@venturewild/workspace 0.6.22 → 0.6.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venturewild/workspace",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "Claude Code Web — Replit/Lovable-style chat-first browser UI that wraps the AI agent already installed on your machine.",
   "license": "MIT",
   "bin": {

package/server/src/auto-update.mjs

@@ -128,9 +128,11 @@ export async function fetchLatestVersion(channel, {
 /** Run `npm i -g <spec>`. Resolves {code, output, timedOut?, error?}; never rejects. */
 export function npmInstall(spec, {
   spawnImpl = spawn, timeoutMs = 180000, ensurePathImpl = ensureToolPath, env = process.env,
+  platform = process.platform,
 } = {}) {
   return new Promise((resolve) => {
-    const cmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const isWin = platform === 'win32';
+    const cmd = isWin ? 'npm.cmd' : 'npm';
     // The always-on supervisor (our caller in the field) runs under launchd/GUI,
     // which inherits a MINIMAL PATH omitting ~/.npm-global, /usr/local/bin,
     // Homebrew, nvm — so a bare `npm` spawn would ENOENT (the 0.1.8 `claude`
@@ -140,7 +142,15 @@ export function npmInstall(spec, {
     try { ensurePathImpl(childEnv); } catch { /* best-effort — fall back to inherited PATH */ }
     let child;
     try {
-      child = spawnImpl(cmd, ['i', '-g', spec], { windowsHide: true, env: childEnv });
+      // On Windows npm is a `.cmd` shim, and Node >=18.20.2/20.12.2/22 REFUSES to
+      // spawn a .cmd/.bat directly (CVE-2024-27980 hardening) — it throws EINVAL
+      // synchronously. That is exactly how field auto-update failed instantly
+      // (code=-1 in ~16ms, never reaching npm). shell:true routes the shim
+      // through cmd.exe so it actually runs. The only interpolated arg is a
+      // package spec we build ourselves (a constant name + a semver from npm's
+      // own dist-tag), so there is no shell-injection surface. POSIX stays
+      // shell:false — npm is a real executable there.
+      child = spawnImpl(cmd, ['i', '-g', spec], { windowsHide: true, env: childEnv, shell: isWin });
     } catch (e) {
       return resolve({ code: -1, error: e?.message || String(e), output: '' });
     }
@@ -226,7 +236,7 @@ export class AutoUpdater {
     this.logImpl(`auto-update: installing ${this.packageName}@${target} (from ${from || 'unknown'})`);
     const install = await this.installImpl(`${this.packageName}@${target}`);
     if (install.code !== 0) {
-      this.logImpl(`auto-update: install failed code=${install.code}${install.timedOut ? ' (timeout)' : ''}`);
+      this.logImpl(`auto-update: install failed code=${install.code}${install.timedOut ? ' (timeout)' : ''}${install.error ? ` error=${install.error}` : ''}`);
       const rec = recordUpdate(this.globalDir, { from, to: target, at: this.nowImpl(), status: 'install-failed' });
       this.onUpdate?.(rec);
       return { ok: false, stage: 'install', install, rec };