mengzhx/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness.git synced 2026-08-29 04:26:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(scripts): launch lefthook bin shim via shell on Windows

Browse Source 
spawnSync on a .cmd shim returns EINVAL/null status on recent Node (CVE-2024-27980) unless shell:true, which made postinstall fail and blocked every 'pnpm run' on Windows.

(cherry picked from commit 65a08f889ff9738ddaceeeb724e6e24f3be4b2ea)
This commit is contained in:
Huanqi Cao
2026-07-15 16:09:12 +08:00
committed by imccyu
parent b4ec4060a7
commit 8e6ad0a347
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/install-lefthook.mjs
+10 -2
View File
@@ -6,8 +6,16 @@ import { join } from 'node:path'
const git = spawnSync('git', ['rev-parse', '--git-dir'], { stdio: 'ignore' })
if (git.status !== 0) process.exit(0)
const lefthook = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'lefthook.cmd' : 'lefthook')
const isWindows = process.platform === 'win32'
const lefthook = join(process.cwd(), 'node_modules', '.bin', isWindows ? 'lefthook.cmd' : 'lefthook')
if (!existsSync(lefthook)) process.exit(0)
const result = spawnSync(lefthook, ['install', '--force'], { stdio: 'inherit' })
// On Windows the bin shim is a `.cmd` file, and recent Node (CVE-2024-27980)
// refuses to launch `.cmd`/`.bat` via spawn without `shell: true` — it returns
// `EINVAL` with a null status, which would otherwise fail postinstall. Quote
// the path because a shell re-parses the command line and the path may contain
// spaces. POSIX needs no shell: the extensionless shim is directly executable.
const result = isWindows
? spawnSync(`"${lefthook}"`, ['install', '--force'], { stdio: 'inherit', shell: true })
: spawnSync(lefthook, ['install', '--force'], { stdio: 'inherit' })
process.exit(result.status ?? 1)