Quarto 1.9.36 fails in enterprise Windows: Dart Sass invoked via temp batch file is blocked by Group Policy (works in 1.8.25)

[m20l22]

I have:

• searched the issue tracker for similar issues
• installed the latest version of Quarto CLI
• formatted my issue following the Bug Reports guide

Bug description

Quarto 1.9.36 fails with Theme file compilation failed on Windows systems where Group Policy blocks execution of .bat files from the %TEMP% directory (common in corporate/enterprise environments).

The root cause is a regression in how Dart Sass is invoked. In Quarto 1.8.25, sass.bat --version was called directly from the Quarto installation directory (C:\Program Files\...\dart-sass\sass.bat), which is in a trusted/allowed path. In Quarto 1.9.36, the same Sass check is now routed through a temporary wrapper batch file (quarto-safe-exec*.bat) written to %TEMP% and executed via cmd /c. On locked-down systems, Group Policy (Software Restriction Policies / AppLocker) blocks .bat execution from %TEMP%, causing the Sass check to fail.

Note that the quarto-safe-exec mechanism is also used in 1.8.25 for optional tool checks (TinyTeX, Chromium, LaTeX, Chrome) — those also fail with exit code 1, but they are handled gracefully as "not installed"/"not detected." The difference is that in 1.9.36, Dart Sass — a critical, non-optional dependency — is now also called via this mechanism, and its failure is fatal.

Steps to reproduce

1. Use a Windows machine with Group Policy / AppLocker rules that block execution of .bat files from the user's %TEMP% directory (common in enterprise environments).
2. Install Quarto 1.9.36 (e.g., bundled with Positron).
3. Run:

quarto check --log-level debug

Actual behavior

quarto check crashes with Theme file compilation failed:

[execProcess] cmd /c C:\Users\<USERNAME>\AppData\Local\Temp\quarto-safe-exec91e465e27a39d068.bat
[execProcess] Success: false, code: 1
[DART path]   : C:\Program Files\Positron\resources\app\quarto\bin\tools\x86_64\dart-sass\sass.bat
[DART args]   : --version
[DART stdout] :
[DART stderr] : This program is blocked by group policy. For more information, contact your system administrator.

ERROR: Theme file compilation failed:

Stack trace:
    at processResult (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:79072:13)
    at dartCommand (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:79089:12)
    ...

The Sass invocation goes through a quarto-safe-exec*.bat wrapper in %TEMP%, which is blocked by Group Policy.

Expected behavior

quarto check should succeed, as it does with Quarto 1.8.25. In 1.8.25, sass.bat is called directly from the installation directory and succeeds:

[execProcess] C:\Program Files\RStudio\resources\app\bin\quarto\bin\tools\x86_64\dart-sass\sass.bat --version
[execProcess] Success: true, code: 0
      Dart Sass version 1.87.0: OK

Possible fix:

• Revert Dart Sass invocation to call sass.bat directly (as in 1.8.25) instead of via the safe-exec wrapper.

Your environment

• IDE: Positron Version: 2026.04.0 (system setup) build 269 (with bundled Quarto 1.9.36)
• OS: Windows_NT x64 10.0.26200 (corporate/enterprise environment with Group Policy restrictions)
• Also tested with: RStudio (with bundled Quarto 1.8.25) — works correctly

Quarto check output

$ quarto check --log-level debug
Quarto version: 1.9.36
Quarto 1.9.36
[>] Checking environment information...
Quarto cache location: C:\Users<USERNAME>\AppData\Local\quarto
[>] Checking versions of quarto binary dependencies...
[execProcess] C:\Program Files\Positron\resources\app\quarto\bin\tools\pandoc --version
[execProcess] Success: true, code: 0
[execProcess] cmd /c C:\Users<USERNAME>\AppData\Local\Temp\quarto-safe-exec91e465e27a39d068.bat
[execProcess] Success: false, code: 1
[DART path] : C:\Program Files\Positron\resources\app\quarto\bin\tools\x86_64\dart-sass\sass.bat
[DART args] : --version
[DART stdout] :
[DART stderr] : This program is blocked by group policy. For more information, contact your system administrator.

[NotebookContext]: Starting Cleanup
ERROR: Theme file compilation failed:

Stack trace:
at processResult (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:79072:13)
at dartCommand (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:79089:12)
at eventLoopTick (ext:core/01_core.js:179:7)
at async checkVersions (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:163474:24)
at async check (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:163388:9)
at async _Command.actionHandler (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:163784:3)
at async _Command.execute (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:102022:7)
at async _Command.parseCommand (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:101899:14)
at async quarto4 (file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:187547:5)
at async file:///C:/Program Files/Positron/resources/app/quarto/bin/quarto.js:187575:5

[cderv]

Thanks for the report. This is a known issue — the safeWindowsExec wrapper routes sass.bat through a temp .bat file, which enterprise Group Policy blocks.

This was fixed in #14273 (merged to main), which bypasses sass.bat entirely by calling dart.exe + sass.snapshot directly. The fix is available in the current prerelease (v1.10.3): https://quarto.org/docs/download/prerelease

The v1.9 backport (#14274) only addressed a related encoding issue and did not include the .bat bypass, so v1.9.x releases won't have this fix.

Closing as duplicate of #6651.

[cderv]

Reopening — re-reading your report more carefully, you identified the problem exactly right. While the underlying issue is the same as #6651 (enterprise .bat blocking), we missed that this is also a regression from v1.8.

The regression was introduced by #14002 in v1.9, which routed dart-sass through a temp .bat wrapper (safeWindowsExec) to handle path quoting with spaces (#13997). As you noted, in v1.8 sass.bat was called directly from the installation directory — a trusted path — while in v1.9 the call goes through a temp .bat in %TEMP%, which Group Policy / AppLocker blocks in enterprise environments.

The full fix is in v1.10 prerelease (#14273), which bypasses sass.bat entirely. For v1.9, we'll backport a fallback: try the safeWindowsExec path first (needed for spaces in paths), and fall back to direct sass.bat execution when that fails, restoring the v1.8 behavior for locked-down environments.

[m20l22]

Thank you @cderv for confirming a regression! I will be using quarto v1.8 until a fix for v1.9 or stable v1.10 will be released.