fix(cli): handle command args

Signed-off-by: Cory Rylan <crylan@nvidia.com>

Author: coryrylan

projects/internals/tools/src/project/starters.test.ts

@@ -1,10 +1,22 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, expect, it } from 'vitest';
-import { startersData, removeWireitScripts } from './starters.js';
+import type * as childProcess from 'node:child_process';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  startersData,
+  createGitInitProcess,
+  createStarterPaths,
+  removeWireitScripts,
+  startStarter
+} from './starters.js';
 import { getNPMClient, isCommandAvailable, getPackageJson } from '../internal/node.js';
 
+vi.mock('node:child_process', async importOriginal => {
+  const actual = await importOriginal<typeof childProcess>();
+  return { ...actual, execFile: vi.fn(), execFileSync: vi.fn() };
+});
+
 describe('startersData', () => {
   it('should provide a list of starter metadata', () => {
     expect(startersData).toBeDefined();
@@ -157,6 +169,17 @@ describe('removeWireitScripts', () => {
   });
 });
 
+describe('createStarterPaths', () => {
+  it('should create starter paths without shell command concatenation', () => {
+    const outDir = '/tmp/starter output; echo bad';
+
+    expect(createStarterPaths('typescript', outDir)).toEqual({
+      archivePath: '/tmp/starter output; echo bad/typescript.zip',
+      extractedPath: '/tmp/starter output; echo bad/typescript'
+    });
+  });
+});
+
 describe('getNPMClient', () => {
   it('should return the npm client', async () => {
     expect(await getNPMClient()).toBe('pnpm');
@@ -184,3 +207,33 @@ describe('getPackageJson', () => {
     expect(result.name).toBe('@internals/tools');
   });
 });
+
+describe('startStarter', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should start the dev server without shell interpretation', async () => {
+    const { execFileSync } = await import('node:child_process');
+    const extractedPath = '/tmp/starter with spaces; echo bad';
+
+    await startStarter(extractedPath);
+
+    expect(execFileSync).toHaveBeenCalledWith('pnpm', ['run', 'dev'], { cwd: extractedPath, stdio: 'inherit' });
+  });
+});
+
+describe('createGitInitProcess', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should initialize git without shell interpretation', async () => {
+    const { execFile } = await import('node:child_process');
+    const extractedPath = '/tmp/starter with spaces; echo bad';
+
+    createGitInitProcess(extractedPath);
+
+    expect(execFile).toHaveBeenCalledWith('git', ['init', extractedPath]);
+  });
+});

projects/internals/tools/src/project/starters.ts

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { basename, dirname, join, parse, resolve } from 'node:path';
-import { exec, execSync } from 'node:child_process';
+import { execFile, execFileSync } from 'node:child_process';
 import { cwd } from 'node:process';
 
 import { writeFile } from 'fs/promises';
@@ -37,6 +37,8 @@ export type Starter =
   | 'typescript'
   | 'vue';
 
+type NPMClient = 'npm' | 'pnpm';
+
 export const startersData = {
   angular: {
     zip: `${ELEMENTS_PAGES_BASE_URL}/starters/download/angular.zip`,
@@ -110,11 +112,11 @@ export const startersData = {
 
 /* istanbul ignore next -- @preserve */
 export async function archiveStarter(projectDir: string, outDir: string) {
-  const dist = `${outDir}/${projectDir}`;
+  const dist = join(outDir, projectDir);
   await copyProject(projectDir);
   writeAllAgentConfigs(dist);
   const packageJSON = await exportPackageFromWorkspace(projectDir);
-  await writeFile(`${dist}/package.json`, JSON.stringify(packageJSON, undefined, 2));
+  await writeFile(join(dist, 'package.json'), JSON.stringify(packageJSON, undefined, 2));
   await zipProject(dist);
 }
 
