@indigoai-us/hq-cli 5.341.2 → 5.341.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.341.4] — 2026-10-03
+- Prevent daemon restarts from waiting on stale or already-owned Claude bridge sessions, and keep captured startup diagnostics useful without exposing authorization credentials.
+
+## [5.341.3] — 2026-10-03
+- Preserve policy-trigger parity for Windows PATH resolution, filesystem paths, and frontmatter parsing.
+- Report unexpected company-resolve, plan-limit body and late owner-context failures that a bare catch used to hide. The report prints only with `--verbose` or `HQ_DEBUG` set.
+- Enable hqd on Windows through a bundled PowerShell named-pipe host that applies and verifies a current-user-only DACL, while refusing startup if the security check fails.
+- `hq doctor` now reports hqd reachability, runtime flag freshness and fallback
+  reasons for the current directory. The same fields are available with
+  `hq doctor --json`, including while the runtime flag is off.
+- Hardened Unix hqd socket startup to reject symlinks anywhere in the socket directory path and unexpected socket-path entries, replace only a stale socket owned by the current user, and verify user-only directory and socket permissions. The default socket now lives under the private `~/.hq/daemon/` directory.
+
 ## [5.341.2] — 2026-10-03
 
 - Preserve the original integrations response read error instead of returning a consumed response.

