fix: resolve node bins via package.json instead of spawning npx .cmd shims so verify/smoke scripts run on Windows - #1997
Draft
olaservo wants to merge 1 commit into
Draft
Conversation
…shims so the verify/smoke scripts run on Windows On Windows npx/npm are .cmd shims a shell-free execFileSync/spawnSync cannot start (ENOENT since the CVE-2024-27980 hardening), so verify:typecheck-coverage died at validate's second step — doubly silently, echoing "(no diagnostic captured)" per project and then reporting all 918 tracked files as getting no tsc pass — and verify:build-gate, the smoke test-server bootstraps, and pack:verify's npm pack failed the same way. Add scripts/lib/resolve-node-bin.mjs: resolves the JS entry behind a package's bin from <pkg>/package.json (deep resolution is blocked by Vite 8's exports map) and spawns it via process.execPath — the same walk npx --no-install did, cross-platform and shell-free. Switch the six npx call sites to it; the npm pack call gets the existing shell-on-win32 idiom instead (npm has no in-tree package to resolve). An unresolvable tsc is now a hard "cannot measure" error with actionable stderr, pinned by a new main() regression test. Closes #1939 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1939
npx/npmare.cmdshims on Windows and Node refuses shell-less.cmdspawns, sovalidate/cidied atverify:typecheck-coverage— silently, as a bogus "918 files get no tsc pass" report. This adds a sharedscripts/lib/resolve-node-bin.mjs(resolves a package'sbinvia itspackage.json, spawned withprocess.execPath) and patches all seven affected call sites across the verify/smoke/pack scripts; a resolution failure is now a hard "cannot resolve — run npm install" error instead of an empty file set. Verified on Windows:test:scripts94/94 (+7 new tests incl. a regression pin),verify:typecheck-coverageandverify:build-gategreen. Full root-cause in the issue comment.🤖 Generated with Claude Code