Greptile Summary

This PR fixes a Windows-specific spawn error that occurred when pnpm.cmd (or any .cmd/.bat/.com runner) was resolved to a path containing spaces. The fix quotes the command path in double quotes before passing it to spawn/spawnSync, but only when shouldUseShellForCommand returns true — i.e., only when shell: true will also be set by createSpawnOptions.

Key observations:

• The conditional shouldUseShellForCommand(cmd) ? \"${cmd}"` : cmdis correctly aligned: quoting is applied if and only ifshell: trueis also active (both code paths use the same helper with the same argument), so.exeexecutables resolved bywhich()` are never accidentally quoted.
• The original (unquoted) cmd is still passed to createSpawnOptions, which is correct — passing a pre-quoted string would cause path.extname to return an empty string and silently drop the shell: true flag.
• On Windows with shell: true, Node.js constructs cmd.exe /d /s /c "<full_command>" using windowsVerbatimArguments, resulting in cmd.exe /c ""C:\path with spaces\pnpm.cmd" install" — which is the correct form for cmd.exe to handle a space-bearing path.
• Previous review thread concerns (unconditional quoting, redundant platform check) have both been addressed in this iteration.

Confidence Score: 5/5

• This PR is safe to merge — the fix is minimal, well-scoped, and correctly aligned with the existing shell-detection logic.
• The quoting is conditional on shouldUseShellForCommand, the same predicate used to set shell: true, so .exe executables are never affected. The original cmd is passed to createSpawnOptions to preserve correct option generation. All concerns from previous review threads have been addressed. No new logic paths or security surface is introduced.
• No files require special attention.

_{Last reviewed commit: e6cbe1a}

@codex review

Codex Review: Didn't find any major issues. Keep it up!

@greptile review

@greptile review

@codex review

@steipete @vincentkoc review and merge ?