@pieai/pro-gov 0.9.1 → 0.9.3

package/assets/public-agent-assets/registry.json

@@ -25,11 +25,11 @@
       "notes": "Public rule for choosing evidence lanes and requiring fresh verification before completion.",
       "promotion": {
         "privateSourcePath": "rules/pie-rules/ai-in-the-loop.md",
-        "privateSourceHash": "sha256:71f487152123491a2c110ad839a90780b08e04ae3a133d59bbe977bf8b2f64e4",
+        "privateSourceHash": "sha256:344eba8c3b1f3130ed33e4b6a4511a332e2ca477e6a40ad7d4c73006197f5445",
         "publicHash": "sha256:911702baf6ea1d724e41ea1876d23d80f4de8dfaaadbf1399a40c982c810224c",
         "sanitized": true,
-        "lastReviewed": "2026-08-17",
-        "reviewNotes": "Reviewed after the private source gained governed front matter and normalized formatting. The public copy intentionally keeps the portable evidence-loop method without the private Grok compatibility lane or project governance metadata."
+        "lastReviewed": "2026-08-20",
+        "reviewNotes": "Reviewed after the private source gained governed front matter and normalized formatting. The public copy intentionally keeps the portable evidence-loop method without the private Grok compatibility lane or project governance metadata. Re-reviewed 2026-08-20: the private source moved by Markdown table padding only, with no wording change, so the sanitized public copy is unaffected and only the private hash is re-pinned."
       }
     },
     {

package/assets/starter/.github/workflows/docs-check.yml

@@ -43,7 +43,7 @@ jobs:
 
       - uses: pnpm/action-setup@v6
         with:
-          version: 11.9.0
+          version: 11.22.0
 
       - uses: actions/setup-node@v6
         with:

package/assets/starter/.oxfmtignore

@@ -0,0 +1,27 @@
+# Seeded by `pro-gov init`. This file is project-local after seeding — add
+# your own build outputs and generated paths freely.
+
+# Dependencies and build output
+node_modules
+dist
+build
+coverage
+out
+.next
+.turbo
+.tmp
+
+# ─────────────────────────────────────────────────────────────────────────
+# PGS-managed content — DO NOT REFORMAT. Keep these entries.
+#
+# `pro-gov sync --check` byte-compares docs/governance against the packaged
+# starter, and `pro-gov portfolio assets-check` byte-compares the shared-rule
+# snapshots. A formatter that only pads Markdown table cells is enough to fail
+# both, and the guardrails cannot tell cosmetic padding from a real local edit
+# — re-applying the asset then refuses with asset-lock-drift.
+#
+# If you need one of these files changed, change it upstream in Project
+# Governance System and re-sync; do not restyle it here.
+# ─────────────────────────────────────────────────────────────────────────
+docs/governance
+docs/policy/shared-rules

