@follenfang/fupload 0.0.0-bootstrap.0 → 0.0.1

package/fupload/scripts/fupload_cli/transport.py

@@ -0,0 +1,125 @@
+"""Small standard-library JSON and multipart HTTP client."""
+
+from __future__ import annotations
+
+import json
+import mimetypes
+import os
+import secrets
+import urllib.error
+import urllib.request
+from typing import Any, Dict, Mapping, Optional
+
+from .errors import FuploadError
+from .trust import official_opener, require_official_url
+
+
+def _http_error_details(raw: bytes, fallback: str) -> tuple[str, Any]:
+    """Extract a server error only from a conforming UTF-8 JSON object."""
+    try:
+        parsed = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, ValueError):
+        return fallback, None
+    if not isinstance(parsed, dict):
+        return fallback, None
+    message = parsed.get("message") or parsed.get("msg") or fallback
+    return str(message), parsed.get("code")
+
+
+def json_request(
+    url: str,
+    *,
+    method: str = "GET",
+    headers: Optional[Mapping[str, str]] = None,
+    body: Any = None,
+    timeout: int = 60,
+    trusted_service: Optional[str] = None,
+) -> Any:
+    data = None
+    request_headers = dict(headers or {})
+    if body is not None:
+        data = json.dumps(body, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+        request_headers.setdefault("Content-Type", "application/json")
+    request = urllib.request.Request(url, data=data, method=method, headers=request_headers)
+    try:
+        response_context = (
+            official_opener(require_official_url(url, trusted_service)).open(request, timeout=timeout)
+            if trusted_service else urllib.request.urlopen(request, timeout=timeout)
+        )
+        with response_context as response:
+            raw = response.read()
+            status = response.status
+    except urllib.error.HTTPError as exc:
+        raw = exc.read()
+        message, code = _http_error_details(raw, "HTTP %d" % exc.code)
+        raise FuploadError(message, endpoint=url, http_status=exc.code, business_code=code) from exc
+    except (OSError, urllib.error.URLError) as exc:
+        raise FuploadError(
+            "network result is uncertain: %s" % exc,
+            endpoint=url,
+            verification_required=method not in ("GET", "HEAD"),
+        ) from exc
+    if status < 200 or status >= 300:
+        raise FuploadError("HTTP %d" % status, endpoint=url, http_status=status)
+    if not raw:
+        return {}
+    try:
+        return json.loads(raw.decode("utf-8"))
+    except ValueError as exc:
+        raise FuploadError("response was not valid JSON", endpoint=url, http_status=status) from exc
+
+
+def multipart_request(
+    url: str,
+    file_path: str,
+    *,
+    file_field: str = "file",
+    fields: Optional[Mapping[str, str]] = None,
+    headers: Optional[Mapping[str, str]] = None,
+    timeout: int = 600,
+    trusted_service: Optional[str] = None,
+) -> Any:
+    boundary = "----fupload-%s" % secrets.token_hex(16)
+    chunks = []
+    for key, value in (fields or {}).items():
+        chunks.extend([
+            ("--%s\r\n" % boundary).encode(),
+            ('Content-Disposition: form-data; name="%s"\r\n\r\n' % key).encode(),
+            str(value).encode("utf-8"), b"\r\n",
+        ])
+    filename = os.path.basename(file_path)
+    content_type = mimetypes.guess_type(filename)[0] or "application/octet-stream"
+    chunks.extend([
+        ("--%s\r\n" % boundary).encode(),
+        ('Content-Disposition: form-data; name="%s"; filename="%s"\r\n' % (file_field, filename)).encode("utf-8"),
+        ("Content-Type: %s\r\n\r\n" % content_type).encode(),
+    ])
+    with open(file_path, "rb") as handle:
+        chunks.append(handle.read())
+    chunks.extend([b"\r\n", ("--%s--\r\n" % boundary).encode()])
+    body = b"".join(chunks)
+    request_headers = dict(headers or {})
+    request_headers["Content-Type"] = "multipart/form-data; boundary=%s" % boundary
+    request = urllib.request.Request(url, data=body, method="POST", headers=request_headers)
+    try:
+        response_context = (
+            official_opener(require_official_url(url, trusted_service)).open(request, timeout=timeout)
+            if trusted_service else urllib.request.urlopen(request, timeout=timeout)
+        )
+        with response_context as response:
+            raw = response.read()
+            status = response.status
+    except urllib.error.HTTPError as exc:
+        raw = exc.read()
+        message, code = _http_error_details(raw, "HTTP %d" % exc.code)
+        raise FuploadError(message, endpoint=url, http_status=exc.code, business_code=code) from exc
+    except (OSError, urllib.error.URLError) as exc:
+        raise FuploadError(
+            "upload result is uncertain: %s" % exc,
+            endpoint=url,
+            verification_required=True,
+        ) from exc
+    try:
+        return json.loads(raw.decode("utf-8")) if raw else {}
+    except ValueError as exc:
+        raise FuploadError("upload response was not valid JSON", endpoint=url, http_status=status) from exc

