fix: avoid npx when applying profile changes

[showms]

Summary

Fixes the interactive openspec config profile apply step by invoking openspec update directly instead of routing through npx.

Closes #1304 #1306 .

Problem

After saving profile or workflow changes, the config wizard prompts:

Apply changes to this project now?

When confirmed, it currently runs:

npx openspec update

This unnecessarily depends on npm/npx and may fail when:

• OpenSpec is installed with Bun or as a standalone binary
• The current project uses pnpm or another package manager
• npm fails while inspecting the project's dependency tree

The openspec executable is already available on PATH, so invoking it through npx is unnecessary.

Changes

• Replace npx openspec update with openspec update
• Update the config profile test expectation

Verification

• test/commands/config-profile.test.ts: 19 tests passed
• node build.js: passed
• git diff --check: passed

Summary by CodeRabbit

• Bug Fixes
  • Improved the project profile “apply now” workflow by running the project update directly with the installed OpenSpec command (instead of a shell-based invocation).
• Tests
  • Updated the config profile flow test to match the new update behavior, including revised assertions and environment setup.

[coderabbitai]

📝 Walkthrough

Walkthrough

The config profile apply flow now calls UpdateCommand directly instead of invoking npx openspec update, with tests updated to validate behavior when no configured tools are available.

Changes

Config apply command

Layer / File(s)	Summary
Direct update invocation src/commands/config.ts	The apply-now flow executes UpdateCommand with the project directory while retaining existing failure handling.
Apply flow validation test/commands/config-profile.test.ts	Tests remove execSync mocking and verify output and process state when the executable path is empty.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• #1304: The change removes the hardcoded npx execution path described in the issue.
• #1306: The issue covers the same config apply-now logic and regression test.

Possibly related PRs

• Fission-AI/OpenSpec#736: Refactors the related config profile interactive/apply-update flow.
• Fission-AI/OpenSpec#1354: Uses UpdateCommand for the same apply-now path.

Suggested reviewers: tabishb

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: removing npx from the profile apply flow.
Linked Issues check	✅ Passed	The change addresses #1304 by removing the npx-based apply step and updating the related test coverage.
Out of Scope Changes check	✅ Passed	The modified files are limited to the config apply path and its test, with no unrelated changes evident.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/commands/config.ts (1)

627-630: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Log the actual error message for better debuggability.

Currently, if the update fails, the underlying error is swallowed and a generic failure message is logged. Capturing and logging the actual error will help users diagnose the root cause (e.g., file permission issues, invalid configurations).

💡 Proposed fix

-            } catch {
-              console.error('`openspec update` failed. Please run it manually to apply the profile changes.');
+            } catch (error) {
+              const errorMessage = error instanceof Error ? error.message : String(error);
+              console.error(`\`openspec update\` failed: ${errorMessage}`);
+              console.error('Please run it manually to apply the profile changes.');
               process.exitCode = 1;
             }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/commands/config.ts` around lines 627 - 630, Update the catch block around
the openspec update operation to capture the thrown error and include its
message or details in the console.error output alongside the existing failure
context, while preserving process.exitCode = 1.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/commands/config-profile.test.ts`:
- Around line 376-378: Update the test setup around the empty-bin PATH scenario
to use Vitest’s vi.stubEnv() instead of assigning process.env.PATH directly.
Ensure the stub is restored through the test lifecycle so subsequent tests
retain the original PATH and can resolve system binaries.

---

Outside diff comments:
In `@src/commands/config.ts`:
- Around line 627-630: Update the catch block around the openspec update
operation to capture the thrown error and include its message or details in the
console.error output alongside the existing failure context, while preserving
process.exitCode = 1.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9d9fb890-ed45-4603-a338-e3b4e6fb93a4

📥 Commits

Reviewing files that changed from the base of the PR and between 2625ca7 and 6c5eb37.

📒 Files selected for processing (2)

• src/commands/config.ts
• test/commands/config-profile.test.ts

[coderabbitai]

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Prevent test state leakage by safely mocking environment variables.

Mutating process.env.PATH directly without restoring it can leak state to subsequent tests in the same worker, potentially causing them to fail when they are unable to resolve system binaries. Use Vitest's vi.stubEnv() instead, which safely mocks the environment variable and cleans it up after the test.

🛠️ Proposed fix to use `vi.stubEnv`

     const emptyBinDir = path.join(tempDir, 'empty-bin');
     fs.mkdirSync(emptyBinDir);
-    process.env.PATH = emptyBinDir;
+    vi.stubEnv('PATH', emptyBinDir);

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	const emptyBinDir = path.join(tempDir, 'empty-bin');
	fs.mkdirSync(emptyBinDir);
	process.env.PATH = emptyBinDir;
	const emptyBinDir = path.join(tempDir, 'empty-bin');
	fs.mkdirSync(emptyBinDir);
	vi.stubEnv('PATH', emptyBinDir);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/commands/config-profile.test.ts` around lines 376 - 378, Update the test
setup around the empty-bin PATH scenario to use Vitest’s vi.stubEnv() instead of
assigning process.env.PATH directly. Ensure the stub is restored through the
test lifecycle so subsequent tests retain the original PATH and can resolve
system binaries.