package/dist/cli.js

@@ -60,7 +60,6 @@ function loadAgentAssetBundles(agentAssetsDir) {
 
 // src/asset-npx/maintenance.ts
 import { createHash } from "node:crypto";
-import { spawnSync } from "node:child_process";
 import {
   cpSync,
   existsSync as existsSync3,
@@ -72,6 +71,29 @@ import {
 } from "node:fs";
 import { join as join3, relative as relative2 } from "node:path";
 import { tmpdir } from "node:os";
+
+// src/command-runner.ts
+import {
+  spawnSync
+} from "node:child_process";
+function spawnPlatformSync(command2, args, options) {
+  if (process.platform !== "win32") return spawnSync(command2, args, options);
+  const commandLine = [command2, ...args].map(quoteWindowsArgument).join(" ");
+  return spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", `"${commandLine}"`], {
+    ...options,
+    // The command line above is intentionally assembled for cmd.exe. Without
+    // this flag Node escapes its quotes before cmd.exe can parse them.
+    windowsVerbatimArguments: true
+  });
+}
+function quoteWindowsArgument(value) {
+  if (value.length === 0 || /[\s"&|<>^]/.test(value)) {
+    return `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1")}"`;
+  }
+  return value;
+}
+
+// src/asset-npx/maintenance.ts
 function createNpxSkillsMaintenancePlan(options) {
   assertNativeNpxRoot(options.npxRoot);
   if (options.operation === "add" && !options.source) {
@@ -140,7 +162,8 @@ function buildNpxCommand(options) {
   return command2;
 }
 function defaultRunner({ command: command2, cwd, timeoutMs }) {
-  const result = spawnSync(command2[0] ?? "npx", command2.slice(1), {
+  const commandName = command2[0] ?? "npx";
+  const result = spawnPlatformSync(commandName, command2.slice(1), {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs
@@ -739,6 +762,13 @@ import { dirname as dirname4, join as join8, relative as relative5, resolve as r
 // src/asset-targets/install-plan.ts
 import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
 import { basename, dirname as dirname3, join as join7, resolve } from "node:path";
+
+// src/symlinks.ts
+function normalizeSymlinkTarget(target) {
+  return target.replaceAll("\\", "/");
+}
+
+// src/asset-targets/install-plan.ts
 function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
   const assetsById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
@@ -1048,7 +1078,7 @@ function createLegacyClaudeAdoptions(options) {
     const targetAbsolutePath = join7(options.targetDir, targetPath);
     const compatibilityRootPath = join7(options.targetDir, ".claude/skills");
     const canonicalRootPath = join7(options.targetDir, ".agents/skills");
-    if (!lstatSync2(canonicalRootPath).isDirectory() || !lstatSync2(compatibilityRootPath).isSymbolicLink() || readlinkSync(compatibilityRootPath) !== "../.agents/skills" || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
+    if (!lstatSync2(canonicalRootPath).isDirectory() || !lstatSync2(compatibilityRootPath).isSymbolicLink() || normalizeSymlinkTarget(readlinkSync(compatibilityRootPath)) !== "../.agents/skills" || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
       throw new Error(
         `Legacy Claude compatibility root is not the exact canonical alias for ${entry.id}.`
       );
@@ -1289,7 +1319,7 @@ function validateAdoptedSymlink(targetDir, action) {
   const compatibilityRootPath = join8(targetDir, action.compatibilityRootPath);
   const targetAbsolutePath = join8(targetDir, action.targetPath);
   const legacyAbsolutePath = join8(targetDir, action.legacyTargetPath);
-  if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || readlinkSync2(compatibilityRootPath) !== action.expectedCompatibilityRawTarget || realpathSync3(compatibilityRootPath) !== realpathSync3(canonicalRootPath)) {
+  if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || normalizeSymlinkTarget(readlinkSync2(compatibilityRootPath)) !== action.expectedCompatibilityRawTarget || realpathSync3(compatibilityRootPath) !== realpathSync3(canonicalRootPath)) {
     throw new Error(
       `Legacy Claude compatibility alias changed before apply: ${action.compatibilityRootPath}`
     );
@@ -2217,7 +2247,6 @@ function printNpxUsage() {
 }
 
