rastack 0.0.39 → 0.0.41

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.41](https://github.com/theserverkid/reactapistack/compare/v0.0.40...v0.0.41) (2026-07-12)
+
+### [0.0.40](https://github.com/theserverkid/reactapistack/compare/v0.0.39...v0.0.40) (2026-07-12)
+
+
+### Bug Fixes
+
+* `rastack init` now wires the GitHub→Lambda deploy variables ([fa35b97](https://github.com/theserverkid/reactapistack/commit/fa35b9744c2149ff7a9c663ffecdd2d6ad1edec6))
+
 ### [0.0.39](https://github.com/theserverkid/reactapistack/compare/v0.0.38...v0.0.39) (2026-07-11)
 
 ### [0.0.38](https://github.com/theserverkid/reactapistack/compare/v0.0.37...v0.0.38) (2026-07-11)

package/dist/deploy/config.d.ts

@@ -185,6 +185,16 @@ export interface RepoVariable {
  * Console.
  */
 export declare function repoVariables(cfg: DeployConfig): RepoVariable[];
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+export declare function ghVariableSetArgs(cfg: DeployConfig, name: string, value: string): string[];
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/dist/deploy/config.js

@@ -33,6 +33,7 @@ exports.bootstrapStackParameters = bootstrapStackParameters;
 exports.bootstrapStackArgs = bootstrapStackArgs;
 exports.bootstrapStackCommand = bootstrapStackCommand;
 exports.repoVariables = repoVariables;
+exports.ghVariableSetArgs = ghVariableSetArgs;
 exports.lambdaEnv = lambdaEnv;
 exports.DEFAULT_LAMBDA = {
     bin: "bootstrap",
@@ -345,6 +346,26 @@ function repoVariables(cfg) {
         { name: "AWS_REGION", value: cfg.region, from: "Region stack output" },
     ];
 }
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+function ghVariableSetArgs(cfg, name, value) {
+    return [
+        "variable",
+        "set",
+        name,
+        "--repo",
+        `${cfg.github.owner}/${cfg.github.repo}`,
+        "--body",
+        value,
+    ];
+}
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/dist/deploy/io.d.ts

@@ -17,7 +17,7 @@ export declare function saveConfig(cfg: DeployConfig, cwd?: string): string;
  */
 export declare function gitRemoteUrl(cwd?: string): string | null;
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-export declare function canPrompt(nonInteractive: boolean): boolean;
+export declare function canPrompt(nonInteractive?: boolean): boolean;
 /** Capture `aws <args>` stdout, or null when the CLI is absent / the call fails. */
 export declare function awsCapture(args: string[], cwd?: string): string | null;
 /** Run `aws <args>` streaming output; throws on a non-zero exit. */
@@ -37,6 +37,29 @@ export declare function stackOutput(stackName: string, key: string, region: stri
  * on every `init`. Returns false when the placeholder file is missing.
  */
 export declare function uploadPlaceholder(artifactsBucket: string, region: string, cwd?: string): boolean;
+/** True when the GitHub CLI is on PATH. */
+export declare function ghAvailable(): boolean;
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+export declare function ghAuthenticated(cwd?: string): boolean;
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+export declare function ghAuthLogin(cwd?: string): boolean;
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+export declare function setRepoVariable(args: string[], cwd?: string): boolean;
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/dist/deploy/io.js

@@ -48,6 +48,10 @@ exports.awsRun = awsRun;
 exports.awsAvailable = awsAvailable;
 exports.stackOutput = stackOutput;
 exports.uploadPlaceholder = uploadPlaceholder;
+exports.ghAvailable = ghAvailable;
+exports.ghAuthenticated = ghAuthenticated;
+exports.ghAuthLogin = ghAuthLogin;
+exports.setRepoVariable = setRepoVariable;
 exports.ask = ask;
 exports.withPrompt = withPrompt;
 const child_process_1 = require("child_process");
@@ -98,7 +102,7 @@ function gitRemoteUrl(cwd = process.cwd()) {
     }
 }
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-function canPrompt(nonInteractive) {
+function canPrompt(nonInteractive = false) {
     return !nonInteractive && Boolean(process.stdin.isTTY);
 }
 // ── AWS CLI boundary ─────────────────────────────────────────────────────────
@@ -175,6 +179,75 @@ function uploadPlaceholder(artifactsBucket, region, cwd = process.cwd()) {
     ]);
     return true;
 }
+// ── GitHub CLI boundary ──────────────────────────────────────────────────────
+// After the stack is up `init` wires the two repo Variables CI reads
+// (AWS_DEPLOY_ROLE_ARN / AWS_REGION) through the developer's own `gh` — already
+// authenticated to their GitHub — so the pipeline fires on the first push
+// instead of leaving the wiring as a manual Console step. Best-effort: absent or
+// unauthenticated `gh` degrades to the printed instructions.
+/** True when the GitHub CLI is on PATH. */
+function ghAvailable() {
+    try {
+        (0, child_process_1.execFileSync)("gh", ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+function ghAuthenticated(cwd = process.cwd()) {
+    try {
+        (0, child_process_1.execFileSync)("gh", ["auth", "status", "--hostname", "github.com"], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+function ghAuthLogin(cwd = process.cwd()) {
+    try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execFileSync)("gh", ["auth", "login", "--hostname", "github.com"], {
+            cwd,
+            stdio: "inherit",
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+function setRepoVariable(args, cwd = process.cwd()) {
+    try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execFileSync)("gh", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/dist/rastack-init.d.ts

