Runs `pnpm install` + `pnpm run build` (tsc -b + tsdown) on windows-2025,
and is listed in all-checks-passed `needs` so a Windows build regression
cannot land silently. Windows path/shell support is still partial, so this
lane covers the build surface only; tests and gates are not run here yet.
shell:true space-joins the executable and args UNESCAPED (Node DEP0190), so
an absolute .cmd path breaks whenever the repo path contains spaces and
`pnpm run hygiene` fails. Invoke publint's (`node_modules/publint/src/cli.js`)
and tsc's (`node_modules/typescript/bin/tsc`) JS entry through process.execPath
instead — no shell, extension-agnostic, identical on every platform, matching
the pattern already used by doc-typecheck.ts.
Addresses ds-review-bot on #324.
execFileSync on a .cmd shim returns EINVAL on recent Node without shell:true. Same bug class as install-lefthook.mjs. Affected publint-all.ts and verify-node-next-types.ts.
(cherry picked from commit 5ae40bee1c840fbbdd197ee15907aa660a343c52)
Pairs with .gitattributes: eol=lf pins what git produces at checkout;
.editorconfig pins what editors write to disk - the one CRLF vector
git's filters cannot reach (git never rewrites the working tree, so an
editor-written CRLF file would persist with a clean status while the
doc gates misbehave on it). insert_final_newline declares the existing
one-trailing-newline policy (AGENTS.md, gated by git diff --check) at
the editor layer too.
(cherry picked from commit 7a09602fd76efff81a0875fb177289004c3dfc9b)
execFileSync('node_modules/.bin/tsc') spawns an extensionless shim
that is not executable on Windows (the CVE-2024-27980 class the
sibling scripts hit); the catch treated the spawn failure as a compile
failure with empty diagnostics. The .cmd shim would need shell:true,
which concatenates args unescaped - a hazard for the temp project
path - so invoke typescript/bin/tsc through the current node instead;
identical behavior on every platform.
Note this gate had never actually run on this Windows checkout: with
the pre-eol=lf CRLF working copy the fence regex matched no ts blocks
('.' does not match \\r), so it reported 'no ts code blocks to check'
and exited green. The LF working tree surfaced the spawn bug; with
this fix the gate compiles all 21 blocks on Windows.
(cherry picked from commit b49993c28e068c2beb411eae1f0c8ac4985aa3ae)
The repo's committed content is already 100% LF (verified: 802/802
text files); until now the working-tree form depended on each
contributor's core.autocrlf, and autocrlf=true checkouts produced CRLF
working copies that byte-level gates had to tolerate (fence parsing,
consistency-record parsing, blob hashing, README splice comparison).
eol=lf removes the smudge boundary entirely: attributes override any
local autocrlf, so every checkout on every host sees the repo's
canonical form. git add --renormalize confirmed a zero-change no-op -
no committed blob (including vendor/) is rewritten. The script-side
CRLF tolerances remain as defense in depth for editor-introduced CRLF
in not-yet-committed files. If a file class ever needs CRLF in the
working tree (.bat/.cmd), a per-pattern eol=crlf override keeps the
in-repo form LF while smudging those checkouts only.
(cherry picked from commit 5d21ebee20391c3d5c1d3812bd3aaa92bc652973)
spawnSync on a .cmd shim returns EINVAL/null status on recent Node (CVE-2024-27980) unless shell:true, which made postinstall fail and blocked every 'pnpm run' on Windows.
(cherry picked from commit 65a08f889ff9738ddaceeeb724e6e24f3be4b2ea)
The web-editor conflict resolution renamed the cordis snapshot keys to
rc.7 but left the mcp-client importer pointing at the deleted
cordis@4.0.0-rc.6(...rc.4) key, so every CI lane failed at
'pnpm install --frozen-lockfile' with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY.
Align the mcp-client cordis range with the repo-wide ^4.0.0-rc.7 sweep
from master and re-resolve the lockfile with pnpm.
