insta 0.0.48 → 0.0.49

package/dist/spawn.js

@@ -0,0 +1,77 @@
+import { existsSync, statSync } from 'node:fs';
+import { dirname, join, win32 } from 'node:path';
+export const isRunnableFile = (path, win) => {
+    try {
+        const stat = statSync(path);
+        if (!stat.isFile())
+            return false;
+        return win || (stat.mode & 0o111) !== 0;
+    }
+    catch {
+        return false;
+    }
+};
+/** Read an environment variable the way Windows itself does: case-insensitively.
+ *  `process.env` is already case-insensitive on win32, but a COPY of it (`{ ...process.env }`,
+ *  which every caller that adds a variable makes) is an ordinary object that keeps whatever
+ *  casing Windows used — and Windows overwhelmingly spells it `Path`, not `PATH`. Reading
+ *  `env.PATH` off such a copy yields undefined, nothing resolves, and the caller falls back to
+ *  spawning the bare `.cmd` shim this module exists to avoid. */
+export function envVar(env, name, win) {
+    const direct = env[name];
+    if (direct !== undefined || !win)
+        return direct;
+    const wanted = name.toLowerCase();
+    for (const [key, value] of Object.entries(env))
+        if (key.toLowerCase() === wanted)
+            return value;
+    return undefined;
+}
+/** Resolve a bare command name to its absolute PATH location (PATHEXT-aware on Windows).
+ *  cmd.exe searches the CURRENT DIRECTORY before PATH for bare names, so callers must pass
+ *  the absolute shim path to the cmd.exe wrapper below. */
+export function whichOnPath(bin, env = process.env, platform = process.platform) {
+    const win = platform === 'win32';
+    const exts = win ? [...(envVar(env, 'PATHEXT', win) ?? '.COM;.EXE;.BAT;.CMD').split(';'), ''] : [''];
+    for (const dir of (envVar(env, 'PATH', win) ?? '').split(win ? ';' : ':')) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const path = join(dir, bin + ext);
+            if (isRunnableFile(path, win))
+                return path;
+        }
+    }
+    return null;
+}
+// On Windows `npm`/`npx` and most npm-installed CLIs are .cmd shims, which spawn() without a
+// shell refuses. Prefer re-entering npm/npx through node; otherwise resolve a safe absolute shim
+// path and invoke it through cmd.exe. Kept shared so every child-process call uses the same rules.
+export function resolveSpawnable(cmd, args, npmExecpath = process.env.npm_execpath, execPath = process.execPath, platform = process.platform, env = process.env, systemRoot = process.env.SYSTEMROOT ?? process.env.windir ?? 'C:\\Windows') {
+    const execIsNode = /(^|[\\/])node(\.exe)?$/i.test(execPath);
+    if ((cmd === 'npm' || cmd === 'npx') && execIsNode) {
+        if (npmExecpath && /(^|[\\/])np[mx](-cli)?\.[cm]?js$/.test(npmExecpath)) {
+            const cli = npmExecpath.replace(/np[mx](-cli)?(\.[cm]?js)$/, `${cmd}$1$2`);
+            if (existsSync(cli))
+                return { cmd: execPath, args: [cli, ...args] };
+        }
+        const nodeDir = dirname(execPath);
+        const besideNode = platform === 'win32'
+            ? join(nodeDir, 'node_modules', 'npm', 'bin', `${cmd}-cli.js`)
+            : join(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', `${cmd}-cli.js`);
+        if (existsSync(besideNode))
+            return { cmd: execPath, args: [besideNode, ...args] };
+    }
+    const bareShim = !/[\\/]/.test(cmd) && !/\.exe$/i.test(cmd);
+    if (platform === 'win32' && bareShim && !args.some((arg) => /[&|<>^%"]/.test(arg))) {
+        const absolute = whichOnPath(cmd, env, platform);
+        // The resolved path itself also becomes cmd.exe input. If a PATH directory contains a shell
+        // metacharacter, fail via the caller's normal bare-spawn fallback rather than interpret it.
+        // Pin cmd.exe to System32 too: CreateProcess-style lookup checks cwd before PATH.
+        if (absolute && !/[&|<>^%"]/.test(absolute)) {
+            return { cmd: win32.join(systemRoot, 'System32', 'cmd.exe'), args: ['/d', '/s', '/c', absolute, ...args] };
+        }
+    }
+    return { cmd, args };
+}
+//# sourceMappingURL=spawn.js.map

package/dist/util.js

@@ -48,9 +48,24 @@ export function openUrl(url) {
         return false;
     }
 }
-export function die(msg) {
+export class CliExit extends Error {
+    constructor() {
+        // Preserve the observable error used by direct command-unit tests that previously mocked
+        // process.exit(1) by throwing `Error('exit 1')`.
+        super('exit 1');
+        this.name = 'CliExit';
+    }
+}
+export function fail(msg) {
     process.stderr.write(`error: ${msg}\n`);
-    process.exit(1);
+    process.exitCode = 1;
+}
+// Stop the current command without forcing Node to tear down active libuv handles. On Windows,
+// process.exit() can race the detached update-check child and abort in src\win\async.c with
+// UV_HANDLE_CLOSING. The guard absorbs CliExit after fail() records the intended exit status.
+export function die(msg) {
+    fail(msg);
+    throw new CliExit();
 }
 export function printJson(v) {
     process.stdout.write(JSON.stringify(v, null, 2) + '\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [