@pnpm/network.web-auth 1100.0.0 → 1101.0.0

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
-export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenExecFile, type PromptBrowserOpenParams, type PromptBrowserOpenProcess, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
+export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenParams, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
 export { isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, type OtpPromptOptions, type OtpPromptResponse, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/promptBrowserOpen.d.ts

@@ -2,21 +2,15 @@ export interface PromptBrowserOpenReadlineInterface {
     once: (event: string, listener: () => void) => void;
     close: () => void;
 }
-export interface PromptBrowserOpenExecFile {
-    (file: string, args: readonly string[], callback: (error: Error | null) => void): unknown;
-}
-export interface PromptBrowserOpenProcess {
-    platform?: NodeJS.Platform;
-    stdin: {
-        isTTY?: boolean;
-    };
-}
 export interface PromptBrowserOpenContext {
     createReadlineInterface?: () => PromptBrowserOpenReadlineInterface;
-    execFile?: PromptBrowserOpenExecFile;
     globalInfo: (message: string) => void;
     globalWarn: (message: string) => void;
-    process: PromptBrowserOpenProcess;
+    process: {
+        stdin: {
+            isTTY?: boolean;
+        };
+    };
 }
 export interface PromptBrowserOpenParams {
     authUrl: string;

package/lib/promptBrowserOpen.js

@@ -1,3 +1,4 @@
+import open from 'open';
 /**
  * Wraps a token-polling promise with an optional "Press ENTER to open in
  * browser" prompt.
@@ -11,65 +12,23 @@
  * logged as warnings and do not interrupt the poll.
  */
 export async function promptBrowserOpen({ authUrl, context, pollPromise, }) {
-    const { createReadlineInterface, execFile, globalInfo, globalWarn, process } = context;
-    if (!createReadlineInterface || !execFile || !process.stdin.isTTY) {
+    const { createReadlineInterface, globalInfo, globalWarn, process } = context;
+    if (!createReadlineInterface || !process.stdin.isTTY) {
         return pollPromise;
     }
-    // Validate the URL before passing it to a shell command. On Windows,
-    // cmd.exe re-parses execFile arguments and would interpret shell
-    // metacharacters (&, |, etc.) in the URL as operators.
-    let parsedUrl;
+    // The authUrl comes from an untrusted registry response, so only allow
+    // http(s) URLs through to `open()`.
+    let canonicalUrl;
     try {
-        parsedUrl = new URL(authUrl);
+        const parsed = new URL(authUrl);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return pollPromise;
+        }
+        canonicalUrl = parsed.href;
     }
     catch {
         return pollPromise;
     }
-    if (parsedUrl.protocol !== 'https:' && parsedUrl.protocol !== 'http:') {
-        return pollPromise;
-    }
-    const canonicalUrl = parsedUrl.href;
-    let cmd;
-    let args;
-    switch (process.platform) {
-        case 'darwin':
-            cmd = 'open';
-            args = [canonicalUrl];
-            break;
-        case 'win32': {
-            cmd = 'cmd';
-            // Windows edge cases for opening URLs from Node.js:
-            //
-            // The clean approach would be calling the Win32 ShellExecuteW API
-            // directly, which is what native Windows programs use. However,
-            // ShellExecuteW is a native API, not an executable — Node.js cannot
-            // call it from child_process without a native addon.
-            //
-            // All process-spawning alternatives have drawbacks:
-            //   - cmd /c start:    cmd.exe re-parses args; special characters in
-            //                      URLs (&, |, ^, %, etc.) are treated as shell
-            //                      operators
-            //   - explorer.exe:    breaks on URLs with query strings (?key=value),
-            //                      opening File Explorer instead of the browser
-            //                      (https://github.com/dotnet/runtime/issues/108817)
-            //   - url.dll:         undocumented, can strip query params on Win 7+
-            //   - PowerShell:      slow startup, own escaping issues
-            //
-            // Since pnpm already ships native addons, a small Rust/N-API addon
-            // calling ShellExecuteW directly could replace this in the future.
-            //
-            // For now, use cmd /c start with ^ escaping for special characters.
-            const escapedUrl = canonicalUrl.replace(/[&|<>^%()!]/g, '^$&');
-            args = ['/c', 'start', '', escapedUrl];
-            break;
-        }
-        case 'linux':
-            cmd = 'xdg-open';
-            args = [canonicalUrl];
-            break;
-        default:
-            return pollPromise;
-    }
     let rl;
     try {
         rl = createReadlineInterface();
@@ -80,10 +39,16 @@ export async function promptBrowserOpen({ authUrl, context, pollPromise, }) {
     }
     globalInfo('Press ENTER to open the URL in your browser.');
     rl.once('line', () => {
-        runExecFile(execFile, cmd, args).catch((err) => {
+        const handleOpenError = (err) => {
             globalWarn(`Could not open browser automatically: ${String(err)}`);
             globalInfo('Please open the URL shown above manually.');
-        });
+        };
+        try {
+            open(canonicalUrl).catch(handleOpenError);
+        }
+        catch (err) {
+            handleOpenError(err);
+        }
     });
     // Only await pollPromise — do NOT await the Enter keypress.
     //
@@ -101,14 +66,4 @@ export async function promptBrowserOpen({ authUrl, context, pollPromise, }) {
         rl.close();
     }
 }
-function runExecFile(execFile, cmd, args) {
-    return new Promise((resolve, reject) => {
-        execFile(cmd, args, (err) => {
-            if (err)
-                reject(err);
-            else
-                resolve();
-        });
-    });
-}
 //# sourceMappingURL=promptBrowserOpen.js.map

package/lib/withOtpHandling.d.ts

@@ -1,6 +1,6 @@
 import { PnpmError } from '@pnpm/error';
 import type { WebAuthFetchOptions, WebAuthFetchResponse } from './pollForWebAuthToken.js';
-import type { PromptBrowserOpenExecFile, PromptBrowserOpenReadlineInterface } from './promptBrowserOpen.js';
+import type { PromptBrowserOpenReadlineInterface } from './promptBrowserOpen.js';
 export interface OtpEnquirer {
     prompt: (options: OtpPromptOptions) => Promise<OtpPromptResponse | undefined>;
 }
@@ -29,7 +29,6 @@ export interface OtpContext {
     setTimeout: (cb: () => void, ms: number) => void;
     createReadlineInterface?: () => PromptBrowserOpenReadlineInterface;
     enquirer: OtpEnquirer;
-    execFile?: PromptBrowserOpenExecFile;
     fetch: (url: string, options: WebAuthFetchOptions) => Promise<WebAuthFetchResponse>;
     globalInfo: (message: string) => void;
     globalWarn: (message: string) => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1100.0.0",
+  "version": "1101.0.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -25,13 +25,14 @@
     "!*.map"
   ],
   "dependencies": {
+    "open": "^7.4.2",
     "qrcode-terminal": "^0.12.0",
     "@pnpm/error": "1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/qrcode-terminal": "^0.12.2",
-    "@pnpm/network.web-auth": "1100.0.0"
+    "@pnpm/network.web-auth": "1101.0.0"
   },
   "engines": {
     "node": ">=22.13"