start-command 0.24.5 → 0.24.6

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # start-command
 
+## 0.24.6
+
+### Patch Changes
+
+- cfc5731: fix: pass `bash -c "..."` style commands directly to Docker without double-wrapping (issue #91)
+
+  When a command like `bash -i -c "nvm --version"` was passed to Docker isolation,
+  it was incorrectly wrapped in an outer shell: `bash -i -c "bash -i -c nvm --version"`.
+  This caused two bugs: (1) the quoted argument `"nvm --version"` was split by the outer
+  shell, so `--version` became `$0` instead of part of the script; (2) the sudo advisory
+  message printed twice due to two nested bash invocations.
+
+  The fix adds `isShellInvocationWithArgs()` to detect commands that start with a shell
+  binary and include `-c`, and `buildShellWithArgsCmdArgs()` to reconstruct the correct
+  argv array. Such commands are now passed directly to Docker's exec, just like bare shell
+  invocations (issue #84), without any additional wrapping.
+
 ## 0.24.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "start-command",
-  "version": "0.24.5",
+  "version": "0.24.6",
   "description": "Gamification of coding, execute any command with ability to auto-report issues on GitHub",
   "main": "src/bin/cli.js",
   "exports": {

package/src/lib/isolation.js

@@ -106,10 +106,7 @@ function isCommandAvailable(command) {
   }
 }
 
-/**
- * Get the shell to use for command execution
- * @returns {{shell: string, shellArgs: string[]}} Shell path and args
- */
+/** Get the shell to use for command execution. */
 function getShell() {
   const isWindows = process.platform === 'win32';
   const shell = isWindows ? 'cmd.exe' : process.env.SHELL || '/bin/sh';
@@ -217,11 +214,28 @@ function getShellInteractiveFlag(shellPath) {
   const shellName = shellPath.split('/').pop();
   return shellName === 'bash' || shellName === 'zsh' ? '-i' : null;
 }
+const SHELL_NAMES = ['bash', 'zsh', 'sh', 'fish', 'ksh', 'csh', 'tcsh', 'dash'];
 /** True if command is a bare shell invocation (no -c); avoids bash-inside-bash (issue #84). */
 function isInteractiveShellCommand(command) {
   const parts = command.trim().split(/\s+/);
-  const shells = ['bash', 'zsh', 'sh', 'fish', 'ksh', 'csh', 'tcsh', 'dash'];
-  return shells.includes(path.basename(parts[0])) && !parts.includes('-c');
+  return SHELL_NAMES.includes(path.basename(parts[0])) && !parts.includes('-c');
+}
+/** True if command is a shell invocation with -c (e.g. `bash -i -c "cmd"`); avoids double-wrapping (issue #91). */
+function isShellInvocationWithArgs(command) {
+  const parts = command.trim().split(/\s+/);
+  return SHELL_NAMES.includes(path.basename(parts[0])) && parts.includes('-c');
+}
+/** Build argv for shell-with-c command; everything after -c is one argument (reverses commandArgs.join(' ')). */
+function buildShellWithArgsCmdArgs(command) {
+  const parts = command.trim().split(/\s+/);
+  const cIdx = parts.indexOf('-c');
+  if (cIdx === -1) {
+    return parts;
+  }
+  const scriptArg = parts.slice(cIdx + 1).join(' ');
+  return scriptArg.length > 0
+    ? [...parts.slice(0, cIdx + 1), scriptArg]
+    : parts.slice(0, cIdx + 1);
 }
 
 /** Returns true if the current process has a TTY attached. */
@@ -428,9 +442,7 @@ function runInScreen(command, options = {}) {
     let effectiveCommand = wrapCommandWithUser(command, options.user);
 
     if (options.detached) {
-      // Detached mode: screen -dmS <session> <shell> -c '<command>'
       if (options.keepAlive) {
-        // With keep-alive: run command, then keep shell open
         effectiveCommand = `${effectiveCommand}; exec ${shell}`;
       }
 
