knoxis-helper 1.4.7 → 1.4.8

package/lib/knoxis-interactive-pair.js

@@ -193,15 +193,30 @@ function runClaudeTurn(message, isResume) {
       args.push('--session-id', SESSION_ID);
     }
 
-    // shell: true on Windows so the claude.cmd shim resolves via PATHEXT.
-    // Required since Node 18.20.2/20.12.2 (CVE-2024-27980) refuses to spawn
-    // .cmd/.bat files without it.
-    const proc = spawn('claude', args, {
-      cwd: process.cwd(),
-      env: process.env,
-      stdio: ['pipe', 'pipe', 'pipe'],
-      shell: isWindows
-    });
+    // Windows: claude is usually claude.cmd (npm shim) or claude.exe.
+    // .cmd/.bat shims require going through cmd.exe (Node CVE-2024-27980).
+    // We can't just pass `shell: true` with an args array — that triggers
+    // DEP0190 in Node 22+ (args get concatenated into the shell command
+    // line without escaping). Instead, build the command line ourselves
+    // and pass it as a single string. Our args are static flags + a UUID
+    // (no whitespace, no quotes) so trivial space-quoting is sufficient.
+    let proc;
+    if (isWindows) {
+      const quote = a => /\s/.test(a) ? `"${a}"` : a;
+      const cmdLine = ['claude', ...args].map(quote).join(' ');
+      proc = spawn(cmdLine, [], {
+        cwd: process.cwd(),
+        env: process.env,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        shell: true
+      });
+    } else {
+      proc = spawn('claude', args, {
+        cwd: process.cwd(),
+        env: process.env,
+        stdio: ['pipe', 'pipe', 'pipe']
+      });
+    }
 
     let stdout = '';
     let stderr = '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "knoxis-helper",
-  "version": "1.4.7",
+  "version": "1.4.8",
   "description": "Local helper for Knoxis pair programming - connects your machine to Knoxis on qig.ai",
   "bin": {
     "knoxis-helper": "./bin/knoxis-helper.js"