zen-gitsync 2.13.23 → 2.13.25

package/src/utils/index.js

@@ -32,7 +32,7 @@ import stringWidth from 'string-width';
 import Table from 'cli-table3';
 import chalk from 'chalk';
 import boxen from "boxen";
-import {exec, execSync} from 'child_process'
+import {execFile, execSync} from 'child_process'
 import os from 'os'
 import ora from "ora";
 import readline from 'readline'
@@ -266,14 +266,18 @@ function clearCommandHistory() {
 
 function execGitCommand(command, options = {}) {
   return new Promise((resolve, reject) => {
-    let {encoding = 'utf-8', maxBuffer = 30 * 1024 * 1024, head = command, log = true} = options
+    let {encoding = 'utf-8', maxBuffer = 30 * 1024 * 1024, head = Array.isArray(command) ? command.join(' ') : command, log = true} = options
     let cwd = getCwd()
-    
+
     // Record start time for command execution
     const startTime = Date.now();
 
     // setTimeout(() => {
-    exec(command, {
+    // 用 execFile('git', argv) 跨平台执行:
+    // - 不走 shell,Windows cmd.exe / POSIX sh 都一致
+    // - argv 数组天然免疫 shell 注入,文件名/参数无需 shellQuote
+    // - 所有调用点约定只跑 git 子命令,见 src/utils/index.js 内的 execGitCommand 调用清单
+    execFile('git', command, {
       env: {
         ...process.env,
         // LANG: 'en_US.UTF-8',    // Linux/macOS
@@ -282,7 +286,10 @@ function execGitCommand(command, options = {}) {
       },
       encoding,
       maxBuffer,
-      cwd
+      cwd,
+      // Windows 下 git 是 .exe;POSIX 下直接 PATH 找。
+      // 不传 shell,杜绝 cmd.exe 单/双引号兼容问题与注入风险。
+      windowsHide: true
     }, (error, stdout, stderr) => {
       if (options.spinner) {
         options.spinner.stop();
@@ -590,7 +597,7 @@ async function printGitLog() {
     n = parseInt(logArg.split('=')[1], 10);
   }
   // 使用 ASCII 记录分隔符 %x1E 作为字段分隔符
-  const logCommand = `git log -n ${n} --pretty=format:"%C(green)%h%C(reset) %x1E %C(cyan)%an%C(reset) %x1E %C(yellow)%ad%C(reset) %x1E %C(blue)%D%C(reset) %x1E %C(magenta)%s%C(reset)" --date=format:"%Y-%m-%d %H:%M" --graph --decorate --color`
+  const logCommand = ['log', '-n', n, '--pretty=format:%C(green)%h%C(reset) %x1E %C(cyan)%an%C(reset) %x1E %C(yellow)%ad%C(reset) %x1E %C(blue)%D%C(reset) %x1E %C(magenta)%s%C(reset)', '--date=format:%Y-%m-%d %H:%M', '--graph', '--decorate', '--color']
   try {
     const logOutput = await execGitCommand(logCommand, {
       head: `git log`
@@ -620,7 +627,7 @@ async function exec_push({exit, commitMessage}) {
   // 执行 git push
   const spinner = ora('正在推送代码...').start();
   try {
-    const {stdout, stderr} = await execGitCommand('git push', {
+    const {stdout, stderr} = await execGitCommand(['push'], {
       spinner
     });
     await printCommitLog({commitMessage});
@@ -633,15 +640,15 @@ async function exec_push({exit, commitMessage}) {
 async function printCommitLog({commitMessage}) {
   try {
     // 获取项目名称（取git仓库根目录名）
-    const projectRootResult = await execGitCommand('git rev-parse --show-toplevel', {log: false});
+    const projectRootResult = await execGitCommand(['rev-parse', '--show-toplevel'], {log: false});
     const projectName = chalk.blueBright(path.basename(projectRootResult.stdout.trim()));
 
     // 获取当前提交hash（取前7位）
-    const commitHashResult = await execGitCommand('git rev-parse --short HEAD', {log: false});
+    const commitHashResult = await execGitCommand(['rev-parse', '--short', 'HEAD'], {log: false});
     const hashDisplay = chalk.yellow(commitHashResult.stdout.trim());
 
