fix(init): refine recursive setup command guards

Author: betegon

src/lib/init/tools/command-utils.ts

@@ -119,24 +119,78 @@ function isSentryCliPackageSpec(token: string): boolean {
   return lower === "@sentry/cli" || lower.startsWith("@sentry/cli@");
 }
 
+function isSentryWizardPackageSpec(token: string): boolean {
+  const lower = token.toLowerCase();
+  return lower === "@sentry/wizard" || lower.startsWith("@sentry/wizard@");
+}
+
 function isExecutablePackageSpec(executable: string, name: string): boolean {
   return executable === name || executable.startsWith(`${name}@`);
 }
 
-function isRecursiveSentrySetup(tokens: string[]): boolean {
-  if (tokens.some((token) => token.toLowerCase().includes("@sentry/wizard"))) {
-    return true;
+function findFirstNonOptionIndex(
+  tokens: string[],
+  startIndex: number
+): number | undefined {
+  for (let index = startIndex; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (!token) {
+      continue;
+    }
+    if (token === "--") {
+      return index + 1 < tokens.length ? index + 1 : undefined;
+    }
+    if (token.startsWith("-")) {
+      continue;
+    }
+    return index;
   }
 
+  return;
+}
+
+function findPackageExecutionTokenIndex(tokens: string[]): number | undefined {
+  const firstExecutable = normalizeExecutableName(tokens[0] ?? "");
+  if (
+    isExecutablePackageSpec(firstExecutable, "npx") ||
+    isExecutablePackageSpec(firstExecutable, "bunx")
+  ) {
+    return findFirstNonOptionIndex(tokens, 1);
+  }
+
+  const subcommandIndex = findFirstNonOptionIndex(tokens, 1);
+  if (subcommandIndex === undefined) {
+    return;
+  }
+
+  const subcommand = normalizeExecutableName(tokens[subcommandIndex] ?? "");
+  if (subcommand !== "exec" && subcommand !== "dlx") {
+    return;
+  }
+
+  return findFirstNonOptionIndex(tokens, subcommandIndex + 1);
+}
+
+function canExecuteToken(tokens: string[], index: number): boolean {
+  return index === 0 || index === findPackageExecutionTokenIndex(tokens);
+}
+
+function isRecursiveSentrySetup(tokens: string[]): boolean {
   return tokens.some((token, index) => {
-    if (isSentryCliPackageSpec(token)) {
-      return hasInitArgAfter(tokens, index);
+    if (!canExecuteToken(tokens, index)) {
+      return false;
     }
 
     const executable = normalizeExecutableName(token);
-    if (isExecutablePackageSpec(executable, "sentry-wizard")) {
+    if (
+      isSentryWizardPackageSpec(token) ||
+      isExecutablePackageSpec(executable, "sentry-wizard")
+    ) {
       return true;
     }
+    if (isSentryCliPackageSpec(token)) {
+      return hasInitArgAfter(tokens, index);
+    }
     if (
       !(
         isExecutablePackageSpec(executable, "sentry") ||

src/lib/init/tools/run-commands.ts

@@ -17,7 +17,7 @@ function isWindowsBatchShim(executable: string): boolean {
 }
 
 function quoteWindowsCommandArg(value: string): string {
-  return `"${value.replace(/\^/g, "^^").replace(/"/g, '""')}"`;
+  return `"${value.replace(/"/g, '""')}"`;
 }
 
 function buildWindowsBatchCommand(executable: string, args: string[]): string {

test/lib/init/tools/run-commands-spawn.mocked.test.ts

@@ -112,7 +112,7 @@ describe("runCommands spawn options", () => {
         "/d",
         "/s",
         "/c",
-        '""C:\\Tools\\pnpm.CMD" "--filter" "./apps/web app" "add" "@sentry/nextjs@^^8.0.0""',
+        '""C:\\Tools\\pnpm.CMD" "--filter" "./apps/web app" "add" "@sentry/nextjs@^8.0.0""',
       ],
       options: { shell: false },
     });

test/lib/init/tools/run-commands.test.ts

@@ -37,6 +37,9 @@ describe("validateCommand", () => {
     ).toBeUndefined();
     expect(validateCommand("dotnet list package")).toBeUndefined();
     expect(validateCommand("futurepm explain sentry-sdk")).toBeUndefined();
+    expect(validateCommand("futurepm explain sentry-wizard")).toBeUndefined();
+    expect(validateCommand("npm uninstall sentry-wizard")).toBeUndefined();
+    expect(validateCommand("npm uninstall @sentry/wizard")).toBeUndefined();
   });
 
   test("allows path-prefixed package managers but blocks dangerous ones", () => {
@@ -108,6 +111,12 @@ describe("validateCommand", () => {
     expect(validateCommand("npx sentry-wizard@latest -i nextjs")).toContain(
       "invokes Sentry setup recursively"
     );
+    expect(validateCommand("npm exec @sentry/wizard -i nextjs")).toContain(
+      "invokes Sentry setup recursively"
+    );
+    expect(validateCommand("pnpm dlx sentry-wizard -i nextjs")).toContain(
+      "invokes Sentry setup recursively"
+    );
     expect(validateCommand("C:\\Tools\\sentry-wizard.cmd -i nextjs")).toContain(
       "invokes Sentry setup recursively"
     );