@hadoku/dev-vault 1.5.2 → 1.5.3

package/dev-vault.mjs

@@ -73,6 +73,7 @@
  */
 
 import { spawn } from 'node:child_process';
+import { spawnSpec } from './spawn-spec.mjs';
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import process from 'node:process';
@@ -330,7 +331,11 @@ if (!process.env.NODE_AUTH_TOKEN && fetched.HADOKU_NPM_READ_TOKEN) {
 // guard that consumed this was removed 2026-08-03 — pnpm 11 runs preinstall
 // AFTER dependency fetch, so it could never rescue an unauthenticated
 // install; `pnpm vault-install` is the documented path.)
-const child = spawn(childCmd[0], childCmd.slice(1), {
+// Through cmd.exe on Windows, where pnpm/vite/playwright are .cmd shims
+// (spawn-spec.mjs).
+const [spawnCmd, spawnArgs, spawnOpts] = spawnSpec(childCmd);
+const child = spawn(spawnCmd, spawnArgs, {
+	...spawnOpts,
 	stdio: 'inherit',
 	env: { ...process.env, ...fetched, ...derived, HADOKU_DEV_VAULT_ACTIVE: '1' },
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hadoku/dev-vault",
-  "version": "1.5.2",
-  "gitHead": "9010a68c19d319334869bb549bc90acc1ee4d0ca",
+  "version": "1.5.3",
+  "gitHead": "4942c6f53fb701a7ba3f411dbb76c55ec65d1b9c",
   "description": "Local-dev vault-broker shim — fetches secrets from the hadoku mgmt-api broker and execs a child command with them in process.env. Works for any consuming repo (Node or non-Node).",
   "type": "module",
   "bin": {
@@ -13,6 +13,7 @@
     "key-file.mjs",
     "install-id.mjs",
     "login.mjs",
+    "spawn-spec.mjs",
     "README.md",
     "LICENSE"
   ],

package/spawn-spec.mjs

@@ -0,0 +1,23 @@
+/**
+ * How to start the child command on this platform.
+ *
+ * On Windows, `pnpm`, `vite`, `playwright` and every other npm-installed
+ * command is a `.cmd` shim, and Node starts a `.cmd` only through a shell
+ * (since Node 20.12 it refuses outright, CVE-2024-27980). Spawned bare,
+ * `dev-vault -- pnpm install` failed with ENOENT/EINVAL for every Windows
+ * contributor, which is most of the people outside the fleet. So on win32 the
+ * child goes through cmd.exe, with each argument quoted where cmd would
+ * otherwise split or reinterpret it. Everywhere else nothing changes.
+ */
+
+/** One argument as cmd.exe reads it back verbatim. */
+export function quoteForCmd(arg) {
+	if (arg !== '' && !/[\s"&|<>^%()!,;=]/.test(arg)) return arg;
+	return `"${arg.replace(/"/g, '""')}"`;
+}
+
+/** `[command, args, options]` for `spawn`. */
+export function spawnSpec(argv, platform = process.platform) {
+	if (platform !== 'win32') return [argv[0], argv.slice(1), {}];
+	return [argv.map(quoteForCmd).join(' '), [], { shell: true }];
+}