     // 获取分支信息
-    const branchResult = await execGitCommand('git branch --show-current', {log: false});
+    const branchResult = await execGitCommand(['branch', '--show-current'], {log: false});
     const branchDisplay = chalk.magenta(branchResult.stdout.trim());
 
     // 构建信息内容
@@ -679,7 +686,7 @@ async function execPull() {
   try {
     // 检查是否需要拉取更新
     const spinner = ora('正在拉取代码...').start();
-    await execGitCommand('git pull', {
+    await execGitCommand(['pull'], {
       spinner
     })
   } catch (e) {
@@ -697,12 +704,12 @@ async function judgeRemote() {
   try {
     // 检查是否有远程更新
     // 先获取远程最新状态
-    await execGitCommand('git remote update', {
+    await execGitCommand(['remote', 'update'], {
       head: 'Fetching remote updates',
       log: false
     });
     // 检查是否需要 pull
-    const res = await execGitCommand('git rev-list HEAD..@{u} --count', {
+    const res = await execGitCommand(['rev-list', 'HEAD..@{u}', '--count'], {
       head: 'Checking if behind remote',
       log: false
     });
@@ -754,7 +761,7 @@ async function judgeRemote() {
 async function execDiff() {
   const no_diff = process.argv.find(arg => arg.startsWith('--no-diff'))
   if (!no_diff) {
-    await execGitCommand('git diff --color=always', {
+    await execGitCommand(['diff', '--color=always'], {
       head: `git diff`
     })
   }
@@ -768,14 +775,14 @@ async function execGitAddWithLockFilter() {
 
     if (lockedFiles.length === 0) {
       // 如果没有锁定文件，直接执行 git add .
-      await execGitCommand('git add .');
+      await execGitCommand(['add', '.']);
       return;
     }
 
     // 获取Git工作目录根路径，确保路径匹配的准确性
     let gitRoot;
     try {
-      const gitRootResult = await execGitCommand('git rev-parse --show-toplevel', {log: false});
+      const gitRootResult = await execGitCommand(['rev-parse', '--show-toplevel'], {log: false});
       gitRoot = path.normalize(gitRootResult.stdout.trim());
     } catch (error) {
       console.warn(chalk.yellow('⚠️ 无法获取Git根目录，使用当前工作目录'));
@@ -783,7 +790,7 @@ async function execGitAddWithLockFilter() {
     }
 
     // 获取所有修改的文件（包括未跟踪文件）
-    const statusResult = await execGitCommand('git status --porcelain --untracked-files=all', {log: false});
+    const statusResult = await execGitCommand(['status', '--porcelain', '--untracked-files=all'], {log: false});
     const modifiedFiles = statusResult.stdout
       .split('\n')
       .filter(line => line.trim())
@@ -896,19 +903,15 @@ async function execGitAddWithLockFilter() {
     }
 
     // 逐个添加未锁定的文件
-    // 注意：用单引号包文件名,单引号内不解释 $ ` " \ 等元字符,
-    // 只需把单引号自身转义为 '\''
-    // 避免文件名含特殊字符(如 " $ ` ;) 导致 shell 注入或命令错乱
-    // null/undefined 显式返回 '' 而非 'null'/'undefined' (与 src/ui/server/utils/shellQuote.js shQuote 契约一致)
-    const shellQuote = (s) => {
-      if (s === null || s === undefined) return "''"
-      return `'${String(s).replace(/'/g, `'\\''`)}'`
-    }
+    // 用 execFile('git', argv) 直接传 argv 数组,不经过 shell,
+    // 文件名含空格/特殊字符时不需要 shellQuote;同时跨 Windows cmd.exe /
+    // POSIX sh 都一致(此前单引号写法在 Windows cmd.exe 不被识别,导致
+    // "pathspec '...did not match any files" 报错,见 da01bcb 回归)。
     let successCount = 0
     let failedFiles = []
     for (const file of filesToAdd) {
       try {
-        await execGitCommand(`git add -- ${shellQuote(file)}`, {
+        await execGitCommand(['add', '--', file], {
           head: `git add ${file}`,
           log: false
         })
@@ -979,7 +982,7 @@ async function execAddAndCommit({statusOutput, commitMessage, exit}) {
   }
 
