发布

  • fix(installer): Windows npm launcher EINVAL on modern Node (#289) (#292)

    frostbyte_neo 发布于 2026-05-22 02:22:50 +00:00 | 723 次提交 在此版本后已推送到 main

    The npm thin-installer shim spawned the per-platform bundle's .cmd
    launcher directly. Modern Node on Windows refuses to spawn .cmd/.bat
    without shell: true (the CVE-2024-27980 hardening), so every codegraph
    command failed with spawnSync …\codegraph.cmd EINVAL (seen on Node 24).

    On Windows the shim now invokes the bundled node.exe against the app
    entry point directly, bypassing the .cmd (and avoiding the arg-quoting
    pitfalls of shell: true). Unix is unchanged.

    Validated end-to-end against a real win32-x64 bundle: npm install of the
    packed tarballs + codegraph init -i/status run on the bundled Node 24.

    Also cuts release 0.9.2, rolling up the pending Drupal, zero-config,
    config-removal, Hermes-installer, and symlink-security changes.

    Co-authored-by: Claude Opus 4.7 (1M context) noreply@anthropic.com

    下载附件