github/codegraph
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(installer): Windows npm launcher EINVAL on modern Node (#289) (#292)

Browse Source 
The npm thin-installer shim spawned the per-platform bundle's `.cmd`
launcher directly. Modern Node on Windows refuses to spawn `.cmd`/`.bat`
without `shell: true` (the CVE-2024-27980 hardening), so every `codegraph`
command failed with `spawnSync …\codegraph.cmd EINVAL` (seen on Node 24).

On Windows the shim now invokes the bundled `node.exe` against the app
entry point directly, bypassing the `.cmd` (and avoiding the arg-quoting
pitfalls of `shell: true`). Unix is unchanged.

Validated end-to-end against a real win32-x64 bundle: `npm install` of the
packed tarballs + `codegraph init -i`/`status` run on the bundled Node 24.

Also cuts release 0.9.2, rolling up the pending Drupal, zero-config,
config-removal, Hermes-installer, and symlink-security changes.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Colby Mchenry
2026-05-21 21:22:50 -05:00
committed by GitHub
co-authored by Claude Opus 4.7
parent f6772dac7c
commit c41559a9d0
5 changed files with 46 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/npm-shim.js
+16 -4
View File
@@ -19,11 +19,23 @@ var childProcess = require('child_process');
var target = process.platform + '-' + process.arch; // e.g. darwin-arm64, linux-x64
var pkg = '@colbymchenry/codegraph-' + target;
var launcher = process.platform === 'win32' ? 'bin/codegraph.cmd' : 'bin/codegraph';
var isWindows = process.platform === 'win32';
var binPath;
// On Windows the bundle's launcher is a .cmd batch file. Modern Node refuses to
// spawn .cmd/.bat directly — spawnSync throws EINVAL (the CVE-2024-27980
// hardening, observed on Node 24). So on Windows we skip the .cmd and invoke the
// bundled node.exe against the app entry point directly. On unix the bin launcher
// is a shell script that spawns cleanly.
var command, args;
try {
binPath = require.resolve(pkg + '/' + launcher);
if (isWindows) {
command = require.resolve(pkg + '/node.exe');
var entry = require.resolve(pkg + '/lib/dist/bin/codegraph.js');
args = [entry].concat(process.argv.slice(2));
} else {
command = require.resolve(pkg + '/bin/codegraph');
args = process.argv.slice(2);
}
} catch (e) {
process.stderr.write(
'codegraph: no prebuilt bundle for ' + target + '.\n' +
@@ -35,7 +47,7 @@ try {
process.exit(1);
}
var res = childProcess.spawnSync(binPath, process.argv.slice(2), { stdio: 'inherit' });
var res = childProcess.spawnSync(command, args, { stdio: 'inherit' });
if (res.error) {
process.stderr.write('codegraph: ' + res.error.message + '\n');
process.exit(1);