memtrace 0.3.33 → 0.3.34

package/bin/memtrace.js

@@ -6,6 +6,7 @@ const path = require("path");
 const fs   = require("fs");
 const { spawnSync, spawn } = require("child_process");
 const { getBinaryPath } = require("../install.js");
+const { platformBinary, spawnOptionsForPlatform } = require("../lib/spawn-helper");
 
 // ── Handle `memtrace uninstall` before delegating to the Rust binary ────────
 // npm v7+ does NOT fire preuninstall hooks for global packages (npm/cli#3042).
@@ -27,14 +28,20 @@ const args = process.argv.slice(2);
 // which now resolves to the freshly-installed shim, not this old one.
 
 if (args[0] === "install" || args[0] === "update" || args[0] === "upgrade") {
-  const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
-  const memtraceCmd = process.platform === "win32" ? "memtrace.cmd" : "memtrace";
+  // `npm.cmd` on win32 needs `shell: true` since the CVE-2024-27980
+  // mitigation in Node 18.20+ / 20.12+ / 21.7+. The helpers in
+  // `lib/spawn-helper.js` are unit + property tested.
+  const npmCmd = platformBinary("npm", process.platform);
+  const memtraceCmd = platformBinary("memtrace", process.platform);
 
   process.stdout.write("memtrace: fetching latest from npm registry…\n");
   const installResult = spawnSync(
     npmCmd,
     ["install", "-g", "memtrace@latest"],
-    { stdio: "inherit", env: process.env }
+    spawnOptionsForPlatform(process.platform, {
+      stdio: "inherit",
+      env: process.env,
+    })
   );
 
   if (installResult.error) {
@@ -60,10 +67,15 @@ if (args[0] === "install" || args[0] === "update" || args[0] === "upgrade") {
   process.stdout.write(
     `memtrace: upgrade complete — running 'memtrace ${rest.join(" ")}'\n`
   );
-  const runResult = spawnSync(memtraceCmd, rest, {
-    stdio: "inherit",
-    env: process.env,
-  });
+  // memtrace.cmd on Windows needs the same shell:true handling.
+  const runResult = spawnSync(
+    memtraceCmd,
+    rest,
+    spawnOptionsForPlatform(process.platform, {
+      stdio: "inherit",
+      env: process.env,
+    })
+  );
   if (runResult.error) {
     console.error(`memtrace: failed to chain command — ${runResult.error.message}`);
     process.exit(1);

package/install.js

@@ -5,6 +5,7 @@ const os = require("os");
 const path = require("path");
 const fs = require("fs");
 const { spawnSync } = require("child_process");
+const { platformBinary, spawnOptionsForPlatform } = require("./lib/spawn-helper");
 
 // ── Platform binary resolution (preserved from legacy) ───────────────────────
 
@@ -68,10 +69,20 @@ function selfHealPlatformPackage() {
     `memtrace: optional platform dep ${pkg} was not installed; ` +
     `running 'npm install ${versioned}' to fetch it…`
   );
+  // On Windows, Node.js 18.20+ / 20.12+ / 21.7+ refuse to spawn `.cmd`
+  // and `.bat` files without `shell: true` as part of the
+  // CVE-2024-27980 mitigation. The platform-aware helpers in
+  // `lib/spawn-helper.js` are unit + property tested so the shell
+  // flag is set IFF process.platform === "win32" — see
+  // `test/spawn-helper.test.js` for the full regression coverage.
   const result = spawnSync(
-    process.platform === "win32" ? "npm.cmd" : "npm",
+    platformBinary("npm", process.platform),
     ["install", "--no-save", versioned],
-    { cwd: __dirname, stdio: "inherit", env: process.env }
+    spawnOptionsForPlatform(process.platform, {
+      cwd: __dirname,
+      stdio: "inherit",
+      env: process.env,
+    })
   );
   if (result.status !== 0) {
     console.warn(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memtrace",
-  "version": "0.3.33",
+  "version": "0.3.34",
   "description": "Code intelligence graph — MCP server + AI agent skills + visualization UI",
   "keywords": [
     "mcp",
@@ -37,9 +37,9 @@
     "fs-extra": "^11.0.0"
   },
   "optionalDependencies": {
-    "@memtrace/darwin-arm64": "0.3.31",
-    "@memtrace/linux-x64": "0.3.31",
-    "@memtrace/win32-x64": "0.3.31"
+    "@memtrace/darwin-arm64": "0.3.34",
+    "@memtrace/linux-x64": "0.3.34",
+    "@memtrace/win32-x64": "0.3.34"
   },
   "engines": {
     "node": ">=18"