Commit c08093c2b136353bc755459febf3e8afd46bf50e | the-knife

author	Theo Browne <me@t3.gg> 2026-10-14 04:17:42-07:00
committer	GitHub <noreply@github.com> 2026-10-14 04:17:42-07:00
log	c08093c2b136353bc755459febf3e8afd46bf50e
tree	caf38ab6b1a6bc72110baa52e250a80eb2de62a6
parent	f5b5f9dd7be29c4f55f4687dda15e4105cf966fc
signature	Signed by PGP key B5690EEEBB952194

fix(shared): Windows .cmd shims no longer print DEP0190 on every spawn (#19385)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

8 files changed, 89 insertions(+), 75 deletions(-)

apps
- server
  - src
    orchestration-v2
    Adapters
    CodexAdapterV2.test.ts
    process
    externalLauncher.test.ts
    processRunner.test.ts
    provider
    providerMaintenanceRunner.test.ts
packages
- shared
  - src
    shell.test.ts
    shell.ts
scripts
- dev-runner.ts
- mobile-native-static-check.ts

apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts+5-2

 @@ -693,8 +693,11 @@ describe("CodexAdapterV2 process spawning", () => {
       if (!ChildProcess.isStandardCommand(command)) {
         return;
       }
-      assert.equal(command.command, '^"C:\\npm\\codex.cmd^"');
+      assert.equal(
-      assert.deepEqual(command.args, ['^"app-server^"', '^"argument^ with^ spaces^"']);
+        command.command,
+        '^"C:\\npm\\codex.cmd^" ^"app-server^" ^"argument^ with^ spaces^"',
+      );
+      assert.deepEqual(command.args, []);
       assert.equal(command.options.shell, true);
       assert.equal(command.options.cwd, "C:\\workspace");
       assert.deepEqual(command.options.env, { CUSTOM: "1" });

apps/server/src/process/externalLauncher.test.ts+29-18

 @@ -153,11 +153,15 @@ it.effect("launches an installed editor with platform-safe arguments", () =>
     );
     assert.ok(spawned);
-    assert.equal(spawned.command, '^"C:\\Program^ Files\\Microsoft^ VS^ Code\\bin\\code.CMD^"');
+    assert.equal(
-    assert.deepEqual(spawned.args, [
+      spawned.command,
-      '^"--goto^"',
+      [
-      '^"C:\\workspace^ with^ spaces\\src\\index.ts:12:4^"',
+        '^"C:\\Program^ Files\\Microsoft^ VS^ Code\\bin\\code.CMD^"',
-    ]);
+        '^"--goto^"',
+        '^"C:\\workspace^ with^ spaces\\src\\index.ts:12:4^"',
+      ].join(" "),
+    );
+    assert.deepEqual(spawned.args, []);
     assert.equal(spawned.options.shell, true);
   }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
 );
 @@ -241,12 +245,16 @@ it.effect("launches Cursor in classic IDE mode through the Windows command shim"
     );
     assert.ok(spawned);
-    assert.equal(spawned.command, '^"C:\\Program^ Files\\Cursor\\bin\\cursor.CMD^"');
+    assert.equal(
-    assert.deepEqual(spawned.args, [
+      spawned.command,
-      '^"--classic^"',
+      [
-      '^"--goto^"',
+        '^"C:\\Program^ Files\\Cursor\\bin\\cursor.CMD^"',
-      '^"C:\\workspace^ with^ spaces\\src\\index.ts:12:4^"',
+        '^"--classic^"',
-    ]);
+        '^"--goto^"',
+        '^"C:\\workspace^ with^ spaces\\src\\index.ts:12:4^"',
+      ].join(" "),
+    );
+    assert.deepEqual(spawned.args, []);
     assert.equal(spawned.options.shell, true);
   }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
 );
 @@ -1033,12 +1041,13 @@ for (const { platform, installPath, editor, args } of [
           ),
         );
         assert.ok(spawned);
+        const shim = executable.endsWith(".cmd");
         assert.equal(
           spawned.command,
-          executable.endsWith(".cmd") ? `^"${executable.replaceAll(" ", "^ ")}^"` : executable,
+          shim ? [`^"${executable.replaceAll(" ", "^ ")}^"`, ...args].join(" ") : executable,
         );
-        assert.deepEqual(spawned.args, args);
+        assert.deepEqual(spawned.args, shim ? [] : args);
-        assert.equal(spawned.options.shell, executable.endsWith(".cmd"));
+        assert.equal(spawned.options.shell, shim);
       }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
   );
 }
 @@ -1476,10 +1485,12 @@ it.effect("starts a Windows command shim for unicode paths with cmd metacharacte
     assert.isTrue(Exit.isSuccess(exit));
     assert.ok(spawned);
     assert.equal(spawned.options.shell, true);
-    assert.deepEqual(spawned.args, [
+    assert.deepEqual(spawned.args, []);
-      '^"--goto^"',
+    assert.isTrue(
-      '^"C:\\Users\\jö\\R^&D^ ^(100^%^)\\naïve^ ^^file^!.ts:3:7^"',
+      spawned.command.endsWith(
-    ]);
+        ' ^"--goto^" ^"C:\\Users\\jö\\R^&D^ ^(100^%^)\\naïve^ ^^file^!.ts:3:7^"',
+      ),
+    );
   }),
 );

