@wrongstack/acp 0.276.4 → 0.277.0

package/dist/client.js

@@ -4,6 +4,32 @@ import * as path from 'path';
 import { spawn } from 'child_process';
 import '@wrongstack/core/coordination';
 
+// src/agent/stdio-transport.ts
+
+// src/win32-cmd.ts
+var WIN32_CMD_META = /[&|<>"\r\n\0]/;
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32CmdArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function assertSafeWin32CmdArgs(args) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
+      throw new Error(
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
+      );
+    }
+  }
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
+
 // src/agent/stdio-transport.ts
 var ClientTransport = class {
   child = null;
@@ -35,19 +61,14 @@ var ClientTransport = class {
       const isPkgLauncher = this.opts.command === "npx" || this.opts.command === "uvx";
       const spawnCwd = isPkgLauncher ? os.homedir() : this.opts.cwd;
       try {
-        this.child = spawn2(this.opts.command, this.opts.args ?? [], {
+        const childArgs = this.opts.args ?? [];
+        const shim = process.platform === "win32" ? buildWin32CmdShimInvocation(this.opts.command, childArgs) : null;
+        this.child = spawn2(shim?.command ?? this.opts.command, shim?.args ?? childArgs, {
           env: { ...buildChildEnv(), ...this.opts.env },
           cwd: spawnCwd,
           stdio: ["pipe", "pipe", "pipe"],
           windowsHide: true,
-          // On Windows, most ACP-supporting tools (claude, gemini, codex,
-          // qwen, copilot) are installed as `.cmd` shims under
-          // AppData\Roaming\npm\. Node's spawn won't find them via
-          // `shell: false` because the .cmd extension is not in the
-          // default PATHEXT lookup. The argv here is always from our
-          // own static catalog or from a hardcoded spec, never from
-          // user input, so shell-expansion is bounded.
-          shell: process.platform === "win32"
+          ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
         });
       } catch (err) {
         clearTimeout(timeout);