create-astro 5.0.0-beta.3 → 5.0.0-beta.4

package/dist/index.js

@@ -295,7 +295,7 @@ async function shell(command, flags, opts = {}) {
   let stdout2 = "";
   let stderr = "";
   try {
-    child = spawn(`${command} ${flags.join(" ")}`, {
+    child = spawn(command, flags, {
       cwd: opts.cwd,
       shell: true,
       stdio: opts.stdio,
@@ -452,7 +452,7 @@ function printHelp({
   if (headline) {
     message.push(
       linebreak(),
-      `${title(commandName)} ${color.green(`v${"5.0.0-beta.3"}`)} ${headline}`
+      `${title(commandName)} ${color.green(`v${"5.0.0-beta.4"}`)} ${headline}`
     );
   }
   if (usage) {
@@ -551,7 +551,7 @@ async function getContext(argv) {
       packageManager,
       "astro",
       getPackageTag(packageSpecifier),
-      "6.0.0-beta.7"
+      "6.0.0-beta.10"
     ),
     skipHouston,
     fancy,
@@ -584,6 +584,21 @@ function detectPackageManager() {
 // src/actions/dependencies.ts
 import fs from "node:fs";
 import path from "node:path";
+
+// ../internal-helpers/dist/cli.js
+var NPM_PACKAGE_NAME_REGEX = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+function validatePackageName(packageName) {
+  return NPM_PACKAGE_NAME_REGEX.test(packageName);
+}
+function assertValidPackageName(packageName) {
+  if (!validatePackageName(packageName)) {
+    throw new Error(
+      `Invalid package name "${packageName}". Package names must follow npm naming rules: lowercase letters, numbers, hyphens, underscores, and dots. Scoped packages like @org/package are also supported.`
+    );
+  }
+}
+
+// src/actions/dependencies.ts
 import { color as color2 } from "@astrojs/cli-kit";
 async function dependencies(ctx) {
   let deps = ctx.install ?? ctx.yes;
@@ -599,6 +614,11 @@ async function dependencies(ctx) {
     ctx.install = deps;
   }
   ctx.add = ctx.add?.reduce((acc, item) => acc.concat(item.split(",")), []);
+  if (ctx.add) {
+    for (const addValue of ctx.add) {
+      assertValidPackageName(addValue);
+    }
+  }
   if (ctx.dryRun) {
     await info(
       "--dry-run",
@@ -651,11 +671,9 @@ async function astroAdd({
   cwd
 }) {
   if (packageManager === "yarn") await ensureYarnLock({ cwd });
-  return shell(
-    packageManager === "npm" ? "npx" : `${packageManager} dlx`,
-    ["astro add", integrations.join(" "), "-y"],
-    { cwd, timeout: 9e4, stdio: "ignore" }
-  );
+  const command = packageManager === "npm" ? "npx" : packageManager;
+  const args = packageManager === "npm" ? ["astro", "add", ...integrations, "-y"] : ["dlx", "astro", "add", ...integrations, "-y"];
+  return shell(command, args, { cwd, timeout: 9e4, stdio: "ignore" });
 }
 async function install({ packageManager, cwd }) {
   if (packageManager === "yarn") await ensureYarnLock({ cwd });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-astro",
-  "version": "5.0.0-beta.3",
+  "version": "5.0.0-beta.4",
   "type": "module",
   "author": "withastro",
   "license": "MIT",
@@ -30,6 +30,7 @@
   },
   "devDependencies": {
     "arg": "^5.0.2",
+    "@astrojs/internal-helpers": "0.8.0-beta.1",
     "astro-scripts": "0.0.14"
   },
   "engines": {