fix(platform,xlings): a program probe is an argument vector, not a /bin/sh string

The vendored-xlings version probe ran `<xlings> --version 2>/dev/null` as a
command string. On Windows every command string reaches cmd.exe, which cannot
open /dev/null: it printed "The system cannot find the path specified." in
every command after the first, did not run xlings, and returned an empty
version, so a Windows home never replaced a vendored xlings older than the pin.

mcpp.platform.process gains capture_stdout: the program runs directly, its
standard output is captured, its standard error is discarded and its standard
input is empty; on Windows the redirect names cmd.exe's own null device. The
xlings probe and the four other program probes that carried POSIX grammar on
a path Windows reaches use it: the clean link specs, the libstdc++ fallback
probe, the freestanding size report and the publish digest.

Tests: capture_stdout unit tests (stdout only, exit code, empty stdin,
environment, empty output for a missing program, the Windows command line);
a version-probe unit test that runs a .bat through the real launcher on
Windows; e2e 687 (no path error on the second command; an older vendored
binary is replaced).

Author: speak-agent

modules/platform/src/process.cppm

@@ -32,6 +32,7 @@ module;
 // Linux and macOS launchers do a direct exec (see run_exec / capture_exec
 // below); only Windows keeps the std::system shell path (#248).
 #include <unistd.h>    // pipe, dup2, close, read
+#include <fcntl.h>     // O_RDONLY, O_WRONLY for capture_stdout's /dev/null
 #include <sys/wait.h>  // waitpid
 #include <spawn.h>     // posix_spawnp, posix_spawn_file_actions_* (incl. addchdir_np)
 // The deadline runners' headers (signal.h, errno, poll.h, fcntl.h, time.h)
@@ -110,6 +111,37 @@ RunResult capture_exec(
     std::string_view cwd = {},
     int* spawn_error = nullptr);
 
+// A PROGRAM PROBE: run `argv` directly, capture its standard output only, give
+// it an empty standard input, and discard its standard error.
+//
+// This is the argument-vector form of `<program> <args> 2>/dev/null`, and it
+// exists because that string form is written in one shell's grammar. On
+// Windows every command string reaches cmd.exe, which resolves `/dev/null` to
+// `\dev\null` on the current drive, cannot open it, prints "The system cannot
+// find the path specified." on its own stderr and does not run the program.
+// Measured on windows-2022 with mcpp 2026.9.14.3: the vendored-xlings version
+// probe printed that line in every command after the first, and returned an
+// empty version, which silently disabled the pin check it existed for. The
+// null device and the redirection belong to this layer; a caller states only
+// the program and its arguments.
+//
+// The output is the program's standard output and nothing else. A program
+// that cannot be started yields exit code 127 and EMPTY output: a probe parses
+// what it captured, so a launcher error message in `output` would be read as
+// the program's answer. `spawn_error` has run_exec's contract.
+RunResult capture_stdout(
+    const std::vector<std::string>& argv,
+    const std::vector<std::pair<std::string, std::string>>& extraEnv = {},
+    int* spawn_error = nullptr);
+
+// capture_stdout for a host tool: the target runtime library search variable is
+// cleared for the child, as capture_host_tool does for a command string.
+RunResult capture_host_tool_stdout(const std::vector<std::string>& argv);
+
+// The command line capture_stdout hands to cmd.exe on Windows. Host-independent
+// so the Windows rendering is testable from any platform.
+std::string windows_stdout_probe_command(const std::vector<std::string>& argv);
+
 // Deadline variants: kill the child once `deadline` elapses and set
 // *timed_out. A zero deadline means no limit.
 //
@@ -753,6 +785,86 @@ RunResult capture_exec(
 #endif
 }
 
