fix: handle spaces in file paths for Open in Editor

[ranvier2d2]

Summary

• Fixes "openInEditor" does not work if there are spaces in path #757
• Fixes "Open" and paths with spaces problem #603

Changes

• In apps/server/src/open.ts, when shell: true (Windows), wrap spawn args containing spaces in double quotes before passing to spawn()
• On Windows, spawn() with shell: true joins args with spaces for cmd.exe, splitting paths like C:\Users\John Doe\project into separate tokens
• Non-Windows platforms use shell: false where args are passed as proper argv entries, so no quoting is needed

Test plan

• On Windows: open a file with spaces in its path via "Open in Editor" — should open correctly in one buffer
• On macOS/Linux: verify "Open in Editor" still works normally (no behavior change expected)
• Verify editor launch still works for paths without spaces on all platforms

Note

Fix spaces in file paths for Open in Editor on Windows

In open.ts, launchDetached now wraps each argument in double quotes when spawning on Windows, and sets the shell option accordingly. Non-Windows behavior is unchanged.

^{Macroscope summarized 443b4e0.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 9784b695-5775-4d8e-ac82-41ea61fef754

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

🟠 High src/open.ts:237

On Windows with shell: true, the quoting logic only wraps arguments containing spaces, leaving shell metacharacters like &, |, (, ), and % unquoted. An argument like Logs&Reports.txt is split into two commands (Logs and Reports.txt) instead of being treated as a single path, and malicious filenames like malicious&whoami can inject arbitrary commands. Arguments containing any shell metacharacters must be quoted, not just those with spaces.

-        const useShell = process.platform === "win32";
-        const args = useShell
-          ? launch.args.map((a) => (a.includes(" ") ? `"${a}"` : a))
-          : [...launch.args];
+        const useShell = process.platform === "win32";
+        const shellMetas = /[&|<>^()%!"]/;
+        const args = useShell
+          ? launch.args.map((a) => (shellMetas.test(a) ? `"${a}"` : a))
+          : [...launch.args];

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/server/src/open.ts around lines 237-240:

On Windows with `shell: true`, the quoting logic only wraps arguments containing spaces, leaving shell metacharacters like `&`, `|`, `(`, `)`, and `%` unquoted. An argument like `Logs&Reports.txt` is split into two commands (`Logs` and `Reports.txt`) instead of being treated as a single path, and malicious filenames like `malicious&whoami` can inject arbitrary commands. Arguments containing any shell metacharacters must be quoted, not just those with spaces.

Evidence trail:
apps/server/src/open.ts lines 236-243 at REVIEWED_COMMIT - shows the quoting logic `launch.args.map((a) => (a.includes(" ") ? `"${a}"` : a))` which only checks for spaces, and the spawn call with `shell: useShell` where `useShell` is true on Windows.