plugins: git dep preparation failed on Windows for git plugins with build scripts #59504

Description

On Windows, opencode plugin add / opencode plugin update fail for any git-spec plugin whose package.json defines one of build, prepare, prepack, install, preinstall, or postinstall:

NpmInstallFailedError
  at Npm.reify ...
  [cause]: Error: git dep preparation failed

Root cause (v2.1.4 bundles @npmcli/[email protected] + patched [email protected]; see packages/util/src/npm.ts):

• Plugin packages are installed via Arborist reify.
• pacote's git fetcher (lib/git.js #prepareDir) runs in-clone preparation when the dep's package.json defines any of the script names above, and shells out to the bare npm CLI: npm(this.npmBin ?? "npm", ["install", "--force", ...], cloneDir).
• On Windows npm is a .cmd shim, and spawning it without a shell fails (observed ENOENT, even with npm 11.12.1 on PATH). Arborist wraps that as git dep preparation failed, OpenCode surfaces NpmInstallFailedError. So this fails regardless of whether node/npm are installed.

Instrumented spawn trace from a standalone reproduction using the same Arborist options as packages/util/src/npm.ts:

spawn ENOENT -> "npm" ["install","--force","--cache=...","--prefer-offline=false",
  "--prefer-online=true",...,"--no-package-lock-only","--no-dry-run"]
cwd: ~\.npm\_cacache\tmp\git-clone*

macOS/Linux are likely unaffected (a real npm executable spawns fine if node is installed), so this is Windows-only.

Environment

• OpenCode version: 2.1.4 (release channel, installed via bun)
• OS: Windows 11 (10.0.26200, x64)
• Plugins: a git-spec TUI plugin installed via opencode plugin add github:<owner>/<repo>
• node 24.15.0 / npm 11.12.1 on PATH (not required for the failure)

Steps to reproduce

1. On Windows, point plugin add at a public git repo whose package.json contains e.g. "scripts": { "build": "echo ok" } (no actual build needed).
2. opencode plugin add github:<owner>/<repo> → fails with NpmInstallFailedError, cause git dep preparation failed.
3. Remove the build key and push → the same command now succeeds (pacote skips prep and packs the clone via npm-packlist).

Expected

Git-spec plugins that define build scripts install successfully — prep skipped when unnecessary, or npm spawned in a Windows-safe way (e.g. process.execPath + npm-cli.js, or shell handling for .cmd shims).

Actual

Install fails consistently with the wrapped error above, before any of the plugin's code runs.

Workaround

Avoid all six script names in a git plugin's package.json (e.g. rename build → build:tui). Confirmed working.

Related but separate: #39986 (Solid JSX transform not applied to TUI plugins under node_modules).