@@ -5,7 +5,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`

package/dist/rastack-init.js

@@ -6,7 +6,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
@@ -68,7 +68,6 @@ function parseFlags(argv) {
     let noWorkflows = false;
     let noDeploy = false;
     let print = false;
-    let nonInteractive = false;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         const next = () => argv[++i] ?? "";
@@ -107,11 +106,6 @@ function parseFlags(argv) {
             case "--dry-run":
                 print = true;
                 break;
-            case "--yes":
-            case "-y":
-            case "--non-interactive":
-                nonInteractive = true;
-                break;
             default:
                 if (a.startsWith("-")) {
                     console.error(`Unknown flag: ${a}`);
@@ -119,7 +113,7 @@ function parseFlags(argv) {
                 }
         }
     }
-    return { patch, force, noWorkflows, noDeploy, print, nonInteractive };
+    return { patch, force, noWorkflows, noDeploy, print };
 }
 /** Seed a config: existing file → flags → git remote → defaults. */
 function seedConfig(flags) {
@@ -209,7 +203,7 @@ function printPlan(cfg) {
  * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
  * the config. Returns the config enriched with the resolved buckets + outputs.
  */
-async function standUp(cfg) {
+async function standUp(cfg, interactive) {
     if (!(0, io_1.awsAvailable)()) {
         console.error("  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
             "    or re-run with --print to see the commands, or --no-deploy to skip.");
@@ -252,8 +246,57 @@ async function standUp(cfg) {
     const outputs = readAppOutputs(cfg);
     cfg = (0, config_1.mergeConfig)(cfg, { outputs });
     (0, io_1.saveConfig)(cfg);
+    // 5. Connect the GitHub CLI and wire the repo Variables CI reads, so the FIRST
+    //    push actually ships. Without this the deploy-backend workflow's `if:
+    //    vars.AWS_DEPLOY_ROLE_ARN != ''` guard silently skips every run.
+    wireRepoVariables(cfg, interactive);
     return cfg;
 }
+/**
+ * Set the `AWS_DEPLOY_ROLE_ARN` / `AWS_REGION` repo Variables via `gh` so the
+ * GitHub → Lambda pipeline is live the moment `init` finishes. Connects `gh` to
+ * GitHub first — running `gh auth login` when it is installed but not yet
+ * authenticated (on a TTY) — so a fresh machine goes from nothing to a working
+ * pipeline in one command. Best-effort throughout: no `gh`, a declined login, or
+ * a value the stack Outputs did not yield falls back to the printed instructions
+ * in `printSummary`. Records the names it wired so the summary reports what is
+ * (and isn't) done.
+ */
+const wiredVariables = new Set();
+function wireRepoVariables(cfg, interactive) {
+    const vars = (0, config_1.repoVariables)(cfg).filter((v) => v.value);
+    if (!vars.length)
+        return;
+    if (!(0, io_1.ghAvailable)()) {
+        console.log("\n▸ GitHub CLI (`gh`) not found — skipping repo Variable wiring.\n" +
+            "  Install `gh` (https://cli.github.com) and re-run, or wire the\n" +
+            "  Variables below by hand so pushes deploy.");
+        return;
+    }
+    // Connect `gh` to GitHub if it isn't already, so it can set the Variables.
+    if (!(0, io_1.ghAuthenticated)()) {
+        if (interactive) {
+            console.log("\n▸ Connecting the GitHub CLI to your account (`gh auth login`)");
+            (0, io_1.ghAuthLogin)();
+        }
+        if (!(0, io_1.ghAuthenticated)()) {
+            console.log("\n▸ GitHub CLI is not connected — skipping repo Variable wiring.\n" +
+                "  Run `gh auth login`, then wire the Variables below by hand.");
+            return;
+        }
+    }
+    console.log("\n▸ Wiring the GitHub repo Variables CI reads (via `gh`)");
+    for (const v of vars) {
+        const ok = (0, io_1.setRepoVariable)((0, config_1.ghVariableSetArgs)(cfg, v.name, v.value));
+        if (ok) {
+            wiredVariables.add(v.name);
+            console.log(`  ✓ set ${v.name}`);
+        }
+        else {
+            console.log(`  • could not set ${v.name} — wire it by hand (below)`);
+        }
+    }
+}
 /** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
 function deployBootstrap(cfg) {
     try {
@@ -277,26 +320,33 @@ function printSummary(cfg) {
     console.log(`\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`);
     if (cfg.outputs?.apiUrl)
         console.log(`    API:  ${cfg.outputs.apiUrl}`);
-    console.log("\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):");
-    console.log(table((0, config_1.repoVariables)(cfg).map((v) => ({
-        key: v.name,
-        value: v.value || `<${v.from}>`,
-    }))));
-    console.log(`\n  Then every push to ${cfg.github.branch} ships code via \`rastack ci deploy\`` +
+    // Only the Variables `init` could NOT wire itself remain a manual step.
+    const pending = (0, config_1.repoVariables)(cfg).filter((v) => !wiredVariables.has(v.name));
+    if (pending.length) {
+        console.log("\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):");
+        console.log(table(pending.map((v) => ({
+            key: v.name,
+            value: v.value || `<${v.from}>`,
+        }))));
+    }
+    else {
+        console.log("\n  ✓ wired the GitHub repo Variables CI reads (AWS_DEPLOY_ROLE_ARN, AWS_REGION).");
+    }
+    console.log(`\n  Every push to ${cfg.github.branch} now ships code via \`rastack ci deploy\`` +
         ` (also runnable locally as \`rastack deploy\`).\n`);
 }
 async function main(argv) {
     const flags = parseFlags(argv);
     let cfg = seedConfig(flags);
-    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+    if ((0, io_1.canPrompt)()) {
         console.log("\n  rastack init — scaffold the deploy config + stand the backend up\n");
         cfg = await promptMissing(cfg);
     }
     const errors = (0, config_1.validateConfig)(cfg);
     // Any deploy needs a complete config; a still-incomplete one is fatal unless we
-    // are only scaffolding files.
+    // are only scaffolding files, and always fatal off a TTY (no prompt to fix it).
     if (errors.length) {
-        const fatal = !flags.noDeploy || flags.nonInteractive;
+        const fatal = !flags.noDeploy || !(0, io_1.canPrompt)();
         const label = fatal ? "✗" : "⚠";
         for (const e of errors)
             console.error(`  ${label} ${e}`);
@@ -334,14 +384,14 @@ async function main(argv) {
             `  or \`rastack init --print\` to see the exact commands.\n`);
         return;
     }
-    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+    if ((0, io_1.canPrompt)()) {
         const ok = await confirm(`Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`);
         if (!ok) {
             console.log("\n  Skipped the deploy. Re-run to deploy, or `rastack init --print` for the commands.\n");
             return;
         }
     }
-    cfg = await standUp(cfg);
+    cfg = await standUp(cfg, (0, io_1.canPrompt)());
     printSummary(cfg);
 }
 if (require.main === module) {

