node-power-user 2.3.1 → 2.3.2

package/dist/commands/install.js

@@ -53,7 +53,7 @@ module.exports = async function (options) {
 
   // Wrap with Socket Firewall
   try {
-    await socket.wrap(command, { force });
+    await socket.wrap('npm', ['install', ...childArgs], { force });
   } catch (e) {
     process.exitCode = e.code || 1;
 

package/dist/commands/npm.js

@@ -34,7 +34,7 @@ module.exports = async function (options) {
 
   // Wrap with Socket Firewall
   try {
-    await socket.wrap(command, { force });
+    await socket.wrap('npm', childArgs, { force });
   } catch (e) {
     process.exitCode = e.code || 1;
     logger.log('');

package/dist/commands/npx.js

@@ -36,7 +36,7 @@ module.exports = async function (options) {
   // (--package still downloads even without a positional, so it stays wrapped.)
   if (!binaryName && !npxArgs.forcesDownload(childArgs)) {
     try {
-      await socket.wrap(command, { force: true });
+      await socket.wrap('npx', childArgs, { force: true });
     } catch (e) {
       process.exitCode = e.code || 1;
     }
@@ -64,7 +64,7 @@ module.exports = async function (options) {
 
   // Wrap with Socket Firewall (plain run for local binaries / --force)
   try {
-    await socket.wrap(command, { force: force || isLocal });
+    await socket.wrap('npx', childArgs, { force: force || isLocal });
   } catch (e) {
     process.exitCode = e.code || 1;
     logger.log('');

package/dist/commands/outdated.js

@@ -324,7 +324,7 @@ module.exports = async function (options) {
     npm.removeLocations(desynced.map(d => d.loc), projectPath);
 
     try {
-      await socket.wrap('npm install', { force: options.force });
+      await socket.wrap('npm', ['install'], { force: options.force });
     } catch (e) {
       // Restore the lockfile so the failed run can't advance it further
       if (lockfileBackup) {
@@ -369,8 +369,8 @@ module.exports = async function (options) {
       return { allPackages, desynced, synced: false };
     }
 
-    const installCmd = `npm install ${toSync.map(pkg => `${pkg.name}@${pkg.packageVersion}`).join(' ')}`;
-    logger.log(logger.format.cyan(`\nRunning ${installCmd}...`));
+    const installArgs = ['install', ...toSync.map(pkg => `${pkg.name}@${pkg.packageVersion}`)];
+    logger.log(logger.format.cyan(`\nRunning npm ${installArgs.join(' ')}...`));
 
     const lockfileBackup = jetpack.read(lockfilePath);
 
@@ -379,7 +379,7 @@ module.exports = async function (options) {
     npm.removeInstalledCopies(toSync.map(pkg => pkg.name), projectPath);
 
     try {
-      await socket.wrap(installCmd, { force: options.force });
+      await socket.wrap('npm', installArgs, { force: options.force });
     } catch (e) {
       // Restore the lockfile so a blocked/failed install can't leave it
       // advanced past the physical files (that desync is what mints loops)
@@ -497,15 +497,15 @@ module.exports = async function (options) {
 
   // Install the specific upgraded packages so npm actually pulls them in
   // (plain `npm install` won't upgrade packages that already satisfy the range)
-  const installCmd = `npm install ${packageNames.map(name => `${name}@${version.clean(upgrades[name])}`).join(' ')}`;
-  logger.log(logger.format.cyan(`\nRunning ${installCmd}...`));
+  const installArgs = ['install', ...packageNames.map(name => `${name}@${version.clean(upgrades[name])}`)];
+  logger.log(logger.format.cyan(`\nRunning npm ${installArgs.join(' ')}...`));
 
   // Remove stale node_modules copies first so npm actually re-fetches them
   // instead of trusting the hidden lockfile and reporting "up to date"
   npm.removeInstalledCopies(packageNames, projectPath);
 
   try {
-    await socket.wrap(installCmd, { force: options.force });
+    await socket.wrap('npm', installArgs, { force: options.force });
   } catch (e) {
     // Restore both manifests since the bulk install failed
     jetpack.write(packageJsonPath, packageJsonBackup);

package/dist/lib/npx-args.js

@@ -6,7 +6,8 @@
 // Tokens that select the npx command (positional + flag alias)
 const NPX_TOKENS = ['npx', '--npx'];
 
-// Args matching this need no quoting for POSIX sh or cmd.exe (commands run with shell: true)
+// Args matching this go unquoted, in a shown command and in the cmd.exe line
+// spawn.js builds, so a char added here must be safe on that line too
 const SAFE_ARG = /^[A-Za-z0-9_\-./@=:,+]+$/;
 
