fix: use printf instead of echo for POSIX path normalization

[Yahiro025]

Summary

Fixes the POSIX bin shim header so Windows-form paths keep their backslashes until sed converts them.

Related: pnpm/pnpm#14867. POSIX echo can interpret \n / \t / etc. before sed runs, so a path like C:\node_modules\.bin\tsc becomes corrupted on dash and macOS /bin/sh. pnpm 11 generates these shims via @zkochan/cmd-shim.

The generated header now uses:

basedir=$(printf '%s\n' "$link" | command -p sed -e 's,\\,/,g')

instead of echo "$link". The commented documentation template above the live JS string is updated to match.

The Rust/pacquet copy of this header was already fixed in pnpm/pnpm#14878. This is the remaining @zkochan/cmd-shim / pnpm 11 path.

Test plan

• npx tsc --build && node --test test/test.js test/e2e.test.js (68 passed on Linux; /bin/sh is dash)
• Generated shims contain printf '%s\n' "$link" and not echo "$link"
• /bin/sh turns C:\node_modules\.bin\tsc into C:/node_modules/.bin/tsc without injecting a newline or tab
• Existing snapshot tests updated for the new header line

AI disclosure

I used Cursor to help draft the fix and tests. I reviewed the diff and verified the regression coverage before opening this PR.

Summary by CodeRabbit

• Bug Fixes

  • Improved POSIX shell shim path handling for Windows-style paths containing escape sequences, preventing characters such as \n and \t from being interpreted incorrectly.

• Tests

  • Added coverage confirming correct path normalization and generated shell shim output across supported test scenarios.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c0daa4d5-fd00-4f95-86d4-1f8f0215476f

📥 Commits

Reviewing files that changed from the base of the PR and between 83f9b94 and 6f43df5.

📒 Files selected for processing (5)

• src/index.ts
• test/e2e.test.js
• test/e2e.test.js.snapshot
• test/test.js
• test/test.js.snapshot

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⚠️ CI failures not shown inline (1)

Commit Status: continuous-integration/appveyor/pr: continuous-integration/appveyor/pr

Conclusion: failure

AppVeyor build failed

🧰 Additional context used

🪛 ast-grep (0.45.3)

test/test.js

[warning] 296-296: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.promises.readFile(to, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(detect-non-literal-fs-filename)

test/e2e.test.js

[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawn, spawnSync } from 'node:child_process'
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

(detect-child-process)

---

[warning] 208-208: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(target, '#!/usr/bin/env node\nconsole.log("ok")\n', 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(detect-non-literal-fs-filename)

---

[warning] 212-212: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(shim, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(detect-non-literal-fs-filename)

🔇 Additional comments (5)

src/index.ts (1)

496-496: LGTM!

Also applies to: 562-562

test/e2e.test.js (1)

202-230: LGTM!

test/e2e.test.js.snapshot (1)

28-28: LGTM!

test/test.js.snapshot (1)

28-28: LGTM!

Also applies to: 156-156, 242-242, 354-354, 489-489, 613-613, 725-725, 837-837, 949-949, 1061-1061, 1173-1173, 1285-1285, 1397-1397, 1476-1476, 1562-1562

test/test.js (1)

285-309: LGTM!

---

📝 Walkthrough

Walkthrough

The POSIX sh shim now uses printf '%s\n' "$link" instead of echo "$link" before converting backslashes with sed. Tests and snapshots verify the generated command and normalized Windows-form paths.

Changes

POSIX shim path handling

Layer / File(s)	Summary
Update sh shim generation src/index.ts	The generated sh shim uses printf to pass $link to sed for basedir conversion.
Validate generated shims test/e2e.test.js, test/test.js, test/*.snapshot	POSIX tests verify the command and normalize C:\node_modules\.bin\tsc to C:/node_modules/.bin/tsc. Shim snapshots record the updated command across cases.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: zkochan

Merge Risk: ⚪ Minimal · up to 6f43d

This change addresses the reported POSIX path-handling issue without introducing a concrete merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing echo with printf for POSIX path normalization.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the shim at night
printf keeps each backslash right
Sed turns the path with care
Snapshots show the change laid bare
The little paths now hop just fine}

_{Comment @coderabbitai help to get the list of available commands.}