fix(scripts): run Windows check commands through shims

test/scripts/changed-lanes.test.ts

@@ -17,6 +17,7 @@ import {
   shouldRunShrinkwrapGuard,
   createShrinkwrapGuardCommand,
 } from "../../scripts/check-changed.mjs";
+import { isDirectRunPath } from "../../scripts/lib/direct-run.mjs";
 import { cleanupTempDirs, makeTempRepoRoot } from "../helpers/temp-repo.js";
 
 const tempDirs: string[] = [];
@@ -72,6 +73,23 @@ afterEach(() => {
 });
 
 describe("scripts/changed-lanes", () => {
+  it("detects direct script execution from Windows argv paths", () => {
+    expect(
+      isDirectRunPath(
+        "C:\\repo\\scripts\\check-changed.mjs",
+        "c:\\repo\\scripts\\check-changed.mjs",
+        "win32",
+      ),
+    ).toBe(true);
+    expect(
+      isDirectRunPath(
+        "C:\\repo\\scripts\\changed-lanes.mjs",
+        "C:\\repo\\scripts\\check-changed.mjs",
+        "win32",
+      ),
+    ).toBe(false);
+  });
+
   it("includes untracked worktree files in the default local diff", () => {
     const dir = makeTempRepoRoot(tempDirs, "openclaw-changed-lanes-");
     git(dir, ["init", "-q", "--initial-branch=main"]);
@@ -864,7 +882,9 @@ describe("scripts/changed-lanes", () => {
     const plan = createChangedCheckPlan(result);
     const shrinkwrapGuard = createShrinkwrapGuardCommand(["extensions/slack/package.json"]);
 
-    expect(shrinkwrapGuard?.args.some((arg) => arg.endsWith("extensions/slack"))).toBe(true);
+    expect(
+      shrinkwrapGuard?.args.some((arg) => arg.replaceAll("\\", "/").endsWith("extensions/slack")),
+    ).toBe(true);
     expect(plan.commands.map((command) => command.name)).toContain("npm shrinkwrap guard");
     expect(plan.commands.map((command) => command.args[0])).not.toContain("deps:shrinkwrap:check");
   });

test/scripts/generate-npm-shrinkwrap.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, it } from "vitest";
 import {
   collectOverrideViolations,
   collectPnpmLockViolations,
+  createNpmShrinkwrapCommand,
   disableShrinkwrappedOverrideConflictSources,
   exactOverrideRulesFromOverrides,
   exactVersionFromOverrideSpec,
@@ -13,6 +14,30 @@ import {
 } from "../../scripts/generate-npm-shrinkwrap.mjs";
 
 describe("generate-npm-shrinkwrap", () => {
+  function repoRelativePath(value: string): string {
+    return path.relative(process.cwd(), value).replaceAll("\\", "/");
+  }
+
+  it("runs npm shrinkwrap through cmd.exe for Windows npm shims", () => {
+    const execPath = "C:\\nodejs\\node.exe";
+    const npmCmdPath = path.win32.resolve(path.win32.dirname(execPath), "npm.cmd");
+
+    expect(
+      createNpmShrinkwrapCommand(["shrinkwrap", "--ignore-scripts"], {
+        comSpec: "C:\\Windows\\System32\\cmd.exe",
+        env: {},
+        execPath,
+        existsSync: (candidate: string) => candidate === npmCmdPath,
+        platform: "win32",
+      }),
+    ).toEqual({
+      args: ["/d", "/s", "/c", `${npmCmdPath} shrinkwrap --ignore-scripts`],
+      command: "C:\\Windows\\System32\\cmd.exe",
+      shell: false,
+      windowsVerbatimArguments: true,
+    });
+  });
+
   it("extracts exact versions from npm override specs", () => {
     expect(exactVersionFromOverrideSpec("8.4.0")).toBe("8.4.0");
     expect(exactVersionFromOverrideSpec("npm:@nolyfill/domexception@1.0.28")).toBe("1.0.28");
@@ -152,13 +177,13 @@ describe("generate-npm-shrinkwrap", () => {
       shrinkwrapPackageDirsForChangedPaths([
         "extensions/acpx/package.json",
         "extensions/acpx/npm-shrinkwrap.json",
-      ]).map((packageDir) => path.relative(process.cwd(), packageDir)),
+      ]).map(repoRelativePath),
     ).toEqual(["extensions/acpx"]);
   });
 
