fix: run package-manager upgrades through a shell on Windows - #1332
Conversation
On Windows, npm/pnpm/yarn are .cmd shims. Since Node's CVE-2024-27980 fix, spawning a .cmd/.bat without a shell throws EINVAL, which broke `kimi upgrade` and background auto-install on Windows. Pass shell: true on win32 so the install runs through the shell.
🦋 Changeset detectedLatest commit: b1318b6 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
commit: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b1318b6884
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| const child = spawn(cmd, [...args], { | ||
| detached: true, | ||
| stdio: 'ignore', | ||
| shell: platform === 'win32' ? true : undefined, | ||
| }); |
There was a problem hiding this comment.
When auto-install runs on Windows, this background path now starts cmd.exe (shell: true) with detached: true and the default windowsHide: false; Windows detached children get their own console window, so a passive update can pop or flash a command window even though stdio is ignored. Please hide this background child, for example by setting windowsHide: true on win32, so the silent updater stays silent.
Useful? React with 👍 / 👎.
1 participant
Related Issue
No related issue — clear, reproducible bug fix with a focused diff.
Problem
On Windows, both
kimi upgradeand the background auto-update fail with:npm/pnpm/yarn are installed as
.cmdshims on Windows. Since Node's CVE-2024-27980 fix,child_process.spawnrefuses to execute a.cmd/.batfile unless it is launched through a shell, so the install never starts and users have to copy the printed command and run it manually.What changed
Pass
shell: truewhen spawning the upgrade command onwin32, in both the foregroundkimi upgradepath and the background auto-install path. The version is a validated semver and the package name is a constant, so the arguments are shell-safe. Other platforms are unaffected (shellstaysundefined).Added a win32 test that drives the
process.platform = 'win32'path on the existing macOS/Linux CI (the dedicated Windows CI job is currently disabled), plus a changeset.Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.