fix(windows): capture SVN status without shell

Add an isolated direct-argv stdout capture path for Windows and use it for pinned SVN status probes. Preserve literal metacharacters, process exit codes, and the existing restricted handle inheritance model.

Signed-off-by: lzl51230 <14934913+lzl51230@users.noreply.github.com>

Author: lzl51230

src/foundation/compat_fs.c

@@ -192,7 +192,8 @@ static wchar_t *cbm_resolve_comspec(void) {
 
 /* On failure returns NULL with *stage naming the failing step and *gle the
  * GetLastError value captured at that step (0 when errno is the signal). */
-static FILE *cbm_popen_isolated(const char *cmd, const char **stage, DWORD *gle) {
+static FILE *cbm_popen_isolated(const char *cmd, const char *const *argv, const char **stage,
+                                DWORD *gle) {
     *stage = "";
     *gle = 0;
     InitOnceExecuteOnce(&g_popen_once, cbm_popen_init, NULL, NULL);
@@ -246,12 +247,19 @@ static FILE *cbm_popen_isolated(const char *cmd, const char **stage, DWORD *gle)
     si.StartupInfo.hStdError = nul;
     si.lpAttributeList = attr;
 
-    /* Run through cmd.exe /c so command quoting and `2>NUL` behave as under
-     * _popen. The command line is heap-composed (no fixed-size truncation)
-     * and widened via UTF-8 so non-ASCII repo paths survive intact. */
-    wchar_t *app = cbm_resolve_comspec();
+    /* Shell commands run through cmd.exe /c for _popen compatibility. Argv
+     * callers bypass the shell and pin the requested executable directly.
+     * Both paths use heap-composed UTF-8 command lines so non-ASCII paths
+     * survive intact. */
+    wchar_t *app = NULL;
     wchar_t *wcmdline = NULL;
-    if (app) {
+    if (argv) {
+        app = cbm_utf8_to_wide(argv[0]);
+        wcmdline = cbm_build_cmdline(argv);
+    } else {
+        app = cbm_resolve_comspec();
+    }
+    if (app && !argv) {
         size_t u8len = strlen(cmd) + sizeof("cmd.exe /c ");
         char *u8 = (char *)malloc(u8len);
         if (u8) {
@@ -334,7 +342,7 @@ FILE *cbm_popen(const char *cmd, const char *mode) {
     if (mode && mode[0] == 'r' && mode[1] == '\0') {
         const char *stage = "";
         DWORD gle = 0;
-        FILE *fp = cbm_popen_isolated(cmd, &stage, &gle);
+        FILE *fp = cbm_popen_isolated(cmd, NULL, &stage, &gle);
         g_popen_last_isolated = (fp != NULL);
         if (!fp) {
             char glebuf[CBM_SZ_16];
@@ -350,6 +358,24 @@ FILE *cbm_popen(const char *cmd, const char *mode) {
     return _popen(cmd, mode);
 }
 
+FILE *cbm_popen_argv(const char *const *argv) {
+    if (!argv || !argv[0] || !argv[0][0]) {
+        return NULL;
+    }
+    const char *stage = "";
+    DWORD gle = 0;
+    FILE *fp = cbm_popen_isolated(NULL, argv, &stage, &gle);
+    g_popen_last_isolated = (fp != NULL);
+    if (!fp) {
+        char glebuf[CBM_SZ_16];
+        char errnobuf[CBM_SZ_16];
+        snprintf(glebuf, sizeof(glebuf), "%lu", (unsigned long)gle);
+        snprintf(errnobuf, sizeof(errnobuf), "%d", errno);
+        cbm_log_warn("compat.popen_argv_failed", "stage", stage, "gle", glebuf, "errno", errnobuf);
+    }
+    return fp;
+}
+
 int cbm_pclose(FILE *f) {
     InitOnceExecuteOnce(&g_popen_once, cbm_popen_init, NULL, NULL);
 

src/foundation/compat_fs.h

@@ -38,6 +38,11 @@ void cbm_closedir(cbm_dir_t *d);
 