package/assets/hqd/windows-pipe-host.ps1

@@ -0,0 +1,282 @@
+$ErrorActionPreference = 'Stop'
+[Console]::InputEncoding = New-Object System.Text.UTF8Encoding($false)
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+try {
+  Add-Type -AssemblyName System.IO.Pipes.AccessControl -ErrorAction SilentlyContinue
+} catch {
+  # Windows PowerShell 5.1 ships the access-control types in its framework assemblies.
+}
+
+$source = @'
+using System;
+using System.Collections;
+using System.Collections.Concurrent;
+using System.IO;
+using System.IO.Pipes;
+using System.Linq;
+using System.Reflection;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Win32.SafeHandles;
+using System.Runtime.InteropServices;
+
+public static class HqdWindowsPipeHost
+{
+    private static readonly object OutputLock = new object();
+    private static readonly ConcurrentDictionary<int, NamedPipeServerStream> Connections = new ConcurrentDictionary<int, NamedPipeServerStream>();
+    private static int NextConnectionId;
+    private static volatile bool Stopping;
+    private static readonly ManualResetEventSlim AcceptStarted = new ManualResetEventSlim(false);
+    private static string PipeName;
+    private static SecurityIdentifier UserSid;
+    private static PipeSecurity Security;
+
+    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+    private static extern bool GetNamedPipeClientComputerName(SafePipeHandle pipe, StringBuilder computerName, uint length);
+
+    private static void Emit(string frame)
+    {
+        lock (OutputLock)
+        {
+            Console.Out.WriteLine(frame);
+            Console.Out.Flush();
+        }
+    }
+
+    private static string B64(string value)
+    {
+        return Convert.ToBase64String(Encoding.UTF8.GetBytes(value));
+    }
+
+    private static void EmitFatal(Exception error)
+    {
+        Emit("FATAL\t" + B64(error.GetBaseException().Message));
+    }
+
+    private static PipeSecurity BuildSecurity(SecurityIdentifier sid)
+    {
+        PipeSecurity security = new PipeSecurity();
+        security.SetAccessRuleProtection(true, false);
+        security.AddAccessRule(new PipeAccessRule(sid, PipeAccessRights.FullControl, AccessControlType.Allow));
+        return security;
+    }
+
+    private static void VerifySecurity(NamedPipeServerStream pipe)
+    {
+        PipeSecurity actual = pipe.GetAccessControl();
+        AuthorizationRuleCollection rules = actual.GetAccessRules(true, true, typeof(SecurityIdentifier));
+        if (rules.Count != 1)
+            throw new InvalidOperationException("created pipe DACL has an unexpected number of ACEs");
+        PipeAccessRule rule = rules[0] as PipeAccessRule;
+        if (rule == null || rule.AccessControlType != AccessControlType.Allow ||
+            !UserSid.Equals(rule.IdentityReference) || rule.PipeAccessRights != PipeAccessRights.FullControl ||
+            rule.InheritanceFlags != InheritanceFlags.None || rule.PropagationFlags != PropagationFlags.None ||
+            rule.IsInherited)
+            throw new InvalidOperationException("created pipe DACL is not exactly current-user full control");
+        if (!actual.AreAccessRulesProtected)
+            throw new InvalidOperationException("created pipe DACL is not protected from inherited ACEs");
+    }
+
+    private static NamedPipeServerStream CreatePipe(bool first)
+    {
+        PipeOptions options = PipeOptions.Asynchronous;
+        string[] names = Enum.GetNames(typeof(PipeOptions));
+        if (first && names.Contains("FirstPipeInstance"))
+            options |= (PipeOptions)Enum.Parse(typeof(PipeOptions), "FirstPipeInstance");
+
+        int instances = 254;
+        Type aclFactory = Type.GetType("System.IO.Pipes.NamedPipeServerStreamAcl, System.IO.Pipes.AccessControl", false);
+        if (aclFactory != null)
+        {
+            MethodInfo method = aclFactory.GetMethods(BindingFlags.Public | BindingFlags.Static)
+                .Where(m => m.Name == "Create")
+                .FirstOrDefault(m => {
+                    ParameterInfo[] p = m.GetParameters();
+                    return p.Length >= 8 && p[0].ParameterType == typeof(string) && p[7].ParameterType == typeof(PipeSecurity);
+                });
+            if (method != null)
+            {
+                ParameterInfo[] parameters = method.GetParameters();
+                object[] args = new object[parameters.Length];
+                args[0] = PipeName;
+                args[1] = PipeDirection.InOut;
+                args[2] = instances;
+                args[3] = PipeTransmissionMode.Byte;
+                args[4] = options;
+                args[5] = 65536;
+                args[6] = 65536;
+                args[7] = Security;
+                for (int i = 8; i < args.Length; i++)
+                    args[i] = parameters[i].DefaultValue;
+                return (NamedPipeServerStream)method.Invoke(null, args);
+            }
+        }
+
+        ConstructorInfo constructor = typeof(NamedPipeServerStream).GetConstructor(new Type[] {
+            typeof(string), typeof(PipeDirection), typeof(int), typeof(PipeTransmissionMode),
+            typeof(PipeOptions), typeof(int), typeof(int), typeof(PipeSecurity)
+        });
+        if (constructor == null)
+            throw new PlatformNotSupportedException("this PowerShell runtime has no ACL-capable named pipe constructor");
+        return (NamedPipeServerStream)constructor.Invoke(new object[] {
+            PipeName, PipeDirection.InOut, instances, PipeTransmissionMode.Byte,
+            options, 65536, 65536, Security
