@trops/dash-core 0.1.407 → 0.1.409

package/dist/electron/index.js

@@ -25715,6 +25715,22 @@ const DEFAULT_TOOL_CACHE_TTL = 5000;
 
 const IS_WINDOWS$1 = process.platform === "win32";
 
+/**
+ * Quote a string for cmd.exe when `shell: true` is in effect. With
+ * shell:true on Windows, Node joins command+args into one string and
+ * hands it to `cmd.exe /d /s /c`, which tokenizes on whitespace. A
+ * path like `C:\Users\First Name\AppData\Local\Programs\Dash\Dash.exe`
+ * (what `process.execPath` returns for a packaged app when the user's
+ * folder name contains a space) parses as two tokens without quoting
+ * and the spawn fails with ENOENT. No-op when the string has no
+ * whitespace or quote character.
+ */
+function windowsQuote$1(s) {
+  const str = String(s);
+  if (!/[\s"]/.test(str)) return str;
+  return `"${str.replace(/"/g, '""')}"`;
+}
+
 /**
  * Cached shell PATH result (resolved once, reused for all spawns).
  */
@@ -26675,7 +26691,13 @@ const mcpController$2 = {
 
     return new Promise((resolve) => {
       const resolvedCmd = resolveNodeCommand(authCommand.command, env);
-      const proc = spawn(resolvedCmd.command, resolvedArgs, {
+      const spawnCmd = IS_WINDOWS$1
+        ? windowsQuote$1(resolvedCmd.command)
+        : resolvedCmd.command;
+      const spawnArgs = IS_WINDOWS$1
+        ? resolvedArgs.map(windowsQuote$1)
+        : resolvedArgs;
+      const proc = spawn(spawnCmd, spawnArgs, {
         env: resolvedCmd.env,
         stdio: ["ignore", "pipe", "pipe"],
         // Needed so Windows can launch .cmd/.bat wrappers (npx.cmd, etc).
@@ -28104,7 +28126,8 @@ var schedulerController_1 = schedulerController$2;
 	        if (!entry.description && manifest.description)
 	          entry.description = manifest.description;
 	        if (!entry.author && manifest.author) entry.author = manifest.author;
-	        if (!entry.version && manifest.version) entry.version = manifest.version;
+	        if (!entry.version && manifest.version)
+	          entry.version = manifest.version;
 	      } catch (err) {
 	        console.warn(
 	          `[WidgetRegistry] Could not parse dash.json at ${dashJsonPath}:`,
@@ -51449,6 +51472,20 @@ const {
 
 const IS_WINDOWS = process.platform === "win32";
 
+/**
+ * Quote a string for cmd.exe when `shell: true` is in effect. With
+ * shell:true on Windows, Node joins command+args into one string and
+ * hands it to `cmd.exe /d /s /c`, which tokenizes on whitespace. A
+ * path like `C:\Users\First Name\AppData\...\claude.cmd` would parse
+ * as two tokens (`C:\Users\First` + junk) without quoting. No-op when
+ * the string has no whitespace or quote character.
+ */
+function windowsQuote(s) {
+  const str = String(s);
+  if (!/[\s"]/.test(str)) return str;
+  return `"${str.replace(/"/g, '""')}"`;
+}
+
 /**
  * Cached shell PATH result (resolved once, reused for all spawns).
  * Same pattern as mcpController.js.
@@ -51720,7 +51757,9 @@ const cliController$2 = {
         }
         spawnOpts.cwd = cwd;
       }
-      const child = spawn(binaryPath, args, spawnOpts);
+      const spawnCmd = IS_WINDOWS ? windowsQuote(binaryPath) : binaryPath;
+      const spawnArgs = IS_WINDOWS ? args.map(windowsQuote) : args;
+      const child = spawn(spawnCmd, spawnArgs, spawnOpts);
 
       activeProcesses.set(requestId, child);