mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-09 15:02:30 +02:00
600072ebd8
* fix(hooks): resolve MCP health-check spawn ENOENT on Windows On Windows, commands like 'npx' are batch files (npx.cmd) that require shell expansion to resolve via PATH. Without shell: true, Node.js spawn() fails with ENOENT. However, absolute paths (e.g. C:\Program Files\nodejs\node.exe) must NOT use shell mode because cmd.exe misparses paths containing spaces. Fix: enable shell mode only for non-absolute commands on Windows, using path.isAbsolute() to distinguish. This matches how attemptReconnect() already handles the shell option. Fixes #1455 * fix(hooks): harden Windows shell spawn — validate command for metacharacters Addresses bot review feedback on PR #1456: - Add UNSAFE_SHELL_CHARS regex to guard against shell injection when needsShell=true: cmd.exe operators (&, |, <, >, ^, %, !, (), ;, whitespace) are rejected before shell mode is enabled - Add typeof command === 'string' check so path.isAbsolute() cannot throw on malformed non-string command values - Rename test to 'via PATH resolution' (not Windows-only; runs all platforms) - Fix misleading test comment: 'node' resolves via PATH like npx.cmd but does not itself use .cmd; comment now accurately reflects the intent * fix(hooks): kill full process tree on Windows when shell mode is used When needsShell=true, the spawned child is cmd.exe. Calling child.kill() only terminates the shell, leaving the real server process orphaned. Use taskkill /PID <pid> /T /F on Windows+shell to kill the entire process tree rooted at cmd.exe. Fall back to SIGTERM+SIGKILL on all other platforms or when shell mode is not active. * fix(hooks): fall back to child.kill() when taskkill fails Windows taskkill can fail if it's not on PATH, the process already exited, or permissions are denied. Previously the failure was silently ignored and no kill signal reached the child. Now: capture the spawnSync result and fall back to child.kill('SIGKILL') on any taskkill error or non-zero status. This still may leak a detached server process but at least guarantees the cmd.exe shell is signaled. |
||
|---|---|---|
| .. | ||
| auto-tmux-dev.test.js | ||
| bash-hook-dispatcher.test.js | ||
| block-no-verify.test.js | ||
| check-hook-enabled.test.js | ||
| config-protection.test.js | ||
| continuous-learning-observe-runner.test.js | ||
| cost-tracker.test.js | ||
| design-quality-check.test.js | ||
| detect-project-worktree.test.js | ||
| doc-file-warning.test.js | ||
| evaluate-session.test.js | ||
| gateguard-fact-force.test.js | ||
| governance-capture.test.js | ||
| hook-flags.test.js | ||
| hooks.test.js | ||
| insaits-security-monitor.test.js | ||
| insaits-security-wrapper.test.js | ||
| mcp-health-check.test.js | ||
| observe-subdirectory-detection.test.js | ||
| observer-memory.test.js | ||
| plugin-hook-bootstrap.test.js | ||
| post-bash-hooks.test.js | ||
| pre-bash-commit-quality.test.js | ||
| pre-bash-dev-server-block.test.js | ||
| pre-bash-reminders.test.js | ||
| quality-gate.test.js | ||
| session-activity-tracker.test.js | ||
| stop-format-typecheck.test.js | ||
| suggest-compact.test.js | ||
| test_insaits_security_monitor.py | ||