@qt4798/pi-web 0.17.2 → 0.17.4

package/bin/pi-web.js

@@ -1,140 +1,140 @@
-#!/usr/bin/env node
-"use strict";
-
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { spawn } = require("child_process");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const path = require("path");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const fs = require("fs");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { parseLaunchOptions, assessLanExposure } = require("./pi-web-options");
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const { wireChildProcessLifecycle } = require("./process-lifecycle");
-
-// Apply the undici CVE fix (formerly a postinstall hook). Running it here —
-// before the pi agent's undici can be loaded — keeps installs quiet under
-// npm >= 11.16's allow-scripts policy and survives installs that skip scripts.
-try {
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  require("./fix-pi-agent-undici").applyUndiciFix();
-} catch {
-  // Best-effort; the app still starts with the shrinkwrapped undici if the
-  // fix cannot be applied.
-}
-
-const pkgDir = path.join(__dirname, "..");
-const nextDir = path.join(pkgDir, ".next");
-
-// Resolve next's CLI entry directly to avoid relying on .bin symlinks (which
-// may not exist when installed via npx).
-let nextBin;
-try {
-  nextBin = require.resolve("next/dist/bin/next", { paths: [pkgDir] });
-} catch {
-  // Fallback: locate next package root and derive the bin path manually.
-  try {
-    const nextPkg = require.resolve("next/package.json", { paths: [pkgDir] });
-    nextBin = path.join(path.dirname(nextPkg), "dist", "bin", "next");
-  } catch {
-    nextBin = path.join(pkgDir, "node_modules", "next", "dist", "bin", "next");
-  }
-}
-
-let launchOptions;
-try {
-  launchOptions = parseLaunchOptions();
-} catch (error) {
-  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
-  process.exit(1);
-}
-if (launchOptions.help) {
-  const { getHelpText } = require("./pi-web-options");
-  process.stdout.write(getHelpText());
-  process.exit(0);
-}
-const { port, hostname, openBrowser } = launchOptions;
-
-// Apply the same heap cap as the npm scripts so `pi-web` (production entry)
-// never lets the V8 heap balloon to Next.js's auto 50%-of-RAM default.
-const { mergedNodeOptions } = require("./with-memory-limit");
-process.env.NODE_OPTIONS = mergedNodeOptions(process.env.NODE_OPTIONS);
-
-// Idle memory watchdog, loaded only into the next-server process. Injected as
-// a node CLI arg (not NODE_OPTIONS) so agent-spawned child processes never
-// inherit it. Disabled with PI_WEB_RSS_RESTART_MB=0; the module itself also
-// refuses to run when it doesn't know the port to ask about running sessions.
-const watchdogPreload = path.join(__dirname, "watchdog-preload.js");
-
-if (!fs.existsSync(nextDir)) {
-  console.error("Build artifacts not found. Please report this issue.");
-  process.exit(1);
-}
-
-const lanExposure = assessLanExposure(hostname);
-if (lanExposure === "warn-plaintext") {
-  console.warn("Pi Web is exposed beyond loopback. HTTP Basic Auth does not encrypt credentials; use HTTPS or a trusted VPN.");
-} else if (lanExposure === "warn-insecure-lan") {
-  console.warn("Pi Web is exposed beyond loopback WITHOUT authentication (PI_WEB_ALLOW_INSECURE_LAN=1). Anyone on the network can run agent commands on this machine.");
-} else if (lanExposure === "refuse") {
-  // Hard fail: an unauthenticated listener on a LAN address hands every
-  // device on the network full read access to sessions/files plus
-  // same-origin write access (agent prompts, task shell commands).
-  console.error("Refusing to start: Pi Web is bound to " + hostname + " (beyond loopback) but PI_WEB_PASSWORD is not set.");
-  console.error("Set PI_WEB_PASSWORD to require HTTP Basic Auth, bind to 127.0.0.1 instead, or set PI_WEB_ALLOW_INSECURE_LAN=1 to override.");
-  process.exit(1);
-}
-
-const nextArgs = ["start", "-p", port, "-H", hostname];
-
-// Always run next's JS entry with node directly — avoids .bin symlink issues
-// and path-with-spaces problems on Windows when shell: true is used.
