fix(core): spawn the sandbox dev server as one shell string (no DEP0190 on Node 24) (#981)

Author: osama-rizk

.changeset/sandbox-dep0190.md

@@ -0,0 +1,8 @@
+---
+"@aws-blocks/core": patch
+"@aws-blocks/blocks": patch
+---
+
+fix(core): stop `npm run sandbox` printing a DEP0190 deprecation warning on Node 24
+
+The sandbox started the local dev server by splitting its command on spaces and passing the pieces as separate args together with `shell: true`. Node 24 warns about that combination (DEP0190, args are concatenated rather than escaped). The command now goes to the shell as a single string, so the warning is gone and the dev server starts exactly as before.

packages/core/src/scripts/sandbox-args.test.ts

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import type { CloudFormationClient } from '@aws-sdk/client-cloudformation';
 import {
   buildSandboxCdkEnv,
+  buildDevServerSpawn,
   buildSandboxDeployArgs,
   buildSandboxSynthArgs,
   findExpressUnsafeStacks,
@@ -207,3 +208,23 @@ describe('buildSandboxCdkEnv — framework sink reaches the synth child, and hon
     assert.ok(!(FRAMEWORK_SINK_ENV in env), `opted-out run must not set ${FRAMEWORK_SINK_ENV}`);
   });
 });
+
+describe('buildDevServerSpawn', () => {
+  // The dev server runs under `shell: true`. Node 24 emits DEP0190 whenever a
+  // non-empty args array is passed alongside `shell: true` (the args are only
+  // concatenated, not escaped), so the whole command must go to the shell as
+  // one string with no separate args.
+  it('passes the default command as one shell string with no args', () => {
+    assert.deepStrictEqual(buildDevServerSpawn(undefined), {
+      command: 'npx tsx watch aws-blocks/scripts/server.ts',
+      args: [],
+    });
+  });
+
+  it('passes a custom devCommand through unsplit', () => {
+    assert.deepStrictEqual(buildDevServerSpawn('npx next dev --port 3100'), {
+      command: 'npx next dev --port 3100',
+      args: [],
+    });
+  });
+});

packages/core/src/scripts/sandbox.ts

@@ -44,6 +44,16 @@ export interface SandboxOptions {
   devCommand?: string;
 }
 
+/**
+ * How the sandbox spawns the local dev server. It runs under `shell: true`, so
+ * the whole command goes to the shell as one string with no separate args:
+ * Node 24 emits DEP0190 whenever a non-empty args array is combined with
+ * `shell: true`, because the args are only concatenated, never escaped.
+ */
+export function buildDevServerSpawn(devCommand: string | undefined): { command: string; args: string[] } {
+  return { command: devCommand || 'npx tsx watch aws-blocks/scripts/server.ts', args: [] };
+}
+
 export interface SandboxDeployArgsOptions {
   /** Directory CDK writes stack outputs to (relative to the project root). */
   outDir: string;
@@ -353,10 +363,9 @@ export async function startSandbox(options: SandboxOptions) {
     console.error(`[CDK Watch] ${data.toString().trim()}`);
   });
 
-  const devServerCmd = devCommand || `npx tsx watch aws-blocks/scripts/server.ts`;
-  const [cmd, ...args] = devServerCmd.split(' ');
-  
-  const devServer = spawnCommand(cmd, args, {
+  const devServerSpawn = buildDevServerSpawn(devCommand);
+
+  const devServer = spawnCommand(devServerSpawn.command, devServerSpawn.args, {
     stdio: "inherit",
     shell: true,
     // Own process group on POSIX so cleanup can signal the whole dev-server