juggernaut-bedrock 4.2.3 → 4.2.5

package/index.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var path = require("path");
-var child_process = require("child_process");
+var childProcess = require("node:child_process");
 var fs = require("fs");
 
 var PLATFORM_MAP = {
@@ -41,7 +41,6 @@ function containsPackage(pkgName) {
 
 /**
  * @param {string} pkgName
- * @param {string} platform
  * @returns {string}
  */
 function resolvePkgDir(pkgName) {
@@ -60,6 +59,33 @@ function getBinaryPath(pkgName, platform) {
   return path.join(resolvePkgDir(pkgName), "bin", binaryName); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
 }
 
+/**
+ * Resolves bin to a real absolute path and asserts it stays within
+ * __dirname, preventing any tainted or traversed path from executing.
+ * @param {string} binPath
+ * @returns {string}
+ */
+function safeResolveBin(binPath) {
+  var real = fs.realpathSync(binPath); // nosemgrep: javascript_pathtraversal_rule-non-literal-fs-filename, javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename
+  var base = fs.realpathSync(__dirname); // nosemgrep: javascript_pathtraversal_rule-non-literal-fs-filename
+  if (!real.startsWith(base + path.sep) && real !== base) {
+    throw new Error("binary path escapes package directory: " + real);
+  }
+  return real;
+}
+
+function safeForwardArgs(args) {
+  var forwarded = [];
+  for (var i = 0; i < args.length; i++) {
+    var arg = String(args[i]);
+    if (arg.indexOf("\u0000") !== -1) {
+      throw new Error("invalid NUL byte in argument");
+    }
+    forwarded.push(arg);
+  }
+  return forwarded;
+}
+
 if (require.main === module) {
   var pkg = getPlatformPackage(process.platform, process.arch);
   if (!pkg) {
@@ -70,23 +96,29 @@ if (require.main === module) {
     process.exit(1);
   }
 
-  var bin = getBinaryPath(pkg, process.platform);
-  // nosemgrep: javascript_pathtraversal_rule-non-literal-fs-filename, javascript.lang.security.audit.detect-non-literal-fs-filename
-  if (!fs.existsSync(bin)) {
+  var binRaw = getBinaryPath(pkg, process.platform);
+  if (!fs.existsSync(binRaw)) { // nosemgrep: javascript_pathtraversal_rule-non-literal-fs-filename, javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename
     process.stderr.write(
-      "juggernaut-bedrock: binary not found at " + bin + "\n" +
+      "juggernaut-bedrock: binary not found at " + binRaw + "\n" +
       "Try reinstalling: npm install -g juggernaut-bedrock\n" +
       "If the problem persists, file an issue: https://github.com/jpvelasco/juggernaut/issues\n"
     );
     process.exit(1);
   }
 
-  // nosemgrep: javascript.lang.security.detect-child-process, javascript_exec_rule-child-process
-  var result = child_process.spawnSync(bin, process.argv.slice(2), {
+  var bin = safeResolveBin(binRaw);
+  var args = safeForwardArgs(process.argv.slice(2));
+  var result = childProcess.spawnSync(bin, args, {
     stdio: "inherit",
-    env: process.env
+    env: Object.assign({}, process.env),
+    shell: false,
+    windowsHide: true
   });
   process.exit(result.status !== null ? result.status : 1);
 }
 
-module.exports = { getPlatformPackage: getPlatformPackage, getBinaryPath: getBinaryPath };
+module.exports = {
+  getPlatformPackage: getPlatformPackage,
+  getBinaryPath: getBinaryPath,
+  safeForwardArgs: safeForwardArgs
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "juggernaut-bedrock",
-  "version": "4.2.3",
+  "version": "4.2.5",
   "description": "Route Claude Code through Amazon Bedrock in one command — IAM, SSO, or API key. Cross-platform CLI for GenAI developers.",
   "bin": {
     "juggernaut": "./index.js"
@@ -9,11 +9,11 @@
     "test": "node --test index.test.js"
   },
   "optionalDependencies": {
-    "juggernaut-bedrock-linux-x64": "4.2.3",
-    "juggernaut-bedrock-linux-arm64": "4.2.3",
-    "juggernaut-bedrock-darwin-x64": "4.2.3",
-    "juggernaut-bedrock-darwin-arm64": "4.2.3",
-    "juggernaut-bedrock-win32-x64": "4.2.3"
+    "juggernaut-bedrock-linux-x64": "4.2.5",
+    "juggernaut-bedrock-linux-arm64": "4.2.5",
+    "juggernaut-bedrock-darwin-x64": "4.2.5",
+    "juggernaut-bedrock-darwin-arm64": "4.2.5",
+    "juggernaut-bedrock-win32-x64": "4.2.5"
   },
   "os": [
     "darwin",