root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(dashboard): spawn npm with a shell on Windows for CLI install button

Browse Source 
The CLI-binary panel's "Install with npm" button (POST /system/fn-binary/install) ran
`spawn("npm", ["install","-g","runfusion.ai"], { shell: false })`. On Windows npm resolves to
npm.cmd, which Node refuses to spawn without a shell (spawn npm ENOENT / EINVAL, CVE-2024-27980),
so the button failed with "spawn npm ENOENT". Use shell on win32; the command/args are fixed
constants with no caller input, so shell quoting is safe. (The npx spawns in cli skills/extension
already set shell:true.)

Verified on Windows: spawn("npm",["--version"],{shell:false}) -> ENOENT; {shell:true} -> ok.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
gsxdsm
2026-07-02 20:00:43 -07:00
parent ca244c07a2
commit b276a98ae0
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
packages/dashboard/src/routes/register-fn-binary-routes.ts
View File

@@ -73,9 +73,16 @@ function runNpmInstall(): Promise<InstallResult> {
let stdout = "";
let stderr = "";
let timedOut = false;
/*
* FNXC:CliBinaryInstall 2026-07-03-03:00:
* On Windows `npm` resolves to `npm.cmd`; Node refuses to spawn a .cmd/.bat without a shell
* (spawn npm ENOENT / EINVAL since CVE-2024-27980), so the CLI-banner "Install with npm" button
* failed with `spawn npm ENOENT`. Use a shell on win32. The command/args are fixed constants
* (`npm install -g runfusion.ai`) with no caller-supplied input, so shell quoting is safe.
*/
const child = spawn("npm", ["install", "-g", FN_NPM_PACKAGE], {
stdio: ["ignore", "pipe", "pipe"],
shell: false,
shell: process.platform === "win32",
});
const timer = setTimeout(() => {
timedOut = true;