   // 提交前二次校验（包括未跟踪文件）
-  const checkStatus = await execGitCommand('git status --porcelain --untracked-files=all', {log: false});
+  const checkStatus = await execGitCommand(['status', '--porcelain', '--untracked-files=all'], {log: false});
   if (!checkStatus.stdout.trim()) {
     console.log(chalk.yellow('⚠️ 没有检测到可提交的变更'));
     // exec_exit(exit)
@@ -988,7 +991,7 @@ async function execAddAndCommit({statusOutput, commitMessage, exit}) {
 
   // 执行 git commit
   if (statusOutput.includes('Untracked files:') || statusOutput.includes('Changes not staged for commit') || statusOutput.includes('Changes to be committed')) {
-    await execGitCommand(`git commit -m "${commitMessage}"`)
+    await execGitCommand(['commit', '-m', commitMessage])
   }
   
   // 返回实际使用的提交信息
@@ -1053,7 +1056,7 @@ async function addResetScriptToPackageJson() {
     }
 
     // 获取当前分支名
-    const branchResult = await execGitCommand('git branch --show-current', {log: false});
+    const branchResult = await execGitCommand(['branch', '--show-current'], {log: false});
     const branch = branchResult.stdout.trim();
 
     // 添加 g:reset 命令

package/src/ui/public/assets/AppVersionBadge-BUS8w2f8.js

@@ -1,2 +0,0 @@
-import"./rolldown-runtime-CMxvf4Kt.js";import{B as e,Cn as t,D as n,En as r,Et as i,Fn as a,G as o,In as s,Nn as c,Y as l,Yn as u,Zn as d,_n as f,a as p,cr as m,gn as h,hn as g,hr as _,i as v,mr as y,nt as b,rt as x,vn as S,vr as C,wn as w,yn as T,zn as E}from"./element-plus-CJjFCgLP.js";import{n as D,t as O}from"./_plugin-vue_export-helper-BfbhkIv4.js";async function k(){let e=await fetch(`/api/app-version`);return e.ok?e.json():{success:!1,current:``,latest:null,hasUpdate:!1,error:`HTTP ${e.status}`}}async function A(e){let t=await fetch(`/api/app-upgrade`,{method:`POST`});if(!t.ok){let n=`HTTP ${t.status}`;try{let e=await t.json();e?.error&&(n=e.error)}catch{}e({type:`error`,message:n}),e({type:`done`,code:t.status});return}if(!t.body){e({type:`error`,message:`响应无 body`}),e({type:`done`,code:-1});return}let n=t.body.getReader(),r=new TextDecoder(`utf-8`),i=``;for(;;){let{done:t,value:a}=await n.read();if(t)break;i+=r.decode(a,{stream:!0});let o=i.split(`
-`);i=o.pop()??``;for(let t of o)if(t.trim())try{e(JSON.parse(t))}catch{}}if(i.trim())try{e(JSON.parse(i))}catch{}}async function j(){let e=await fetch(`/api/app-restart`,{method:`POST`});if(!e.ok){let t=`HTTP ${e.status}`;try{let n=await e.json();n?.error&&(t=n.error)}catch{}throw Error(t)}}var M={key:3},N={key:4},P={key:5},F={key:0,class:`upgrade-hint`},I={key:0,class:`upgrade-countdown`},L=O(r({__name:`UpgradeDialog`,props:{modelValue:{type:Boolean},logs:{},status:{},countdown:{default:0}},emits:[`update:modelValue`,`retry`,`restart`,`cancel`],setup(r,{emit:a}){let o=r,s=a,p=m(null);u(()=>o.logs,async()=>{await c(),p.value&&(p.value.scrollTop=p.value.scrollHeight)});function g(){o.status!