fix: address CLI regressions from dependency slimming (#1534)

The post-merge review of #1532 found regressions in the published CLI:

- declare engines >=22 (fs.globSync raised the runtime floor silently;
  Node 20 users crashed at runtime with no install-time warning)
- finish the glob removal: project-files.ts still imported it at runtime
  and only worked through transitive hoisting. getPublishableFiles now
  uses fs.globSync; the ignore-package filter stays the authoritative
  .dclignore gate, directories are stat-filtered (the old nodir), and
  dot-dirs/node_modules are pruned during the walk. Old and new produce
  identical file lists on a fixture covering the edge cases. Root
  scripts/tests with the same phantom import migrated the same way.
- restore the stable 8000-based preview port search (tryListen(0) handed
  out a random ephemeral port on every run)
- decide colors by FORCE_COLOR/NO_COLOR again: styleText's default
  validation consults stdout while all logger output goes to stderr
- abort pending prompts on SIGINT: on Node <24 readline pauses stdin
  instead of rejecting, so Ctrl+C hung forever and onCancel never ran
- pass the Windows 'start' command line verbatim: libuv's CRT-style
  quoting mangled the '""' title arg and the browser never opened
- apply the protobufjs override in sdk-commands' own manifest: the root
  override never reached its standalone lockfile, which still shipped
  the vulnerable 7.2.4 that #1532 set out to remove (consumer installs
  still need a @dcl/protocol bump; see PR)

Author: gonpombo8

packages/@dcl/sdk-commands/package-lock.json

@@ -42,6 +42,12 @@
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.5.4"
   },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "overrides": {
+    "protobufjs": "^7.6.3"
+  },
   "files": [
     "dist",
     ".dclrc",

packages/@dcl/sdk-commands/package.json

@@ -19,10 +19,9 @@ export const writeToStderr = (...parameters: readonly unknown[]) => {
 // @see https://no-color.org
 // @see https://www.npmjs.com/package/chalk
 const useColor = process.env.FORCE_COLOR !== '0' && !process.env.NO_COLOR
-const paint =
-  (format: Parameters<typeof styleText>[0]) =>
-  (text: string | number) =>
-    useColor ? styleText(format, String(text)) : String(text)
+// skip styleText's stream validation: it checks stdout, but the logger writes to stderr
+const paint = (format: Parameters<typeof styleText>[0]) => (text: string | number) =>
+  useColor ? styleText(format, String(text), { validateStream: false }) : String(text)
 
 export const colors = {
   bgBlack: paint('bgBlack'),

packages/@dcl/sdk-commands/src/components/log.ts

@@ -1,5 +1,9 @@
 import * as net from 'net'
 
+// search upward from 8000 (portfinder's contract) so the preview URL stays stable across runs
+const BASE_PORT = 8000
+const HIGHEST_PORT = 65535
+
 function tryListen(port: number): Promise<number> {
   return new Promise((resolve, reject) => {
     const server = net.createServer()
@@ -16,11 +20,14 @@ export async function getPort(port: number, failoverPort = 2044) {
   const resolvedPort = port && Number.isInteger(port) ? +port : 0
 
   if (!resolvedPort) {
-    try {
-      return await tryListen(0)
-    } catch (e) {
-      return failoverPort
+    for (let candidate = BASE_PORT; candidate <= HIGHEST_PORT; candidate++) {
+      try {
+        return await tryListen(candidate)
+      } catch {
+        // busy, try the next one
+      }
     }
+    return failoverPort
   }
 
   return resolvedPort

packages/@dcl/sdk-commands/src/logic/get-free-port.ts

@@ -1,4 +1,4 @@
-import { spawn } from 'child_process'
+import { spawn, SpawnOptions } from 'child_process'
 import { release } from 'os'
 
 function isWsl(): boolean {
@@ -10,14 +10,25 @@ export default async function open(target: string): Promise<void> {
   if (protocol !== 'http:' && protocol !== 'https:') {
     throw new Error(`Refusing to open non-http(s) URL: ${target}`)
   }
-  const [command, args] =
-    process.platform === 'darwin'
-      ? ['open', [target]]
-      : process.platform === 'win32' || isWsl()
-        ? // `start` treats the first quoted arg as a window title; `&` must be escaped for cmd
-          [isWsl() ? 'cmd.exe' : 'cmd', ['/c', 'start', '""', target.replace(/&/g, '^&')]]
-        : ['xdg-open', [target]]
-  const child = spawn(command, args, { stdio: 'ignore', detached: true })
+  const spawnOptions: SpawnOptions = { stdio: 'ignore', detached: true }
+  let command: string
+  let args: string[]
+  if (process.platform === 'darwin') {
+    command = 'open'
+    args = [target]
+  } else if (process.platform === 'win32') {
+    // libuv's CRT-style quoting mangles the '""' title arg, so hand cmd the exact line
+    command = 'cmd'
+    args = ['/c', `start "" "${target}"`]
+    spawnOptions.windowsVerbatimArguments = true
+  } else if (isWsl()) {
+    command = 'cmd.exe'
+    args = ['/c', 'start', '""', target.replace(/&/g, '^&')]
+  } else {
+    command = 'xdg-open'
+    args = [target]
+  }
+  const child = spawn(command, args, spawnOptions)
   // opening the browser is best-effort: without this handler a missing
   // xdg-open/open/cmd (headless, containers) crashes the CLI
   child.on('error', () => {})