package/dist/rastack-update.js

@@ -56,6 +56,12 @@ const path = __importStar(require("path"));
 const update_1 = require("./update");
 /** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
 const NPM = (0, update_1.npmBinary)();
+/**
+ * Whether to launch npm through a shell. Required on Windows, where a bare
+ * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;
+ * false on POSIX so the direct spawn stays injection-free.
+ */
+const NPM_SHELL = (0, update_1.npmSpawnShell)();
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -73,6 +79,7 @@ function npmCapture(args) {
     try {
         return (0, child_process_1.execFileSync)(NPM, args, {
             stdio: ["ignore", "pipe", "pipe"],
+            shell: NPM_SHELL,
         })
             .toString()
             .trim();
@@ -118,10 +125,12 @@ function main(argv) {
     }
     console.log(`\n▸ Updating rastack (${current} → ${flags.version}) in ${prefix}\n`);
     try {
-        // Re-runs the developer's own npm to update this global package — no
-        // untrusted input, and execFileSync (no shell) avoids any injection.
+        // Re-runs the developer's own npm to update this global package. On Windows
+        // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
+        // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
+        // and every other arg is a fixed literal, so nothing injectable reaches it.
         // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env });
+        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
     }
     catch (err) {
         console.error(`\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${(0, update_1.npmInstallArgs)(flags.version)[2]}\n    ${err.message}`);

