@geml/logseq-sync 2.0.3 → 2.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geml/logseq-sync",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "publishConfig": {
     "access": "public"
   },

package/watcher/bin/logseq-sync.mjs

@@ -135,7 +135,9 @@ for (let i = 0; i < args.length; i++) {
   } else if (arg === "--api-server-token") {
     needValue(i, "--api-server-token");
     flags.apiServerToken = args[++i];
-  } else if (arg.startsWith("--")) {
+  } else if (arg.startsWith("-")) {
+    // One dash included: "-graph demo" once sailed through as a graph literally
+    // named "-graph" and a vault named "demo" — a typo must stop, not sync.
     console.error(`Error: Unknown flag "${arg}". Run \`logseq-sync --help\` for usage.`);
     process.exit(2);
   } else if (subcommand === null && positional.length === 0 && (arg === "doctor" || arg === "restore")) {
@@ -278,13 +280,13 @@ function resolveGraphOrExit() {
   if (detected?.candidates) {
     console.error(
       `Error: several graphs and none open in the app — ${detected.candidates.join(", ")}. ` +
-        `Pick one with --graph <name>.`
+        `Pick one with --graph <name>. Run \`logseq-sync doctor\` for the full picture.`
     );
     process.exit(2);
   }
   console.error(
     `Error: no Logseq graphs found under ${join(logseqRootDir(probe), "graphs")}. ` +
-      `Open a graph in Logseq first, or name one with --graph <name>.`
+      `Open a graph in Logseq first. Run \`logseq-sync doctor\` for the full picture.`
   );
   process.exit(2);
 }
@@ -293,7 +295,8 @@ function resolveVaultOrExit() {
   if (vaultRaw) return resolve(expandHome(vaultRaw));
   console.error(
     `Error: no vault directory. Set it in Logseq — Settings → Plugins → ${PLUGIN_TITLE} → ` +
-      `"Vault folder" — or pass one: logseq-sync <vault-dir>.`
+      `"Vault folder" — or pass one: logseq-sync <vault-dir>. ` +
+      `Run \`logseq-sync doctor\` for the full picture.`
   );
   process.exit(2);
 }
@@ -395,20 +398,34 @@ if (subcommand === "doctor") doctor();
 graphName = resolveGraphOrExit();
 
 // Validate graph name to prevent command/path injection
-if (!/^[a-zA-Z0-9_.-]+$/.test(graphName)) {
+// The first character must not be a dash or a dot: the name travels as argv
+// into the exporting CLI, where a leading dash reads as a flag ("-graph"
+// arrived here as a real user typo for --graph), and "." / ".." read as paths.
+if (!/^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(graphName)) {
   console.error(`Error: Invalid graph name "${graphName}". Only alphanumeric characters, hyphens, and underscores are allowed.`);
   process.exit(2);
 }
 
 // `logseq graph export --graph <name>` does not fail on an unknown name — it
 // CREATES that graph and exports the empty result. A typo would then sync
-// emptiness over the vault and commit it. Refuse names we cannot see on disk.
-// An unreadable graphs directory yields an empty list; that is "I do not know",
-// not "it is missing", so the check only fires when we did find graphs.
-if (knownGraphs.length > 0 && !knownGraphs.includes(graphName)) {
+// emptiness over the vault and commit it. Refuse names we cannot see,
+// INCLUDING when we see none at all: a bare run calls zero graphs a hard
+// error, and naming one does not make graphs exist — treating the same state
+// as "cannot verify, proceed" is how `--graph demo` once sailed past this
+// check straight into the vault error, and reads as a contradiction. The
+// escape hatches are real, not hypothetical: LOGSEQ_ROOT_DIR when the graphs
+// live elsewhere, and the API-server route, which exports whatever graph the
+// app has open and ignores local directories entirely.
+if (!apiServerToken && !knownGraphs.includes(graphName)) {
   console.error(
-    `Error: no graph named "${graphName}" — found ${knownGraphs.join(", ")}. ` +
-      `(The app CLI would silently create "${graphName}" rather than fail.)`
+    knownGraphs.length > 0
+      ? `Error: no graph named "${graphName}" — found ${knownGraphs.join(", ")}. ` +
+          `(The app CLI would silently create "${graphName}" rather than fail.) ` +
+          `Run \`logseq-sync doctor\` for the full picture.`
+      : `Error: no graph named "${graphName}" — no graphs found under ` +
+          `${join(logseqRootDir(probe), "graphs")} at all, and the app CLI would silently ` +
+          `create "${graphName}" and sync emptiness. If your graphs live elsewhere, set ` +
+          `LOGSEQ_ROOT_DIR. Run \`logseq-sync doctor\` for the full picture.`
   );
   process.exit(2);
 }
@@ -476,9 +493,19 @@ function runLogseqCli(...cmdArgs) {
     });
   }
 
-  // Fallback to npx (executable npx.cmd on Windows, npx on Unix) without shell: true
-  const npxCmd = process.platform === "win32" ? "npx.cmd" : "npx";
-  return execFileSync(npxCmd, ["-y", "@logseq/cli", ...cmdArgs], {
+  // On Windows the npx fallback is an instruction, not a spawn: Node refuses
+  // to run a .cmd without a shell (CVE-2024-27980), and routing a user-typed
+  // graph name through cmd.exe to get around that is how injection happens.
+  // Every prior attempt died as `spawnSync npx.cmd EINVAL`, once every poll.
+  if (process.platform === "win32") {
+    throw new Error(
+      "@logseq/cli is not installed where I can see it. Install it once\n" +
+      "  (mkdir logseq-cli && cd logseq-cli && npm init -y && npm i @logseq/cli)\n" +
+      "and point LOGSEQ_CLI_DIR at that directory — or pass --app-cli <path>\n" +
+      "to the desktop app's CLI."
+    );
+  }
+  return execFileSync("npx", ["-y", "@logseq/cli", ...cmdArgs], {
     cwd: cliCwd,
     encoding: "utf8",
     shell: false,