[Fermionic-Lyu]

Windows agent setup fails when the resolved npx.cmd path contains spaces: cmd.exe /s /c strips the executable quotes and tries to run the first path component. Preserve a fully quoted command line through the shared resolver and its setup, skill-install, and upgrade callers.

The wrapper disables delayed expansion, preserves trailing backslashes and empty arguments, and retains the shell-metacharacter rejection with CR/LF also rejected. No command or flag changes.

Validation: typecheck, build, and all 107 local test files pass (2259 tests; one Windows-only test skipped on macOS). The new Windows regression executes a real .cmd shim under a spaced path and checks literal argv, including empty arguments, trailing backslashes, parentheses, and exclamation marks. Windows CI passed all 11 tests in this regression file; its full suite passed 2213 tests with 47 platform-specific skips. Linux CI also passed.

Independent self-review and mutation checks completed before push. Cubic reported no issues across all 8 files. No release is included.

[cubic-dev-ai]

No issues found across 8 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[agent-zhang-beihai]

Reviewed by Wang Miao

This PR fixes how the CLI runs npm-installed .cmd shims on Windows (for example npx or claude) when their install path contains a space. resolveSpawnable now builds one quoted cmd.exe command line and returns a windowsVerbatimArguments flag, and every caller passes that flag on to spawn. I found nothing that needs changing and would approve.

The old version really was broken. libuv quoted a spaced shim path and any spaced arguments, then cmd /s /c removed the first and last quote of the whole line. That split a path like C:\Program Files\… at the space, which is the 'C:\Program' is not recognized error.

The new version is correct:

• Quoting: each argument is quoted, and trailing backslashes are doubled so they survive the closing quote.
• Expansion: /v:off stops ! from being expanded.
• Shell characters: arguments containing &|<>^%", CR or LF still skip the cmd.exe route and are spawned directly, as before.
• Callers: I traced every caller of resolveSpawnable and resolveRunSpec: setup.ts:175, ensure-skills.ts:37, and upgrade.ts:222 and :240. All four forward the flag. No other code in src/ spawns through this path.

I couldn't run the tests locally because dependencies aren't installed in this checkout. On the PR, the test and test-windows CI jobs both pass. The Windows job includes the new test that runs a shim from a directory with spaces and parentheses and checks the arguments arrive unchanged.

No findings.

[agent-zhang-beihai]

Reviewed by Yang Dong

This rebuilds Windows shim invocations as a fully quoted cmd.exe command line and propagates windowsVerbatimArguments through every production spawn site. The quoting correctly preserves spaced paths, empty arguments, and trailing backslashes while retaining the metacharacter guard, so I approve it as written. No findings.

[jwfing]

LGTM - approved.