@ktpartners/dgs-platform 3.3.0 → 3.3.1

package/CHANGELOG.md

@@ -8,6 +8,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.3.1] - 2026-05-26
+
+### Fixed
+- **`execGit` works on Windows** — `bin/lib/core.cjs:execGit` previously POSIX-quoted args (`'arg with spaces'`) then ran them through `execSync`'s shell. On Windows `execSync` invokes `cmd.exe`, which treats single quotes as literal characters — so `git commit -m 'docs(88): create phase plan'` was tokenised into separate args and git interpreted the trailing words as pathspecs. Every multi-word commit message broke on Windows, affecting essentially every DGS command that commits (`/dgs:fast`, `/dgs:quick`, `/dgs:execute-phase`, `/dgs:complete-quick`, the v1→v2 migration self-commit, etc.). Replaced with `execFileSync('git', args, ...)` which bypasses the shell entirely on both platforms — no quoting needed since `args` is already an array. Preserved the existing `{exitCode, stdout, stderr}` return shape and `.trim()` behaviour. Added round-trip regression test in `tests/core.test.cjs` that asserts a message with spaces, parens, colon, ampersand, and percent (`docs(88): create phase plan & 100% coverage`) survives `init`→`commit`→`log` verbatim (quick-260526-dip).
+- **`execGitWithTimeout` works on Windows** — `bin/lib/sync.cjs:execGitWithTimeout` was a fork of `execGit` (added a `timeout` option per its `(NOT execGit)` comment) and inherited the identical POSIX-quoting bug. Affected `/dgs:sync` pre-flight checks across every registered repo (`remote`, `rev-parse --abbrev-ref HEAD`, etc.). Same fix: `execFileSync('git', args, { ..., timeout: timeoutMs })`. Preserved the `isTimeout`/`isAuth` error classification in the catch block (quick-260526-e5l).
+- **`hasCodeFiles` no longer shells out** — `bin/lib/init.cjs` used `execSync('find . -maxdepth 3 \\( -name "*.ts" -o ... \\) | grep -v node_modules | head -5')` during `/dgs:new-project` to detect existing source files for template selection. `find`/`grep`/`head` aren't on Windows by default and the bash-style `\\(` escaping is shell-specific; the catch-block silently fell back to `hasCode = false`, producing wrong init heuristics on Windows. Extracted a pure-Node `hasCodeFiles(cwd)` helper using `fs.readdirSync({ withFileTypes: true })` — depth 3, skips `node_modules` and `.git`, early-exits at 5 matches across `.ts/.js/.py/.go/.rs/.swift/.java`. Exported for testability; added unit tests in `tests/init.test.cjs` covering depth-3 boundary, depth-4 cap, `node_modules`/`.git` skip, the 7-extension matrix, and nonexistent paths (quick-260526-e5l).
+- **`~/` tilde expansion works on Windows** — `bin/lib/verify.cjs` resolved `~/path` canonical_refs via `path.join(process.env.HOME || '', cleanRef.slice(2))`. On Windows `HOME` is unset, so `|| ''` produced a relative path and `cmdVerifyReferences` falsely reported the ref as missing. Replaced with `path.join(os.homedir(), cleanRef.slice(2))` — `os.homedir()` returns `USERPROFILE` on Windows and `HOME` elsewhere. Added a sentinel-file test in `tests/verify.test.cjs` that creates a real file under `os.homedir()` and verifies the `~/` resolution finds it (quick-260526-e5l).
+- **PDF/DOCX/XLSX extraction no longer shells out** — `bin/lib/docs.cjs` ran the async `pdf-parse`/`mammoth`/`exceljs` libs in a sync context via three near-identical `` execSync(`node -e ${JSON.stringify(script)}`) `` sites. Although `JSON.stringify`'s double quotes are cmd.exe-friendly, this path (a) triggered cmd.exe %-variable expansion on filenames containing `%`, and (b) pushed the script body toward cmd.exe's 8191-char command-line limit on long inputs. Replaced all three with `spawnSync('node', ['-e', script], { shell: false, ... })` — same script body, no shell at all. Added structural source-grep guard in `tests/docs.test.cjs` (`!/execSync\(\s*\`node -e/.test(src)`) so the bug pattern can't regress (quick-260526-e5l).
+
 ## [3.3.0] - 2026-05-15
 
 ### Added

package/deliver-great-systems/bin/lib/core.cjs

@@ -4,7 +4,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const { getPlanningRoot, isV2Install, PROJECTS_DIR } = require('./paths.cjs');
 
