DEP0190 DeprecationWarning: shell option with args is a security risk

Description

When starting Claude Code, Node.js emits a deprecation warning about a potential security vulnerability:

(node:53875) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)

The Issue

This warning indicates that somewhere in Claude Code's codebase (or a dependency), a child process is being spawned with shell: true while also passing arguments. This pattern is dangerous because:

1. Arguments are concatenated into a shell command string without escaping
2. Shell metacharacters in arguments can lead to command injection
3. Node.js has deprecated this pattern as of v22

Reproduction

ccr code  # or however you start Claude Code

The warning appears during service startup.

Suggested Fix

Either:

1. Use shell: false and pass arguments as an array (Node handles escaping)
2. Or manually escape arguments before passing to shell

Environment

• Platform: macOS
• Node.js: v22+
• Claude Code: latest