+        });
+    }
+
+    private static bool IsLocalClient(NamedPipeServerStream pipe)
+    {
+        StringBuilder clientName = new StringBuilder(256);
+        uint bufferLengthBytes = (uint)(clientName.Capacity * 2);
+        if (!GetNamedPipeClientComputerName(pipe.SafePipeHandle, clientName, bufferLengthBytes))
+        {
+            // ERROR_PIPE_LOCAL (229), not ERROR_PIPE_NOT_CONNECTED (233),
+            // means the client connected through the local NPFS path.
+            int error = Marshal.GetLastWin32Error();
+            if (error == 229) return true;
+            throw new InvalidOperationException("could not verify the named-pipe client computer (Win32 error " + error + ")");
+        }
+        // A successful lookup identifies a remote SMB client.
+        Emit("REJECT\t" + B64("remote named-pipe client computer " + clientName));
+        return false;
+    }
+
+    private static void Relay(int id, NamedPipeServerStream pipe)
+    {
+        try
+        {
+            byte[] buffer = new byte[32768];
+            while (!Stopping && pipe.IsConnected)
+            {
+                int count = pipe.Read(buffer, 0, buffer.Length);
+                if (count <= 0) break;
+                string data = Convert.ToBase64String(buffer, 0, count);
+                Emit("DATA\t" + id + "\t" + data);
+            }
+        }
+        catch (ObjectDisposedException) { }
+        catch (IOException) { }
+        finally
+        {
+            NamedPipeServerStream ignored;
+            Connections.TryRemove(id, out ignored);
+            try { pipe.Dispose(); } catch { }
+            Emit("CLOSE\t" + id);
+        }
+    }
+
+    private static void AcceptLoop(NamedPipeServerStream first)
+    {
+        NamedPipeServerStream listener = first;
+        try
+        {
+            AcceptStarted.Wait();
+            while (!Stopping)
+            {
+                listener.WaitForConnection();
+                if (!IsLocalClient(listener))
+                {
+                    listener.Dispose();
+                    listener = CreatePipe(false);
+                    VerifySecurity(listener);
+                    continue;
+                }
+
+                NamedPipeServerStream connected = listener;
+                listener = CreatePipe(false);
+                VerifySecurity(listener);
+                int id = Interlocked.Increment(ref NextConnectionId);
+                Connections[id] = connected;
+                Emit("OPEN\t" + id);
+                Task.Run(() => Relay(id, connected));
+            }
+        }
+        catch (ObjectDisposedException error)
+        {
+            if (!Stopping)
+            {
+                EmitFatal(error);
+                Stopping = true;
+                foreach (NamedPipeServerStream pipe in Connections.Values)
+                    try { pipe.Dispose(); } catch { }
+                try { listener.Dispose(); } catch { }
+                Environment.ExitCode = 1;
+            }
+        }
+        catch (Exception error)
+        {
+            EmitFatal(error);
+            Stopping = true;
+            foreach (NamedPipeServerStream pipe in Connections.Values)
+                try { pipe.Dispose(); } catch { }
+            try { listener.Dispose(); } catch { }
+            Environment.ExitCode = 1;
+        }
+    }
+
+    private static void ReadControl()
+    {
+        string line;
+        while (!Stopping && (line = Console.In.ReadLine()) != null)
+        {
+            string[] fields = line.Split('\t');
+            if (fields[0] == "START")
+            {
+                AcceptStarted.Set();
+                continue;
+            }
+            if (fields.Length < 2) continue;
+            int id;
+            if (!Int32.TryParse(fields[1], out id)) continue;
+            NamedPipeServerStream pipe;
+            if (!Connections.TryGetValue(id, out pipe)) continue;
+            try
+            {
+                if (fields[0] == "WRITE" && fields.Length == 3)
+                {
+                    byte[] bytes = Convert.FromBase64String(fields[2]);
+                    pipe.Write(bytes, 0, bytes.Length);
+                    pipe.Flush();
+                }
+                else if (fields[0] == "CLOSE")
+                {
+                    pipe.Dispose();
+                }
+            }
+            catch (ObjectDisposedException) { }
+            catch (IOException) { }
+        }
+        Stopping = true;
+        foreach (NamedPipeServerStream pipe in Connections.Values)
+            try { pipe.Dispose(); } catch { }
+    }
+
+    public static void Run(string pipeName)
+    {
+        PipeName = pipeName;
+        UserSid = WindowsIdentity.GetCurrent().User;
+        if (UserSid == null) throw new InvalidOperationException("current Windows user SID is unavailable");
+        Security = BuildSecurity(UserSid);
+        NamedPipeServerStream first = CreatePipe(true);
+        VerifySecurity(first);
+        string sddl = first.GetAccessControl().GetSecurityDescriptorSddlForm(AccessControlSections.Access);
+        Emit("READY\t" + UserSid.Value + "\t" + B64(sddl));
+        Task accept = Task.Run(() => AcceptLoop(first));
+        ReadControl();
+        Stopping = true;
+        try { first.Dispose(); } catch { }
+        try { accept.Wait(1000); } catch { }
+    }
+}
+'@
+
+try {
+  Add-Type -TypeDefinition $source -ErrorAction Stop
+  [HqdWindowsPipeHost]::Run($env:HQD_PIPE_NAME)
+} catch {
+  [Console]::Error.WriteLine($_.Exception.GetBaseException().Message)
+  exit 1
+}

