fix: isolate diagnostic subprocess working directories

[nicknisi]

Summary

Run commands without an explicit cwd from a fresh temporary directory instead of inheriting the project directory. This prevents Windows shell lookup from selecting repo-local tool shims and keeps diagnostic probes scoped to host tools and user-level MCP configuration.

Preserve explicit working directories for trusted project commands. Clean up temporary directories and return a failed result if setup or cleanup fails.

Add real-process regression tests and a compiled-CLI smoke check covering runtime and MCP probes, including Windows batch shims and paths containing spaces.

Verification

• A1. bun run test: 2,767 tests passed across 160 files.
• A2. bun run build, bun run typecheck, and bun run lint passed. Changed TypeScript files pass formatting checks.
• A3. env -u WORKOS_API_KEY sh scripts/command-smoke.sh ./dist/workos passed against the compiled CLI. Authenticated checks were skipped. Shell syntax and sandbox setup failure checks passed.
• A4. Run the regression tests and compiled-CLI smoke check on native Windows before release. The smoke script already runs in the Windows x64 and arm64 release jobs, but those runs have not been verified for this change.

Local verification used macOS and Bun 1.4.2. This PR remains a draft pending native Windows verification.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge based on the reviewed changes, with no concrete correctness, security, or repository-rule violations identified.

Summary

This PR changes subprocess execution without an explicit cwd to use a fresh temporary directory, preventing diagnostic host-tool and user-level MCP probes from resolving repository-local shims or configuration.

• Preserves explicit working directories for trusted project commands.
• Converts temporary-directory setup and cleanup failures into failed execution results.
• Adds real-process coverage for executable lookup, cleanup, nonzero exits, missing tools, setup failures, timeouts, and explicit working directories.
• Extends compiled-binary smoke coverage with diagnostic probes and platform-specific shim fixtures.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[execFileNoThrow invocation] --> B{Explicit cwd supplied?}
    B -->|Yes| C[Run in trusted project directory]
    B -->|No| D[Create fresh temporary directory]
    D --> E[Run host tool or user-level MCP probe]
    C --> F[Collect status, stdout, and stderr]
    E --> F
    F --> G{Temporary directory created?}
    G -->|Yes| H[Remove temporary directory]
    G -->|No| I[Return process result]
    H --> I
    D -->|Setup failure| J[Return failed result]
    H -->|Cleanup failure| J

Loading

_{Reviews (1) · Last reviewed commit: "test: keep POSIX smoke PATH compatible w..."}