@contentful/experience-design-system-generation 2.34.2-dev-build-3cd48dd.0 → 2.34.2-dev-build-f52da46.0

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentful/experience-design-system-generation",
-  "version": "2.34.2-dev-build-3cd48dd.0",
+  "version": "2.34.2-dev-build-f52da46.0",
   "description": "Agent-invocation and skill-prompt engine for the Contentful Experience Design System SDK",
   "license": "MIT",
   "type": "module",

package/dist/src/agent-runner.d.ts

@@ -113,6 +113,18 @@ export declare function agentSupportsBedrock(agent: AgentName): boolean;
  */
 export declare function resolveAgentModel(agent: AgentName, explicit?: string, bedrock?: boolean): string | undefined;
 export type AgentDebugEvent = (name: string, payload?: Record<string, unknown>) => void;
+export declare function agentSupportsStdinPrompt(agent: AgentName): boolean;
+/**
+ * Decide how to deliver the prompt.
+ *
+ * Prefer stdin whenever the agent supports it and the prompt is large enough for
+ * argv limits to matter. This is what makes `generate components` work on Windows,
+ * and it removes a latent ARG_MAX failure on macOS as the skills grow.
+ *
+ * Exported so callers can detect the case that has no answer: a large prompt for an
+ * agent that can only accept argv.
+ */
+export declare function shouldUseStdinPrompt(agent: AgentName, prompt: string): boolean;
 export declare function buildArgs(agent: AgentName, prompt: string, model?: string, promptViaStdin?: boolean, bedrock?: boolean): string[];
 export declare function runAgent(options: {
     agent: AgentName;
@@ -123,9 +135,12 @@ export declare function runAgent(options: {
     bedrock?: boolean;
     onOutput?: (chunk: string) => void;
     /**
-     * Deliver the prompt on stdin instead of as an argv positional. Required for
-     * large prompts (e.g. the composition resolver inlining candidate files),
-     * which overflow ARG_MAX when passed as an argument.
+     * Force the prompt onto stdin instead of an argv positional.
+     *
+     * Usually unnecessary: a prompt large enough for argv limits to matter is sent
+     * on stdin automatically (see shouldUseStdinPrompt). Set this to opt in for a
+     * small prompt too. It cannot force stdin for an agent that has no stdin path —
+     * copilot requires the prompt as its `-p` value.
      */
     promptViaStdin?: boolean;
     /** Optional debug-event sink; callers own how/where events get logged. */

