fix: fix spawn shell args

Author: zdm

lib/package.js

@@ -427,18 +427,20 @@ export default class Package {
 
         // publish npm package
         const addTags = [ latestTag, nextTag ].filter( tag => tag ).map( tag => `"${ tag }"` ),
-            params = [ "publish", "--access", "public" ];
+            args = [ "npm", "publish", "--access", "public" ];
 
         if ( addTags.length ) {
-            params.push( "--tag", addTags.shift() );
+            args.push( "--tag", addTags.shift() );
         }
 
-        params.push( `"${ pack.path }"` );
+        args.push( pack.path );
+
+        const command = shellEscape( args );
 
         res = await repeatAction( async () => {
-            console.log( "Publishing:", "npm", params.join( " " ) );
+            console.log( "Publishing:", command );
 
-            const res = childProcess.spawnSync( "npm", params, {
+            const res = childProcess.spawnSync( command, {
                 "shell": true,
                 "stdio": "pipe",
             } );
@@ -459,12 +461,12 @@ export default class Package {
         // add additional tags
         if ( addTags.length ) {
             for ( const tag of addTags ) {
-                const params = [ "dist-tag", "add", `"${ this.name }@${ this.version }"`, tag ];
+                const command = shellEscape( [ "npm", "dist-tag", "add", `${ this.name }@${ this.version }`, tag ] );
 
                 res = await repeatAction( async () => {
-                    console.log( "Adding npm tag:", "npm", params.join( " " ) );
+                    console.log( "Adding npm tag:", command );
 
-                    const res = childProcess.spawnSync( "npm", params, {
+                    const res = childProcess.spawnSync( command, {
                         "shell": true,
                         "stdio": "pipe",
                     } );
@@ -626,7 +628,7 @@ export default class Package {
     }
 
     runCommand ( command, ...args ) {
-        const res = childProcess.spawnSync( command, args, {
+        const res = childProcess.spawnSync( shellEscape( [ command, ...args ] ), {
             "cwd": this.root,
             "stdio": "inherit",
             "shell": true,
@@ -650,7 +652,7 @@ export default class Package {
             argv = [];
         }
 
-        const res = childProcess.spawnSync( "npm", [ "run", script, ...argv ], {
+        const res = childProcess.spawnSync( shellEscape( [ "npm", "run", script, ...argv ] ), {
             "cwd": this.root,
             "stdio": "inherit",
             "shell": true,
@@ -928,7 +930,7 @@ export default class Package {
         // perform update
         process.stdout.write( "Updating dependencies ... " );
 
-        res = childProcess.spawnSync( "npm", [ "update", "--json" ], {
+        res = childProcess.spawnSync( "npm update --json", {
             "cwd": this.root,
             "stdio": [ "ignore", "pipe", "ignore" ],
             "shell": true,