Diego Rodrigues de Sa e Souza 6459dde35c fix(cli): reuse win32-aware locateCommand in tool-detector (#7279) (#7569) ...

detectBinary() in tool-detector.ts never checked process.platform and never
passed shell:true, so on native Windows an installed CLI (npm installs
claude/codex/opencode as .cmd shims) was reported as NOT installed:
1. execFileImpl(binary, ["--version"]) fails without shell:true for .cmd
   shims (Node's CVE-2024-27980 hardening).
2. the `which` fallback doesn't exist on native Windows (no WSL/git-bash).

Both threw, both were swallowed by empty catches, detectBinary returned
{installed: false}. cliRuntime.ts::locateCommand already solved this for the
runtime-spawn path (#968) but never propagated here — re-drift, per the
issue title.

Exports locateCommand from cliRuntime.ts and reuses it (+ shouldUseShellForCommand,
+ getLookupEnv) for the win32 existence/path probe in tool-detector.ts, keeping
the --version probe local but shell-gated. Also routes the which fallback through
the injectable execFileImpl hook (it previously called the raw execFileAsync,
making it unmockable and prone to false-positives from a real system which).

2026-07-17 06:36:04 -03:00

..

config-generator.test.ts

fix(security): block cloud-metadata SSRF pivot in cli-tools catalog fetch (CodeQL #326 critical) (#3544)

2026-06-10 02:20:21 -03:00

hermes-home-env.test.ts

Release v3.8.22 (#3623)

2026-06-11 18:52:29 -03:00

tool-detector-win32-7279.test.ts

fix(cli): reuse win32-aware locateCommand in tool-detector (#7279) (#7569)

2026-07-17 06:36:04 -03:00

tool-detector.test.ts

Release v3.8.6 (#2804)

2026-05-29 12:44:29 -03:00