super-backlog 1.0.0 → 1.0.3

package/dist/commands/backlog-alias.js

@@ -1,6 +1,4 @@
-// src/commands/backlog-alias.ts
-import { spawn } from 'node:child_process';
-import process from 'node:process';
+import spawn from 'cross-spawn';
 import { resolveBacklogBin } from '../lib/run.js';
 /** Run a backlog.md subcommand by delegating to the resolved backlog binary. */
 export function runBacklogSubcommand(cwd, subcommand, args = []) {
@@ -13,7 +11,6 @@ export function runBacklogSubcommand(cwd, subcommand, args = []) {
         const child = spawn(bin, [subcommand, ...args], {
             cwd,
             stdio: 'inherit',
-            shell: process.platform === 'win32',
         });
         child.on('error', () => resolve(1));
         child.on('exit', (code) => resolve(code ?? 1));

package/dist/commands/dashboard.js

@@ -1,8 +1,6 @@
-// src/commands/dashboard.ts
-import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import process from 'node:process';
+import spawn from 'cross-spawn';
 import { collectDashboardData } from '../dashboard/data.js';
 import { renderDashboard } from '../dashboard/render.js';
 import { DASHBOARD_PORT, startServeServer } from '../dashboard/server.js';
@@ -24,7 +22,6 @@ function spawnBacklogBrowser(cwd) {
             cwd,
             detached: true,
             stdio: 'ignore',
-            shell: process.platform === 'win32',
         });
         child.on('error', () => { });
         child.unref();

package/dist/commands/uninstall.js

@@ -1,8 +1,6 @@
-// src/commands/uninstall.ts
-import { spawnSync } from 'node:child_process';
+import spawn from 'cross-spawn';
 import { existsSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
-import process from 'node:process';
 import { findGitDir, POINTER_HEADING_RE } from '../init/execute.js';
 import { atomicWrite } from '../lib/atomic.js';
 import { GUARD_RE, REFRESH_RE, removeGuardHook, removeRefreshHook } from '../lib/hooks.js';
@@ -195,11 +193,10 @@ export function verifyRemnants(cwd) {
     return remnants;
 }
 function defaultRemoveGlobal() {
-    const cmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-    const r = spawnSync(cmd, ['uninstall', '-g', 'super-backlog'], {
+    const cmd = 'npm';
+    const r = spawn.sync(cmd, ['uninstall', '-g', 'super-backlog'], {
         encoding: 'utf8',
         windowsHide: true,
-        shell: process.platform === 'win32',
     });
     if (r.error)
         return 1;

package/dist/commands/update.js

@@ -100,13 +100,12 @@ export async function runUpdate(cwd, _args) {
             warnings.push(`\`${bin} --version\` failed with exit code ${local.status}`);
         }
     }
-    const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
     let published = null;
     try {
         // test seam: SBL_FORCE_OFFLINE makes e2e runs take the offline path deterministically
         if (process.env.SBL_FORCE_OFFLINE)
             throw new Error('forced offline');
-        const view = runCapture(npm, ['view', 'backlog.md', 'version'], cwd);
+        const view = runCapture('npm', ['view', 'backlog.md', 'version'], cwd);
         if (view.status === 0)
             published = firstLine(view.stdout);
     }

package/dist/dashboard/server.js

@@ -5,6 +5,7 @@ import { readFile } from 'node:fs/promises';
 import { createServer } from 'node:http';
 import { isAbsolute, join } from 'node:path';
 import process from 'node:process';
+import crossSpawn from 'cross-spawn';
 import { createModelApiHandler } from '../models/dashboard-api.js';
 import { resolveBacklogBin } from '../lib/run.js';
 export const DASHBOARD_PORT = 6428;
@@ -66,11 +67,10 @@ export function createRunApiHandler(cwd) {
         }
         const args = WHITELIST.get(payload.command);
         try {
-            const child = spawn(bin, args, {
+            const child = crossSpawn(bin, args, {
                 cwd,
                 detached: true,
                 stdio: 'ignore',
-                shell: process.platform === 'win32',
             });
             child.on('error', () => { });
             child.unref();

