fix(demo): npm launcher fails with ENOENT on native Windows

[viktar-b]

What happened

The repository demo launcher uses spawnSync('npm', ...) without Windows command handling. On native Windows it exits 1 with:

Error: spawnSync npm ENOENT
  code: 'ENOENT'
  syscall: 'spawnSync npm'
  path: 'npm'
  spawnargs: [ 'run', 'dev', '--workspace', '@cs-object/demo', '--' ]

Suggested priority: P1. Root npm run dev, npm run build:demo and npm run build share this launcher. They cannot invoke the demo npm script on Windows, even when example preparation is bypassed or fixed.

What you expected

The launcher starts the requested demo workspace script using a working Windows npm installation. Paths containing spaces are passed intact, and child exit status/errors remain visible.

How to reproduce

Prerequisites: native Windows Node.js 24+, npm and Git. No Python setup or successful canonical reference generation is needed for this isolated reproduction.

In PowerShell, in a fresh directory:

git -c core.autocrlf=false clone https://github.com/viktar-b/CalculationSourceObject.git cso-launcher-repro
Set-Location cso-launcher-repro
git checkout f3a5b7f16e4d7f964362bed3dcb717df04046b51
node --version
npm.cmd --version
npm.cmd ci

# Bypass canonical example preparation to isolate the npm launch failure.
$gallery = Join-Path $env:TEMP ('cso-empty-gallery-' + [guid]::NewGuid())
New-Item -ItemType Directory -Path $gallery | Out-Null
$env:CSO_EXAMPLES_DIRECTORY = $gallery
node node_modules/tsx/dist/cli.mjs scripts/demo.ts dev

Expected: launch npm run dev --workspace @cs-object/demo. Actual: exit 1 with spawnSync npm ENOENT before the demo process starts. The empty gallery intentionally bypasses preparation; it is not intended as a populated demonstration.

Optional minimal confirmation of the process-launch mechanism:

node -e "const r=require('node:child_process').spawnSync('npm',['--version']); console.log({platform:process.platform,status:r.status,error:r.error?.code})"

Expected observed output on the tested Windows setup:

{ platform: 'win32', status: null, error: 'ENOENT' }

Clear the temporary override when finished:

Remove-Item Env:CSO_EXAMPLES_DIRECTORY
Remove-Item $gallery

Cause

Windows npm installations provide npm.cmd; Node's direct spawnSync call does not automatically execute this through the command shell. The launcher has no shell option or Node/npm-JavaScript-entry invocation. The initializer already handles this situation when npm_execpath is available.

Environment

Windows 11 Pro x64; native Windows Node.js 24.19.0 and Python 3.12.14. Tested 28 September 2026. Repository commit: f3a5b7f16e4d7f964362bed3dcb717df04046b51 (current main at filing).

The reproduction ensured native Node 24 and a working npm installation were available. It bypasses the canonical-reference failure rather than relying on that failure being repaired first.

Relevant code

• Demo launcher spawn
• Root scripts sharing the launcher
• Initializer npm launch handling

Acceptance criteria

• The launcher invokes npm reliably on Windows and Unix, including installations and repository paths containing spaces.
• dev, build:demo and build reach their intended workspace processes after their own prerequisites pass.
• Child process failures retain their actual exit status and useful error messages.
• Add a native Windows launch regression check, isolated from canonical example preparation.
• Keep the canonical reference identity defect as a separate issue (#77): fixing npm launch alone does not resolve default demo startup.

[viktar-b]

Resolved by PR81, with maintained native launch coverage in PR86.

The demo launches npm's JavaScript entry through the current Node executable with direct argv and no shell. Space/metacharacter arguments, cwd/environment, missing-entry failures, child exit statuses and cleanup have focused regression coverage. Both native hosts execute the real npm demo build launch, and Linux quality runs the complete demo build. Installed project build/dev/browser/API/report workflows also pass in each PowerShell host.

The full suite passes on merged main 1b9e921bceb6b459943c3052f43481f160f303f9 in CI36708816522. Independent launcher review and current native artifact review record the proof. The canonical binding defect remains separately traceable in issue77 and PR80.