Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ terminal, then it is up to the user to end it, of course.

If stdio is `inherit` this package will emit a banner with the package
name and version, event name, and script command to be run, and send it
to [`proc-log.output.standard`](https://npm.im/proc-log). Consuming
to [`proc-log.log.notice`](https://npm.im/proc-log) under the `run` heading. Consuming
libraries can decide whether or not to display this.

### Options
Expand Down Expand Up @@ -161,14 +161,14 @@ Functionally, this means:
## Escaping

In order to ensure that arguments are handled consistently, this module
writes a temporary script file containing the command as it exists in
the package.json, followed by the user supplied arguments having been
escaped to ensure they are processed as literal strings. We then instruct
the shell to execute the script file, and when the process exits we remove
the temporary file.
passes the command from package.json and the extra arguments to
`@npmcli/promise-spawn`. That module escapes the extra arguments for the
selected shell, then runs the resulting command through the shell. The
package script itself is not escaped, so shell operators in it still work.

In Windows, when the shell is cmd, and when the initial command in the script
is a known batch file (i.e. `something.cmd`) we double escape additional
arguments so that the shim scripts npm installs work correctly.

The actual implementation of the escaping is in `lib/escape.js`.
The actual implementation of the escaping is in
[`@npmcli/promise-spawn`'s `lib/escape.js`](https://github.com/npm/promise-spawn/blob/main/lib/escape.js).