package/dist/src/agent-runner.js

@@ -1,4 +1,4 @@
-import { spawn } from 'node:child_process';
+import { findBinary, spawnBinary } from './lib/binary-launch.js';
 export { AGENT_NAMES, DEFAULT_AGENT_NAME, isAgentName } from './agent-names.js';
 const VALID_SELECT_TOOL_NAMES = new Set(['select_component', 'reject_component']);
 function findJsonObjectEnd(line) {
@@ -355,15 +355,55 @@ function codexBedrockConfigArgs() {
     const region = process.env.AWS_REGION?.trim() || process.env.AWS_DEFAULT_REGION?.trim() || DEFAULT_CODEX_BEDROCK_REGION;
     return ['-c', 'model_provider=amazon-bedrock', '-c', `model_providers.amazon-bedrock.region=${region}`];
 }
+/**
+ * Agents that can read the prompt from stdin instead of argv.
+ *
+ * copilot cannot: its `-p` flag requires the prompt as the flag's value (see
+ * buildArgs), so there is nowhere for stdin to go.
+ */
+const STDIN_CAPABLE_AGENTS = new Set(['claude', 'codex', 'opencode', 'cursor']);
+export function agentSupportsStdinPrompt(agent) {
+    return STDIN_CAPABLE_AGENTS.has(agent);
+}
+/**
+ * Windows caps a command line at 8191 characters through cmd.exe, and 32767 in
+ * CreateProcess. Our skill prompts are far larger than both — generate-components
+ * alone is ~50KB — so passing one as an argv positional cannot work there. POSIX
+ * is far more generous (ARG_MAX ~1MB on macOS) but not unlimited.
+ *
+ * Kept deliberately low: stdin is the better path for any prompt of real size, and
+ * there is no benefit to argv beyond the few agents that require it.
+ */
+const ARGV_PROMPT_LIMIT = 4096;
+/**
+ * Decide how to deliver the prompt.
+ *
+ * Prefer stdin whenever the agent supports it and the prompt is large enough for
+ * argv limits to matter. This is what makes `generate components` work on Windows,
+ * and it removes a latent ARG_MAX failure on macOS as the skills grow.
+ *
+ * Exported so callers can detect the case that has no answer: a large prompt for an
+ * agent that can only accept argv.
+ */
+export function shouldUseStdinPrompt(agent, prompt) {
+    return agentSupportsStdinPrompt(agent) && prompt.length > ARGV_PROMPT_LIMIT;
+}
 export function buildArgs(agent, prompt, model, promptViaStdin = false, bedrock = false) {
     // codex with no configured model resolves to undefined — omit --model
     // entirely so the CLI picks its own account-compatible default.
     const resolvedModel = resolveAgentModel(agent, model, bedrock);
     const modelArg = resolvedModel ? ['--model', resolvedModel] : [];
-    // When the prompt is delivered on stdin, omit it from argv — a large prompt
-    // as a command-line argument overflows ARG_MAX (spawn E2BIG). All four CLIs
-    // read the prompt from stdin when it isn't passed positionally.
-    const promptArg = promptViaStdin ? [] : [prompt];
+    // Ignore a stdin request for an agent that has no stdin path. copilot's `-p`
+    // takes the prompt as its value, so honouring the request would emit a bare
+    // `-p` and silently drop the prompt. runAgent already avoids asking, but keep
+    // the guard here so the function can't be misused.
+    const useStdin = promptViaStdin && agentSupportsStdinPrompt(agent);
+    // When the prompt is delivered on stdin, omit it from argv — a large prompt as
+    // a command-line argument overflows ARG_MAX on POSIX (E2BIG) and cannot be
+    // passed at all on Windows, whose command line caps at 8191 characters through
+    // cmd.exe. These CLIs read the prompt from stdin when it isn't passed
+    // positionally.
+    const promptArg = useStdin ? [] : [prompt];
     switch (agent) {
         case 'claude':
             return ['--print', ...modelArg, ...promptArg];
@@ -406,7 +446,11 @@ export async function runAgent(options) {
     // call sites that forget to thread the flag through by hand.
     const bedrock = options.bedrock ?? process.env.EDS_BEDROCK === '1';
     const binary = resolveBinary(agent);
-    const useStdin = !!promptViaStdin;
+    // Send a large prompt on stdin even when the caller didn't ask: a ~50KB skill
+    // prompt exceeds every Windows command-line limit, so argv simply cannot carry
+    // it. Honour an explicit promptViaStdin for smaller prompts, but never route to
+    // stdin for an agent that can't read it (copilot).
+    const useStdin = agentSupportsStdinPrompt(agent) && (!!promptViaStdin || shouldUseStdinPrompt(agent, prompt));
     const args = buildArgs(agent, prompt, model, useStdin, bedrock);
     const startedAt = Date.now();
     onDebugEvent?.('run.start', {
@@ -420,7 +464,7 @@ export async function runAgent(options) {
     });
     return new Promise((resolve) => {
         const bedrockEnv = bedrock ? BEDROCK_ENV_BY_AGENT[agent] : undefined;
-        const child = spawn(binary, args, {
+        const child = spawnBinary(binary, args, {
             stdio: ['pipe', 'pipe', 'pipe'],
             ...(bedrockEnv ? { env: { ...process.env, ...bedrockEnv } } : {}),
         });
@@ -477,19 +521,10 @@ export async function runAgent(options) {
 export async function checkAgentAuth(agent) {
     const binary = resolveBinary(agent);
     // Verify the selected agent's binary exists first — for EVERY agent, not
-    // just claude. When `binary` is an absolute path (e.g. set via
-    // EDS_AGENT_BINARY_<AGENT>=/opt/custom/bin), `which` on some shells doesn't
-    // resolve it — check the filesystem directly for absolute paths, and fall
-    // back to `which` for bare names on $PATH.
-    const binaryExists = await new Promise((resolve) => {
-        if (binary.startsWith('/')) {
-            import('node:fs/promises').then((fs) => fs.access(binary).then(() => resolve(true), () => resolve(false)));
-            return;
-        }
-        const child = spawn('which', [binary], { stdio: 'ignore' });
-        child.on('close', (code) => resolve(code === 0));
-    });
-    if (!binaryExists)
+    // just claude. Handles an absolute EDS_AGENT_BINARY_<AGENT> override as well as
+    // a bare name on PATH.
+    const resolvedBinary = findBinary(binary);
+    if (!resolvedBinary)
         return 'not-found';
     // Only Claude exposes `auth status --json`. Non-Claude agents are considered
     // authenticated once their binary is present — never gate them on claude
@@ -499,7 +534,7 @@ export async function checkAgentAuth(agent) {
     // Use `claude auth status` — fast, no API call, works regardless of which
     // auth provider (direct, Bedrock, Vertex) or whether AWS_PROFILE is set.
     return new Promise((resolve) => {
-        const child = spawn(binary, ['auth', 'status', '--json'], {
+        const child = spawnBinary(resolvedBinary, ['auth', 'status', '--json'], {
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         let stdout = '';

