fix(scripts): claw.js spawn 'claude' fails with ENOENT on Windows

[mike-batrakov]

Summary

scripts/claw.js:94 calls spawnSync('claude', args, { ... }) with no shell option. On Windows, the installed claude binary is claude.cmd (a batch wrapper), and Node's spawn cannot resolve .cmd via PATH without shell: true. The call fails with spawn claude ENOENT and askClaude() returns an error string to the caller.

Root cause

Same class of bug as issue #1455 (fixed in PR #1456 for the MCP health-check hook): commands on PATH that are actually .cmd shims require shell: true on Windows; absolute paths must not use shell mode because cmd.exe misparses spaces in paths.

Reproduction

1. Windows 10 / 11
2. claude installed via npm i -g @anthropic-ai/claude-code (creates claude.cmd)
3. Run node scripts/claw.js <args> — askClaude() errors with spawn claude ENOENT

Proposed fix

Mirror the pattern used in scripts/hooks/mcp-health-check.js after PR #1456:

• Add needsShell = process.platform === 'win32' && typeof command === 'string' && !path.isAbsolute(command) && !UNSAFE_SHELL_CHARS.test(command) gate
• Pass shell: needsShell to spawnSync

Since claw.js hardcodes 'claude' (trusted value, not user input), the safety checks are defensive but keep the pattern consistent.

Related

• Part 1 of this fix: fix(hooks): MCP health-check blocks all MCP calls on Windows — spawn npx ENOENT #1455 / PR fix(hooks): resolve MCP health-check spawn ENOENT on Windows #1456 (MCP health-check hook)
• Audit of all spawn/spawnSync usage in scripts/ confirms claw.js is the only other occurrence of the same bug; other call sites either already handle .cmd explicitly (post-edit-format.js, stop-format-typecheck.js) or use absolute paths (process.execPath).