fix: fallback for missing process.env.ComSpec on Windows

[SongMinQQ]

What / Why

---

issue No. #131

On Windows, some environments don’t expose process.env.ComSpec.
When that happens, the shell selection logic ends up passing undefined to child_process.spawn(), throwing ERR_INVALID_ARG_TYPE (“file” must be a string).

This PR updates the shell resolution so that on win32 we fallback to "cmd.exe" when process.env.ComSpec is missing, while preserving existing behavior on:

non-Windows (sh) and

Windows when ComSpec is set (still honored).

Rationale: cmd.exe is the standard Windows shell and is present by default. This change prevents crashes in real-world setups without altering behavior for users who explicitly define ComSpec.

Change summary

Update shell selection:

command = process.platform === 'win32'
  ? (process.env.ComSpec || 'cmd.exe')
  : 'sh'

Add/adjust tests to cover the “missing ComSpec” case on Windows.

Tests

os: Windows 10 (WSL2)
node: 22.14.0
npm: 11.2.0

References

Prior attempt on npm/cli was closed with a maintainer note that this logic lives in @npmcli/promise-spawn (npm vendors this dependency).
GitHub

[owlstronaut]

You can ignore the CodeQL failure. Next step is for me to actually review it