 // src/commands/doctor.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync12 } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname as dirname6, join as join12 } from "node:path";
@@ -2252,10 +2281,12 @@ function runDoctor(args) {
   return runPackageDoctor(args);
 }
 function checkDocGov(options = {}) {
-  const run = options.run ?? ((command2, args) => spawnSync2(command2, args, {
-    encoding: "utf8",
-    stdio: "ignore"
-  }));
+  const run = options.run ?? ((command2, args) => {
+    return spawnPlatformSync(command2, args, {
+      encoding: "utf8",
+      stdio: "ignore"
+    });
+  });
   const dependencyCli = (options.resolveDependencyCli ?? resolveDocGovDependencyCli)();
   if (!dependencyCli) {
     const fromPath = run("doc-gov", ["--help"]);
@@ -2328,7 +2359,10 @@ function classifyOwnership(targetPath) {
   if (targetPath === "lefthook.yml" || targetPath === ".github/workflows/docs-check.yml") {
     return "optional-guardrail";
   }
-  if (targetPath === "AGENTS.md" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
+  if (targetPath === "AGENTS.md" || // Seeded so a new project starts with the managed paths protected from its
+  // formatter, then owned locally — every project adds its own build outputs,
+  // so this must not be byte-compared by `sync --check`.
+  targetPath === ".oxfmtignore" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
     return "project-local-seed";
   }
   return "shared";
@@ -2501,28 +2535,28 @@ var ROOT_DEFINITIONS = [
   {
     id: "pnpm-store",
     label: "pnpm Store",
-    relativePath: "Library/pnpm/store",
+    relativePath: process.platform === "win32" ? "AppData/Local/pnpm/store" : "Library/pnpm/store",
     kind: "package-cache",
     note: "pnpm \u5185\u5BB9\u5BFB\u5740\u4ED3\u5E93\uFF1B\u6E05\u7406\u65F6\u53EA\u5EFA\u8BAE pnpm store prune\u3002"
   },
   {
     id: "playwright",
     label: "Playwright \u6D4F\u89C8\u5668",
-    relativePath: "Library/Caches/ms-playwright",
+    relativePath: process.platform === "win32" ? "AppData/Local/ms-playwright" : "Library/Caches/ms-playwright",
     kind: "browser-cache",
     note: "\u6D4B\u8BD5\u6D4F\u89C8\u5668\u4E8C\u8FDB\u5236\u7F13\u5B58\uFF1B\u7248\u672C\u5806\u79EF\u53EF\u80FD\u9020\u6210\u663E\u8457\u78C1\u76D8\u5360\u7528\u3002"
   },
   {
     id: "claude-desktop",
     label: "Claude Desktop",
-    relativePath: "Library/Application Support/Claude",
+    relativePath: process.platform === "win32" ? "AppData/Roaming/Claude" : "Library/Application Support/Claude",
     kind: "ai-host",
     note: "\u684C\u9762\u5E94\u7528\u8FD0\u884C\u6570\u636E\uFF0C\u9ED8\u8BA4\u53D7\u4FDD\u62A4\u3002"
   },
   {
     id: "cursor-desktop",
     label: "Cursor Desktop",
-    relativePath: "Library/Application Support/Cursor",
+    relativePath: process.platform === "win32" ? "AppData/Roaming/Cursor" : "Library/Application Support/Cursor",
     kind: "ai-host",
     note: "\u684C\u9762\u5E94\u7528\u8FD0\u884C\u6570\u636E\uFF0C\u9ED8\u8BA4\u53D7\u4FDD\u62A4\u3002"
   }
@@ -2590,11 +2624,17 @@ function inspectHost(options = {}) {
 function inspectAgentBrowser(options) {
   const command2 = options.command ?? "agent-browser";
   try {
-    const output = execFileSync(command2, ["--version"], {
+    const result = spawnPlatformSync(command2, ["--version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: 3e3
-    }).trim();
+      // Host scans can run alongside the full portfolio test matrix. Keep the
+      // probe bounded, but leave enough headroom for a busy Node process to
+      // spawn the pinned CLI instead of misclassifying a slow start as an
+      // unparseable version.
+      timeout: 1e4
+    });
+    if (result.error || result.status !== 0) throw result.error ?? new Error("command failed");
+    const output = result.stdout.trim();
     const installedVersion = output.match(/(?:^|\s)(\d+\.\d+\.\d+)(?:\s|$)/)?.[1];
     if (!installedVersion) {
       return {
@@ -2753,7 +2793,12 @@ function inspectFindings(homePath) {
     id: "pnpm-store",
     rootId: "pnpm-store",
     label: "pnpm \u672A\u5F15\u7528\u5305\u5019\u9009",
-    paths: [join14(homePath, "Library/pnpm/store")],
+    paths: [
+      join14(
+        homePath,
+        process.platform === "win32" ? "AppData/Local/pnpm/store" : "Library/pnpm/store"
+      )
+    ],
     category: "cache",
     confidence: "high",
     disposition: "native-tool",
@@ -2765,7 +2810,13 @@ function inspectFindings(homePath) {
     id: "playwright-browsers",
     rootId: "playwright",
     label: "Playwright \u6D4F\u89C8\u5668\u7248\u672C",
-    paths: [join14(homePath, "Library/Caches/ms-playwright"), join14(homePath, ".cache/ms-playwright")],
+    paths: [
+      join14(
+        homePath,
+        process.platform === "win32" ? "AppData/Local/ms-playwright" : "Library/Caches/ms-playwright"
+      ),
+      join14(homePath, ".cache/ms-playwright")
+    ],
     category: "duplicate-runtime",
     confidence: "medium",
     disposition: "native-tool",
@@ -2787,6 +2838,8 @@ function inspectFindings(homePath) {
   });
 }
 function buildProtections(homePath) {
+  const claudeDesktopPath = process.platform === "win32" ? "~/AppData/Roaming/Claude" : "~/Library/Application Support/Claude";
+  const cursorDesktopPath = process.platform === "win32" ? "~/AppData/Roaming/Cursor" : "~/Library/Application Support/Cursor";
   return [
     {
       label: "\u914D\u7F6E\u4E0E\u8EAB\u4EFD\u8FB9\u754C",
@@ -2805,7 +2858,7 @@ function buildProtections(homePath) {
     },
     {
       label: "\u684C\u9762\u5BBF\u4E3B\u8FD0\u884C\u6570\u636E",
-      paths: ["~/Library/Application Support/Claude", "~/Library/Application Support/Cursor"],
+      paths: [claudeDesktopPath, cursorDesktopPath],
       reason: "\u5E94\u7528\u6570\u636E\u5E93\u4E0E\u8FD0\u884C\u72B6\u6001\u6DF7\u5728\u5176\u4E2D\uFF0C\u4E0D\u80FD\u628A\u6574\u4E2A\u76EE\u5F55\u5F53\u7F13\u5B58\u3002"
     }
   ].map((protection) => ({
@@ -2889,7 +2942,7 @@ function displayPath(path, homePath) {
   const absolute = resolve3(path);
   const withinHome = relative6(homePath, absolute);
   if (withinHome === "") return "~";
-  if (!withinHome.startsWith("..")) return `~/${withinHome}`;
+  if (!withinHome.startsWith("..")) return `~/${withinHome.replaceAll("\\", "/")}`;
   return absolute;
 }
 function undisplayPath(path, homePath) {
@@ -4782,7 +4835,7 @@ function formatLink(link) {
 }
 
