fix(server): enable cross-platform update flow and password escaping

packages/web/server/index.js

@@ -5424,13 +5424,21 @@ async function main(options = {}) {
         // Use defaults
       }
 
+      const isWindows = process.platform === 'win32';
+
       // Build restart command with stored options
       let restartCmd = `openchamber serve --port ${storedOptions.port} --daemon`;
       if (storedOptions.uiPassword) {
-        // Escape password for shell
+        if (isWindows) {
+          // Escape for cmd.exe quoted argument
+          const escapedPw = storedOptions.uiPassword.replace(/"/g, '""');
+          restartCmd += ` --ui-password "${escapedPw}"`;
+        } else {
+          // Escape for POSIX single-quoted argument
           const escapedPw = storedOptions.uiPassword.replace(/'/g, "'\\''");
           restartCmd += ` --ui-password '${escapedPw}'`;
         }
+      }
 
       // Respond immediately - update will happen after response
       res.json({
@@ -5449,7 +5457,21 @@ async function main(options = {}) {
         // 1. Wait for current process to exit
         // 2. Run the update
         // 3. Restart the server with original options
-        const script = `
+        const shell = isWindows ? (process.env.ComSpec || 'cmd.exe') : 'sh';
+        const shellFlag = isWindows ? '/c' : '-c';
+        const script = isWindows
+          ? `
+            timeout /t 2 /nobreak >nul
+            ${updateCmd}
+            if %ERRORLEVEL% EQU 0 (
+              echo Update successful, restarting OpenChamber...
+              ${restartCmd}
+            ) else (
+              echo Update failed
+              exit /b 1
+            )
+          `
+          : `
             sleep 2
             ${updateCmd}
             if [ $? -eq 0 ]; then
@@ -5462,7 +5484,7 @@ async function main(options = {}) {
           `;
 
         // Spawn detached shell to run update after we exit
-        const child = spawnChild('sh', ['-c', script], {
+        const child = spawnChild(shell, [shellFlag, script], {
           detached: true,
           stdio: 'ignore',
           env: process.env,