@hadoku/dev-vault 1.5.1 → 1.5.3

package/dev-vault.mjs

@@ -73,6 +73,7 @@
  */
 
 import { spawn } from 'node:child_process';
+import { spawnSpec } from './spawn-spec.mjs';
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import process from 'node:process';
@@ -330,7 +331,11 @@ if (!process.env.NODE_AUTH_TOKEN && fetched.HADOKU_NPM_READ_TOKEN) {
 // guard that consumed this was removed 2026-08-03 — pnpm 11 runs preinstall
 // AFTER dependency fetch, so it could never rescue an unauthenticated
 // install; `pnpm vault-install` is the documented path.)
-const child = spawn(childCmd[0], childCmd.slice(1), {
+// Through cmd.exe on Windows, where pnpm/vite/playwright are .cmd shims
+// (spawn-spec.mjs).
+const [spawnCmd, spawnArgs, spawnOpts] = spawnSpec(childCmd);
+const child = spawn(spawnCmd, spawnArgs, {
+	...spawnOpts,
 	stdio: 'inherit',
 	env: { ...process.env, ...fetched, ...derived, HADOKU_DEV_VAULT_ACTIVE: '1' },
 });

package/login.mjs

@@ -21,8 +21,23 @@ import { mainCheckoutOf } from './key-file.mjs';
 export const EDGE = 'https://hadoku.me';
 const FILE = '.devvault.local.json';
 const POLL_MS = 3000;
+// A request lives a day (edge DEVICE_TTL_S), so the approver can get to it
+// later. Poll briskly while someone is likely approving right now, then slowly:
+// a day at 3s would be ~29k requests for one abandoned login.
+const BRISK_MS = 10 * 60 * 1000;
+const SLOW_POLL_MS = 30_000;
 const DAY_MS = 24 * 60 * 60 * 1000;
 
+/** 86_400_000 -> "24 hours", 600_000 -> "10 minutes". */
+export function spell(ms) {
+	const min = Math.round(ms / 60_000);
+	if (min % 60 === 0) {
+		const h = min / 60;
+		return `${h} hour${h === 1 ? '' : 's'}`;
+	}
+	return `${min} minute${min === 1 ? '' : 's'}`;
+}
+
 function runGit(cwd, args) {
 	const r = spawnSync('git', args, { cwd, encoding: 'utf-8' });
 	return r.status === 0 ? r.stdout.trim() : '';
@@ -94,9 +109,12 @@ export async function login({
 	log(`[dev-vault]   code ${userCode}  ·  ${host}${repo ? `  ·  ${repo}` : ''}`);
 	log('[dev-vault] waiting for approval…');
 
-	const deadline = now() + (Number(expiresIn) || 600) * 1000;
+	const ttlMs = (Number(expiresIn) || 600) * 1000;
+	const startedAt = now();
+	const deadline = startedAt + ttlMs;
+	log(`[dev-vault] (the link stays valid for ${spell(ttlMs)}; leave this running)`);
 	while (now() < deadline) {
-		await sleep(POLL_MS);
+		await sleep(now() - startedAt < BRISK_MS ? POLL_MS : SLOW_POLL_MS);
 		let polled;
 		try {
 			polled = await postJson(fetchImpl, `${base}/auth/service-access/device/poll`, {
@@ -129,6 +147,6 @@ export async function login({
 		);
 		return 0;
 	}
-	log('[dev-vault] login: nobody approved within 10 minutes. Run `dev-vault login` again.');
+	log(`[dev-vault] login: nobody approved within ${spell(ttlMs)}. Run \`dev-vault login\` again.`);
 	return 1;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hadoku/dev-vault",
-  "version": "1.5.1",
-  "gitHead": "a1ecd41d02f32e8b58bfa42fec6a8e5df302333a",
+  "version": "1.5.3",
+  "gitHead": "4942c6f53fb701a7ba3f411dbb76c55ec65d1b9c",
   "description": "Local-dev vault-broker shim — fetches secrets from the hadoku mgmt-api broker and execs a child command with them in process.env. Works for any consuming repo (Node or non-Node).",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
     "key-file.mjs",
     "install-id.mjs",
     "login.mjs",
+    "spawn-spec.mjs",
     "README.md",
     "LICENSE"
   ],

package/spawn-spec.mjs

@@ -0,0 +1,23 @@
+/**
+ * How to start the child command on this platform.
+ *
+ * On Windows, `pnpm`, `vite`, `playwright` and every other npm-installed
+ * command is a `.cmd` shim, and Node starts a `.cmd` only through a shell
+ * (since Node 20.12 it refuses outright, CVE-2024-27980). Spawned bare,
+ * `dev-vault -- pnpm install` failed with ENOENT/EINVAL for every Windows
+ * contributor, which is most of the people outside the fleet. So on win32 the
+ * child goes through cmd.exe, with each argument quoted where cmd would
+ * otherwise split or reinterpret it. Everywhere else nothing changes.
+ */
+
+/** One argument as cmd.exe reads it back verbatim. */
+export function quoteForCmd(arg) {
+	if (arg !== '' && !/[\s"&|<>^%()!,;=]/.test(arg)) return arg;
+	return `"${arg.replace(/"/g, '""')}"`;
+}
+
+/** `[command, args, options]` for `spawn`. */
+export function spawnSpec(argv, platform = process.platform) {
+	if (platform !== 'win32') return [argv[0], argv.slice(1), {}];
+	return [argv.map(quoteForCmd).join(' '), [], { shell: true }];
+}