package/fupload/scripts/fupload_cli/trust.py

@@ -0,0 +1,207 @@
+"""Platform trust primitives for credential and executable boundaries."""
+
+from __future__ import annotations
+
+import ctypes
+import json
+import os
+import re
+import subprocess
+import urllib.parse
+import urllib.request
+from pathlib import Path
+from typing import Any, Dict, Mapping, Optional, Tuple
+
+from .errors import FuploadError
+
+
+NEWBEE_ORIGINS = {
+    "creator": "https://api.newbeebox.com",
+    "auth": "https://api.next.newbeebox.com",
+    "next": "https://api.next.newbeebox.com",
+    "metadata": "https://cdn2.newbeebox.com",
+    "upload": "https://api.next.newbeebox.com",
+}
+ALLOWED_DD_PUBLISHERS = (
+    "netease (hangzhou) network co., ltd",
+)
+_SUBJECT_ORGANIZATION = re.compile(r"(?:^|,\s*)O=(?:\"([^\"]+)\"|([^,]+))", re.IGNORECASE)
+
+
+def _origin(value: str) -> Tuple[str, str, int]:
+    parsed = urllib.parse.urlsplit(value)
+    if parsed.scheme.casefold() != "https" or not parsed.hostname:
+        raise FuploadError("untrusted HTTPS origin", kind="trust_boundary")
+    host = parsed.hostname.casefold().rstrip(".")
+    try:
+        port = parsed.port or 443
+    except ValueError as exc:
+        raise FuploadError("origin contains an invalid port", kind="trust_boundary") from exc
+    if parsed.username or parsed.password or parsed.fragment:
+        raise FuploadError("origin contains unsupported URL components", kind="trust_boundary")
+    return parsed.scheme.casefold(), host, port
+
+
+def require_official_url(value: str, service: str, *, path_prefix: str = "") -> str:
+    expected = _origin(NEWBEE_ORIGINS[service])
+    actual = _origin(value)
+    if actual != expected:
+        raise FuploadError(
+            "untrusted %s origin" % service,
+            kind="trust_boundary",
+            endpoint="%s://%s:%d" % actual,
+        )
+    parsed = urllib.parse.urlsplit(value)
+    if path_prefix and not parsed.path.startswith(path_prefix):
+        raise FuploadError("untrusted %s path" % service, kind="trust_boundary")
+    return value.rstrip("/")
+
+
+def same_origin_redirect(original: str, redirected: str) -> bool:
+    try:
+        return _origin(original) == _origin(redirected)
+    except (FuploadError, ValueError):
+        return False
+
+
+class SameOriginRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def __init__(self, allowed_origin: str) -> None:
+        super().__init__()
+        self.allowed_origin = allowed_origin
+
+    def redirect_request(self, req: urllib.request.Request, fp: Any, code: int, msg: str, headers: Mapping[str, str], newurl: str) -> Optional[urllib.request.Request]:
+        if not same_origin_redirect(req.full_url, newurl) or not same_origin_redirect(self.allowed_origin, newurl):
+            raise FuploadError("cross-origin redirect rejected", kind="trust_boundary")
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+
+def official_opener(origin: str) -> urllib.request.OpenerDirector:
+    return urllib.request.build_opener(SameOriginRedirectHandler(origin))
+
+
+def _known_folder_roaming() -> Path:
+    if os.name != "nt":
+        raise FuploadError("Windows Roaming AppData is unavailable", kind="authentication_error")
+    try:
+        shell32 = ctypes.WinDLL("shell32", use_last_error=True)
+        ole32 = ctypes.WinDLL("ole32", use_last_error=True)
+        folder_id = ctypes.c_ubyte * 16
+        # FOLDERID_RoamingAppData: 3EB685DB-65F9-4CF6-A03A-E3EF65729F3D.
+        guid = folder_id(0xDB, 0x85, 0xB6, 0x3E, 0xF9, 0x65, 0xF6, 0x4C,
+                         0xA0, 0x3A, 0xE3, 0xEF, 0x65, 0x72, 0x9F, 0x3D)
+        shell32.SHGetKnownFolderPath.argtypes = [ctypes.POINTER(folder_id), ctypes.c_uint32, ctypes.c_void_p, ctypes.POINTER(ctypes.c_wchar_p)]
+        shell32.SHGetKnownFolderPath.restype = ctypes.c_long
+        value = ctypes.c_wchar_p()
+        result = shell32.SHGetKnownFolderPath(ctypes.byref(guid), 0, None, ctypes.byref(value))
+        if result != 0:
+            raise OSError(result, "SHGetKnownFolderPath failed")
+        path = Path(value.value)
+        ole32.CoTaskMemFree(value)
+        return path
+    except (AttributeError, OSError, TypeError, ValueError) as exc:
+        raise FuploadError("Windows Roaming AppData could not be resolved", kind="authentication_error") from exc
+
+
+def _known_folder_local() -> Path:
+    if os.name != "nt":
+        raise FuploadError("Windows Local AppData is unavailable", kind="trust_boundary")
+    try:
+        shell32 = ctypes.WinDLL("shell32", use_last_error=True)
+        ole32 = ctypes.WinDLL("ole32", use_last_error=True)
+        folder_id = ctypes.c_ubyte * 16
+        # FOLDERID_LocalAppData: F1B32785-6FBA-4FCF-9D55-7B8E7F157091.
+        guid = folder_id(0x85, 0x27, 0xB3, 0xF1, 0xBA, 0x6F, 0xCF, 0x4F,
