Function cmdQuote

src/utils/deepLink/terminalLauncher.ts:553–557

* cmd.exe argument quoting. cmd.exe does NOT use CommandLineToArgvW-style * backslash escaping — it toggles its quoting state on every raw " * character, so an embedded " breaks out of the quoted region and exposes * metacharacters (& | < > ^) to cmd.exe interpretation = command injection. * *

(arg: string)

 * \ before our closing " would eat the close-quote.
 */
function cmdQuote(arg: string): string {
  const stripped = arg.replace(/"/g, '').replace(/%/g, '%%')
  const escaped = stripped.replace(/(\\+)$/, '$1$1')
  return `"${escaped}"`
}