The CLI-binary panel's "Install with npm" button (POST /system/fn-binary/install) ran
`spawn("npm", ["install","-g","runfusion.ai"], { shell: false })`. On Windows npm resolves to
npm.cmd, which Node refuses to spawn without a shell (spawn npm ENOENT / EINVAL, CVE-2024-27980),
so the button failed with "spawn npm ENOENT". Use shell on win32; the command/args are fixed
constants with no caller input, so shell quoting is safe. (The npx spawns in cli skills/extension
already set shell:true.)
Verified on Windows: spawn("npm",["--version"],{shell:false}) -> ENOENT; {shell:true} -> ok.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
b276a98ae0