We use node-cross-spawn to fix a few issues with cross-platform support, specifically Windows. This includes shebang support, PATHEXT, running commands with spaces in them, and more.
My understanding of what node-cross-spawn is:
- Call
node-which to resolve the executable's absolute file path. This fixes PATHEXT support.
- Read the first 150 bytes of that file, to detect any shebang. This fixes shebang support.
- Unless the file is
*.exe or *.com, runs the file with cmd.exe /d /s /c. Unlike the shell: true option implemented by Node.js, this does proper escaping.
All of the above is only done on Windows. Also, it is not done if shell: true is used. Running cmd.exe fixes PATHEXT support, so using shell: true is enough, although I don't think it supports shebangs, and also the escaping done by Node.js is not as good.
From reading the original Node.js issue that both introduced shell: true and led to the creation of node-cross-spawn, this is a very complex topic. The following comment has a complex list of Windows' behavior, some of it appears to be undocumented. The Windows syscalls apparently have some inherent limitations. That issue describes actually many different problems, which probably should have been separate issues as pointed out by this comment.
We need to get a better understand on what node-cross-spawn is actually fixing and:
- Add tests in Execa covering those cases
- Better document them in the Windows guide (and also in the
readme.md). At the moment, we only mention shebang support.
- In the Shells guide, better document why
shell: true might, or might not, be needed in specific cases based on the above.
We use
node-cross-spawnto fix a few issues with cross-platform support, specifically Windows. This includes shebang support,PATHEXT, running commands with spaces in them, and more.My understanding of what
node-cross-spawnis:node-whichto resolve the executable's absolute file path. This fixesPATHEXTsupport.*.exeor*.com, runs the file withcmd.exe /d /s /c. Unlike theshell: trueoption implemented by Node.js, this does proper escaping.All of the above is only done on Windows. Also, it is not done if
shell: trueis used. Runningcmd.exefixesPATHEXTsupport, so usingshell: trueis enough, although I don't think it supports shebangs, and also the escaping done by Node.js is not as good.From reading the original Node.js issue that both introduced
shell: trueand led to the creation ofnode-cross-spawn, this is a very complex topic. The following comment has a complex list of Windows' behavior, some of it appears to be undocumented. The Windows syscalls apparently have some inherent limitations. That issue describes actually many different problems, which probably should have been separate issues as pointed out by this comment.We need to get a better understand on what
node-cross-spawnis actually fixing and:readme.md). At the moment, we only mention shebang support.shell: truemight, or might not, be needed in specific cases based on the above.