnv ? { env: { ...process.env, ...bedrockEnv } } : {}),
         });
         if (useStdin && child.stdin) {
@@ -535,10 +528,8 @@ export async function runAgent(options) {
 export async function checkAgentAuth(agent) {
     const binary = resolveBinary(agent);
     // Verify the selected agent's binary exists first — for EVERY agent, not
-    // just claude. findBinary handles both shapes this has to cover: an absolute
-    // path (e.g. EDS_AGENT_BINARY_<AGENT>=/opt/custom/bin, or C:\tools\claude.cmd)
-    // and a bare name on PATH. It replaces shelling out to `which`, which doesn't
-    // exist on Windows, and recognises Windows `.cmd` shims.
+    // just claude. Handles an absolute EDS_AGENT_BINARY_<AGENT> override as well as
+    // a bare name on PATH.
     const resolvedBinary = findBinary(binary);
     if (!resolvedBinary)
         return 'not-found';
@@ -550,11 +541,8 @@ export async function checkAgentAuth(agent) {
     // Use `claude auth status` — fast, no API call, works regardless of which
     // auth provider (direct, Bedrock, Vertex) or whether AWS_PROFILE is set.
     return new Promise((resolve) => {
-        // Already resolved above, so wrap the real path rather than looking it up again.
-        const launch = spawnSpec(resolvedBinary, ['auth', 'status', '--json']);
-        const child = spawn(launch.command, launch.args, {
+        const child = spawnBinary(resolvedBinary, ['auth', 'status', '--json'], {
             stdio: ['ignore', 'pipe', 'pipe'],
-            ...(launch.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
         });
         let stdout = '';
         let done = false;

package/dist/src/index.d.ts

@@ -7,5 +7,4 @@ export type { AgentInvoker, CreateLocalCliAgentInvokerOptions, InvokeAgentOption
 export { buildPrompt, formatCustomPromptBanner, resolveSkillPath } from './prompt-builder.js';
 export type { ComponentSourceRef, GeneratedCdf, Mode, PromptOptions, Skill } from './prompt-builder.js';
 export { formatGenerateProgressLine } from './progress.js';
-export { binaryExists, findBinary, resolveSpawn, spawnSpec } from './lib/binary-launch.js';
-export type { SpawnSpec } from './lib/binary-launch.js';
+export { binaryExists, findBinary, spawnBinary } from './lib/binary-launch.js';

package/dist/src/index.js

@@ -9,4 +9,4 @@ export { buildPrompt, formatCustomPromptBanner, resolveSkillPath } from './promp
 // Progress reporting
 export { formatGenerateProgressLine } from './progress.js';
 // Cross-platform binary lookup and launch (Windows .cmd shims, PATHEXT)
-export { binaryExists, findBinary, resolveSpawn, spawnSpec } from './lib/binary-launch.js';
+export { binaryExists, findBinary, spawnBinary } from './lib/binary-launch.js';

