openclaw/scripts/lib/npm-verify-exec.ts

// Npm Verify Exec script supports OpenClaw repository automation.
import { execFileSync, type ExecFileSyncOptionsWithStringEncoding } from "node:child_process";

export type NpmVerifyCommandInvocation = {
  command: string;
  args: string[];
  windowsVerbatimArguments?: boolean;
};

type NpmVerifyExecOptions = ExecFileSyncOptionsWithStringEncoding & {
  windowsVerbatimArguments?: boolean;
};

const DEFAULT_NPM_VERIFY_COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
const DEFAULT_NPM_VERIFY_COMMAND_MAX_BUFFER_BYTES = 16 * 1024 * 1024;

function positiveEnvInt(name: string, fallback: number): number {
  const raw = process.env[name]?.trim();
  if (raw === undefined || raw === "") {
    return fallback;
  }
  if (!/^[1-9]\d*$/u.test(raw)) {
    throw new Error(`invalid ${name}: ${raw}`);
  }
  const value = Number(raw);
  if (!Number.isSafeInteger(value)) {
    throw new Error(`invalid ${name}: ${raw}`);
  }
  return value;
}

export function runNpmVerifyCommand(
  invocation: NpmVerifyCommandInvocation,
  cwd: string,
  options: { maxBufferBytes?: number; timeoutMs?: number } = {},
): string {
  const timeoutMs =
    options.timeoutMs ??
    positiveEnvInt("OPENCLAW_NPM_VERIFY_COMMAND_TIMEOUT_MS", DEFAULT_NPM_VERIFY_COMMAND_TIMEOUT_MS);
  const maxBuffer =
    options.maxBufferBytes ??
    positiveEnvInt(
      "OPENCLAW_NPM_VERIFY_COMMAND_MAX_BUFFER_BYTES",
      DEFAULT_NPM_VERIFY_COMMAND_MAX_BUFFER_BYTES,
    );

  const execOptions: NpmVerifyExecOptions = {
    cwd,
    encoding: "utf8",
    killSignal: "SIGKILL",
    maxBuffer,
    stdio: ["ignore", "pipe", "pipe"],
    timeout: timeoutMs,
    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
  };
  return execFileSync(invocation.command, invocation.args, execOptions).trim();
}