mirror of
https://github.com/JuliusBrussee/caveman.git
synced 2026-08-11 13:21:09 +02:00
Julius BrusseeandClaude Fable 5
ed1fbb7f4c
Marketplace fix (#712, #705): Claude Desktop rejects plugins containing a top-level bin/ directory, and .claude-plugin/marketplace.json packages the repo root, so the installer directory is now cli/. Every reference updated (package.json bin entry + files, shims, docs, tests, caveman-init require path). Supersedes PR #726. Security (PR #717 verified): quoteWinArg only quoted on whitespace/quotes, leaving cmd.exe metacharacters (& | ^ < > % parens) unescaped on the shell:true Windows spawn path. Attacker-influenced arguments (--with-init cwd, --with-mcp-shrink value) could chain commands. Trigger regex now covers the metacharacter set; quoting logic split into a platform- independent, unit-tested helper. Also: - uninstall removes .caveman-active.prev, .caveman-mode-log.jsonl, .caveman-statusline-suffix, .caveman-nudge-shown; keeps .caveman-history.jsonl with a printed note; dry-run now says 'would remove' instead of lying (#635, supersedes PRs #693 #636) - Array.isArray guard in rewriteLegacyManagedHookCommands — malformed hook event no longer crashes the installer mid-run (supersedes PR #646) - gemini extensions install --consent: the security prompt hung every piped/non-interactive install forever (#676, part of PR #664) - OpenClaw skill stamps the real PINNED_REF version instead of hardcoded 1.0.0; new --no-always flag for load-on-demand installs (supersedes PR #720) - shims scope NPM_CONFIG_ALLOW_GIT=all to the npx call — npm >=12 defaults allow-git to none and EALLOWGITs github: installs (#698) - .codex/config.toml ships hooks + codex_hooks keys so auto-activation works on both sides of the codex-cli rename (#617) - caveman-help card shows the Windows config path (%APPDATA%) (#723) - caveman-parse.js added to HOOK_FILES, opencode payload (.cjs), and the regenerated checksums.sha256; manifest now matches shipped hook contents — release must bump PINNED_REF to a tag containing these files Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016ySX6TBWZuvFze4ajf7Hpf
82 lines
2.9 KiB
PowerShell
82 lines
2.9 KiB
PowerShell
# caveman — installer shim (Windows / PowerShell).
|
|
#
|
|
# Thin wrapper around cli/install.js (the unified Node installer). Every flag
|
|
# you'd pass to cli/install.js can be passed here; we just forward them.
|
|
#
|
|
# One-line install:
|
|
# irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex
|
|
#
|
|
# Local clone:
|
|
# pwsh install.ps1 [flags]
|
|
#
|
|
# Why a Node installer? install.sh + install.ps1 used to be parallel sources of
|
|
# truth and constantly drifted (issue #249 was a `node -e "..."` quoting bug
|
|
# that silently dropped the JSON merge step on every Windows install). One
|
|
# Node script works everywhere without quoting bugs.
|
|
#
|
|
# Why no top-level param() and everything inside a function? `irm | iex`
|
|
# executes this file as a string: script-path variables ($PSCommandPath,
|
|
# $MyInvocation.MyCommand.Path) are $null and a top-level param block cannot
|
|
# receive arguments through a pipe anyway (issue #565). Wrapping the logic in
|
|
# a function and forwarding $args keeps one script working for both the pipe
|
|
# path (no args, no script path) and the local-clone path.
|
|
|
|
function Install-Caveman {
|
|
param(
|
|
[string[]]$InstallerArgs = @()
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$Repo = "JuliusBrussee/caveman"
|
|
|
|
# Require Node ≥18.
|
|
$node = Get-Command node -ErrorAction SilentlyContinue
|
|
if (-not $node) {
|
|
Write-Error @"
|
|
caveman: Node.js (>=18) required. Install:
|
|
- winget install OpenJS.NodeJS.LTS
|
|
- or download from https://nodejs.org
|
|
"@
|
|
exit 1
|
|
}
|
|
|
|
$nodeMajor = [int](& node -p "process.versions.node.split('.')[0]")
|
|
if ($nodeMajor -lt 18) {
|
|
Write-Error "caveman: Node $nodeMajor too old. Need Node >=18. Upgrade: https://nodejs.org"
|
|
exit 1
|
|
}
|
|
|
|
# If we're inside the repo clone, run the local installer directly.
|
|
# $PSCommandPath is $null when piped to iex (#565) — the old unguarded
|
|
# Split-Path on it was the "Cannot bind argument to parameter 'Path'
|
|
# because it is null" crash.
|
|
if ($PSCommandPath) {
|
|
$here = Split-Path -Parent $PSCommandPath
|
|
$local = Join-Path $here "cli/install.js"
|
|
if (Test-Path $local) {
|
|
& node $local @InstallerArgs
|
|
exit $LASTEXITCODE
|
|
}
|
|
}
|
|
|
|
# Curl-pipe path: delegate to npx.
|
|
$npx = Get-Command npx -ErrorAction SilentlyContinue
|
|
if (-not $npx) {
|
|
Write-Error "caveman: npx required (ships with Node >=18). Reinstall Node.js."
|
|
exit 1
|
|
}
|
|
|
|
# Do NOT pass `--` here — npm 7+ npx already forwards trailing args to the
|
|
# package, and a literal `--` was tripping cli/install.js's parseArgs as an
|
|
# unknown flag.
|
|
# npm >=12 defaults allow-git to "none", failing github: specs with
|
|
# EALLOWGIT (#698). Scope the override to this invocation.
|
|
$env:NPM_CONFIG_ALLOW_GIT = "all"
|
|
& npx -y "github:$Repo" @InstallerArgs
|
|
exit $LASTEXITCODE
|
|
}
|
|
|
|
# $args is the automatic variable: populated when run as a file
|
|
# (`pwsh install.ps1 --force`), empty under `irm | iex`.
|
|
Install-Caveman -InstallerArgs $args
|