codev-code 1.18.23-2 → 1.18.23-3

package/bin/codev.exe

@@ -2,6 +2,8 @@ echo "Error: codev-code's postinstall script was not run." >&2
 echo "" >&2
 echo "This occurs when using --ignore-scripts during installation, or when using a" >&2
 echo "package manager like pnpm that does not run postinstall scripts by default." >&2
+echo "npm 12 and later block install scripts on global installs unless allowed:" >&2
+echo "  npm install -g codev-code --allow-scripts=codev-code" >&2
 echo "" >&2
 echo "To fix this, run the postinstall script manually:" >&2
 echo "  cd node_modules/codev-code && node postinstall.mjs" >&2

package/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "postinstall": "node ./postinstall.mjs"
   },
-  "version": "1.18.23-2",
+  "version": "1.18.23-3",
   "license": "MIT",
   "os": [
     "darwin",
@@ -19,17 +19,17 @@
     "x64"
   ],
   "optionalDependencies": {
-    "codev-code-darwin-arm64": "1.18.23-2",
-    "codev-code-darwin-x64-baseline": "1.18.23-2",
-    "codev-code-windows-x64": "1.18.23-2",
-    "codev-code-linux-arm64": "1.18.23-2",
-    "codev-code-windows-x64-baseline": "1.18.23-2",
-    "codev-code-linux-x64-musl": "1.18.23-2",
-    "codev-code-linux-x64-baseline": "1.18.23-2",
-    "codev-code-linux-x64": "1.18.23-2",
-    "codev-code-darwin-x64": "1.18.23-2",
-    "codev-code-windows-arm64": "1.18.23-2",
-    "codev-code-linux-x64-baseline-musl": "1.18.23-2",
-    "codev-code-linux-arm64-musl": "1.18.23-2"
+    "codev-code-darwin-arm64": "1.18.23-3",
+    "codev-code-darwin-x64-baseline": "1.18.23-3",
+    "codev-code-windows-x64": "1.18.23-3",
+    "codev-code-linux-arm64": "1.18.23-3",
+    "codev-code-windows-x64-baseline": "1.18.23-3",
+    "codev-code-linux-x64-musl": "1.18.23-3",
+    "codev-code-linux-x64-baseline": "1.18.23-3",
+    "codev-code-linux-x64": "1.18.23-3",
+    "codev-code-darwin-x64": "1.18.23-3",
+    "codev-code-windows-arm64": "1.18.23-3",
+    "codev-code-linux-x64-baseline-musl": "1.18.23-3",
+    "codev-code-linux-arm64-musl": "1.18.23-3"
   }
 }

package/postinstall.mjs

@@ -125,23 +125,52 @@ function resolveBinary(name) {
   return binaryPath
 }
 
-function installPackage(name) {
+// Fork: records why each step failed in `failures` so the final error says
+// what actually went wrong (the package was never installed, npm could not
+// start, the binary would not run) instead of only naming packages to retry.
+function installPackage(name, failures) {
   const version = packageJson.optionalDependencies?.[name]
-  if (!version) return
+  if (!version) {
+    failures.push(`${name}: not pinned in optionalDependencies, nothing to fetch`)
+    return
+  }
 
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), "codev-install-"))
   try {
-    const result = childProcess.spawnSync(
-      "npm",
-      ["install", "--ignore-scripts", "--no-save", "--loglevel=error", "--prefix", temp, `${name}@${version}`],
-      { stdio: "inherit", windowsHide: true },
-    )
-    if (result.status !== 0) return
+    const args = [
+      "install",
+      "--ignore-scripts",
+      "--no-save",
+      "--loglevel=error",
+      "--prefix",
+      temp,
+      `${name}@${version}`,
+    ]
+    // Fork: `npm` is `npm.cmd` on Windows, and Node refuses to spawn .cmd
+    // files without a shell (EINVAL since 18.20.2/20.12.2, CVE-2024-27980),
+    // so this fallback silently never ran there. Go through cmd.exe as the
+    // Node docs recommend; Node still quotes each argument, so a temp path
+    // with spaces survives.
+    const result =
+      platform === "windows"
+        ? childProcess.spawnSync("cmd.exe", ["/d", "/s", "/c", "npm", ...args], { stdio: "inherit", windowsHide: true })
+        : childProcess.spawnSync("npm", args, { stdio: "inherit", windowsHide: true })
+    if (result.error) {
+      failures.push(`${name}: could not start npm to fetch it (${result.error.message})`)
+      return
+    }
+    if (result.status !== 0) {
+      failures.push(`${name}: npm install ${name}@${version} exited with ${result.status ?? `signal ${result.signal}`}`)
+      return
+    }
     const packageDir = path.join(temp, "node_modules", name)
     copyBinary(path.join(packageDir, "bin", sourceBinary), targetBinary)
     // Before the finally deletes temp — the bundled rg lives in the same package.
     copyRipgrep(packageDir)
     return true
+  } catch (error) {
+    failures.push(`${name}: fetched, but ${firstLine(error.message)}`)
+    return
   } finally {
     fs.rmSync(temp, { recursive: true, force: true })
   }
@@ -176,33 +205,56 @@ function copyBinary(source, target) {
   fs.chmodSync(target, 0o755)
 }
 
+// Fork: returns null when the binary runs, else a one-line reason. stderr is
+// captured (not ignored) because a binary that a security policy or
+// antivirus refuses to launch, or one missing a DLL, says so there and
+// nowhere else.
 function verifyBinary() {
   const result = childProcess.spawnSync(targetBinary, ["--version"], {
     encoding: "utf8",
-    stdio: "ignore",
+    stdio: ["ignore", "ignore", "pipe"],
     windowsHide: true,
   })
-  return result.status === 0
+  if (result.error) return `${targetBinary} could not be started (${result.error.message})`
+  if (result.status === 0) return null
+  const stderr = (result.stderr || "").trim()
+  const exit = result.status === null ? `was killed by signal ${result.signal}` : `exited with code ${result.status}`
+  return `${targetBinary} --version ${exit}${stderr ? `: ${firstLine(stderr)}` : ""}`
+}
+
+function firstLine(text) {
+  return String(text).split(/\r?\n/, 1)[0].slice(0, 300)
 }
 
 function main() {
+  const failures = []
   for (const name of packageNames()) {
+    let binary
     try {
-      const binary = resolveBinary(name)
+      binary = resolveBinary(name)
       copyBinary(binary, targetBinary)
-      if (verifyBinary()) {
-        copyRipgrep(path.dirname(path.dirname(binary)))
-        return
+    } catch (error) {
+      failures.push(`${name}: not installed by your package manager (${firstLine(error.message)})`)
+      // Fetch it ourselves; the fallback verifies what it copied.
+      if (installPackage(name, failures)) {
+        const problem = verifyBinary()
+        if (!problem) return
+        failures.push(`${name}: fetched, but ${problem}`)
       }
-    } catch {
-      if (installPackage(name) && verifyBinary()) return
+      continue
+    }
+    const problem = verifyBinary()
+    if (!problem) {
+      copyRipgrep(path.dirname(path.dirname(binary)))
+      return
     }
+    failures.push(`${name}: installed, but ${problem}`)
   }
 
   throw new Error(
     `It seems your package manager failed to install the right codev CLI package. Try manually installing ${packageNames()
       .map((name) => JSON.stringify(name))
-      .join(" or ")}.`,
+      .join(" or ")}.\n\nWhat was tried:\n${failures.map((line) => `  - ${line}`).join("\n")}`,
   )
 }