+                         0x9D, 0x55, 0x7B, 0x8E, 0x7F, 0x15, 0x70, 0x91)
+        shell32.SHGetKnownFolderPath.argtypes = [ctypes.POINTER(folder_id), ctypes.c_uint32, ctypes.c_void_p, ctypes.POINTER(ctypes.c_wchar_p)]
+        shell32.SHGetKnownFolderPath.restype = ctypes.c_long
+        value = ctypes.c_wchar_p()
+        result = shell32.SHGetKnownFolderPath(ctypes.byref(guid), 0, None, ctypes.byref(value))
+        if result != 0:
+            raise OSError(result, "SHGetKnownFolderPath failed")
+        path = Path(value.value)
+        ole32.CoTaskMemFree(value)
+        return path
+    except (AttributeError, OSError, TypeError, ValueError) as exc:
+        raise FuploadError("Windows Local AppData could not be resolved", kind="trust_boundary") from exc
+
+
+def trusted_roaming_dir(*parts: str) -> Path:
+    root = _known_folder_roaming().resolve()
+    current = root
+    for part in parts:
+        current = current / part
+        if current.exists() and _is_reparse_point(current):
+            raise FuploadError("trusted application path contains a reparse point", kind="trust_boundary")
+    resolved = current.resolve(strict=False)
+    if resolved != root and root not in resolved.parents:
+        raise FuploadError("trusted application path escaped Known Folder", kind="trust_boundary")
+    return resolved
+
+
+def trusted_local_dir(*parts: str) -> Path:
+    root = _known_folder_local().resolve()
+    current = root
+    for part in parts:
+        current = current / part
+        if current.exists() and _is_reparse_point(current):
+            raise FuploadError("trusted application path contains a reparse point", kind="trust_boundary")
+    resolved = current.resolve(strict=False)
+    if resolved != root and root not in resolved.parents:
+        raise FuploadError("trusted application path escaped Known Folder", kind="trust_boundary")
+    return resolved
+
+
+def _is_reparse_point(path: Path) -> bool:
+    if path.is_symlink():
+        return True
+    try:
+        attributes = os.stat(str(path), follow_symlinks=False).st_file_attributes
+    except (AttributeError, OSError):
+        return False
+    return bool(attributes & 0x400)
+
+
+def _powershell_path() -> str:
+    if os.name != "nt":
+        raise FuploadError("DD executable signature validation requires Windows", kind="trust_boundary")
+    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel32.GetWindowsDirectoryW.argtypes = [ctypes.c_wchar_p, ctypes.c_uint32]
+    kernel32.GetWindowsDirectoryW.restype = ctypes.c_uint32
+    buffer = ctypes.create_unicode_buffer(32768)
+    length = kernel32.GetWindowsDirectoryW(buffer, len(buffer))
+    if not length:
+        raise FuploadError("Windows system directory could not be resolved", kind="trust_boundary")
+    return str(Path(buffer.value) / "System32" / "WindowsPowerShell" / "v1.0" / "powershell.exe")
+
+
+def verify_dd_executable(executable: Path) -> Dict[str, str]:
+    powershell = _powershell_path()
+    script = (
+        "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop; "
+        "$OutputEncoding = [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false); "
+        "$s=Get-AuthenticodeSignature -LiteralPath '%s'; "
+        "[pscustomobject]@{Status=[string]$s.Status;Subject=[string]$s.SignerCertificate.Subject} "
+        "| ConvertTo-Json -Compress"
+    ) % str(executable).replace("'", "''")
+    try:
+        environment = os.environ.copy()
+        windows_root = str(Path(powershell).parents[3])
+        environment["PSModulePath"] = windows_root + "\\System32\\WindowsPowerShell\\v1.0\\Modules"
+        completed = subprocess.run(
+            [powershell, "-NoProfile", "-NonInteractive", "-Command", script],
+            capture_output=True, text=True, encoding="utf-8", errors="strict",
+            timeout=20, check=False, env=environment,
+        )
+        if completed.returncode != 0:
+            raise FuploadError("DD Authenticode verification process failed", kind="trust_boundary")
+        payload = json.loads((completed.stdout or "").strip() or "{}")
+    except (OSError, subprocess.SubprocessError, ValueError) as exc:
+        raise FuploadError("DD Authenticode verification failed", kind="trust_boundary") from exc
+    status = str(payload.get("Status") or "")
+    subject = str(payload.get("Subject") or "")
+    match = _SUBJECT_ORGANIZATION.search(subject)
+    publisher = (match.group(1) or match.group(2)).strip() if match else ""
+    normalized_publisher = publisher.casefold()
+    if status.casefold() != "valid" or normalized_publisher not in ALLOWED_DD_PUBLISHERS:
+        raise FuploadError("DD executable has no trusted official signature", kind="trust_boundary")
+    return {"status": status, "publisher": publisher}