@@ -134,7 +136,7 @@ async function zipProject(outDir: string) {
 /* istanbul ignore next -- @preserve */
 function copyProject(projectDir: string) {
   const ignoreDirs = new Set(['dist', 'node_modules', '.wireit']);
-  cpSync(projectDir, `dist/${projectDir}`, {
+  cpSync(projectDir, join('dist', projectDir), {
     recursive: true,
     filter: src => !ignoreDirs.has(basename(src))
   });
@@ -179,8 +181,7 @@ export async function createStarter(starter: Starter, outDir: string = resolve(c
     if (!downloadPath) {
       throw new Error(`No download URL for starter "${starter}"`);
     }
-    const archivePath = `${outDir}/${starter}.zip`;
-    const extractedPath = `${outDir}/${starter}`;
+    const { archivePath, extractedPath } = createStarterPaths(starter, outDir);
     await downloadStarter(downloadPath, archivePath);
     await extractStarter(archivePath, extractedPath);
     await setupStarterGit(extractedPath);
@@ -202,6 +203,13 @@ export async function createStarter(starter: Starter, outDir: string = resolve(c
   }
 }
 
+export function createStarterPaths(starter: Starter, outDir: string) {
+  return {
+    archivePath: join(outDir, `${starter}.zip`),
+    extractedPath: join(outDir, starter)
+  };
+}
+
 /* istanbul ignore next -- @preserve */
 async function downloadStarter(starterPath: string, outPath: string) {
   console.log('⏳ Downloading starter...');
@@ -225,7 +233,7 @@ async function setupStarterGit(extractedDir: string) {
   if (hasGit && !isGitRepository(extractedDir)) {
     console.log('🔄 Initializing git...');
     await new Promise<void>((resolve, reject) => {
-      const child = exec(`cd ${extractedDir} && git init`);
+      const child = createGitInitProcess(extractedDir);
       child.on('close', code => (code === 0 ? resolve() : reject(new Error(`git init exited with code ${code}`))));
       child.on('error', reject);
     });
@@ -234,6 +242,10 @@ async function setupStarterGit(extractedDir: string) {
   }
 }
 
+export function createGitInitProcess(extractedDir: string) {
+  return execFile('git', ['init', extractedDir]);
+}
+
 /* istanbul ignore next -- @preserve */
 function isGitRepository(directoryPath: string) {
   // Check if .git directory exists directly in the given path
@@ -276,19 +288,17 @@ async function setupStarterNPM(extractedDir: string) {
 
 /* istanbul ignore next -- @preserve */
 async function loginRegistry(extractedDir: string) {
-  const npmClient = await getNPMClient();
+  const npmClient = await getRequiredNPMClient();
   console.log('🔒 Logging in to registry...');
-  execSync(`cd ${extractedDir} && ${npmClient} login`, {
-    stdio: 'inherit'
-  });
+  execPackageManagerSync(npmClient, ['login'], extractedDir);
 }
 
 /* istanbul ignore next -- @preserve */
 async function installFromRegistry(extractedDir: string) {
-  const npmClient = await getNPMClient();
+  const npmClient = await getRequiredNPMClient();
   console.log('📦 Installing dependencies...');
   await new Promise<void>((resolve, reject) => {
-    const child = exec(`cd ${extractedDir} && ${npmClient} install`);
+    const child = execPackageManager(npmClient, ['install'], extractedDir);
     child.on('close', code =>
       code === 0 ? resolve() : reject(new Error(`${npmClient} install exited with code ${code}`))
     );
@@ -303,9 +313,7 @@ export async function startStarter(extractedPath: string) {
     console.log('🚀 Starting project...');
 
     try {
-      execSync(`cd ${extractedPath} && ${npmClient} run dev`, {
-        stdio: 'inherit'
-      });
+      execPackageManagerSync(npmClient, ['run', 'dev'], extractedPath);
     } catch (e) {
       if (e instanceof Error && 'signal' in e && e.signal === 'SIGINT') {
         console.log('\n👋 Stopped.');
@@ -316,6 +324,21 @@ export async function startStarter(extractedPath: string) {
   }
 }
 
