fix(cli): quote Windows paths with spaces in Claude CLI validation

[jeremykit]

When validating Claude CLI on Windows with shell: true (for .cmd/.bat files), paths containing spaces were being split by cmd.exe. For example: D:\Program Files\nodejs\claude.cmd was parsed as command D:\Program with arguments Files\nodejs\claude.cmd --version.

This fix adds proper quoting for paths with spaces when using shell: true, preventing cmd.exe from incorrectly splitting the path at space characters.

🤖 Generated with Claude Code

Base Branch

• This PR targets the develop branch (required for all feature/fix PRs)
• This PR targets main (hotfix only - maintainers)

Description

Related Issue

Closes #

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 📚 Documentation
• ♻️ Refactor
• 🧪 Test

Area

• Frontend
• Backend
• Fullstack

Commit Message Format

Follow conventional commits: <type>: <subject>

Types: feat, fix, docs, style, refactor, test, chore

Example: feat: add user authentication system

Checklist

• I've synced with develop branch
• I've tested my changes locally
• I've followed the code principles (SOLID, DRY, KISS)
• My PR is small and focused (< 400 lines ideally)

CI/Testing Requirements

• All CI checks pass
• All existing tests pass
• New features include test coverage
• Bug fixes include regression tests

Screenshots

Before	After

Feature Toggle

• Behind localStorage flag: use_feature_name
• Behind settings toggle
• Behind environment variable/config
• N/A - Feature is complete and ready for all users

Breaking Changes

Breaking: Yes / No

Details:

Summary by CodeRabbit

• Bug Fixes
  • Fixed CLI validation on Windows so executable paths containing spaces are handled reliably during both synchronous and asynchronous checks. This reduces false failures when validating the local CLI and maintains existing invocation behavior and environment handling, improving consistency of detection and version-checking on Windows.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[jeremykit]

@AndyMik90 I've addressed the HIGH priority issue by adding the same quoting fix to validateClaudeAsync() in commit 4c6f3bc.

I've also synced my branch with the latest develop.

Could you please re-review when you have a chance? Thanks!

[jeremykit]

OK

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In @apps/frontend/src/main/cli-tool-manager.ts:
- Around line 1035-1041: The async validation path in validateClaudeAsync does
not apply the same Windows-quoting logic as validateClaude(), causing commands
with spaces to be split when needsShell is true; update validateClaudeAsync to
generate cmdToRun using the same condition on needsShell, claudeCmd.includes('
'), and !claudeCmd.startsWith('"') and pass that cmdToRun into execFileAsync
(referencing claudeCmd, needsShell, cmdToRun, execFileAsync, and
validateClaudeAsync) so both validateClaude() and validateClaudeAsync handle
Windows paths with spaces consistently.
- Around line 926-932: Change the quote-detection to ensure the path is fully
quoted before skipping quoting: instead of only checking
!claudeCmd.startsWith('"'), update the condition used to build cmdToRun (the
expression referencing needsShell and claudeCmd) to verify both
claudeCmd.startsWith('"') and claudeCmd.endsWith('"') (or equivalent regex) so
you only skip quoting when the string is already fully wrapped in quotes; keep
the rest of the needsShell && space check and use double quotes for the injected
quoting.

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4c6f3bc and 1524cd9.

📒 Files selected for processing (1)

• apps/frontend/src/main/cli-tool-manager.ts

🧰 Additional context used

📓 Path-based instructions (3)

apps/frontend/src/**/*.{ts,tsx,jsx}

📄 CodeRabbit inference engine (CLAUDE.md)

Always use i18n translation keys for all user-facing text in the frontend instead of hardcoded strings

Files:

• apps/frontend/src/main/cli-tool-manager.ts

apps/frontend/src/**/*.{ts,tsx}

📄 CodeRabbit inference engine (CLAUDE.md)

Use useTranslation() hook with namespace prefixes (e.g., 'navigation:items.key') for accessing translation strings in React components

Files:

• apps/frontend/src/main/cli-tool-manager.ts

apps/frontend/**/*.{ts,tsx}

⚙️ CodeRabbit configuration file

apps/frontend/**/*.{ts,tsx}: Review React patterns and TypeScript type safety.
Check for proper state management and component composition.

Files:

• apps/frontend/src/main/cli-tool-manager.ts

🧠 Learnings (1)

📓 Common learnings

Learnt from: MikeeBuilds
Repo: AndyMik90/Auto-Claude PR: 661
File: apps/frontend/src/renderer/components/onboarding/OllamaModelSelector.tsx:176-189
Timestamp: 2026-01-04T23:59:48.743Z
Learning: In the AndyMik90/Auto-Claude repository, pre-existing i18n issues (hardcoded user-facing strings that should be localized) can be deferred to future i18n cleanup passes rather than requiring immediate fixes in PRs that don't introduce new i18n violations.