 // src/lens/scan.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync21, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join22 } from "node:path";
@@ -4858,7 +4911,7 @@ function inspectCompatibilityLink(root, path, expectedRawTarget) {
     if (stat.isDirectory()) return { ...base, status: "directory" };
     return { ...base, status: "other" };
   }
-  const rawTarget = readlinkSync3(absolutePath);
+  const rawTarget = normalizeSymlinkTarget(readlinkSync3(absolutePath));
   const resolvedTarget = resolve6(dirname12(absolutePath), rawTarget);
   const expectedPath = resolve6(dirname12(absolutePath), expectedRawTarget);
   const targetStat = safeLstat2(resolvedTarget);
@@ -5064,7 +5117,7 @@ function readPackageJson(path) {
 }
 
 // src/repository-files.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync20, readdirSync as readdirSync10 } from "node:fs";
 import { isAbsolute as isAbsolute5, join as join21, posix as posix3, relative as relative9 } from "node:path";
 var gitMaxBufferBytes = 64 * 1024 * 1024;
@@ -5147,7 +5200,7 @@ function isSafeRepositoryRelativePath(path) {
   return path !== "" && path !== "." && !isAbsolute5(path) && !/^[a-zA-Z]:\//.test(path) && path !== ".." && !path.startsWith("../");
 }
 function runGit(root, args) {
-  const result = spawnSync3("git", ["-C", root, ...args], {
+  const result = spawnSync2("git", ["-C", root, ...args], {
     encoding: "utf8",
     maxBuffer: gitMaxBufferBytes,
     env: { ...process.env, LANG: "C", LC_ALL: "C" }
@@ -5230,7 +5283,7 @@ function readGitState(targetDir) {
   };
 }
 function runGit2(targetDir, args) {
-  const result = spawnSync4("git", ["-C", targetDir, ...args], {
+  const result = spawnSync3("git", ["-C", targetDir, ...args], {
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
   });
@@ -5408,7 +5461,7 @@ import { existsSync as existsSync33, readFileSync as readFileSync18 } from "node
 import { join as join34 } from "node:path";
 
