@popovych.co/witness 0.14.5 → 0.14.6

package/dist/calibrate.js

@@ -9,9 +9,10 @@ import { loadConfig } from './config.js';
 import { changedFiles, diffBase, evidenceForDiff } from './evidence.js';
 import { readDoc, splitDoc, writeDoc } from './fm.js';
 import { git, stateCommit } from './gitio.js';
-import { ok, refuse, v } from './refusal.js';
+import { ok, refuse, renderRefusal, v } from './refusal.js';
 import { PROMPT_NAMES, invokeReviewer, parseVerdictText, resolvePrompt } from './reviewer.js';
 import { findById, loadCanon } from './scan.js';
+import { resolveSpawn } from './spawn.js';
 import { anchorMenu, parseVerdict, verdictViolations } from './verdict.js';
 import { createWorktree } from './worktree.js';
 export function calibrationDir() {
@@ -478,11 +479,20 @@ export async function runPlanSeed(ctx, harness, model, seed, extras) {
 // a pure-pi user, the residual the routing decision exists to kill.
 export async function defaultAgent(ctx, harness, worktree, prompt) {
     const { cmd, args, env } = harness.worker.spawn(prompt);
-    spawnSync(cmd, args, {
+    // Row 164. The prompt rides argv, and the implement seed's is a whole SKILL.md: on
+    // Windows no `.cmd` shim can receive its line breaks. Say so — a worker that never
+    // started otherwise reads, one step later, as an agent that made no diff.
+    const run = resolveSpawn(cmd, args, { ...ctx.env, ...env, WITNESS_BIN: `node ${join(dirname(fileURLToPath(import.meta.url)), 'bin.js')}` });
+    if (!run.ok) {
+        renderRefusal(run.violations).forEach((l) => ctx.err(l));
+        return;
+    }
+    spawnSync(run.value.file, run.value.args, {
         cwd: worktree,
-        env: { ...ctx.env, ...env, WITNESS_BIN: `node ${join(dirname(fileURLToPath(import.meta.url)), 'bin.js')}` },
+        env: run.value.env,
         timeout: 900_000,
         stdio: 'ignore',
+        windowsVerbatimArguments: run.value.windowsVerbatimArguments,
     });
 }
 export async function runImplementSeed(ctx, harness, seed, agent) {

package/dist/drive.js

@@ -6,6 +6,7 @@ import { EXIT, main } from './cli.js';
 import { resolveJudge } from './harness.js';
 import { renderRefusal } from './refusal.js';
 import { loadCanon } from './scan.js';
+import { resolveSpawn } from './spawn.js';
 import { computeNext, flowAction, resolveFlow } from './verbs/next.js';
 // A conversation is a stage whose product IS the exchange with a human: brainstorm has no
 // artifact to author headlessly, and design authoring/showing needs eyes on a rendered
@@ -69,7 +70,7 @@ const EXIT_GRACE_MS = 2_000;
 // This CLI, for the child. A spawned session shells out to `witness` through
 // ${WITNESS_BIN:-npx …} in every stage skill, and an unset value means the child resolves
 // the PUBLISHED version while its parent runs an unpublished one — which the state floor
-// then refuses (cli-behind-state). calibrate.ts:517 sets it for its worker for exactly
+// then refuses (cli-behind-state). calibrate.ts:520 sets it for its worker for exactly
 // this reason. An explicitly set value wins: a session that already knows its bin is
 // stating a fact drive has no better answer for.
 function localBin(ctx) {
@@ -115,14 +116,21 @@ export async function spawnSession(step, cfg, ctx, spawnN) {
     // a scripted fake that performs real CLI acts. Never documented for users — a spawn
     // binary chosen by ambient env is exactly the identity confusion row 90 removed.
     const bin = ctx.env.WITNESS_DRIVE_AGENT_BIN ?? cmd;
+    // Row 164: on Windows the agent CLI may be a `.cmd` shim, which only cmd.exe can start.
+    const run = resolveSpawn(bin, args, { ...ctx.env, ...env, WITNESS_BIN: localBin(ctx) });
+    if (!run.ok) {
+        renderRefusal(run.violations).forEach((l) => ctx.err(l));
+        return 'spawn-failed';
+    }
     const prefix = `[${spawnN} ${step.stage ?? 'drive'}/${step.target ?? step.home.split('/').pop() ?? '-'}] `;
     const out = lineSink(prefix, (l) => ctx.out(l));
     const err = lineSink(prefix, (l) => ctx.out(l));
     return await new Promise((resolve) => {
-        const child = spawn(bin, args, {
+        const child = spawn(run.value.file, run.value.args, {
             cwd: step.home,
-            env: { ...ctx.env, ...env, WITNESS_BIN: localBin(ctx) },
+            env: run.value.env,
             stdio: ['ignore', 'pipe', 'pipe'],
+            windowsVerbatimArguments: run.value.windowsVerbatimArguments,
         });
         let outcome = 'exited';
         let settled = false;

