[Bug]: Windows managed-installer updater cannot launch npm.cmd with shell:false

[adenzhou1350]

Product or interface

Source build or repository tooling

Version

Source commit a914a30; Node.js 24.14.1; pnpm 11.7.0 (no installed mcode update was run)

Platform

Windows

OS version and architecture

Windows 11 Pro, build 26200, x64

Issue area

Startup / install / update

Desktop log upload ID (optional)

No response

Steps to reproduce

Source inspection: packages/tui/src/update/service.ts selects npm.cmd in defaultInstallArtifact (line 356) and mcode.cmd in defaultValidateInstalledVersion (lines 377–381), then runMcodeUpdateCommand invokes Node spawn with shell:false (line 397). The managed-installer update path calls this service from packages/tui/src/update/application.ts.

Minimal Windows/Node reproduction (no installation or update):

node -e "const {spawnSync}=require('node:child_process');const r=spawnSync('npm.cmd',['--version'],{shell:false,encoding:'utf8'});console.log({error:r.error?.code,status:r.status})"
# { error: 'EINVAL', status: null }

The asynchronous spawn('npm.cmd',['--version'],{shell:false}) also throws Error: spawn EINVAL here. npm.cmd itself is present and works from a shell. This is a launcher-level reproduction, not a claim that I ran an end-to-end mcode update. This is distinct from desktop Codex-plugin issue #130.

Expected and actual behavior

Expected: the Windows managed updater can execute its npm and installed mcode command shims, preserving arguments, exit status and update validation.

Actual: Node rejects direct .cmd execution with EINVAL before npm starts. The same helper is also used for mcode.cmd version validation. A Windows-aware launcher or direct Node entry point would avoid this, with a test that exercises real .cmd shims.

Redacted error summary

spawnSync npm.cmd EINVAL; status: null (Node.js 24.14.1 on Windows 11).

Screenshots

No response

Before submitting

• I have searched existing issues.
• I have included my version and removed sensitive information.