poseref 0.1.0 → 0.1.1

package/dist-server/cli.js

@@ -2324,14 +2324,29 @@ function registrationEnv(port = resolvePort()) {
 }
 /** Every argument PoseRef passes to another CLI is a fixed word or a version, never user text. */
 var SAFE_ARG = /^[\w@.:/=-]+$/;
-function run(command, args) {
+/**
+* Joins a command for the Windows shell. claude and codex are .cmd shims there,
+* which Node can only start through a shell; building the line ourselves (rather
+* than passing an args array with `shell: true`, which Node deprecates because it
+* concatenates without escaping) keeps the check on every piece explicit. Pieces
+* are limited to SAFE_ARG, which has no spaces or shell metacharacters, so they
+* need no quoting.
+*/
+function shellCommandLine(command, args) {
 	for (const arg of [command, ...args]) if (!SAFE_ARG.test(arg)) throw new Error(`Refusing to run a command with an unexpected argument: ${arg}`);
-	const result = spawnSync(command, args, {
+	return [command, ...args].join(" ");
+}
+function run(command, args) {
+	const line = shellCommandLine(command, args);
+	const options = {
 		encoding: "utf8",
-		shell: process.platform === "win32",
 		windowsHide: true,
 		timeout: 6e4
-	});
+	};
+	const result = process.platform === "win32" ? spawnSync(line, {
+		...options,
+		shell: true
+	}) : spawnSync(command, args, options);
 	return {
 		ok: result.status === 0,
 		output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poseref",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Pose and composition reference maker for image-generation AI, with an MCP server so Claude Code and Codex can pose it",
   "keywords": [
     "pose",