package/dist/update.d.ts

@@ -23,14 +23,35 @@ export interface UpdateFlags {
  * 0.0.40`). Unknown values default to `latest`.
  */
 export declare function parseUpdateFlags(argv: string[]): UpdateFlags;
+/**
+ * Constrain the update target to a safe npm version or dist-tag. The Windows
+ * update path runs npm through a shell (see `npmSpawnShell`), so the target —
+ * the one caller-supplied token that reaches the command line — must not be
+ * able to carry shell metacharacters. A valid npm spec starts alphanumeric and
+ * uses only `A-Za-z0-9._-` (e.g. `latest`, `next`, `0.0.40`, `1.2.3-beta.1`);
+ * anything else falls back to `latest`.
+ */
+export declare function sanitizeVersion(version: string | undefined): string;
 /**
  * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
  * not a real executable, so `execFile("npm", …)` (no shell) fails with
  * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
  * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
  * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ *
+ * The `.cmd` must still be launched through a shell — see `npmSpawnShell`.
  */
 export declare function npmBinary(platform?: string): string;
+/**
+ * Whether npm must be spawned through a shell on this platform. Since the Node
+ * fix for CVE-2024-27980 (18.20.2 / 20.12.2 / 21.7.2), spawning a `.cmd` shim
+ * like `npm.cmd` *without* a shell is rejected with `spawnSync npm.cmd EINVAL`
+ * — the very failure a Windows/PowerShell `rastack update` hits. cmd.exe knows
+ * how to run a `.cmd`, so Windows spawns through the shell; POSIX keeps the
+ * direct, shell-free spawn (npm is a real script resolved on PATH there, and no
+ * shell means no injection surface).
+ */
+export declare function npmSpawnShell(platform?: string): boolean;
 /** The npm package spec to install for a target version. */
 export declare function installSpec(version: string): string;
 /** The `npm <args>` (after the `npm` binary) that installs the target globally. */

package/dist/update.js

@@ -12,7 +12,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseUpdateFlags = parseUpdateFlags;
+exports.sanitizeVersion = sanitizeVersion;
 exports.npmBinary = npmBinary;
+exports.npmSpawnShell = npmSpawnShell;
 exports.installSpec = installSpec;
 exports.npmInstallArgs = npmInstallArgs;
 exports.globalPrefixFromPackageDir = globalPrefixFromPackageDir;
@@ -39,26 +41,53 @@ function parseUpdateFlags(argv) {
                 break;
             case "--version":
             case "--to":
-                version = argv[++i] ?? "latest";
+                version = sanitizeVersion(argv[++i]);
                 break;
             default:
                 // A bare, non-flag token is taken as the target version.
                 if (!a.startsWith("-"))
-                    version = a;
+                    version = sanitizeVersion(a);
         }
     }
     return { version, check, dryRun };
 }
+/**
+ * Constrain the update target to a safe npm version or dist-tag. The Windows
+ * update path runs npm through a shell (see `npmSpawnShell`), so the target —
+ * the one caller-supplied token that reaches the command line — must not be
+ * able to carry shell metacharacters. A valid npm spec starts alphanumeric and
+ * uses only `A-Za-z0-9._-` (e.g. `latest`, `next`, `0.0.40`, `1.2.3-beta.1`);
+ * anything else falls back to `latest`.
+ */
+function sanitizeVersion(version) {
+    return version && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version)
+        ? version
+        : "latest";
+}
 /**
  * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
  * not a real executable, so `execFile("npm", …)` (no shell) fails with
  * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
  * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
  * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ *
+ * The `.cmd` must still be launched through a shell — see `npmSpawnShell`.
  */
 function npmBinary(platform = process.platform) {
     return platform === "win32" ? "npm.cmd" : "npm";
 }
+/**
+ * Whether npm must be spawned through a shell on this platform. Since the Node
+ * fix for CVE-2024-27980 (18.20.2 / 20.12.2 / 21.7.2), spawning a `.cmd` shim
+ * like `npm.cmd` *without* a shell is rejected with `spawnSync npm.cmd EINVAL`
+ * — the very failure a Windows/PowerShell `rastack update` hits. cmd.exe knows
+ * how to run a `.cmd`, so Windows spawns through the shell; POSIX keeps the
+ * direct, shell-free spawn (npm is a real script resolved on PATH there, and no
+ * shell means no injection surface).
+ */
+function npmSpawnShell(platform = process.platform) {
+    return platform === "win32";
+}
 /** The npm package spec to install for a target version. */
 function installSpec(version) {
     return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/deploy/config.ts