 // Split raw argv into npu's own flags (before the command token) and the
@@ -47,8 +48,8 @@ function firstPositional(args) {
   return (args || []).find((arg) => !arg.startsWith('-')) || null;
 }
 
-// Quote an arg for the shell when it contains anything unsafe: single quotes
-// for POSIX sh; double quotes for cmd.exe, which keeps single quotes as text,
+// Quote an arg for a shown command (the Running line, a retry hint) and for
+// spawn.js's cmd.exe line when it holds anything unsafe: single quotes for POSIX sh; double quotes for cmd.exe,
 // escaped the way the C runtime splits argv (backslashes before a quote double)
 function quoteArg(arg, platform = process.platform) {
   if (SAFE_ARG.test(arg)) {
@@ -62,12 +63,12 @@ function quoteArg(arg, platform = process.platform) {
   return `'${String(arg).replace(/'/g, `'\\''`)}'`;
 }
 
-// Quote each arg and join them, the one way every command string is built
+// Quote each arg and join them, the one way every shown command is built
 function quoteArgs(args, platform = process.platform) {
   return args.map((arg) => quoteArg(arg, platform)).join(' ');
 }
 
-// Rebuild the npx command string with shell-safe quoting
+// The npx command as shown to the user
 function buildCommand(childArgs, platform = process.platform) {
   return `npx ${quoteArgs(childArgs, platform)}`.trim();
 }

package/dist/lib/socket.js

@@ -1,7 +1,18 @@
 // Libraries
+const fs = require('fs');
 const { execute } = require('node-powertools');
+const { spawn } = require('./spawn');
 const logger = new (require('./logger'))('node-power-user');
 
+// Whether npu's stdin is a file (`npu npx tool < input.txt`); a closed fd 0 is not
+function stdinIsFile() {
+  try {
+    return fs.fstatSync(0).isFile();
+  } catch (e) {
+    return false;
+  }
+}
+
 // Check if sfw (Socket Firewall) is installed
 let _sfwVersion = undefined;
 async function isFirewallAvailable() {
@@ -56,62 +67,65 @@ function isBlockOutput(output) {
   return BLOCK_MARKERS.some((marker) => marker.test(output || ''));
 }
 
-// Wrap a command with sfw if available; force (or no sfw) runs it plain.
-// Output always streams live. Throws on non-zero exit with:
-//   err.reason — 'sfw-blocked' (real firewall block) | 'command-failed'
-//   err.code   — the child's exit code
-async function wrap(command, options) {
+// Wrap a bin and its args with sfw if available; force (or no sfw) runs it
+// plain, output streaming live, each arg reaching the child as written. A
+// non-zero exit throws with err.reason 'sfw-blocked' or 'command-failed', and
+// err.code the exit code.
+async function wrap(bin, args, options) {
   options = options || {};
 
   const wrapped = !options.force && await isFirewallAvailable();
-  const finalCommand = wrapped ? `sfw ${command}` : command;
+  const [file, fileArgs] = wrapped ? ['sfw', [bin, ...args]] : [bin, args];
 
   let output = '';
-  let exitCode = null;
 
-  // The child shares npu's stdin: a pipe npu never closes leaves `sfw npm
-  // install` waiting forever on Windows, and an install that prompts can read
-  // the terminal. Only stdout/stderr are piped, for the live echo below.
-  const executeOptions = { log: !wrapped, config: wrapped ? { stdio: ['inherit', 'pipe', 'pipe'] } : {} };
+  // sfw waits for its stdin to close, so it shares npu's stdin only when that
+  // is a terminal or a redirected file; a pipe may never close, as Git Bash's
+  // mintty gives. Only stdout/stderr are piped, for the live echo below.
+  const stdin = process.stdin.isTTY || stdinIsFile() ? 'inherit' : 'ignore';
+  const config = { stdio: wrapped ? [stdin, 'pipe', 'pipe'] : 'inherit' };
 
   // The wrapped child runs on pipes (not a TTY), which disables color in most
-  // CLIs — restore it, but only when npu itself is printing to a real TTY
+  // CLIs: restore it, but only when npu itself is printing to a real TTY
   if (wrapped && process.stdout.isTTY) {
-    executeOptions.config.env = { ...process.env, FORCE_COLOR: '1' };
+    config.env = { ...process.env, FORCE_COLOR: '1' };
   }
 