package/npm/bin/fupload.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { recordManagedSkill } from "../lib/managed-install.mjs";
+import { parseLauncherOptions, resolveSkillDirectory } from "../lib/options.mjs";
+import { discoverPython, runPython } from "../lib/python.mjs";
+import { ensureSkill } from "../lib/skill-installer.mjs";
+import { uninstallSelf } from "../lib/uninstall.mjs";
+import { updateSelf } from "../lib/update.mjs";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+function emitError(code, message, details = undefined) {
+  const record = { event: "error", code, message };
+  if (details) {
+    record.details = details;
+  }
+  process.stderr.write(`${JSON.stringify(record)}\n`);
+}
+
+async function main() {
+  let options;
+  try {
+    options = parseLauncherOptions(process.argv.slice(2));
+  } catch (error) {
+    emitError("LAUNCHER_ARGUMENT_INVALID", error.message);
+    return 2;
+  }
+  const target = resolveSkillDirectory({ explicit: options.skillDirectory });
+  if (options.forwarded.length === 1 && options.forwarded[0] === "update") {
+    try {
+      const result = await updateSelf({ packageRoot, target });
+      process.stdout.write(`${JSON.stringify(result)}\n`);
+      return 0;
+    } catch (error) {
+      emitError(error.code || "FUPLOAD_UPDATE_FAILED", error.message, error.details);
+      return 1;
+    }
+  }
+  if (options.forwarded.length === 1 && options.forwarded[0] === "uninstall") {
+    try {
+      const result = await uninstallSelf({ packageRoot, target });
+      process.stdout.write(`${JSON.stringify(result)}\n`);
+      return 0;
+    } catch (error) {
+      emitError(error.code || "FUPLOAD_UNINSTALL_FAILED", error.message, error.details);
+      return 1;
+    }
+  }
+
+  let ensured;
+  try {
+    ensured = await ensureSkill({ packageRoot, target });
+    recordManagedSkill(target);
+  } catch (error) {
+    emitError("SKILL_INSTALL_FAILED", error.message, { target });
+    return 1;
+  }
+  if (options.forwarded.length === 1 && options.forwarded[0] === "--version") {
+    process.stdout.write(`${ensured.distribution.packageRecord.version}\n`);
+    return 0;
+  }
+
+  const python = discoverPython();
+  if (!python) {
+    emitError(
+      "PYTHON_VERSION_UNSUPPORTED",
+      "Fuploader requires Python >=3.9,<4.0. Install Python and run the command again.",
+    );
+    return 1;
+  }
+  const script = path.join(target, "scripts", "fupload.py");
+  const result = runPython(python, script, options.forwarded);
+  if (result.error) {
+    emitError("PYTHON_LAUNCH_FAILED", result.error.message);
+    return 1;
+  }
+  if (
+    result.status === 0 &&
+    options.forwarded.length === 1 &&
+    ["--help", "-h"].includes(options.forwarded[0])
+  ) {
+    process.stdout.write("\nnpm management:\n  fupload update     Update this CLI and all managed Skills.\n  fupload uninstall  Remove managed Skills, this CLI, and its npm package.\n");
+  }
+  return result.status ?? 1;
+}
+
+process.exitCode = await main();

