Bug: The npm wrapper's execSync drops quotes in arguments, breaking complex commands in service exec

[gloomcheng]

Describe the bug

When using npx zeabur service exec to run a command that contains quotes (such as bash -c "sed -i '...'"), the command fails because the quotes and escaped characters are stripped by the npm wrapper.

To Reproduce

Run a command with quotes using the npx wrapper:

npx zeabur service exec --id <service_id> -- bash -c "echo 'hello world'"

The quotes are dropped when the underlying Go binary is executed.

Root Cause

In the published NPM package, index.js parses and executes the binary like this:

const args = process.argv.slice(2);
execSync(`${pathToBinary} ${args.join(" ")}`, { stdio: "inherit" });

Using args.join(" ") flattens the arguments into a single string, stripping the original argument boundaries and quotes. When execSync runs, the shell evaluates the flattened string, breaking complex commands containing spaces, pipes, or quotes.

Expected behavior

The npm wrapper should pass the arguments exactly as provided, preserving quotes, spaces, and special characters.

Suggested Fix

Use spawnSync instead of execSync with a joined string, which allows passing the arguments array directly to the executable without shell interpolation.

import { spawnSync } from "child_process";

// ...
const args = process.argv.slice(2);
spawnSync(pathToBinary, args, { stdio: "inherit" });