fix: avoid shell: true deprecation warning on Node 24

the "shell" option is used to support executing npm on win32 (during "pleb publish").

ensure the args are part of the command to avoid a security warning about them not being automatically escaped.

Author: AviVahl

src/commands/publish.ts

@@ -49,7 +49,7 @@ export async function publish({
           stdio: 'inherit',
           shell: true,
         };
-        spawnSyncLogged('npm', publishArgs, spawnOptions, npmPackage.displayName);
+        spawnSyncLogged(`npm ${publishArgs.join(' ')}`, spawnOptions, npmPackage.displayName);
         log(`${npmPackage.displayName}: done.`);
       }
     } else {

src/utils/process.ts

@@ -15,12 +15,11 @@ export const spawnSyncSafe = ((...args: Parameters<typeof spawnSync>) => {
 
 export function spawnSyncLogged(
   command: string,
-  args: string[],
   options: SpawnSyncOptions,
   label = options.cwd || process.cwd(),
 ): SpawnSyncReturns<string | Buffer> {
-  log(`${label.toString()}: ${command} ${args.join(' ')}`);
-  return spawnSyncSafe(command, args, options);
+  log(`${label.toString()}: ${command}`);
+  return spawnSyncSafe(command, options);
 }
 
 export function reportProcessError(message: unknown): void {