+async function getRequiredNPMClient() {
+  const npmClient = await getNPMClient();
+  if (npmClient === 'npm' || npmClient === 'pnpm') return npmClient;
+  throw new Error('No supported package manager found.');
+}
+
+function execPackageManager(npmClient: NPMClient, args: string[], cwd: string) {
+  return npmClient === 'pnpm' ? execFile('pnpm', args, { cwd }) : execFile('npm', args, { cwd });
+}
+
+function execPackageManagerSync(npmClient: NPMClient, args: string[], cwd: string) {
+  const options = { cwd, stdio: 'inherit' as const };
+  npmClient === 'pnpm' ? execFileSync('pnpm', args, options) : execFileSync('npm', args, options);
+}
+
 export const claudeProjectSettings = {
   $schema: 'https://json.schemastore.org/claude-code-settings.json',
   permissions: {

projects/internals/tools/src/project/update.test.ts

@@ -12,7 +12,7 @@ vi.mock('node:fs', async importOriginal => {
 });
 
 vi.mock('node:child_process', () => ({
-  execSync: vi.fn()
+  execFileSync: vi.fn()
 }));
 
 vi.mock('../internal/node.js', () => ({
@@ -341,8 +341,10 @@ describe('updatePackageJson', () => {
 });
 
 describe('updateProject', () => {
-  beforeEach(() => {
+  beforeEach(async () => {
     vi.clearAllMocks();
+    const { existsSync } = await import('node:fs');
+    vi.mocked(existsSync).mockReturnValue(true);
   });
 
   it('should return warning when no package.json exists', async () => {
@@ -372,4 +374,56 @@ describe('updateProject', () => {
     expect(result.dependencies.message).toContain('package.json');
     expect(result.dependencies.message).toContain('/some/cdn-only/project');
   });
+
+  it('should update dependencies without shell interpretation', async () => {
+    const { writeFileSync } = await import('node:fs');
+    const { execFileSync } = await import('node:child_process');
+    const { ProjectsService } = await import('@internals/metadata');
+    const { getLatestPublishedVersions } = await import('../api/utils.js');
+    const { getNPMClient, getPackageJson } = await import('../internal/node.js');
+    const cwd = '/tmp/project with spaces; echo bad';
+    const packageJson = {
+      dependencies: { '@nvidia-elements/core': '1.0.0' },
+      devDependencies: {},
+      peerDependencies: {}
+    };
+
+    vi.mocked(getPackageJson).mockReturnValue(packageJson);
+    vi.mocked(ProjectsService.getData).mockResolvedValue({ data: [{ changelog: 'core' }] });
+    vi.mocked(getLatestPublishedVersions).mockResolvedValue(
+      createMockElementVersions({ '@nvidia-elements/core': '2.0.0' })
+    );
+    vi.mocked(getNPMClient).mockResolvedValue('pnpm');
+
+    const result = await updateProject(cwd);
+
+    expect(result.dependencies.status).toBe('success');
+    expect(writeFileSync).toHaveBeenCalledWith(`${cwd}/package.json`, expect.stringContaining('"2.0.0"'));
+    expect(execFileSync).toHaveBeenCalledWith('pnpm', ['update', '@nvidia-elements/*', '@nvidia-elements/*'], { cwd });
+  });
+
+  it('should not write package.json when no package manager exists', async () => {
+    const { writeFileSync } = await import('node:fs');
+    const { execFileSync } = await import('node:child_process');
+    const { ProjectsService } = await import('@internals/metadata');
+    const { getLatestPublishedVersions } = await import('../api/utils.js');
+    const { getNPMClient, getPackageJson } = await import('../internal/node.js');
+
+    vi.mocked(getPackageJson).mockReturnValue({
+      dependencies: { '@nvidia-elements/core': '1.0.0' },
+      devDependencies: {},
+      peerDependencies: {}
+    });
+    vi.mocked(ProjectsService.getData).mockResolvedValue({ data: [{ changelog: 'core' }] });
+    vi.mocked(getLatestPublishedVersions).mockResolvedValue(
+      createMockElementVersions({ '@nvidia-elements/core': '2.0.0' })
+    );
+    vi.mocked(getNPMClient).mockResolvedValue(null);
+
+    const result = await updateProject('/tmp/project');
+
+    expect(result.dependencies.status).toBe('danger');
+    expect(writeFileSync).not.toHaveBeenCalled();
+    expect(execFileSync).not.toHaveBeenCalled();
+  });
 });