@@ -471,6 +471,31 @@ export function repoVariables(cfg: DeployConfig): RepoVariable[] {
   ];
 }
 
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+export function ghVariableSetArgs(
+  cfg: DeployConfig,
+  name: string,
+  value: string,
+): string[] {
+  return [
+    "variable",
+    "set",
+    name,
+    "--repo",
+    `${cfg.github.owner}/${cfg.github.repo}`,
+    "--body",
+    value,
+  ];
+}
+
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/src/deploy/io.ts

@@ -55,7 +55,7 @@ export function gitRemoteUrl(cwd = process.cwd()): string | null {
 }
 
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-export function canPrompt(nonInteractive: boolean): boolean {
+export function canPrompt(nonInteractive = false): boolean {
   return !nonInteractive && Boolean(process.stdin.isTTY);
 }
 
@@ -144,6 +144,79 @@ export function uploadPlaceholder(
   return true;
 }
 
+// ── GitHub CLI boundary ──────────────────────────────────────────────────────
+// After the stack is up `init` wires the two repo Variables CI reads
+// (AWS_DEPLOY_ROLE_ARN / AWS_REGION) through the developer's own `gh` — already
+// authenticated to their GitHub — so the pipeline fires on the first push
+// instead of leaving the wiring as a manual Console step. Best-effort: absent or
+// unauthenticated `gh` degrades to the printed instructions.
+
+/** True when the GitHub CLI is on PATH. */
+export function ghAvailable(): boolean {
+  try {
+    execFileSync("gh", ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+export function ghAuthenticated(cwd = process.cwd()): boolean {
+  try {
+    execFileSync("gh", ["auth", "status", "--hostname", "github.com"], {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+export function ghAuthLogin(cwd = process.cwd()): boolean {
+  try {
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    execFileSync("gh", ["auth", "login", "--hostname", "github.com"], {
+      cwd,
+      stdio: "inherit",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+export function setRepoVariable(
+  args: string[],
+  cwd = process.cwd(),
+): boolean {
+  try {
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    execFileSync("gh", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/src/rastack-init.ts

@@ -6,7 +6,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
@@ -38,6 +38,7 @@ import {
   bootstrapStackName,
   deployStackArgs,
   deployStackCommand,
+  ghVariableSetArgs,
   mergeConfig,
   normalizeConfig,
   parseGitHubRemote,
@@ -50,9 +51,13 @@ import {
   awsAvailable,
   awsRun,
   canPrompt,
+  ghAuthLogin,
+  ghAuthenticated,
+  ghAvailable,
   gitRemoteUrl,
   loadConfig,
   saveConfig,
+  setRepoVariable,
   stackOutput,
   uploadPlaceholder,
   withPrompt,
@@ -64,7 +69,6 @@ interface Flags {
   noWorkflows: boolean;
   noDeploy: boolean;
   print: boolean;
-  nonInteractive: boolean;
 }
 
 function parseFlags(argv: string[]): Flags {
@@ -73,7 +77,6 @@ function parseFlags(argv: string[]): Flags {
   let noWorkflows = false;
   let noDeploy = false;
   let print = false;
-  let nonInteractive = false;
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     const next = () => argv[++i] ?? "";
@@ -112,11 +115,6 @@ function parseFlags(argv: string[]): Flags {
       case "--dry-run":
         print = true;
         break;
-      case "--yes":
-      case "-y":
-      case "--non-interactive":
-        nonInteractive = true;
-        break;
       default:
         if (a.startsWith("-")) {
           console.error(`Unknown flag: ${a}`);
@@ -124,7 +122,7 @@ function parseFlags(argv: string[]): Flags {
         }
     }
   }
-  return { patch, force, noWorkflows, noDeploy, print, nonInteractive };
+  return { patch, force, noWorkflows, noDeploy, print };
 }
 