package/dist/probe.js

@@ -1,14 +1,20 @@
-import { execFileSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
+import { resolveSpawn } from './spawn.js';
 // Revision 3. The old form passed no `env`, so it silently answered about process.env
-// while reviewer.ts:113 spawns `claude` with `env: ctx.env` — two different questions,
+// while reviewer.ts:133 spawns `claude` with `env: ctx.env` — two different questions,
 // one answer. It also made the finding untestable: helpers.ts runs main() in-process,
 // so a test can control ctx.env and nothing else.
+//
+// Row 164, the same argument one level down: the probe starts the binary through
+// resolveSpawn, exactly as a gate will — a probe that resolved differently would call a
+// `.cmd` shim missing while the gate ran it. spawnSync, not execFileSync, whose typings
+// omit windowsVerbatimArguments; the question is unchanged: did it start and exit 0.
 export function probe(cmd, args, env) {
-    try {
-        execFileSync(cmd, args, { stdio: 'ignore', env: env });
-        return true;
-    }
-    catch {
+    const run = resolveSpawn(cmd, args, env);
+    if (!run.ok)
         return false;
-    }
+    const r = spawnSync(run.value.file, run.value.args, {
+        stdio: 'ignore', env: run.value.env, windowsVerbatimArguments: run.value.windowsVerbatimArguments,
+    });
+    return r.error === undefined && r.status === 0;
 }

package/dist/reviewer.js

@@ -5,6 +5,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { validatePin } from './harness.js';
 import { ok, refuse, v } from './refusal.js';
+import { resolveSpawn } from './spawn.js';
 export const PROMPT_NAMES = [
     'slicing-critic', 'plan-critic', 'code-reviewer', 'silent-failure-hunter',
     'type-design', 'pr-test', 'drift-reviewer', 'design-critic', 'design-reviewer',
@@ -95,15 +96,23 @@ export function invokeReviewer(ctx, harness, opts) {
         pin = pinR.value;
     }
     const { cmd, args, env } = harness.reviewer.spawn(pin, opts.extensions);
+    // Row 164: on Windows the CLI may be a `.cmd` shim, which only cmd.exe can start. The
+    // prompt rides stdin, so the shim's second parse of the command line never sees it. A
+    // reviewer that cannot be started is an invocation failure on every platform: the
+    // resolution's own got/want, under the rule a missing binary has always reported.
+    const run = resolveSpawn(cmd, args, { ...ctx.env, ...env });
+    if (!run.ok)
+        return refuse(run.violations.map((x) => ({ ...x, rule: 'reviewer-invocation' })));
     const timeout = opts.timeoutMs ?? REVIEWER_TIMEOUT_MS;
     for (let attempt = 0;; attempt += 1) {
-        const r = spawnSync(cmd, args, {
+        const r = spawnSync(run.value.file, run.value.args, {
             cwd: opts.cwd,
-            env: { ...ctx.env, ...env },
+            env: run.value.env,
             input: opts.prompt,
             encoding: 'utf8',
             timeout,
             maxBuffer: 64 * 1024 * 1024,
+            windowsVerbatimArguments: run.value.windowsVerbatimArguments,
         });
         if (r.error) {
             // A stall is NOT the missing-binary case. Reporting it as one sent the last

