@join-pantheon/cli 0.27.0 → 0.29.0

package/dist/which.js

@@ -1,6 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { accessSync, constants, existsSync, statSync } from "node:fs";
-import { posix, win32 } from "node:path";
+import { accessSync, constants, existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, posix, resolve, win32 } from "node:path";
 import { platform } from "node:os";
 export const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.PS1";
 const isWindows = (os = platform()) => os === "win32";
@@ -76,15 +76,79 @@ export function spawnShape(binary, os = platform()) {
         return { command: binary, shell: false };
     return { command: binary, shell: /\.(cmd|bat)$/i.test(binary) };
 }
-export function npmSpawn(args, os = platform(), resolveNpm = () => which("npm", os)) {
+export function npmSpawn(args, os = platform(), resolveNpm = () => which("npm", os), proxyEnv = {}) {
+    const env = Object.keys(proxyEnv).length ? { env: { ...process.env, ...proxyEnv } } : {};
     if (!isWindows(os))
-        return { command: "npm", args: [...args], options: {} };
-    return agentSpawn(resolveNpm() ?? "npm.cmd", args, os);
+        return { command: "npm", args: [...args], options: { ...env } };
+    const s = agentSpawn(resolveNpm() ?? "npm.cmd", args, os);
+    return { ...s, options: { ...s.options, ...env } };
 }
-const cmdQuote = (a) => (/[\s"&|<>^()]/.test(a) || a === "" ? `"${a.replace(/"/g, '\\"')}"` : a);
-export function agentSpawn(binary, args, os = platform()) {
+const CMD_UNSAFE = /["%!^&|<>\r\n\0]/;
+export const cmdSafe = (a) => !CMD_UNSAFE.test(a);
+const cmdQuote = (a) => {
+    if (!cmdSafe(a))
+        throw new CmdLineUnsafe(a);
+    return /[\s&|<>^()]/.test(a) || a === "" ? `"${a.replace(/(\\+)$/, "$1$1")}"` : a;
+};
+export class CmdLineUnsafe extends Error {
+    arg;
+    constructor(arg, binary, why) {
+        super(`${binary ? `${binary} ${why ?? "is a Windows command script Pantheon could not read"}, and ` : ""}this text cannot be passed through cmd.exe safely (it contains a quote, a %, a !, a cmd.exe operator or a line break) — it was not run`);
+        this.arg = arg;
+        this.name = "CmdLineUnsafe";
+    }
+}
+export function inspectCmdShim(shim, read = (f) => { try {
+    return readFileSync(f, "utf8");
+}
+catch {
+    return null;
+} }, exists = existsSync, depth = 0) {
+    const text = read(shim);
+    if (text === null)
+        return { why: "is a Windows command script Pantheon could not read" };
+    if (text.length > 64 * 1024)
+        return { why: "was read but not recognised as a package manager's shim (it is too large to be one)" };
+    const dir = dirname(shim);
+    const re = /"%(?:~dp0|dp0%)\\?([^"%\r\n]+)"[ \t]*%\*[ \t]*\)?[ \t]*\r?$/gm;
+    let rel = null;
+    for (let m = re.exec(text); m; m = re.exec(text))
+        rel = m[1];
+    if (!rel)
+        return { why: "was read but not recognised as a package manager's shim" };
+    const parts = rel.split(/[\\/]+/).filter(Boolean);
+    if (!parts.length)
+        return { why: "was read but not recognised as a package manager's shim" };
+    const target = resolve(dir, ...parts);
+    if (!exists(target))
+        return { why: `was read, but what it runs is not there (${target})` };
+    if (/\.exe$/i.test(target))
+        return { command: target, args: [] };
+    if (/\.(?:cmd|bat)$/i.test(target)) {
+        if (depth >= 4)
+            return { why: "was read, but it runs shims that run shims too deep to follow" };
+        return inspectCmdShim(target, read, exists, depth + 1);
+    }
+    const js = /\.(?:c|m)?js$/i.test(target);
+    if (!js && (/\.[A-Za-z0-9]+$/.test(target) || !/\bnode(?:\.exe)?\b/i.test(text))) {
+        return { why: `was read, but it runs ${target}, which is not something Pantheon can start without cmd.exe` };
+    }
+    const localNode = join(dir, "node.exe");
+    return { command: exists(localNode) ? localNode : process.execPath, args: [target] };
+}
+export function resolveCmdShim(shim, read, exists) {
+    const r = inspectCmdShim(shim, read, exists);
+    return "command" in r ? r : null;
+}
+export function agentSpawn(binary, args, os = platform(), shim = (f) => inspectCmdShim(f)) {
     if (!isWindows(os) || !/\.(cmd|bat)$/i.test(binary))
         return { command: binary, args: [...args], options: {} };
+    if (!args.every(cmdSafe) || !cmdSafe(binary)) {
+        const direct = shim(binary);
+        if (!direct || !("command" in direct))
+            throw new CmdLineUnsafe(args.find((a) => !cmdSafe(a)) ?? binary, binary, direct?.why);
+        return { command: direct.command, args: [...direct.args, ...args], options: {} };
+    }
     const line = [binary, ...args].map(cmdQuote).join(" ");
     return {
         command: process.env.ComSpec || "cmd.exe",

package/dist/workdir.js

@@ -9,6 +9,12 @@ export function gitActivity(path) {
     }
     return 0;
 }
+export function mentions(text, name) {
+    if (!name)
+        return false;
+    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|[^A-Za-z0-9._-])${esc}(?=$|[\\/]|\\.git(?![A-Za-z0-9_-])|\\.(?![A-Za-z0-9_-])|[^A-Za-z0-9._-])`).test(text);
+}
 export function pickWorkdir(bindings, hints, team, activity = gitActivity, exists = existsSync) {
     const live = bindings.filter((b) => exists(b.path));
     if (!live.length) {
@@ -17,7 +23,7 @@ export function pickWorkdir(bindings, hints, team, activity = gitActivity, exist
             note: `no folder on this machine is bound to "${team}", so this opens in your home folder. To fix it, run  pantheon use ${team} --here  inside the repo.`,
         };
     }
-    const named = live.filter((b) => hints.some((h) => (b.origin ? h.includes(b.origin) : false) || h.includes(b.path)));
+    const named = live.filter((b) => hints.some((h) => (b.origin ? mentions(h, b.origin) : false) || mentions(h, b.path)));
     const pool = named.length ? named : live;
     const chosen = [...pool].sort((x, y) => (activity(y.path) - activity(x.path)) || (y.bound_at - x.bound_at))[0];
     const others = live.filter((b) => b.path !== chosen.path).map((b) => basename(b.path));