-const child = spawn(process.execPath, ["--require", watchdogPreload, nextBin, ...nextArgs], {
-  cwd: pkgDir,
-  stdio: ["inherit", "pipe", "inherit"],
-  env: { ...process.env, PI_WEB_HOSTNAME: hostname, PI_WEB_PORT: String(port) },
-});
-wireChildProcessLifecycle(child);
-
-let browserOpened = false;
-const url = `http://${hostname}:${port}`;
-
-child.stdout.on("data", (chunk) => {
-  const text = chunk.toString();
-  process.stdout.write(text);
-  if (openBrowser && !browserOpened && text.includes("Ready")) {
-    browserOpened = true;
-    const isWindows = process.platform === "win32";
-    const isMac = process.platform === "darwin";
-    // Avoid `shell: true` to suppress Node.js DEP0190 deprecation
-    // ("Passing args to a child process with shell option true can lead to
-    // security vulnerabilities, as the arguments are not escaped").
-    // Pass a structured argv so Node.js handles escaping instead of
-    // concatenating the args into a shell command string.
-    let opener;
-    if (isWindows) {
-      // `start` is a cmd.exe built-in, so invoke cmd directly. The empty
-      // title argument is required by `start` before the target URL.
-      opener = spawn(process.env.ComSpec || "cmd.exe", ["/c", "start", "", url], {
-        stdio: "ignore",
-        detached: true,
-      });
-    } else if (isMac) {
-      opener = spawn("open", [url], {
-        stdio: "ignore",
-        detached: true,
-      });
-    } else {
-      opener = spawn("xdg-open", [url], {
-        stdio: "ignore",
-        detached: true,
-      });
-    }
-
-    opener.on("error", (error) => {
-      console.warn(`Could not open browser automatically: ${error.message}`);
-    });
-
-    opener.unref();
-  }
-});
+#!/usr/bin/env node
+"use strict";
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { spawn } = require("child_process");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const path = require("path");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const fs = require("fs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { parseLaunchOptions, assessLanExposure } = require("./pi-web-options");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { wireChildProcessLifecycle } = require("./process-lifecycle");
+
+// Apply the undici CVE fix (formerly a postinstall hook). Running it here —
+// before the pi agent's undici can be loaded — keeps installs quiet under
+// npm >= 11.16's allow-scripts policy and survives installs that skip scripts.
+try {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  require("./fix-pi-agent-undici").applyUndiciFix();
+} catch {
+  // Best-effort; the app still starts with the shrinkwrapped undici if the
+  // fix cannot be applied.
+}
+
+const pkgDir = path.join(__dirname, "..");
+const nextDir = path.join(pkgDir, ".next");
+
+// Resolve next's CLI entry directly to avoid relying on .bin symlinks (which
+// may not exist when installed via npx).
+let nextBin;
+try {
+  nextBin = require.resolve("next/dist/bin/next", { paths: [pkgDir] });
+} catch {
+  // Fallback: locate next package root and derive the bin path manually.
+  try {
+    const nextPkg = require.resolve("next/package.json", { paths: [pkgDir] });
+    nextBin = path.join(path.dirname(nextPkg), "dist", "bin", "next");
+  } catch {
+    nextBin = path.join(pkgDir, "node_modules", "next", "dist", "bin", "next");
+  }
+}
+
+let launchOptions;
+try {
+  launchOptions = parseLaunchOptions();
+} catch (error) {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exit(1);
+}
+if (launchOptions.help) {
+  const { getHelpText } = require("./pi-web-options");
+  process.stdout.write(getHelpText());
+  process.exit(0);
+}
+const { port, hostname, openBrowser } = launchOptions;
+
+// Apply the same heap cap as the npm scripts so `pi-web` (production entry)
+// never lets the V8 heap balloon to Next.js's auto 50%-of-RAM default.
+const { mergedNodeOptions } = require("./with-memory-limit");
+process.env.NODE_OPTIONS = mergedNodeOptions(process.env.NODE_OPTIONS);
+
+// Idle memory watchdog, loaded only into the next-server process. Injected as
+// a node CLI arg (not NODE_OPTIONS) so agent-spawned child processes never
+// inherit it. Disabled with PI_WEB_RSS_RESTART_MB=0; the module itself also
+// refuses to run when it doesn't know the port to ask about running sessions.
