fix(core): resolve Windows PATH locator tools

vincentkoc · vincentkoc · commit 72b9bc730370 · 2026-06-21T12:09:33.000+02:00
diff --git a/src/daemon/program-args.test.ts b/src/daemon/program-args.test.ts
@@ -1,6 +1,8 @@
 // Daemon program argument tests cover CLI argument construction for services.
 import path from "node:path";
 import { afterEach, describe, expect, it, vi } from "vitest";
+import { resetWindowsInstallRootsForTests } from "../infra/windows-install-roots.js";
+import { withMockedWindowsPlatform } from "../test-utils/vitest-spies.js";
 
 const childProcessMocks = vi.hoisted(() => ({
   execFileSync: vi.fn(),
@@ -43,6 +45,8 @@ const originalArgv = [...process.argv];
 afterEach(() => {
   process.argv = [...originalArgv];
   vi.resetAllMocks();
+  vi.unstubAllEnvs();
+  resetWindowsInstallRootsForTests();
 });
 
 describe("resolveGatewayProgramArguments", () => {
@@ -179,6 +183,39 @@ describe("resolveGatewayProgramArguments", () => {
     expect(result.workingDirectory).toBe(path.resolve("/repo"));
   });
 
+  it("uses trusted Windows where.exe when resolving dev runtime binaries", async () => {
+    const repoIndexPath = path.resolve("/repo/src/index.ts");
+    const repoEntryPath = path.resolve("/repo/src/entry.ts");
+    process.argv = [String.raw`D:\nodejs\node.exe`, repoIndexPath];
+    vi.stubEnv("SystemRoot", String.raw`D:\Windows`);
+    resetWindowsInstallRootsForTests({ queryRegistryValue: () => null });
+    fsMocks.realpath.mockResolvedValue(repoIndexPath);
+    fsMocks.access.mockResolvedValue(undefined);
+    childProcessMocks.execFileSync.mockReturnValue(String.raw`D:\Tools\bun.exe` + "\r\n");
+
+    let result: Awaited<ReturnType<typeof resolveGatewayProgramArguments>> | undefined;
+    await withMockedWindowsPlatform(async () => {
+      result = await resolveGatewayProgramArguments({
+        dev: true,
+        port: 18789,
+        runtime: "bun",
+      });
+    });
+
+    expect(childProcessMocks.execFileSync).toHaveBeenCalledWith(
+      path.win32.join(String.raw`D:\Windows`, "System32", "where.exe"),
+      ["bun"],
+      { encoding: "utf8" },
+    );
+    expect(result?.programArguments).toEqual([
+      String.raw`D:\Tools\bun.exe`,
+      repoEntryPath,
+      "gateway",
+      "--port",
+      "18789",
+    ]);
+  });
+
   it("uses an executable wrapper when provided", async () => {
     const wrapperPath = path.resolve("/usr/local/bin/openclaw-doppler");
     fsMocks.stat.mockResolvedValue({ isFile: () => true } as never);
diff --git a/src/daemon/program-args.ts b/src/daemon/program-args.ts
@@ -3,6 +3,7 @@ import { execFileSync } from "node:child_process";
 import { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { getWindowsSystem32ExePath } from "../infra/windows-install-roots.js";
 import {
   buildGatewayDistEntrypointCandidates,
   findFirstAccessibleGatewayEntrypoint,
@@ -165,7 +166,7 @@ async function resolveNodePath(): Promise<string> {
 }
 
 async function resolveBinaryPath(binary: string): Promise<string> {
-  const cmd = process.platform === "win32" ? "where" : "which";
+  const cmd = process.platform === "win32" ? getWindowsSystem32ExePath("where.exe") : "which";
   try {
     const output = execFileSync(cmd, [binary], { encoding: "utf8" }).trim();
     const resolved = output.split(/\r?\n/)[0]?.trim();
diff --git a/src/tui/tui.resolve-codex-bin.test.ts b/src/tui/tui.resolve-codex-bin.test.ts
@@ -0,0 +1,42 @@
+// Covers TUI Codex CLI lookup command selection.
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { resetWindowsInstallRootsForTests } from "../infra/windows-install-roots.js";
+import { withMockedWindowsPlatform } from "../test-utils/vitest-spies.js";
+
+const execFileSyncMock = vi.hoisted(() => vi.fn());
+
+vi.mock("node:child_process", async () => {
+  const actual = await vi.importActual<typeof import("node:child_process")>("node:child_process");
+  return {
+    ...actual,
+    execFileSync: execFileSyncMock,
+  };
+});
+
+import { resolveCodexCliBin } from "./tui.js";
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllEnvs();
+  execFileSyncMock.mockReset();
+  resetWindowsInstallRootsForTests();
+});
+
+describe("resolveCodexCliBin", () => {
+  it("uses the trusted Windows where.exe when resolving codex", async () => {
+    vi.stubEnv("SystemRoot", "D:\\Windows");
+    resetWindowsInstallRootsForTests({ queryRegistryValue: () => null });
+    execFileSyncMock.mockReturnValue("D:\\Tools\\codex.exe\r\n");
+
+    await withMockedWindowsPlatform(async () => {
+      expect(resolveCodexCliBin()).toBe("D:\\Tools\\codex.exe");
+    });
+
+    expect(execFileSyncMock).toHaveBeenCalledWith(
+      path.win32.join("D:\\Windows", "System32", "where.exe"),
+      ["codex"],
+      { encoding: "utf8" },
+    );
+  });
+});
diff --git a/src/tui/tui.ts b/src/tui/tui.ts
@@ -19,6 +19,7 @@ import { resolveAgentIdByWorkspacePath, resolveDefaultAgentId } from "../agents/
 import { getRuntimeConfig, type OpenClawConfig } from "../config/config.js";
 import { isChatStopCommandText } from "../gateway/chat-abort.js";
 import { registerUncaughtExceptionHandler } from "../infra/unhandled-rejections.js";
+import { getWindowsSystem32ExePath } from "../infra/windows-install-roots.js";
 import { setConsoleSubsystemFilter } from "../logging/console.js";
 import { loggingState } from "../logging/state.js";
 import {
@@ -98,7 +99,8 @@ type RunTuiOptions = TuiOptions & {
 /** Resolve the absolute path to the `codex` CLI binary, or `null` if not installed. */
 export function resolveCodexCliBin(): string | null {
   try {
-    const lookupCmd = process.platform === "win32" ? "where" : "which";
+    const lookupCmd =
+      process.platform === "win32" ? getWindowsSystem32ExePath("where.exe") : "which";
     // `where` on Windows can return multiple lines; take the first match.
     const raw = execFileSync(lookupCmd, ["codex"], { encoding: "utf8" }).trim();
     return raw.split(/\r?\n/)[0] || null;
