fix: use shell=True for all Windows Python versions

Windows requires shell=True to properly execute .cmd batch files like npx.cmd
across all Python versions. Previous approach only applied this to Python 3.9,
causing inconsistent behavior and npm cache corruption errors on other versions.

Now using shell=True with properly quoted command string (via shlex.quote) for
all Windows Python versions, and shell=False with list format on Unix systems
for better security.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: claude

src/promptfoo/cli.py

@@ -55,20 +55,28 @@ def main() -> NoReturn:
 
     # Build the command: npx promptfoo@latest <args>
     # Use @latest to always get the most recent version
-    # Use the full path to npx for Windows compatibility
-    cmd = [npx_path, "--yes", "promptfoo@latest"] + sys.argv[1:]
-
-    # On Windows Python 3.9, we need shell=True for proper .cmd execution
-    # On other platforms/versions, use shell=False to avoid npm cache issues
-    is_windows_py39 = platform.system() == "Windows" and sys.version_info[:2] == (3, 9)
+    is_windows = platform.system() == "Windows"
+
+    # On Windows, we need special handling for .cmd files
+    if is_windows:
+        # On Windows, build command as string for shell=True
+        # This properly handles npx.cmd batch file execution
+        import shlex
+        args = ["npx", "--yes", "promptfoo@latest"] + sys.argv[1:]
+        cmd = " ".join(shlex.quote(arg) for arg in args)
+        use_shell = True
+    else:
+        # On Unix, use list format with shell=False (more secure)
+        cmd = [npx_path, "--yes", "promptfoo@latest"] + sys.argv[1:]
+        use_shell = False
 
     try:
         # Execute the command and pass through stdio
         result = subprocess.run(
             cmd,
             env=os.environ.copy(),
             check=False,  # Don't raise exception on non-zero exit
-            shell=is_windows_py39,  # Only use shell on Windows Python 3.9
+            shell=use_shell,
         )
         sys.exit(result.returncode)
     except KeyboardInterrupt: