fix: cmd-shim not identified if placed outside node_modules/.bin/

[patrickkfkan]

I have a node executable installed globally with npm i -g . Because of this, the cmd-shim was not placed in node_modules/.bin/. On Windows, this caused cross-spawn to escape arguments only once.

This PR inspects the contents of the target file and if it can obtain the wrapped command, it will take it as cmd-shim and escape arguments twice.

[patrickkfkan]

Revisiting this, I realize the read-cmd-shim dependency added for this fix requires minimum Node v14.17. This is quite higher than the v8 required by this project, and will essentially throw "bad engine" warnings on builds with legacy Node versions.

I'll leave it to the project devs to decide what to do with this PR.

[sara554-beep]

60441cf

[hlovdal]

@patrickkfkan

Revisiting this, I realize the read-cmd-shim dependency added for this fix requires minimum Node v14.17.

Even back in 2024 when you wrote this, Node.js 14 had been not maintained for over one and a half year. And Node.js went out of support in 2019.

I most certainly see the value in keeping support for older versions, even beyond the Node.js support window, however in this case I do not think updating Node.js version is a problem now in 2026.