@house365/comate 0.2.8 → 0.2.9

package/bin/init-run.mjs

@@ -3,8 +3,10 @@ import { spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 
+import { findBash } from './doctor.mjs';
 import {
   NPM_TIMEOUT_MS,
+  capture,
   SKILLS_TIMEOUT_MS,
   npmInvocation,
   openSpecState,
@@ -55,6 +57,19 @@ export async function init(pkgRoot) {
     return 1;
   }
 
+  // comate's skills are bash scripts needing associative arrays (bash 4+), and
+  // macOS ships 3.2. Fail here rather than installing everything and letting the
+  // first /comate call die inside a sourced library.
+  const bash = bashVersion();
+  if (bash !== null && bash < 4) {
+    console.error(
+      `\ncomate 的脚本需要 bash >= 4，当前 ${bash === 0 ? '未知版本' : `bash ${bash}.x`}。\n` +
+        'macOS 自带 bash 3.2（授权原因），装一个新的：\n\n  brew install bash\n\n' +
+        '装好后重跑 comate init。',
+    );
+    return 3;
+  }
+
   const stopSpinner = startSpinner('Initializing…');
 
   // 1. OpenSpec CLI — a PATH command, so always global.
@@ -236,6 +251,22 @@ export function banner(version, { ci = isCI() } = {}) {
   ].join('\n');
 }
 
+// Major version of the bash that comate's scripts will actually run under, or
+// null when there is no bash at all — that is doctor's diagnosis to deliver, not
+// a reason to block the install. Windows resolves through findBash so a Git Bash
+// install is not mistaken for the WSL launcher.
+// Parsed from --version rather than `-c 'echo $BASH_VERSINFO'`: capture() runs
+// through a shell on Windows, which swallows the variable before bash sees it.
+export function bashVersion(probe = (bin) => capture(bin, ['--version'])) {
+  const bin = process.platform === 'win32' ? findBash() : 'bash';
+  if (!bin) return null;
+  const out = probe(bin);
+  if (out === null) return null;
+  // "GNU bash, version 5.2.26(1)-release ..." / macOS: "... version 3.2.57(1)"
+  const major = out.match(/version (\d+)\./)?.[1];
+  return major === undefined ? 0 : Number(major);
+}
+
 // Every major CI sets CI=true; GITHUB_ACTIONS covers the Actions runner even in
 // the odd config that doesn't.
 function isCI() {

package/bin/init.mjs

@@ -98,12 +98,16 @@ function run({ command, args, shell }, timeout, { quiet = false } = {}) {
   return { ok: true };
 }
 
-function capture(command, args) {
+// shell defaults to off: passing args with shell:true is deprecated in Node 24
+// and is an injection surface, since the args are concatenated rather than
+// escaped. Callers that genuinely need cmd.exe resolution (a bare `openspec`
+// that only exists as openspec.cmd) opt in explicitly.
+function capture(command, args, { shell = false } = {}) {
   const { status, stdout: out } = spawnSync(command, args, {
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'ignore'],
     timeout: 15_000,
-    shell: process.platform === 'win32',
+    ...(shell ? { shell: true } : {}),
   });
   return status === 0 ? out.trim() : null;
 }
@@ -138,7 +142,9 @@ function skillsInvocation(pkgRoot, args) {
 }
 
 function openSpecState() {
-  const version = capture('openspec', ['--version']);
+  // shell:true on Windows: npm installs this as openspec.cmd, which cannot be
+  // spawned directly. bashVersion needs no shell — it has a real executable path.
+  const version = capture('openspec', ['--version'], { shell: process.platform === 'win32' });
   if (version === null) return { status: 'missing' };
   return { status: atLeast(version, MIN_OPENSPEC) ? 'ready' : 'outdated', version };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@house365/comate",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "comate —— OpenSpec + Superpowers 规约驱动的 AI 开发编排器（Agent Skills）",
   "type": "module",
   "license": "MIT",

package/skills/comate/scripts/comate.sh

@@ -25,6 +25,24 @@
 
 set -euo pipefail
 
+# Must come before sourcing the lib. comate-lib.sh declares associative arrays
+# at load time, which bash 3.2 (what macOS ships as /bin/bash) parses as an
+# ordinary array assignment — the subscript is then evaluated as arithmetic and
+# `set -u` aborts with "schema_version: unbound variable". doctor has its own
+# bash>=4 check, but it never got to run: the source above it already died.
+if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ]; then
+  cat >&2 <<EOF
+comate needs bash >= 4 (associative arrays), found ${BASH_VERSION:-unknown}.
+
+macOS ships bash 3.2 for licensing reasons. Install a current one:
+  brew install bash
+
+Then re-run through it, e.g.:
+  $(command -v brew >/dev/null 2>&1 && echo "\$(brew --prefix)/bin/bash" || echo /opt/homebrew/bin/bash) $0 $*
+EOF
+  exit 3
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "$(readlink -f "$0" 2>/dev/null || echo "$0")")" && pwd)"
 # shellcheck source=comate-lib.sh
 . "$SCRIPT_DIR/comate-lib.sh"