apps/server/src/processRunner.test.ts+11-8

...	@@ -127,14 +127,17 @@ describe("runProcess", () => {	...	@@ -127,14 +127,17 @@ describe("runProcess", () => {
127	it.effect("resolves and escapes Windows command shims before spawning", () => {	127	it.effect("resolves and escapes Windows command shims before spawning", () => {
128	const spawner = makeSpawner((command) =>	128	const spawner = makeSpawner((command) =>
129	Effect.sync(() => {	129	Effect.sync(() => {
130	expect(command.command).toBe('^"C:\\Users\\tester\\AppData\\Roaming\\npm\\az.cmd^"');	130	expect(command.command).toBe(
131	expect(command.args).toEqual([	131	[
132	'^"repos^"',	132	'^"C:\\Users\\tester\\AppData\\Roaming\\npm\\az.cmd^"',
133	'^"pr^"',	133	'^"repos^"',
134	'^"list^"',	134	'^"pr^"',
135	'^"--source-branch^"',	135	'^"list^"',
136	'^"feature^ ^&^ release^"',	136	'^"--source-branch^"',
137	]);	137	'^"feature^ ^&^ release^"',
		138	].join(" "),
		139	);
		140	expect(command.args).toEqual([]);
138	expect(command.options.shell).toBe(true);	141	expect(command.options.shell).toBe(true);
139	return makeHandle({ stdout: "[]" });	142	return makeHandle({ stdout: "[]" });
140	}),	143	}),

apps/server/src/provider/providerMaintenanceRunner.test.ts+6-11

 @@ -943,21 +943,16 @@ describe("providerMaintenanceRunner", () => {
       const result = yield* runner.updateProvider(CODEX_DRIVER);
       // On win32, resolveSpawnCommand resolves `npm` to the `.cmd` shim and
-      // routes the spawn through cmd.exe (shell: true), escaping every arg.
+      // routes the spawn through cmd.exe (shell: true) as one escaped line.
       assert.strictEqual(captured.length, 1);
       const call = captured[0];
       assert.ok(call, "expected the spawner to be invoked once");
-      // The resolved command is the escaped `.cmd` path. Asserting the precise
+      assert.strictEqual(
-      // escaped string is brittle, so verify it carries the resolved shim and
+        call.command,
-      // that shell mode was used.
+        '^"C:\\fake\\npm\\npm.cmd^" ^"install^" ^"-g^" ^"@openai/codex@latest^"',
-      assert.match(call.command, /npm\.cmd/i);
+      );
+      assert.deepEqual(call.args, []);
       assert.strictEqual(call.shell, true);
-      // Args are escaped for cmd.exe shell mode (each quoted) but still carry
-      // the original install command (`install -g @openai/codex@latest`) in order.
-      assert.strictEqual(call.args.length, 3);
-      assert.match(call.args[0] ?? "", /install/);
-      assert.match(call.args[1] ?? "", /-g/);
-      assert.match(call.args[2] ?? "", /@openai\/codex@latest/);
       assert.strictEqual(result.providers[0]?.updateState?.status, "succeeded");
     }).pipe(
       Effect.provide(

packages/shared/src/shell.test.ts+25-11

 @@ -681,11 +681,19 @@ effectIt.layer(NodeServices.layer)("resolveSpawnCommand", (it) => {
     }),
   );
-  it.effect("escapes the executable and arguments for Windows command shims", () =>
+  it.effect("builds one escaped cmd.exe line for Windows command shims", () =>
     Effect.gen(function* () {
       const command = yield* resolveSpawnCommand(
         "vp",
-        ["run", "value & calc", "%PATH%", 'quote"value'],
+        [
+          "run",
+          "value & calc",
+          "%PATH%",
+          'quote"value',
+          "C:\\dir with space\\",
+          'slash\\"quote',
+          "x|y<z>^",
+        ],
         { env: { PATH: "", PATHEXT: ".COM;.EXE;.BAT;.CMD" } },
       ).pipe(
         Effect.provideService(HostProcess.Platform, "win32"),
 @@ -696,15 +704,21 @@ effectIt.layer(NodeServices.layer)("resolveSpawnCommand", (it) => {
         ),
       );
-      expect(command.shell).toBe(true);
+      // No args alongside `shell: true`: Node prints DEP0190 for that pairing.
-      expect(command.command).not.toContain(" & ");
+      expect(command).toEqual({
-      expect(command.command).toContain("^&");
+        command: [
-      expect(command.args).toEqual([
+          String.raw`^"C:\Program^ Files\npm^ ^&^ tools\vp.cmd^"`,
-        '^"run^"',
+          String.raw`^"run^"`,
-        '^"value^ ^&^ calc^"',
+          String.raw`^"value^ ^&^ calc^"`,
-        '^"^%PATH^%^"',
+          String.raw`^"^%PATH^%^"`,
-        '^"quote\\^"value^"',
+          String.raw`^"quote\^"value^"`,
-      ]);
+          String.raw`^"C:\dir^ with^ space\\^"`,
+          String.raw`^"slash\\\^"quote^"`,
+          String.raw`^"x^|y^<z^>^^^"`,
+        ].join(" "),
+        args: [],
+        shell: true,
+      });
     }),
   );