+const watchdogPreload = path.join(__dirname, "watchdog-preload.js");
+
+if (!fs.existsSync(nextDir)) {
+  console.error("Build artifacts not found. Please report this issue.");
+  process.exit(1);
+}
+
+const lanExposure = assessLanExposure(hostname);
+if (lanExposure === "warn-plaintext") {
+  console.warn("Pi Web is exposed beyond loopback. HTTP Basic Auth does not encrypt credentials; use HTTPS or a trusted VPN.");
+} else if (lanExposure === "warn-insecure-lan") {
+  console.warn("Pi Web is exposed beyond loopback WITHOUT authentication (PI_WEB_ALLOW_INSECURE_LAN=1). Anyone on the network can run agent commands on this machine.");
+} else if (lanExposure === "refuse") {
+  // Hard fail: an unauthenticated listener on a LAN address hands every
+  // device on the network full read access to sessions/files plus
+  // same-origin write access (agent prompts, task shell commands).
+  console.error("Refusing to start: Pi Web is bound to " + hostname + " (beyond loopback) but PI_WEB_PASSWORD is not set.");
+  console.error("Set PI_WEB_PASSWORD to require HTTP Basic Auth, bind to 127.0.0.1 instead, or set PI_WEB_ALLOW_INSECURE_LAN=1 to override.");
+  process.exit(1);
+}
+
+const nextArgs = ["start", "-p", port, "-H", hostname];
+
+// Always run next's JS entry with node directly — avoids .bin symlink issues
+// and path-with-spaces problems on Windows when shell: true is used.
+const child = spawn(process.execPath, ["--require", watchdogPreload, nextBin, ...nextArgs], {
+  cwd: pkgDir,
+  stdio: ["inherit", "pipe", "inherit"],
+  env: { ...process.env, PI_WEB_HOSTNAME: hostname, PI_WEB_PORT: String(port) },
+});
+wireChildProcessLifecycle(child);
+
+let browserOpened = false;
+const url = `http://${hostname}:${port}`;
+
+child.stdout.on("data", (chunk) => {
+  const text = chunk.toString();
+  process.stdout.write(text);
+  if (openBrowser && !browserOpened && text.includes("Ready")) {
+    browserOpened = true;
+    const isWindows = process.platform === "win32";
+    const isMac = process.platform === "darwin";
+    // Avoid `shell: true` to suppress Node.js DEP0190 deprecation
+    // ("Passing args to a child process with shell option true can lead to
+    // security vulnerabilities, as the arguments are not escaped").
+    // Pass a structured argv so Node.js handles escaping instead of
+    // concatenating the args into a shell command string.
+    let opener;
+    if (isWindows) {
+      // `start` is a cmd.exe built-in, so invoke cmd directly. The empty
+      // title argument is required by `start` before the target URL.
+      opener = spawn(process.env.ComSpec || "cmd.exe", ["/c", "start", "", url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    } else if (isMac) {
+      opener = spawn("open", [url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    } else {
+      opener = spawn("xdg-open", [url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    }
+
+    opener.on("error", (error) => {
+      console.warn(`Could not open browser automatically: ${error.message}`);
+    });
+
+    opener.unref();
+  }
+});

package/bin/prepare-terminal.js

@@ -1,14 +1,14 @@
-// node-pty 1.1.0 ships macOS spawn-helper binaries without executable bits.
-// Remove this workaround once the upstream package preserves those modes.
-/* eslint-disable @typescript-eslint/no-require-imports */
-const { chmodSync, statSync } = require("node:fs");
-const { dirname, join } = require("node:path");
-
-if (process.platform === "darwin") {
-  const root = dirname(require.resolve("node-pty/package.json"));
-  for (const directory of ["build/Release", "build/Debug", `prebuilds/darwin-${process.arch}`]) {
-    const helper = join(root, directory, "spawn-helper");
-    const stat = statSync(helper, { throwIfNoEntry: false });
-    if (stat?.isFile() && (stat.mode & 0o111) !== 0o111) chmodSync(helper, stat.mode | 0o111);
-  }
-}
+// node-pty 1.1.0 ships macOS spawn-helper binaries without executable bits.
+// Remove this workaround once the upstream package preserves those modes.