package/dist/commands/billing-sponsor.js

@@ -27,7 +27,9 @@
  * a feature that simply is not turned on.
  */
 import chalk from "chalk";
+import { diagnosticsEnabled } from "../lib/diagnostics.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { isCompanySelectionError } from "../utils/company-selection-error.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 /** The request kind this command files. Matches hq-pro's contract. */
 export const PLAN_RESOURCE = "plan";
@@ -45,6 +47,20 @@ export const HELD_FOR_CARD_SENTENCE = "Your company said yes and is adding a car
 class SponsorError extends Error {
     expected = true;
 }
+function isExpectedCompanyResolveFailure(error) {
+    if (isCompanySelectionError(error))
+        return true;
+    return (typeof error === "object" &&
+        error !== null &&
+        "expected" in error &&
+        error.expected === true);
+}
+function noteSponsorCompanyUnresolved(error) {
+    if (isExpectedCompanyResolveFailure(error) || !diagnosticsEnabled())
+        return;
+    const errorName = error instanceof Error ? error.name : "Error";
+    console.error(`billing-sponsor company resolve failed errorName=${errorName}`);
+}
 function fail(err) {
     console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
     process.exit(1);
@@ -185,7 +201,10 @@ export function registerBillingSponsorCommands(billing) {
             // this feature is for often belongs to no company at all, and they
             // still need to be told what to do next.
             const named = opts.company ?? billing.opts().company;
-            const companyUid = await getCompanyUid(token, named).catch(() => null);
+            const companyUid = await getCompanyUid(token, named).catch((error) => {
+                noteSponsorCompanyUnresolved(error);
+                return null;
+            });
             // The admin queue is the richer view. A non-admin is refused it, so we
             // fall back to the member SELF-READ — a different route with a
             // different answer: hq-pro returns ONE status for that person and that

package/dist/commands/core-derive-trigger-facts-native.d.ts

@@ -15,6 +15,8 @@ export type DeriveTriggerRunResult = {
     stdout: Buffer;
     stderr: Buffer;
 };
+export declare function resolveWindowsFilesystemPath(candidate: string, cwd: string, resolveRealpath?: (value: string) => string, isDirectory?: (value: string) => boolean): string | undefined;
+export declare function commandOnPath(command: string, env: Record<string, string | undefined>, platform?: NodeJS.Platform): boolean;
 /** Run the native handler contract, retaining exact bytes for differential tests. */
 export declare function runDeriveTriggerFacts(options: DeriveTriggerRunOptions): DeriveTriggerRunResult;
 export declare function runDeriveTriggerFactsFast(argv: readonly string[], stdin: string, cwd: string, hqRoot: string | undefined): number;

