getsuperpower - npm Package Compare versions

Comparing version 0.3.5 to 0.3.6

src/process.ts

+import { spawn } from "node:child_process";
+
+export interface SubprocessCommand {
+  executable: string;
+  args: string[];
+  cwd: string;
+  env?: Record<string, string | undefined>;
+}
+
+export interface SubprocessResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+}
+
+export async function runSubprocess(command: SubprocessCommand): Promise<SubprocessResult> {
+  const subprocess = spawn(command.executable, command.args, {
+    cwd: command.cwd,
+    env: command.env,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  let spawnErrorMessage = "";
+
+  const stdout = readStream(subprocess.stdout);
+  const stderr = readStream(subprocess.stderr);
+  const exitCode = new Promise<number>((resolve) => {
+    subprocess.once("error", (error) => {
+      spawnErrorMessage = error.message;
+      resolve(127);
+    });
+    subprocess.once("close", (code) => resolve(code ?? 1));
+  });
+
+  const [stdoutText, stderrText, code] = await Promise.all([stdout, stderr, exitCode]);
+
+  return {
+    stdout: stdoutText,
+    stderr: [stderrText, spawnErrorMessage].filter(Boolean).join("\n"),
+    exitCode: code,
+  };
+}
+
+function readStream(stream: NodeJS.ReadableStream | null): Promise<string> {
+  if (!stream) {
+    return Promise.resolve("");
+  }
+
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    stream.on("data", (chunk: Buffer | string) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    });
+    stream.on("error", reject);
+    stream.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+  });
+}

package.json

 {
   "name": "getsuperpower",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "type": "module",
@@ -20,3 +20,3 @@ "repository": {
     "dev": "bun src/cli.ts",
-    "build": "bun build --target=bun --outfile=dist/cli.js src/cli.ts",
+    "build": "bun build --target=node --outfile=dist/cli.js src/cli.ts",
     "test": "bun test tests",
@@ -23,0 +23,0 @@ "ci:test": "find tests -maxdepth 1 -name '*.test.ts' ! -name '*.e2e.test.ts' -print0 | xargs -0 bun test",

src/cli.ts

@@ -1,2 +0,2 @@
-#!/usr/bin/env bun
+#!/usr/bin/env node
 
@@ -24,3 +24,3 @@ import { homedir } from "node:os";
 
-const CLI_VERSION = "0.3.5";
+const CLI_VERSION = "0.3.6";
 
@@ -27,0 +27,0 @@ interface CommanderVersionInternals {

src/getsuperpower.ts

@@ -21,2 +21,3 @@ import { existsSync } from "node:fs";
 } from "./plugins";
+import { runSubprocess } from "./process";
 import {
@@ -568,15 +569,3 @@ createWorkflowBundleScaffold,
 ): Promise<GetSuperpowerExternalSkillCommandResult> {
-  const subprocess = Bun.spawn([command.executable, ...command.args], {
-    cwd: command.cwd,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: command.env,
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(subprocess.stdout).text(),
-    new Response(subprocess.stderr).text(),
-    subprocess.exited,
-  ]);
-
-  return { stdout, stderr, exitCode };
+  return runSubprocess(command);
 }
@@ -583,0 +572,0 @@

src/runtimes/ponytrail/workflow-bundles.ts

@@ -6,2 +6,3 @@ import { existsSync } from "node:fs";
 import { z } from "zod";
+import { runSubprocess } from "../../process";
 
@@ -543,15 +544,3 @@ const workflowFileName = "workflow.json";
 
-  const subprocess = Bun.spawn([command.executable, ...command.args], {
-    cwd: command.cwd,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: command.env,
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(subprocess.stdout).text(),
-    new Response(subprocess.stderr).text(),
-    subprocess.exited,
-  ]);
-
-  return { stdout, stderr, exitCode };
+  return runSubprocess(command);
 }
@@ -558,0 +547,0 @@

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Number of package files

43

2.38%

Worsened metrics

Total package byte prevSize

866493

-5.35%

Lines of code

23073

-0.05%

Number of low supply chain risk alerts

35

2.94%

Number of medium supply chain risk alerts

3

200%

No dependency changes