package/dist/src/lib/binary-launch.d.ts

@@ -1,10 +1,24 @@
 /**
- * Resolve a command to an absolute path, or null when it isn't on PATH.
+ * Cross-platform binary lookup and launch.
  *
- * Replaces shelling out to `which`, which doesn't exist on Windows. An absolute
- * path is checked directly — on Windows `which` wouldn't resolve one anyway, and
- * `isAbsolute` recognises `C:\...` where a `startsWith('/')` test does not.
+ * Two separate Windows problems live here, and they need different fixes:
+ *
+ *  1. LOOKUP. libuv's spawn only tries `.com` and `.exe` when resolving a bare
+ *     command name against PATH — it ignores PATHEXT. Every tool installed via
+ *     npm (`claude`, `codex`, `pnpm`) is a `.cmd` shim on Windows, so a bare
+ *     name resolves to nothing and spawn fails with ENOENT. `findBinary` walks
+ *     PATH itself and tries the Windows executable extensions.
+ *
+ *  2. LAUNCH. Even with the full path, Node refuses to start a `.bat`/`.cmd`
+ *     directly — it throws EINVAL (a deliberate guard added for CVE-2024-27980).
+ *     Such a file has to run through `cmd.exe /d /s /c`. `spawnSpec` builds that
+ *     argv.
+ *
+ * Both take `platform` as an argument so tests can assert Windows behaviour
+ * while running on macOS or Linux.
  */
+import { type ChildProcess, type SpawnOptions } from 'node:child_process';
+/** Resolve a command to an absolute path, or null when it isn't on PATH. */
 export declare function findBinary(binary: string, platform?: NodeJS.Platform): string | null;
 /** True when `binary` resolves to something executable. */
 export declare function binaryExists(binary: string, platform?: NodeJS.Platform): boolean;
@@ -15,21 +29,14 @@ export type SpawnSpec = {
     windowsVerbatimArguments?: boolean;
 };
 /**
- * Build the argv for launching an already-resolved executable.
- *
- * Off Windows, and for a real `.exe`/`.com`, this passes straight through. A
- * Windows `.cmd`/`.bat` is wrapped in `cmd.exe /d /s /c "..."`, which is the only
- * way to start one.
+ * Build the argv for launching an already-resolved executable. A real `.exe`, and
+ * anything off Windows, passes straight through.
  *
- * Quoting note: the wrapped form re-parses the command line, so arguments are
- * quoted here. That quoting is deliberately simple — double quotes are doubled
- * and each argument wrapped — which is sufficient because the arguments reaching
- * this path are our own flags and model names. Large or user-controlled text
- * (agent prompts) travels over stdin instead, and must keep doing so. If
- * user-controlled values ever need to go through argv here, replace this with
- * `cross-spawn` rather than extending the escaping: it implements the full
- * cmd.exe rules, including the double-escaping that `node_modules/.bin` shims
- * require.
+ * The quoting is deliberately simple, and is only safe because the arguments
+ * reaching it are our own flags and model names — prompts travel over stdin and
+ * must keep doing so. If user-controlled text ever needs to go through argv here,
+ * switch to `cross-spawn` rather than extending this: it implements the full
+ * cmd.exe rules, including the double-escaping `node_modules/.bin` shims need.
  */
 export declare function spawnSpec(resolved: string, args: string[], platform?: NodeJS.Platform): SpawnSpec;
 /**
@@ -38,3 +45,12 @@ export declare function spawnSpec(resolved: string, args: string[], platform?: N
  * to run.
  */
 export declare function resolveSpawn(binary: string, args: string[], platform?: NodeJS.Platform): SpawnSpec | null;
+/**
+ * `child_process.spawn`, with Windows shim resolution applied.
+ *
+ * Use this instead of `spawn` for anything installed by a package manager. When
+ * the command can't be resolved it is passed through unchanged, so a missing
+ * binary still surfaces as the caller's usual `error` event rather than throwing
+ * from here.
+ */
+export declare function spawnBinary(command: string, args: string[], options?: SpawnOptions): ChildProcess;