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: CodeQL (javascript-typescript)
• GitHub Check: CodeQL (python)

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

apps/frontend/src/main/cli-tool-manager.ts (1)

926-939: Extract quoting logic into a helper function to normalize path handling

The quoting logic is duplicated (lines 926–939 and 1035–1047) and has a reliability issue: it adds wrapping quotes without first stripping existing ones. When shell: true is used on Windows, Node.js passes the command string verbatim to cmd.exe (with windowsVerbatimArguments = true), and cmd.exe may misinterpret pre-quoted paths due to its own quote-parsing rules.

Centralize the logic into a helper like prepareWindowsShellCommand(command, needsShell) that:

1. Strips any existing wrapping quotes
2. Re-applies quotes only when shell: true and whitespace is present

This ensures cmd.exe receives a properly formed command line and eliminates duplication.

Proposed refactor

+function prepareWindowsShellCommand(command: string, needsShell: boolean): string {
+  const trimmed = command.trim();
+  const unwrapped =
+    trimmed.startsWith('"') && trimmed.endsWith('"')
+      ? trimmed.slice(1, -1)
+      : trimmed;
+
+  // Only quote when cmd.exe is involved and whitespace exists
+  return needsShell && /\s/.test(unwrapped) ? `"${unwrapped}"` : unwrapped;
+}
+
   private validateClaude(claudeCmd: string): ToolValidation {
     try {
       // On Windows, .cmd files need shell: true to execute properly.
       // SECURITY NOTE: shell: true is safe here because:
       // 1. claudeCmd comes from internal path detection (user config or known system paths)
       // 2. Only '--version' is passed as an argument (no user input)
       // If claudeCmd origin ever changes to accept user input, use escapeShellArgWindows.
       const needsShell = process.platform === 'win32' &&
         (claudeCmd.endsWith('.cmd') || claudeCmd.endsWith('.bat'));
 
-      // When using shell: true on Windows, paths with spaces must be quoted
-      // to prevent cmd.exe from splitting at spaces
-      const cmdToRun = needsShell && claudeCmd.includes(' ') && !(claudeCmd.startsWith('"') && claudeCmd.endsWith('"'))
-        ? `"${claudeCmd}"`
-        : claudeCmd;
+      const cmdToRun = prepareWindowsShellCommand(claudeCmd, needsShell);
 
       const version = execFileSync(cmdToRun, ['--version'], {
         encoding: 'utf-8',
         timeout: 5000,
         windowsHide: true,
         shell: needsShell,
         env: getAugmentedEnv(),
       }).trim();

   private async validateClaudeAsync(claudeCmd: string): Promise<ToolValidation> {
     try {
       const needsShell = process.platform === 'win32' &&
         (claudeCmd.endsWith('.cmd') || claudeCmd.endsWith('.bat'));
 
-      // When using shell: true on Windows, paths with spaces must be quoted
-      // to prevent cmd.exe from splitting at spaces
-      const cmdToRun = needsShell && claudeCmd.includes(' ') && !(claudeCmd.startsWith('"') && claudeCmd.endsWith('"'))
-      ? `"${claudeCmd}"`
-      : claudeCmd;
+      const cmdToRun = prepareWindowsShellCommand(claudeCmd, needsShell);
 
       const { stdout } = await execFileAsync(cmdToRun, ['--version'], {
         encoding: 'utf-8',
         timeout: 5000,
         windowsHide: true,
         shell: needsShell,
         env: await getAugmentedEnvAsync(),
       });

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1524cd9 and dc50ab5.

📒 Files selected for processing (1)

• apps/frontend/src/main/cli-tool-manager.ts

🧰 Additional context used

📓 Path-based instructions (3)

apps/frontend/src/**/*.{ts,tsx,jsx}

📄 CodeRabbit inference engine (CLAUDE.md)

Always use i18n translation keys for all user-facing text in the frontend instead of hardcoded strings

Files:

• apps/frontend/src/main/cli-tool-manager.ts

apps/frontend/src/**/*.{ts,tsx}

📄 CodeRabbit inference engine (CLAUDE.md)

Use useTranslation() hook with namespace prefixes (e.g., 'navigation:items.key') for accessing translation strings in React components

Files:

• apps/frontend/src/main/cli-tool-manager.ts

apps/frontend/**/*.{ts,tsx}

⚙️ CodeRabbit configuration file

apps/frontend/**/*.{ts,tsx}: Review React patterns and TypeScript type safety.
Check for proper state management and component composition.

