mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 20:32:20 +03:00
3f2d88b679
* fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7913) runOpenCodeAuth spawned the opencode.cmd shim with shell:false on win32, which throws spawnSync EINVAL under Node's hardened child_process handling (post CVE-2024-27980). Mirrors the fix already applied to codex (resolveCodexSpawn in launch-codex.mjs, #6263) and qodercli/Auggie (#6263/#6304): shell:isWin, unchanged elsewhere. Exported runOpenCodeAuth for testability and added a regression test covering both the win32 shell:true path and the non-regressing linux/darwin bare-binary path. * fix(cli): make opencode --auth win32 spawn testable without module mocks (#7913) The regression test used t.mock.module, which needs --experimental-test-module-mocks and fails to even run in CI (TypeError: t.mock.module is not a function → the fix was unvalidated). Extract a pure resolveOpenCodeAuthSpawn(providerId, platform) helper and test it directly (win32 → shell:true, linux/darwin → shell:false). Production behavior of runOpenCodeAuth is unchanged.
43 lines
1.9 KiB
JavaScript
43 lines
1.9 KiB
JavaScript
// Regression test for #7913: `omniroute setup opencode --auth` spawns the
|
|
// `opencode.cmd` shim on win32. Since Node's CVE-2024-27980 hardening,
|
|
// spawning a `.cmd`/`.bat` shim with `shell:false` throws EINVAL — the same
|
|
// class already fixed for codex (bin/cli/commands/launch-codex.mjs,
|
|
// crediting #6263) and qodercli/Auggie (#6263/#6304). This callsite was
|
|
// missed; `resolveOpenCodeAuthSpawn` must use `shell: isWin`.
|
|
//
|
|
// Tested through the pure `resolveOpenCodeAuthSpawn(providerId, platform)`
|
|
// resolver (no child_process mocking, no process.platform mutation — both of
|
|
// which required an unavailable --experimental-test-module-mocks flag in CI).
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
import { resolveOpenCodeAuthSpawn } from "../../bin/cli/commands/setup-open-code.mjs";
|
|
|
|
test("resolveOpenCodeAuthSpawn: win32 spawns opencode.cmd with shell:true (repro #7913)", () => {
|
|
const spawn = resolveOpenCodeAuthSpawn("omniroute", "win32");
|
|
assert.equal(spawn.command, "opencode.cmd");
|
|
assert.equal(
|
|
spawn.options.shell,
|
|
true,
|
|
`expected shell:true on win32 (the EINVAL fix), got shell:${spawn.options.shell}`
|
|
);
|
|
assert.deepEqual(spawn.args, ["auth", "login", "--provider", "omniroute"]);
|
|
});
|
|
|
|
test("resolveOpenCodeAuthSpawn: linux/darwin spawn bare opencode with shell:false (no regression)", () => {
|
|
for (const platform of ["linux", "darwin"]) {
|
|
const spawn = resolveOpenCodeAuthSpawn("omniroute", platform);
|
|
assert.equal(spawn.command, "opencode", `command on ${platform}`);
|
|
assert.equal(
|
|
spawn.options.shell,
|
|
false,
|
|
`expected shell:false on ${platform}, got shell:${spawn.options.shell}`
|
|
);
|
|
}
|
|
});
|
|
|
|
test("resolveOpenCodeAuthSpawn: forwards the provider id into the args", () => {
|
|
const spawn = resolveOpenCodeAuthSpawn("anthropic", "linux");
|
|
assert.deepEqual(spawn.args, ["auth", "login", "--provider", "anthropic"]);
|
|
});
|