fix: address Copilot review comments

- resolveInstallDir: use directory mtime instead of lexicographic sort
  to pick the newest JetBrains installation (fixes 2024.9 vs 2024.10)
- runInDir RunAsUser path: shell-quote name and args via platformShellQuote
  to prevent issues with spaces/metacharacters
- Fix stale yarn global Windows test to match RunInDir call shape

Author: swarit-stepsecurity

internal/detector/ide.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"path/filepath"
-	"sort"
 	"strings"
 	"time"
 
@@ -243,7 +242,8 @@ func (d *IDEDetector) detectWindows(ctx context.Context, spec ideSpec) (model.ID
 // resolveInstallDir resolves a Windows path to an install directory.
 // Supports glob patterns (e.g., "C:\Program Files\JetBrains\GoLand *")
 // for IDEs that embed version numbers in folder names.
-// When multiple matches exist, returns the last (newest by lexicographic order).
+// When multiple matches exist, returns the most recently modified directory
+// (more reliable than lexicographic sort which fails for "2024.9" vs "2024.10").
 func (d *IDEDetector) resolveInstallDir(resolved string) (string, bool) {
 	if !strings.ContainsAny(resolved, "*?[") {
 		if d.exec.DirExists(resolved) {
@@ -257,19 +257,32 @@ func (d *IDEDetector) resolveInstallDir(resolved string) (string, bool) {
 		return "", false
 	}
 
-	// Filter to directories only
-	var dirs []string
+	// Filter to directories and pick the most recently modified one
+	var newest string
+	var newestTime int64
 	for _, m := range matches {
-		if d.exec.DirExists(m) {
-			dirs = append(dirs, m)
+		if !d.exec.DirExists(m) {
+			continue
+		}
+		info, err := d.exec.Stat(m)
+		if err != nil {
+			// Can't stat — still consider it as a candidate
+			if newest == "" {
+				newest = m
+			}
+			continue
+		}
+		mtime := info.ModTime().Unix()
+		if mtime > newestTime {
+			newestTime = mtime
+			newest = m
 		}
 	}
-	if len(dirs) == 0 {
+
+	if newest == "" {
 		return "", false
 	}
-
-	sort.Strings(dirs)
-	return dirs[len(dirs)-1], true
+	return newest, true
 }
 
 // runVersionCmd runs a binary with a version flag and extracts the first line.

internal/detector/ide_test.go

@@ -266,13 +266,11 @@ func TestIDEDetector_Windows_FindsGoLand_Glob(t *testing.T) {
 	mock.SetEnv("PROGRAMFILES", `C:\Program Files`)
 
 	globPattern := `C:\Program Files\JetBrains\GoLand *`
-	golandOld := `C:\Program Files\JetBrains\GoLand 2024.1`
-	golandNew := `C:\Program Files\JetBrains\GoLand 2025.1.3`
-	mock.SetGlob(globPattern, []string{golandOld, golandNew})
-	mock.SetDir(golandOld)
-	mock.SetDir(golandNew)
+	golandPath := `C:\Program Files\JetBrains\GoLand 2025.1.3`
+	mock.SetGlob(globPattern, []string{golandPath})
+	mock.SetDir(golandPath)
 
-	productInfoPath := golandNew + "/product-info.json"
+	productInfoPath := golandPath + "/product-info.json"
 	mock.SetFile(productInfoPath,
 		[]byte(`{"name":"GoLand","version":"2025.1.3","buildNumber":"251.26927.50"}`))
 
@@ -286,8 +284,8 @@ func TestIDEDetector_Windows_FindsGoLand_Glob(t *testing.T) {
 	if found.Version != "2025.1.3" {
 		t.Errorf("expected 2025.1.3, got %s", found.Version)
 	}
-	if found.InstallPath != golandNew {
-		t.Errorf("expected install path %s, got %s", golandNew, found.InstallPath)
+	if found.InstallPath != golandPath {
+		t.Errorf("expected install path %s, got %s", golandPath, found.InstallPath)
 	}
 }
 

internal/detector/nodescan.go

@@ -74,9 +74,9 @@ func (s *NodeScanner) runInDir(ctx context.Context, dir string, timeout time.Dur
 	if s.shouldRunAsUser() {
 		ctx, cancel := context.WithTimeout(ctx, timeout)
 		defer cancel()
-		cmd := "cd " + platformShellQuote(s.exec, dir) + " && " + name
+		cmd := "cd " + platformShellQuote(s.exec, dir) + " && " + platformShellQuote(s.exec, name)
 		for _, a := range args {
-			cmd += " " + a
+			cmd += " " + platformShellQuote(s.exec, a)
 		}
 		stdout, err := s.exec.RunAsUser(ctx, s.loggedInUser, cmd)
 		if err != nil {

internal/detector/nodescan_test.go

@@ -89,9 +89,9 @@ func TestNodeScanner_ScanYarnGlobal_Windows(t *testing.T) {
 	mock.SetPath("yarn", `C:\Program Files\nodejs\yarn.cmd`)
 	mock.SetCommand("1.22.19\n", "", 0, "yarn", "--version")
 	mock.SetCommand(`C:\Users\dev\AppData\Local\Yarn\Data\global`+"\n", "", 0, "yarn", "global", "dir")
-	// runShellCmd dispatches to cmd /c on Windows; platformShellQuote uses double quotes
+	// RunInDir calls Run(name, args...) directly — no shell cd needed
 	mock.SetCommand(`{"type":"tree","data":{"trees":[]}}`, "", 0,
-		"cmd", "/c", `cd "C:\Users\dev\AppData\Local\Yarn\Data\global" && yarn list --json --depth=0`)
+		"yarn", "list", "--json", "--depth=0")
 
 	scanner := newTestScanner(mock)
 	results := scanner.ScanGlobalPackages(context.Background())