package/npm/lib/managed-install.mjs

@@ -0,0 +1,86 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export const MANAGED_INSTALL_SCHEMA = "fupload.npm-managed-install.v1";
+export const MANAGED_INSTALL_FILE = "managed-install.json";
+const PACKAGE_NAME = "@follenfang/fupload";
+
+function stateRoot({ platform = process.platform, env = process.env, home = os.homedir() } = {}) {
+  if (platform === "win32") {
+    return path.join(env.LOCALAPPDATA || path.join(home, "AppData", "Local"), "Fupload", "npm");
+  }
+  return path.join(env.XDG_STATE_HOME || path.join(home, ".local", "state"), "fupload", "npm");
+}
+
+function atomicWriteJson(filename, value) {
+  fs.mkdirSync(path.dirname(filename), { recursive: true });
+  const temporary = `${filename}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+  fs.renameSync(temporary, filename);
+}
+
+export function managedInstallFile(options = {}) {
+  return path.join(stateRoot(options), MANAGED_INSTALL_FILE);
+}
+
+export function readManagedInstall(options = {}) {
+  const filename = options.filename || managedInstallFile(options);
+  try {
+    const value = JSON.parse(fs.readFileSync(filename, "utf8"));
+    if (
+      value?.schema !== MANAGED_INSTALL_SCHEMA ||
+      value?.package_name !== PACKAGE_NAME ||
+      !Array.isArray(value.targets)
+    ) {
+      throw new Error("unsupported schema");
+    }
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { schema: MANAGED_INSTALL_SCHEMA, package_name: PACKAGE_NAME, targets: [] };
+    }
+    throw new Error(`Managed Skill registry is invalid: ${filename}`, { cause: error });
+  }
+}
+
+export function recordManagedSkill(target, options = {}) {
+  const filename = options.filename || managedInstallFile(options);
+  const resolved = path.resolve(target);
+  if (resolved === path.parse(resolved).root) {
+    throw new Error("A filesystem root cannot be registered as a managed Skill.");
+  }
+  const state = readManagedInstall({ ...options, filename });
+  const targets = state.targets
+    .filter((entry) => typeof entry?.path === "string" && path.resolve(entry.path) !== resolved)
+    .map((entry) => ({ path: path.resolve(entry.path), registered_at: entry.registered_at }));
+  targets.push({ path: resolved, registered_at: new Date().toISOString() });
+  targets.sort((left, right) => left.path.localeCompare(right.path));
+  atomicWriteJson(filename, {
+    schema: MANAGED_INSTALL_SCHEMA,
+    package_name: PACKAGE_NAME,
+    targets,
+  });
+  return { filename, target: resolved, count: targets.length };
+}
+
+export function clearManagedInstall(options = {}) {
+  const filename = options.filename || managedInstallFile(options);
+  fs.rmSync(filename, { force: true });
+  const npmState = path.dirname(filename);
+  const productState = path.dirname(npmState);
+  for (const directory of [npmState, productState]) {
+    try {
+      if (fs.readdirSync(directory).length === 0) {
+        fs.rmdirSync(directory);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT" && error.code !== "ENOTEMPTY") {
+        throw error;
+      }
+    }
+  }
+}