package/dist/commands/core-derive-trigger-facts-native.js

@@ -4,7 +4,6 @@ import * as path from "node:path";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { isByteOrientedLocale } from "../lib/core-utils/byte-oriented-locale.js";
 export const DERIVE_TRIGGER_FACTS_ASSET = "core/scripts/derive-trigger-facts.sh";
-const TEXT_FACT_AWK = "core/scripts/lib/trigger-fact-text.awk";
 const TRANSCRIPT_TAIL_MAX_BYTES = 1_048_576;
 function effectiveEnvironment(options) {
     return {
@@ -62,13 +61,51 @@ function globSegmentMatches(pattern, value) {
         return false;
     }
 }
+export function resolveWindowsFilesystemPath(candidate, cwd, resolveRealpath = (value) => fs.realpathSync.native(value), isDirectory = (value) => fs.statSync(value).isDirectory()) {
+    const value = candidate || ".";
+    // Node's win32 path helpers collapse `link/..` lexically before the OS can
+    // follow `link`. Bash walks the path component by component, so resolve a
+    // symlink before applying each parent component while keeping the emitted
+    // glob word untouched.
+    // Git Bash exposes mounted Windows drives as /c/... while Node's win32
+    // path parser treats that spelling as a path rooted at the current drive.
+    // Convert only the drive-mount prefix before probing the filesystem.
+    const windowsValue = value.replace(/^\/([A-Za-z])(?:\/|$)/, (_match, drive) => `${drive.toUpperCase()}:\\`);
+    const absolute = path.win32.isAbsolute(windowsValue);
+    const parsed = path.win32.parse(absolute ? windowsValue : cwd);
+    let current = absolute ? parsed.root : cwd;
+    const rest = absolute ? windowsValue.slice(parsed.root.length) : windowsValue;
+    for (const segment of rest.split(/[\\/]+/)) {
+        if (!segment || segment === ".")
+            continue;
+        if (segment === "..") {
+            try {
+                current = resolveRealpath(current);
+                if (!isDirectory(current))
+                    return undefined;
+            }
+            catch {
+                return undefined;
+            }
+            current = path.win32.dirname(current);
+        }
+        else {
+            current = path.win32.join(current, segment);
+        }
+    }
+    return current;
+}
 function filesystemPath(candidate, cwd) {
     const value = candidate || ".";
-    return path.isAbsolute(value) ? value : `${cwd}${path.sep}${value}`;
+    if (process.platform !== "win32") {
+        return path.isAbsolute(value) ? value : `${cwd}${path.sep}${value}`;
+    }
+    return resolveWindowsFilesystemPath(value, cwd);
 }
 function isDirectoryPath(candidate, cwd) {
     try {
-        return fs.statSync(filesystemPath(candidate, cwd)).isDirectory();
+        const resolved = filesystemPath(candidate, cwd);
+        return resolved !== undefined && fs.statSync(resolved).isDirectory();
     }
     catch {
         return false;
@@ -76,7 +113,10 @@ function isDirectoryPath(candidate, cwd) {
 }
 function pathEntryExists(candidate, cwd) {
     try {
-        fs.lstatSync(filesystemPath(candidate, cwd));
+        const resolved = filesystemPath(candidate, cwd);
+        if (resolved === undefined)
+            return false;
+        fs.lstatSync(resolved);
         return true;
     }
     catch {
@@ -86,16 +126,17 @@ function pathEntryExists(candidate, cwd) {
 function expandBashGlob(token, cwd) {
     if (!hasGlobPattern(token))
         return [token];
-    const absolute = token.startsWith(path.sep);
-    const trailingSlash = token.endsWith(path.sep);
-    const parts = token.split(path.sep).filter((part, index) => !(absolute && index === 0));
+    // Bash emits slash-separated words even when running under Git Bash on Windows.
+    const absolute = token.startsWith("/");
+    const trailingSlash = token.endsWith("/");
+    const parts = token.split("/").filter((part, index) => !(absolute && index === 0));
     if (trailingSlash)
         parts.pop();
-    let candidates = [absolute ? path.sep : ""];
+    let candidates = [absolute ? "/" : ""];
     let matchedPattern = false;
     for (const [index, part] of parts.entries()) {
         if (!hasGlobPattern(part)) {
-            candidates = candidates.map((parent) => !parent ? part : parent === path.sep ? `${path.sep}${part}` : `${parent}${path.sep}${part}`);
+            candidates = candidates.map((parent) => !parent ? part : parent === "/" ? `/${part}` : `${parent}/${part}`);
             if (matchedPattern) {
                 const needsDirectory = index < parts.length - 1 || trailingSlash;
                 candidates = candidates.filter((candidate) => needsDirectory ? isDirectoryPath(candidate, cwd) : pathEntryExists(candidate, cwd));
@@ -106,6 +147,8 @@ function expandBashGlob(token, cwd) {
         const expanded = [];
         for (const parent of candidates) {
             const directory = filesystemPath(parent || ".", cwd);
+            if (directory === undefined)
+                continue;
             let names;
             try {