packages/shared/src/shell.ts+9-18

 @@ -46,10 +46,10 @@ const WINDOWS_SHELL_META_CHARS = /([()\][%!^"`<>&|;, *?])/g;
 /**
  * Escapes a single argument for `cmd.exe` shell mode (`spawn(..., { shell: true })`
- * on Windows). Node joins the command and arguments with spaces and hands the
+ * on Windows). Node hands the command string to `cmd.exe /d /s /c "<command>"`
- * resulting string to `cmd.exe` without any quoting, so every dynamic argument
+ * without any quoting, so every dynamic argument must be escaped to survive both
- * must be escaped to survive both cmd.exe parsing and the target program's
+ * cmd.exe parsing and the target program's `CommandLineToArgvW` parsing.
- * `CommandLineToArgvW` parsing. Mirrors cross-spawn's argument escaping.
+ * Mirrors cross-spawn's argument escaping.
  */
 function escapeWindowsShellArg(arg: string): string {
   // Double up backslashes that precede a double quote, then escape the quote
 @@ -63,18 +63,6 @@ function escapeWindowsShellArg(arg: string): string {
   return escaped.replace(WINDOWS_SHELL_META_CHARS, "^$1");
 }
-/**
- * Escapes arguments for shell-mode spawns: applies {@link escapeWindowsShellArg}
- * when the platform is `win32` (where `shell: true` routes through `cmd.exe`)
- * and returns the arguments untouched everywhere else.
- */
-function sanitizeShellModeArgsForPlatform(
-  args: ReadonlyArray<string>,
-  platform: NodeJS.Platform,
-): Array<string> {
-  return platform === "win32" ? args.map(escapeWindowsShellArg) : [...args];
-}
 export interface ResolvedSpawnCommand {
   readonly command: string;
   readonly args: ReadonlyArray<string>;
 @@ -773,9 +761,12 @@ export const resolveSpawnCommand = Effect.fnUntraced(function* (
     return { command: resolvedCommand, args: [...args], shell: false };
   }
+  // Node runs a shell spawn as `cmd.exe /d /s /c "<command> <args...>"`, but
+  // passing args with `shell: true` prints DEP0190. Build the same escaped line
+  // here and pass no args.
   return {
-    command: escapeWindowsShellArg(resolvedCommand),
+    command: [resolvedCommand, ...args].map(escapeWindowsShellArg).join(" "),
-    args: sanitizeShellModeArgsForPlatform(args, platform),
+    args: [],
     shell: true,
   };
 });

scripts/dev-runner.ts+3-6

 @@ -791,15 +791,12 @@ export function runDevRunnerWithInput(input: DevRunnerCliInput) {
       }
     }
-    const spawnCommand = yield* resolveSpawnCommand(
+    const args = [...MODE_ARGS[input.mode], ...input.runArgs];
-      "vp",
+    const spawnCommand = yield* resolveSpawnCommand("vp", args, { env });
-      [...MODE_ARGS[input.mode], ...input.runArgs],
-      { env },
-    );
     const processContext = {
       mode: input.mode,
       executable: "vp" as const,
-      argumentCount: spawnCommand.args.length,
+      argumentCount: args.length,
       shell: spawnCommand.shell,
     } as const;
     const child = yield* ChildProcess.make(spawnCommand.command, spawnCommand.args, {

scripts/mobile-native-static-check.ts+1-1

...	@@ -127,7 +127,7 @@ export const runCommand = Effect.fn("runCommand")(function* (	...	@@ -127,7 +127,7 @@ export const runCommand = Effect.fn("runCommand")(function* (
127	const spawnCommand = yield* resolveSpawnCommand(command, args);	127	const spawnCommand = yield* resolveSpawnCommand(command, args);
128	const processContext = {	128	const processContext = {
129	command,	129	command,
130	argumentCount: spawnCommand.args.length,	130	argumentCount: args.length,
131	cwd,	131	cwd,
132	shell: spawnCommand.shell,	132	shell: spawnCommand.shell,
133	} as const;	133	} as const;