fix(server): check Homebrew for provider updates on Homebrew installs

[ishaanko]

What Changed

Provider update advisories compared the installed version against npm's latest for every install kind. A Homebrew-managed Codex or Claude is flagged as outdated the moment a release hits npm, and the offered brew upgrade cannot clear it until the cask is bumped, so the nag never goes away.

ProviderMaintenanceCapabilities now carries homebrewFormula, set only when the install resolves through Homebrew. For those installs resolveLatestProviderVersion reads the latest version from formulae.brew.sh (cask first, then formula), which is the same JSON API brew installs from and therefore exactly what brew upgrade can deliver. Cask build suffixes (1.2.3,4567) are stripped before the semver compare. Third-party taps (anomalyco/tap/opencode) have no public API and keep npm. npm, bun, pnpm, Vite+, and native installs are unchanged.

Fixes #7730

Why

npm and the Homebrew cask publish at different times. Today @openai/codex@0.149.0 hit npm at 21:04Z while the cask is still at 0.148.0. The app asked for brew upgrade codex, which had nothing to do, and kept showing "update available". Comparing against the source the update command actually pulls from makes the advisory and the button agree.

UI Changes

None.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Test plan

• vp test run src/provider/providerMaintenance.test.ts 21/21, with three new cases: Homebrew cask lookup (and build-suffix strip), formula fallback when the name is not a cask, third-party tap stays on npm
• providerMaintenanceRunner, makeManagedServerProvider, ProviderRegistry tests 61/61
• tsgo --noEmit for apps/server, targeted lint and fmt
• Live check through the new code against the real APIs: Homebrew-managed codex resolves 0.148.0 (reads as current), npm-managed resolves 0.149.0

Written by Claude Fable 5 via Claude Code.

---

Note

Low Risk
Scoped to provider version-advisory HTTP lookups; no auth, install, or update-command execution changes. Failure still returns null and leaves the advisory unknown.

Overview
Stops Homebrew-managed providers from being flagged as outdated whenever npm publishes first. Latest-version checks now follow the same source as brew upgrade.

ProviderMaintenanceCapabilities now carries homebrewFormula (set only for Homebrew-resolved installs). resolveLatestProviderVersion queries formulae.brew.sh (cask, then formula), strips cask build suffixes, and caches under homebrew:<name>. Third-party taps still use npm because they are not on that API. npm/bun/pnpm/Vite+/native installs are unchanged.

^{Reviewed by Cursor Bugbot for commit 4a2d57c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add Homebrew formula/cask version checks to resolveLatestProviderVersion

• Homebrew-managed provider installs now resolve their latest version from formulae.brew.sh instead of npm. fetchHomebrewLatestVersion tries the cask endpoint first, then falls back to the formula endpoint, stripping build suffixes after a comma.
• ProviderMaintenanceCapabilities gains a readonly homebrewFormula field (string or null) that records the formula/cask name for Homebrew-managed installs.
• resolveLatestVersionSource picks Homebrew for core formulas (no slash in the name), keeps npm for third-party taps and npm installs, and returns no source otherwise.
• A shared fetchJson helper centralizes HTTP GET, timeout, status check, and Schema decode logic; npm version lookup is refactored to use it with no behavior change.
• Behavioral Change: resolveLatestProviderVersion now uses separate cache keys (homebrew:<name> vs npm package name) and may return a version sourced from Homebrew rather than npm for Homebrew-managed installs.

^{Macroscope summarized 4a2d57c.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e775161d-f7cb-4a9e-ac92-cd7c925b48fa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes runtime behavior by modifying how provider version checks work for Homebrew installs - introducing new HTTP calls to Homebrew's API (formulae.brew.sh) instead of npm. This behavioral change to the update-checking system warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}