fix(shared): spawn Windows cmd/bat shims without shell:true DEP0190

[macodev00]

What

• Spawn Windows .cmd/.bat shims via ComSpec /d /s /c with shell: false, windowsVerbatimArguments: true (so Node does not re-quote buildCmdExeCommandLine), and windowsHide: true, forwarded at every resolveSpawnCommand spawn site (incl. Effect platform patch).

Why

Fixes #12797

Redo of closed #12862 addressing Macroscope Not-approved / High quoting: verbatim /c line + hide console; regression tests for spaced paths and quoted args.

UI

No UI. Windows cmd/bat shim launches only.

Checklist

• I read CONTRIBUTING.md and kept this small / bug-only
• What + why explained above
• Followed AGENTS.md documentation rules (no new docs)
• No unrelated changes
• CLA / AI-reviewed standing override for macodev00 auto-contrib

Summary by CodeRabbit

• Bug Fixes

  • Improved Windows execution of command-line tools and batch files, including paths and arguments containing spaces or special characters.
  • Windows command shims now run through the system command processor with safer argument handling and hidden console windows.
  • Standardized process launching so platform-specific options are applied consistently across CLI tools, providers, maintenance tasks, and build workflows.

• Tests

  • Added coverage for Windows command quoting, escaping, and process-launch behavior.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This change alters the existing Windows .cmd/.bat process-launch contract across provider, server, and tooling paths, adding custom ComSpec quoting and a patched process-spawner dependency. Its intent and tests are clear, but the cross-cutting runtime impact is broader than a small isolated bug fix.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: pingdotgg/t3code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 6c573ef4-fd90-435c-b738-6ea29e60c0d1

📥 Commits

Reviewing files that changed from the base of the PR and between 1de563c and c0cb94d.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (29)

• apps/server/scripts/cli.ts
• apps/server/src/cli/triage.ts
• apps/server/src/process/externalLauncher.test.ts
• apps/server/src/process/externalLauncher.ts
• apps/server/src/processRunner.test.ts
• apps/server/src/processRunner.ts
• apps/server/src/provider/Drivers/ClaudeExecutable.ts
• apps/server/src/provider/Drivers/GrokSkills.ts
• apps/server/src/provider/Layers/ClaudeProvider.ts
• apps/server/src/provider/Layers/CodexProvider.ts
• apps/server/src/provider/Layers/CodexSessionRuntime.ts
• apps/server/src/provider/Layers/CursorProvider.ts
• apps/server/src/provider/Layers/GrokProvider.ts
• apps/server/src/provider/acp/AcpSessionRuntime.ts
• apps/server/src/provider/opencodeRuntime.ts
• apps/server/src/provider/providerMaintenanceRunner.test.ts
• apps/server/src/provider/providerMaintenanceRunner.ts
• apps/server/src/testUtils/fakeCli.ts
• apps/server/src/textGeneration/ClaudeTextGeneration.ts
• apps/server/src/textGeneration/CodexTextGeneration.ts
• packages/shared/src/shell.test.ts
• packages/shared/src/shell.ts
• patches/@effect__platform-node-shared@4.0.0-rc.115.patch
• pnpm-workspace.yaml
• scripts/build-cli-archive.ts
• scripts/build-desktop-artifact.ts
• scripts/dev-runner.ts
• scripts/mobile-native-client.ts
• scripts/mobile-native-static-check.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Windows command shim spawning

Layer / File(s)	Summary
Shared Windows spawn resolution packages/shared/src/shell.ts, packages/shared/src/shell.test.ts, patches/..., pnpm-workspace.yaml	Windows .cmd and .bat shims now use ComSpec with /d /s /c, shell: false, hidden windows, and verbatim arguments. Quoting and option propagation are tested and patched through the Effect platform dependency.
Server process spawn adoption apps/server/src/process/*, apps/server/src/provider/*, apps/server/src/textGeneration/*, apps/server/src/cli/*	Server process callers now use spawnOptionsFromResolvedCommand. Windows editor, provider, maintenance, and process-runner tests assert the ComSpec invocation and spawn flags.
Build and development spawn adoption scripts/*	Build, desktop, development, archive, and mobile scripts now apply the complete resolved spawn-option set.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Low

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant resolveSpawnCommand
  participant ChildProcess
  participant ComSpec
  Caller->>resolveSpawnCommand: Resolve executable and arguments
  resolveSpawnCommand->>Caller: Return ComSpec command and spawn options
  Caller->>ChildProcess: Spawn with shell false
  ChildProcess->>ComSpec: Execute /d /s /c command line

Loading

Suggested reviewers: juliusmarminge, t3dotgg

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 27 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: fixing Windows .cmd/.bat shim spawning without shell:true to address DEP0190.
Description check	✅ Passed	The description explains what changed and why, identifies the linked issue, states that there are no UI changes, and includes a checklist. The content is focused and sufficiently complete.
Linked Issues check	✅ Passed	The pull request satisfies the coding requirements in [#12797] and [#12862]. resolveSpawnCommand now routes Windows .cmd and .bat shims through ComSpec with /d /s /c, shell: false, `window…
Out of Scope Changes check	✅ Passed	The changes stay within [#12797] and [#12862]. Spawn-site updates apply the new resolver options consistently. The Effect platform patch is required to forward windowsVerbatimArguments. Tests, docum…

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 27 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}