@venturewild/workspace 0.6.27 → 0.6.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venturewild/workspace",
-  "version": "0.6.27",
+  "version": "0.6.28",
   "description": "Claude Code Web — Replit/Lovable-style chat-first browser UI that wraps the AI agent already installed on your machine.",
   "license": "MIT",
   "bin": {

package/server/src/agent.mjs

@@ -46,13 +46,32 @@ export function ensureToolPath(env = process.env, { platform = process.platform,
   return env.PATH;
 }
 
+// On Windows, `where.exe <binary>` lists the extensionless POSIX npm shim
+// (e.g. `…\AppData\Roaming\npm\claude`) BEFORE claude.cmd. spawn() with
+// shell:false can't run that shim — it's a sh script — so a npm-installed
+// Claude resolved to ENOENT (caught live 2026-06-26). Prefer a real Windows
+// launcher (.cmd > .exe > .bat); fall back to the first hit if none. Exported
+// for unit testing.
+export function pickWindowsBinary(lines) {
+  const list = Array.isArray(lines) ? lines : [];
+  for (const ext of ['.exe', '.cmd', '.bat']) {
+    const re = new RegExp(ext.replace('.', '\\.') + '$', 'i');
+    const hit = list.find((l) => re.test(l.trim()));
+    if (hit) return hit.trim();
+  }
+  return list[0]?.trim() || null;
+}
+
 async function isOnPath(binary) {
   ensureToolPath(); // make sure the tool dirs are on PATH before we look
   const probe = process.platform === 'win32' ? 'where.exe' : 'which';
   try {
     const { stdout } = await execFile(probe, [binary], { timeout: PATH_LOOKUP_TIMEOUT_MS });
     const lines = stdout.split(/\r?\n/).filter(Boolean);
-    if (lines.length > 0) return lines[0].trim();
+    if (lines.length > 0) {
+      // Skip the extensionless npm shim on Windows (see pickWindowsBinary).
+      return process.platform === 'win32' ? pickWindowsBinary(lines) : lines[0].trim();
+    }
   } catch { /* fall through to a direct probe */ }
   // which/where can still miss a freshly-installed binary in a stripped launchd
   // environment — probe the known install dirs directly and return an ABSOLUTE
@@ -180,12 +199,19 @@ export class AgentSession extends EventEmitter {
         ? buildClaudeArgs(this.agent.args, ctx)
         : [...this.agent.args];
     // Prefer the resolved absolute path from detection; fall back to the bare
-    // name. claude ships a native binary, so shell:false spawns cleanly.
+    // name. On Windows a npm-installed Claude resolves to claude.cmd — which
+    // Node refuses to spawn with shell:false (CVE-2024-27980) — so a .cmd/.bat
+    // shim (or the extensionless npm shim, which cmd rescues via PATHEXT) must
+    // go through cmd.exe. A real .exe (node, native claude.exe) spawns
+    // directly with shell:false, so tests + native installs are untouched.
+    // POSIX keeps shell:false (the native binary there spawns directly).
     const command = this.agent.resolvedPath || this.agent.binary;
+    const isWin = process.platform === 'win32';
+    const needsShell = isWin && !/\.exe$/i.test(command);
     this.proc = spawn(command, args, {
       cwd: ctx.cwd || this.opts.cwd || process.cwd(),
       env: { ...process.env, ...(ctx.env || {}) },
-      shell: false,
+      shell: needsShell,
       stdio: ['pipe', 'pipe', 'pipe'],
       windowsHide: true,
     });