package/dist/src/lib/binary-launch.js

@@ -17,22 +17,14 @@
  * Both take `platform` as an argument so tests can assert Windows behaviour
  * while running on macOS or Linux.
  */
+import { spawn } from 'node:child_process';
 import { accessSync, constants } from 'node:fs';
 import { delimiter, isAbsolute, join } from 'node:path';
-/**
- * Executable suffixes to try for a bare command name. The POSIX case is a
- * single empty string: the name is already the whole filename.
- */
+/** Suffixes to try for a bare command name; POSIX names carry their own. */
 function executableExtensions(platform) {
     return platform === 'win32' ? ['.exe', '.cmd', '.bat', '.com'] : [''];
 }
-/**
- * Resolve a command to an absolute path, or null when it isn't on PATH.
- *
- * Replaces shelling out to `which`, which doesn't exist on Windows. An absolute
- * path is checked directly — on Windows `which` wouldn't resolve one anyway, and
- * `isAbsolute` recognises `C:\...` where a `startsWith('/')` test does not.
- */
+/** Resolve a command to an absolute path, or null when it isn't on PATH. */
 export function findBinary(binary, platform = process.platform) {
     const extensions = executableExtensions(platform);
     if (isAbsolute(binary)) {
@@ -49,8 +41,8 @@ export function findBinary(binary, platform = process.platform) {
         return null;
     }
     for (const directory of (process.env['PATH'] ?? '').split(delimiter)) {
-        // Skip empty and relative PATH entries: resolving a command against the cwd
-        // would make the result depend on where the CLI happens to be run from.
+        // Skip relative entries: resolving against the cwd would make the result
+        // depend on where the CLI was run from.
         if (!directory || !isAbsolute(directory))
             continue;
         for (const extension of extensions) {
@@ -71,21 +63,14 @@ export function binaryExists(binary, platform = process.platform) {
     return findBinary(binary, platform) !== null;
 }
 /**
- * Build the argv for launching an already-resolved executable.
+ * Build the argv for launching an already-resolved executable. A real `.exe`, and
+ * anything off Windows, passes straight through.
  *
- * Off Windows, and for a real `.exe`/`.com`, this passes straight through. A
- * Windows `.cmd`/`.bat` is wrapped in `cmd.exe /d /s /c "..."`, which is the only
- * way to start one.
- *
- * Quoting note: the wrapped form re-parses the command line, so arguments are
- * quoted here. That quoting is deliberately simple — double quotes are doubled
- * and each argument wrapped — which is sufficient because the arguments reaching
- * this path are our own flags and model names. Large or user-controlled text
- * (agent prompts) travels over stdin instead, and must keep doing so. If
- * user-controlled values ever need to go through argv here, replace this with
- * `cross-spawn` rather than extending the escaping: it implements the full
- * cmd.exe rules, including the double-escaping that `node_modules/.bin` shims
- * require.
+ * The quoting is deliberately simple, and is only safe because the arguments
+ * reaching it are our own flags and model names — prompts travel over stdin and
+ * must keep doing so. If user-controlled text ever needs to go through argv here,
+ * switch to `cross-spawn` rather than extending this: it implements the full
+ * cmd.exe rules, including the double-escaping `node_modules/.bin` shims need.
  */
 export function spawnSpec(resolved, args, platform = process.platform) {
     if (platform !== 'win32' || /\.(exe|com)$/i.test(resolved)) {
@@ -113,3 +98,18 @@ export function resolveSpawn(binary, args, platform = process.platform) {
         return null;
     return spawnSpec(resolved, args, platform);
 }
+/**
+ * `child_process.spawn`, with Windows shim resolution applied.
+ *
+ * Use this instead of `spawn` for anything installed by a package manager. When
+ * the command can't be resolved it is passed through unchanged, so a missing
+ * binary still surfaces as the caller's usual `error` event rather than throwing
+ * from here.
+ */
+export function spawnBinary(command, args, options = {}) {
+    const launch = resolveSpawn(command, args) ?? { command, args };
+    return spawn(launch.command, launch.args, {
+        ...options,
+        ...(launch.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentful/experience-design-system-generation",
-  "version": "2.34.1-dev-build-928f202.0",
+  "version": "2.34.1-dev-build-1576344.0",
   "description": "Agent-invocation and skill-prompt engine for the Contentful Experience Design System SDK",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,7 @@
     "skills/"
   ],
   "dependencies": {
-    "@contentful/experience-design-system-types": "2.34.1-dev-build-928f202.0"
+    "@contentful/experience-design-system-types": "2.34.1-dev-build-1576344.0"
   },
   "devDependencies": {
     "@tsconfig/node24": "^24.0.4",