Fix Windows merge command quoting and harden CLI execution

[mguzmanm]

Fixes

#111

Changes

Screenshots

Checklist

• 🤖 This change is covered by unit tests (if applicable).
• 🤹 Manual testing has been performed (if necessary).
• 🛡️ Security impacts have been considered (if relevant).
• 📖 Documentation updates are complete (if required).
• 🧠 Third-party dependencies and TPIP updated (if required).

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 860cdcf.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/shell-quote	1.8.3	🟢 4.2	Details Check Score Reason Code-Review ⚠️ 1 Found 3/30 approved changesets -- score normalized to 1 Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 2 1 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[qltysh]

Coverage Impact

⬆️ Merging this pull request will increase total coverage on main by 0.20%.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	src/views/solution-outline/commands/merge-command.ts	94.4%	220
	Total	94.4%

🤖 Increase coverage with AI coding...

In the `ow_merge` branch, add test coverage for this new code:

- `src/views/solution-outline/commands/merge-command.ts` -- Line 220

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[Copilot]

Pull request overview

This PR addresses Issue #111 on Windows where triggering the merge action from the solution outline no longer opens the VS Code merge UI, by changing how the VS Code CLI merge command is constructed and executed and by extending unit test coverage around the merge flow.

Changes:

• Reworked merge CLI invocation to build a quoted command string and added path validation before execution.
• Updated merge execution to use exec(command, { windowsHide: true }) and expanded unit tests for cross-platform and Windows-specific behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
src/views/solution-outline/commands/merge-command.ts	Replaces array+shell-quote command building with a validated, quoted command string and updates merge execution behavior.
src/views/solution-outline/commands/merge-command.test.ts	Adds/reshapes tests for path validation, non-zero exit behavior, and Windows path handling.

[edriouk]

Tested locally on Windows, works good
However copilot recommendations should be revised an some definitely implemented

[edriouk]

LGTM