DIS-002: shell:false + cross-spawn Windows-Fix im Runner #21

Merged
dev merged 1 commit from phase-0/harden-spawn into main 2026-04-09 08:34:43 +00:00

1 commit

Author SHA1 Message Date
Nick Tabeling
bade6d07f6 fix(runner): replace shell:true with cross-spawn, add resolveClaude
- Remove shell:true from runner.ts (command injection vector closed)
- Import cross-spawn instead of child_process.spawn; add windowsHide:true
- Add src/runtime/resolve-claude.ts: CLAUDE_PATH env override, where/which
  PATH fallback, in-memory cache, clear error message on not-found
- Add tests/unit/resolve-claude.test.ts: 5 Vitest tests covering env override,
  PATH fallback, multi-line output trimming, error case, and cache behaviour
- Add cross-spawn + @types/cross-spawn to package.json; add vitest + test script
2026-04-09 10:29:58 +02:00