node-power-user 2.3.0 → 2.3.1

package/dist/commands/install.js

@@ -43,7 +43,7 @@ module.exports = async function (options) {
     npm.removeInstalledCopies(names);
   }
 
-  const command = `npm install ${childArgs.map(npxArgs.quoteArg).join(' ')}`.trim();
+  const command = `npm install ${npxArgs.quoteArgs(childArgs)}`.trim();
 
   // Check socket status upfront (blocks if not installed unless --force)
   await socket.check({ force });

package/dist/commands/npm.js

@@ -24,7 +24,7 @@ module.exports = async function (options) {
     return;
   }
 
-  const command = `npm ${childArgs.map(npxArgs.quoteArg).join(' ')}`;
+  const command = `npm ${npxArgs.quoteArgs(childArgs)}`;
 
   // Check firewall status upfront (blocks if not installed unless --force)
   await socket.check({ force });

package/dist/lib/npx-args.js

@@ -6,7 +6,7 @@
 // Tokens that select the npx command (positional + flag alias)
 const NPX_TOKENS = ['npx', '--npx'];
 
-// Args matching this need no quoting for POSIX sh (commands run with shell: true)
+// Args matching this need no quoting for POSIX sh or cmd.exe (commands run with shell: true)
 const SAFE_ARG = /^[A-Za-z0-9_\-./@=:,+]+$/;
 
 // Split raw argv into npu's own flags (before the command token) and the
@@ -47,18 +47,29 @@ function firstPositional(args) {
   return (args || []).find((arg) => !arg.startsWith('-')) || null;
 }
 
-// Single-quote an arg for the shell when it contains anything unsafe
-function quoteArg(arg) {
+// Quote an arg for the shell when it contains anything unsafe: single quotes
+// for POSIX sh; double quotes for cmd.exe, which keeps single quotes as text,
+// escaped the way the C runtime splits argv (backslashes before a quote double)
+function quoteArg(arg, platform = process.platform) {
   if (SAFE_ARG.test(arg)) {
     return arg;
   }
 
+  if (platform === 'win32') {
+    return `"${String(arg).replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
+  }
+
   return `'${String(arg).replace(/'/g, `'\\''`)}'`;
 }
 
+// Quote each arg and join them, the one way every command string is built
+function quoteArgs(args, platform = process.platform) {
+  return args.map((arg) => quoteArg(arg, platform)).join(' ');
+}
+
 // Rebuild the npx command string with shell-safe quoting
-function buildCommand(childArgs) {
-  return ['npx', ...childArgs.map(quoteArg)].join(' ');
+function buildCommand(childArgs, platform = process.platform) {
+  return `npx ${quoteArgs(childArgs, platform)}`.trim();
 }
 
 // Export
@@ -68,5 +79,6 @@ module.exports = {
   forcesDownload,
   firstPositional,
   quoteArg,
+  quoteArgs,
   buildCommand,
 };

package/dist/lib/socket.js

@@ -69,7 +69,10 @@ async function wrap(command, options) {
   let output = '';
   let exitCode = null;
 
-  const executeOptions = { log: !wrapped, config: {} };
+  // The child shares npu's stdin: a pipe npu never closes leaves `sfw npm
+  // install` waiting forever on Windows, and an install that prompts can read
+  // the terminal. Only stdout/stderr are piped, for the live echo below.
+  const executeOptions = { log: !wrapped, config: wrapped ? { stdio: ['inherit', 'pipe', 'pipe'] } : {} };
 
   // The wrapped child runs on pipes (not a TTY), which disables color in most
   // CLIs — restore it, but only when npu itself is printing to a real TTY

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "node-power-user",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Easy tools for every Node.js developer!",
+  "private": false,
   "main": "dist/index.js",
   "scripts": {
     "test": "npm run prepare && mocha test/ --recursive --timeout=10000",