cli-jaw 2.17.4 → 2.17.5

package/scripts/require-release-evidence.mjs

@@ -390,6 +390,10 @@ if (!changed.length) {
 
 const macosEvidence = process.env.CLI_JAW_MACOS_EVIDENCE_DIR || process.env.MACOS_EVIDENCE_DIR || '';
 const wslEvidence = process.env.CLI_JAW_WSL_EVIDENCE_DIR || process.env.WSL_EVIDENCE_DIR || '';
+// Optional third lane (#384): native Windows evidence. WSL is a Linux
+// userland, so WSL evidence proves nothing about win32. The lane is optional
+// until the ps1 collector and auditor target support land.
+const windowsEvidence = process.env.CLI_JAW_WINDOWS_EVIDENCE_DIR || process.env.WINDOWS_EVIDENCE_DIR || '';
 
 console.error(`[release-evidence-required] installer-sensitive changes detected since ${ref || '(initial release)'} (${changed.length}, ${shortHash(changed)})`);
 for (const file of changed.slice(0, 30)) {
@@ -408,12 +412,18 @@ if (!macosEvidence || !wslEvidence) {
       'run', 'list',
       '--workflow', 'postinstall-platform.yml',
       '--commit', headSha,
-      '--event', 'push',
       '--status', 'success',
       '--limit', '1',
       '--json', 'url',
       '--jq', '.[0].url // ""',
     ], { cwd: repoRoot, encoding: 'utf8', shell: false });
+    // No --event filter, mirroring bc7c19ba which already made publish.yml
+    // accept any-event Postinstall Platform Checks. A merge commit whose diff
+    // is empty (e.g. main merged back into preview after a promotion) never
+    // produces a push run for its own SHA, so requiring the push event made
+    // this gate unpassable for exactly the SHA a promotion certifies. Any
+    // successful run of the pinned workflow on this commit is the same
+    // evidence regardless of the event that started it.
     const ciUrl = (ciCheck.stdout || '').trim();
     if (ciUrl) {
       console.log(`[release-evidence-required] PASS CI postinstall-platform evidence: ${ciUrl}`);
@@ -433,7 +443,9 @@ if (!macosEvidence || !wslEvidence) {
 }
 
 const gate = path.join(__dirname, 'verify-release-evidence.mjs');
-const result = spawnSync(process.execPath, [gate, '--macos', macosEvidence, '--wsl', wslEvidence], {
+const gateArgs = [gate, '--macos', macosEvidence, '--wsl', wslEvidence];
+if (windowsEvidence) gateArgs.push('--windows', windowsEvidence);
+const result = spawnSync(process.execPath, gateArgs, {
   cwd: repoRoot,
   env: process.env,
   encoding: 'utf8',

package/scripts/run-with-env.mjs

@@ -0,0 +1,30 @@
+// Cross-platform env-prefixed script runner (#383). npm scripts on Windows run
+// under cmd.exe, where the POSIX `VAR=value cmd` prefix is not syntax - it
+// fails with "'VAR' is not recognized". Usage:
+//   node scripts/run-with-env.mjs VAR=value [VAR2=value2 ...] -- <cmd> [args...]
+// The command runs through the current Node when it is a .mjs/.cjs/.js/.ts
+// entry resolved via node_modules, else spawned directly.
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const argv = process.argv.slice(2);
+const sep = argv.indexOf('--');
+if (sep === -1) {
+    console.error('usage: node scripts/run-with-env.mjs VAR=value ... -- <cmd> [args...]');
+    process.exit(2);
+}
+const env = { ...process.env };
+for (const pair of argv.slice(0, sep)) {
+    const eq = pair.indexOf('=');
+    if (eq === -1) { console.error(`not a VAR=value pair: ${pair}`); process.exit(2); }
+    env[pair.slice(0, eq)] = pair.slice(eq + 1);
+}
+const [cmd, ...args] = argv.slice(sep + 1);
+const require = createRequire(import.meta.url);
+// tsx runs through its JS entry so no .cmd shim is involved (#381/#382).
+const spec = cmd === 'tsx'
+    ? { file: process.execPath, args: [require.resolve('tsx/cli'), ...args] }
+    : { file: cmd, args };
+const child = spawn(spec.file, spec.args, { stdio: 'inherit', env });
+child.on('exit', (code, signal) => process.exit(signal ? 1 : (code ?? 1)));
+child.on('error', (err) => { console.error(err.message); process.exit(1); });

package/scripts/sync-electron-version.cjs

@@ -19,7 +19,9 @@
  * wrote something else.
  */
 const { readFileSync } = require('node:fs');
+const { existsSync } = require('node:fs');
 const { join } = require('node:path');
+const { dirname } = require('node:path');
 const { spawnSync } = require('node:child_process');
 
 const repoRoot = join(__dirname, '..');
@@ -41,6 +43,28 @@ function readVersion(dir) {
     }
 }
 
