@dashclaw/cli 0.7.1 → 0.7.4

package/lib/up/index.js

@@ -20,7 +20,7 @@ import { join } from 'node:path';
 import { STEPS, loadInstance, saveInstance, checkpoint } from './instance.js';
 import { resolveAppVersion, downloadAndExtract } from './fetch-app.js';
 import { dockerAvailableSync, chooseDbMode, provisionDatabase } from './db.js';
-import { installDeps, buildApp, startServer, waitForHealth, openBrowser } from './run.js';
+import { installDeps, buildApp, startServer, waitForHealth, openBrowser, winSafeSpawnSync } from './run.js';
 import { installClaude } from '../claude/install.js';
 import { parseUpArgs } from './args.js';
 import { ask } from '../config.js';
@@ -58,7 +58,7 @@ export function resolveBaseDir(args) {
  * @param {object} [opts.logger]
  * @param {Function} [opts.spawn]  injectable spawnSync for testing (default: spawnSync)
  */
-export function runSetupScriptReal({ appDir, databaseUrl, logger = console, spawn: spawnFn = spawnSync }) {
+export function runSetupScriptReal({ appDir, databaseUrl, logger = console, spawn: spawnFn = winSafeSpawnSync }) {
   logger.error('-> Running setup (migrations + first admin) ...');
   const res = spawnFn(
     'node',
@@ -71,7 +71,9 @@ export function runSetupScriptReal({ appDir, databaseUrl, logger = console, spaw
     ],
     // stdin MUST be 'ignore': the default open pipe makes any stray readline
     // prompt in the child hang forever (observed: 12-minute silent hang).
-    { cwd: appDir, encoding: 'utf8', shell: process.platform === 'win32', stdio: ['ignore', 'pipe', 'pipe'] },
+    // Windows shell handling (npm-style .cmd resolution + DEP0190 avoidance)
+    // lives in winSafeSpawnSync.
+    { cwd: appDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] },
   );
   const stdout = res.stdout || '';
   const lines = stdout.split('\n').map((l) => l.trim()).filter(Boolean);
@@ -178,7 +180,7 @@ export async function runUp({ args, baseDir = join(homedir(), '.dashclaw'), deps
   // is both wrong and hangs. Reuse the saved URL when db_ready is already
   // checkpointed and inst.databaseUrl is set.
   const dbMode = inst.dbMode ?? await deps.chooseDbMode({
-    flagDb: args.db, dockerAvailable: deps.dockerAvailable, yes: args.yes, promptFn: deps.promptFn,
+    flagDb: args.db, dockerAvailable: deps.dockerAvailable, yes: args.yes, promptFn: deps.promptFn, logger,
   });
   const db = (dbMode === 'url' && done('db_ready') && inst.databaseUrl)
     ? { databaseUrl: inst.databaseUrl, stop: async () => {} }
@@ -313,6 +315,15 @@ export async function runDown({
     dockerStop('dashclaw-pg');
     logger.log('[ok] Stopped Docker Postgres (container dashclaw-pg).');
   }
+  if (inst.dbMode === 'embedded' && process.platform === 'win32') {
+    // On Windows the embedded server runs detached via pg_ctl (see db.js) and
+    // survives the up process — stop it here, best-effort.
+    try {
+      const { pg_ctl } = await import('@embedded-postgres/windows-x64');
+      const res = spawnSync(pg_ctl, ['-D', join(baseDir, 'pg'), '-m', 'fast', 'stop'], { stdio: 'ignore' });
+      if (res.status === 0) logger.log('[ok] Stopped embedded Postgres.');
+    } catch { /* binaries not installed — nothing to stop */ }
+  }
 }
 
 /**

package/lib/up/run.js

@@ -6,26 +6,45 @@ import { spawn, spawnSync } from 'node:child_process';
 
 const shell = process.platform === 'win32';
 
-function npm(args, cwd, logger, runner = spawnSync) {
+// npm/npx are .cmd files on Windows, which node refuses to spawn without a
+// shell — but shell:true + an args ARRAY is deprecated (DEP0190, and the
+// warning prints mid-flow for first-run users). So on Windows the command is
+// joined into ONE string (quoting any arg with shell-special characters) and
+// handed to the shell whole; elsewhere args pass through verbatim, no shell.
+const quoteArg = (a) => (/^[\w\-.:/@=]+$/.test(String(a)) ? String(a) : `"${a}"`);
+export function winSafeSpawnArgs(cmd, args) {
+  return shell
+    ? { cmd: [cmd, ...args.map(quoteArg)].join(' '), args: [], opts: { shell: true } }
+    : { cmd, args, opts: {} };
+}
+
+/** spawnSync that takes LOGICAL (cmd, args) and win-joins only at the edge. */
+export function winSafeSpawnSync(cmd, args, opts) {
+  const safe = winSafeSpawnArgs(cmd, args);
+  return spawnSync(safe.cmd, safe.args, { ...opts, ...safe.opts });
+}
+
+function npm(args, cwd, logger, runner = winSafeSpawnSync) {
   logger.error(`-> npm ${args.join(' ')}`);
-  const res = runner('npm', args, { cwd, stdio: ['ignore', 'inherit', 'inherit'], shell });
+  const res = runner('npm', args, { cwd, stdio: ['ignore', 'inherit', 'inherit'] });
   if (res.status !== 0) throw new Error(`npm ${args[0]} failed (exit ${res.status}). Re-run \`npx dashclaw up\` to resume from this step.`);
 }
 
-export function installDeps(appDir, logger = console, runner = spawnSync) {
+export function installDeps(appDir, logger = console, runner = winSafeSpawnSync) {
   try { npm(['ci', '--no-audit', '--no-fund'], appDir, logger, runner); }
   catch { npm(['install', '--no-audit', '--no-fund'], appDir, logger, runner); } // lockfile mismatch fallback
 }
 
-export function buildApp(appDir, logger = console, runner = spawnSync) {
+export function buildApp(appDir, logger = console, runner = winSafeSpawnSync) {
   npm(['run', 'build'], appDir, logger, runner);
 }
 
 /** Start `next start` as a child; .env.local in appDir is loaded by Next itself. */
 export function startServer({ appDir, port, logger = console }) {
   logger.error(`-> Starting server on :${port}`);
-  const child = spawn('npx', ['next', 'start', '-p', String(port)], {
-    cwd: appDir, stdio: ['ignore', 'inherit', 'inherit'], shell,
+  const safe = winSafeSpawnArgs('npx', ['next', 'start', '-p', String(port)]);
+  const child = spawn(safe.cmd, safe.args, {
+    cwd: appDir, stdio: ['ignore', 'inherit', 'inherit'], ...safe.opts,
   });
   return child;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dashclaw/cli",
-  "version": "0.7.1",
+  "version": "0.7.4",
   "description": "DashClaw terminal client — approve agent actions and diagnose your instance",
   "type": "module",
   "keywords": [
@@ -27,6 +27,7 @@
   "dependencies": {
     "dashclaw": "^2.2.1",
     "embedded-postgres": "18.4.0-beta.17",
+    "pg": "^8.22.0",
     "tar": "^7.4.0"
   },
   "license": "MIT",