fix: use PATH-aware resolution for provider availability and fix Windows cmd escaping

Provider isAvailable() was using executableExists() which only checks
filesystem paths, not PATH. Commands like ["claude", "--flag"] would
show as unavailable even though they'd launch fine. Switch to
isCommandAvailable() which uses findExecutable() for proper PATH
resolution. Un-export executableExists from the public API.

Fix Windows cmd.exe metacharacter escaping — &, |, ^, <, >, (, ), !
are now properly escaped with ^, and % is doubled. Add shared
escapeWindowsCmdValue helper used by both quoteWindowsCommand and
quoteWindowsArgument. Replace local quoteForCmd in spawn.ts.

Add server-tests-windows CI job to catch Windows-specific regressions.

packages/server/src/utils/executable.test.ts

@@ -240,6 +240,46 @@ describe("quoteWindowsCommand", () => {
     expect(quoteWindowsCommand("C:\\nvm4w\\nodejs\\codex")).toBe("C:\\nvm4w\\nodejs\\codex");
   });
 
+  test("escapes ampersands", async () => {
+    setPlatform("win32");
+    const { quoteWindowsCommand } = await loadExecutableModule();
+    expect(quoteWindowsCommand("feature&bugfix")).toBe("feature^&bugfix");
+  });
+
+  test("escapes pipes", async () => {
+    setPlatform("win32");
+    const { quoteWindowsCommand } = await loadExecutableModule();
+    expect(quoteWindowsCommand("feature|bugfix")).toBe("feature^|bugfix");
+  });
+
+  test("doubles percent signs", async () => {
+    setPlatform("win32");
+    const { quoteWindowsCommand } = await loadExecutableModule();
+    expect(quoteWindowsCommand("100%")).toBe("100%%");
+  });
+
+  test("escapes carets", async () => {
+    setPlatform("win32");
+    const { quoteWindowsCommand } = await loadExecutableModule();
+    expect(quoteWindowsCommand("feature^bugfix")).toBe("feature^^bugfix");
+  });
+
+  test("escapes multiple metacharacters", async () => {
+    setPlatform("win32");
+    const { quoteWindowsCommand } = await loadExecutableModule();
+    expect(quoteWindowsCommand("build&(test|deploy)!<output>")).toBe(
+      "build^&^(test^|deploy^)^!^<output^>",
+    );
+  });
+
+  test("quotes commands with spaces after escaping metacharacters", async () => {
+    setPlatform("win32");
+    const { quoteWindowsCommand } = await loadExecutableModule();
+    expect(quoteWindowsCommand("C:\\Program Files\\My Tool&Stuff\\run 100%.cmd")).toBe(
+      '"C:\\Program Files\\My Tool^&Stuff\\run 100%%.cmd"',
+    );
+  });
+
   test("returns the command unchanged on non-Windows platforms", async () => {
     setPlatform("darwin");
     const { quoteWindowsCommand } = await loadExecutableModule();

packages/server/src/utils/executable.ts

@@ -105,6 +105,20 @@ export async function isCommandAvailable(command: string): Promise<boolean> {
   return (await findExecutable(command)) !== null;
 }
 
+function escapeWindowsCmdValue(value: string): string {
+  if (process.platform !== "win32") return value;
+
+  const isQuoted = value.startsWith('"') && value.endsWith('"');
+  const unquoted = isQuoted ? value.slice(1, -1) : value;
+  const escaped = unquoted.replace(/%/g, "%%").replace(/([&|^<>()!])/g, "^$1");
+
+  if (isQuoted || escaped.includes(" ")) {
+    return `"${escaped}"`;
+  }
+
+  return escaped;
+}
+
 /**
  * When spawning with `shell: true` on Windows, the command is passed to
  * `cmd.exe /d /s /c "command args"`. The `/s` strips outer quotes, so a
@@ -112,10 +126,7 @@ export async function isCommandAvailable(command: string): Promise<boolean> {
  * space. Wrapping it in quotes produces the correct `"C:\Program Files\..." args`.
  */
 export function quoteWindowsCommand(command: string): string {
-  if (process.platform !== "win32") return command;
-  if (!command.includes(" ")) return command;
-  if (command.startsWith('"') && command.endsWith('"')) return command;
-  return `"${command}"`;
+  return escapeWindowsCmdValue(command);
 }
 
 /**
@@ -124,8 +135,5 @@ export function quoteWindowsCommand(command: string): string {
  * child process sees it.
  */
 export function quoteWindowsArgument(argument: string): string {
-  if (process.platform !== "win32") return argument;
-  if (!argument.includes(" ")) return argument;
-  if (argument.startsWith('"') && argument.endsWith('"')) return argument;
-  return `"${argument}"`;
+  return escapeWindowsCmdValue(argument);
 }

packages/server/src/utils/spawn.ts

@@ -1,6 +1,8 @@
 import { execFile, spawn, type ChildProcess, type SpawnOptions } from "node:child_process";
 import { promisify } from "node:util";
 
+import { quoteWindowsArgument, quoteWindowsCommand } from "./executable.js";
+
 const execFileAsync = promisify(execFile);
 
 interface ExecCommandOptions {
@@ -16,12 +18,6 @@ interface ExecCommandResult {
   stderr: string;
 }
 
-function quoteForCmd(value: string): string {
-  if (!value.includes(" ")) return value;
-  if (value.startsWith('"') && value.endsWith('"')) return value;
-  return `"${value}"`;
-}
-
 export function spawnProcess(
   command: string,
   args: string[],
@@ -29,8 +25,8 @@ export function spawnProcess(
 ): ChildProcess {
   const isWindows = process.platform === "win32";
 
-  const resolvedCommand = isWindows ? quoteForCmd(command) : command;
-  const resolvedArgs = isWindows ? args.map(quoteForCmd) : args;
+  const resolvedCommand = isWindows ? quoteWindowsCommand(command) : command;
+  const resolvedArgs = isWindows ? args.map(quoteWindowsArgument) : args;
 
   return spawn(resolvedCommand, resolvedArgs, {
     ...options,
@@ -45,8 +41,8 @@ export async function execCommand(
   options?: ExecCommandOptions,
 ): Promise<ExecCommandResult> {
   const isWindows = process.platform === "win32";
-  const resolvedCommand = isWindows ? quoteForCmd(command) : command;
-  const resolvedArgs = isWindows ? args.map(quoteForCmd) : args;
+  const resolvedCommand = isWindows ? quoteWindowsCommand(command) : command;
+  const resolvedArgs = isWindows ? args.map(quoteWindowsArgument) : args;
 
   return execFileAsync(resolvedCommand, resolvedArgs, {
     cwd: options?.cwd,