fix: quote tempBatFile path in cmd.exe args to support paths with spaces

[Copilot]

Windows builds fail when Node.js is installed in a path containing spaces (e.g., C:\Program Files\Volta\node). Introduced in v26.5.0 when shell: true was added — Node.js wraps the spawn in cmd.exe /d /s /c "...", and the unquoted tempBatFile path gets split at spaces.

• Quote tempBatFile in the cmd.exe /c args so paths with spaces are treated as a single argument

// Before
args = ["/c", tempBatFile, ...args]

// After
args = ["/c", `"${tempBatFile}"`, ...args]

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Windows build fails when Node.js is in path with spaces (v26.5.0+)</issue_title>
<issue_description>## Summary

Windows builds fail starting from electron-builder v26.5.0 when Node.js is installed in a path containing spaces (e.g., C:\Program Files\Volta\node). The node-module-collector process exits with error code 1 because the temporary batch file path is not properly quoted when passed to cmd.exe.

Error message:

'C:\Program' は、内部コマンドまたは外部コマンド、
操作可能なプログラムまたはバッチ ファイルとして認識されていません。

(Translation: 'C:\Program' is not recognized as an internal or external command)

Environment

• Operating System: Windows 10 (10.0.26100)
• Node.js version: v22.22.0
• Package manager: pnpm 10.28.2
• Electron version: 29.3.3
• electron-builder versions:
  • ✅ v26.4.1 and earlier: Works
  • ❌ v26.5.0, v26.6.0, v26.7.0: Broken
• Node.js installation path: C:\Program Files\Volta\node (contains space)

Reproduction Steps

1. Install Node.js in a path containing spaces
   • Example: Use Volta which installs to C:\Program Files\Volta\node
   • Or manually install Node.js to C:\Program Files\nodejs
2. Create an Electron project using pnpm
3. Install electron-builder v26.5.0 or later
4. Run electron-builder build -w --x64
5. Observe the build fails with the error above

Configuration

package.json:

{
  "devDependencies": {
    "electron": "29.3.3",
    "electron-builder": "26.5.0"
  }
}

electron-builder config:
Standard NSIS configuration (no special settings required to reproduce).

Terminal Output

• packageManager not detected by file, falling back to environment detection  resolvedPackageManager=pnpm
• detected workspace root for project using process environment  pm=pnpm
• executing @electron/rebuild  electronVersion=29.3.3 arch=x64 buildFromSource=false
• installing native dependencies  arch=x64
• completed installing native dependencies
• packaging       platform=win32 arch=x64 electron=29.3.3 appOutDir=dist\win-unpacked
• searching for node modules  pm=pnpm searchDir=C:\Users\...\project
⨯ Node module collector process exited with code 1:
'C:\Program' は、内部コマンドまたは外部コマンド、
操作可能なプログラムまたはバッチ ファイルとして認識されていません。
  failedTask=build stackTrace=Error: Node module collector process exited with code 1:
...
    at ChildProcess.<anonymous> (C:\...\node_modules\app-builder-lib\src\node-module-collector\nodeModulesCollector.ts:391:51)

Root Cause Analysis

This regression was introduced in v26.5.0 by PR #9489, which fixed issue #9488 (Windows builds failing with spawn EINVAL after Node.js CVE-2024-27980 security fix).

The fix changed shell: false to shell: true in nodeModulesCollector.ts, but did not update the path quoting logic.

Problem location:

electron-builder/packages/app-builder-lib/src/node-module-collector/nodeModulesCollector.ts

Line 359 in 9c67fd3

args = ["/c", tempBatFile, ...args]

const tempBatFile = await this.tempDirManager.getTempFile({
  prefix: execName,
  suffix: ".bat",
})
const batScript = `@echo off\r\n"${command}" %*\r\n`
await fs.writeFile(tempBatFile, batScript, { encoding: "utf8" })
command = "cmd.exe"
args = ["/c", tempBatFile, ...args]  // ← tempBatFile is not quoted

When shell: true, Node.js constructs:

cmd.exe /d /s /c "cmd.exe /c C:\Program Files\...\temp.bat arg1 arg2"

The unquoted tempBatFile path gets split at the first space, causing Windows to interpret C:\Program as the command.

Proposed Fix

Quote the temporary batch file path:

args = ["/c", `"${tempBatFile}"`, ...args]

This ensures the path is treated as a single argument even when it contains spaces.

Workaround

Downgrade to electron-builder v26.4.1:

{
  "devDependencies": {
    "electron-builder": "26.4.1"
  }
}

Impact

This affects any Windows user with Node.js installed in:

• Default Program Files directory (C:\Program Files\nodejs)
• Volta installation (C:\Program Files\Volta)
• Any custom path containing spaces
• Temporary directories with spaces in the path

Given that Windows' default Program Files location contains a space, this has the potential to affect a significant number of Windows developers upgrading to v26.5.0+.
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Windows build fails when Node.js is in path with spaces (v26.5.0+) #9562

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[changeset-bot]

🦋 Changeset detected

Latest commit: 3a8b731

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
app-builder-lib	Patch
dmg-builder	Patch
electron-builder-squirrel-windows	Patch
electron-builder	Patch
electron-forge-maker-appimage	Patch
electron-forge-maker-nsis-web	Patch
electron-forge-maker-nsis	Patch
electron-forge-maker-snap	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR