Stop-review-gate hook masks the real failure: Node 24 DEP0190 warning displaces the actual error in stderr-first reporting

Labels (suggestion): bug, windows

Summary
When the stop-time review task fails on Windows with Node 24, the hook reports only a Node DeprecationWarning instead of the actual failure cause. The real error (in our case: ChatGPT usage limit reached) is only discoverable by manually reading the job logs under CLAUDE_PLUGIN_DATA/state//jobs/*.log.

Environment
Windows 11 Pro (10.0.26200)
Node v24.14.1
codex-cli 0.142.5 (logged in via ChatGPT)
Claude Code 2.1.202
codex plugin 1.0.5
What happens
At turn end with stopReviewGate enabled, Claude Code shows:

Stop hook blocking error: The stop-time Codex review task failed:
(node:98328) [DEP0190] DeprecationWarning: Passing args to a child process
with shell option true can lead to security vulnerabilities, as the arguments
are not escaped, only concatenated.
The actual failure (quota exhausted — "You've hit your usage limit...") never reaches the user. We initially chased the deprecation warning as the root cause; the real error was only visible in the companion job log.

Root-cause chain
scripts/lib/app-server.mjs — SpawnedCodexAppServerClient.initialize():

this.proc = spawn("codex", ["app-server"], {
...
shell: process.platform === "win32" ? (process.env.SHELL || true) : false,
});
shell: true (introduced to fix #85, spawn ENOENT for .cmd shims) combined with an args array makes Node 24 emit DEP0190 on the hook process's stderr.

scripts/stop-review-gate-hook.mjs — runStopReview():

if (result.status !== 0) {
const detail = String(result.stderr || result.stdout || "").trim();
return { ok: false, reason: detail ? The stop-time Codex review task failed: ${detail} : ... };
}
stderr is preferred over stdout. Since stderr now always starts with the DEP0190 warning on Windows/Node 24, the warning displaces whatever useful diagnostics exist. The companion's structured JSON (with rawOutput, threadId) goes to stdout and is never shown.

Impact
Every stop-gate failure on Windows + Node 24 presents as a deprecation warning, regardless of the true cause (quota, auth, network, app-server crash). Users debug the wrong thing. This also compounds #248 (gate blocking on infrastructure errors) by making those errors undiagnosable from the hook output.

Suggested fixes (any one of these helps)
Filter warning noise from stderr before building the failure reason: drop lines matching /^(node:\d+) [DEP\d+]|DeprecationWarning|ExperimentalWarning/.
Silence the warning at the source: spawn the companion/app-server child with NODE_OPTIONS=--no-deprecation (or pass a single command string when shell: true, which avoids DEP0190 entirely).
Prefer structured output: when stdout parses as the companion's JSON, report rawOutput/job-log error content instead of raw stderr; fall back to stderr only when stdout is empty.
Happy to provide the full job log excerpt if useful.

Start with scripts/lib/app-server.mjs and scripts/stop-review-gate-hook.mjs, tracing how the Windows/Node 24 child-process warning and companion output are collected. Reproduce the stop-review failure in the stated environment or inspect the job logs under CLAUDE_PLUGIN_DATA/state//jobs/*.log. Done means the hook surfaces the underlying quota, authentication, network, or app-server error instead of allowing DEP0190 to mask it.