package/dist/spawn.js

@@ -0,0 +1,107 @@
+import { statSync } from 'node:fs';
+import { extname, join, win32 } from 'node:path';
+import { ok, refuse, v } from './refusal.js';
+// The two ways Windows starts a program: an image CreateProcess runs itself, or a batch
+// file only cmd.exe can run. PATHEXT also lists script-host types (.js, .vbs, .wsf) that
+// cmd.exe would open with Windows Script Host — never what a CLI's `.js` means — so
+// those are not candidates at all.
+const IMAGES = ['.com', '.exe'];
+const BATCH = ['.bat', '.cmd'];
+// Every cmd.exe metacharacter, `"` included, and whatever follows a `%`. Escaped, a quote
+// never opens cmd's quote mode, and no `%NAME%` or `%NAME:a=b%` names a variable: cmd.exe
+// expands those before it reads a single caret, so the name itself must start with one.
+// Nothing in an argument is then special to cmd.exe, and each caret is one escape.
+const CMD_META = /[()[\]%!^"`<>&|;, *?]|(?<=%)[^]/gu;
+// Windows env names are case-insensitive, and a spread process.env carries `Path` beside
+// any `PATH` a caller adds. Node gives the child the key that sorts first, so resolution
+// reads that one — any other answer names a binary the child never sees.
+function envGet(env, name) {
+    const key = Object.keys(env).sort().find((k) => k.toUpperCase() === name);
+    return key === undefined ? undefined : env[key];
+}
+function isFile(p) {
+    try {
+        return statSync(p).isFile();
+    }
+    catch {
+        return false; // absent, or under a PATH entry that is not a directory: no candidate
+    }
+}
+// PATH order, then PATHEXT order inside each directory — cmd.exe's walk minus its first
+// step: the current directory is never searched, and neither is a relative entry (`.`, or
+// the empty one a trailing `;` leaves), so a `pi.cmd` committed to a reviewed repo cannot
+// make itself the judge. A name that carries a path is checked where it points.
+function whichWin32(cmd, env) {
+    const runnable = [...IMAGES, ...BATCH];
+    const listed = (envGet(env, 'PATHEXT') ?? '').split(';').map((e) => e.toLowerCase())
+        .filter((e) => runnable.includes(e));
+    const exts = runnable.includes(extname(cmd).toLowerCase()) ? [''] : listed.length > 0 ? listed : runnable;
+    const bases = /[\\/]/.test(cmd) ? [cmd] : (envGet(env, 'PATH') ?? '').split(';')
+        .map((d) => d.replace(/^"(.*)"$/, '$1')).filter((d) => win32.isAbsolute(d)).map((d) => join(d, cmd));
+    for (const base of bases) {
+        for (const ext of exts)
+            if (isFile(`${base}${ext}`))
+                return `${base}${ext}`;
+    }
+    return undefined;
+}
+// The C runtime's rules (CommandLineToArgvW; node's own argv parser follows them): inside
+// quotes a backslash is literal unless a quote follows it, where the run doubles and the
+// quote takes one more.
+function crtQuote(arg) {
+    let out = '"';
+    let slashes = 0;
+    for (const ch of arg) {
+        if (ch === '\\') {
+            slashes += 1;
+            continue;
+        }
+        out += ch === '"' ? `${'\\'.repeat(slashes * 2 + 1)}"` : `${'\\'.repeat(slashes)}${ch}`;
+        slashes = 0;
+    }
+    return `${out}${'\\'.repeat(slashes * 2)}"`;
+}
+const caret = (s) => s.replace(CMD_META, '^$&');
+// Off win32 this is the identity: the spawn every site made before. On win32 the name
+// is resolved here, not by libuv, which tries only `.com` and `.exe` — and looks in the
+// child's cwd first — while npm installs `pi` and `claude` as `.cmd` shims: a bare-name
+// spawn of either was ENOENT, and the resolved shim will not start without a shell
+// (EINVAL). A name nothing on PATH answers to is refused rather than handed to libuv's
+// cwd search. An image starts directly; a batch file runs as
+// `cmd.exe /d /v:off /s /c ""<file>" <args>"`, built here verbatim:
+//
+// - the file is quoted, not caret-escaped: carets cannot keep a `=` in an install path
+//   from splitting the command (measured);
+// - each argument is CRT-quoted, then caret-escaped TWICE, because a shim forwards `%*`
+//   and cmd.exe parses that line again — escaped once, `" & echo pwned & "` ran `echo`;
+// - /v:off, because the registry can turn delayed expansion on, and then `!VAR!` in an
+//   argument expands; /d skips AutoRun commands;
+// - cmd.exe is System32's, never ComSpec, which may name a shell with other syntax; and
+//   it runs with NoDefaultCurrentDirectoryInExePath, because the shim runs a bare `node`
+//   when no node.exe sits beside it and cmd.exe would look in the cwd first — measured:
+//   a `node.cmd` planted in the reviewed repo answered as the judge. The CLI inherits it.
+//
+// Nothing makes cmd.exe carry a line break: it ends the command at LF, silently dropping
+// every later argument, and deletes CR. Such an argument is refused, never truncated.
+export function resolveSpawn(cmd, args, env, platform = process.platform) {
+    if (platform !== 'win32')
+        return ok({ file: cmd, args: [...args], env, windowsVerbatimArguments: false });
+    const file = whichWin32(cmd, env);
+    if (file === undefined) {
+        return refuse([v(cmd, 'not-on-path', 'no .com, .exe, .bat or .cmd by that name on PATH', `the ${cmd} CLI installed on PATH — witness never looks for it in the current directory, where a repo could plant one`)]);
+    }
+    if (IMAGES.includes(extname(file).toLowerCase()))
+        return ok({ file, args: [...args], env, windowsVerbatimArguments: false });
+    for (const [i, arg] of args.entries()) {
+        if (/[\r\n]/.test(arg)) {
+            return refuse([v(cmd, 'batch-argv-line-break', `argument ${i + 1}: ${JSON.stringify(arg.slice(0, 60))}`, `an argument without CR or LF — ${file} is a batch file, and cmd.exe ends a command at a line feed and deletes carriage returns, so the CLI would run on a truncated command line`)]);
+        }
+    }
+    const line = [`"${file}"`, ...args.map((a) => caret(caret(crtQuote(a))))].join(' ');
+    return ok({
+        file: win32.join(envGet(env, 'SYSTEMROOT') ?? 'C:\\Windows', 'System32', 'cmd.exe'),
+        args: ['/d', '/v:off', '/s', '/c', `"${line}"`],
+        env: { ...env, NoDefaultCurrentDirectoryInExePath: '1' },
+        windowsVerbatimArguments: true,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popovych.co/witness",
-  "version": "0.14.5",
+  "version": "0.14.6",
   "description": "Evidence-gated spec-driven development pipeline for AI coding agents: brainstorm to PR in six stages, where specs are state, plans are motion, and no transition passes without evidence. Drives from Claude Code or Pi.",
   "keywords": [
     "spec-driven-development",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "witness",
   "description": "Spec-driven development with evidence gates: brainstorm → PR through six stages and five gates. Skills author, the pinned witness CLI writes state and witnesses evidence; gates stop where judgment is owed.",
-  "version": "0.14.5",
+  "version": "0.14.6",
   "author": {
     "name": "Kostiantyn Popovych"
   },