 FILE *cbm_popen(const char *cmd, const char *mode);
 int cbm_pclose(FILE *f);
+#ifdef _WIN32
+/* Spawn an argv vector directly while capturing stdout through the same
+ * isolated handle-inheritance path as cbm_popen. */
+FILE *cbm_popen_argv(const char *const *argv);
+#endif
 
 /* ── File operations ──────────────────────────────────────────── */
 

src/watcher/svn_state.c

@@ -1019,22 +1019,27 @@ cbm_svn_probe_result_t cbm_svn_client_init(const char *root_path, cbm_svn_client
 
 cbm_svn_probe_result_t cbm_svn_probe(const cbm_svn_client_t *client, const char *root_path,
                                      cbm_svn_observation_t *observation) {
-    if (!client || !client->executable[0] || !root_path || !observation ||
-        !cbm_validate_shell_arg(client->executable) || !cbm_validate_shell_arg(root_path)) {
+    if (!client || !client->executable[0] || !root_path || !observation) {
         return CBM_SVN_PROBE_UNCERTAIN;
     }
     char status_root[CBM_SZ_4K];
-    if (!cbm_svn_format_path_arg(client, root_path, status_root, sizeof(status_root)) ||
-        !cbm_validate_shell_arg(status_root)) {
+    if (!cbm_svn_format_path_arg(client, root_path, status_root, sizeof(status_root))) {
         return CBM_SVN_PROBE_UNCERTAIN;
     }
 #ifdef _WIN32
-    /* cbm_popen routes through cmd.exe, where percent expansion occurs even
-     * inside double quotes. Fail closed until this leaf can use argv capture. */
-    if (strchr(client->executable, '%') || strchr(status_root, '%')) {
+    char peg_root[CBM_SZ_8K];
+    int peg_length = snprintf(peg_root, sizeof(peg_root), "%s@", status_root);
+    if (peg_length < 0 || (size_t)peg_length >= sizeof(peg_root)) {
+        return CBM_SVN_PROBE_UNCERTAIN;
+    }
+    const char *argv[] = {
+        client->executable,  "status", "--xml",  "--verbose", "--no-ignore", "--depth", "infinity",
+        "--non-interactive", "--",     peg_root, NULL};
+    FILE *process = cbm_popen_argv(argv);
+#else
+    if (!cbm_validate_shell_arg(client->executable) || !cbm_validate_shell_arg(status_root)) {
         return CBM_SVN_PROBE_UNCERTAIN;
     }
-#endif
     char command[CBM_SZ_16K];
     int written = snprintf(command, sizeof(command),
                            "\"%s\" status --xml --verbose --no-ignore --depth infinity "
@@ -1043,8 +1048,8 @@ cbm_svn_probe_result_t cbm_svn_probe(const cbm_svn_client_t *client, const char
     if (written < 0 || (size_t)written >= sizeof(command)) {
         return CBM_SVN_PROBE_UNCERTAIN;
     }
-
     FILE *process = cbm_popen(command, "r");
+#endif
     if (!process) {
         return CBM_SVN_PROBE_UNCERTAIN;
     }

tests/test_main.c

@@ -148,6 +148,20 @@ static int tf_maybe_run_socket_probe(int argc, char **argv) {
 #endif
 }
 
+static int tf_maybe_run_argv_probe(int argc, char **argv) {
+#ifdef _WIN32
+    if (argc < 4 || strcmp(argv[1], "__cbm_argvprobe") != 0) {
+        return -1;
+    }
+    puts(argv[2]);
+    return atoi(argv[3]);
+#else
+    (void)argc;
+    (void)argv;
+    return -1;
+#endif
+}
+
 static int g_suite_argc = 0;
 static char **g_suite_argv = NULL;
 static bool *g_suite_arg_matched = NULL;
@@ -284,6 +298,10 @@ extern void suite_dump_verify_io(void);
 extern void cbm_kind_in_set_free_cache(void);
 
