kushi-agents 4.2.2 → 4.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kushi-agents",
-  "version": "4.2.2",
+  "version": "4.2.3",
   "description": "Install Kushi — multi-source project evidence agent with snapshot+stream capture across Email, Teams, OneNote, SharePoint, Meetings, CRM, ADO. WorkIQ-only for M365 sources (Graph / m365_* FORBIDDEN as fallbacks; user-paste is first-class). Host-agnostic.",
   "type": "module",
   "bin": {

package/src/check-workiq.mjs

@@ -78,15 +78,23 @@ function findOnPath(name) {
 }
 
 function runVersion(binPath) {
-  // Windows requires shell:true to spawn .cmd / .bat / shim files. The DEP0190
-  // warning is harmless here because we control both binPath (resolved via
-  // `where` / explicit --workiq-path) and args (literal ['--version']).
+  // Windows requires shell:true to spawn .cmd / .bat shim files (Node can't
+  // exec them directly). To avoid the DEP0190 deprecation warning that fires
+  // when args + shell are combined, we put the whole command into the
+  // `command` string and pass NO args array. binPath is controlled (resolved
+  // via `where` or explicit --workiq-path), and the literal `--version`
+  // suffix is hard-coded — no injection surface.
   const isWin = process.platform === 'win32';
-  const res = spawnSync(binPath, ['--version'], {
-    encoding: 'utf-8',
-    timeout: 10_000,
-    shell: isWin,
-  });
+  const res = isWin
+    ? spawnSync(`"${binPath}" --version`, {
+        encoding: 'utf-8',
+        timeout: 10_000,
+        shell: true,
+      })
+    : spawnSync(binPath, ['--version'], {
+        encoding: 'utf-8',
+        timeout: 10_000,
+      });
   if (res.status !== 0) {
     return {
       ok: false,