==`running`&&(o.status===`success`&&o.countdown>0&&s(`cancel`),s(`update:modelValue`,!1))}function v(){s(`retry`)}function O(){s(`restart`)}function k(){s(`cancel`),s(`update:modelValue`,!1)}return(a,o)=>{let c=l,u=e,m=n;return E(),f(m,{"model-value":r.modelValue,"onUpdate:modelValue":o[0]||=e=>s(`update:modelValue`,e),title:y(D)(`@F13B4:升级`),width:`680px`,"close-on-click-modal":!1,"close-on-press-escape":!1,"show-close":r.status!==`running`,onClose:g},{footer:d(()=>[r.status===`failed`?(E(),f(u,{key:0,type:`primary`,onClick:v},{default:d(()=>[t(C(y(D)(`@F13B4:重试`)),1)]),_:1})):S(``,!0),r.status===`success`?(E(),f(u,{key:1,type:`primary`,onClick:O},{default:d(()=>[t(C(y(D)(`@F13B4:立即重启并刷新`)),1)]),_:1})):S(``,!0),r.status===`success`?(E(),f(u,{key:2,onClick:k},{default:d(()=>[t(C(y(D)(`@F13B4:稍后手动重启`)),1)]),_:1})):S(``,!0),r.status===`running`?(E(),f(u,{key:3,disabled:``},{default:d(()=>[t(C(y(D)(`@F13B4:升级中`))+`... `,1)]),_:1})):S(``,!0)]),default:d(()=>[h(`div`,{class:_([`upgrade-status`,`is-${r.status}`])},[r.status===`running`?(E(),f(c,{key:0,class:`is-loading`},{default:d(()=>[w(y(i))]),_:1})):r.status===`success`?(E(),f(c,{key:1,color:`#67c23a`},{default:d(()=>[w(y(b))]),_:1})):(E(),f(c,{key:2,color:`#f56c6c`},{default:d(()=>[w(y(x))]),_:1})),r.status===`running`?(E(),T(`span`,M,C(y(D)(`@F13B4:升级中`)),1)):r.status===`success`?(E(),T(`span`,N,C(y(D)(`@F13B4:升级完成`)),1)):(E(),T(`span`,P,C(y(D)(`@F13B4:升级失败`)),1))],2),r.status===`success`?(E(),T(`p`,F,[t(C(y(D)(`@F13B4:新版本已全局安装，需要重启服务才能生效`))+` `,1),r.countdown>0?(E(),T(`span`,I,C(y(D)(`@F13B4:{seconds} 秒后自动刷新`,{seconds:r.countdown})),1)):S(``,!0)])):S(``,!0),h(`pre`,{ref_key:`logEl`,ref:p,class:`upgrade-log`},C(r.logs||y(D)(`@F13B4:等待日志输出`)),513)]),_:1},8,[`model-value`,`title`,`show-close`])}}}),[[`__scopeId`,`data-v-b2f9992a`]]),R={class:`app-version-badge`},z=[`aria-label`],B=[`aria-label`],V=`https://github.com/xz333221/zen-gitsync/releases`,H=5,U=`app-version-check`,W=3600*1e3,G=O(r({__name:`AppVersionBadge`,setup(n){let r=`2.13.23`,i=m(r),c=g(()=>i.value||r),l=m(null),u=m(!1),_=m(``),b=m(`running`),x=m(0),O=null;function M(){try{let e=sessionStorage.getItem(U);if(!e)return null;let{at:t,data:n}=JSON.parse(e);return Date.now()-t>W?null:n}catch{return null}}function N(e){try{sessionStorage.setItem(U,JSON.stringify({at:Date.now(),data:e}))}catch{}}async function P(e=!1){let t=M();t&&(l.value=t);try{let t=await k();l.value=t,N(t),t.current&&(i.value=t.current),!e&&t.success&&t.hasUpdate&&p({type:`success`,message:D(`@F13B4:发现新版本 {version}`,{version:t.latest??``}),duration:4e3})}catch(t){e||p({type:`warning`,message:D(`@F13B4:检查更新失败 {error}`,{error:t?.message||``})})}}async function F(){if(l.value?.hasUpdate){try{await v.confirm(D(`@F13B4:确定要从 {current} 升级到 {latest} 吗？`,{current:l.value.current,latest:l.value.latest}),D(`@F13B4:升级`),{confirmButtonText:D(`@F13B4:确定升级`),cancelButtonText:D(`@F13B4:取消`),type:`info`})}catch{return}_.value=``,b.value=`running`,u.value=!0,await A(e=>{if(e.type===`done`){if(b.value=e.code===0?