Fix CDS extractor for cds-indexer private package dependency installation

extractors/cds/tools/cds-extractor.ts

@@ -115,6 +115,7 @@ try {
         new Set([
           ...globSync(join(sourceRoot, '**/*.cds'), {
             ignore: ['**/node_modules/**', '**/.git/**'],
+            windowsPathsNoEscape: true,
           }),
         ]),
       );

extractors/cds/tools/index-files.cmd

@@ -6,7 +6,7 @@ REM - assumes it is run from the root of the project source directory;
 
 where node >nul 2>nul
 if %ERRORLEVEL% neq 0 (
-    echo node executable is required (in PATH) to run the 'cds-extractor.bundle.js' script. Please install Node.js and try again.
+    echo node executable is required ^(in PATH^) to run the 'cds-extractor.bundle.js' script. Please install Node.js and try again.
     exit /b 2
 )
 

extractors/cds/tools/src/cds/compiler/compile.ts

@@ -250,7 +250,7 @@ function createSpawnOptions(
 ): SpawnSyncOptions {
   const spawnOptions: SpawnSyncOptions = {
     cwd: projectBaseDir, // CRITICAL: Always use project base directory as cwd to ensure correct path generation
-    shell: false, // Use shell=false to ensure proper argument handling for paths with spaces
+    shell: true, // Required on Windows where npm/npx are .cmd files
     stdio: 'pipe',
     env: { ...process.env },
   };

extractors/cds/tools/src/cds/indexer.ts

@@ -5,6 +5,7 @@ import { delimiter, join } from 'path';
 
 import { addCdsIndexerDiagnostic } from '../diagnostics';
 import { cdsExtractorLog } from '../logging';
+import { projectInstallDependencies } from '../packageManager';
 import type { CdsDependencyGraph, CdsProject } from './parser/types';
 
 /** Maximum time (ms) allowed for a single cds-indexer invocation. */
@@ -114,6 +115,7 @@ export function runCdsIndexer(
       env,
       stdio: 'pipe',
       timeout: CDS_INDEXER_TIMEOUT_MS,
+      shell: true,
     });
 
     result.durationMs = Date.now() - startTime;
@@ -199,6 +201,19 @@ export function orchestrateCdsIndexer(
 
     if (result.success) {
       summary.successfulRuns++;
+
+      // Install the project's full dependencies so the CDS compiler can
+      // resolve all CDS model imports (e.g. `@sap/cds-shim`) during
+      // compilation.  The cache directory only contains `@sap/cds`,
+      // `@sap/cds-dk`, and `@sap/cds-indexer`, which is not enough for
+      // projects that reference additional CDS packages.
+      const installResult = projectInstallDependencies(project, sourceRoot);
+      if (!installResult.success) {
+        cdsExtractorLog(
+          'warn',
+          `Full dependency installation failed for project '${projectDir}' after successful cds-indexer run: ${installResult.error ?? 'unknown error'}`,
+        );
+      }
     } else {
       summary.failedRuns++;
 

extractors/cds/tools/src/cds/parser/functions.ts

@@ -47,6 +47,7 @@ export function determineCdsFilesForProjectDir(
     const cdsFiles = sync(join(projectDir, '**/*.cds'), {
       nodir: true,
       ignore: ['**/node_modules/**', '**/*.testproj/**'],
+      windowsPathsNoEscape: true,
     });
 
     // Convert absolute paths to paths relative to sourceRootDir
@@ -91,11 +92,13 @@ export function determineCdsProjectsUnderSourceDir(sourceRootDir: string): strin
   const packageJsonFiles = sync(join(sourceRootDir, '**/package.json'), {
     nodir: true,
     ignore: ['**/node_modules/**', '**/*.testproj/**'],
+    windowsPathsNoEscape: true,
   });
 
   const cdsFiles = sync(join(sourceRootDir, '**/*.cds'), {
     nodir: true,
     ignore: ['**/node_modules/**', '**/*.testproj/**'],
+    windowsPathsNoEscape: true,
   });
 
   // Collect all potential project directories
@@ -369,7 +372,10 @@ function hasStandardCdsContent(dir: string): boolean {
   for (const location of standardLocations) {
     if (existsSync(location) && statSync(location).isDirectory()) {
       // Check for any .cds files at any level under these directories.
-      const cdsFiles = sync(join(location, '**/*.cds'), { nodir: true });
+      const cdsFiles = sync(join(location, '**/*.cds'), {
+        nodir: true,
+        windowsPathsNoEscape: true,
+      });
       if (cdsFiles.length > 0) {
         return true;
       }
@@ -383,7 +389,7 @@ function hasStandardCdsContent(dir: string): boolean {
  * Check if a directory has direct CDS files.
  */
 function hasDirectCdsContent(dir: string): boolean {
-  const directCdsFiles = sync(join(dir, '*.cds'));
+  const directCdsFiles = sync(join(dir, '*.cds'), { windowsPathsNoEscape: true });
   return directCdsFiles.length > 0;
 }
 

extractors/cds/tools/src/environment.ts

@@ -227,7 +227,9 @@ export function configureLgtmIndexFilters(): void {
       `Found $LGTM_INDEX_FILTERS already set to:
 ${process.env.LGTM_INDEX_FILTERS}`,
     );
-    const allowedExcludePatterns = [join('exclude:**', '*'), join('exclude:**', '*.*')];
+    // Use forward slashes explicitly — join() uses backslashes on Windows
+    // which causes 'Illegal use of **' errors in the JS extractor.
+    const allowedExcludePatterns = ['exclude:**/*', 'exclude:**/*.*'];
 
     excludeFilters =
       '\n' +
@@ -245,12 +247,14 @@ ${process.env.LGTM_INDEX_FILTERS}`,
   // The cdsExtractorMarkerFileName file is auto-created by the CDS extractor in order
   // to force the underlying JS extractor to see at least one .js file, which became a
   // requirement starting with v2.23.5 of the CodeQL CLI.
+  // Use forward slashes explicitly — join() uses backslashes on Windows
+  // which causes 'Illegal use of **' errors in the JS extractor.
   const lgtmIndexFiltersPatterns = [
-    join('exclude:**', '*.*'),
-    join('include:**', '*.cds.json'),
-    join('include:**', '*.cds'),
-    join('include:**', cdsExtractorMarkerFileName),
-    join('exclude:**', 'node_modules', '**', '*.*'),
+    'exclude:**/*.*',
+    'include:**/*.cds.json',
+    'include:**/*.cds',
+    `include:**/${cdsExtractorMarkerFileName}`,
+    'exclude:**/node_modules/**/*.*',
   ].join('\n');
 
   process.env.LGTM_INDEX_FILTERS = lgtmIndexFiltersPatterns + excludeFilters;

extractors/cds/tools/src/packageManager/cacheInstaller.ts

@@ -497,6 +497,7 @@ function installDependenciesInCache(
     execFileSync('npm', ['install', '--quiet', '--no-audit', '--no-fund'], {
       cwd: cacheDir,
       stdio: 'inherit',
+      shell: true,
     });
 
     // Add warning diagnostic if using fallback versions

extractors/cds/tools/src/packageManager/projectInstaller.ts

@@ -75,6 +75,7 @@ export function projectInstallDependencies(
         cwd: projectPath,
         stdio: 'inherit',
         timeout: 120000, // 2-minute timeout
+        shell: true,
       });
 
       result.success = true;