package/dist/lib/preflight.js

@@ -3,19 +3,17 @@
 // System-changing fixes (node install, execution policy) require consent or fixAll;
 // safe fixes run unconditionally. Every fix is verified and reports a manual
 // fallback command on failure.
-import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { delimiter, join } from 'node:path';
 import process from 'node:process';
+import spawn from 'cross-spawn';
 import { getEffectiveExecutionPolicy, isBlockingExecutionPolicy, } from './powershell.js';
 import { resolveBacklogBin } from './run.js';
 const defaultExecutor = (cmd, args) => {
-    // shell on win32 — .cmd/.ps1 shims (npm.cmd etc.) are not directly executable.
-    // Safe only because callers pass constant args; never pass user input here.
-    const r = spawnSync(cmd, args, {
+    // cross-spawn resolves .cmd shims on Windows without shell: true.
+    const r = spawn.sync(cmd, args, {
         encoding: 'utf8',
         windowsHide: true,
-        shell: process.platform === 'win32',
     });
     if (r.error)
         return { status: null, stdout: '', stderr: String(r.error.message) };
@@ -99,13 +97,6 @@ function checkNpmCommand(ctx) {
         ctx.npmCmd = 'npm';
         return { id, status: 'ok', detail: `npm ${probe.stdout.trim()}` };
     }
-    if (ctx.platform === 'win32') {
-        const fallback = ctx.executor('npm.cmd', ['--version']);
-        if (fallback.status === 0) {
-            ctx.npmCmd = 'npm.cmd';
-            return { id, status: 'fixed', detail: 'npm not directly callable; using npm.cmd shim' };
-        }
-    }
     return {
         id,
         status: 'failed',
@@ -206,7 +197,7 @@ export function runPreflight(cwd, deps = {}) {
         log: deps.log ?? ((line) => console.log(line)),
         confirm: deps.confirm,
         fixAll: deps.fixAll ?? false,
-        npmCmd: platform === 'win32' ? 'npm.cmd' : 'npm',
+        npmCmd: 'npm',
     };
     const unitNames = [
         ['node-version', checkNodeVersion],

package/dist/lib/run.js

@@ -1,12 +1,9 @@
 import { existsSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
 import { join } from 'node:path';
 import process from 'node:process';
+import spawn from 'cross-spawn';
 export function runCapture(cmd, args, cwd) {
-    // shell on win32 — safe only because callers pass constant args; never pass user input here.
-    const winShell = process.platform === 'win32';
-    const file = winShell && /\s/.test(cmd) ? `"${cmd}"` : cmd;
-    const r = spawnSync(file, args, { cwd, encoding: 'utf8', shell: winShell });
+    const r = spawn.sync(cmd, args, { cwd, encoding: 'utf8' });
     if (r.error && (r.status === null || r.status === undefined)) {
         return { status: 127, stdout: '', stderr: String(r.error.message) };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "super-backlog",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "One command to equip any project with Backlog.md + Superpowers, plus a Project Dashboard.",
   "license": "MIT",
   "repository": {
@@ -32,6 +32,7 @@
     "screenshot": "npm run build && node scripts/capture-dashboard.mjs"
   },
   "devDependencies": {
+    "@types/cross-spawn": "^6.0.6",
     "@types/node": "^26.2.0",
     "backlog.md": "^1.50.1",
     "cspell": "^10.1.1",
@@ -52,9 +53,13 @@
     },
     "vitest": {
       "vite": "^8.2.2",
+      "esbuild": "^0.25.0",
       "@vitest/mocker": {
         "vite": "^8.2.2"
       }
     }
+  },
+  "dependencies": {
+    "cross-spawn": "^7.0.6"
   }
 }