`success`:`failed`,e.code===0){try{sessionStorage.removeItem(U)}catch{}l.value?.latest&&(i.value=l.value.latest),I()}}else e.message&&(_.value+=e.message)})}}function I(){G(),x.value=H,O=setInterval(()=>{--x.value,x.value<=0&&(O&&=(clearInterval(O),null),q())},1e3)}function G(){O&&=(clearInterval(O),null),x.value=0}function K(){G()}async function q(){G();try{await j(),setTimeout(()=>{window.location.reload()},600)}catch(e){p({type:`warning`,message:D(`@F13B4:重启失败 {error}`,{error:e?.message||``})})}}return a(()=>{G()}),s(()=>{P(!0)}),(n,r)=>{let i=o,a=e;return E(),T(`div`,R,[w(i,{content:y(D)(`@F13B4:在 GitHub 上查看源码`),placement:`top`,effect:`dark`,"show-after":300},{default:d(()=>[h(`a`,{href:`https://github.com/xz333221/zen-gitsync`,target:`_blank`,rel:`noopener noreferrer`,class:`badge-icon-link`,"aria-label":y(D)(`@F13B4:在 GitHub 上查看源码`)},[...r[1]||=[h(`svg`,{viewBox:`0 0 24 24`,width:`15`,height:`15`,"aria-hidden":`true`,fill:`currentColor`,xmlns:`http://www.w3.org/2000/svg`},[h(`path`,{d:`M12 2C6.477 2 2 6.484 2 12.017c0 4.425 2.865 8.18 6.839 9.504.5.092.682-.217.682-.483 0-.237-.008-.868-.013-1.703-2.782.605-3.369-1.343-3.369-1.343-.454-1.158-1.11-1.466-1.11-1.466-.908-.62.069-.608.069-.608 1.003.07 1.531 1.032 1.531 1.032.892 1.53 2.341 1.088 2.91.832.092-.647.35-1.088.636-1.338-2.22-.253-4.555-1.113-4.555-4.951 0-1.093.39-1.988 1.029-2.688-.103-.253-.446-1.272.098-2.65 0 0 .84-.27 2.75 1.026A9.564 9.564 0 0 1 12 6.844a9.59 9.59 0 0 1 2.504.337c1.909-1.296 2.747-1.027 2.747-1.027.546 1.379.202 2.398.1 2.651.64.7 1.028 1.595 1.028 2.688 0 3.848-2.339 4.695-4.566 4.943.359.309.678.92.678 1.855 0 1.338-.012 2.419-.012 2.747 0 .268.18.58.688.482A10.02 10.02 0 0 0 22 12.017C22 6.484 17.522 2 12 2z`})],-1)]],8,z)]),_:1},8,[`content`]),w(i,{content:y(D)(`@F13B4:在 npm 上查看包`),placement:`top`,effect:`dark`,"show-after":300},{default:d(()=>[h(`a`,{href:`https://www.npmjs.com/package/zen-gitsync`,target:`_blank`,rel:`noopener noreferrer`,class:`badge-icon-link badge-icon-link--npm`,"aria-label":y(D)(`@F13B4:在 npm 上查看包`)},[...r[2]||=[h(`svg`,{viewBox:`0 0 24 24`,width:`15`,height:`15`,"aria-hidden":`true`,fill:`currentColor`,xmlns:`http://www.w3.org/2000/svg`},[h(`path`,{d:`M2 2v20h20V2H2zm17.167 17.167H12.5v-10h-3.333v10H4.833V4.833h14.334v14.334z`})],-1)]],8,B)]),_:1},8,[`content`]),w(i,{content:y(D)(`@F13B4:查看更新`),placement:`top`,effect:`dark`,"show-after":300},{default:d(()=>[h(`a`,{href:V,target:`_blank`,rel:`noopener noreferrer`,class:`version-link`},`v`+C(c.value),1)]),_:1},8,[`content`]),l.value?.hasUpdate?(E(),f(i,{key:0,content:y(D)(`@F13B4:发现新版本 {version}`,{version:l.value.latest??``}),placement:`top`,effect:`dark`,"show-after":300},{default:d(()=>[w(a,{class:`upgrade-btn`,size:`small`,type:`primary`,onClick:F},{default:d(()=>[t(C(y(D)(`@F13B4:升级`)),1)]),_:1})]),_:1},8,[`content`])):S(``,!0),w(L,{modelValue:u.value,"onUpdate:modelValue":r[0]||=e=>u.value=e,logs:_.value,status:b.value,countdown:x.value,onRetry:F,onRestart:q,onCancel:K},null,8,[`modelValue`,`logs`,`status`,`countdown`])])}}}),[[`__scopeId`,`data-v-f1bc3386`]]);export{G as default};

