watchmen-cli 1.7.0 → 1.7.1

package/bin/wm-install-shim.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+"use strict";
+
+// W-WIN-CMD-CRLF-1 mitigation — install a direct wm.exe alongside the
+// npm-generated wm.cmd shim. cmd.exe's command-line parser splits on
+// `\n` BEFORE wm.cmd's `%*` expansion runs, which silently truncates
+// CR/LF-bearing args (the W-WIN-IP-CRLF-1 attack vector class) before
+// they reach wm.exe. The v1.7.0 GetCommandLineW check inside wm.exe
+// can only fire when args arrive intact — invoking wm.exe directly is
+// the only way to guarantee that on Windows.
+//
+// Strategy: copy wm.exe to the npm bin prefix (where wm.cmd lives).
+// Windows' default PATHEXT search order is `.EXE` before `.CMD`, so
+// `wm <args>` from any shell resolves to wm.exe first. The auto-
+// generated wm.cmd remains in place for backwards compatibility with
+// explicit `.cmd` invocations.
+//
+// Failures here MUST NOT break the install — we exit 0 with a warning
+// so npm doesn't roll back the package. The cmd shim still works for
+// non-sensitive operations.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+function main() {
+  // Only act on Windows; mac + linux have no cmd-shim CR/LF problem.
+  if (process.platform !== "win32") {
+    return 0;
+  }
+  // Only run on global installs — local node_modules/.bin/ has different
+  // semantics and a copy there would be unexpected.
+  if (process.env.npm_config_global !== "true") {
+    return 0;
+  }
+  const prefix = process.env.npm_config_prefix;
+  if (!prefix) {
+    console.warn("note: wm-install-shim: npm_config_prefix unset; skipping");
+    return 0;
+  }
+
+  let resolveBinary;
+  try {
+    ({ resolveBinary } = require(".."));
+  } catch (err) {
+    console.warn(`note: wm-install-shim: could not load shim resolver: ${err.message}`);
+    return 0;
+  }
+
+  let src;
+  try {
+    src = resolveBinary();
+  } catch (err) {
+    console.warn(`note: wm-install-shim: could not resolve platform binary: ${err.message}`);
+    return 0;
+  }
+
+  if (!fs.existsSync(src)) {
+    console.warn(`note: wm-install-shim: source binary missing at ${src}`);
+    return 0;
+  }
+
+  const dst = path.join(prefix, "wm.exe");
+  try {
+    fs.copyFileSync(src, dst);
+    console.log(
+      `wm-install-shim: copied wm.exe to ${dst}\n` +
+      `  Windows PATH will resolve 'wm' to this .exe (PATHEXT default puts .EXE\n` +
+      `  before .CMD), bypassing the cmd.exe %* CR/LF-truncation hazard.`
+    );
+  } catch (err) {
+    console.warn(
+      `note: wm-install-shim: could not write ${dst}: ${err.message}\n` +
+      `  The npm-generated wm.cmd shim will still work for non-sensitive\n` +
+      `  invocations. For CR/LF-safe IP input use \`wm watchdog firewall add\n` +
+      `  --ip-file <path>\` or invoke ${src} directly.`
+    );
+  }
+  return 0;
+}
+
+process.exit(main());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmen-cli",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Capture, compare, and transfer your complete development environment",
   "main": "shim.js",
   "keywords": [
@@ -25,17 +25,21 @@
   "bin": {
     "wm": "bin/wm.js"
   },
+  "scripts": {
+    "postinstall": "node bin/wm-install-shim.js"
+  },
   "engines": {
     "node": ">=18"
   },
   "optionalDependencies": {
-    "watchmen-cli-darwin-arm64": "1.7.0",
-    "watchmen-cli-linux-x64": "1.7.0",
-    "watchmen-cli-win32-x64": "1.7.0"
+    "watchmen-cli-darwin-arm64": "1.7.1",
+    "watchmen-cli-linux-x64": "1.7.1",
+    "watchmen-cli-win32-x64": "1.7.1"
   },
   "files": [
     "shim.js",
     "bin/wm.js",
+    "bin/wm-install-shim.js",
     "README.md"
   ]
 }