dsh-code 1.0.3 → 1.0.4

package/bin/deepseek.mjs

@@ -58,6 +58,12 @@ export function globalDshRoots() {
   ].filter(Boolean))]
 }
 
+/** Convert a file URL to a windows-style path even when resolved on a non-windows host. */
+function fileUrlToWindowsPath(url) {
+  const pathname = decodeURIComponent(new URL(url).pathname)
+  return pathname.replace(/^\/([A-Za-z]:)/, '$1').replace(/\//g, '\\')
+}
+
 /** Resolve the DSH entrypoint without passing user arguments through a Windows shell. */
 export function rawDshCommand(args, {
   platform = process.platform,
@@ -67,7 +73,9 @@ export function rawDshCommand(args, {
   resolvePackage = packageRequire.resolve,
 } = {}) {
   if (platform !== 'win32') return { command: 'dsh', args }
-  const adjacentEntrypoint = fileURLToPath(new URL('../../@deepseek-ai/dsh/lib/bin.js', moduleUrl))
+  // fileURLToPath follows the HOST separator; the win32 target needs a
+  // windows-style path regardless of where this resolver itself runs.
+  const adjacentEntrypoint = fileUrlToWindowsPath(new URL('../../@deepseek-ai/dsh/lib/bin.js', moduleUrl))
   if (fileExists(adjacentEntrypoint)) return { command: process.execPath, args: [adjacentEntrypoint, ...args] }
   for (const root of roots) {
     try {
@@ -111,7 +119,12 @@ function printDoctor(resolveCommand = rawDshCommand, spawnCommand = spawnSync) {
 }
 
 function launchChild(command, args) {
-  const child = spawn(command, args, { stdio: 'inherit' })
+  // Windows .cmd/.bat shims (npm.cmd) need a shell since Node's
+  // CVE-2024-27980 fix rejects spawning them directly with EINVAL. Every
+  // launch through here uses fixed, wrapper-owned arguments, so the shell
+  // surface adds no injection risk.
+  const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(command)
+  const child = spawn(command, args, { stdio: 'inherit', ...(needsShell ? { shell: true } : {}) })
   child.once('error', error => {
     console.error(`dsh-code: command failed: ${error.message}`)
     process.exitCode = 1
@@ -152,8 +165,9 @@ export function launchOperation(args = process.argv.slice(2)) {
     return launchChild(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['install', '-g', '@deepseek-ai/dsh', 'dsh-code'])
   }
   const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+  const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(npm)
   for (const name of ['@deepseek-ai/dsh', 'dsh-code']) {
-    const result = spawnSync(npm, ['view', name, 'version'], { encoding: 'utf8', windowsHide: true })
+    const result = spawnSync(npm, ['view', name, 'version'], { encoding: 'utf8', windowsHide: true, ...(needsShell ? { shell: true } : {}) })
     console.log(`${name}: ${result.status === 0 ? String(result.stdout).trim() : 'version check failed'}`)
   }
   console.log('Run `deepseek update --apply` to install the latest versions.')
@@ -166,12 +180,21 @@ export function launchDsh(
   spawnProcess = spawn,
   resolveCommand = dshCommand,
   isProfileReady = profileHasDshCode,
+  isInteractiveStdin = () => process.stdin.isTTY === true,
 ) {
   if (!isProfileReady()) {
     console.error('dsh-code: the cli profile does not mount dsh-code yet. Run: dsh plugin --profile cli add dsh-code')
     process.exitCode = 1
     return undefined
   }
+  // The interactive TUI is a raw-mode terminal application: with piped or
+  // otherwise non-TTY stdin it would die deep inside Ink's raw-mode gate
+  // with a cryptic stack. Fail here with one actionable line instead.
+  if (!isInteractiveStdin()) {
+    console.error('dsh-code: this terminal UI requires an interactive TTY on stdin; run it in a real terminal instead of a pipe')
+    process.exitCode = 1
+    return undefined
+  }
   const command = resolveCommand(args)
   if (command === undefined) {
     console.error('dsh-code: @deepseek-ai/dsh must be installed globally beside dsh-code; run: npm install -g @deepseek-ai/dsh dsh-code')