 // ─── Path helpers ────────────────────────────────────────────────────────────
@@ -181,11 +181,7 @@ function isGitIgnored(cwd, targetPath) {
 
 function execGit(cwd, args) {
   try {
-    const escaped = args.map(a => {
-      if (/^[a-zA-Z0-9._\-/=:@]+$/.test(a)) return a;
-      return "'" + a.replace(/'/g, "'\\''") + "'";
-    });
-    const stdout = execSync('git ' + escaped.join(' '), {
+    const stdout = execFileSync('git', args, {
       cwd,
       stdio: 'pipe',
       encoding: 'utf-8',

package/deliver-great-systems/bin/lib/docs.cjs

@@ -14,6 +14,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { spawnSync } = require('child_process');
 const { safeReadFile, execGit, generateSlugInternal, output, error } = require('./core.cjs');
 const { getPlanningRoot } = require('./paths.cjs');
 const { findIdeaFile } = require('./ideas.cjs');
@@ -129,10 +130,11 @@ function extractText(filePath, ext) {
       try {
         const pdfParse = require('pdf-parse');
         const buffer = fs.readFileSync(filePath);
-        // pdf-parse returns a promise; we use execSync workaround for sync context
-        // Instead, we'll use a sync extraction approach
+        // pdf-parse returns a promise; run it in a child node process via
+        // spawnSync so the parent can stay synchronous. spawnSync (not
+        // execSync with a shell-built command) is required on Windows where
+        // cmd.exe applies different quoting rules.
         let result = null;
-        const { execSync } = require('child_process');
         const script = `
           const pdfParse = require('pdf-parse');
           const fs = require('fs');
@@ -143,12 +145,15 @@ function extractText(filePath, ext) {
             process.stdout.write(JSON.stringify({ error: err.message }));
           });
         `;
-        const out = execSync(`node -e ${JSON.stringify(script)}`, {
+        const r = spawnSync('node', ['-e', script], {
           encoding: 'utf-8',
           timeout: 30000,
           stdio: ['pipe', 'pipe', 'pipe'],
         });
-        result = JSON.parse(out.trim());
+        if (r.status !== 0) {
+          return { text: null, error: `PDF extraction failed: ${r.stderr || r.error?.message || 'unknown'}` };
+        }
+        result = JSON.parse(r.stdout.trim());
         if (result.error) {
           return { text: null, error: result.error };
         }
@@ -160,7 +165,6 @@ function extractText(filePath, ext) {
 
     if (ext === '.xlsx') {
       try {
-        const { execSync } = require('child_process');
         const script = `
           const ExcelJS = require('exceljs');
           const workbook = new ExcelJS.Workbook();
@@ -178,11 +182,15 @@ function extractText(filePath, ext) {
             process.stdout.write(JSON.stringify({ error: err.message }));
           });
         `;
-        const out = execSync(`node -e ${JSON.stringify(script)}`, {
+        const r = spawnSync('node', ['-e', script], {
           encoding: 'utf-8',
           timeout: 30000,
-        }).trim();
-        const parsed = JSON.parse(out);
+          stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        if (r.status !== 0) {
+          return { text: null, error: `XLSX extraction failed: ${r.stderr || r.error?.message || 'unknown'}` };
+        }
+        const parsed = JSON.parse(r.stdout.trim());
         if (parsed.error) return { text: null, error: parsed.error };
         return { text: parsed.text, error: null };
       } catch (e) {
@@ -202,7 +210,6 @@ function extractText(filePath, ext) {
     if (ext === '.docx') {
       try {
         const mammoth = require('mammoth');
-        const { execSync } = require('child_process');
         const script = `
           const mammoth = require('mammoth');
           mammoth.extractRawText({ path: ${JSON.stringify(filePath)} })
@@ -213,12 +220,15 @@ function extractText(filePath, ext) {
               process.stdout.write(JSON.stringify({ error: err.message }));
             });
         `;
-        const out = execSync(`node -e ${JSON.stringify(script)}`, {
+        const r = spawnSync('node', ['-e', script], {
           encoding: 'utf-8',
           timeout: 30000,
           stdio: ['pipe', 'pipe', 'pipe'],
         });
-        const result = JSON.parse(out.trim());
+        if (r.status !== 0) {
+          return { text: null, error: `DOCX extraction failed: ${r.stderr || r.error?.message || 'unknown'}` };
+        }
+        const result = JSON.parse(r.stdout.trim());
         if (result.error) {
           return { text: null, error: result.error };
         }

package/deliver-great-systems/bin/lib/init.cjs

@@ -88,6 +88,54 @@ function applySyncPull(cwd, workflowName, result) {
   result.needs_pull = false;
 }
 