+// Host-independent (see the declaration): always the Windows shape. The
+// redirect names cmd.exe's own null device, and the argv is quoted by the one
+// shaper every Windows launch in this file uses.
+std::string windows_stdout_probe_command(const std::vector<std::string>& argv) {
+    return windows_command_from_argv(argv) + " 2>nul";
+}
+
+RunResult capture_stdout(
+    const std::vector<std::string>& argv,
+    const std::vector<std::pair<std::string, std::string>>& extraEnv,
+    int* spawn_error)
+{
+    RunResult result;
+    if (spawn_error) *spawn_error = 0;
+    if (argv.empty()) { result.exit_code = 127; return result; }
+#if defined(__linux__) || defined(__APPLE__)
+    int fds[2];
+    if (::pipe(fds) != 0) { result.exit_code = 127; return result; }
+
+    auto envStore = merged_environ(extraEnv);
+    std::vector<char*> envp;
+    for (auto& s : envStore) envp.push_back(s.data());
+    envp.push_back(nullptr);
+    std::vector<char*> cargv;
+    for (auto& a : argv) cargv.push_back(const_cast<char*>(a.c_str()));
+    cargv.push_back(nullptr);
+
+    posix_spawn_file_actions_t fa;
+    ::posix_spawn_file_actions_init(&fa);
+    ::posix_spawn_file_actions_addopen(&fa, 0, "/dev/null", O_RDONLY, 0);
+    ::posix_spawn_file_actions_adddup2(&fa, fds[1], 1);   // stdout -> pipe
+    ::posix_spawn_file_actions_addopen(&fa, 2, "/dev/null", O_WRONLY, 0);
+    ::posix_spawn_file_actions_addclose(&fa, fds[0]);
+    ::posix_spawn_file_actions_addclose(&fa, fds[1]);
+
+    // Owned as capture_exec's child is: a probe that outlives an interrupted
+    // mcpp is the same orphan, only smaller.
+    posix_spawnattr_t attr;
+    ::posix_spawnattr_init(&attr);
+    ::posix_spawnattr_setpgroup(&attr, 0);
+    ::posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETPGROUP);
+
+    pid_t pid = 0;
+    int sp = ::posix_spawnp(&pid, cargv[0], &fa, &attr, cargv.data(), envp.data());
+    ::posix_spawnattr_destroy(&attr);
+    ::posix_spawn_file_actions_destroy(&fa);
+    ::close(fds[1]);
+    if (sp != 0) {
+        ::close(fds[0]);
+        result.exit_code = 127;
+        if (spawn_error) *spawn_error = sp;
+        return result;
+    }
+    mcpp::platform::unixproc::guard_group_on_signal(pid);
+
+    std::array<char, 4096> buf{};
+    ssize_t n;
+    while ((n = ::read(fds[0], buf.data(), buf.size())) > 0)
+        result.output.append(buf.data(), static_cast<size_t>(n));
+    ::close(fds[0]);
+    int status = 0;
+    while (::waitpid(pid, &status, 0) < 0) { /* EINTR retry */ }
+    mcpp::platform::unixproc::unguard_group(pid);
+    result.exit_code = normalize_exit_code(status);
+    return result;
+#else
+    // cmd.exe reports a program it cannot find on stderr, which the redirect
+    // discards, and returns 9009; the output stays empty either way.
+    return capture_with_env(windows_stdout_probe_command(argv), extraEnv);
+#endif
+}
+
+RunResult capture_host_tool_stdout(const std::vector<std::string>& argv) {
+    auto key = mcpp::platform::env::host_tool_runtime_library_path_key();
+    std::optional<mcpp::platform::env::ScopedEnv> runtime_env;
+    if (!key.empty())
+        runtime_env.emplace(key, std::nullopt);
+    return capture_stdout(argv);
+}
+
 // ─── The ONE place the platform question is asked for a bounded run ────────
 //
 // Both launchers answer the same contract behind a `std`-free interface (see

src/build/execute.cppm

@@ -810,11 +810,12 @@ void report_freestanding_size(const BuildContext& ctx) {
         auto art = ctx.outputDir / lu.output;
         std::error_code ec;
         if (!std::filesystem::exists(art, ec)) continue;
-        auto out = mcpp::xlings::run_capture(std::format(
-            "{} {} 2>/dev/null", mcpp::xlings::shq(tool.string()),
-            mcpp::xlings::shq(art.string())));
-        if (!out) continue;
-        auto s = mcpp::freestanding::parse_size_output(*out);
+        // An argument vector rather than a `2>/dev/null` command string,
+        // which cmd.exe cannot open on a Windows host.
+        auto out = mcpp::platform::process::capture_stdout(
+            {tool.string(), art.string()});
+        if (out.exit_code != 0 && out.output.empty()) continue;
+        auto s = mcpp::freestanding::parse_size_output(out.output);
         if (!s) continue;
         mcpp::ui::info("Size", std::format(
             "{}  text {}  data {}  bss {}  total {}",

