fix: Audit 08/07 (#2077)

* Bump.

* Fix env vars.

* Fix args.

* Update.

Author: milesj

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## Unreleased
+
+#### 🐞 Fixes
+
+- Fixed an issue with `moon setup` failing when proto is not available.
+- Fixed task input inferrence to not include the `$HOME`, `$USER`, and `$PWD` environment variables.
+- Fixed some arg/shell quoting issues.
+
 ## 1.39.3
 
 #### 🐞 Fixes

Cargo.lock

@@ -73,7 +73,7 @@ starbase_archive = { version = "0.11.3", default-features = false, features = [
 starbase_console = { version = "0.6.13", features = ["miette"] }
 starbase_events = "0.7.3"
 starbase_sandbox = "0.9.4"
-starbase_shell = "0.9.1"
+starbase_shell = "0.10.1"
 starbase_styles = { version = "0.6.1", features = ["relative-path"] }
 starbase_utils = { version = "0.11.13", default-features = false, features = [
     "editor-config",

Cargo.toml

@@ -1,6 +1,5 @@
 use cached::proc_macro::cached;
-use moon_args::join_args_os;
-use starbase_shell::BoxedShell;
+use starbase_shell::{BoxedShell, join_args};
 use std::ffi::{OsStr, OsString};
 use std::path::PathBuf;
 
@@ -51,34 +50,11 @@ impl Shell {
         }
     }
 
-    pub fn is_quoted(&self, arg: &str) -> bool {
-        arg.starts_with("$'") || arg.starts_with("'") || arg.starts_with('"')
-    }
-
     pub fn join_args(&self, args: Vec<OsString>) -> OsString {
-        let mut line = OsString::new();
-        let last_index = args.len() - 1;
-
-        for (index, arg) in args.into_iter().enumerate() {
-            let quoted_arg = match arg.to_str() {
-                Some(inner) => {
-                    if self.is_quoted(inner) {
-                        arg
-                    } else {
-                        OsString::from(self.instance.quote(inner))
-                    }
-                }
-                None => join_args_os([arg]),
-            };
-
-            line.push(&quoted_arg);
-
-            if index != last_index {
-                line.push(OsStr::new(" "));
-            }
-        }
-
-        line
+        OsString::from(join_args(
+            &self.instance,
+            args.iter().filter_map(|arg| arg.to_str()),
+        ))
     }
 }
 

crates/process/src/shell.rs

@@ -765,6 +765,9 @@ impl<'graph> TokenExpander<'graph> {
 
     fn infer_inputs_from_set(&self, task: &mut Task, mut set: FxHashSet<String>) {
         let mut blacklist = vec![
+            "HOME",
+            "USER",
+            "PWD",
             "CI_",
             "GIT_",
             "BUILD_",