package/plugin/commands/witness.md

@@ -10,7 +10,7 @@ The CLI decides, you act. If `$ARGUMENTS` contains `--manual`, append `--manual`
 Resolve the CLI once:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6}"
 ```
 
 If the repo has no `witness.config.yaml`, run `$WITNESS init` first (one bootstrap commit), then proceed. If init or any verb refuses on a dirty tree, the human commits or cleans it — **never `git commit` yourself, anywhere, at any stage**: the CLI makes its own state commits, and the ship phase makes the sole code commit.

package/plugin/hooks/session-dashboard.sh

@@ -3,4 +3,4 @@
 # context). Silent everywhere that isn't a witness repo; failures swallowed:
 # session start must never hang or die on this.
 [ -f witness.config.yaml ] || exit 0
-${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5} 2>/dev/null || true
+${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6} 2>/dev/null || true

package/plugin/skills/witness-brainstorm/SKILL.md

@@ -15,7 +15,7 @@ witness: ends in a confirmed scope recap, writes no document. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-decompose/SKILL.md

@@ -10,7 +10,7 @@ description: Slice a witness effort's confirmed recap into vertical spec slices,
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-design/SKILL.md

@@ -16,7 +16,7 @@ No text copied verbatim; the design-critic lens is new material. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-implement/SKILL.md

@@ -15,7 +15,7 @@ tests carry the parent spec's tag in their NAME. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-plan/SKILL.md

@@ -15,7 +15,7 @@ parent's criteria. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-ship/SKILL.md

@@ -15,7 +15,7 @@ model can. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.5}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.6}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.