OmniRoute/changelog.d/fixes/7913-opencode-spawnsync-einval-win32.md at feat/plugin-browser-pool

mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00

Files

Diego Rodrigues de Sa e Souza 3f2d88b679 fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7913 ) (#7964 )

* fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7913)

runOpenCodeAuth spawned the opencode.cmd shim with shell:false on win32,
which throws spawnSync EINVAL under Node's hardened child_process
handling (post CVE-2024-27980). Mirrors the fix already applied to
codex (resolveCodexSpawn in launch-codex.mjs, #6263) and
qodercli/Auggie (#6263/#6304): shell:isWin, unchanged elsewhere.

Exported runOpenCodeAuth for testability and added a regression test
covering both the win32 shell:true path and the non-regressing
linux/darwin bare-binary path.

* fix(cli): make opencode --auth win32 spawn testable without module mocks (#7913)

The regression test used t.mock.module, which needs --experimental-test-module-mocks
and fails to even run in CI (TypeError: t.mock.module is not a function → the fix was
unvalidated). Extract a pure resolveOpenCodeAuthSpawn(providerId, platform) helper and
test it directly (win32 → shell:true, linux/darwin → shell:false). Production behavior
of runOpenCodeAuth is unchanged.

2026-07-21 09:15:39 -03:00

164 B

Raw Permalink Blame History

fix(cli): spawn the win32 opencode.cmd shim with shell:true in omniroute setup opencode --auth to avoid the Node spawnSync EINVAL hardening error (#7913)

164 B Raw Permalink Blame History

164 B

Raw Permalink Blame History