 int main(int argc, char **argv) {
+    int argv_probe_rc = tf_maybe_run_argv_probe(argc, argv);
+    if (argv_probe_rc >= 0) {
+        return argv_probe_rc;
+    }
     /* #798 follow-up: if spawned as the socket-isolation probe, report whether an
      * inheritable socket handle crossed into this child and exit before any suite. */
     int probe_rc = tf_maybe_run_socket_probe(argc, argv);

tests/test_security.c

@@ -707,6 +707,22 @@ TEST(popen_isolated_propagates_exit_code) {
     PASS();
 }
 
+TEST(popen_argv_direct_spawn_propagates_exit_code) {
+    char self[MAX_PATH];
+    ASSERT(GetModuleFileNameA(NULL, self, sizeof(self)) > 0);
+    const char *literal = "%CBM_POPEN_ARGV_LITERAL% & value";
+    const char *argv[] = {self, "__cbm_argvprobe", literal, "37", NULL};
+    FILE *fp = cbm_popen_argv(argv);
+    ASSERT_NOT_NULL(fp);
+    ASSERT_EQ(cbm_popen_last_was_isolated(), 1);
+    char line[128];
+    ASSERT_NOT_NULL(fgets(line, sizeof(line), fp));
+    line[strcspn(line, "\r\n")] = '\0';
+    ASSERT_STR_EQ(line, literal);
+    ASSERT_EQ(cbm_pclose(fp), 37);
+    PASS();
+}
+
 /* #798 follow-up (the full-repro gap flagged above): prove the EXACT handle class
  * that deadlocked git — an inheritable AFD/listening-socket handle, the kind the
  * UI HTTP server holds — does NOT cross into the cbm_popen child. Unlike the
@@ -837,6 +853,7 @@ SUITE(security) {
     /* Isolated popen — handle-inheritance regression guard for #798 */
     RUN_TEST(popen_isolated_git_version_round_trip);
     RUN_TEST(popen_isolated_propagates_exit_code);
+    RUN_TEST(popen_argv_direct_spawn_propagates_exit_code);
     RUN_TEST(popen_isolates_listening_socket);
 #endif
 }

tests/test_svn_state.c

@@ -203,8 +203,9 @@ TEST(path_arg_matches_client_runtime) {
     char path[128];
 #ifdef _WIN32
     client.uses_posix_paths = true;
-    ASSERT_TRUE(cbm_svn_format_path_arg(&client, "D:\\workspace\\project", path, sizeof(path)));
-    ASSERT_STR_EQ(path, "/d/workspace/project");
+    ASSERT_TRUE(
+        cbm_svn_format_path_arg(&client, "D:\\R&D\\%project%", path, sizeof(path)));
+    ASSERT_STR_EQ(path, "/d/R&D/%project%");
 #else
     ASSERT_TRUE(cbm_svn_format_path_arg(&client, "/workspace/project", path, sizeof(path)));
     ASSERT_STR_EQ(path, "/workspace/project");
@@ -220,8 +221,12 @@ TEST(client_runtime_detection_is_case_insensitive) {
 
 TEST(real_probe_tracks_repeated_working_copy_edits) {
     th_svn_fixture_t fixture;
-    ASSERT_EQ(th_svn_fixture_init(&fixture, "cbm_svn_probe", "source.c", "int value = 1;\n"),
-              0);
+#ifdef _WIN32
+    const char *prefix = "cbm_svn_probe_%_and&";
+#else
+    const char *prefix = "cbm_svn_probe";
+#endif
+    ASSERT_EQ(th_svn_fixture_init(&fixture, prefix, "source.c", "int value = 1;\n"), 0);
     cbm_svn_observation_t non_working_copy = {0};
     ASSERT_EQ(cbm_svn_probe(&fixture.client, fixture.root, &non_working_copy),
               CBM_SVN_PROBE_NOT_WORKING_COPY);