doc-detective 4.2.0 → 4.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doc-detective",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Treat doc content as testable assertions to validate doc accuracy and product UX.",
   "bin": {
     "doc-detective": "bin/doc-detective.js"
@@ -48,6 +48,8 @@
     "dev": "node ./dev",
     "container:build": "node src/container/scripts/build.cjs",
     "container:rebuild": "node src/container/scripts/build.cjs --no-cache",
+    "container:build:base": "node src/container/scripts/build.cjs --target=base",
+    "container:build:base:push": "node src/container/scripts/build.cjs --target=base --push",
     "container:test": "mocha src/container/test/*.test.cjs --timeout 0"
   },
   "repository": {

package/scripts/postinstall.js

@@ -63,27 +63,46 @@ async function maybePromptInstallAgents() {
       : "PATH";
   const originalPath = process.env[pathKey];
   const pathSep = process.platform === "win32" ? ";" : ":";
+  // Windows paths are case-insensitive, so normalize both sides of every
+  // comparison to lowercase on win32. Otherwise `C:\Proj\NODE_MODULES\.BIN`
+  // would slip past a literal `/node_modules/.bin` check.
+  const isWin = process.platform === "win32";
+  const caseFold = (s) => (isWin ? s.toLowerCase() : s);
   const initCwdAbs = process.env.INIT_CWD
     ? path.resolve(process.env.INIT_CWD)
     : null;
+  const initCwdMatch = initCwdAbs ? caseFold(initCwdAbs) : null;
+  // Guard against INIT_CWD resolving to a root ("/" on POSIX, "C:\" on
+  // Windows): blindly appending path.sep would produce "//" or "C:\\", and
+  // `startsWith` would miss every subpath. When the value already ends with
+  // a separator (root case), use it as-is; otherwise append.
+  const initCwdPrefix =
+    initCwdMatch && !initCwdMatch.endsWith(path.sep)
+      ? initCwdMatch + path.sep
+      : initCwdMatch;
   const sanitizedPath = (originalPath || "")
     .split(pathSep)
     .filter((entry) => {
       if (!entry || entry === ".") return false;
-      const normalized = entry.split(path.sep).join("/");
+      const normalized = caseFold(entry.split(path.sep).join("/"));
       if (normalized.includes("/node_modules/.bin")) return false;
-      if (initCwdAbs) {
-        const resolved = path.resolve(entry);
-        if (
-          resolved === initCwdAbs ||
-          resolved.startsWith(initCwdAbs + path.sep)
-        )
+      if (initCwdMatch) {
+        const resolved = caseFold(path.resolve(entry));
+        if (resolved === initCwdMatch || resolved.startsWith(initCwdPrefix))
           return false;
       }
       return true;
     })
     .join(pathSep);
   process.env[pathKey] = sanitizedPath;
+  // Restoring via `process.env[k] = undefined` coerces to the literal string
+  // "undefined" (Node stringifies every env value), leaving the process with
+  // a broken PATH. Delete the key when the original was absent; only assign
+  // when we have a real string.
+  const restorePath = () => {
+    if (originalPath === undefined) delete process.env[pathKey];
+    else process.env[pathKey] = originalPath;
+  };
 
   // Hard ceiling on the whole detection phase. Some adapters shell out to
   // external CLIs that could hang on auth prompts, proxy stalls, etc. On
@@ -121,17 +140,17 @@ async function maybePromptInstallAgents() {
     );
     const result = await Promise.race([detection, timeout]);
     if (result === "__timeout__") {
-      process.env[pathKey] = originalPath;
+      restorePath();
       // Orphaned adapter children would otherwise keep the event loop alive
       // and freeze `npm install`. See comment above.
       process.exit(0);
     }
     adaptersNeedingInstall = result.filter(Boolean);
   } catch {
-    process.env[pathKey] = originalPath;
+    restorePath();
     return;
   }
-  process.env[pathKey] = originalPath;
+  restorePath();
 
   if (adaptersNeedingInstall.length === 0) return;