fix(server): resolve provider update command spawns

[Andrew-Forster]

Summary

Provider update commands now go through the shared resolveSpawnCommand path before ChildProcess.make, matching the provider/runtime process paths that already handle Windows .cmd and .bat shims.

Why

On Windows, package-manager commands such as npm often resolve to shim files like npm.cmd. The provider update runner was still spawning the raw command name, so one-click Codex updates could fail with NotFound: ChildProcess.spawn (npm install -g @openai/codex@latest) even though the same command worked from a terminal. This keeps the command allowlist/update flow intact while reusing the centralized shim resolution and escaping added for other process spawns. Fixes #2765.

Validation

• pnpm --dir apps/server exec vp test run src/provider/providerMaintenanceRunner.test.ts
• pnpm exec vp run --filter t3 typecheck
• pnpm exec vp check passes with existing warnings outside this change

Note

Resolve Windows command shims before spawning provider update commands

• ProviderMaintenanceRunner.runCommand now calls resolveSpawnCommand before spawning, which may transform the command/args and set shell: true when the resolved executable is a .cmd shim on Windows.
• Tests are updated to pass a linuxHostPlatformLayer to existing cases and add a new case asserting that Windows shim resolution produces the correct escaped command, args, and shell: true.
• The mock spawner in tests is extended to forward CommandOptions to the handler, enabling assertions on spawn options.
• Behavioral Change: on Windows, provider update commands now run via a shell when the executable resolves to a .cmd shim, changing the process spawning behavior for those environments.

^{Macroscope summarized 60b77c5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: d3dc1ed4-5ade-4ead-ba43-9ef193e4b8f6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}