packages/@dcl/sdk-commands/src/logic/open.ts

@@ -1,7 +1,7 @@
 import { ContentMapping } from '@dcl/schemas/dist/misc/content-mapping'
 import { CliComponents } from '../components'
 import { getDCLIgnorePatterns } from './dcl-ignore'
-import { sync as globSync } from 'glob'
+import { globSync, statSync, Dirent } from 'fs'
 import ignore from 'ignore'
 import i18next from 'i18next'
 import os from 'os'
@@ -27,13 +27,15 @@ export async function getPublishableFiles(
   const ig = ignore().add(ignorePatterns)
   const allFiles = globSync('**/*', {
     cwd: projectRoot,
-    absolute: false,
-    dot: false,
-    ignore: ignorePatterns,
-    nodir: true
+    // prune walking into trees ig.filter below always excludes anyway (perf only;
+    // exclude receives a string on some Node versions and a Dirent on others)
+    exclude: (entry: string | Dirent) => {
+      const name = typeof entry === 'string' ? path.basename(entry) : entry.name
+      return name.startsWith('.') || name === 'node_modules'
+    }
   })
 
-  return ig.filter(allFiles)
+  return ig.filter(allFiles).filter((file) => statSync(resolve(projectRoot, file)).isFile())
 }
 
 /**

packages/@dcl/sdk-commands/src/logic/project-files.ts

@@ -22,10 +22,13 @@ export default async function prompts(
   options: Options = {}
 ): Promise<Record<string, string | number | boolean>> {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+  // on Node <24 Ctrl+C only pauses stdin instead of rejecting rl.question; abort so onCancel runs
+  const canceled = new AbortController()
+  rl.on('SIGINT', () => canceled.abort())
   try {
     for (;;) {
       const suffix = question.type === 'confirm' ? (question.initial ? ' [Y/n] ' : ' [y/N] ') : ' '
-      const answer = await rl.question(`${question.message}${suffix}`)
+      const answer = await rl.question(`${question.message}${suffix}`, { signal: canceled.signal })
       if (question.type === 'confirm') {
         const value = answer === '' ? !!question.initial : /^y(es)?$/i.test(answer)
         return { [question.name]: value }

packages/@dcl/sdk-commands/src/logic/prompts.ts

@@ -1,8 +1,7 @@
 import { exec } from 'child_process'
-import { sync as globSync } from 'glob'
 import { resolve, relative } from 'path'
 import { existsSync, readFileSync, writeFileSync, lstatSync, removeSync, copySync } from 'fs-extra'
-import { rmSync } from 'fs'
+import { rmSync, globSync } from 'fs'
 
 /**
  * @returns the resolved absolute path
@@ -51,10 +50,12 @@ export function itDeletesFolder(folder: string, cwd: string) {
 }
 export function itDeletesGlob(pattern: string, cwd: string) {
   it(`deletes ${pattern} in ${cwd}`, () => {
-    globSync(pattern, { absolute: true, cwd }).forEach((file) => {
-      console.log(`> deleting ${file}`)
-      rmSync(file, { recursive: true, force: true })
-    })
+    globSync(pattern, { cwd })
+      .map((file) => resolve(cwd, file))
+      .forEach((file) => {
+        console.log(`> deleting ${file}`)
+        rmSync(file, { recursive: true, force: true })
+      })
   })
 }
 

scripts/helpers.ts

@@ -1,13 +1,12 @@
-import { readFileSync } from 'fs'
-import { glob } from 'glob'
+import { readFileSync, globSync } from 'fs'
 import path from 'path'
 import { Composite, Engine, Entity, IEngine } from '../../packages/@dcl/ecs/src'
 import { components } from '../../packages/@dcl/ecs/src'
 
 const COMPOSITE_BASE_PATH = 'test/ecs/composites'
 
 function getJsonCompositeFrom(globPath: string, cwd: string): Composite.Resource[] {
-  const compositeFileContent = glob.sync(globPath, { cwd }).map((item) => ({
+  const compositeFileContent = globSync(globPath, { cwd }).map((item) => ({
     src: item,
     content: readFileSync(path.resolve(cwd, item)).toString()
   }))

test/ecs/add-entity-from-composite.spec.ts

@@ -1,5 +1,4 @@
-import { existsSync, readFileSync, writeFileSync } from 'fs'
-import { glob } from 'glob'
+import { existsSync, readFileSync, writeFileSync, globSync } from 'fs'
 import path from 'path'
 import {
   Composite,
@@ -23,7 +22,7 @@ const nonBinaryCompositeJsonPath = 'non-binary.composite'
 // ########
 
 function getJsonCompositeFrom(globPath: string, cwd: string): Composite.Resource[] {
-  const compositeFileContent = glob.sync(globPath, { cwd }).map((item) => ({
+  const compositeFileContent = globSync(globPath, { cwd }).map((item) => ({
     src: item,
     content: readFileSync(path.resolve(cwd, item)).toString()
   }))
@@ -34,7 +33,7 @@ function getJsonCompositeFrom(globPath: string, cwd: string): Composite.Resource
 }
 
 function getBinaryCompositeFrom(globPath: string, cwd: string) {
-  const compositeFileContent = glob.sync(globPath, { cwd }).map((item) => ({
+  const compositeFileContent = globSync(globPath, { cwd }).map((item) => ({
     src: item,
     content: readFileSync(path.resolve(cwd, item))
   }))
@@ -149,7 +148,7 @@ describe('composite instantiation system', () => {
       // actually instances nested child composites. Leaf composites (whose
       // definition carries no `composite::root` component) emit none.
       const hasNestedComposites = composite.composite.components.some(
-        component => component.name === CompositeRootComponent.componentName
+        (component) => component.name === CompositeRootComponent.componentName
       )
       if (hasNestedComposites) {
         expect(composites.length).toBeGreaterThan(0)