 /** Seed a config: existing file → flags → git remote → defaults. */
@@ -236,7 +234,10 @@ function printPlan(cfg: DeployConfig): void {
  * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
  * the config. Returns the config enriched with the resolved buckets + outputs.
  */
-async function standUp(cfg: DeployConfig): Promise<DeployConfig> {
+async function standUp(
+  cfg: DeployConfig,
+  interactive: boolean,
+): Promise<DeployConfig> {
   if (!awsAvailable()) {
     console.error(
       "  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
@@ -308,9 +309,67 @@ async function standUp(cfg: DeployConfig): Promise<DeployConfig> {
   const outputs = readAppOutputs(cfg);
   cfg = mergeConfig(cfg, { outputs });
   saveConfig(cfg);
+
+  // 5. Connect the GitHub CLI and wire the repo Variables CI reads, so the FIRST
+  //    push actually ships. Without this the deploy-backend workflow's `if:
+  //    vars.AWS_DEPLOY_ROLE_ARN != ''` guard silently skips every run.
+  wireRepoVariables(cfg, interactive);
   return cfg;
 }
 
+/**
+ * Set the `AWS_DEPLOY_ROLE_ARN` / `AWS_REGION` repo Variables via `gh` so the
+ * GitHub → Lambda pipeline is live the moment `init` finishes. Connects `gh` to
+ * GitHub first — running `gh auth login` when it is installed but not yet
+ * authenticated (on a TTY) — so a fresh machine goes from nothing to a working
+ * pipeline in one command. Best-effort throughout: no `gh`, a declined login, or
+ * a value the stack Outputs did not yield falls back to the printed instructions
+ * in `printSummary`. Records the names it wired so the summary reports what is
+ * (and isn't) done.
+ */
+const wiredVariables = new Set<string>();
+function wireRepoVariables(cfg: DeployConfig, interactive: boolean): void {
+  const vars = repoVariables(cfg).filter((v) => v.value);
+  if (!vars.length) return;
+
+  if (!ghAvailable()) {
+    console.log(
+      "\n▸ GitHub CLI (`gh`) not found — skipping repo Variable wiring.\n" +
+        "  Install `gh` (https://cli.github.com) and re-run, or wire the\n" +
+        "  Variables below by hand so pushes deploy.",
+    );
+    return;
+  }
+
+  // Connect `gh` to GitHub if it isn't already, so it can set the Variables.
+  if (!ghAuthenticated()) {
+    if (interactive) {
+      console.log(
+        "\n▸ Connecting the GitHub CLI to your account (`gh auth login`)",
+      );
+      ghAuthLogin();
+    }
+    if (!ghAuthenticated()) {
+      console.log(
+        "\n▸ GitHub CLI is not connected — skipping repo Variable wiring.\n" +
+          "  Run `gh auth login`, then wire the Variables below by hand.",
+      );
+      return;
+    }
+  }
+
+  console.log("\n▸ Wiring the GitHub repo Variables CI reads (via `gh`)");
+  for (const v of vars) {
+    const ok = setRepoVariable(ghVariableSetArgs(cfg, v.name, v.value));
+    if (ok) {
+      wiredVariables.add(v.name);
+      console.log(`  ✓ set ${v.name}`);
+    } else {
+      console.log(`  • could not set ${v.name} — wire it by hand (below)`);
+    }
+  }
+}
+
 /** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
 function deployBootstrap(cfg: DeployConfig): void {
   try {
@@ -338,19 +397,28 @@ function printSummary(cfg: DeployConfig): void {
     `\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`,
   );
   if (cfg.outputs?.apiUrl) console.log(`    API:  ${cfg.outputs.apiUrl}`);
+
+  // Only the Variables `init` could NOT wire itself remain a manual step.
+  const pending = repoVariables(cfg).filter((v) => !wiredVariables.has(v.name));
+  if (pending.length) {
+    console.log(
+      "\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):",
+    );
+    console.log(
+      table(
+        pending.map((v) => ({
+          key: v.name,
+          value: v.value || `<${v.from}>`,
+        })),
+      ),
+    );
+  } else {
+    console.log(
+      "\n  ✓ wired the GitHub repo Variables CI reads (AWS_DEPLOY_ROLE_ARN, AWS_REGION).",
+    );
+  }
   console.log(
-    "\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):",
-  );
-  console.log(
-    table(
-      repoVariables(cfg).map((v) => ({
-        key: v.name,
-        value: v.value || `<${v.from}>`,
-      })),
-    ),
-  );
-  console.log(
-    `\n  Then every push to ${cfg.github.branch} ships code via \`rastack ci deploy\`` +
+    `\n  Every push to ${cfg.github.branch} now ships code via \`rastack ci deploy\`` +
       ` (also runnable locally as \`rastack deploy\`).\n`,
   );
 }
@@ -359,7 +427,7 @@ async function main(argv: string[]): Promise<void> {
   const flags = parseFlags(argv);
   let cfg = seedConfig(flags);
 
