@rienn/guanyuan-cli 0.7.1 → 0.8.1

package/bin/guanyuan.js

@@ -10,9 +10,15 @@ const os = require("os");
 const PKG = "@rienn/guanyuan-cli";
 
 if (process.argv[2] === "update" || process.argv[2] === "upgrade") {
-  const npmCmd = os.platform() === "win32" ? "npm.cmd" : "npm";
+  const isWin = os.platform() === "win32";
   console.error(`更新 ${PKG} 到最新版...`);
-  const res = spawnSync(npmCmd, ["install", "-g", `${PKG}@latest`], { stdio: "inherit" });
+  // Windows 必须 shell:true。Node 修 CVE-2024-27980 后收紧了对 .cmd/.bat 的直接 spawn,
+  // 再直接 spawnSync("npm.cmd") 会抛 EINVAL —— 也就是说 update 命令本身在 Windows 上是坏的。
+  // 参数全是写死的常量,没有用户输入拼进命令行,不存在注入面。
+  const res = spawnSync(isWin ? "npm.cmd" : "npm", ["install", "-g", `${PKG}@latest`], {
+    stdio: "inherit",
+    shell: isWin,
+  });
   if (res.error) {
     console.error(`更新失败: ${res.error.message}`);
     console.error(`请手动执行: npm install -g ${PKG}@latest（检查 npm registry / 代理 / 权限）`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rienn/guanyuan-cli",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "description": "观远 Agent CLI — 给 AI Agent 用的观远 BI 取数遥控器(零依赖 Go 单二进制)",
   "bin": {
     "guanyuan": "bin/guanyuan.js"