package/src/ui/public/assets/AppVersionBadge-DVn027LE.css

@@ -1 +0,0 @@
-.upgrade-status[data-v-b2f9992a]{align-items:center;gap:var(--spacing-base);margin-bottom:var(--spacing-md);font-size:14px;font-weight:500;display:flex}.upgrade-status.is-running[data-v-b2f9992a]{color:var(--el-color-primary)}.upgrade-status.is-success[data-v-b2f9992a]{color:var(--el-color-success)}.upgrade-status.is-failed[data-v-b2f9992a]{color:var(--el-color-danger)}.upgrade-status .is-loading[data-v-b2f9992a]{animation:2s linear infinite rotating-b2f9992a}.upgrade-log[data-v-b2f9992a]{color:#d4d4d4;white-space:pre-wrap;word-break:break-all;background:#1e1e1e;border-radius:4px;height:320px;margin:0;padding:12px;font-family:JetBrains Mono,Cascadia Code,Consolas,monospace;font-size:12px;line-height:1.6;overflow:auto}.upgrade-hint[data-v-b2f9992a]{margin:0 0 var(--spacing-md) 0;border-left:3px solid var(--el-color-success);color:var(--el-color-success);background:#67c23a14;border-radius:4px;padding:8px 12px;font-size:13px}.upgrade-countdown[data-v-b2f9992a]{background:var(--el-color-success);color:#fff;border-radius:10px;margin-left:8px;padding:1px 8px;font-size:12px;font-weight:600;animation:1s ease-in-out infinite pulse-b2f9992a;display:inline-block}@keyframes pulse-b2f9992a{0%,to{opacity:1}50%{opacity:.55}}@keyframes rotating-b2f9992a{0%{transform:rotate(0)}to{transform:rotate(360deg)}}.app-version-badge[data-v-f1bc3386]{align-items:center;gap:var(--spacing-base);margin-left:auto;display:inline-flex}.badge-icon-link[data-v-f1bc3386]{width:22px;height:22px;color:var(--text-tertiary);opacity:.7;border-radius:4px;justify-content:center;align-items:center;text-decoration:none;transition:color .18s,opacity .18s,background .18s;display:inline-flex}.badge-icon-link[data-v-f1bc3386]:hover{opacity:1;color:var(--text-secondary);background:var(--bg-hover,#0000000f)}.badge-icon-link--npm[data-v-f1bc3386]:hover{color:#cb3837}.badge-icon-link[data-v-f1bc3386]:first-child:hover{color:var(--text-primary)}.version-link[data-v-f1bc3386]{color:#6c757d;border-radius:3px;padding:2px 6px;font-family:monospace;font-size:11px;text-decoration:none;transition:color .2s,background-color .2s}.version-link[data-v-f1bc3386]:hover{color:var(--el-color-primary);background-color:#0000000a}.upgrade-btn[data-v-f1bc3386]{border-radius:3px!important;height:20px!important;padding:0 8px!important;font-size:11px!important}