@michengai/dsh-codex-suite-installer 0.1.4 → 0.1.6

package/README.md

@@ -55,7 +55,7 @@ dsh plugin --profile web add @michengai/dsh-codex-ui@latest --registry=https://r
 Preview the installation plan from a repository checkout:
 
 ```powershell
-node .\packages\dsh-codex-suite\bin.mjs --profile codex --dry-run
+node .\packages\dsh-codex-suite-installer\bin.mjs --profile codex --dry-run
 ```
 
 Remove `--dry-run` to apply it. The checkout path resolves the local `workspace:*` entry to the root package version.

package/README.zh-CN.md

@@ -55,7 +55,7 @@ dsh plugin --profile web add @michengai/dsh-codex-ui@latest --registry=https://r
 仓库检出状态下可先查看安装计划：
 
 ```powershell
-node .\packages\dsh-codex-suite\bin.mjs --profile codex --dry-run
+node .\packages\dsh-codex-suite-installer\bin.mjs --profile codex --dry-run
 ```
 
 正式执行时去掉 `--dry-run`。安装器会读取工作区根包版本替换本地的 `workspace:*`。

package/bin.mjs

@@ -5,6 +5,6 @@ import { installSuite } from './installer.mjs'
 try {
   installSuite()
 } catch (error) {
-  process.stderr.write(`dsh-codex-suite: ${error instanceof Error ? error.message : String(error)}\n`)
+  process.stderr.write(`dsh-codex-suite-installer: ${error instanceof Error ? error.message : String(error)}\n`)
   process.exitCode = 1
 }

package/installer.mjs

@@ -1,7 +1,7 @@
 import { spawnSync } from 'node:child_process'
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { resolve } from 'node:path'
+import { resolve, win32 } from 'node:path'
 
 export const SUITE_PACKAGE = '@michengai/dsh-codex-suite'
 export const BASE_BUNDLE = '@deepseek-ai/dsh-base'
@@ -94,18 +94,32 @@ export function directInstallArgs(profile, registry, manifest = suiteManifest) {
 }
 
 export function helpText() {
-  return `Usage: dsh-codex-suite [options]\n\nInstall every Codex Suite member as a direct dependency of one DSH profile.\n\nOptions:\n  --profile <name>    target profile (default: web)\n  --registry <url>    npm registry (default: https://registry.npmjs.org/)\n  --dry-run           print commands without changing the profile\n  -h, --help          show this help\n`
+  return `Usage: dsh-codex-suite-installer [options]\n\nInstall every Codex Suite member as a direct dependency of one DSH profile.\n\nOptions:\n  --profile <name>    target profile (default: web)\n  --registry <url>    npm registry (default: https://registry.npmjs.org/)\n  --dry-run           print commands without changing the profile\n  -h, --help          show this help\n`
 }
 
 function quote(argument) {
   return /[\s"']/u.test(argument) ? JSON.stringify(argument) : argument
 }
 
+export function validateWindowsDshCommand(command) {
+  if (typeof command !== 'string' || command === '' || command.trim() !== command || /["&|<>^%\r\n]/u.test(command)) {
+    throw new Error('DSH_BIN contains unsupported shell characters.')
+  }
+  if (/^[0-9A-Za-z._-]+$/u.test(command)) return command
+  if (/^[A-Za-z]:\\/u.test(command) && win32.isAbsolute(command)) return command
+  throw new Error('DSH_BIN must be a command name or an absolute local Windows path.')
+}
+
+function quoteWindowsCommandArgument(argument) {
+  if (/["\r\n]/u.test(argument)) throw new Error('dsh argument contains unsupported shell characters.')
+  return `"${argument}"`
+}
+
 function runDsh(args, { dryRun = false, command = process.env.DSH_BIN || 'dsh' } = {}) {
   process.stdout.write(`> dsh ${args.map(quote).join(' ')}\n`)
   if (dryRun) return
   const result = process.platform === 'win32'
-    ? spawnSync(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', `call ${/\s/.test(command) ? `"${command.replaceAll('"', '""')}"` : command} ${args.join(' ')}`], { encoding: 'utf8', stdio: 'inherit', windowsHide: true })
+    ? spawnSync(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', `call ${quoteWindowsCommandArgument(validateWindowsDshCommand(command))} ${args.map(quoteWindowsCommandArgument).join(' ')}`], { encoding: 'utf8', stdio: 'inherit', windowsHide: true })
     : spawnSync(command, args, { encoding: 'utf8', stdio: 'inherit' })
   if (result.error !== undefined) throw new Error(`Unable to run dsh: ${result.error.message}`)
   if (result.status !== 0) throw new Error(`dsh exited with code ${result.status ?? 1}.`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-codex-suite-installer",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "轻量 DSH Codex Suite 安装器：将六个成员装为同一 profile 的直接插件",
   "license": "Apache-2.0",
   "type": "module",
@@ -22,12 +22,12 @@
   },
   "dshCodexSuite": {
     "members": {
-      "@michengai/dsh-archive-manager": "0.1.13",
-      "@michengai/dsh-codex-ui": "0.2.87",
-      "@michengai/dsh-skills-manager": "0.1.24",
+      "@michengai/dsh-archive-manager": "0.1.16",
+      "@michengai/dsh-codex-ui": "0.2.89",
+      "@michengai/dsh-skills-manager": "0.1.25",
       "@michengai/dsh-agency-agents": "0.1.21",
       "@michengai/dsh-im-connect": "0.1.24",
-      "@michengai/dsh-automation": "0.1.15"
+      "@michengai/dsh-automation": "0.1.21"
     }
   }
 }