 // src/portfolio/doctor.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync24, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir4 } from "node:os";
@@ -5416,7 +5469,6 @@ import { dirname as dirname15, join as join25 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/host-tooling/inventory.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
 function inspectHostTooling(requirements, runner = defaultRunner2) {
   const hosts = [];
   const issues = [];
@@ -5490,7 +5542,7 @@ function parseHostPlugins(host, value) {
   });
 }
 function defaultRunner2({ command: command2 }) {
-  const result = spawnSync5(command2[0] ?? "", command2.slice(1), {
+  const result = spawnPlatformSync(command2[0] ?? "", command2.slice(1), {
     encoding: "utf8",
     timeout: 1e4
   });
@@ -5605,7 +5657,7 @@ function pathIsSymlink(path) {
 }
 
 // src/portfolio/version-policy.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { existsSync as existsSync23, lstatSync as lstatSync9, readFileSync as readFileSync15 } from "node:fs";
 import { dirname as dirname14, join as join24 } from "node:path";
 function inspectVersionPolicy(root, policy, projectType) {
@@ -5697,7 +5749,7 @@ function inspectRuntime(expectedName, expectedVersion) {
 function readRuntimeVersion(name) {
   if (name === "node") return process.versions.node;
   if (name !== "deno") return void 0;
-  const result = spawnSync6("deno", ["--version"], { encoding: "utf8" });
+  const result = spawnSync4("deno", ["--version"], { encoding: "utf8" });
   if (result.status !== 0) return void 0;
   return /^deno\s+(\d+\.\d+\.\d+)/m.exec(result.stdout)?.[1];
 }
@@ -5915,7 +5967,7 @@ function runTargetChecks(target) {
   ];
   return commands.map((command2) => {
     if (!existsSync24(command2.cli)) return { name: command2.name, status: null };
-    const result = spawnSync7(process.execPath, [command2.cli, ...command2.args], {
+    const result = spawnSync5(process.execPath, [command2.cli, ...command2.args], {
       cwd: target.path,
       encoding: "utf8",
       timeout: 3e4
@@ -5924,13 +5976,13 @@ function runTargetChecks(target) {
   });
 }
 function inspectGit(path) {
-  const inside = spawnSync7("git", ["rev-parse", "--is-inside-work-tree"], {
+  const inside = spawnSync5("git", ["rev-parse", "--is-inside-work-tree"], {
     cwd: path,
     encoding: "utf8"
   });
   if (inside.status !== 0) return { isRepository: false, dirty: false };
-  const status = spawnSync7("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
-  const branch = spawnSync7("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
+  const status = spawnSync5("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
+  const branch = spawnSync5("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
   return {
     isRepository: true,
     dirty: status.stdout.trim().length > 0,
@@ -5999,12 +6051,13 @@ function safeRealpath(path) {
 }
 function commandVersion(command2) {
   try {
-    const output = execFileSync2(command2, ["version"], {
+    const result = spawnPlatformSync(command2, ["version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 3e3
     });
-    return output.match(/\b\d+\.\d+\.\d+\b/)?.[0];
+    if (result.error || result.status !== 0) return void 0;
+    return result.stdout.match(/\b\d+\.\d+\.\d+\b/)?.[0];
   } catch {
     return void 0;
   }
@@ -6285,12 +6338,10 @@ function inspectGit2(root) {
 }
 
 // src/portfolio/ai-health/hosts.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync28 } from "node:fs";
 import { join as join28, resolve as resolve8, sep as sep3 } from "node:path";
 
