test(cli): round-trip cmd.exe argument escaping through the shipped CLI

[Simon Ingeson (smonn)]

Closes WIZ-11295

Overview of Changes

The windows-smoke job only ever passed --version through cmd.exe, an argument with no meta character, so every escapeArgument branch it exists to protect ran on no runner. argv.cmd forwards %* to node, so twelve arguments now reach a real argv. doctorSmoke.mjs drives dist/cli.js instead of a re-bundled copy, so a call site that drops platform fails CI.

The unit suite was no help and still would not be: it stays green with the escaping halved and with it deleted, because four files assert the escaped shape rather than its effect. Both mutations were run on the runner to size that. The four quote-then-metacharacter cases are the interesting ones — cmd.exe ignores the backslash-escaped quote escapeArgument writes, so under one caret layer a"&echo pwned closes the quoted run and executes. That is what proves the second caret layer load-bearing, and it answers the open question the ticket carried.

Testing

Only Windows CI can verify this; local runs skip. Run 30593534552 is green with 12/12 arguments round-tripping.

bun run typecheck && bun run lint && bun run format:check && bun run knip && bun run test

Checklist

• Changes follow the code style of this project
• Self-review completed
• Tests added/updated (or not applicable)
• No breaking changes (or described below)

[coderabbitai]

Walkthrough

Adds workflow-level concurrency to cancel superseded CI runs. Replaces the generic npm spawn smoke test with direct spawn.ts bundling and shipped CLI validation. Adds a Windows command-script argument round-trip smoke test covering cmd.exe-sensitive characters, plus a doctor --json smoke test validating npm-registry and Playwright checks. Documents a missing distinction in caret-escaping coverage.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• qawolf/cli#1405: Directly exercises Windows .cmd argument escaping and spawn behavior.
• qawolf/cli#1408: Extends the Windows spawn smoke-test workflow and test/spawn coverage.
• qawolf/cli#1412: Adds related Windows CLI smoke testing and CI workflow updates.

Suggested reviewers: chajac

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title follows Conventional Commits, uses an allowed type and scope, clearly describes the change, and is 71 characters without trailing punctuation.
Description check	✅ Passed	The description includes an issue reference, detailed overview, concrete testing information, and a completed checklist matching the repository template.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wiz-11295-the-windows-ci-job-does-not-exercise-the-cmdexe-argument

---

_{Comment @coderabbitai help to get the list of available commands.}