fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7913) (#7964)

* fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7913)

runOpenCodeAuth spawned the opencode.cmd shim with shell:false on win32,
which throws spawnSync EINVAL under Node's hardened child_process
handling (post CVE-2024-27980). Mirrors the fix already applied to
codex (resolveCodexSpawn in launch-codex.mjs, #6263) and
qodercli/Auggie (#6263/#6304): shell:isWin, unchanged elsewhere.

Exported runOpenCodeAuth for testability and added a regression test
covering both the win32 shell:true path and the non-regressing
linux/darwin bare-binary path.

* fix(cli): make opencode --auth win32 spawn testable without module mocks (#7913)

The regression test used t.mock.module, which needs --experimental-test-module-mocks
and fails to even run in CI (TypeError: t.mock.module is not a function → the fix was
unvalidated). Extract a pure resolveOpenCodeAuthSpawn(providerId, platform) helper and
test it directly (win32 → shell:true, linux/darwin → shell:false). Production behavior
of runOpenCodeAuth is unchanged.

bin/cli/commands/setup-open-code.mjs

@@ -218,13 +218,29 @@ function registerPluginInOpenCodeConfig({
  * a clear "could not run opencode" message instead of a hard import
  * failure.
  */
-function runOpenCodeAuth(providerId) {
-  const isWin = process.platform === "win32";
-  const opencodeBin = isWin ? "opencode.cmd" : "opencode";
-  const res = spawnSync(opencodeBin, ["auth", "login", "--provider", providerId], {
-    stdio: "inherit",
-    shell: false,
-  });
+/**
+ * Pure resolver for the `opencode auth login` spawn descriptor. Extracted so the
+ * platform-branching logic is unit-testable without mocking child_process or
+ * mutating process.platform.
+ *
+ * On Windows the `opencode` binary is an npm `.cmd` shim that Node's hardened
+ * spawnSync (post CVE-2024-27980) refuses to run without a shell — spawning it
+ * with shell:false throws EINVAL (#7913). Mirror the same fix already applied to
+ * codex (resolveCodexSpawn in launch-codex.mjs, crediting #6263) and
+ * qodercli/Auggie (#6263/#6304): shell:true on win32, shell:false everywhere else.
+ */
+export function resolveOpenCodeAuthSpawn(providerId, platform = process.platform) {
+  const isWin = platform === "win32";
+  return {
+    command: isWin ? "opencode.cmd" : "opencode",
+    args: ["auth", "login", "--provider", providerId],
+    options: { stdio: "inherit", shell: isWin },
+  };
+}
+
+export function runOpenCodeAuth(providerId) {
+  const { command, args, options } = resolveOpenCodeAuthSpawn(providerId);
+  const res = spawnSync(command, args, options);
   if (res.error) {
     // ENOENT = opencode is not on PATH
     if (res.error.code === "ENOENT") {

changelog.d/fixes/7913-opencode-spawnsync-einval-win32.md

@@ -0,0 +1 @@
+- fix(cli): spawn the win32 `opencode.cmd` shim with `shell:true` in `omniroute setup opencode --auth` to avoid the Node `spawnSync EINVAL` hardening error (#7913)

tests/unit/setup-open-code-win32-shell.test.mjs

@@ -0,0 +1,42 @@
+// Regression test for #7913: `omniroute setup opencode --auth` spawns the
+// `opencode.cmd` shim on win32. Since Node's CVE-2024-27980 hardening,
+// spawning a `.cmd`/`.bat` shim with `shell:false` throws EINVAL — the same
+// class already fixed for codex (bin/cli/commands/launch-codex.mjs,
+// crediting #6263) and qodercli/Auggie (#6263/#6304). This callsite was
+// missed; `resolveOpenCodeAuthSpawn` must use `shell: isWin`.
+//
+// Tested through the pure `resolveOpenCodeAuthSpawn(providerId, platform)`
+// resolver (no child_process mocking, no process.platform mutation — both of
+// which required an unavailable --experimental-test-module-mocks flag in CI).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { resolveOpenCodeAuthSpawn } from "../../bin/cli/commands/setup-open-code.mjs";
+
+test("resolveOpenCodeAuthSpawn: win32 spawns opencode.cmd with shell:true (repro #7913)", () => {
+  const spawn = resolveOpenCodeAuthSpawn("omniroute", "win32");
+  assert.equal(spawn.command, "opencode.cmd");
+  assert.equal(
+    spawn.options.shell,
+    true,
+    `expected shell:true on win32 (the EINVAL fix), got shell:${spawn.options.shell}`
+  );
+  assert.deepEqual(spawn.args, ["auth", "login", "--provider", "omniroute"]);
+});
+
+test("resolveOpenCodeAuthSpawn: linux/darwin spawn bare opencode with shell:false (no regression)", () => {
+  for (const platform of ["linux", "darwin"]) {
+    const spawn = resolveOpenCodeAuthSpawn("omniroute", platform);
+    assert.equal(spawn.command, "opencode", `command on ${platform}`);
+    assert.equal(
+      spawn.options.shell,
+      false,
+      `expected shell:false on ${platform}, got shell:${spawn.options.shell}`
+    );
+  }
+});
+
+test("resolveOpenCodeAuthSpawn: forwards the provider id into the args", () => {
+  const spawn = resolveOpenCodeAuthSpawn("anthropic", "linux");
+  assert.deepEqual(spawn.args, ["auth", "login", "--provider", "anthropic"]);
+});