+// ─── Brownfield detection ───────────────────────────────────────────────────
+
+/**
+ * Detect whether the directory tree rooted at cwd contains any source
+ * files in a small set of common languages, ignoring node_modules and .git,
+ * with a maximum recursion depth of 3 (cwd itself is depth 0).
+ *
+ * Returns true on first match (early termination).
+ * Returns false on any error (e.g. permission denied on top-level dir).
+ *
+ * Pure Node — replaces the prior `find ... | grep ... | head -5` shell
+ * pipeline that does not exist on Windows.
+ *
+ * @param {string} cwd - Directory to scan.
+ * @returns {boolean}
+ */
+function hasCodeFiles(cwd) {
+  const CODE_EXTENSIONS = new Set(['.ts', '.js', '.py', '.go', '.rs', '.swift', '.java']);
+  const SKIP_DIRS = new Set(['node_modules', '.git']);
+  const MAX_DEPTH = 3;
+
+  function walk(dir, depth) {
+    if (depth > MAX_DEPTH) return false;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return false;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        if (walk(path.join(dir, entry.name), depth + 1)) return true;
+      } else if (entry.isFile()) {
+        const ext = path.extname(entry.name).toLowerCase();
+        if (CODE_EXTENSIONS.has(ext)) return true;
+      }
+    }
+    return false;
+  }
+
+  try {
+    return walk(cwd, 0);
+  } catch {
+    return false;
+  }
+}
+
 // ─── v2 Project Context Resolution ──────────────────────────────────────────
 
 /**
@@ -411,17 +459,9 @@ function cmdInitNewProject(cwd, slugArg, raw) {
   const braveKeyFile = path.join(homedir, '.dgs', 'brave_api_key');
   const hasBraveSearch = !!(process.env.BRAVE_API_KEY || fs.existsSync(braveKeyFile));
 
-  // Detect existing code
-  let hasCode = false;
+  // Detect existing code (pure-Node walk, Windows-safe)
+  const hasCode = hasCodeFiles(cwd);
   let hasPackageFile = false;
-  try {
-    const files = execSync('find . -maxdepth 3 \\( -name "*.ts" -o -name "*.js" -o -name "*.py" -o -name "*.go" -o -name "*.rs" -o -name "*.swift" -o -name "*.java" \\) 2>/dev/null | grep -v node_modules | grep -v .git | head -5', {
-      cwd,
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    hasCode = files.trim().length > 0;
-  } catch {}
 
   hasPackageFile = pathExistsInternal(cwd, 'package.json') ||
                    pathExistsInternal(cwd, 'requirements.txt') ||
@@ -1547,4 +1587,5 @@ module.exports = {
   cmdInitProgress,
   cmdInitProgressAll,
   applySyncPull,
+  hasCodeFiles,
 };

package/deliver-great-systems/bin/lib/sync.cjs

@@ -5,7 +5,7 @@
  * with pre-flight checks, error handling, and structured result reporting.
  */
 
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 const { execGit, safeReadFile, loadConfig } = require('./core.cjs');
@@ -29,11 +29,7 @@ const { getLocalConfigPath } = require('./config.cjs');
  */
 function execGitWithTimeout(cwd, args, timeoutMs = 30000) {
   try {
-    const escaped = args.map(a => {
-      if (/^[a-zA-Z0-9._\-/=:@]+$/.test(a)) return a;
-      return "'" + a.replace(/'/g, "'\\''") + "'";
-    });
-    const stdout = execSync('git ' + escaped.join(' '), {
+    const stdout = execFileSync('git', args, {
       cwd,
       stdio: 'pipe',
       encoding: 'utf-8',

package/deliver-great-systems/bin/lib/verify.cjs

@@ -4,6 +4,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const { safeReadFile, normalizePhaseName, execGit, findPhaseInternal, getMilestoneInfo, output, error } = require('./core.cjs');
 const { getPlanningRoot } = require('./paths.cjs');
 const { extractFrontmatter, parseMustHavesBlock } = require('./frontmatter.cjs');
@@ -227,7 +228,7 @@ function cmdVerifyReferences(cwd, filePath, raw) {
   for (const ref of atRefs) {
     const cleanRef = ref.slice(1); // remove @
     const resolved = cleanRef.startsWith('~/')
-      ? path.join(process.env.HOME || '', cleanRef.slice(2))
+      ? path.join(os.homedir(), cleanRef.slice(2))
       : path.join(cwd, cleanRef);
     if (fs.existsSync(resolved)) {
       found.push(cleanRef);

package/package.json

@@ -8,7 +8,7 @@
   "bugs": {
     "url": "https://github.com/KT-Partners-Ltd/dgs-platform-docs/issues"
   },
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Deliver Great Systems Platform — A meta-prompting, context engineering and spec-driven development system for Claude Code and Gemini by KT Partners.",
   "bin": {
     "dgs": "bin/install.js"