@rtorcato/repo-tooling 3.19.1 → 3.19.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -129,15 +129,31 @@ export async function readShippedSkill(name = SHIPPED_SKILL) {
129
129
  const pkg = await fs.readJson(path.join(root, 'package.json'));
130
130
  return { content, version: String(pkg.version), file };
131
131
  }
132
+ /**
133
+ * POSIX single-quote escaping — the only form correct for arbitrary bytes.
134
+ * Inside single quotes every character is literal, so `'` is the sole one
135
+ * needing care: end the quote, escape it, start a new one. Double quotes are
136
+ * not a substitute; `$(...)`, backticks and `\` all still expand inside them.
137
+ */
138
+ function shellQuote(value) {
139
+ return `'${value.replaceAll("'", "'\\''")}'`;
140
+ }
132
141
  /**
133
142
  * The command a human runs to see what their fork changed, before deciding
134
143
  * whether to take the shipped copy. One builder, because `doctor` and `fix`
135
144
  * both print it and two independently-built strings drift (#484). Always
136
145
  * `realFile`: through a stow symlink the nominal path is the link, and the
137
146
  * bytes worth reading are in the dotfiles checkout it points at.
147
+ *
148
+ * Both paths are user-influenced — `--skills-dir` is an argument (#490) and
149
+ * `realFile` is wherever a symlink happens to point — and this line exists to
150
+ * be pasted into a shell, so it is quoted rather than merely interpolated
151
+ * (#493). Quoting beats refusing to emit a command: single quotes make an odd
152
+ * path *more* visible, not less, and keep the hint usable in the odd case
153
+ * instead of only the ordinary one.
138
154
  */
139
155
  export function skillDiffCommand(paths) {
140
- return `diff "${paths.realFile}" "${paths.shippedFile}"`;
156
+ return `diff ${shellQuote(paths.realFile)} ${shellQuote(paths.shippedFile)}`;
141
157
  }
142
158
  /** Whether `file` is itself a symlink, as opposed to merely resolving through one. */
143
159
  async function isSymlink(file) {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@rtorcato/repo-tooling",
3
- "version": "3.19.1",
3
+ "version": "3.19.2",
4
4
  "description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
5
5
  "type": "module",
6
6
  "keywords": [