-  try {
-    await execute(finalCommand, executeOptions, (child) => {
-      // Echo piped output through LIVE (and capture it for block detection)
-      // instead of letting it buffer invisibly until the process exits
-      if (child.stdout) {
-        child.stdout.on('data', (chunk) => {
-          output += chunk.toString();
-          process.stdout.write(chunk);
-        });
-      }
-
-      if (child.stderr) {
-        child.stderr.on('data', (chunk) => {
-          output += chunk.toString();
-          process.stderr.write(chunk);
-        });
-      }
-
-      child.on('close', (code) => {
-        exitCode = code;
+  const { code, spawnError } = await new Promise((resolve) => {
+    const child = spawn(file, fileArgs, config);
+
+    // Echo piped output through LIVE (and capture it for block detection)
+    // instead of letting it buffer invisibly until the process exits
+    if (child.stdout) {
+      child.stdout.on('data', (chunk) => {
+        output += chunk.toString();
+        process.stdout.write(chunk);
       });
-    });
-  } catch (e) {
-    const blocked = wrapped && isBlockOutput(output);
-    const err = blocked
-      ? new Error('Blocked by Socket Firewall — it flagged a risky package.')
-      : new Error(`Command failed with exit code ${exitCode === null ? 1 : exitCode}.`);
-
-    err.reason = blocked ? 'sfw-blocked' : 'command-failed';
-    err.code = exitCode === null ? 1 : exitCode;
-    throw err;
+    }
+
+    if (child.stderr) {
+      child.stderr.on('data', (chunk) => {
+        output += chunk.toString();
+        process.stderr.write(chunk);
+      });
+    }
+
+    child.on('error', (e) => resolve({ code: null, spawnError: e }));
+    child.on('close', (exitCode) => resolve({ code: exitCode }));
+  });
+
+  if (code === 0) {
+    return;
   }
+
+  const blocked = wrapped && isBlockOutput(output);
+  const err = blocked
+    ? new Error('Blocked by Socket Firewall: it flagged a risky package.')
+    : new Error(spawnError ? `Could not run ${file}: ${spawnError.message}` : `Command failed with exit code ${code === null ? 1 : code}.`);
+
+  err.reason = blocked ? 'sfw-blocked' : 'command-failed';
+  err.code = code === null ? 1 : code;
+  throw err;
 }
 
 // Socket Firewall handles protection at install time — no separate audit step needed

package/dist/lib/spawn.js

@@ -0,0 +1,61 @@
+// Libraries
+const childProcess = require('child_process');
+const jetpack = require('fs-jetpack');
+const path = require('path');
+const { quoteArg } = require('./npx-args');
+
+// cmd.exe metacharacters: each is escaped with ^ so cmd keeps it as text
+const CMD_META = /([()\][%!^"`<>&|;, *?])/g;
+
+// Windows env keys are case-insensitive, but a copied env object is not
+function envValue(env, name) {
+  const key = Object.keys(env).find((k) => k.toUpperCase() === name);
+  return key ? env[key] : '';
+}
+
+// The file cmd.exe runs for a bin: the first PATH dir holding it under a
+// PATHEXT extension (npm, npx and sfw resolve to their .cmd shims)
+function resolveWindowsBin(bin, env) {
+  const exts = (envValue(env, 'PATHEXT') || '.COM;.EXE;.BAT;.CMD').split(';');
+
+  for (const dir of envValue(env, 'PATH').split(';')) {
+    for (const ext of exts) {
+      const file = path.join(dir, `${bin}${ext}`);
+      if (dir && jetpack.exists(file) === 'file') {
+        return file;
+      }
+    }
+  }
+
+  return null;
+}
+
+// One arg on a cmd.exe line: C-runtime quoting, then every metacharacter
+// escaped, twice for a batch file, whose %* line cmd parses a second time
+function cmdArg(arg, batch) {
+  const once = quoteArg(arg, 'win32').replace(CMD_META, '^$1');
+  return batch ? once.replace(CMD_META, '^$1') : once;
+}
+
+// Spawn a bin with its args, each reaching the child exactly as written.
+// Windows runs bins through cmd.exe, as a .cmd shim needs.
+function spawn(bin, args, options, platform = process.platform) {
+  if (platform !== 'win32') {
+    return childProcess.spawn(bin, args, options);
+  }
+
+  const env = options.env || process.env;
+  const batch = /\.(?:cmd|bat)$/i.test(resolveWindowsBin(bin, env) || '');
+  const line = [bin, ...args.map((arg) => cmdArg(arg, batch))].join(' ');
+
+  return childProcess.spawn(envValue(env, 'COMSPEC') || 'cmd.exe', ['/d', '/s', '/c', `"${line}"`], {
+    ...options,
+    windowsVerbatimArguments: true,
+  });
+}
+
+// Export
+module.exports = {
+  cmdArg,
+  spawn,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-power-user",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Easy tools for every Node.js developer!",
   "private": false,
   "main": "dist/index.js",