package/dist/src/index.d.ts

@@ -1,9 +1,10 @@
 export { AGENT_NAMES, DEFAULT_AGENT_NAME, isAgentName } from './agent-names.js';
 export type { AgentName } from './agent-names.js';
-export { agentSupportsBedrock, buildArgs, checkAgentAuth, describeAgentFailure, extractSentinelOutput, parseMapTokenPropToolCallLines, parseSelectToolCallLines, parseTokenToolCallLines, parseToolCallLines, resolveAgentModel, resolveBinary, runAgent, } from './agent-runner.js';
+export { agentSupportsBedrock, agentSupportsStdinPrompt, buildArgs, checkAgentAuth, describeAgentFailure, extractSentinelOutput, parseMapTokenPropToolCallLines, parseSelectToolCallLines, parseTokenToolCallLines, parseToolCallLines, resolveAgentModel, resolveBinary, runAgent, shouldUseStdinPrompt, } from './agent-runner.js';
 export type { AgentAuthStatus, AgentDebugEvent, AgentRunResult, ClassifyComponentCall, ClassifyPropCall, ClassifySlotCall, ExcludePropCall, MapTokenPropCall, ParsedMapTokenPropToolCalls, ParsedSelectToolCalls, ParsedTokenToolCalls, ParsedToolCalls, RejectComponentCall, SelectComponentCall, SelectToolCall, SetGroupCall, SetTokenCall, ToolCall, TokenToolCall, } from './agent-runner.js';
 export { createLocalCliAgentInvoker } from './agent-invoker.js';
 export type { AgentInvoker, CreateLocalCliAgentInvokerOptions, InvokeAgentOptions } from './agent-invoker.js';
 export { buildPrompt, formatCustomPromptBanner, resolveSkillPath } from './prompt-builder.js';
 export type { ComponentSourceRef, GeneratedCdf, Mode, PromptOptions, Skill } from './prompt-builder.js';
 export { formatGenerateProgressLine } from './progress.js';
+export { binaryExists, findBinary, spawnBinary } from './lib/binary-launch.js';

package/dist/src/index.js

@@ -1,10 +1,12 @@
 // Agent identity
 export { AGENT_NAMES, DEFAULT_AGENT_NAME, isAgentName } from './agent-names.js';
 // Agent invocation (low-level)
-export { agentSupportsBedrock, buildArgs, checkAgentAuth, describeAgentFailure, extractSentinelOutput, parseMapTokenPropToolCallLines, parseSelectToolCallLines, parseTokenToolCallLines, parseToolCallLines, resolveAgentModel, resolveBinary, runAgent, } from './agent-runner.js';
+export { agentSupportsBedrock, agentSupportsStdinPrompt, buildArgs, checkAgentAuth, describeAgentFailure, extractSentinelOutput, parseMapTokenPropToolCallLines, parseSelectToolCallLines, parseTokenToolCallLines, parseToolCallLines, resolveAgentModel, resolveBinary, runAgent, shouldUseStdinPrompt, } from './agent-runner.js';
 // Agent invocation (interface)
 export { createLocalCliAgentInvoker } from './agent-invoker.js';
 // Prompt building
 export { buildPrompt, formatCustomPromptBanner, resolveSkillPath } from './prompt-builder.js';
 // Progress reporting
 export { formatGenerateProgressLine } from './progress.js';
+// Cross-platform binary lookup and launch (Windows .cmd shims, PATHEXT)
+export { binaryExists, findBinary, spawnBinary } from './lib/binary-launch.js';

