fix(shared): preserve Windows shell PATH priority

[UtkarshUsername]

Closes #7570

What Changed

Preserved the user shell PATH order during Windows environment hydration. Known package-manager CLI directories now append as fallbacks rather than taking priority.

Why

A stale %APPDATA%\npm\codex.cmd shim could be selected ahead of the user's working Codex executable, causing an opaque app-server protocol error. Keeping shell PATH precedence makes bare provider commands resolve the same way they do in the user's terminal.

Checklist

• This PR is small and focused
• I explained what changed and why

Model: gpt-5.6-terra
Harness: Codex

---

Note

Medium Risk
Changes how every Windows spawn resolves commands via resolveWindowsEnvironment (e.g. server os-jank), so wrong ordering could still break CLI discovery—but the change is narrowly scoped to PATH merge precedence with tests covering the main flows.

Overview
Windows PATH hydration now keeps shell and inherited entries ahead of hard-coded package-manager directories when building the baseline environment in resolveWindowsEnvironment.

The merge order flips from known CLI dirs first to merged shell PATH first, with npm/nodejs/Volta/pnpm/bun/scoop paths appended only as fallbacks for GUI-launched processes that lack a full interactive PATH. That avoids stale shims (e.g. %APPDATA%\npm\codex.cmd) winning over the same commands the user gets in a terminal.

shell.test.ts expectations were updated for the baseline, profile-loaded, and profile-fallback cases so PATH ordering matches the new priority rules.

^{Reviewed by Cursor Bugbot for commit 34886fd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 006e82d3-09e5-49cc-8880-7b65209860c6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at 34886fd

Macroscope's review found this PR approvable — This is a narrowly scoped Windows PATH bug fix that preserves the shell's existing command priority while retaining known CLI directories as fallbacks. Runtime impact is confined to environment hydration, and the affected baseline and profile flows are covered by tests.

^{You can add or adjust custom eligibility rules. Learn more.}

[CDVolvik]

Verified fix(shared): preserve Windows shell PATH priority (#8748) on pr-8748 (34886fd).

Environment: Windows, pnpm exec vitest run packages/shared/src/shell.test.ts — mocked WindowsShellEnvironment/CommandAvailability, not a live pwsh.exe codex app-server spawn.

Scope: packages/shared/src/shell.ts:726-729 flips baselinePath from mergePathValues(knownCliPath, mergedPath) to mergePathValues(mergedPath, knownCliPath) — shell/inherited PATH keeps priority, resolveKnownWindowsCliDirs (npm/nodejs/Volta/pnpm/bun/scoop) appends only as fallback for GUI-launched processes. Matches #7570 root cause (stale %APPDATA% npm codex.cmd winning over where codex) and prior #6116 pattern.

Tests:

• PR: pnpm exec vitest run packages/shared/src/shell.test.ts → 29/29 PASS (3x resolveWindowsEnvironment + 26 others)
• Revert check (shell.ts → main ordering, PR tests kept): 3 FAILED / 26 PASS — PATH prefix vs suffix mismatch as expected. Restore → 29 PASS again.

Surgical, no drive-bys. Would be good to also log resolved command + first stdout bytes on decode-wire-message failures in a follow-up, but out of scope here.

Verified as CDVolvik on Windows.