@@ -466,14 +478,6 @@ function runInScreen(command, options = {}) {
         message,
       });
     } else {
-      // Attached mode: use detached mode with log capture for reliable output
-      // (direct attached screen loses output for quick commands; see issue #25)
-      if (DEBUG) {
-        console.log(
-          `[DEBUG] Using detached mode with log capture for reliable output`
-        );
-      }
-
       return runScreenWithLogCapture(
         command,
         sessionName,
@@ -515,9 +519,7 @@ function runInTmux(command, options = {}) {
 
   try {
     if (options.detached) {
-      // Detached mode: tmux new-session -d -s <session> '<command>'
       if (options.keepAlive) {
-        // With keep-alive: run command, then keep shell open
         effectiveCommand = `${effectiveCommand}; exec ${shell}`;
       }
 
@@ -549,7 +551,6 @@ function runInTmux(command, options = {}) {
         message,
       });
     } else {
-      // Attached mode: tmux new-session -s <session> '<command>'
       if (DEBUG) {
         console.log(
           `[DEBUG] Running: tmux new-session -s "${sessionName}" "${effectiveCommand}"`
@@ -631,7 +632,6 @@ function runInSsh(command, options = {}) {
 
   try {
     if (options.detached) {
-      // Detached mode: Run command in background via nohup; continues after SSH closes
       const remoteShell = useExplicitShell || shellToUse;
       const shellInvocation = shellInteractiveFlag
         ? `${remoteShell} ${shellInteractiveFlag}`
@@ -658,7 +658,6 @@ function runInSsh(command, options = {}) {
         message: `Command started in detached SSH session on ${sshTarget}\nSession: ${sessionName}\nView logs: ssh ${sshTarget} "tail -f /tmp/${sessionName}.log"`,
       });
     } else {
-      // Attached mode: pass command directly (auto) or wrap with explicit shell + -i flag (bash/zsh).
       const extraFlags = shellInteractiveFlag ? [shellInteractiveFlag] : [];
       const sshArgs = isInteractiveShellCommand(command)
         ? [sshTarget, ...command.trim().split(/\s+/)]
@@ -747,8 +746,6 @@ function runInDocker(command, options = {}) {
   }
 
   const containerName = options.session || generateSessionName('docker');
-
-  // Check if image exists locally; if not, pull it as a virtual command
   if (!dockerImageExists(options.image)) {
     const pullResult = dockerPullImage(options.image);
     if (!pullResult.success) {
@@ -772,9 +769,7 @@ function runInDocker(command, options = {}) {
 
   try {
     if (options.detached) {
-      // Detached mode: docker run -d --name <name> [--user <user>] <image> <shell> -c '<command>'
       const dockerArgs = ['run', '-d', '--name', containerName];
-      // --rm must come before the image name in args
       if (options.autoRemoveDockerContainer) {
         dockerArgs.splice(2, 0, '--rm');
       }
@@ -791,7 +786,9 @@ function runInDocker(command, options = {}) {
         : [shellToUse];
       const cmdArgs = isBareShell
         ? command.trim().split(/\s+/)
-        : [...shellArgs, '-c', effectiveCommand];
+        : isShellInvocationWithArgs(command)
+          ? buildShellWithArgsCmdArgs(effectiveCommand)
+          : [...shellArgs, '-c', effectiveCommand];
       dockerArgs.push(options.image, ...cmdArgs);
 
       if (DEBUG) {
@@ -829,7 +826,6 @@ function runInDocker(command, options = {}) {
         message,
       });
     } else {
-      // Attached mode: docker run -it --rm --name <name> [--user <user>] <image> <shell> -c '<cmd>'
       const dockerArgs = ['run', '-it', '--rm', '--name', containerName];
       if (options.user) {
         dockerArgs.push('--user', options.user);
@@ -841,6 +837,7 @@ function runInDocker(command, options = {}) {
         ? [shellToUse, shellInteractiveFlag]
         : [shellToUse];
       // Bare shell: pass directly with -i (avoids bash-inside-bash, issue #84; -i ensures interactive).
+      // Shell with -c: pass directly as argv (avoids double-wrapping and quote-stripping, issue #91).
       let attachedCmdArgs;
       if (isBareShell) {
         const parts = command.trim().split(/\s+/);
@@ -849,6 +846,8 @@ function runInDocker(command, options = {}) {
           bareFlag && !parts.includes(bareFlag)
             ? [parts[0], bareFlag, ...parts.slice(1)]
             : parts;
+      } else if (isShellInvocationWithArgs(command)) {
+        attachedCmdArgs = buildShellWithArgsCmdArgs(command);
       } else {
         attachedCmdArgs = [...shellCmdArgs, '-c', command];
       }
@@ -973,6 +972,8 @@ module.exports = {
   isCommandAvailable,
   hasTTY,
   isInteractiveShellCommand,
+  isShellInvocationWithArgs,
+  buildShellWithArgsCmdArgs,
   detectShellInEnvironment,
   runInScreen,
   runInTmux,

