[luvs01]

Summary

Windows read-only planning currently refuses standard npm installations when codex.cmd and Node/npm live in separate prefixes. This change binds the Node/npm pair resolved from the trusted launcher's captured PATH as the updater's metadata toolchain when prefix-local Node is proven absent and the launcher architecture matches the observed Node PE architecture.

This deliberately expands the supported read-only contract. It does not attest the interpreter a future codex.cmd invocation will resolve: CMD can prefer that invocation's working directory. Documentation distinguishes installation-layout classification (managed) from interpreter or write authority. Windows apply remains disabled in this PR.

Stacked on #7596 at refreshed head f7e55ab0. Explicit candidate selection, denied/reparse-versus-missing handling, held file identities, revalidation, isolated metadata queries and backing-package checks remain in place. The content-proof domain is v3. The parent's opt-in content observation and handles held across asynchronous resolution are preserved. Seven translated locale summaries now match this supported-layout contract.

Verification

• Current head 6b723008cc945cccabd0e7af0947fb6e6f531e64 is a normal-merge composition of original head 3407e5f6 and refreshed parent f7e55ab0 (current dev plus the shared Bun 1.4.4 baseline from chore(test): align Bun runner with the 1.4.4 security baseline #7627), plus the shared one-row CI duration-table correction.
• Runtime and configured test runner are now both Bun 1.4.4.
• On this exact head, official Bun 1.4.4, native Windows, bun test --isolate --timeout 60000: tests/codex-integration/codex-cli-windows-plan.test.ts 18 passed / 0 failed / 108 assertions, including the published Node CLI production-inspector metadata case. Root tsc --noEmit, structure SSOT, skill-surface and scoped static checks all exited 0.
• The new duration-table row is a scheduling sample from a successful Bun 1.4.4 integration run, not a measurement of every current parent head.
• Dependency inputs are byte-identical across the eight refreshed heads; versus dev only testRunnerBun changes to 1.4.4.
• The stack fan-in head (feat(codex): apply Windows CLI updates with owned transactions #7648, bc08a484), which contains this change, passed 510 tests / 64 platform skips / 0 failures / 2,911 assertions across 18 units on the same validation.
• Remaining: native POSIX/full-suite execution, real user installation, ARM64 acceptance, future shell-interpreter equivalence, and required maintainer security acceptance. Current-head CI is pending on this head; additional native runs follow sequentially after the first wave.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.