-  if (canPrompt(flags.nonInteractive)) {
+  if (canPrompt()) {
     console.log(
       "\n  rastack init — scaffold the deploy config + stand the backend up\n",
     );
@@ -368,9 +436,9 @@ async function main(argv: string[]): Promise<void> {
 
   const errors = validateConfig(cfg);
   // Any deploy needs a complete config; a still-incomplete one is fatal unless we
-  // are only scaffolding files.
+  // are only scaffolding files, and always fatal off a TTY (no prompt to fix it).
   if (errors.length) {
-    const fatal = !flags.noDeploy || flags.nonInteractive;
+    const fatal = !flags.noDeploy || !canPrompt();
     const label = fatal ? "✗" : "⚠";
     for (const e of errors) console.error(`  ${label} ${e}`);
     if (fatal) {
@@ -413,7 +481,7 @@ async function main(argv: string[]): Promise<void> {
     return;
   }
 
-  if (canPrompt(flags.nonInteractive)) {
+  if (canPrompt()) {
     const ok = await confirm(
       `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`,
     );
@@ -425,7 +493,7 @@ async function main(argv: string[]): Promise<void> {
     }
   }
 
-  cfg = await standUp(cfg);
+  cfg = await standUp(cfg, canPrompt());
   printSummary(cfg);
 }
 

package/src/rastack-update.ts

@@ -24,6 +24,7 @@ import {
   globalPrefixFromPackageDir,
   npmBinary,
   npmInstallArgs,
+  npmSpawnShell,
   parseUpdateFlags,
   updateAvailable,
 } from "./update";
@@ -31,6 +32,13 @@ import {
 /** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
 const NPM = npmBinary();
 
+/**
+ * Whether to launch npm through a shell. Required on Windows, where a bare
+ * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;
+ * false on POSIX so the direct spawn stays injection-free.
+ */
+const NPM_SHELL = npmSpawnShell();
+
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -49,6 +57,7 @@ function npmCapture(args: string[]): string | null {
   try {
     return execFileSync(NPM, args, {
       stdio: ["ignore", "pipe", "pipe"],
+      shell: NPM_SHELL,
     })
       .toString()
       .trim();
@@ -103,10 +112,12 @@ function main(argv: string[]): void {
     `\n▸ Updating rastack (${current} → ${flags.version}) in ${prefix}\n`,
   );
   try {
-    // Re-runs the developer's own npm to update this global package — no
-    // untrusted input, and execFileSync (no shell) avoids any injection.
+    // Re-runs the developer's own npm to update this global package. On Windows
+    // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
+    // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
+    // and every other arg is a fixed literal, so nothing injectable reaches it.
     // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync(NPM, args, { stdio: "inherit", env });
+    execFileSync(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,

package/src/update.ts

@@ -40,27 +40,56 @@ export function parseUpdateFlags(argv: string[]): UpdateFlags {
         break;
       case "--version":
       case "--to":
-        version = argv[++i] ?? "latest";
+        version = sanitizeVersion(argv[++i]);
         break;
       default:
         // A bare, non-flag token is taken as the target version.
-        if (!a.startsWith("-")) version = a;
+        if (!a.startsWith("-")) version = sanitizeVersion(a);
     }
   }
   return { version, check, dryRun };
 }
 
+/**
+ * Constrain the update target to a safe npm version or dist-tag. The Windows
+ * update path runs npm through a shell (see `npmSpawnShell`), so the target —
+ * the one caller-supplied token that reaches the command line — must not be
+ * able to carry shell metacharacters. A valid npm spec starts alphanumeric and
+ * uses only `A-Za-z0-9._-` (e.g. `latest`, `next`, `0.0.40`, `1.2.3-beta.1`);
+ * anything else falls back to `latest`.
+ */
+export function sanitizeVersion(version: string | undefined): string {
+  return version && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version)
+    ? version
+    : "latest";
+}
+
 /**
  * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
  * not a real executable, so `execFile("npm", …)` (no shell) fails with
  * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
  * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
  * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ *
+ * The `.cmd` must still be launched through a shell — see `npmSpawnShell`.
  */
 export function npmBinary(platform: string = process.platform): string {
   return platform === "win32" ? "npm.cmd" : "npm";
 }
 