Files:

• apps/frontend/src/main/cli-tool-manager.ts

🧠 Learnings (1)

📓 Common learnings

Learnt from: MikeeBuilds
Repo: AndyMik90/Auto-Claude PR: 661
File: apps/frontend/src/renderer/components/onboarding/OllamaModelSelector.tsx:176-189
Timestamp: 2026-01-04T23:59:48.743Z
Learning: In the AndyMik90/Auto-Claude repository, pre-existing i18n issues (hardcoded user-facing strings that should be localized) can be deferred to future i18n cleanup passes rather than requiring immediate fixes in PRs that don't introduce new i18n violations.

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: CodeQL (javascript-typescript)
• GitHub Check: CodeQL (python)

🔇 Additional comments (2)

apps/frontend/src/main/cli-tool-manager.ts (2)

926-938: Quoting fix addresses cmd.exe path-splitting on Windows

The cmdToRun logic correctly ensures .cmd/.bat paths with spaces aren’t split when shell: true, and it’s applied consistently in both sync and async validation.

Also applies to: 1035-1047

---

918-925: Verify security context of claudeCmd origin and shell: true usage

The review raises a legitimate security concern: if claudeCmd can originate from user-configurable settings (userConfig.claudePath in settings.json), then the security comment claiming "no user input" is inaccurate. User configuration is user input. With shell: true on Windows, metacharacters like &|<>^\r\n could alter command behavior.

However, the concern requires verification of:

1. Whether claudeCmd is actually sourced from userConfig.claudePath
2. What validation (if any) currently exists for claudeCmd
3. Whether the suggested hardening (metacharacter validation) applies at all call sites (lines 926-939, 1032-1047)

At minimum, update the security comment to acknowledge user configuration as a source and add validation if shell: true is used with user-sourced paths.

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In @apps/frontend/src/main/cli-tool-manager.ts:
- Around line 1034-1039: The regex used to detect characters requiring quoting
in the async Claude CLI validation (used in needsQuoting where claudeCmd is
tested before calling execFileAsync) currently checks /[ &|<>^%]/; update it to
include parentheses by changing the character class to include () — i.e., add
'(' and ')' inside the brackets so commands containing parentheses are also
quoted consistently with the sync path.
- Around line 926-931: Update the quoting regex used to decide if claudeCmd
needs quoting: in the code that computes needsQuoting (referencing the
needsQuoting variable and claudeCmd), expand the character class `/[ &|<>^%]/`
to include parentheses so it also detects "(" or ")" in paths (e.g., change to
include `()` inside the brackets) before building cmdToRun and calling
execFileSync.

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between dc50ab5 and 654170c.

📒 Files selected for processing (1)

• apps/frontend/src/main/cli-tool-manager.ts

🧰 Additional context used

📓 Path-based instructions (3)

apps/frontend/src/**/*.{ts,tsx,jsx}

📄 CodeRabbit inference engine (CLAUDE.md)

Always use i18n translation keys for all user-facing text in the frontend instead of hardcoded strings

Files:

• apps/frontend/src/main/cli-tool-manager.ts

apps/frontend/src/**/*.{ts,tsx}

📄 CodeRabbit inference engine (CLAUDE.md)

Use useTranslation() hook with namespace prefixes (e.g., 'navigation:items.key') for accessing translation strings in React components

Files:

• apps/frontend/src/main/cli-tool-manager.ts

apps/frontend/**/*.{ts,tsx}

⚙️ CodeRabbit configuration file

apps/frontend/**/*.{ts,tsx}: Review React patterns and TypeScript type safety.
Check for proper state management and component composition.

Files:

• apps/frontend/src/main/cli-tool-manager.ts

🧠 Learnings (2)

📓 Common learnings

Learnt from: MikeeBuilds
Repo: AndyMik90/Auto-Claude PR: 661
File: apps/frontend/src/renderer/components/onboarding/OllamaModelSelector.tsx:176-189
Timestamp: 2026-01-04T23:59:48.743Z
Learning: In the AndyMik90/Auto-Claude repository, pre-existing i18n issues (hardcoded user-facing strings that should be localized) can be deferred to future i18n cleanup passes rather than requiring immediate fixes in PRs that don't introduce new i18n violations.

📚 Learning: 2026-01-04T23:59:48.743Z

Learnt from: MikeeBuilds
Repo: AndyMik90/Auto-Claude PR: 661
File: apps/frontend/src/renderer/components/onboarding/OllamaModelSelector.tsx:176-189
Timestamp: 2026-01-04T23:59:48.743Z
Learning: In the AndyMik90/Auto-Claude repository, pre-existing i18n issues (hardcoded user-facing strings that should be localized) can be deferred to future i18n cleanup passes rather than requiring immediate fixes in PRs that don't introduce new i18n violations.

Applied to files:

• apps/frontend/src/main/cli-tool-manager.ts

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: CodeQL (javascript-typescript)
• GitHub Check: CodeQL (python)