fix(create-rezi): harden windows scaffold installs

[RtlZeroMemory]

Summary

• switch create-rezi Windows installs to the standard cross-spawn launcher and resolve npm through the active npm entrypoint
• add a regression test for npm_execpath / npm.cmd install invocation resolution
• fix the minimal template plus-keybinding so generated apps do not bind an invalid bare '+' sequence

Validation

• npm install
• npx biome check CHANGELOG.md packages/create-rezi/package.json packages/create-rezi/src/index.ts packages/create-rezi/src/tests/index.test.ts packages/create-rezi/templates/minimal/src/main.ts packages/create-rezi/templates/minimal/src/helpers/keybindings.ts packages/create-rezi/templates/minimal/src/tests/keybindings.test.ts
• npx tsc -b packages/testkit/tsconfig.json packages/create-rezi/tsconfig.json
• node scripts/run-tests.mjs --filter "create-rezi"
• npx tsx --test packages/create-rezi/templates/minimal/src/tests/keybindings.test.ts
• node scripts/release-set-version.mjs 0.1.0-alpha.68
• node packages/create-rezi/dist/index.js V:\temp\rezi-smoke-minimal --template minimal
• npm run start (confirmed tsx launch and cleared the original create-rezi install failure; remaining backend engine_create failure is outside this regression scope)
• node scripts/release-set-version.mjs 0.1.0-alpha.61

Summary by CodeRabbit

• Bug Fixes
  • Resolved Windows nested-install issues so project creation reliably runs package installs using the active npm entrypoint instead of failing under Git Bash.
  • Improved minimal template keybindings: replaced an invalid + binding with = (and Shift+= on Windows) while preserving + as a command alias, ensuring consistent behavior across platforms.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 91bd2454ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Respect --pm npm instead of always trusting npm_execpath

In resolveInstallInvocation, any truthy npm_execpath is executed when packageManager === "npm", but npm_execpath is often set by non-npm launchers (for example pnpm/yarn script contexts). In that case, create-rezi --pm npm can run the wrong installer (or fail) because it invokes node <pnpm-or-yarn-cli> install instead of npm, which breaks the explicit --pm contract and regresses prior behavior that always executed npm install.

Useful? React with 👍 / 👎.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 46a3b02f-fa9d-4415-806f-7ef58ff1641e

📥 Commits

Reviewing files that changed from the base of the PR and between 8bb7a2b and ad95ee0.

📒 Files selected for processing (2)

• packages/create-rezi/src/__tests__/index.test.ts
• packages/create-rezi/src/index.ts

---

📝 Walkthrough

Walkthrough

Introduces a Windows-safe install launcher using cross-spawn and a resolveInstallInvocation helper to pick the correct installer command (respecting npm_execpath), and replaces a bare + keybinding with =/shift+= in the minimal template.

Changes

Cohort / File(s)	Summary
CHANGELOG & package manifest CHANGELOG.md, packages/create-rezi/package.json	Documented Windows install fix; added cross-spawn runtime dependency and @types/cross-spawn devDependency.
Installer resolution & spawn logic packages/create-rezi/src/index.ts, packages/create-rezi/src/__tests__/index.test.ts	Added exported resolveInstallInvocation(...) to compute {command,args} for installs (handles npm_execpath and Windows npm.cmd), replaced direct spawnSync with cross-spawn.sync, and added Windows-focused tests for npm/pnpm install invocation.
Minimal template keybindings packages/create-rezi/templates/minimal/src/helpers/keybindings.ts, packages/create-rezi/templates/minimal/src/__tests__/keybindings.test.ts, packages/create-rezi/templates/minimal/src/main.ts	Replaced bare + binding with =/shift+= mapping for the "increment" command and added test assertion for resolveMinimalCommand("=").

Sequence Diagram(s)

sequenceDiagram
  participant CLI as create-rezi CLI
  participant Resolver as resolveInstallInvocation
  participant Spawner as cross-spawn.sync
  participant Installer as npm/pnpm (or node exec)

  CLI->>Resolver: provide packageManager, env, platform, nodeExecPath
  Resolver-->>CLI: return { command, args }
  CLI->>Spawner: call sync(command, args, options)
  Spawner-->>Installer: spawn process (npm/pnpm or node + npm_execpath)
  Installer-->>CLI: install exit/status

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hop through Windows, light and spry,
cross-spawn beneath the open sky.
Equals now press where plus once lay,
installs resolve the proper way.
A tiny hop, a stable try.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(create-rezi): harden windows scaffold installs' accurately and concisely describes the primary change: improving Windows install robustness by switching to cross-spawn and fixing npm resolution.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/windows-create-rezi-debug

Warning

Review ran into problems

🔥 Problems

Timed out fetching pipeline failures after 30000ms

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}