@ran-sh/dsh-crew 0.5.5 → 0.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ran-sh/dsh-crew",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "main": "./src/hub/entry.mjs",
   "bin": {

package/src/install/npx-lifecycle.mjs

@@ -49,8 +49,23 @@ import {
 export const CREW_APP_DIRNAME = 'app';
 export const RELEASES_DIRNAME = 'releases';
 export const CURRENT_POINTER_FILENAME = 'current.json';
-export const KEEP_RELEASES = 2;
-export const INCOMPLETE_MARKER = '.dsh-crew-incomplete';
+export const KEEP_RELEASES = 2;
+export const INCOMPLETE_MARKER = '.dsh-crew-incomplete';
+
+export function npmCliInvocation(args, {
+  platform = process.platform,
+  environment = process.env,
+} = {}) {
+  if (platform !== 'win32') return { command: 'npm', args: [...args] };
+  const unsafe = args.find((arg) => /[\0\r\n"%!^&|<>]/.test(String(arg)));
+  if (unsafe !== undefined) throw new Error(`unsafe npm argument: ${unsafe}`);
+  const commandLine = ['npm.cmd', ...args.map((arg) => `"${String(arg)}"`)].join(' ');
+  return {
+    command: environment.ComSpec || environment.COMSPEC || 'cmd.exe',
+    args: ['/d', '/s', '/c', commandLine],
+    windowsVerbatimArguments: true,
+  };
+}
 
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
@@ -217,13 +232,18 @@ export function copyProductionDependencyTree({
   return { copied, missing, missingOptional };
 }
 
-function defaultNpmInstaller(stageRoot, log) {
-  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-  const result = spawnSync(npm, [
-    'install', '--prefix', stageRoot,
-    '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund',
-    '--no-package-lock', '--loglevel=error',
-  ], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], shell: process.platform === 'win32', timeout: 600_000, windowsHide: true, env: sanitizedPackageManagerEnv() });
+function defaultNpmInstaller(stageRoot, log) {
+  const npmArgs = [
+    'install', '--prefix', stageRoot,
+    '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund',
+    '--no-package-lock', '--loglevel=error',
+  ];
+  const invocation = npmCliInvocation(npmArgs);
+  const result = spawnSync(invocation.command, invocation.args, {
+    encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 600_000,
+    windowsHide: true, windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+    env: sanitizedPackageManagerEnv(),
+  });
   if (result.status !== 0) {
     log(`- npm fallback install failed (${result.status}): ${(result.stderr || result.stdout || '').trim().slice(-300)}`);
     return false;
@@ -759,13 +779,15 @@ export function resolveUpdateCandidate({
   mkdirSync(tmpDir, { recursive: true });
   try {
     const effectiveSpec = process.env.DSH_CREW_UPDATE_SPEC ?? spec;
-    const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-    const packArgs = ['pack', effectiveSpec, '--pack-destination', tmpDir, '--json', '--loglevel=error'];
-    log(`- resolving update candidate from the configured npm registry (${effectiveSpec})`);
-    const packed = runner(npm, packArgs, {
-      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], shell: process.platform === 'win32',
-      timeout: 600_000, windowsHide: true, env: sanitizedPackageManagerEnv(),
-    });
+    const packArgs = ['pack', effectiveSpec, '--pack-destination', tmpDir, '--json', '--loglevel=error'];
+    log(`- resolving update candidate from the configured npm registry (${effectiveSpec})`);
+    const invocation = npmCliInvocation(packArgs);
+    const packed = runner(invocation.command, invocation.args, {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 600_000, windowsHide: true,
+      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+      env: sanitizedPackageManagerEnv(),
+    });
     if (packed.status !== 0) {
       return { ok: false, code: 'REGISTRY_PACK_FAILED', detail: `${effectiveSpec}: ${(packed.stderr || packed.stdout || '').trim().slice(-300)}` };
     }

package/src/runtime-identity.mjs

@@ -8,7 +8,7 @@
 // Keep this module pure and dependency-free so Hub, MCP and tests all use the
 // exact same compatibility rules.
 
-export const RUNTIME_VERSION = '0.5.5';
+export const RUNTIME_VERSION = '0.5.6';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([