+/* eslint-disable @typescript-eslint/no-require-imports */
+const { chmodSync, statSync } = require("node:fs");
+const { dirname, join } = require("node:path");
+
+if (process.platform === "darwin") {
+  const root = dirname(require.resolve("node-pty/package.json"));
+  for (const directory of ["build/Release", "build/Debug", `prebuilds/darwin-${process.arch}`]) {
+    const helper = join(root, directory, "spawn-helper");
+    const stat = statSync(helper, { throwIfNoEntry: false });
+    if (stat?.isFile() && (stat.mode & 0o111) !== 0o111) chmodSync(helper, stat.mode | 0o111);
+  }
+}

package/bin/process-lifecycle.js

@@ -1,81 +1,81 @@
-"use strict";
-
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const os = require("node:os");
-
-const forwardedSignals = ["SIGINT", "SIGTERM"];
-const shutdownTimeoutMs = 5_000;
-
-function getSignalExitCode(signal) {
-  const signalNumber = signal ? os.constants.signals[signal] : undefined;
-  return typeof signalNumber === "number" ? 128 + signalNumber : 1;
-}
-
-function wireChildProcessLifecycle(
-  child,
-  parentProcess = process,
-  timeoutMs = shutdownTimeoutMs,
-  log = console.error,
-) {
-  const signalHandlers = new Map();
-  let shutdownTimer;
-  // Set once we forward a signal, so an exit we asked for stays quiet and one
-  // we did not gets reported.
-  let shuttingDown = false;
-
-  const forceKill = () => child.kill("SIGKILL");
-
-  function unwire() {
-    if (shutdownTimer) clearTimeout(shutdownTimer);
-    for (const [forwardedSignal, handler] of signalHandlers) {
-      parentProcess.removeListener(forwardedSignal, handler);
-    }
-    child.removeListener("error", handleError);
-  }
-
-  function handleError(error) {
-    const failedToSpawn = child.pid === undefined;
-    log(
-      `[pi-web] ${failedToSpawn ? "could not run the Next.js process" : "Next.js process error"}: ${error.message}`,
-    );
-
-    if (failedToSpawn) {
-      unwire();
-      parentProcess.exit(1);
-    }
-  }
-
-  for (const signal of forwardedSignals) {
-    const handler = () => {
-      if (shutdownTimer) {
-        forceKill();
-        return;
-      }
-
-      shuttingDown = true;
-      shutdownTimer = setTimeout(forceKill, timeoutMs);
-      shutdownTimer.unref();
-      child.kill(signal);
-    };
-    signalHandlers.set(signal, handler);
-    parentProcess.on(signal, handler);
-  }
-
-  child.on("error", handleError);
-
-  child.once("exit", (code, signal) => {
-    unwire();
-
-    // A shutdown the user asked for needs no explanation; anything else left
-    // the window closing with no stated reason.
-    if (!shuttingDown) {
-      log(
-        `[pi-web] Next.js exited unexpectedly (${signal ? `signal ${signal}` : `code ${code}`})`,
-      );
-    }
-
-    parentProcess.exit(code ?? getSignalExitCode(signal));
-  });
-}
-
-module.exports = { wireChildProcessLifecycle };
+"use strict";
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const os = require("node:os");
+
+const forwardedSignals = ["SIGINT", "SIGTERM"];
+const shutdownTimeoutMs = 5_000;
+
+function getSignalExitCode(signal) {
+  const signalNumber = signal ? os.constants.signals[signal] : undefined;
+  return typeof signalNumber === "number" ? 128 + signalNumber : 1;
+}
+
+function wireChildProcessLifecycle(
+  child,
+  parentProcess = process,
+  timeoutMs = shutdownTimeoutMs,
+  log = console.error,
+) {
+  const signalHandlers = new Map();
+  let shutdownTimer;
+  // Set once we forward a signal, so an exit we asked for stays quiet and one
+  // we did not gets reported.