package/dist/src/lib/binary-launch.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Cross-platform binary lookup and launch.
+ *
+ * Two separate Windows problems live here, and they need different fixes:
+ *
+ *  1. LOOKUP. libuv's spawn only tries `.com` and `.exe` when resolving a bare
+ *     command name against PATH — it ignores PATHEXT. Every tool installed via
+ *     npm (`claude`, `codex`, `pnpm`) is a `.cmd` shim on Windows, so a bare
+ *     name resolves to nothing and spawn fails with ENOENT. `findBinary` walks
+ *     PATH itself and tries the Windows executable extensions.
+ *
+ *  2. LAUNCH. Even with the full path, Node refuses to start a `.bat`/`.cmd`
+ *     directly — it throws EINVAL (a deliberate guard added for CVE-2024-27980).
+ *     Such a file has to run through `cmd.exe /d /s /c`. `spawnSpec` builds that
+ *     argv.
+ *
+ * Both take `platform` as an argument so tests can assert Windows behaviour
+ * while running on macOS or Linux.
+ */
+import { type ChildProcess, type SpawnOptions } from 'node:child_process';
+/** Resolve a command to an absolute path, or null when it isn't on PATH. */
+export declare function findBinary(binary: string, platform?: NodeJS.Platform): string | null;
+/** True when `binary` resolves to something executable. */
+export declare function binaryExists(binary: string, platform?: NodeJS.Platform): boolean;
+export type SpawnSpec = {
+    command: string;
+    args: string[];
+    /** Set when `args` are pre-quoted and Node must pass them through untouched. */
+    windowsVerbatimArguments?: boolean;
+};
+/**
+ * Build the argv for launching an already-resolved executable. A real `.exe`, and
+ * anything off Windows, passes straight through.
+ *
+ * The quoting is deliberately simple, and is only safe because the arguments
+ * reaching it are our own flags and model names — prompts travel over stdin and
+ * must keep doing so. If user-controlled text ever needs to go through argv here,
+ * switch to `cross-spawn` rather than extending this: it implements the full
+ * cmd.exe rules, including the double-escaping `node_modules/.bin` shims need.
+ */
+export declare function spawnSpec(resolved: string, args: string[], platform?: NodeJS.Platform): SpawnSpec;
+/**
+ * Resolve a command and build its launch spec in one step. Returns null when the
+ * command isn't installed, so callers can report that distinctly from a failure
+ * to run.
+ */
+export declare function resolveSpawn(binary: string, args: string[], platform?: NodeJS.Platform): SpawnSpec | null;
+/**
+ * `child_process.spawn`, with Windows shim resolution applied.
+ *
+ * Use this instead of `spawn` for anything installed by a package manager. When
+ * the command can't be resolved it is passed through unchanged, so a missing
+ * binary still surfaces as the caller's usual `error` event rather than throwing
+ * from here.
+ */
+export declare function spawnBinary(command: string, args: string[], options?: SpawnOptions): ChildProcess;

