@terminus-ai/cli 0.0.2 → 0.0.3

package/README.md

@@ -767,7 +767,7 @@ Bare `terminus` (or `terminus help`) prints its version and the everyday command
 with what it does on one line (`<word>` is a placeholder, `[ ]` is optional):
 
 ```text
-Terminus v0.0.2, created by Terminus Intelligence
+Terminus v0.0.3, created by Terminus Intelligence
 
 Account:
   terminus login                         Open your browser and sign in

package/bin/devserver.mjs

@@ -28,7 +28,6 @@
  * visitor chose, and only an agent that offers a choice has one.
  */
 
-import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { watch } from "node:fs";
 import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -37,6 +36,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { DEV_DIRECTORY, ensureDevDirectory, TERMINUS_DIRECTORY } from "./files.mjs";
+import { openWithPlatform } from "./open.mjs";
 
 import {
   AgentDevSession,
@@ -719,22 +719,6 @@ async function listLane(root, skip) {
   return entries;
 }
 
-export async function openWithPlatform(target) {
-  const command =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", target] : [target];
-  return new Promise((resolve) => {
-    try {
-      const child = execFile(command, args, { detached: true, stdio: "ignore" }, (error) => {
-        resolve(!error);
-      });
-      child.unref();
-    } catch {
-      resolve(false);
-    }
-  });
-}
-
 // ---------------------------------------------------------------------------
 // The server
 // ---------------------------------------------------------------------------

package/bin/open.mjs

@@ -0,0 +1,61 @@
+/**
+ * Opening a link or a file the way the person's own system does: the browser
+ * for a URL, the default app for a file. Every command that opens something
+ * comes through here — `terminus login`, `terminus dev`, `terminus service
+ * dev`, and the dev UI's Open — so the Windows rules below live once.
+ *
+ * macOS and Linux take the target as one argument to `open` / `xdg-open`,
+ * and no shell reads it. Windows opens things with `start`, a cmd.exe
+ * built-in, and cmd.exe parses the command line itself: an unquoted `&` ends
+ * the command (so `terminus login` opened its sign-in URL only up to the
+ * first `&`, and the page refused the sign-in), and runs whatever follows (a
+ * file named `notes&calc.exe` ran calc.exe). So the target goes to `start`
+ * inside double quotes, where cmd.exe reads its operators as text, with
+ * delayed expansion off, and the command line is handed over verbatim:
+ * Node's own quoting escapes quotes the way C programs read them, which
+ * cmd.exe does not. `%NAME%` still expands inside quotes, but only for a
+ * variable that is set, and a URL's `%3A%2F` names none. The failure list
+ * behind this is in test/open.test.mjs.
+ */
+
+import { execFile } from "node:child_process";
+
+/**
+ * The program, arguments and spawn options that open `target` on
+ * `platform`, or null for a target that cannot be quoted for cmd.exe: a
+ * double quote or a line break would end the quoting early, and neither
+ * occurs in a Windows file name or a serialized URL.
+ */
+export function openCommand(target, platform = process.platform) {
+  if (platform === "darwin") return { command: "open", args: [target], options: {} };
+  if (platform !== "win32") return { command: "xdg-open", args: [target], options: {} };
+  if (/["\r\n\0]/u.test(target)) return null;
+  // /s strips exactly the outer quotes around the command; START takes its
+  // first quoted argument as the window title, so an empty one goes first.
+  return {
+    command: "cmd",
+    args: ["/d", "/v:off", "/s", "/c", `"start "" "${target}""`],
+    options: { windowsVerbatimArguments: true },
+  };
+}
+
+/** Open `target`; resolves whether the system accepted it. */
+export async function openWithPlatform(target) {
+  const plan = openCommand(target);
+  if (!plan) return false;
+  return new Promise((resolve) => {
+    try {
+      const child = execFile(
+        plan.command,
+        plan.args,
+        { ...plan.options, detached: true, stdio: "ignore" },
+        (error) => {
+          resolve(!error);
+        },
+      );
+      child.unref();
+    } catch {
+      resolve(false);
+    }
+  });
+}

package/bin/servicedev.mjs

@@ -36,7 +36,8 @@ import {
   refuseForeignHost,
   resolveDevPortRange,
 } from "./dev-ports.mjs";
-import { contentTypeFor, openWithPlatform, timingSafeTokenMatch } from "./devserver.mjs";
+import { contentTypeFor, timingSafeTokenMatch } from "./devserver.mjs";
+import { openWithPlatform } from "./open.mjs";
 
 const SERVICE_DEV_PORT = 4750;
 const PORT_ATTEMPTS = 50;

package/bin/terminus.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 
 import { Buffer } from "node:buffer";
-import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { mkdir, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { createServer } from "node:http";
@@ -43,6 +42,7 @@ import {
   sessionPath,
   sessionTokenIsUsable,
 } from "./http.mjs";
+import { openWithPlatform } from "./open.mjs";
 import { SYNC_DIRECTORY, byKey, entryKey, localChanges, readSyncRecord, writeSyncRecord } from "./sync.mjs";
 import { formatReleaseVersion, parseReleaseVersion } from "./versioning.mjs";
 
@@ -502,7 +502,7 @@ async function loginWithBrowser(base, flags = {}) {
     console.log("Opening your browser to log in to Terminus.");
     console.log(`If it does not open, visit:\n${loginUrl}`);
     if (!flags.no_browser) {
-      await openBrowser(loginUrl);
+      await openWithPlatform(loginUrl);
     }
 
     const callbackResult = await callback.wait();
@@ -739,22 +739,6 @@ async function startLoginCallbackServer(expectedState, brandOrigin) {
   };
 }
 
-async function openBrowser(url) {
-  const command =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-  return new Promise((resolve) => {
-    try {
-      const child = execFile(command, args, { detached: true, stdio: "ignore" }, (error) => {
-        resolve(!error);
-      });
-      child.unref();
-    } catch {
-      resolve(false);
-    }
-  });
-}
-
 /** A login with the profile of the account it signs in as. */
 async function loginWithCurrentProfile(api, login, currentProfile = null) {
   const profile = currentProfile ?? await api.me();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@terminus-ai/cli",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "Terminus CLI (`terminus`): search and use skills, and develop, run, and publish apps, services, and agents on the Terminus platform.",
   "license": "MIT",
   "type": "module",