src/fallback/xlings_binary.cppm

@@ -156,8 +156,12 @@ acquire_xlings_binary(const std::filesystem::path& destBin, bool quiet = false,
 std::string vendored_xlings_version(const std::filesystem::path& bin) {
     std::error_code ec;
     if (!std::filesystem::exists(bin, ec)) return {};
-    auto r = mcpp::platform::process::capture(std::format(
-        "{} --version 2>/dev/null", mcpp::platform::shell::quote(bin.string())));
+    // An argument vector, not a command string. The string form carried
+    // `2>/dev/null`, which cmd.exe cannot open: on Windows it printed "The
+    // system cannot find the path specified." in every command after the first,
+    // did not run xlings, and so returned an empty version, which made the
+    // pin comparison in acquire_xlings_binary return early forever.
+    auto r = mcpp::platform::process::capture_stdout({bin.string(), "--version"});
     if (r.exit_code != 0) return {};
     // Output carries ANSI colour; take the first dotted-numeric run.
     std::string out;

src/pm/publisher.cppm

@@ -360,9 +360,10 @@ std::string release_tarball_url(std::string_view repo,
 
 std::string sha256_of_file(const std::filesystem::path& file) {
     if (!std::filesystem::exists(file)) return {};
-    auto cmd = std::format("sha256sum {} 2>/dev/null",
-        mcpp::platform::shell::quote(file.string()));
-    auto r = mcpp::platform::process::capture_host_tool(cmd);
+    // An argument vector rather than a `2>/dev/null` command string, which
+    // cmd.exe cannot open on a Windows host.
+    auto r = mcpp::platform::process::capture_host_tool_stdout(
+        {"sha256sum", file.string()});
     if (r.exit_code != 0) return {};
     // sha256sum format: "<64-hex>  <filename>\n"
     auto sp = r.output.find(' ');

src/toolchain/gcc.cppm

@@ -123,11 +123,12 @@ std::optional<std::filesystem::path> find_std_module_source(
         }
     }
 
-    auto cmd = std::format("'{}' -print-file-name=libstdc++.so 2>/dev/null",
-                           cxx_binary.string());
-    auto r = mcpp::toolchain::run_capture(cmd);
-    if (r) {
-        auto trimmed = mcpp::toolchain::trim_line(*r);
+    // An argument vector: the command-string form was written for /bin/sh
+    // (single quotes and `2>/dev/null`), and cmd.exe reads neither.
+    auto r = mcpp::platform::process::capture_host_tool_stdout(
+        {cxx_binary.string(), "-print-file-name=libstdc++.so"});
+    if (r.exit_code == 0) {
+        auto trimmed = mcpp::toolchain::trim_line(r.output);
         if (!trimmed.empty()) {
             std::filesystem::path libpath = trimmed;
             auto root2 = libpath.parent_path().parent_path();

src/toolchain/post_install.cppm

@@ -849,9 +849,11 @@ std::filesystem::path write_clean_link_specs(
     // regenerating it every build would spawn a process for a constant.
     if (std::filesystem::exists(out, ec)) return out;
 
-    auto r = mcpp::platform::process::capture(std::format(
-        "{} -dumpspecs 2>/dev/null",
-        mcpp::platform::shell::quote(compilerBin.string())));
+    // An argument vector: the command-string form carried `2>/dev/null`, which
+    // cmd.exe cannot open, so on a Windows host this probe printed a spurious
+    // path error in every prepared GCC build and never produced the file.
+    auto r = mcpp::platform::process::capture_stdout(
+        {compilerBin.string(), "-dumpspecs"});
     if (r.exit_code != 0 || r.output.empty()) return {};
 
     // `*link:` is a section header on its own line; its body is the next line.

