fix(doctor): the shell check walked past the shim and told Windows to switch it off

[xizhuomengcontin]

Orca-Code-Review — push 1

Severity	Count
P0	0
P1	0
P2	0
P3	0

✅ no blocking findings

shell shim  warn  commands pass through but nothing is captured
  fix: record with --no-shell rather than trusting a layer that records nothing

That is what orca doctor said on every Windows machine — advising the user to turn off a
capture layer that works fine.

Why

On Windows the shim is sh.cmd, because PATH cannot execute an extensionless script there.
installShellShim knows this and says so in its own doc comment. The check did not:

await execFileAsync('sh', ['-c', 'printf ok'], { env: { PATH: `${shim.dir}${delimiter}…` } });

execFile without a shell goes to CreateProcess, which looks for sh and sh.exe and never
sh.cmd. So the probe walked straight past the shim directory it had just prepended, found
whichever sh.exe was further down PATH — Git for Windows', here — ran the command through that,
and correctly observed that no frames had been written.

Measured, with the shim directory on PATH:

how sh -c "printf ok" was invoked	stdout	frames
execFile('sh', …) — what the check did	"ok"	0
execFile('sh.cmd', …)	—	spawn EINVAL
cmd.exe /d /s /c sh -c "printf ok"	"ok"	1

The middle row is why naming the .cmd directly is not the fix: node has refused to spawn a
.cmd or .bat without a shell since CVE-2024-27980. The command processor is what resolves
PATHEXT, so it is what has to do the resolving.

The layer was never broken

A real orca record on Windows, with an agent that invokes a shell the way a Windows caller does:

{"type":"shell.exec","attrs":{"argv":["sh","-c","echo hello from the shell; exit 3"],"cwd":"…"}}
{"type":"shell.result","causes":[5],"attrs":{"exit_code":3,"signal":null,"duration_ms":27,…}}

argv with its quoting intact, and exit_code: 3 — the exit code the failing test's own name says
a broken shim "loses silently". It was being recorded the whole time.

And now:

shell shim  ok  sh, bash, zsh — captured a test command

Scope

One branch in one check. POSIX takes the identical path it took before. The shim, the runner and
the frame format are untouched — the only thing that was wrong was how the check reached them.

Worth stating plainly, since it bounds the claim: a caller that bypasses PATHEXT — node's own
execFile without shell, as this check did — will not hit the shim on Windows. That is inherent
to a .cmd shim and not something this PR changes. What it changes is that doctor no longer
reports its own choice of spawn API as a failure of the thing it was measuring.

Windows: 10 failures before, 9 after. prettier --check, tsc --build --force,
scripts/conformance.mjs (63 events, 0 failures) and scripts/fidelity.mjs --check
(0 regressions) are clean.

🤖 Generated with Claude Code

[orcacode-review]

🐳 OrcaCode Review

✅ No findings — nothing to flag in this PR. Great work!

_{OrcaCode Review — Route Smarter. Ship Safer. Spend Less.
Engine-reported: 519 calls · 52.4M tokens · 99% cached}

❤️ Share · Install OrcaCode Review

Free on GitHub — the review runs on your own OrcaRouter key. If it helped, a shout-out goes a long way.

Share: X · Reddit · LinkedIn
Follow: X · Discord · LinkedIn · OrcaRouter