                 names = fs.readdirSync(directory).sort();
@@ -118,7 +161,7 @@ function expandBashGlob(token, cwd) {
                     continue;
                 if (!globSegmentMatches(part, name))
                     continue;
-                expanded.push(!parent ? name : parent === path.sep ? `${path.sep}${name}` : `${parent}${path.sep}${name}`);
+                expanded.push(!parent ? name : parent === "/" ? `/${name}` : `${parent}/${name}`);
             }
         }
         if (expanded.length === 0)
@@ -128,7 +171,7 @@ function expandBashGlob(token, cwd) {
     if (trailingSlash) {
         candidates = candidates
             .filter((candidate) => isDirectoryPath(candidate, cwd))
-            .map((candidate) => candidate.endsWith(path.sep) ? candidate : `${candidate}${path.sep}`)
+            .map((candidate) => candidate.endsWith("/") ? candidate : `${candidate}/`)
             .sort();
     }
     return matchedPattern && candidates.length > 0 ? candidates : [token];
@@ -136,16 +179,27 @@ function expandBashGlob(token, cwd) {
 function bashUnquotedWords(facts, cwd) {
     return facts.join(" ").split(/[\t\n ]+/).filter(Boolean).flatMap((word) => expandBashGlob(word, cwd));
 }
-function commandOnPath(command, env) {
+export function commandOnPath(command, env, platform = process.platform) {
     const pathValue = env.PATH ?? "";
+    const extensions = platform === "win32"
+        ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)]
+        : [""];
     for (const directory of pathValue.split(path.delimiter)) {
-        const candidate = path.join(directory || process.cwd(), command);
-        try {
-            fs.accessSync(candidate, fs.constants.X_OK);
-            return true;
-        }
-        catch {
-            // PATH probes intentionally ignore missing and inaccessible entries.
+        for (const extension of extensions) {
+            const candidate = path.join(directory || process.cwd(), `${command}${extension}`);
+            try {
+                if (platform === "win32") {
+                    if (fs.statSync(candidate).isFile())
+                        return true;
+                }
+                else {
+                    fs.accessSync(candidate, fs.constants.X_OK);
+                    return true;
+                }
+            }
+            catch {
+                // PATH probes intentionally ignore missing and inaccessible entries.
+            }
         }
     }
     return false;
@@ -185,10 +239,12 @@ function parsePayload(raw) {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new ShellFallbackRequired("malformed hook JSON");
+        // The shell redirects jq's parse diagnostic and leaves every field empty.
+        return emptyPayload();
     }
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new ShellFallbackRequired("unexpected hook payload shape");
+        // jq's object indexing fails quietly through the same redirected pipeline.
+        return emptyPayload();
     }
     const record = parsed;
     const toolResponse = jqField(record.tool_response);
@@ -207,6 +263,12 @@ function parsePayload(raw) {
     }
     return fields;
 }
+function emptyPayload() {
+    return {
+        tool: "", command: "", runInBackground: "", toolResponse: "", prompt: "",
+        cwd: "", sessionId: "", transcriptPath: "",
+    };
+}
 function matchTextFacts(rawText, env) {
     const text = localeLower(rawText, env);
     const facts = [];
@@ -391,9 +453,8 @@ function computeOutput(options) {
     const withAssistantIntent = args[1] === "--with-assistant-intent";
     if (args.length === 2 && !withAssistantIntent)
         throw new ShellFallbackRequired("unsupported argv");
-    if (!["PreToolUse", "PostToolUse", "UserPromptSubmit", "AssistantIntent"].includes(event)) {
-        throw new ShellFallbackRequired("unsupported event");
-    }
+    // The shell accepts unknown event names and emits the baseline `always`
+    // fact (plus any static session facts); it does not validate the event.
     const paired = withAssistantIntent && (event === "PreToolUse" || event === "UserPromptSubmit");
     const env = effectiveEnvironment(options);
     const jqAvailable = options.jqAvailable ?? commandOnPath("jq", env);
@@ -465,6 +526,7 @@ function shellFallback(options) {
         args: [...options.argv],
         cwd: options.hqRoot,
         hqRoot: options.hqRoot,
+        msysScriptPath: true,
         stdin: options.stdin,
         captureOutput: true,
         env,
@@ -487,12 +549,17 @@ function missingSupportLibrary(hqRoot) {
         ],
     ];
     for (const [relativePath, message] of required) {
+        let descriptor;
         try {
-            fs.accessSync(path.join(hqRoot, relativePath), fs.constants.R_OK);
+            descriptor = fs.openSync(path.join(hqRoot, relativePath), "r");
         }
         catch {
             return message;
         }
+        finally {
+            if (descriptor !== undefined)
+                fs.closeSync(descriptor);
+        }
     }
     return undefined;
 }

