create-kide-app 0.3.3 → 0.3.5

package/index.js

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
 
 import * as p from "@clack/prompts";
-import { execFileSync, execSync, spawn } from "node:child_process";
+import { execSync, spawn } from "node:child_process";
 import {
   cpSync,
   existsSync,
-  mkdirSync,
   readdirSync,
   readFileSync,
   rmSync,
@@ -32,6 +31,27 @@ const runAsync = (cmd, cwd) =>
     });
   });
 
+// Argv-based variant: no shell, so untrusted values (like the project directory)
+// are passed as single arguments and can never be reinterpreted as commands.
+const runFileAsync = (file, args, cwd) =>
+  new Promise((resolve, reject) => {
+    const child = spawn(file, args, { cwd });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => (stdout += d.toString()));
+    child.stderr.on("data", (d) => (stderr += d.toString()));
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve(stdout);
+      else {
+        const err = new Error(`Command failed: ${file} ${args.join(" ")}`);
+        err.stderr = stderr;
+        err.stdout = stdout;
+        reject(err);
+      }
+    });
+  });
+
 // --- Package manager detection ---
 
 const pm = {
@@ -97,44 +117,28 @@ const validateProjectName = (value) => {
 };
 
 // Resolve the latest release tag (v-prefixed semver) so scaffolds pin to a
-// deliberate release instead of whatever HEAD happens to be. Also captures the
-// tag's commit SHA from the same listing (peeled `^{}` entries win, so annotated
-// tags resolve to the commit, not the tag object). Returns null when the repo
-// has no tags (falls back to the default branch).
-const resolveLatestTag = () => {
+// deliberate release instead of whatever HEAD happens to be. Returns null when
+// the repo has no tags (falls back to the default branch). Async so the
+// "Downloading template" spinner keeps animating during the network call.
+const resolveLatestTag = async () => {
   try {
-    const output = execSync(
-      `git ls-remote --tags --sort=-v:refname ${REPO} "v*"`,
-      { stdio: "pipe" },
-    ).toString();
-    let tag = null;
-    let commit = null;
+    const output = await runFileAsync("git", [
+      "ls-remote",
+      "--tags",
+      "--sort=-v:refname",
+      REPO,
+      "v*",
+    ]);
     for (const line of output.split("\n")) {
-      const match = line.match(/^([0-9a-f]{40})\trefs\/tags\/(v[0-9][^\s^]*)(\^\{\})?$/);
-      if (!match) continue;
-      if (!tag) {
-        tag = match[2];
-        commit = match[1];
-      }
-      if (match[2] === tag && match[3]) commit = match[1];
+      const match = line.match(/refs\/tags\/(v[0-9][^^\s]*)$/);
+      if (match) return match[1];
     }
-    if (tag) return { tag, commit };
   } catch {
     // Network/git hiccup — fall back to default branch
   }
   return null;
 };
 
-// GitHub serves any tag as a single gzipped tarball — one HTTP request instead of
-// git protocol negotiation, and no .git dir to delete afterwards. Only applicable
-// for github.com remotes (KIDE_TEMPLATE_REPO may point anywhere, incl. file://).
-const githubTarballUrl = (tag) => {
-  const match = REPO.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/);
-  return match && tag
-    ? `https://codeload.github.com/${match[1]}/${match[2]}/tar.gz/refs/tags/${tag}`
-    : null;
-};
-
 // --- CLI flags (non-interactive use: CI, agents, testing) ---
 // Any prompt whose answer is supplied by a flag is skipped. Example:
 //   create-kide-app my-app --starter=marketing --seed --mode=embedded --target=local --no-github --no-dev
@@ -216,58 +220,23 @@ async function main() {
 
   s.start("Downloading template");
 
-  const resolved = resolveLatestTag();
-  const templateRef = resolved?.tag ?? null;
-  let templateCommit = resolved?.commit ?? null;
-
-  // Fast path: single tarball request. Falls back to git clone on any failure.
-  let downloaded = false;
-  const tarballUrl = githubTarballUrl(templateRef);
-  if (tarballUrl) {
-    try {
-      const response = await fetch(tarballUrl);
-      if (!response.ok) throw new Error(`HTTP ${response.status}`);
-      const tarball = Buffer.from(await response.arrayBuffer());
-      mkdirSync(projectDir, { recursive: true });
-      execFileSync("tar", ["-xzf", "-", "--strip-components=1", "-C", projectDir], {
-        input: tarball,
-        stdio: ["pipe", "pipe", "pipe"],
-      });
-      downloaded = true;
-    } catch {
-      rmSync(projectDir, { recursive: true, force: true });
-    }
-  }
+  const templateRef = await resolveLatestTag();
+  let templateCommit = null;
 
-  if (!downloaded) {
+  try {
+    const branchArgs = templateRef ? ["--branch", templateRef] : [];
+    await runFileAsync("git", ["clone", "--depth", "1", ...branchArgs, REPO, projectDir]);
     try {
-      const branchArgs = templateRef ? ["--branch", templateRef] : [];
-      // execFileSync, not execSync: no shell, so projectDir is passed as one argv entry
-      // and can never be reinterpreted as a command regardless of what it contains.
-      execFileSync(
-        "git",
-        ["clone", "--depth", "1", ...branchArgs, REPO, projectDir],
-        {
-          stdio: "pipe",
-        },
-      );
-      try {
-        templateCommit = execSync("git rev-parse HEAD", {
-          cwd: projectDir,
-          stdio: "pipe",
-        })
-          .toString()
-          .trim();
-      } catch {
-        // best-effort — stamp without a commit hash
-      }
-      rmSync(path.join(projectDir, ".git"), { recursive: true, force: true });
+      templateCommit = (await runFileAsync("git", ["rev-parse", "HEAD"], projectDir)).trim();
     } catch {
-      rmSync(projectDir, { recursive: true, force: true });
-      s.stop("Failed to download template.");
-      p.cancel("Check your network connection.");
-      process.exit(1);
+      // best-effort — stamp without a commit hash
     }
+    rmSync(path.join(projectDir, ".git"), { recursive: true, force: true });
+  } catch {
+    rmSync(projectDir, { recursive: true, force: true });
+    s.stop("Failed to download template.");
+    p.cancel("Check your network connection.");
+    process.exit(1);
   }
 
   // Remove files that shouldn't be in the scaffold

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kide-app",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Scaffold a new Kide CMS project",
   "author": "Matti Hernesniemi",
   "license": "MIT",