fix: bypass shell entirely for cross-platform Docker commands

[Treelovah]

Summary

The original commit tried to fix Windows by adding cmd.exe escaping to shellEscape(). Pie's review correctly identified that cmd.exe escaping is fundamentally broken — \" doesn't escape quotes in cmd.exe, %% only works in .bat files, and the implementation had a real injection vector.

The right fix is to not use a shell at all. execFileSync with argument arrays bypasses cmd.exe (and bash) entirely — arguments go directly to the process. No shell means no escaping means no injection surface.

docker.ts: Every execSync call replaced with execFileSync argument arrays. The POSIX sleep 2 replaced with Atomics.wait-based sleepSync() that works cross-platform.

env-check.ts: Same treatment. || echo "FAIL" replaced with try/catch. 2>/dev/null replaced by stdio: 'pipe'.

shell.ts: Reverted to POSIX-only with doc comment explaining to use execFileSync for cross-platform.

Closes #63

Test plan

• npm run build — clean
• npx vitest run — 410/410 pass
• Manual: run benchmark on Windows — Docker commands should work without shell quoting issues
• Manual: run benchmark on macOS/Linux — no regression

[pi3-code]

Review: Windows cmd.exe Shell Escaping

Hey, thanks for tackling this — Windows shell quoting is genuinely one of the trickiest areas to get right, and the core idea here (platform-aware escaping) is the right direction. I dug into cmd.exe's parsing behavior and found a few things worth addressing before this ships.

---

cmd.exe Quote Escaping

The main thing: cmd.exe doesn't recognize \" as an escaped quote the way POSIX shells or the C runtime do. It treats \ as a literal character, so \" actually closes the quoted region from cmd.exe's perspective. The standard cmd.exe convention is "" (doubled quote).

This matters because input containing a double quote could unintentionally break out of the quoting:

Input:    hello" & whoami
Escaped:  "hello\" & whoami"
cmd.exe interprets the \" as closing the quote, then runs & whoami as a separate command.

Swapping to "" would fix this.

A few other cmd.exe quirks to handle

• %% for percent escaping — this works in .bat/.cmd files but not reliably at the cmd.exe /c command line (which is what Node's execSync uses). The BatBadBut research has a good writeup on safer alternatives.
• Caret (^) — it's cmd.exe's escape character and can interfere with parsing even inside quotes. Worth escaping as ^^.
• Newlines — a \n or \r\n in the input would terminate the command line. Probably safest to throw on these since there's no clean way to embed them.
• Trailing backslash — shellEscape('C:\\') would produce "C:\\", and the C runtime parser can misread \" as an escaped quote, leaving the string unterminated. Edge case but worth covering.
• ! (delayed expansion) — if cmd /V:ON is active, !var! gets expanded. Lower risk but easy to handle.

Test coverage

The existing tests cover the happy path well. A few additional cases that would strengthen confidence: caret ^, trailing backslash, newlines, and a double-quote-plus-metacharacter combo (the real attack surface).

Bigger picture suggestion

cmd.exe escaping is notoriously fragile — you might want to consider using execFileSync/spawnSync with argument arrays for the Windows path, which bypasses cmd.exe entirely and sidesteps the whole escaping problem:

import { execFileSync } from 'child_process';
execFileSync('docker', ['pull', imageName]); // no shell involved

Alternatively, a library like cross-spawn handles all these edge cases.

Also worth noting: some callers in docker.ts and env-check.ts use POSIX-isms like 2>/dev/null and sleep that would need separate fixes for full Windows support — but that can be a follow-up.

---

Again, appreciate you taking this on — Windows compat is important and this is a solid start. Happy to chat through any of these if it would help!