setup-learning.ts fails on Windows with "spawn npx.cmd EINVAL" #792

On Windows, bun scripts/setup-learning.ts (Quick start, step 2) stops before doing anything, and prints only this:

PS C:\...\openbot> bun scripts/setup-learning.ts
spawn npx.cmd EINVAL

npx --yes copilotkit@latest login and project select had both succeeded beforehand, from the OpenBot root. Nothing is written to .env, so neither the runtime key nor the openbot Learning container is set up.

Cause

runCli in server/src/learning/ensure-container.ts:124-149 starts the CopilotKit CLI like this:

const child = spawn(
  process.platform === "win32" ? "npx.cmd" : "npx",
  ["--yes", "copilotkit@latest", ...args],
  { cwd: directory, env: cliEnvironment(), stdio: ["ignore", "pipe", "pipe"] },
);

Since the fix for CVE-2024-27980, Node refuses to spawn a .cmd or .bat file without shell: true, and Bun does the same. The refusal is a synchronous EINVAL thrown by spawn() itself, not an 'error' event. As a result, the child.on("error", () => finish(127)) handler at line 147 never runs. The throw happens inside the Promise executor, so it becomes a rejection, and setup-learning.ts exits with the bare message.

Minimal reproduction, Bun 1.4.3 on Windows 11:

import { spawn } from "node:child_process";
spawn("npx.cmd", ["--version"]);                 // throws: spawn npx.cmd EINVAL
spawn("npx.cmd", ["--version"], { shell: true }); // runs, prints 11.19.0

The server calls the same runCli from ensureLearningContainer at boot (server/src/index.ts:360) when a CLI login is present. Automatic container creation should therefore fail the same way on Windows, although I have only reproduced it through the setup helper.

Suggested fix

Run through the shell on Windows only:

{
  cwd: directory,
  env: cliEnvironment(),
  shell: process.platform === "win32",
  stdio: ["ignore", "pipe", "pipe"],
}

With shell: true the arguments are joined into a cmd.exe command line rather than passed as an argv. That is safe here because every caller passes literals (whoami, project list --json). cliEnvironment() already keeps COMSPEC, SystemRoot and PATHEXT, so cmd.exe resolves. macOS and Linux are unchanged.

Windows 11 Enterprise 10.0.26200, Bun 1.4.3, Node 24.21.0 / npm 11.19.0, OpenBot at 8c9ad4c. Related: #679 and #681 (other Windows checkout problems).