+  let shuttingDown = false;
+
+  const forceKill = () => child.kill("SIGKILL");
+
+  function unwire() {
+    if (shutdownTimer) clearTimeout(shutdownTimer);
+    for (const [forwardedSignal, handler] of signalHandlers) {
+      parentProcess.removeListener(forwardedSignal, handler);
+    }
+    child.removeListener("error", handleError);
+  }
+
+  function handleError(error) {
+    const failedToSpawn = child.pid === undefined;
+    log(
+      `[pi-web] ${failedToSpawn ? "could not run the Next.js process" : "Next.js process error"}: ${error.message}`,
+    );
+
+    if (failedToSpawn) {
+      unwire();
+      parentProcess.exit(1);
+    }
+  }
+
+  for (const signal of forwardedSignals) {
+    const handler = () => {
+      if (shutdownTimer) {
+        forceKill();
+        return;
+      }
+
+      shuttingDown = true;
+      shutdownTimer = setTimeout(forceKill, timeoutMs);
+      shutdownTimer.unref();
+      child.kill(signal);
+    };
+    signalHandlers.set(signal, handler);
+    parentProcess.on(signal, handler);
+  }
+
+  child.on("error", handleError);
+
+  child.once("exit", (code, signal) => {
+    unwire();
+
+    // A shutdown the user asked for needs no explanation; anything else left
+    // the window closing with no stated reason.
+    if (!shuttingDown) {
+      log(
+        `[pi-web] Next.js exited unexpectedly (${signal ? `signal ${signal}` : `code ${code}`})`,
+      );
+    }
+
+    parentProcess.exit(code ?? getSignalExitCode(signal));
+  });
+}
+
+module.exports = { wireChildProcessLifecycle };

package/bin/watchdog-preload.js

@@ -1,20 +1,20 @@
-"use strict";
-
-// Loaded into the next-server process via `node --require bin/watchdog-preload.js
-// next start ...` (wired up in pi-web.js). Startup is deferred so a problem
-// here can never delay or break server boot — worst case is one warn line and
-// no watchdog.
-
-try {
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
-  const { startMemoryWatchdog } = require("./memory-watchdog");
-  setTimeout(() => {
-    try {
-      startMemoryWatchdog();
-    } catch (err) {
-      console.warn(`[memory-watchdog] failed to start: ${err && err.message}`);
-    }
-  }, 3000).unref();
-} catch (err) {
-  console.warn(`[memory-watchdog] preload failed: ${err && err.message}`);
-}
+"use strict";
+
+// Loaded into the next-server process via `node --require bin/watchdog-preload.js
+// next start ...` (wired up in pi-web.js). Startup is deferred so a problem
+// here can never delay or break server boot — worst case is one warn line and
+// no watchdog.
+
+try {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { startMemoryWatchdog } = require("./memory-watchdog");
+  setTimeout(() => {
+    try {
+      startMemoryWatchdog();
+    } catch (err) {
+      console.warn(`[memory-watchdog] failed to start: ${err && err.message}`);
+    }
+  }, 3000).unref();
+} catch (err) {
+  console.warn(`[memory-watchdog] preload failed: ${err && err.message}`);
+}

package/bin/with-memory-limit.js

@@ -1,46 +1,73 @@
-#!/usr/bin/env node
-"use strict";
-
-const { spawnSync } = require("child_process");
-
-/** Keep the V8 heap from ballooning during local runs. Next.js dev auto-sets
- *  --max-old-space-size to 50% of physical RAM (12GB on a 24GB machine)
- *  unless the user already capped it. A 3GB cap makes GC engage earlier and
- *  bounds RSS growth for both dev and production start.
- */
-const MEMORY_LIMIT_MB = 3072;
-const SEMI_SPACE_MB = 128;
-
-/**
- * Merge a heap cap into an existing NODE_OPTIONS value. If the user already
- * set --max-old-space-size explicitly, theirs wins (we only add the semi-space
- * hint); otherwise we append both flags so V8 and Next.js see a hard cap.
- */
-function mergedNodeOptions(existing) {
-  const base = existing ?? "";
-  const hasHeapLimit = /(^|\s)--max-old-space-size=\d+/.test(base);
-  const flags = hasHeapLimit ? [] : [`--max-old-space-size=${MEMORY_LIMIT_MB}`, `--max-semi-space-size=${SEMI_SPACE_MB}`];
-  return [...flags, base].filter(Boolean).join(" ");
-}
-
-module.exports = { mergedNodeOptions, MEMORY_LIMIT_MB, SEMI_SPACE_MB };
-
-// CLI: with-memory-limit <cmd> [args...] — runs cmd with the capped heap.