 // src/portfolio/ai-health/devspace.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync27, statSync as statSync8 } from "node:fs";
 import { join as join27, relative as relative10, resolve as resolve7, sep as sep2 } from "node:path";
 function inspectDevSpaceHealth(options) {
@@ -6306,9 +6357,9 @@ function inspectDevSpaceHealth(options) {
     5e3
   );
   const latestVersion = latestResult.ok ? latestResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
-  const processResult = run("pgrep", ["-f", "devspace serve"], 3e3);
-  const pid = processResult.ok ? processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
-  const processEnvironment = pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
+  const processResult = process.platform === "win32" ? run("tasklist", ["/FI", "IMAGENAME eq devspace.exe", "/FO", "CSV", "/NH"], 3e3) : run("pgrep", ["-f", "devspace serve"], 3e3);
+  const pid = processResult.ok ? process.platform === "win32" ? processResult.stdout.match(/"devspace\.exe","(\d+)"/i)?.[1] : processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
+  const processEnvironment = process.platform !== "win32" && pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
   const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(
     /(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/
   )?.[1] : void 0;
@@ -6320,9 +6371,9 @@ function inspectDevSpaceHealth(options) {
     (repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))
   ) ? "complete" : "partial";
   const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
-  const directoryMode = existsSync27(configDirectory) ? modeString(statSync8(configDirectory).mode) : void 0;
-  const fileMode = existsSync27(configPath) ? modeString(statSync8(configPath).mode) : void 0;
-  const authMode = existsSync27(authPath) ? modeString(statSync8(authPath).mode) : void 0;
+  const directoryMode = process.platform !== "win32" && existsSync27(configDirectory) ? modeString(statSync8(configDirectory).mode) : void 0;
+  const fileMode = process.platform !== "win32" && existsSync27(configPath) ? modeString(statSync8(configPath).mode) : void 0;
+  const authMode = process.platform !== "win32" && existsSync27(authPath) ? modeString(statSync8(authPath).mode) : void 0;
   const update = installedVersion && latestVersion ? installedVersion === latestVersion ? "current" : "available" : "unknown";
   const recommendations = [];
   let status = "healthy";
@@ -6346,7 +6397,7 @@ function inspectDevSpaceHealth(options) {
   if (doctor === "failed") unhealthy("devspace doctor \u672A\u901A\u8FC7\u3002");
   if (portfolioCoverage === "partial") attention("DevSpace allowedRoots \u6CA1\u6709\u8986\u76D6\u5168\u90E8\u5DF2\u767B\u8BB0\u4ED3\u5E93\u3002");
   if (installedResult.ok && !pid) attention("DevSpace \u5DF2\u5B89\u88C5\u4F46\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u3002");
-  if (options.expectedToolMode && pid && processToolMode !== options.expectedToolMode) {
+  if (options.expectedToolMode && pid && processToolMode !== void 0 && processToolMode !== options.expectedToolMode) {
     attention(
       `\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`
     );
@@ -6381,18 +6432,12 @@ function inspectDevSpaceHealth(options) {
   };
 }
 function runDevSpaceCommand(command2, args, timeout) {
-  try {
-    return {
-      ok: true,
-      stdout: execFileSync4(command2, args, {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout
-      })
-    };
-  } catch {
-    return { ok: false, stdout: "" };
-  }
+  const result = spawnPlatformSync(command2, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout
+  });
+  return result.error || result.status !== 0 ? { ok: false, stdout: "" } : { ok: true, stdout: result.stdout };
 }
 function isLoopbackHost(host) {
   return ["127.0.0.1", "localhost", "::1"].includes(host.trim().toLowerCase());
@@ -6483,16 +6528,16 @@ function inspectGrokProject(root, homeDir, grokVersion) {
   });
   if (!grokVersion) return empty("unavailable");
   try {
-    const value = JSON.parse(
-      execFileSync5("grok", ["inspect", "--json"], {
-        cwd: root,
-        encoding: "utf8",
-        env: { ...process.env, HOME: homeDir, GROK_HOME: join28(homeDir, ".grok") },
-        maxBuffer: 10 * 1024 * 1024,
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 8e3
-      })
-    );
+    const result = spawnPlatformSync("grok", ["inspect", "--json"], {
+      cwd: root,
+      encoding: "utf8",
+      env: { ...process.env, HOME: homeDir, GROK_HOME: join28(homeDir, ".grok") },
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 8e3
+    });
+    if (result.error || result.status !== 0) return empty("failed");
+    const value = JSON.parse(result.stdout);
     if (!isRecord3(value)) return empty("failed");
     const userClaudeNames = new Set(
       jsonObjectKeys(join28(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode), "mcpServers")
@@ -6580,6 +6625,7 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
 // src/portfolio/ai-health/secrets.ts
 import { existsSync as existsSync29, lstatSync as lstatSync12, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
 import { join as join29, relative as relative11, sep as sep4 } from "node:path";
+var supportsPosixModes = process.platform !== "win32";
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
   const centralPath = join29(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
@@ -6601,7 +6647,7 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
   });
   return {
     centralDirectory: existsSync29(centralPath) ? "present" : "absent",
-    centralMode: existsSync29(centralPath) ? modeString(statSync9(centralPath).mode) : void 0,
+    centralMode: supportsPosixModes && existsSync29(centralPath) ? modeString(statSync9(centralPath).mode) : void 0,
     centralFiles: existsSync29(centralPath) ? collectCentralSecretFiles(centralPath) : [],
     repositoryEnvFiles: envFiles
   };
@@ -6630,7 +6676,7 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
         if (!SKIP_ENV_DIRECTORIES.has(entry.name))
           found.push(...collectEnvironmentFiles(root, join29(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
-        found.push(relative11(root, join29(current, entry.name)));
+        found.push(relative11(root, join29(current, entry.name)).replaceAll("\\", "/"));
       }
     }
   } catch {
@@ -6645,7 +6691,11 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
     for (const entry of readdirSync12(current, { withFileTypes: true })) {
       const path = join29(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
-      else found.push({ path: relative11(root, path), mode: modeString(lstatSync12(path).mode) });
+      else
+        found.push({
+          path: relative11(root, path).replaceAll("\\", "/"),
+          mode: supportsPosixModes ? modeString(lstatSync12(path).mode) : "unknown"
+        });
     }
   } catch {
     return found;
@@ -6676,10 +6726,15 @@ function pointsInside(path, expectedRoot) {
   return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep4}`);
 }
 function hasUnsafeCentralSecretPermissions(secrets) {
+  if (!supportsPosixModes) return false;
   return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
 }
 function inspectSecretsRoot(path) {
-  return existsSync29(path) ? { path, exists: true, mode: modeString(statSync9(path).mode) } : { path, exists: false };
+  return existsSync29(path) ? {
+    path,
+    exists: true,
+    ...supportsPosixModes ? { mode: modeString(statSync9(path).mode) } : {}
+  } : { path, exists: false };
 }
 
