create-adsk - npm Package Compare versions

Comparing version 0.3.1 to 0.3.2

dist/skills.d.ts

@@ -9,7 +9,13 @@ import type { Scope } from "./types.js";
 }>;
+export type SpawnSpec = {
+    command: string;
+    shell: boolean;
+};
 /**
- * Resolve npm/npx for `spawn(..., { shell: false })`.
- * On Windows, Node cannot find bare `npx`/`npm` (they are `.cmd` shims) → ENOENT.
+ * Windows spawn rules for npm/npx:
+ * - Bare `npx` with `shell: false` → ENOENT (shim is `npx.cmd`)
+ * - `npx.cmd` with `shell: false` → EINVAL (CVE-2024-27980 blocks .cmd/.bat)
+ * So win32 must use the `.cmd` name **and** `shell: true`.
  */
-export declare function resolveSpawnCommand(cmd: string, platform?: NodeJS.Platform): string;
+export declare function resolveSpawnSpec(cmd: string, platform?: NodeJS.Platform): SpawnSpec;
 export declare function buildSkillsAddArgv(opts: {
@@ -16,0 +22,0 @@ kitSource: string;

dist/skills.js

 import { spawn } from "node:child_process";
 /**
- * Resolve npm/npx for `spawn(..., { shell: false })`.
- * On Windows, Node cannot find bare `npx`/`npm` (they are `.cmd` shims) → ENOENT.
+ * Windows spawn rules for npm/npx:
+ * - Bare `npx` with `shell: false` → ENOENT (shim is `npx.cmd`)
+ * - `npx.cmd` with `shell: false` → EINVAL (CVE-2024-27980 blocks .cmd/.bat)
+ * So win32 must use the `.cmd` name **and** `shell: true`.
  */
-export function resolveSpawnCommand(cmd, platform = process.platform) {
-    if (platform !== "win32")
-        return cmd;
-    if (cmd === "npx" || cmd === "npm")
-        return `${cmd}.cmd`;
-    return cmd;
+export function resolveSpawnSpec(cmd, platform = process.platform) {
+    if (platform !== "win32") {
+        return { command: cmd, shell: false };
+    }
+    const command = cmd === "npx" || cmd === "npm" ? `${cmd}.cmd` : cmd;
+    return { command, shell: true };
 }
@@ -54,14 +56,14 @@ export function buildSkillsAddArgv(opts) {
     const [cmd, ...args] = argv;
-    const resolved = resolveSpawnCommand(cmd);
+    const { command, shell } = resolveSpawnSpec(cmd);
     const code = await new Promise((resolve, reject) => {
-        const child = spawn(resolved, args, {
+        const child = spawn(command, args, {
             cwd: opts.cwd,
             stdio: "inherit",
-            shell: false,
+            shell,
         });
         child.on("error", (err) => {
-            if (err.code === "ENOENT") {
-                reject(new Error(`Failed to spawn '${resolved}' (ENOENT). Ensure Node.js is installed and on PATH` +
+            if (err.code === "ENOENT" || err.code === "EINVAL") {
+                reject(new Error(`Failed to spawn '${command}' (${err.code}). Ensure Node.js/npm are installed and on PATH` +
                     (process.platform === "win32"
-                        ? " (Windows: create-adsk runs npx.cmd without a shell)."
+                        ? " (Windows: create-adsk spawns npx.cmd with shell:true)."
                         : ".") +
@@ -68,0 +70,0 @@ ` Command was: ${argv.join(" ")}`));

dist/skills.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAQ3C;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,GAAG,GAAG,MAAM,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAGrC;IACC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,KAAY,EACZ,GAAY;IAEZ,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAe,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAChE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CACJ,IAAI,KAAK,CACP,oBAAoB,QAAQ,qDAAqD;oBAC/E,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAC3B,CAAC,CAAC,uDAAuD;wBACzD,CAAC,CAAC,GAAG,CAAC;oBACR,iBAAiB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpC,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAc,EACd,IAAwD;IAExD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC;IAC1C,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAU3C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAGrC;IACC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,KAAY,EACZ,GAAY;IAEZ,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAe,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAChE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,SAAS;YAChB,KAAK;SACN,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnD,MAAM,CACJ,IAAI,KAAK,CACP,oBAAoB,OAAO,MAAM,GAAG,CAAC,IAAI,iDAAiD;oBACxF,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAC3B,CAAC,CAAC,yDAAyD;wBAC3D,CAAC,CAAC,GAAG,CAAC;oBACR,iBAAiB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpC,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAc,EACd,IAAwD;IAExD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC;IAC1C,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package.json

 {
   "name": "create-adsk",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Adopt the Agentic Development Starter Kit as a versioned profile (skills + Cursor wiring).",
@@ -5,0 +5,0 @@ "type": "module",

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

111070

0.5%

Lines of code

1398

0.58%

No dependency changes