tests/e2e/687_the_vendored_xlings_probe_is_an_argument_vector.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# requires:
+# 687 -- the vendored-xlings version probe is an argument vector.
+#
+# It was the command string `<xlings> --version 2>/dev/null`. On Windows every
+# command string reaches cmd.exe, which cannot open `/dev/null`: it printed "The
+# system cannot find the path specified." in every command after the first, did
+# not run xlings, and returned an empty version. acquire_xlings_binary reads an
+# empty version as "unknown, keep it", so a Windows home never replaced a
+# vendored xlings older than the pin. Measured on windows-2022 with 2026.9.14.3.
+#
+# Criteria, in a home whose vendored xlings exists before the command runs:
+#   A. The command's stderr carries no path error. The denominator is that the
+#      vendored binary exists, so the probe did run.
+#   B. A vendored binary whose `--version` answers a version older than the pin
+#      is replaced from MCPP_VENDORED_XLINGS, and the command says so. The stand-in
+#      is the ninja payload, whose `--version` prints a dotted version older than
+#      any dated xlings. Not `subos/default/bin/ninja`: that is an xlings shim, one
+#      multicall binary that answers as xlings once it is named `xlings`, and for
+#      the same reason the real xlings is kept under its own name.
+# A and B discriminate on Windows; elsewhere they are the control legs.
+set -e
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+fail() { echo "FAIL: $1"; shift; for f in "$@"; do echo "--- $f ---"; cat "$f" 2>/dev/null; done; exit 1; }
+
+EXE=""
+case "$(uname -s)" in MINGW*|MSYS*|CYGWIN*) EXE=".exe" ;; esac
+
+export MCPP_HOME="$TMP/mcpp-home"
+# Offline: configuration loading still acquires the vendored xlings (it copies
+# a local binary), and no bootstrap step reaches the network.
+export MCPP_OFFLINE=1
+source "$(dirname "$0")/_inherit_toolchain.sh"
+cd "$TMP"
+
+VENDORED="$MCPP_HOME/registry/bin/xlings$EXE"
+
+"$MCPP" self env > first.out 2> first.err || true
+[ -f "$VENDORED" ] || fail "the first command did not vendor xlings at $VENDORED" first.out first.err
+
+# ── A ──────────────────────────────────────────────────────────────────────
+"$MCPP" self env > second.out 2> second.err || true
+if grep -qi 'cannot find the path specified' second.err; then
+    fail "A: the version probe reached a shell that could not open its redirect" second.err
+fi
+echo "ok: A, the probe ran and wrote nothing to stderr"
+
+# ── B ──────────────────────────────────────────────────────────────────────
+NINJA=""
+for cand in "$MCPP_HOME"/registry/data/xpkgs/xim-x-ninja/*/ninja$EXE \
+            "$MCPP_HOME"/registry/data/xpkgs/xim-x-ninja/*/bin/ninja$EXE; do
+    if [ -f "$cand" ]; then NINJA="$cand"; break; fi
+done
+[ -n "$NINJA" ] || fail "B: no ninja binary to stand in for an older xlings under $MCPP_HOME/registry"
+older=$("$NINJA" --version 2>/dev/null | head -1)
+case "$older" in
+    [0-9]*.*) ;;
+    *) fail "B: the stand-in '$NINJA' answered '$older', not a dotted version" ;;
+esac
+
+mkdir -p "$TMP/real"
+cp "$VENDORED" "$TMP/real/xlings$EXE"
+rm -f "$VENDORED"
+cp "$NINJA" "$VENDORED"
+chmod +x "$VENDORED" 2>/dev/null || true
+
+MCPP_VENDORED_XLINGS="$TMP/real/xlings$EXE" "$MCPP" self env > third.out 2> third.err || true
+grep -q "vendored xlings $older -> " third.err \
+    || fail "B: a vendored xlings answering $older was not replaced" third.out third.err
+"$VENDORED" --version 2>/dev/null | grep -q '^xlings ' \
+    || fail "B: after the replacement the vendored binary is not xlings" third.err
+echo "ok: B, a vendored binary older than the pin was replaced"

tests/unit/test_process_run_exec.cpp

@@ -215,6 +215,47 @@ TEST(CaptureExecDeadline, SpawnFailureIsInOutputWhenCallerDoesNotAsk) {
     EXPECT_NE(r.output.find("error 2"), std::string::npos) << r.output;
 }
 
