openclaw-hybrid-memory-install 2026.2.240 → 2026.2.271

package/install.js

@@ -5,7 +5,7 @@
  * Run: npx -y openclaw-hybrid-memory-install
  * Fix broken credentials config (without loading plugin): npx -y openclaw-hybrid-memory-install fix-config
  */
-const { execSync } = require("child_process");
+const { execFileSync } = require("child_process");
 const fs = require("fs");
 const path = require("path");
 
@@ -25,8 +25,31 @@ const tmpDir = path.join(
   `openclaw-plugin-install-${process.pid}`
 );
 
-function run(cmd, opts = {}) {
-  return execSync(cmd, { stdio: "inherit", ...opts });
+function run(cmd, args = [], opts = {}) {
+  const isWindows = process.platform === "win32";
+
+  // On Windows, avoid running npm via a shell (cmd.exe) to prevent shell interpretation
+  // of arguments that may contain user-controlled data (e.g., version from process.argv).
+  if (isWindows && cmd === "npm") {
+    let npmExecPath = process.env.npm_execpath;
+    if (!npmExecPath) {
+      throw new Error(
+        "Unable to locate npm safely on Windows (npm_execpath is not set). " +
+          "Please run this installer via npm or npx so npm_execpath is available."
+      );
+    }
+    // When invoked via npx, npm_execpath may point to npx-cli.js instead of npm-cli.js
+    // (npm issue #6662). Derive the correct npm-cli.js path.
+    if (npmExecPath.endsWith("npx-cli.js")) {
+      npmExecPath = npmExecPath.replace("npx-cli.js", "npm-cli.js");
+    }
+    return execFileSync(process.execPath, [npmExecPath, ...args], {
+      stdio: "inherit",
+      ...opts,
+    });
+  }
+
+  return execFileSync(cmd, args, { stdio: "inherit", ...opts });
 }
 
 try {
@@ -39,7 +62,7 @@ try {
 
   console.log("Fetching via npm pack...");
   fs.mkdirSync(tmpDir, { recursive: true });
-  run(`npm pack openclaw-hybrid-memory@${version}`, { cwd: tmpDir });
+  run("npm", ["pack", `openclaw-hybrid-memory@${version}`], { cwd: tmpDir });
 
   const tgz = fs.readdirSync(tmpDir).find((f) => f.endsWith(".tgz"));
   if (!tgz) throw new Error("npm pack did not produce a .tgz file");
@@ -47,10 +70,10 @@ try {
   console.log("Extracting...");
   fs.mkdirSync(pluginDir, { recursive: true });
   const tgzPath = path.join(tmpDir, tgz);
-  run(`tar -xzf ${JSON.stringify(tgzPath)} -C ${JSON.stringify(pluginDir)} --strip-components=1`);
+  run("tar", ["-xzf", tgzPath, "-C", pluginDir, "--strip-components=1"]);
 
   console.log("Installing deps and rebuilding native modules...");
-  run("npm install --omit=dev", { cwd: pluginDir });
+  run("npm", ["install", "--omit=dev"], { cwd: pluginDir });
 
   console.log("Cleaning up...");
   fs.rmSync(tmpDir, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-hybrid-memory-install",
-  "version": "2026.02.240",
+  "version": "2026.02.271",
   "description": "Standalone installer for openclaw-hybrid-memory. Use when OpenClaw config validation fails.",
   "bin": {
     "openclaw-hybrid-memory-install": "./install.js"