   it("falls back to every shrinkwrap when lockfile ownership is ambiguous", () => {
-    const packageDirs = shrinkwrapPackageDirsForChangedPaths(["pnpm-lock.yaml"]).map((packageDir) =>
-      path.relative(process.cwd(), packageDir),
+    const packageDirs = shrinkwrapPackageDirsForChangedPaths(["pnpm-lock.yaml"]).map(
+      repoRelativePath,
     );
 
     expect(packageDirs).toContain("");
@@ -169,7 +194,7 @@ describe("generate-npm-shrinkwrap", () => {
     const packageDirs = shrinkwrapPackageDirsForChangedPaths([
       "extensions/acpx/package.json",
       "pnpm-lock.yaml",
-    ]).map((packageDir) => path.relative(process.cwd(), packageDir));
+    ]).map(repoRelativePath);
 
     expect(packageDirs).toContain("");
     expect(packageDirs).toContain("extensions/acpx");

test/scripts/parallels-smoke-model.test.ts

@@ -7,9 +7,10 @@ import {
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { delimiter, join } from "node:path";
+import { delimiter, join, win32 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { describe, expect, it } from "vitest";
+import { resolveHostCommandInvocation } from "../../scripts/e2e/parallels/host-command.ts";
 import { execNodeEvalSync, spawnNodeEvalSync } from "../../src/test-utils/node-process.js";
 
 const WRAPPERS = {
@@ -568,6 +569,55 @@ console.log(JSON.stringify(result));
     expect(result.stdout).toBeTypeOf("string");
   });
 
+  it("routes Windows host pnpm and npm shims through safe runners", () => {
+    const comSpec = "C:\\Windows\\System32\\cmd.exe";
+
+    expect(
+      resolveHostCommandInvocation("pnpm", ["build"], {
+        env: {
+          ComSpec: comSpec,
+          npm_execpath: "C:\\Tools\\pnpm.cmd",
+        },
+        platform: "win32",
+      }),
+    ).toEqual({
+      args: ["/d", "/s", "/c", "C:\\Tools\\pnpm.cmd build"],
+      command: comSpec,
+      shell: false,
+      windowsVerbatimArguments: true,
+    });
+
+    const execPath = "C:\\nodejs\\node.exe";
+    const npmCmdPath = win32.resolve(win32.dirname(execPath), "npm.cmd");
+    expect(
+      resolveHostCommandInvocation("npm", ["view", "openclaw", "version"], {
+        env: { ComSpec: comSpec },
+        execPath,
+        existsSync: (candidate) => candidate === npmCmdPath,
+        platform: "win32",
+      }),
+    ).toEqual({
+      args: ["/d", "/s", "/c", `${npmCmdPath} view openclaw version`],
+      command: comSpec,
+      shell: false,
+      windowsVerbatimArguments: true,
+    });
+  });
+
+  it("wraps explicit Windows batch host commands without shell mode", () => {
+    expect(
+      resolveHostCommandInvocation("C:\\Tools\\helper.cmd", ["@scope/pkg@^1.0.0"], {
+        comSpec: "cmd.exe",
+        platform: "win32",
+      }),
+    ).toEqual({
+      args: ["/d", "/s", "/c", "C:\\Tools\\helper.cmd @scope/pkg@^^1.0.0"],
+      command: "cmd.exe",
+      shell: false,
+      windowsVerbatimArguments: true,
+    });
+  });
+
   it("runs the Windows agent turn through the detached done-file runner", () => {
     const script = readFileSync(TS_PATHS.windows, "utf8");