Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Session-start hook reports "The Vercel CLI is not installed" on Windows — execFileSync on vercel.cmd throws EINVAL

未关闭
  • 哪里不对？
#175 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
76/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
node.js, typescript
领域
tooling

调研方向

从 hooks/src/session-start-profiler.mts 中的 checkVercelCli 开始，并将其与实际运行的 hooks/session-start-profiler.mjs 进行比较。运行 Windows 最小复现，并检查附近的 npm view 调用是否采用相同的 spawning 模式。完成标准是：能够检测到 Windows 上由 npm 安装的 .cmd 和 .bat CLI，并且 session-start hook 不再将已安装的 CLI 报告为缺失。

由索引模型根据 Issue 内容生成。

描述

What happened

On Windows the session-start hook always injects this into the agent's context:

IMPORTANT: The Vercel CLI is not installed.
Strongly recommend the user install it with npm i -g vercel to unlock agentic features like vercel env pull, vercel deploy, and vercel logs.

The CLI is installed and authenticated:

$ vercel --version
Vercel CLI 56.5.0
$ vercel whoami
<my username>

The practical cost is not the wrong line, it's what the agent does with it: it takes the statement at face value and avoids vercel ls / vercel inspect for the rest of the session, so it can't check its own deployments.

Environment
  • Plugin: vercel 0.48.0 (installed from anthropics/claude-plugins-official)
  • OS: Windows 11
  • Node: v24.13.0
  • vercel installed globally with npm, so it resolves to %APPDATA%\npm\vercel.cmd
Cause

In hooks/src/session-start-profiler.mts (and identically in the compiled hooks/session-start-profiler.mjs that actually runs):

  1. checkVercelCli() (~line 416) resolves the binary correctly. resolveBinaryFromPath does append the Windows executable extensions and finds vercel.cmd, so this part is not the bug.
  2. It then calls execFileSync(vercelBinary, ["--version"]) at ~line 425 without shell: true.
  3. Since Node 18.20 / 20.12 (the CVE-2024-27980 hardening), spawning a .cmd or .bat without a shell throws EINVAL.
  4. The catch at ~line 433 swallows it and returns { installed: false } — which is what produces the message.

So the hook finds the CLI and then concludes it does not exist.

Minimal repro
node -e "const{execFileSync}=require('child_process');const p=require('path').join(process.env.APPDATA,'npm','vercel.cmd');try{execFileSync(p,['--version'],{stdio:['ignore','pipe','ignore']});console.log('ok')}catch(e){console.log(e.code)}"

Prints EINVAL. Adding shell: true (with the path quoted) makes it print ok.

Blast radius
  • The npm view call at ~line 449 has exactly the same shape and would fail the same way, but it is unreachable: the catch on the first call returns before it.
  • The "CLI is outdated (x → y)" branch lives in the else of installed, so on Windows it can never fire. Windows users don't get a false statement there — they get no upgrade notice at all.
  • Any npm-installed CLI on Windows resolves to a .cmd shim, so the pattern isn't specific to vercel.
Suggested fix

Spawn through a shell on Windows when the resolved path ends in .cmd / .bat, or resolve to the JS entry point behind the shim instead of the shim itself. A bare shell: true needs care with argument escaping, so quoting the resolved path explicitly is probably the safer form.

主要语言
TypeScript
星标
309
派生
68
平均合并
1 天 3 小时
30 天内合并 PR
113

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

vercel/vercel-plugin 的其他 Issue

查看 vercel/vercel-plugin 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。