PR #24699 real-environment verification, 2026-10-30 Linux Boat VM; Node v24.22.1; /usr/bin/google-chrome; repo Playwright 1.60.0. Main baseline: git worktree add ../main github/main HEAD 5ef56853ef1854da50bc1909c6c0a32700f2cb13 timeout 600 vp i background: setsid nohup vp run dev [dev-runner] serverPort=16733 webPort=8693 baseDir=/home/user/main/.t3 Fresh isolated state, no seeded/demo data. Added /home/user/main through Add project > Local folder. Settings > Providers > Codex > Launch arguments: -c 'developer_instructions="Prefer rg | head"' Refresh provider status: Codex v0.164.0 Available. Web composer: Codex gpt-6.1-sol, full access. Requested real provider shell command: printf '%s\n' '{"note":"a & b | c < d > e ^ f"}' Completed in 11s; persisted CLI thread show status=completed. Output: {"note":"a & b | c < d > e ^ f"} cwd: /home/user/main Response appeared in web after reload. Stopped captured main process group 26365 before PR startup. PR: HEAD 9430cfc5b3ad3e24e736f5e796af9af65195fbfb branch fix/c086-01-cmd-shim-args-escaped-once-so-a-quote-pl timeout 600 vp i background: setsid nohup vp run dev [dev-runner] serverPort=13773 webPort=5733 baseDir=/home/user/t3code/.t3 Fresh isolated state; real repo projects created through web UI. Real turn used project /home/user/t3code/apps/server (inside the real git repo). Same Codex launch arguments, refresh: v0.164.0 Available. OS process argv confirmed: codex app-server -c developer_instructions="Prefer rg | head" Web composer: Codex gpt-6.1-sol, full access. Same JSON printf command: output exactly {"note":"a & b | c < d > e ^ f"} Web expanded tool output showed actual /bin/bash -lc command and matching output. CLI thread show: status=completed, model=gpt-6.1-sol, runCount=1. Follow-up in same thread: printf '%s\n' 'plain value' Output: plain value. Completed in 7.1s. CLI runCount=2, status=completed. Cleared launch arguments through Settings; refreshed Codex: Available. Fresh web thread, same model: printf '%s\n' 'default launch ok' Output: default launch ok. Completed. Verified via web and CLI thread show. Blacksmith (not local tests): vp test run packages/shared/src/shell.test.ts 40 passed, 2 skipped. vp test run apps/server/src/processRunner.test.ts apps/server/src/process/externalLauncher.test.ts apps/server/src/provider/providerMaintenanceRunner.test.ts 46 passed, 3 files passed. Limit: no Windows host or cmd.exe on this Linux VM. resolveSpawnCommand returns shell:false before the changed branch on Linux. The Windows double-parse bug could not be reproduced, and the fix is NOT verified by these Linux passes. No shim emulation, mocks, provider wrappers, or synthetic Windows result used. No source changes, commits, or pushes. No new test files.