Environment: Windows 11, OpenCode 1.18.18 (desktop), opencode-swarm-plugin 0.63.2, Node v24.12.0.
Symptom: Every plugin tool (hivemind_*, hive_*, swarmmail_*, swarm_*, cass_*) fails with spawn EINVAL on Windows.
Root cause: the plugin wrapper spawns the CLI via child_process.spawn("swarm.cmd", args, { /* no shell:true */ }). Since Node 18.20.2 / 20.12.2 (CVE-2024-27980 mitigation), spawning .cmd/.bat without shell: true throws EINVAL. Repro:
node -e "require('child_process').spawn('swarm.cmd',['--version'],{stdio:'ignore'})"
# THROW: EINVAL spawn EINVALImpact: the entire swarm backend is unusable on Windows.
Local fix that works: replace import { spawn } from "child_process" with cross-spawn (drop-in, handles .cmd + arg quoting).
Related finding: running the CLI via Bun on this machine burns 100% CPU for minutes per invocation (parsing the ~437k-line dist/bin/swarm.js); invoking it with node directly (node dist/bin/swarm.js ...) starts in <1s and also avoids cmd.exe mangling shell metacharacters (>, &, |) inside --json payloads (observed corrupting a hivemind_store payload and redirecting stdout into a stray file). Consider documenting node as the runtime for the CLI on Windows, or shipping a smaller entry bundle.
Environment: Windows 11, OpenCode 1.18.18 (desktop), opencode-swarm-plugin 0.63.2, Node v24.12.0.
Symptom: Every plugin tool (
hivemind_*,hive_*,swarmmail_*,swarm_*,cass_*) fails withspawn EINVALon Windows.Root cause: the plugin wrapper spawns the CLI via
child_process.spawn("swarm.cmd", args, { /* no shell:true */ }). Since Node 18.20.2 / 20.12.2 (CVE-2024-27980 mitigation), spawning.cmd/.batwithoutshell: truethrowsEINVAL. Repro:Impact: the entire swarm backend is unusable on Windows.
Local fix that works: replace
import { spawn } from "child_process"withcross-spawn(drop-in, handles .cmd + arg quoting).Related finding: running the CLI via Bun on this machine burns 100% CPU for minutes per invocation (parsing the ~437k-line
dist/bin/swarm.js); invoking it with node directly (node dist/bin/swarm.js ...) starts in <1s and also avoids cmd.exe mangling shell metacharacters (>,&,|) inside--jsonpayloads (observed corrupting ahivemind_storepayload and redirecting stdout into a stray file). Consider documenting node as the runtime for the CLI on Windows, or shipping a smaller entry bundle.