From 4b45b56aace28056b2ed3a1b42ece31a900ae014 Mon Sep 17 00:00:00 2001
From: RYGrit <ry_grit@sina.com>
Date: Wed, 4 Feb 2026 22:11:06 +0800
Subject: [PATCH] fix(cli): enable shell for npm on windows

---
 cli/src/npm-client.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cli/src/npm-client.ts b/cli/src/npm-client.ts
index 77ebcccf9e..1c1cb270f8 100644
--- a/cli/src/npm-client.ts
+++ b/cli/src/npm-client.ts
@@ -124,10 +124,12 @@ async function execNpm(
 
   try {
     // Use execFile instead of exec to avoid shell injection vulnerabilities
-    // execFile does not spawn a shell, so metacharacters are passed literally
+    // On Windows, shell: true is required to execute .cmd files (like npm.cmd)
+    // On Unix, we keep it false for better security and performance
     const { stdout, stderr } = await execFileAsync('npm', npmArgs, {
       timeout: 60000,
       env: { ...process.env, FORCE_COLOR: '0' },
+      shell: process.platform === 'win32',
     })
 
     if (!options.silent) {
@@ -386,6 +388,7 @@ export async function packageInit(
         timeout: 60000,
         cwd: tempDir,
         env: { ...process.env, FORCE_COLOR: '0' },
+        shell: process.platform === 'win32',
       })
 
       logSuccess(`Published ${name}@0.0.0`)