+// ── capture_stdout: the argument-vector form of `<program> 2>/dev/null` ──
+
+TEST(CaptureStdout, CapturesStandardOutputOnly) {
+    auto r = process::capture_stdout(
+        {"/bin/sh", "-c", "echo out; echo 9.9.9-on-stderr 1>&2"});
+    EXPECT_EQ(r.exit_code, 0);
+    EXPECT_EQ(r.output, "out\n");
+}
+
+TEST(CaptureStdout, PropagatesExitCode) {
+    auto r = process::capture_stdout({"/bin/sh", "-c", "echo partial; exit 3"});
+    EXPECT_EQ(r.exit_code, 3);
+    EXPECT_EQ(r.output, "partial\n");
+}
+
+// A probe parses what it captured, so a launcher message must never be read
+// as the program's answer: a missing program leaves the output empty.
+TEST(CaptureStdout, MissingProgramLeavesOutputEmpty) {
+    int spawnErr = 0;
+    auto r = process::capture_stdout({"/no/such/program/mcpp-probe-2026.1.2.3"},
+                                     {}, &spawnErr);
+    EXPECT_EQ(r.exit_code, 127);
+    EXPECT_EQ(spawnErr, ENOENT);
+    EXPECT_TRUE(r.output.empty()) << r.output;
+}
+
+TEST(CaptureStdout, StandardInputIsEmpty) {
+    // `cat` returns at once with nothing when stdin is /dev/null; with an
+    // inherited terminal or pipe it would block or echo the parent's input.
+    auto r = process::capture_stdout({"/bin/sh", "-c", "cat; echo done"});
+    EXPECT_EQ(r.exit_code, 0);
+    EXPECT_EQ(r.output, "done\n");
+}
+
+TEST(CaptureStdout, ExtraEnvironmentReachesTheChild) {
+    auto r = process::capture_stdout({"/bin/sh", "-c", "printf %s \"$MCPP_PROBE_ENV\""},
+                                     {{"MCPP_PROBE_ENV", "reached"}});
+    EXPECT_EQ(r.exit_code, 0);
+    EXPECT_EQ(r.output, "reached");
+}
+
 #else  // _WIN32
 
 TEST(RunExec, WindowsCoveredByIntegration) {
@@ -224,3 +265,12 @@ TEST(RunExec, WindowsCoveredByIntegration) {
 }
 
 #endif
+
+// Host-independent: the command line capture_stdout gives cmd.exe names cmd's
+// own null device, never a POSIX path cmd would try to open as `\dev\null`.
+TEST(CaptureStdout, WindowsCommandNamesCmdNullDevice) {
+    auto line = process::windows_stdout_probe_command(
+        {"C:\\Program Files\\xlings\\xlings.exe", "--version"});
+    EXPECT_EQ(line, "\"C:\\Program Files\\xlings\\xlings.exe\" \"--version\" 2>nul");
+    EXPECT_EQ(line.find("/dev/null"), std::string::npos) << line;
+}

tests/unit/test_xlings_version_pin.cpp

@@ -13,6 +13,7 @@
 // one, and an unparseable version is not evidence of being behind.
 
 #include <gtest/gtest.h>
+#include <fstream>
 
 import std;
 import mcpp.fallback.xlings_binary;
@@ -63,4 +64,38 @@ TEST(XlingsVersionPin, DatedSchemeIsNewerThanTheOldOne) {
     EXPECT_TRUE(fb::version_is_older("0.4.51", "0.4.54"));
 }
 
+// THE PROBE READS STANDARD OUTPUT, AND ON WINDOWS IT RUNS AT ALL.
+//
+// The version used to be read through the command string
+// `<bin> --version 2>/dev/null`. cmd.exe cannot open `/dev/null`, so on Windows
+// the probe printed "The system cannot find the path specified.", never ran
+// xlings, and returned an empty version -- which acquire_xlings_binary reads as
+// "unknown, keep it", so a Windows home never moved to a newer pin. On Windows
+// this test runs a .bat through the real launcher, which is the path that
+// failed; elsewhere a shell script. Both print a dotted number on stderr first,
+// which must not be taken for the version.
+TEST(XlingsVersionPin, ProbeReadsStandardOutputThroughTheLauncher) {
+    auto dir = std::filesystem::temp_directory_path()
+             / std::format("mcpp probe {}", std::chrono::steady_clock::now().time_since_epoch().count());
+    std::filesystem::create_directories(dir);
+#if defined(_WIN32)
+    auto fake = dir / "xlings.bat";
+    {
+        std::ofstream os(fake, std::ios::binary);
+        os << "@echo off\r\necho warning 9.9.9 1>&2\r\necho xlings 2026.1.2.3\r\n";
+    }
+#else
+    auto fake = dir / "xlings";
+    {
+        std::ofstream os(fake, std::ios::binary);
+        os << "#!/bin/sh\necho 'warning 9.9.9' 1>&2\nprintf 'xlings 2026.1.2.3\\n'\n";
+    }
+    std::filesystem::permissions(fake, std::filesystem::perms::owner_all,
+                                 std::filesystem::perm_options::replace);
+#endif
+    EXPECT_EQ(fb::vendored_xlings_version(fake), "2026.1.2.3");
+    std::error_code ec;
+    std::filesystem::remove_all(dir, ec);
+}
+
 }  // namespace