fix(updater): spawn pnpm via cross-spawn so updates work on Windows

[kaanisthatyou]

On Windows, the updater checks for pnpm and runs pnpm install / pnpm run build:ui with child_process.spawn('pnpm', ...). pnpm is a .cmd shim on Windows, which child_process.spawn cannot start without a shell (it fails with ENOENT). As a result, on a git install created with the PowerShell installer from the README:

• pnpmOnPath() always resolves false, so preflight fails with pnpm-not-found even though pnpm is installed;
• the install, build and rollback steps (runStep in UpdateExecutor / RollbackHandler) would fail the same way.

This uses cross-spawn (already a dependency, used by utils/run_cmd.ts) for the pnpm check and as the spawnFn passed to the executor and rollback handler. cross-spawn runs .cmd shims correctly on Windows and falls through to child_process.spawn on other platforms, so behavior on Linux and macOS is unchanged. I preferred it over shell: true, which on Node 24 prints a DEP0190 warning when combined with an args array.

Testing

On Windows 11 / Node 24.14.0:

• The exact pnpmOnPath spawn call returns false (ENOENT) with child_process.spawn and true with cross-spawn.
• npx vitest run tests/backend-new/specs/updater (in src): 18 files, 236 tests passing.
• npx tsc --noEmit: no errors.

I did not run a full update end to end on Windows. Running npx eslint in src (ESLint 10.10.0) fails for me with "couldn't find an eslint.config.* file" (the repo only has src/.eslintrc.cjs), so I could not lint the change locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_016Wuh9RTwTUHB7wxpNxrSiw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Fix updater pnpm spawning on Windows

🐞 Bug fix 🕐 10-20 Minutes

AI Description

• Route pnpm preflight checks through cross-spawn to detect Windows command shims.
• Use cross-spawn for manual, scheduled, and rollback update command execution.
• Preserve native spawning behavior on Linux and macOS without enabling shell mode.

Diagram

sequenceDiagram
    participant API as Admin API
    participant Scheduler
    participant Preflight
    participant Executor as Update Executor
    participant Rollback as Rollback Handler
    participant Spawn as cross-spawn
    participant PNPM as pnpm shim
    API->>Preflight: Check pnpm
    Scheduler->>Preflight: Check pnpm
    Preflight->>Spawn: Spawn version check
    Spawn->>PNPM: Resolve platform shim
    API->>Executor: Apply update
    Scheduler->>Executor: Apply update
    Executor->>Spawn: Install and build
    Rollback->>Spawn: Restore dependencies
    Spawn->>PNPM: Execute commands

Loading

High-Level Assessment

The current approach is appropriate because cross-spawn is already a project dependency, handles Windows .cmd resolution, and preserves child_process.spawn semantics elsewhere. Enabling shell mode was reasonably rejected because it introduces shell quoting concerns and Node 24 DEP0190 warnings when used with argument arrays.

Files changed (2) +9 / -5

Bug fix (2) +9 / -5

updateActions.tsMake manual updater pnpm commands Windows-compatible +4/-2

Make manual updater pnpm commands Windows-compatible

• Uses cross-spawn for the manual update preflight pnpm check and the executor's injected spawn function. Existing direct Git operations continue using Node's native spawn implementation.

src/node/hooks/express/updateActions.ts

index.tsMake scheduled updates and rollbacks Windows-compatible +5/-3

Make scheduled updates and rollbacks Windows-compatible

• Uses cross-spawn for scheduled pnpm availability checks and update execution. It also injects cross-spawn into rollback dependencies so pnpm installation succeeds through Windows command shims.

src/node/updater/index.ts

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can ask Qodo to dismiss a finding you disagree with, with your reason on record

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[SamTV12345]

Thanks for the addition :)