create-principles-disciple 1.127.0 → 1.127.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -564,7 +564,11 @@ async function doApplyUpdate(options, workspaceDir) {
|
|
|
564
564
|
fs.writeFileSync(tarballPath, buffer);
|
|
565
565
|
// EP-08: spawn tar via argv array — tarball/temp paths stay data, never
|
|
566
566
|
// shell syntax (Mimosa command-injection finding, 2026-08-22).
|
|
567
|
-
|
|
567
|
+
// Use cwd + relative archive path: GNU tar on Windows (Git Bash) misparses
|
|
568
|
+
// absolute C:\... paths as remote host C: (host:path syntax), causing
|
|
569
|
+
// "tar: Cannot connect to C: resolve failed". Windows System32 bsdtar does
|
|
570
|
+
// not support GNU tar's --force-local, so relative path is the universal fix.
|
|
571
|
+
execFileSync('tar', ['xzf', 'package.tgz', '--strip-components=1'], { cwd: tempDir, stdio: 'pipe' });
|
|
568
572
|
fs.unlinkSync(tarballPath);
|
|
569
573
|
// 4. Compute diff and apply.
|
|
570
574
|
// Fix 3: we ONLY apply modified + added files. We deliberately skip ALL
|
|
@@ -918,7 +922,11 @@ async function doInlineFullUpdate(workspaceDir) {
|
|
|
918
922
|
fs.writeFileSync(tarballPath, buffer);
|
|
919
923
|
// EP-08: spawn tar via argv array — tarball/temp paths stay data, never
|
|
920
924
|
// shell syntax (Mimosa command-injection finding, 2026-08-22).
|
|
921
|
-
|
|
925
|
+
// Use cwd + relative archive path: GNU tar on Windows (Git Bash) misparses
|
|
926
|
+
// absolute C:\... paths as remote host C: (host:path syntax), causing
|
|
927
|
+
// "tar: Cannot connect to C: resolve failed". Windows System32 bsdtar does
|
|
928
|
+
// not support GNU tar's --force-local, so relative path is the universal fix.
|
|
929
|
+
execFileSync('tar', ['xzf', 'package.tgz', '--strip-components=1'], { cwd: tempDir, stdio: 'pipe' });
|
|
922
930
|
fs.unlinkSync(tarballPath);
|
|
923
931
|
// The tarball, not the installer package version, is the release we are
|
|
924
932
|
// about to activate. Prove it advances the installed plugin BEFORE the
|