package/test/regression-91.test.js

@@ -0,0 +1,260 @@
+#!/usr/bin/env bun
+/**
+ * Regression tests for issue #91:
+ * "`bash -i -c "nvm --version"` was interpreted as `bash -i -c nvm --version`,
+ *  and executed inside bash, instead of directly"
+ *
+ * Two bugs were reported:
+ *
+ * Bug 1 — Quote stripping / wrong interpretation:
+ *   `bash -i -c "nvm --version"` was treated as `bash -i -c nvm` with `--version`
+ *   as $0. Caused by join(' ') collapsing the quoted argument, then the command
+ *   being re-wrapped in an outer shell: `bash -i -c "bash -i -c nvm --version"`.
+ *   The outer bash then parsed `nvm --version` as two separate words.
+ *
+ * Bug 2 — Executed inside bash (double-wrapping):
+ *   Because isInteractiveShellCommand() returns false for any command with -c,
+ *   the code wrapped `bash -i -c "nvm --version"` inside another `bash -i -c "..."`.
+ *   This caused the sudo advisory message to print twice (one per bash invocation).
+ *
+ * Root cause:
+ *   isInteractiveShellCommand() only returns true for bare shell invocations
+ *   (no -c flag). Commands that ARE a shell invocation but include -c fell into the
+ *   else-branch: `[shellToUse, shellInteractiveFlag, '-c', command]`, creating a
+ *   shell-inside-shell. The fix adds isShellInvocationWithArgs() + buildShellWithArgsCmdArgs()
+ *   to detect and pass such commands directly to Docker without additional wrapping.
+ *
+ * Reference: https://github.com/link-foundation/start/issues/91
+ * Fixed in: PR #92
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('assert');
+const {
+  isInteractiveShellCommand,
+  isShellInvocationWithArgs,
+  buildShellWithArgsCmdArgs,
+} = require('../src/lib/isolation');
+
+// Helper: mirrors the attached-mode command-args construction logic in runInDocker.
+// Returns the argv array that would be passed to `docker run ... image <argv>`.
+function buildAttachedCmdArgs(command, shellToUse = '/bin/bash') {
+  const path = require('path');
+  const shellName = shellToUse.split('/').pop();
+  const shellInteractiveFlag =
+    shellName === 'bash' || shellName === 'zsh' ? '-i' : null;
+  const shellCmdArgs = shellInteractiveFlag
+    ? [shellToUse, shellInteractiveFlag]
+    : [shellToUse];
+
+  if (isInteractiveShellCommand(command)) {
+    // Bare shell: pass directly with explicit -i (issue #84 fix)
+    const parts = command.trim().split(/\s+/);
+    const bareFlag =
+      path.basename(parts[0]) === 'bash' || path.basename(parts[0]) === 'zsh'
+        ? '-i'
+        : null;
+    if (bareFlag && !parts.includes(bareFlag)) {
+      return [parts[0], bareFlag, ...parts.slice(1)];
+    }
+    return parts;
+  } else if (isShellInvocationWithArgs(command)) {
+    // Shell with -c: pass directly as argv (issue #91 fix)
+    return buildShellWithArgsCmdArgs(command);
+  }
+  return [...shellCmdArgs, '-c', command];
+}
+
+describe('isShellInvocationWithArgs (issue #91)', () => {
+  it('should return true for "bash -i -c nvm --version"', () => {
+    assert.strictEqual(
+      isShellInvocationWithArgs('bash -i -c nvm --version'),
+      true
+    );
+  });
+
+  it('should return true for \'bash -c "echo hello"\'', () => {
+    assert.strictEqual(isShellInvocationWithArgs('bash -c "echo hello"'), true);
+  });
+
+  it('should return true for "bash -c echo hello"', () => {
+    assert.strictEqual(isShellInvocationWithArgs('bash -c echo hello'), true);
+  });
+
