git-watchtower 2.1.4 → 2.1.6

package/bin/git-watchtower.js

@@ -529,8 +529,14 @@ async function getSessionUrl(branchName) {
 
 // Check if a CLI tool is available
 async function hasCommand(cmd) {
+  // `which` ships on macOS/Linux; Windows has no `which` by default but
+  // does ship `where` (since Windows Server 2003 / Vista). Without this
+  // platform branch, `hasCommand('gh')` always rejects on Windows, which
+  // makes the entire branch-actions modal (open/approve/merge PR, CI
+  // status) silently inert for Windows users.
+  const probe = process.platform === 'win32' ? 'where' : 'which';
   try {
-    await execCli('which', [cmd]);
+    await execCli(probe, [cmd]);
     return true;
   } catch (e) {
     return false;
@@ -2276,7 +2282,18 @@ function createStaticServer() {
     // directory. Without this second realpath+check, a symlinked dir
     // whose target pointed outside would serve its attacker-controlled
     // index.html through our root check.
-    if (fs.statSync(initial.path).isDirectory()) {
+    let isDir;
+    try {
+      isDir = fs.statSync(initial.path).isDirectory();
+    } catch (e) {
+      // File vanished (ENOENT), perms changed (EACCES), or symlink loop
+      // (ELOOP) between resolveStaticPath's realpath and this stat.
+      // Without this guard the throw bubbles to uncaughtException and
+      // tears down the entire TUI for what should be a 404.
+      send404();
+      return;
+    }
+    if (isDir) {
       const indexResult = resolveStaticPath(
         path.join(initial.path, 'index.html'),
         realStaticDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {