fix(shared): avoid DEP0190 when spawning .cmd/.bat shims on Windows

[cestercian]

Summary

On Windows with Node 24, resolveSpawnCommand was returning a .cmd/.bat path plus an args array with shell: true, which triggers DEP0190.

Return a single command string with an empty args array for those shims so Node expands shell: true as %ComSpec% /d /s /c "…", while .exe/.com stay shell: false.

Test plan

• vp test run packages/shared/src/shell.test.ts apps/server/src/provider/providerMaintenanceRunner.test.ts (50 passed)

Fixes #12797

Summary by CodeRabbit

• Bug Fixes
  • Improved execution of Windows .cmd and .bat tools, including editor launches and maintenance commands.
  • Prevented shell command failures with arguments in newer Node.js versions by passing the complete escaped command line to the Windows shell.
  • Improved escaping of command names, flags, and file paths to help ensure Windows commands run as expected.

[macroscopeapp]

Approvability

Verdict: Approved at 7a3cb01

Macroscope's review found this PR approvable — The PR is a focused Windows compatibility fix that preserves existing .cmd/.bat execution while avoiding Node 24’s deprecated shell-spawn argument shape. Runtime, editor, maintenance, and escaping cases are covered by targeted test updates, with no product-default or deployment changes.

Notes:

• Diff unchanged. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 224a5590-e85f-4994-92fc-c6c440447bff

📥 Commits

Reviewing files that changed from the base of the PR and between 3185106 and 7a3cb01.

📒 Files selected for processing (2)

• apps/server/src/process/externalLauncher.test.ts
• apps/server/src/processRunner.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The Windows .cmd and .bat spawn path now escapes the executable and arguments into one command string and passes an empty args array with shell: true. Related tests and comments reflect this command shape and its Node 24 DEP0190 context.

Changes

Windows shell shim handling

Layer / File(s)	Summary
Escaped command-line construction packages/shared/src/shell.ts	resolveSpawnCommand now joins the escaped command and arguments into command and returns args: [] for Windows .cmd and .bat shims.
Shim spawn validation and context packages/shared/src/shell.test.ts, apps/server/src/provider/providerMaintenanceRunner.test.ts, apps/server/src/process/externalLauncher.test.ts, apps/server/src/processRunner.test.ts, apps/server/src/provider/providerMaintenanceRunner.ts, apps/server/src/provider/Drivers/ClaudeExecutable.ts	Tests check the combined command shape for Windows shims in shared-shell, provider maintenance, editor-launch, and process-runner cases. Comments and JSDoc describe the empty-argument-array behavior and DEP0190 context.

Estimated code review effort: 2 (Simple) | ~15 minutes

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 7a3cb

The Windows shim change can proceed through normal merge checks; no actionable regression or sensitive-data exposure was established.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR addresses the DEP0190 argument shape for issue #12797. For Windows .cmd and .bat shims, it folds the escaped command and arguments into command and uses args: []. Tests cover this shape…	For .cmd and .bat shims, spawn process.env.ComSpec || "cmd.exe" with /d, /s, /c, and the escaped command line. Use shell: false, windowsHide: true, and the required verbatim-argument setting at the spawn site. Add tests for …

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: avoiding Node 24 DEP0190 when spawning Windows .cmd and .bat shims.
Description check	✅ Passed	The description explains the Windows Node 24 problem, the change to command and args handling, retained behavior for .exe and .com files, test results, and the linked issue. It uses Summary and Test p…
Out of Scope Changes check	✅ Passed	The changed helper, provider maintenance code and tests, process-launcher tests, and comments support the Windows shim spawn behavior for issue #12797. No unrelated product behavior is shown.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 7 files.

Full details: Linked Issues check

Explanation

The PR addresses the DEP0190 argument shape for issue #12797. For Windows .cmd and .bat shims, it folds the escaped command and arguments into command and uses args: []. Tests cover this shape. The PR keeps shell: true, so it does not meet the issue requirement to avoid stray cmd.exe tabs by spawning ComSpec directly with shell: false and windowsHide: true, or by using the real executable. The .exe and .com paths remain on the shell: false path.

Resolution

For .cmd and .bat shims, spawn process.env.ComSpec || "cmd.exe" with /d, /s, /c, and the escaped command line. Use shell: false, windowsHide: true, and the required verbatim-argument setting at the spawn site. Add tests for the direct ComSpec arguments and hidden-window option. Preserve the .exe and .com behavior.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate 7a3cb01

Dismissing prior approval to re-evaluate 7a3cb01