+  it('should return true for "zsh -c nvm --version"', () => {
+    assert.strictEqual(isShellInvocationWithArgs('zsh -c nvm --version'), true);
+  });
+
+  it('should return true for "sh -c ls"', () => {
+    assert.strictEqual(isShellInvocationWithArgs('sh -c ls'), true);
+  });
+
+  it('should return true for "/bin/bash -c echo hi"', () => {
+    assert.strictEqual(isShellInvocationWithArgs('/bin/bash -c echo hi'), true);
+  });
+
+  it('should return false for bare "bash" (no -c)', () => {
+    assert.strictEqual(isShellInvocationWithArgs('bash'), false);
+  });
+
+  it('should return false for "bash -i" (no -c)', () => {
+    assert.strictEqual(isShellInvocationWithArgs('bash -i'), false);
+  });
+
+  it('should return false for "bash --norc" (no -c)', () => {
+    assert.strictEqual(isShellInvocationWithArgs('bash --norc'), false);
+  });
+
+  it('should return false for non-shell commands', () => {
+    assert.strictEqual(isShellInvocationWithArgs('nvm --version'), false);
+    assert.strictEqual(isShellInvocationWithArgs('echo hello'), false);
+    assert.strictEqual(isShellInvocationWithArgs('npm test'), false);
+  });
+});
+
+describe('buildShellWithArgsCmdArgs (issue #91)', () => {
+  it('should reconstruct "bash -i -c nvm --version" correctly', () => {
+    const result = buildShellWithArgsCmdArgs('bash -i -c nvm --version');
+    assert.deepStrictEqual(result, ['bash', '-i', '-c', 'nvm --version']);
+  });
+
+  it('should reconstruct "bash -c echo hello" correctly', () => {
+    const result = buildShellWithArgsCmdArgs('bash -c echo hello');
+    assert.deepStrictEqual(result, ['bash', '-c', 'echo hello']);
+  });
+
+  it('should handle single-word script "bash -c ls"', () => {
+    const result = buildShellWithArgsCmdArgs('bash -c ls');
+    assert.deepStrictEqual(result, ['bash', '-c', 'ls']);
+  });
+
+  it('should handle zsh with -c', () => {
+    const result = buildShellWithArgsCmdArgs('zsh -c nvm --version');
+    assert.deepStrictEqual(result, ['zsh', '-c', 'nvm --version']);
+  });
+
+  it('should handle /bin/bash -i -c with multi-word script', () => {
+    const result = buildShellWithArgsCmdArgs(
+      '/bin/bash -i -c node -e process.version'
+    );
+    assert.deepStrictEqual(result, [
+      '/bin/bash',
+      '-i',
+      '-c',
+      'node -e process.version',
+    ]);
+  });
+
+  it('should not include -c argument inside script argument (no double -c)', () => {
+    const result = buildShellWithArgsCmdArgs('bash -i -c nvm --version');
+    // The script arg must be 'nvm --version', not '-c nvm --version'
+    assert.strictEqual(result[result.length - 1], 'nvm --version');
+    assert.strictEqual(result.indexOf('-c'), 2);
+    assert.strictEqual(result.length, 4);
+  });
+});
+
+describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
+  // Each test verifies that `bash -i -c "cmd"` style commands are NOT re-wrapped
+  // in another outer shell -c invocation.
+  //
+  // Before fix: buildAttachedCmdArgs('bash -i -c nvm --version')
+  //   → ['/bin/bash', '-i', '-c', 'bash -i -c nvm --version']   (WRONG: double-wrap)
+  // After fix:  buildAttachedCmdArgs('bash -i -c nvm --version')
+  //   → ['bash', '-i', '-c', 'nvm --version']                   (CORRECT: direct pass)
+
+  it('should pass "bash -i -c nvm --version" directly without outer shell wrapper', () => {
+    const args = buildAttachedCmdArgs('bash -i -c nvm --version');
