[BUG] "command not found" when running script with bash as script-shell on Windows

[stevenwdv]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

On Windows, if Bash/sh is set as script-shell for npm and a script is run, it gives the following error:

/usr/bin/bash: C:UsersMeAppDataLocalTempmy-script-1656497236474.sh: command not found

It appears that backslashes in paths are not escaped or paths transformed.

This bug is likely introduced in run-script 4.1.0:

write scripts to a file and run that instead of passing scripts as a single string 24c5165

Expected Behavior

It should run the script fine

Steps To Reproduce

1. Install npm 8.13.0 or later
2. Put some script in a packages.json, "the-script": "echo hi" will do
3. Run npm config set script-shell "C:\Program Files\Git\bin\sh.exe" if you have Git installed, or use the path to sh/bash for your MSYS2 installation
4. Run npm run the-script
5. Get the error shown above

Environment

• npm: 8.13.0, 8.13.1 (8.12.2 and below work fine)
• Node: 18.4.0
• OS: Windows 10

[schmidtk]

Confirmed on Windows 10 with Git Bash, and npm's script-shell set to use bash.

The script generated by run-script uses a Windows-style path, and the single backslashes are treated as escape characters by Git Bash. This causes the separators to be dropped from the path, and the script fails to run with "command not found" due to the invalid path.

As noted, npm 8.12.2 works as it uses an older version of run-script. Our team is using npm workspaces, which presented another problem when sub-dependencies (@semantic-release/npm in our case) depend on npm. The sub-dependency was hoisted to <project>/node_modules/npm which was used by npm run scripts in <project>/package.json.

Our current workaround to the above problem is to add [email protected] as a direct dependency of our project, so that version will be hoisted to the root node_modules. A complete solution would require updating run-script to escape the path properly in this environment.