Lint rule: require `windowsHide: true` on every child_process call in production source

Open
  • Is something wrong?
#1,763 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@SaulMoro is already working on this.

Since Nov 6, 2026.

  • #1775 by @SaulMoro — open

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Stale
Tech stack
eslint, node.js, typescript
Domain
testing-qa, tooling

Research direction

Read the existing oxlint-plugin-teamai rules, using home-env.js as the small example, and inspect ruleHarness fixtures plus .oxlintrc.json. Start by checking how the plugin handles production source and suppression reasons; the issue leaves a decision about options passed through variables. Done means the rule is enabled, fixtures cover each handled call shape, and the stated lint and Vitest commands pass; the linked pull request is already open.

Written by the indexing model from the issue text.

Description

enhancement help wanted

Problem

A child process started on Windows without windowsHide: true opens a visible console window. teamai starts many processes from hooks, so every missed call site shows up as windows popping up during normal use. This has been fixed call site by call site four times: #506, #672, #686 and #1747. Each fix covered the sites known at the time, and the next one appeared later.

A missed site is still present on main: whereOnWindows in src/utils/cli-path.ts calls execFileSync('where', ...) without windowsHide, and it runs inside background hook passes.

Nothing enforces the option today, so the next new spawn can miss it again.

Proposal

Add a teamai/* rule in oxlint-plugin-teamai that reports a node:child_process call (spawn, spawnSync, execFile, execFileSync, exec, execSync, fork) in production source when its options do not set windowsHide: true. Follow the existing rules (home-env.js is a small example) and test it with ruleHarness fixtures.

AGENTS.md ("Testing before a PR") says import boundaries, banned APIs and required options belong in this plugin, not in source-scanning tests.

Points to settle in the PR:

  • An options object that is built elsewhere and passed as a variable: either require a shared helper that sets the option, or report it so the author makes it explicit. Pick one and say why.
  • A call site that must show a window on purpose (if any exists) uses the repository's suppression convention with a reason (teamai/suppression-reason).
  • Processes started through simple-git are out of scope for this issue.

Acceptance criteria

  1. npm run lint fails on a production child_process call without windowsHide: true, with a message that names the option.
  2. npm run lint passes on main after the PR, with every existing site fixed or suppressed with a reason; whereOnWindows is fixed.
  3. Test files under src/__tests__/ are not checked by the rule.

Definition of done

  • Rule and ruleHarness fixtures (one passing and one failing case for each call shape the rule handles).
  • The rule is enabled in .oxlintrc.json.
  • npm run lint and npx vitest run oxlint-plugin-teamai pass.
  • Fixing the flagged sites changes runtime code, so the PR carries one real-CLI record (AGENTS.md "Testing before a PR"): a command that reaches a fixed site, run after npm run build.
Dominant language
TypeScript
Stars
5.7k
Forks
486
Avg merge
13h 3m
Merged PRs (30d)
474

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Tencent/teamai-cli

All issues in Tencent/teamai-cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.