 // src/portfolio/ai-health/skills.ts
@@ -7918,9 +7973,10 @@ function findPortfolioAgentAssetsDir(manifest) {
 }
 function reportMissingPortfolioRegistry(loaded, json) {
   const expectedPath = loaded.manifest?.executionEngine?.path ? join34(loaded.manifest.executionEngine.path, "agent-assets/registry.json") : "executionEngine.path/agent-assets/registry.json";
+  const displayExpectedPath = expectedPath.replaceAll("\\", "/");
   const issue = {
     type: "missing-control-plane-registry",
-    message: `Portfolio control-plane registry is required at ${expectedPath}; refusing the package fallback registry.`
+    message: `Portfolio control-plane registry is required at ${displayExpectedPath}; refusing the package fallback registry.`
   };
   if (json) {
     console.log(
@@ -8015,7 +8071,7 @@ function runSync(args) {
       continue;
     }
     if (file.kind === "symlink") {
-      if (!stat.isSymbolicLink() || readlinkSync4(targetPath) !== file.linkTarget) {
+      if (!stat.isSymbolicLink() || normalizeSymlinkTarget(readlinkSync4(targetPath)) !== file.linkTarget) {
         console.log(`different: ${file.targetPath}`);
         differences += 1;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pieai/pro-gov",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Project-level distribution kit for Project Governance System.",
   "keywords": [
     "ai-agents",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pieai/doc-gov": "^0.9.1"
+    "@pieai/doc-gov": "^0.9.3"
   },
   "devDependencies": {
     "@pieai/swimmer-ui-kit": "1.3.2",
@@ -53,7 +53,7 @@
   },
   "scripts": {
     "dev": "tsx src/cli.ts",
-    "build": "node scripts/build-dashboard.mjs && node scripts/copy-assets.mjs && esbuild src/cli.ts --bundle --platform=node --format=esm --target=node24 --banner:js=\"#!/usr/bin/env node\" --outfile=dist/cli.js && chmod +x dist/cli.js",
+    "build": "node scripts/build.mjs",
     "pretest": "pnpm --filter @pieai/doc-gov build && pnpm build",
     "test": "tsx --test src/*.test.ts src/**/*.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.dashboard.json --noEmit"