package/dist/commands/core-migrate-policy-triggers-native.d.ts

@@ -12,6 +12,7 @@ export type MigratePolicyDependencies = {
         error?: Error;
     };
 };
+export declare function executableInPath(name: string, env: NodeJS.ProcessEnv, fileSystem: typeof fs, platform?: NodeJS.Platform): boolean;
 export declare function runMigratePolicyTriggers(args: readonly string[], deps: MigratePolicyDependencies): {
     code: number;
     stdout: string;

package/dist/commands/core-migrate-policy-triggers-native.js

@@ -57,16 +57,24 @@ function isDirectory(fileSystem, value) {
         return false;
     }
 }
-function executableInPath(name, env, fileSystem) {
+export function executableInPath(name, env, fileSystem, platform = process.platform) {
+    const extensions = platform === "win32"
+        // spawnSync("flock", ...) without shell support can launch native images,
+        // but not batch files. Treating .cmd/.bat as available skips the fallback
+        // lock while the later spawn fails on Windows.
+        ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((extension) => /^\.(?:COM|EXE)$/i.test(extension))
+        : [""];
     for (const directory of (env.PATH ?? "").split(path.delimiter)) {
         if (!directory)
             continue;
-        try {
-            const stat = fileSystem.statSync(path.join(directory, name));
-            if (stat.isFile() && (stat.mode & 0o111) !== 0)
-                return true;
+        for (const extension of extensions) {
+            try {
+                const stat = fileSystem.statSync(path.join(directory, `${name}${extension}`));
+                if (stat.isFile() && (platform === "win32" || (stat.mode & 0o111) !== 0))
+                    return true;
+            }
+            catch { /* continue through PATH */ }
         }
-        catch { /* continue through PATH */ }
     }
     return false;
 }
@@ -79,7 +87,9 @@ function runNonblockingFlock(lockFd, cwd, pathValue) {
 }
 function frontmatterValue(content, key) {
     let depth = 0;
-    for (const line of content.split("\n")) {
+    for (const rawLine of content.split("\n")) {
+        // Git for Windows' awk reads CRLF as a line ending; POSIX awk keeps the CR.
+        const line = process.platform === "win32" ? rawLine.replace(/\r$/, "") : rawLine;
         if (line === "---") {
             depth += 1;
             continue;
@@ -154,10 +164,11 @@ function deriveWhen(trigger, rawTags, enforcementRaw) {
 function writeAtomic(fileSystem, target, bytes) {
     const temporary = path.join(path.dirname(target), `.migrate-policy-triggers.${process.pid}.${Math.random().toString(16).slice(2)}`);
     // The shell writes through mktemp, whose private mode survives the rename on both platforms.
-    const mode = 0o600;
+    const mode = process.platform === "win32" ? undefined : 0o600;
     try {
-        fileSystem.writeFileSync(temporary, bytes, { encoding: "utf8", mode, flag: "wx" });
-        fileSystem.chmodSync(temporary, mode);
+        fileSystem.writeFileSync(temporary, bytes, { encoding: "utf8", ...(mode === undefined ? {} : { mode }), flag: "wx" });
+        if (mode !== undefined)
+            fileSystem.chmodSync(temporary, mode);
         fileSystem.renameSync(temporary, target);
         return true;
     }
@@ -447,7 +458,7 @@ export function runMigratePolicyTriggers(args, deps) {
                     continue;
                 }
                 const anchor = original.split("\n").some((line) => line.startsWith("trigger:")) ? /^trigger:/ : /^id:/;
-                const lines = original.split("\n");
+                const lines = original.split("\n").map((line) => process.platform === "win32" ? line.replace(/\r$/, "") : line);
                 let inserted = false;
                 const rewritten = lines.flatMap((line) => {
                     if (!inserted && anchor.test(line)) {
@@ -471,7 +482,10 @@ export function runMigratePolicyTriggers(args, deps) {
         if (!dryRun && stateReady && !errorCode) {
             const stampTmp = path.join(path.dirname(stamp), `.last-success.${process.pid}.${Math.random().toString(16).slice(2)}`);
             try {
-                fileSystem.writeFileSync(stampTmp, `${nowSeconds()}\n`, { mode: 0o600, flag: "wx" });
+                fileSystem.writeFileSync(stampTmp, `${nowSeconds()}\n`, {
+                    ...(process.platform === "win32" ? {} : { mode: 0o600 }),
+                    flag: "wx",
+                });
                 fileSystem.renameSync(stampTmp, stamp);
             }
             catch {