Spawn the package manager the way Windows needs (AP-1)

[DKoenig9]

AP-1 of the lt dev Windows port (inventory: windows-support/cli-lt-dev-windows.md). It comes first because nothing else can be measured until it lands.

The defect

On Windows pnpm is pnpm.cmd, and Node refuses to exec a .cmd directly (CVE-2024-27980, EINVAL). Every child lt dev starts went through a bare spawn(pm.bin, …) with no shell — eleven call sites across up, test, dev-test-session and dev-api-launch.

So on Windows nothing started at all, which is why none of the other findings in the inventory could even be reproduced there.

src/lib/platform.ts has solved exactly this since 1.47.0 (cross-spawn, findExecutable), and no dev-* module imported any of it. CLAUDE.md already says so: "The lt dev spawn sites … and dev-service.ts#resolveCaddyBin are not migrated yet." This is that migration.

What changed

File	Change
platform.ts	New spawnCmd — the async counterpart of spawnCmdSync. detached and stdio pass through, so callers keep their process group and log-file descriptors
dev-process.ts	runChildInherit, runChildToFile, spawnDetached route through it
dev-test-session.ts, dev-ticket.ts	the two execFileSync(pm.bin, …) sites
caddy.ts	runCaddy — one shape for every tool spawn
dev-service.ts	resolveCaddyBin uses findExecutable instead of spawning which (absent on Windows; where.exe prints every match, not the first)
doctor.ts	spawns process.execPath, not a bare node

lsof and curl are deliberately untouched — they are AP-2 and AP-3.

The part that is not mechanical

execFileSync throws on a non-zero exit. spawnSync does not. Both migrated sites depended on the throw, so both now check status explicitly:

• installWorktreeDeps must keep throwing. Its only caller, lt ticket start, catches and warns. Swallowing the failure would hand the developer a half-installed worktree with no hint anything went wrong.
• ensurePlaywrightBrowsers must keep logging. Otherwise the suite dies later on a missing browser — which reads as a broken spec rather than a missing install.

Both pinned by tests. Reverting the status check in installWorktreeDeps turns its test red. One detail the assertion states explicitly: result.error is null, not undefined, when nothing went wrong at the spawn level — a call site testing === undefined would be wrong.

Verified against the compiled artifact, not just ts-node

tsconfig.json sets allowSyntheticDefaultImports but not esModuleInterop, and cross-spawn has no .default property. A default import could therefore have emitted cross_spawn_1.default — undefined at runtime — while tsc stayed green. It does not: tsc emits __importStar, which sets default to the module itself. Checked by compiling and running build/lib/platform.js, which spawns a child correctly.

This is the same class as the help-export trap already in CLAUDE.md, and tsc cannot catch either.

Also fixed, because of when the message is read

installService said "Install with brew install caddy (macOS) or your package manager (Linux)" on every platform. It now names something that exists per platform (winget/scoop on Windows). A user reads that line at the moment nothing works yet; advice for someone else's operating system is worse than none.

The test covering "caddy not on PATH" drove the old which spawn through the injected ShellRunner. That seam is gone, so installService takes an optional lookup: FindExecutableOptions and the test injects the file probe instead — platform.ts's own injection model, the one that keeps Windows branches assertable from macOS.

Checks

• tsc --noEmit and npm run lint clean. The perfectionist/sort-modules --fix diff was read, not trusted — the moved function kept its JSDoc.
• Jest: 77 suites / 1175 tests (git-commands and dev-service-e2e excluded — real network, real launchctl; see CLAUDE.md).
• Mutation: dropping the status check in installWorktreeDeps turns its test red. (A first attempt at that mutation produced Tests: 0 total — an unused-variable compile error, the trap CLAUDE.md documents. Redone by mutating the body only.)

Draft until the block is reviewed as a whole.

🤖 Generated with Claude Code

https://claude.ai/code/session_01N8cvaEziSrKGHv3Jcp59JH