Greptile Summary

This PR fixes DEP0190 on Node.js v24 by refactoring createSpawnOptions into resolveSpawnCall, which folds args into the command string when shell: true is required (Windows .cmd/.bat paths), eliminating the spawn(file, args, { shell: true }) pattern that triggers the deprecation warning. The security invariant is preserved — assertSafeWindowsShellArgs runs before the join to reject shell metacharacters.

Confidence Score: 5/5

Safe to merge — the fix correctly eliminates the DEP0190 pattern while preserving the existing security validation.

No P0 or P1 findings. The arg-folding logic is equivalent to what Node.js was doing internally before v24, assertSafeWindowsShellArgs runs before the join, and non-Windows code paths are untouched.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix(scripts): avoid DEP0190 by folding a..." | Re-trigger Greptile}

Codex review: needs maintainer review before merge.

Summary
The PR updates scripts/ui.js to launch Windows .cmd/.bat UI runners through cmd.exe with shell: false, adds focused tests, and adds a changelog entry.

Reproducibility: yes. source-backed: current main can select shell: true for Windows UI .cmd/.bat launchers and still pass a separate args array to spawn()/spawnSync(), matching DEP0190. I did not run a live Windows Node 24 repro in this read-only review.

Real behavior proof
Override: The PR has proof: override, so the external after-fix real behavior proof gate is waived despite no posted Windows Node 24 runtime output.

Next step before merge
No repair lane is needed; this is a focused, mergeable implementation PR with no actionable review finding, so maintainers should let CI and merge policy decide.

Security
Cleared: No concrete security or supply-chain regression found; the diff reduces shell-mode process spawning and adds no dependencies, workflows, lockfile, secret, or release-script changes.

Maintainer prep complete for #62910.

What changed:

• Rebased/reseated the PR onto current main and replaced the submitted args.join(" ") shell workaround with the shared buildCmdExeCommandLine path.
• Windows .cmd/.bat UI runner calls now spawn cmd.exe /d /s /c <escaped command line> with shell: false and windowsVerbatimArguments: true, preserving argument boundaries and avoiding Node.js v24 DEP0190.
• Ordinary .exe launchers and non-Windows launches remain direct spawns.
• Added focused regression coverage and changelog.

Prepared head: 87ace89dca4f3620bba8b6d699cad061023aa0f1
Previous head: fc2d117ecf34077bddd041cf9d9e91b4c603cc41

Verification:

• pnpm install --frozen-lockfile passed
• pnpm exec oxfmt --check --threads=1 scripts/ui.js test/scripts/ui.test.ts CHANGELOG.md passed
• pnpm exec vitest run --config test/vitest/vitest.unit-fast.config.ts test/scripts/ui.test.ts passed (4 tests)
• git diff --check passed

Notes:

• pnpm test test/scripts/ui.test.ts test/scripts/pnpm-runner.test.ts ran test/scripts/ui.test.ts successfully, then the tooling shard failed before collecting test/scripts/pnpm-runner.test.ts with TypeError: Class extends value undefined is not a constructor or null from test/non-isolated-runner.ts.
• pnpm check:changed failed in lint:scripts during plugin-sdk boundary artifact preparation with broad dependency/type-resolution errors (for example missing typebox and @openclaw/fs-safe/* declarations), unrelated to this three-file UI runner change.
• Added proof: override because live Windows Node 24 proof is unavailable from this maintainer macOS workspace; the regression tests cover the exact spawn spec.

Re-review progress:

• State: Review in progress
• Detail: Targeted re-review run started; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/25451648679
• Updated: 2026-05-06T17:48:17.239Z

Maintainer refresh: rebased the prepared branch onto current main after main moved.\n\nNew prepared head: bb4f1598abed90a276578c22f4454aaa6123cff4\nPrevious prepared head: 87ace89dca4f3620bba8b6d699cad061023aa0f1\n\nFocused verification after refresh:\n- pnpm exec oxfmt --check --threads=1 scripts/ui.js test/scripts/ui.test.ts CHANGELOG.md passed\n- pnpm exec vitest run --config test/vitest/vitest.unit-fast.config.ts test/scripts/ui.test.ts passed (4 tests)\n- git diff --check passed\n\nFresh CI is running on the refreshed head.

@greptile-apps[bot] Thanks for the review — the Greptile summary matches an older head (it references the resolveSpawnCall + folded shell: true approach and commit 84a74625c3682d7ff2d045732ffb2701d0426239).

The branch has been rebased onto current main and the implementation now matches what maintainers landed afterward: Windows .cmd / .bat UI runners go through cmd.exe /d /s /c + buildCmdExeCommandLine with shell: false and windowsVerbatimArguments: true in scripts/ui.js, so DEP0190 is avoided without passing a separate args array alongside shell: true. Focused coverage lives in test/scripts/ui.test.ts.

If you want an updated bot pass, a Greptile re-trigger on the refreshed head should re-summarize against the current diff.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/25584100708
• Updated: 2026-05-08T23:19:13.316Z

Maintainer prep refresh for #62910.

Prepared head: 252f744c232fbeb0282a4175fc570a457ae1eda6

What I changed:

• Rebased onto current origin/main.
• Resolved the test/scripts/ui.test.ts rebase conflict by keeping current test structure and preserving the new cmd.exe/shell:false Windows launcher coverage.
• Moved the changelog entry to the SOP-required tail position for the current section.

Verification:

• node scripts/test-projects.mjs test/scripts/ui.test.ts passed (4 tests).
• pnpm build passed.
• pnpm check passed.

Fresh CI should start on the prepared head. Not merging until required/full checks are green.

Maintainer refresh:

• Rebasing this PR onto current origin/main completed successfully.
• Prepared head is now c49f3d56fae0d4d2af9f0b19a60bd49b169317ce.
• The import-cycle cleanup commit from the older PR branch was already present upstream, so the refreshed branch now keeps only the Windows .cmd/.bat runner fix plus the changelog entry.

Local verification passed:

pnpm install --frozen-lockfile
pnpm exec oxfmt --check --threads=1 scripts/ui.js test/scripts/ui.test.ts CHANGELOG.md
node scripts/test-projects.mjs test/scripts/ui.test.ts
pnpm build
pnpm check

I’ll wait for fresh GitHub checks before merging.

Merged with squash after the refreshed head c49f3d56fae0d4d2af9f0b19a60bd49b169317ce passed local maintainer verification and fresh GitHub checks, including Real behavior proof and ClawSweeper-related gates.

Merge commit: 5adbbaa3cbcc20df26d5425318dbb71d2962fa55

Linked issue #62881 was already closed, and this landing keeps the Windows .cmd/.bat UI runner fix in the main branch with contributor attribution.