Fix current Windows Codex package resolution

apps/server/src/provider/providerMaintenance.test.ts

@@ -331,6 +331,26 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => {
     });
   });
 
+  it("recognizes absolute Windows npm shims as one-click updatable installs", () => {
+    const commandPath = "C:\\Users\\example\\AppData\\Roaming\\npm\\package-tool.cmd";
+    expect(
+      packageToolUpdate.resolve({
+        binaryPath: commandPath,
+        resolvedCommandPath: commandPath,
+        realCommandPath: commandPath,
+      }),
+    ).toEqual({
+      provider: driver("packageTool"),
+      packageName: "@example/package-tool",
+      update: {
+        command: "npm install -g @example/package-tool@latest",
+        executable: "npm",
+        args: ["install", "-g", "@example/package-tool@latest"],
+        lockKey: "npm-global",
+      },
+    });
+  });
+
   it.effect(
     "switches native-package-tool to native updates when the binary resolves through the native installer",
     () =>

apps/server/src/provider/providerMaintenance.ts

@@ -245,7 +245,10 @@ function isNpmGlobalCommandPath(commandPath: string): boolean {
   return (
     normalized.includes("/node_modules/.bin/") ||
     normalized.includes("/lib/node_modules/") ||
-    normalized.includes("/npm/node_modules/")
+    normalized.includes("/npm/node_modules/") ||
+    normalized.includes("/appdata/roaming/npm/") ||
+    normalized.includes("/.npm-global/") ||
+    normalized.includes("/npm-global/")
   );
 }
 

apps/server/src/provider/security/CommandCenterProviderIsolation.test.ts

@@ -496,7 +496,7 @@
     }),
   );
 
-  it.effect("resolves the native executable behind an official Windows npm launcher", () =>
+  it.effect("resolves current and legacy native executables behind a Windows npm launcher", () =>
     Effect.gen(function* () {
       const fileSystem = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
@@ -509,22 +509,32 @@
         "@openai",
         "codex-win32-x64",
       );
-      const nativePath = path.join(
-        platformPackageRoot,
-        "vendor",
-        "x86_64-pc-windows-msvc",
-        "codex",
-        "codex.exe",
-      );
+      const platformVendorRoot = path.join(platformPackageRoot, "vendor", "x86_64-pc-windows-msvc");
+      const currentNativePath = path.join(platformVendorRoot, "bin", "codex.exe");
+      const legacyNativePath = path.join(platformVendorRoot, "codex", "codex.exe");
       yield* writeFile(commandPath, "@echo off\r\n");
       yield* writeFile(path.join(packageRoot, "bin", "codex.js"), "// launcher\n");
       yield* writeFile(
         path.join(platformPackageRoot, "package.json"),
         '{"name":"@openai/codex-win32-x64","version":"0.0.0"}\n',
       );
-      yield* fileSystem.makeDirectory(path.dirname(nativePath), { recursive: true });
-      yield* fileSystem.writeFile(nativePath, Uint8Array.from([0x4d, 0x5a, 0x00, 0x00]));
+      yield* fileSystem.makeDirectory(path.dirname(currentNativePath), { recursive: true });
+      yield* fileSystem.makeDirectory(path.dirname(legacyNativePath), { recursive: true });
+      yield* fileSystem.writeFile(currentNativePath, Uint8Array.from([0x4d, 0x5a, 0x00, 0x00]));
+      yield* fileSystem.writeFile(legacyNativePath, Uint8Array.from([0x4d, 0x5a, 0x00, 0x00]));
+
+      NodeAssert.equal(
+        yield* resolveCommandCenterCodexRuntimeExecutable({
+          commandPath,
+          platform: "win32",
+          architecture: "x64",
+          fileSystem,
+          path,
+        }),
+        yield* fileSystem.realPath(currentNativePath),
+      );
 
+      yield* fileSystem.remove(currentNativePath);
       NodeAssert.equal(
         yield* resolveCommandCenterCodexRuntimeExecutable({
           commandPath,
@@ -533,7 +543,7 @@
           fileSystem,
           path,
         }),
-        yield* fileSystem.realPath(nativePath),
+        yield* fileSystem.realPath(legacyNativePath),
       );
     }),
   );
@@ -664,7 +674,7 @@
           fileSystem,
           path,
         }).pipe(Effect.flip);
         NodeAssert.match(error.issue, fixture.expected);
       }
     }),
   );
@@ -702,7 +712,7 @@
           fileSystem,
           path,
         }).pipe(Effect.flip);
         NodeAssert.match(error.issue, /single-link regular file/u);
       }
     }),
   );

apps/server/src/provider/security/CommandCenterProviderIsolation.ts

@@ -374,7 +374,7 @@
   issue: string,
   cause?: unknown,
 ): CommandCenterManagedWorktreeIsolationError {
   return new CommandCenterManagedWorktreeIsolationError({
     issue,
     ...(cause === undefined ? {} : { cause }),
   });
@@ -440,23 +440,25 @@
         cause,
       ),
   });
-  const nativeExecutablePath = path.join(
-    path.dirname(packageJsonPath),
-    "vendor",
-    target.triple,
-    "codex",
-    "codex.exe",
+  const platformVendorRoot = path.join(path.dirname(packageJsonPath), "vendor", target.triple);
+  const nativeExecutableCandidates = [
+    path.join(platformVendorRoot, "bin", "codex.exe"),
+    path.join(platformVendorRoot, "codex", "codex.exe"),
+  ];
+  for (const candidate of nativeExecutableCandidates) {
+    if (yield* fileSystem.exists(candidate)) {
+      return yield* fileSystem
+        .realPath(candidate)
+        .pipe(
+          Effect.mapError((cause) =>
+            codexHomeError("Command Center could not canonicalize the native codex.exe.", cause),
+          ),
+        );
+    }
+  }
+  return yield* codexHomeError(
+    "Command Center found the Windows Codex package but not its native codex.exe. Reinstall @openai/codex with optional dependencies enabled.",
   );
-  return yield* fileSystem
-    .realPath(nativeExecutablePath)
-    .pipe(
-      Effect.mapError((cause) =>
-        codexHomeError(
-          "Command Center could not locate the native codex.exe and its Windows sandbox resources. Reinstall or update @openai/codex.",
-          cause,
-        ),
-      ),
-    );
 });
 
 function isNotSymlink(error: PlatformError.PlatformError): boolean {