-// Child processes spawned by cmd inherit NODE_OPTIONS, so next dev / next
-// start and their next-server children all see the same limit.
-if (require.main === module) {
-  const [cmd, ...args] = process.argv.slice(2);
-  if (!cmd) {
-    console.error("usage: node bin/with-memory-limit.js <cmd> [args...]");
-    process.exit(1);
-  }
-  const result = spawnSync(cmd, args, {
-    stdio: "inherit",
-    env: { ...process.env, NODE_OPTIONS: mergedNodeOptions(process.env.NODE_OPTIONS) },
-  });
-  if (result.error) {
-    console.error(`with-memory-limit: ${result.error.message}`);
-    process.exit(1);
-  }
-  process.exit(result.status ?? 0);
-}
+#!/usr/bin/env node
+"use strict";
+
+const { spawnSync } = require("child_process");
+
+/** Keep the V8 heap from ballooning during local runs. Next.js dev auto-sets
+ *  --max-old-space-size to 50% of physical RAM (12GB on a 24GB machine)
+ *  unless the user already capped it. A 3GB cap makes GC engage earlier and
+ *  bounds RSS growth for both dev and production start.
+ */
+const MEMORY_LIMIT_MB = 3072;
+const SEMI_SPACE_MB = 128;
+
+/**
+ * Merge a heap cap into an existing NODE_OPTIONS value. If the user already
+ * set --max-old-space-size explicitly, theirs wins (we only add the semi-space
+ * hint); otherwise we append both flags so V8 and Next.js see a hard cap.
+ */
+function mergedNodeOptions(existing) {
+  const base = existing ?? "";
+  const hasHeapLimit = /(^|\s)--max-old-space-size=\d+/.test(base);
+  const flags = hasHeapLimit ? [] : [`--max-old-space-size=${MEMORY_LIMIT_MB}`, `--max-semi-space-size=${SEMI_SPACE_MB}`];
+  return [...flags, base].filter(Boolean).join(" ");
+}
+
+module.exports = { mergedNodeOptions, MEMORY_LIMIT_MB, SEMI_SPACE_MB };
+
+// CLI: with-memory-limit <cmd> [args...] — runs cmd with the capped heap.
+// Child processes spawned by cmd inherit NODE_OPTIONS, so next dev / next
+// start and their next-server children all see the same limit.
+if (require.main === module) {
+  const [cmd, ...args] = process.argv.slice(2);
+  if (!cmd) {
+    console.error("usage: node bin/with-memory-limit.js <cmd> [args...]");
+    process.exit(1);
+  }
+  const env = { ...process.env, NODE_OPTIONS: mergedNodeOptions(process.env.NODE_OPTIONS) };
+  let result;
+  if (process.platform === "win32") {
+    // spawnSync cannot execute npm's extensionless .bin shims on Windows
+    // (ENOENT), and .cmd shims need cmd.exe (EINVAL since the Node CVE fix).
+    // Prefer the .cmd/.bat sibling and run it through %ComSpec%.
+    const fs = require("fs");
+    let target = cmd;
+    if (!/\.(exe|cmd|bat)$/i.test(target)) {
+      for (const ext of [".cmd", ".bat"]) {
+        if (fs.existsSync(target + ext)) {
+          target += ext;
+          break;
+        }
+      }
+    }
+    if (/\.(cmd|bat)$/i.test(target)) {
+      // cmd.exe parses `/` as a switch character, so hand it a native path.
+      const native = require("path").win32.normalize(target);
+      const quote = (a) => (/["&<>^|()%!?\s]/.test(a) ? `"${a}"` : a);
+      const line = [native, ...args].map(quote).join(" ");
+      result = spawnSync(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", line], {
+        stdio: "inherit",
+        env,
+      });
+    } else {
+      result = spawnSync(target, args, { stdio: "inherit", env });
+    }
+  } else {
+    result = spawnSync(cmd, args, { stdio: "inherit", env });
+  }
+  if (result.error) {
+    console.error(`with-memory-limit: ${result.error.message}`);
+    process.exit(1);
+  }
+  process.exit(result.status ?? 0);
+}