b399bc64e1
Copilot review round 2 (suppressed comments), all three real:
- `require.resolve("<pkg>/package.json")` is governed by the package's
`exports`, and Node keeps no special case for `./package.json` — so a
package declaring an `exports` map without it threw
ERR_PACKAGE_PATH_NOT_EXPORTED even though its bin was installed and
spawnable, a false "not installed" pointing at `npm install` for a
package already on disk. Walk `resolve.paths()` instead, which never
consults `exports`. The docblock claiming the opposite is corrected.
- `shell: true` (needed at all on Windows to start the `.cmd` shims) makes
Node hand `cmd.exe` one space-joined string, so an argument holding a
path with a space splits in two. Every generated path in
pack-and-verify lives under `tmpdir()`, which sits beneath the user
profile. Quote them via `shellArgs()` at all four spawn sites, the
command path included — the hazard predates this PR, so fix the class.
- Document the new module: `scripts/lib/resolve-node-bin.mjs` in AGENTS.md's
scripts/ tree, its tests in the README's `test:scripts` row.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01387r3MotGk52hrkfjzHFsN
Signed-off-by: cliffhall <cliff@futurescale.com>
86 lines
4.3 KiB
JavaScript
86 lines
4.3 KiB
JavaScript
// Shared resolver for spawning a package's CLI cross-platform (#1939).
|
|
//
|
|
// On Windows, `npx`/`npm` are `.cmd` shims, not executables — a shell-free
|
|
// `execFileSync`/`spawnSync` cannot start one (Node refuses `.cmd`/`.bat`
|
|
// spawns without `shell: true` since the CVE-2024-27980 hardening) and throws
|
|
// `ENOENT`. GitHub CI runs Linux, so the gate stayed green there while being
|
|
// unrunnable for any Windows contributor. Instead of shelling through `npx`,
|
|
// resolve the JS entry behind the package's bin and run it with
|
|
// `process.execPath`: cross-platform, shell-free (no quoting hazards), faster
|
|
// (no npx resolution), and pinned to the locally installed package exactly as
|
|
// `npx --no-install` was.
|
|
|
|
import { existsSync, readFileSync } from "node:fs";
|
|
import { createRequire } from "node:module";
|
|
import path from "node:path";
|
|
|
|
/**
|
|
* Absolute path of the JS entry behind a package's bin (e.g. typescript's
|
|
* `tsc`, vite's `vite`), resolved from `fromDir` up the node_modules tree —
|
|
* the same walk `npx --no-install` does, minus the `.cmd` shim a shell-free
|
|
* spawn can't start on Windows. Reads the package's manifest and takes the
|
|
* path out of its `bin` field (what npx itself does) rather than resolving the
|
|
* bin path directly, because an `exports` map blocks deep resolution — Vite 8
|
|
* doesn't export `./bin/vite.js`, so `require.resolve("vite/bin/vite.js")`
|
|
* throws `ERR_PACKAGE_PATH_NOT_EXPORTED`.
|
|
*
|
|
* Throws if the package isn't installed from `fromDir`, declares no such bin,
|
|
* or declares one whose file is missing — the caller decides whether that's a
|
|
* hard "cannot measure" error or a fallback.
|
|
*/
|
|
export function resolveNodeBin(pkg, binName, fromDir) {
|
|
const pkgPath = resolveManifest(pkg, fromDir);
|
|
const manifest = JSON.parse(readFileSync(pkgPath, "utf8"));
|
|
const { bin } = manifest;
|
|
// A string-form `bin` is npm's shorthand for ONE command, named after the
|
|
// package (unscoped). It does not make every requested `binName` valid, so
|
|
// match it rather than accepting whatever was asked for — otherwise a typo
|
|
// silently resolves the package's only executable instead of failing.
|
|
const rel =
|
|
typeof bin === "string"
|
|
? unscopedName(manifest.name ?? pkg) === binName
|
|
? bin
|
|
: undefined
|
|
: bin?.[binName];
|
|
if (typeof rel !== "string")
|
|
throw new Error(`${pkg} declares no "${binName}" bin in its package.json`);
|
|
const entry = path.join(path.dirname(pkgPath), rel);
|
|
// A declared bin whose file is absent is a partial install, and it fails
|
|
// *silently* downstream: `process.execPath <missing>` still spawns fine and
|
|
// exits 1 with nothing on stdout, which `rawProjectListing` records as "no
|
|
// diagnostic captured" and turns into the bogus every-file-uncovered report
|
|
// this helper exists to eliminate. Fail here, where the remedy is actionable.
|
|
if (!existsSync(entry))
|
|
throw new Error(
|
|
`${pkg}'s "${binName}" bin points at a missing file: ${entry}`,
|
|
);
|
|
return entry;
|
|
}
|
|
|
|
/**
|
|
* The package's own `package.json`, found by walking the same `node_modules`
|
|
* chain Node's resolver would from `fromDir` — deliberately NOT via
|
|
* `require.resolve("<pkg>/package.json")`.
|
|
*
|
|
* That shortcut reads as safe and isn't: subpath resolution is governed by the
|
|
* package's `exports`, and a package may declare one that omits `./package.json`
|
|
* (Node dropped its special case for it, so there is no guaranteed export). Such
|
|
* a package throws `ERR_PACKAGE_PATH_NOT_EXPORTED` here even though its bin is
|
|
* installed and perfectly spawnable — a false "not installed" that would send
|
|
* someone to `npm install` for a package already on disk. `resolve.paths()`
|
|
* gives the search dirs without consulting `exports` at all.
|
|
*/
|
|
function resolveManifest(pkg, fromDir) {
|
|
const require = createRequire(path.join(fromDir, "package.json"));
|
|
// `resolve.paths` returns null only for builtins, which have no bin to find.
|
|
for (const dir of require.resolve.paths(pkg) ?? []) {
|
|
const candidate = path.join(dir, ...pkg.split("/"), "package.json");
|
|
if (existsSync(candidate)) return candidate;
|
|
}
|
|
throw new Error(`cannot find ${pkg} from ${fromDir}`);
|
|
}
|
|
|
|
/** `@scope/name` → `name`; an unscoped name is returned unchanged. */
|
|
function unscopedName(name) {
|
|
return name.startsWith("@") ? name.slice(name.indexOf("/") + 1) : name;
|
|
}
|