package/npm/lib/options.mjs

@@ -0,0 +1,38 @@
+import os from "node:os";
+import path from "node:path";
+
+export function resolveSkillDirectory({ explicit, env = process.env, home } = {}) {
+  if (explicit) {
+    return path.resolve(explicit);
+  }
+  if (env.FUPLOAD_AGENT_HOME) {
+    return path.resolve(env.FUPLOAD_AGENT_HOME, "skills", "fupload");
+  }
+  return path.join(home || os.homedir(), ".agents", "skills", "fupload");
+}
+
+export function parseLauncherOptions(argv) {
+  const forwarded = [];
+  let skillDirectory;
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (value === "--skill-dir") {
+      const candidate = argv[index + 1];
+      if (!candidate || candidate.startsWith("--")) {
+        throw new Error("--skill-dir requires a directory path.");
+      }
+      skillDirectory = candidate;
+      index += 1;
+      continue;
+    }
+    if (value.startsWith("--skill-dir=")) {
+      skillDirectory = value.slice("--skill-dir=".length);
+      if (!skillDirectory) {
+        throw new Error("--skill-dir requires a directory path.");
+      }
+      continue;
+    }
+    forwarded.push(value);
+  }
+  return { forwarded, skillDirectory };
+}

package/npm/lib/python.mjs

@@ -0,0 +1,45 @@
+import { spawnSync } from "node:child_process";
+
+function probe(command, args, minimum) {
+  const result = spawnSync(command, [...args, "-c", "import sys; print('.'.join(map(str, sys.version_info[:3])))"], {
+    encoding: "utf8",
+    shell: false,
+    windowsHide: true,
+  });
+  if (result.status !== 0) {
+    return null;
+  }
+  const match = result.stdout.trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+  if (!match) {
+    return null;
+  }
+  const version = match.slice(1).map(Number);
+  if (version[0] !== 3 || version[1] < minimum) {
+    return null;
+  }
+  return { command, args, version };
+}
+
+export function discoverPython({ platform = process.platform, minimumMinor = 9 } = {}) {
+  const candidates = platform === "win32"
+    ? [["python", []], ["py", ["-3"]], ["python3", []]]
+    : [["python3", []], ["python", []]];
+  for (const [command, args] of candidates) {
+    const result = probe(command, args, minimumMinor);
+    if (result) {
+      return result;
+    }
+  }
+  return null;
+}
+
+export function runPython(python, script, args, options = {}) {
+  return spawnSync(python.command, [...python.args, script, ...args], {
+    cwd: options.cwd || process.cwd(),
+    env: options.env || process.env,
+    stdio: options.stdio || "inherit",
+    encoding: options.encoding,
+    shell: false,
+    windowsHide: true,
+  });
+}