Volta's Windows shims exec through `cmd /C`, which re-parses the argument
list, so the `>=` inside the probe's `node -e` payload was read as output
redirection. The command died with "The filename, directory name, or volume
label syntax is incorrect" before node started, the guard read that as a
missing runtime, and the hook it exists to protect was disabled on every
PostToolUse and Stop. A user on a supported Node 24 got a one-time notice
telling them to install Node 22, then silence.
Clamping with Math.min is the same floor test in the same ES5-only syntax,
with no character cmd.exe can claim. Verified through the Volta shim on Node
24.16.0 and 22.18.0 (exit 0) and against a real Node 20.6.1 binary (exit 1),
so the floor is unchanged. Adds a regression test asserting no `<`, `>`, or
newline reaches any generated `node -e` payload.
Upstream cause: volta-cli/volta#1791.
Prepared with AI assistance (Claude Code).
Upgrade @babel/parser from 7.29.7 to 8.0.4 and raise the repository Node 22 minimum from 22.12.0 to 22.18.0 across package metadata, CI, and npm documentation.
No parser API migration was required. Validated with the full local suite and refreshed GitHub CI on Node 22.18.0 and Node 24.
Prepared and validated with AI assistance from OpenAI Codex under maintainer instructions.
Version bumps for all three components plus the build:release sync of
the tracked harness dirs and the plugin subtree at 4.0.4, rebased onto
the composition-axes work so the release carries both threads.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions[bot]
Rex LorenzoandGitHub
dependabot[bot]andGitHub
Paul BakausandClaude Fable 5