wp-advads 1.0.36 → 1.0.38

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "wp-advads",
-  "version": "1.0.36",
+  "version": "1.0.38",
   "description": "Create an Advanced Ads WordPress plugin ecosystem.",
   "author": {
     "name": "Shakeeb Ahmed",

package/src/commands/build.js

@@ -64,17 +64,33 @@ function run( commitMessages ) {
 		}
 
 		process.stdout.write('Building plugin resources...')
-		let buildScript
+		let pkg
 		try {
-			buildScript = JSON.parse( fs.readFileSync( 'package.json', 'utf8' ) ).scripts?.build
+			pkg = JSON.parse( fs.readFileSync( 'package.json', 'utf8' ) )
 		} catch {
-			buildScript = null
+			pkg = {}
 		}
+		const buildScript = pkg.scripts?.build
+		const usesWpScripts = Object.values( pkg.scripts || {} ).some( ( script ) => /\bwp-scripts\b/.test( script ) )
 
 		if ( ! buildScript ) {
 			onSameLine(`${logSymbols.warning} No package.json build script, skipping`)
+		} else if ( /\bwp-advads\b/.test( buildScript ) || process.env.WP_ADVADS_BUILDING ) {
+			if ( usesWpScripts ) {
+				await runExec( 'npx wp-scripts build', {
+					env: { ...process.env, WP_ADVADS_BUILDING: '1' },
+				} )
+				onSameLine(`${logSymbols.success} Built plugin resources`);
+				if ( Array.isArray( commitMessages ) ) {
+					commitMessages.push( 'Build plugin resources' )
+				}
+			} else {
+				onSameLine(`${logSymbols.warning} Skipping recursive npm run build`)
+			}
 		} else {
-			await runExec( 'npm run build' )
+			await runExec( 'npm run build', {
+				env: { ...process.env, WP_ADVADS_BUILDING: '1' },
+			} )
 			onSameLine(`${logSymbols.success} Built plugin resources`);
 			if ( Array.isArray( commitMessages ) ) {
 				commitMessages.push( 'Build plugin resources' )

package/src/utilities/shell.js

@@ -3,6 +3,48 @@
  */
 import { spawn } from 'node:child_process'
 
+// cmd.exe metacharacters. See https://github.com/moxystudio/node-cross-spawn/blob/v7.0.6/lib/util/escape.js
+const WIN_META = /([()\][%!^"`<>&|;, *?])/g
+
+function escapeWinCommand( arg ) {
+	return String( arg ).replace( WIN_META, '^$1' )
+}
+
+function escapeWinArgument( arg ) {
+	let value = String( arg )
+	value = value.replace( /(?=(\\+?)?)\1"/g, '$1$1\\"' )
+	value = value.replace( /(?=(\\+?)?)\1$/, '$1$1' )
+	value = `"${value}"`
+	return value.replace( WIN_META, '^$1' )
+}
+
+/**
+ * Windows argv spawn must go through cmd.exe so PATHEXT (.cmd/.bat) resolves.
+ * Direct spawn('wp') looks for wp.exe only and throws ENOENT.
+ *
+ * @param {string} file Command name
+ * @param {string[]} args Arguments
+ * @param {string} [comspec] cmd.exe path
+ * @returns {{ file: string, args: string[], options: Object }}
+ */
+export function winArgvSpawnSpec( file, args, comspec = process.env.ComSpec || process.env.comspec || 'cmd.exe' ) {
+	const shellCommand = [ escapeWinCommand( file ), ...args.map( escapeWinArgument ) ].join( ' ' )
+	return {
+		file: comspec,
+		args: [ '/d', '/s', '/c', `"${shellCommand}"` ],
+		options: { shell: false, windowsVerbatimArguments: true },
+	}
+}
+
+function spawnArgv( file, args, spawnOpts ) {
+	if ( process.platform !== 'win32' ) {
+		return spawn( file, args, { ...spawnOpts, shell: false } )
+	}
+
+	const spec = winArgvSpawnSpec( file, args )
+	return spawn( spec.file, spec.args, { ...spawnOpts, ...spec.options } )
+}
+
 /**
  * Run a command in the terminal.
  *
@@ -38,7 +80,7 @@ export function execCommand( command, callback, options = {} ) {
 	}
 
 	const child = Array.isArray( command )
-		? spawn( command[0], command.slice( 1 ), { ...spawnOpts, shell: false } )
+		? spawnArgv( command[0], command.slice( 1 ), spawnOpts )
 		: spawn( command, { ...spawnOpts, shell: true } )
 
 	let stdout = ''

package/test/build.test.js

@@ -136,6 +136,39 @@ test( 'resource build is skipped when package.json has no build script', async (
 	} )
 } )
 
+test( 'resource build is skipped when scripts.build invokes wp-advads', async () => {
+	await withPackage( { scripts: { build: 'rm -rf assets/dist && npx wp-advads build' } }, async () => {
+		await runBuild()
+
+		assert.equal(
+			execCalls.some( ( call ) => call.cmd === 'npm run build' ),
+			false
+		)
+		assert.equal( potCalled, true )
+	} )
+} )
+
+test( 'resource build runs wp-scripts when scripts.build invokes wp-advads', async () => {
+	await withPackage( {
+		scripts: {
+			build: 'rm -rf assets/dist && npx wp-advads build',
+			start: 'wp-scripts start',
+		},
+	}, async () => {
+		await runBuild()
+
+		assert.equal(
+			execCalls.some( ( call ) => call.cmd === 'npm run build' ),
+			false
+		)
+		assert.equal(
+			execCalls.some( ( call ) => call.cmd === 'npx wp-scripts build' ),
+			true
+		)
+		assert.equal( potCalled, true )
+	} )
+} )
+
 test( 'composer dump receives COMPOSER_VENDOR_DIR packages', async () => {
 	await runBuild()
 

package/test/shell.test.js

@@ -7,7 +7,7 @@ import { existsSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { test } from 'node:test'
-import { execCommand, runCommand } from '../src/utilities/shell.js'
+import { execCommand, runCommand, winArgvSpawnSpec } from '../src/utilities/shell.js'
 
 function execOnce( command ) {
 	return new Promise( ( resolve ) => {
@@ -130,3 +130,24 @@ test( 'execCommand does not ENOBUFS on stdout larger than 1MB', async () => {
 		console.log = originalLog
 	}
 } )
+
+test( 'Windows argv spawn uses cmd.exe so PATHEXT commands like wp.cmd resolve', () => {
+	const spec = winArgvSpawnSpec( 'wp', [ 'i18n', 'make-pot' ], 'C:\\Windows\\system32\\cmd.exe' )
+	assert.equal( spec.file, 'C:\\Windows\\system32\\cmd.exe' )
+	assert.deepEqual( spec.args.slice( 0, 3 ), [ '/d', '/s', '/c' ] )
+	assert.match( spec.args[3], /wp/ )
+	assert.equal( spec.options.windowsVerbatimArguments, true )
+	assert.equal( spec.options.shell, false )
+} )
+
+test( 'Windows argv spawn escapes cmd metacharacters so headers and injection stay literal', () => {
+	const spec = winArgvSpawnSpec(
+		'wp',
+		[ '--headers={"Last-Translator":"A <b@c.com>"}', '& echo pwned' ],
+		'cmd.exe'
+	)
+	const line = spec.args[3]
+	assert.match( line, /\^</ )
+	assert.match( line, /\^>/ )
+	assert.match( line, /\^&/ )
+} )