package/dist/src/lib/binary-launch.js

@@ -0,0 +1,115 @@
+/**
+ * Cross-platform binary lookup and launch.
+ *
+ * Two separate Windows problems live here, and they need different fixes:
+ *
+ *  1. LOOKUP. libuv's spawn only tries `.com` and `.exe` when resolving a bare
+ *     command name against PATH — it ignores PATHEXT. Every tool installed via
+ *     npm (`claude`, `codex`, `pnpm`) is a `.cmd` shim on Windows, so a bare
+ *     name resolves to nothing and spawn fails with ENOENT. `findBinary` walks
+ *     PATH itself and tries the Windows executable extensions.
+ *
+ *  2. LAUNCH. Even with the full path, Node refuses to start a `.bat`/`.cmd`
+ *     directly — it throws EINVAL (a deliberate guard added for CVE-2024-27980).
+ *     Such a file has to run through `cmd.exe /d /s /c`. `spawnSpec` builds that
+ *     argv.
+ *
+ * Both take `platform` as an argument so tests can assert Windows behaviour
+ * while running on macOS or Linux.
+ */
+import { spawn } from 'node:child_process';
+import { accessSync, constants } from 'node:fs';
+import { delimiter, isAbsolute, join } from 'node:path';
+/** Suffixes to try for a bare command name; POSIX names carry their own. */
+function executableExtensions(platform) {
+    return platform === 'win32' ? ['.exe', '.cmd', '.bat', '.com'] : [''];
+}
+/** Resolve a command to an absolute path, or null when it isn't on PATH. */
+export function findBinary(binary, platform = process.platform) {
+    const extensions = executableExtensions(platform);
+    if (isAbsolute(binary)) {
+        // An explicit path may already carry its extension, or (on Windows) omit it.
+        for (const extension of ['', ...extensions]) {
+            try {
+                accessSync(binary + extension, constants.F_OK);
+                return binary + extension;
+            }
+            catch {
+                continue;
+            }
+        }
+        return null;
+    }
+    for (const directory of (process.env['PATH'] ?? '').split(delimiter)) {
+        // Skip relative entries: resolving against the cwd would make the result
+        // depend on where the CLI was run from.
+        if (!directory || !isAbsolute(directory))
+            continue;
+        for (const extension of extensions) {
+            const candidate = join(directory, binary + extension);
+            try {
+                accessSync(candidate, constants.X_OK);
+                return candidate;
+            }
+            catch {
+                continue;
+            }
+        }
+    }
+    return null;
+}
+/** True when `binary` resolves to something executable. */
+export function binaryExists(binary, platform = process.platform) {
+    return findBinary(binary, platform) !== null;
+}
+/**
+ * Build the argv for launching an already-resolved executable. A real `.exe`, and
+ * anything off Windows, passes straight through.
+ *
+ * The quoting is deliberately simple, and is only safe because the arguments
+ * reaching it are our own flags and model names — prompts travel over stdin and
+ * must keep doing so. If user-controlled text ever needs to go through argv here,
+ * switch to `cross-spawn` rather than extending this: it implements the full
+ * cmd.exe rules, including the double-escaping `node_modules/.bin` shims need.
+ */
+export function spawnSpec(resolved, args, platform = process.platform) {
+    if (platform !== 'win32' || /\.(exe|com)$/i.test(resolved)) {
+        return { command: resolved, args };
+    }
+    // `||` not `??`: an empty ComSpec is as unusable as an absent one.
+    const shell = process.env['ComSpec'] || 'cmd.exe';
+    const quote = (value) => `"${value.replace(/"/g, '""')}"`;
+    const commandLine = [resolved, ...args].map(quote).join(' ');
+    return {
+        command: shell,
+        // /d skips AutoRun scripts, /s keeps the outer quotes intact, /c runs and exits.
+        args: ['/d', '/s', '/c', `"${commandLine}"`],
+        windowsVerbatimArguments: true,
+    };
+}
+/**
+ * Resolve a command and build its launch spec in one step. Returns null when the
+ * command isn't installed, so callers can report that distinctly from a failure
+ * to run.
+ */
+export function resolveSpawn(binary, args, platform = process.platform) {
+    const resolved = findBinary(binary, platform);
+    if (!resolved)
+        return null;
+    return spawnSpec(resolved, args, platform);
+}
+/**
+ * `child_process.spawn`, with Windows shim resolution applied.
+ *
+ * Use this instead of `spawn` for anything installed by a package manager. When
+ * the command can't be resolved it is passed through unchanged, so a missing
+ * binary still surfaces as the caller's usual `error` event rather than throwing
+ * from here.
+ */
+export function spawnBinary(command, args, options = {}) {
+    const launch = resolveSpawn(command, args) ?? { command, args };
+    return spawn(launch.command, launch.args, {
+        ...options,
+        ...(launch.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentful/experience-design-system-generation",
-  "version": "2.34.2-dev-build-3cd48dd.0",
+  "version": "2.34.2-dev-build-f52da46.0",
   "description": "Agent-invocation and skill-prompt engine for the Contentful Experience Design System SDK",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,7 @@
     "skills/"
   ],
   "dependencies": {
-    "@contentful/experience-design-system-types": "2.34.2-dev-build-3cd48dd.0"
+    "@contentful/experience-design-system-types": "2.34.2-dev-build-f52da46.0"
   },
   "devDependencies": {
     "@tsconfig/node24": "^24.0.4",