+/**
+ * Resolve npm as [bin, ...baseArgs] runnable via spawnSync WITHOUT a shell.
+ * On Windows the bare name 'npm' is npm.cmd, and Node's spawnSync refuses to
+ * run .cmd/.bat files without shell:true (EINVAL since the CVE-2024-27980
+ * hardening) -- so the sync silently failed on every native-Windows release.
+ * Running npm-cli.js under the current node binary sidesteps both the shim
+ * and the shell. Same resolution ladder as scripts/ensure-native-modules.cjs.
+ */
+function resolveNpmCommand() {
+    const nodeBinDir = dirname(process.execPath);
+    const candidates = [
+        process.env.npm_execpath,
+        join(nodeBinDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+        join(nodeBinDir, 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+        join(dirname(nodeBinDir), 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    ].filter(Boolean);
+    for (const candidate of candidates) {
+        if (existsSync(candidate)) return [process.execPath, candidate];
+    }
+    return [process.platform === 'win32' ? 'npm.cmd' : 'npm'];
+}
+
 function main() {
     let rootVersion;
     let electronVersion;
@@ -75,13 +99,20 @@ function main() {
     // both files directly means reimplementing the lockfile's shape, and
     // getting it subtly wrong surfaces later as unexplained churn in someone
     // else's dependency diff.
+    const [npmBin, ...npmBaseArgs] = resolveNpmCommand();
     const result = spawnSync(
-        'npm',
-        ['version', rootVersion, '--no-git-tag-version', '--allow-same-version'],
-        { cwd: electronDir, encoding: 'utf8', timeout: 60_000 },
+        npmBin,
+        [...npmBaseArgs, 'version', rootVersion, '--no-git-tag-version', '--allow-same-version'],
+        {
+            cwd: electronDir,
+            encoding: 'utf8',
+            timeout: 60_000,
+            // .cmd shims need a shell; the npm-cli.js path never takes this branch.
+            shell: npmBin.endsWith('.cmd'),
+        },
     );
     if (result.status !== 0) {
-        const detail = (result.stderr || result.stdout || '').trim();
+        const detail = (result.stderr || result.stdout || (result.error && result.error.message) || '').trim();
         console.error(`ERROR: npm version failed in electron/: ${detail}`);
         return 1;
     }

package/scripts/verify-release-evidence.mjs

@@ -13,6 +13,10 @@ function usage() {
 Options:
   --macos DIR       Strict macOS fresh-machine evidence directory.
   --wsl DIR         Strict Windows-via-WSL fresh-machine evidence directory.
+  --windows DIR     Optional native-Windows evidence directory (plumbing lane,
+                    #384). Validates the directory and the archived install.ps1
+                    hash; the full native audit lands with the ps1 collector
+                    (auditor targets are macos|wsl|linux today).
   --auditor FILE    Auditor script path. Defaults to sibling audit-fresh-install-evidence.mjs.
   -h, --help        Show this help.
 
@@ -24,12 +28,14 @@ flags to the per-target auditor.
 const args = process.argv.slice(2);
 let macosDir = '';
 let wslDir = '';
+let windowsDir = '';
 let auditor = path.join(__dirname, 'audit-fresh-install-evidence.mjs');
 const currentScripts = {
   collector: path.join(__dirname, 'collect-fresh-install-evidence.sh'),
   verifier: path.join(__dirname, 'verify-fresh-install.sh'),
   macosInstaller: path.join(__dirname, 'install.sh'),
   wslInstaller: path.join(__dirname, 'install-wsl.sh'),
+  windowsInstaller: path.join(__dirname, 'install.ps1'),
 };
 
 for (let i = 0; i < args.length; i += 1) {
@@ -46,6 +52,10 @@ for (let i = 0; i < args.length; i += 1) {
     wslDir = args[++i] || '';
     continue;
   }
+  if (arg === '--windows') {
+    windowsDir = args[++i] || '';
+    continue;
+  }
   if (arg === '--auditor') {
     auditor = args[++i] || '';
     continue;
@@ -85,6 +95,10 @@ function requireFile(label, file) {
 
 requireDirectory('macOS', macosDir);
 requireDirectory('Windows-via-WSL', wslDir);
+// Optional lane (#384): mandatory would break the package.json script, the
+// README examples, and the literal-string tests. require-release-evidence
+// passes it only when CLI_JAW_WINDOWS_EVIDENCE_DIR is set.
+if (windowsDir) requireDirectory('Windows-native', windowsDir);
 requireFile('auditor', auditor);
 requireFile('current collector', currentScripts.collector);
 requireFile('current verifier', currentScripts.verifier);
@@ -145,6 +159,12 @@ if (!failures.length) {
   requireEvidenceScriptMatches('Windows-via-WSL', wslDir, '00-collector-script.sh', currentScripts.collector);
   requireEvidenceScriptMatches('Windows-via-WSL', wslDir, '02-installer-script.sh', currentScripts.wslInstaller);
   requireEvidenceScriptMatches('Windows-via-WSL', wslDir, '21-verifier-script.sh', currentScripts.verifier);
+  // Native-Windows plumbing lane (#384): hash-pin the archived installer to
+  // the shipped install.ps1. The full per-file audit needs a ps1 collector and
+  // auditor target support - recorded as its own unit, not silently skipped.
+  if (windowsDir) {
+    requireEvidenceScriptMatches('Windows-native', windowsDir, '02-installer-script.ps1', currentScripts.windowsInstaller);
+  }
 }
 
 if (failures.length) {