+/**
+ * Whether npm must be spawned through a shell on this platform. Since the Node
+ * fix for CVE-2024-27980 (18.20.2 / 20.12.2 / 21.7.2), spawning a `.cmd` shim
+ * like `npm.cmd` *without* a shell is rejected with `spawnSync npm.cmd EINVAL`
+ * — the very failure a Windows/PowerShell `rastack update` hits. cmd.exe knows
+ * how to run a `.cmd`, so Windows spawns through the shell; POSIX keeps the
+ * direct, shell-free spawn (npm is a real script resolved on PATH there, and no
+ * shell means no injection surface).
+ */
+export function npmSpawnShell(platform: string = process.platform): boolean {
+  return platform === "win32";
+}
+
 /** The npm package spec to install for a target version. */
 export function installSpec(version: string): string {
   return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/test/deploy.spec.ts

@@ -13,6 +13,7 @@ import {
   bootstrapStackParameters,
   cognitoAdvancedSecuritySupported,
   APP_STACK_OUTPUTS,
+  ghVariableSetArgs,
   lambdaEnv,
   mergeConfig,
   normalizeConfig,
@@ -345,6 +346,32 @@ describe("repo variables + lambda env", () => {
     expect(vars.find((v) => v.name === "AWS_REGION")!.value).toBe("af-south-1");
   });
 
+  it("builds the `gh variable set` argv init wires the pipeline with", () => {
+    const cfg = base({ outputs: { deployRoleArn: "arn:aws:iam::1:role/x" } });
+    const roleVar = repoVariables(cfg).find(
+      (v) => v.name === "AWS_DEPLOY_ROLE_ARN",
+    )!;
+    expect(ghVariableSetArgs(cfg, roleVar.name, roleVar.value)).toEqual([
+      "variable",
+      "set",
+      "AWS_DEPLOY_ROLE_ARN",
+      "--repo",
+      "theserverkid/reactapistack-demo",
+      "--body",
+      "arn:aws:iam::1:role/x",
+    ]);
+    // Region variable targets the same repo with the region value.
+    expect(ghVariableSetArgs(cfg, "AWS_REGION", cfg.region)).toEqual([
+      "variable",
+      "set",
+      "AWS_REGION",
+      "--repo",
+      "theserverkid/reactapistack-demo",
+      "--body",
+      "af-south-1",
+    ]);
+  });
+
   it("fills the RASTACK_* env, using outputs where available", () => {
     const cfg = base({
       outputs: {

package/test/update.spec.ts

@@ -4,7 +4,9 @@ import {
   installSpec,
   npmBinary,
   npmInstallArgs,
+  npmSpawnShell,
   parseUpdateFlags,
+  sanitizeVersion,
   updateAvailable,
 } from "../src/update";
 
@@ -56,6 +58,39 @@ describe("update — npm spec + args", () => {
     expect(npmBinary("linux")).toBe("npm");
     expect(npmBinary("darwin")).toBe("npm");
   });
+
+  it("runs npm through a shell only on Windows", () => {
+    // A `.cmd` shim can't be spawned directly since the Node CVE-2024-27980 fix
+    // (spawnSync npm.cmd EINVAL) — it must go through cmd.exe. POSIX spawns npm
+    // directly so there is no shell and no injection surface.
+    expect(npmSpawnShell("win32")).toBe(true);
+    expect(npmSpawnShell("linux")).toBe(false);
+    expect(npmSpawnShell("darwin")).toBe(false);
+  });
+});
+
+describe("update — version sanitization", () => {
+  it("keeps valid semver, dist-tags, and pinned versions", () => {
+    expect(sanitizeVersion("latest")).toBe("latest");
+    expect(sanitizeVersion("next")).toBe("next");
+    expect(sanitizeVersion("0.0.40")).toBe("0.0.40");
+    expect(sanitizeVersion("1.2.3-beta.1")).toBe("1.2.3-beta.1");
+  });
+
+  it("falls back to latest for empty or shell-unsafe input", () => {
+    expect(sanitizeVersion(undefined)).toBe("latest");
+    expect(sanitizeVersion("")).toBe("latest");
+    // Shell metacharacters must never reach the Windows shell-spawned npm.
+    expect(sanitizeVersion("0.0.40; rm -rf /")).toBe("latest");
+    expect(sanitizeVersion("$(whoami)")).toBe("latest");
+    expect(sanitizeVersion("a b")).toBe("latest");
+  });
+
+  it("is applied when parsing the bare positional and --version", () => {
+    expect(parseUpdateFlags(["0.0.40; evil"]).version).toBe("latest");
+    expect(parseUpdateFlags(["--version", "&& evil"]).version).toBe("latest");
+    expect(parseUpdateFlags(["0.0.40"]).version).toBe("0.0.40");
+  });
 });
 
 describe("update — global prefix derivation", () => {