fix: use cmd.exe /c on windows to spawn npm/pnpm safely without shell: true

Author: Timeless0911

src/workspace-dev.ts

@@ -189,17 +189,19 @@ export class WorkspaceDevRunner {
       }
       this.visiting[node] = true;
 
-      const child = spawn(
-        process.platform === 'win32' ? 'npm.cmd' : 'npm',
-        ['run', command],
-        {
-          cwd: path,
-          env: {
-            ...process.env,
-            FORCE_COLOR: '3',
-          },
+      const spawnCommand = process.platform === 'win32' ? 'cmd.exe' : 'npm';
+      const spawnArgs =
+        process.platform === 'win32'
+          ? ['/c', 'npm', 'run', command]
+          : ['run', command];
+
+      const child = spawn(spawnCommand, spawnArgs, {
+        cwd: path,
+        env: {
+          ...process.env,
+          FORCE_COLOR: '3',
         },
-      );
+      });
 
       child.stdout.on('data', async (data) => {
         const stdout = data.toString();

test/index.pw.test.ts

@@ -14,13 +14,15 @@ test('should run dev succeed', async ({ page }) => {
     let testCompleted = false;
     let serverStarted = false;
 
-    const child = spawn(
-      process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm',
-      ['run', 'dev'],
-      {
-        cwd,
-      },
-    );
+    const command = process.platform === 'win32' ? 'cmd.exe' : 'pnpm';
+    const args =
+      process.platform === 'win32'
+        ? ['/c', 'pnpm', 'run', 'dev']
+        : ['run', 'dev'];
+
+    const child = spawn(command, args, {
+      cwd,
+    });
 
     child.stdout.on('data', async (data) => {
       const output = data.toString();