+    // Must start with 'bash', not with '/bin/bash' (the outer shellToUse)
+    assert.strictEqual(args[0], 'bash');
+    // Must not wrap in outer bash -i -c
+    assert.ok(
+      args.filter((a) => a === '-c').length === 1,
+      `Must have exactly one -c flag, got: ${JSON.stringify(args)}`
+    );
+    // The script argument must be 'nvm --version' as one element
+    assert.deepStrictEqual(
+      args,
+      ['bash', '-i', '-c', 'nvm --version'],
+      `Expected ['bash', '-i', '-c', 'nvm --version'], got: ${JSON.stringify(args)}`
+    );
+  });
+
+  it('should pass "zsh -c nvm --version" directly without outer shell wrapper', () => {
+    const args = buildAttachedCmdArgs('zsh -c nvm --version', '/bin/zsh');
+    assert.deepStrictEqual(args, ['zsh', '-c', 'nvm --version']);
+    assert.ok(
+      args.filter((a) => a === '-c').length === 1,
+      'Must have exactly one -c flag'
+    );
+  });
+
+  it('should pass "bash -c echo hello" directly', () => {
+    const args = buildAttachedCmdArgs('bash -c echo hello');
+    assert.deepStrictEqual(args, ['bash', '-c', 'echo hello']);
+  });
+
+  it('should not introduce a second bash layer (no shell-inside-shell)', () => {
+    const args = buildAttachedCmdArgs('bash -i -c nvm --version');
+    // The first element of the docker image command args must NOT be the outer shell
+    // i.e., must not be ['/bin/bash', '-i', '-c', 'bash ...']
+    assert.notStrictEqual(
+      args[0],
+      '/bin/bash',
+      'Must not wrap in outer /bin/bash (shell-inside-shell)'
+    );
+    // Must not contain the original full command string as an argument
+    assert.ok(
+      !args.includes('bash -i -c nvm --version'),
+      'Must not contain the full command string as a single argument (double-wrap)'
+    );
+  });
+
+  it('should still handle bare "bash" with -i (regression guard for issue #84)', () => {
+    const args = buildAttachedCmdArgs('bash');
+    assert.deepStrictEqual(args, ['bash', '-i']);
+    assert.ok(
+      !args.includes('-c'),
+      'Bare shell must not use -c (issue #84 guard)'
+    );
+  });
+
+  it('should still wrap non-shell commands in outer shell -c (guard against over-broad fix)', () => {
+    const args = buildAttachedCmdArgs('nvm --version', '/bin/bash');
+    assert.deepStrictEqual(args, ['/bin/bash', '-i', '-c', 'nvm --version']);
+    assert.ok(
+      args.includes('-c'),
+      'Non-shell commands must still use -c wrapper'
+    );
+  });
+
+  it('should still wrap "npm test" in outer shell -c', () => {
+    const args = buildAttachedCmdArgs('npm test', '/bin/bash');
+    assert.deepStrictEqual(args, ['/bin/bash', '-i', '-c', 'npm test']);
+  });
+});
+
+describe('isShellInvocationWithArgs is mutually exclusive with isInteractiveShellCommand', () => {
+  // A command cannot be both a bare shell AND a shell-with-args; they are disjoint.
+  const testCases = [
+    'bash',
+    'bash -i',
+    'bash --norc',
+    'bash -i -c nvm --version',
+    'bash -c echo hi',
+    'zsh -c ls',
+    'nvm --version',
+    'echo hello',
+  ];
+
+  for (const cmd of testCases) {
+    it(`"${cmd}" is not both bare-shell and shell-with-args`, () => {
+      const bare = isInteractiveShellCommand(cmd);
+      const withArgs = isShellInvocationWithArgs(cmd);
+      assert.ok(
+        !(bare && withArgs),
+        `"${cmd}" must not return true from both helpers simultaneously`
+      );
+    });
+  }
+});