From ad0747ccac50c9537c2cc6418f33b2109db9e609 Mon Sep 17 00:00:00 2001
From: Fabio <fabiossj83@gmail.com>
Date: Tue, 5 May 2026 21:16:36 +0200
Subject: [PATCH] fix(hooks): scope shell:true to Windows + add changeset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address adversarial review feedback on PR #3102:

1. shell:true is now conditional (process.platform === 'win32')
   - POSIX path unchanged: no shell spawn, no overhead, original
     signal/exit-code semantics and windowsHide effect preserved
   - Windows path: still routes through cmd.exe to resolve npm.cmd
     via PATHEXT (the actual fix for ENOENT)

2. Added .changeset/windows-npm-shell-fix.md (Fixed type)

Reviewed feedback resolved:
- Cross-platform regression risk → shell now Windows-only
- Missing changeset → added
---
 .changeset/windows-npm-shell-fix.md |  5 +++++
 hooks/gsd-check-update-worker.js    | 12 +++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/windows-npm-shell-fix.md

diff --git a/.changeset/windows-npm-shell-fix.md b/.changeset/windows-npm-shell-fix.md
new file mode 100644
index 000000000..f33c5d5e6
--- /dev/null
+++ b/.changeset/windows-npm-shell-fix.md
@@ -0,0 +1,5 @@
+---
+type: Fixed
+---
+
+**Windows update-check no longer silently fails** — `gsd-check-update-worker` now passes `shell: true` only on Windows, allowing `execFileSync('npm', ...)` to resolve `npm.cmd` via PATHEXT. POSIX path (Linux/macOS) is unchanged. Without this fix, the worker failed with ENOENT, `latest` stayed `null`, `update_available` became `null`, and the statusline `⬆ /gsd-update` indicator never rendered for Windows users. Fixes #3103.
diff --git a/hooks/gsd-check-update-worker.js b/hooks/gsd-check-update-worker.js
index e6b7f6d58..ff5a16f7e 100644
--- a/hooks/gsd-check-update-worker.js
+++ b/hooks/gsd-check-update-worker.js
@@ -93,11 +93,13 @@ try {
     encoding: 'utf8',
     timeout: 10000,
     windowsHide: true,
-    // shell:true is required on Windows so 'npm' resolves to npm.cmd via PATHEXT.
-    // Without it, execFileSync looks for a literal 'npm' binary, fails with ENOENT,
-    // the catch swallows the error, latest stays null, and the statusline never shows
-    // the "⬆ /gsd-update" indicator on Windows.
-    shell: true,
+    // On Windows, 'npm' is distributed as npm.cmd. Node's execFileSync does
+    // not apply PATHEXT resolution and looks for a literal 'npm' binary,
+    // failing with ENOENT. Setting shell:true on Windows routes through
+    // cmd.exe which resolves npm.cmd via PATHEXT.
+    // POSIX (Linux/macOS) is left untouched — no shell spawn, no extra
+    // signal/exit-code semantics, no overhead.
+    shell: process.platform === 'win32',
   }).trim();
 } catch (e) {}