knoxis-helper 1.4.6 → 1.4.8

package/lib/knoxis-interactive-pair.js

@@ -177,8 +177,10 @@ function callGroq(systemPrompt, userMessage) {
 // === RUN CLAUDE TURN ===
 function runClaudeTurn(message, isResume) {
   return new Promise((resolve) => {
-    // Check claude is available
-    const which = spawnSync('which', ['claude'], { stdio: 'pipe' });
+    // Check claude is available (Windows uses `where`, Unix uses `which`)
+    const isWindows = process.platform === 'win32';
+    const detector = isWindows ? 'where' : 'which';
+    const which = spawnSync(detector, ['claude'], { stdio: 'pipe' });
     if (which.status !== 0) {
       resolve({ stdout: '', stderr: 'claude CLI not found', code: 127 });
       return;
@@ -191,11 +193,30 @@ function runClaudeTurn(message, isResume) {
       args.push('--session-id', SESSION_ID);
     }
 
-    const proc = spawn('claude', args, {
-      cwd: process.cwd(),
-      env: process.env,
-      stdio: ['pipe', 'pipe', 'pipe']
-    });
+    // Windows: claude is usually claude.cmd (npm shim) or claude.exe.
+    // .cmd/.bat shims require going through cmd.exe (Node CVE-2024-27980).
+    // We can't just pass `shell: true` with an args array — that triggers
+    // DEP0190 in Node 22+ (args get concatenated into the shell command
+    // line without escaping). Instead, build the command line ourselves
+    // and pass it as a single string. Our args are static flags + a UUID
+    // (no whitespace, no quotes) so trivial space-quoting is sufficient.
+    let proc;
+    if (isWindows) {
+      const quote = a => /\s/.test(a) ? `"${a}"` : a;
+      const cmdLine = ['claude', ...args].map(quote).join(' ');
+      proc = spawn(cmdLine, [], {
+        cwd: process.cwd(),
+        env: process.env,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        shell: true
+      });
+    } else {
+      proc = spawn('claude', args, {
+        cwd: process.cwd(),
+        env: process.env,
+        stdio: ['pipe', 'pipe', 'pipe']
+      });
+    }
 
     let stdout = '';
     let stderr = '';
@@ -337,7 +358,10 @@ async function main() {
   if (phase1.code !== 0 && !phase1.stdout) {
     console.log('');
     console.log('  Phase 1 failed (exit ' + phase1.code + '). Falling back to single-shot.');
-    appendLog('Phase 1 failed. Falling back to single-shot.\n');
+    if (phase1.stderr) {
+      console.log('  stderr: ' + phase1.stderr.split('\n').slice(0, 5).join('\n  '));
+    }
+    appendLog('Phase 1 failed (exit ' + phase1.code + '). stderr: ' + (phase1.stderr || '(empty)') + '\n');
     const code = await runSingleShot(task);
     const logFile = saveSessionLog();
     if (logFile) console.log('  Log: ' + logFile);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "knoxis-helper",
-  "version": "1.4.6",
+  "version": "1.4.8",
   "description": "Local helper for Knoxis pair programming - connects your machine to Knoxis on qig.ai",
   "bin": {
     "knoxis-helper": "./bin/knoxis-helper.js"