@sberpay-cli/cli-diagnostic 0.4.0-dev.5 → 0.4.0-dev.7

package/dist/npm-entry.mjs

@@ -708,7 +708,7 @@ var require_graceful_fs = __commonJS({
       }
       function ReadStream$open() {
         var that = this;
-        open7(that.path, that.flags, that.mode, function(err, fd) {
+        open8(that.path, that.flags, that.mode, function(err, fd) {
           if (err) {
             if (that.autoClose)
               that.destroy();
@@ -728,7 +728,7 @@ var require_graceful_fs = __commonJS({
       }
       function WriteStream$open() {
         var that = this;
-        open7(that.path, that.flags, that.mode, function(err, fd) {
+        open8(that.path, that.flags, that.mode, function(err, fd) {
           if (err) {
             that.destroy();
             that.emit("error", err);
@@ -745,8 +745,8 @@ var require_graceful_fs = __commonJS({
         return new fs2.WriteStream(path, options);
       }
       var fs$open = fs2.open;
-      fs2.open = open7;
-      function open7(path, flags, mode, cb) {
+      fs2.open = open8;
+      function open8(path, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
         return go$open(path, flags, mode, cb);
@@ -1618,27 +1618,13 @@ var require_proper_lockfile = __commonJS({
 
 // scripts/diagnostics/npm-entry.mts
 import { readFile as readFile3 } from "node:fs/promises";
-import { dirname as dirname6, join as join11 } from "node:path";
+import { dirname as dirname7, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from "node:url";
 import { homedir as homedir4 } from "node:os";
 
-// packages/cli/src/core/paths.ts
-import { homedir } from "node:os";
-import { join } from "node:path";
-function cliPaths(env = process.env) {
-  const home = env.SBERPAY_CLI_HOME;
-  if (home) return { configDir: join(home, "config"), cacheDir: join(home, "cache"), stateDir: join(home, "state") };
-  const h = homedir();
-  return {
-    configDir: join(env.XDG_CONFIG_HOME ?? join(h, ".config"), "sberpay-cli"),
-    cacheDir: join(env.XDG_CACHE_HOME ?? join(h, ".cache"), "sberpay-cli"),
-    stateDir: join(env.XDG_STATE_HOME ?? join(h, ".local", "state"), "sberpay-cli")
-  };
-}
-
-// packages/cli/src/paymentMode/state.ts
-import { lstatSync, readFileSync, openSync as openSync2, closeSync as closeSync2, fstatSync, constants } from "node:fs";
-import { join as join2 } from "node:path";
+// packages/cli/src/core/windowsAcl.ts
+import { spawnSync } from "node:child_process";
+import { dirname, win32 } from "node:path";
 
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -2362,9 +2348,9 @@ function floatSafeRemainder(val, step) {
   return ratio - roundedRatio;
 }
 var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-function defineLazy(object3, key, getter) {
+function defineLazy(object2, key, getter) {
   let value = void 0;
-  Object.defineProperty(object3, key, {
+  Object.defineProperty(object2, key, {
     get() {
       if (value === EVALUATING) {
         return void 0;
@@ -2376,7 +2362,7 @@ function defineLazy(object3, key, getter) {
       return value;
     },
     set(v) {
-      Object.defineProperty(object3, key, {
+      Object.defineProperty(object2, key, {
         value: v
         // configurable: true,
       });
@@ -17443,8 +17429,8 @@ function foldObjects(members2) {
   }
   const properties = {};
   const required2 = /* @__PURE__ */ new Set();
-  for (const object3 of objects) {
-    for (const key in object3.properties) {
+  for (const object2 of objects) {
+    for (const key in object2.properties) {
       if (Object.prototype.hasOwnProperty.call(properties, key))
         continue;
       const parts = [];
@@ -17458,18 +17444,18 @@ function foldObjects(members2) {
       const merged = parts.length === 1 ? parts[0] : foldObjects(parts) ?? { allOf: parts };
       assignProp(properties, key, merged);
     }
-    for (const key of object3.required ?? [])
+    for (const key of object2.required ?? [])
       required2.add(key);
   }
   const folded = { type: "object", properties };
   if (required2.size)
     folded.required = [...required2];
-  if (objects.every((object3) => object3.additionalProperties === false)) {
+  if (objects.every((object2) => object2.additionalProperties === false)) {
     folded.additionalProperties = false;
   } else {
     const constraints = [];
-    for (const object3 of objects) {
-      const constraint = undeclaredConstraint(object3);
+    for (const object2 of objects) {
+      const constraint = undeclaredConstraint(object2);
       if (constraint && !constraints.some((seen) => JSON.stringify(seen) === JSON.stringify(constraint)))
         constraints.push(constraint);
     }
@@ -21308,12 +21294,135 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// packages/cli/src/core/windowsAcl.ts
+var Sid = external_exports.string().regex(/^S-1-(?:\d+-)*\d+$/);
+var Inspection = external_exports.object({ owner: Sid, currentUser: Sid, reparse: external_exports.literal(false), rules: external_exports.array(external_exports.object({ sid: Sid, allow: external_exports.boolean(), rights: external_exports.number().int() })).min(1) });
+var WRITE_ACCESS = 852310 | 1342177280;
+function assertWindowsAcl(value, policy) {
+  const parsed = Inspection.safeParse(value);
+  if (!parsed.success) throw Error("WINDOWS_ACL_UNSAFE");
+  const s = parsed.data, trusted = /* @__PURE__ */ new Set([s.currentUser, "S-1-5-18", "S-1-5-32-544"]);
+  if (!trusted.has(s.owner) || s.rules.some((r) => r.allow && !trusted.has(r.sid) && (policy === "private" ? r.rights !== 0 : (r.rights & WRITE_ACCESS) !== 0))) throw Error("WINDOWS_ACL_UNSAFE");
+}
+var SCRIPT = String.raw`
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=New-Object System.Text.UTF8Encoding($false)
+$p=[IO.Path]::GetFullPath($env:SBERPAY_ACL_PATH)
+$cursor=$p
+while($cursor){
+ if(Test-Path -LiteralPath $cursor){
+  $item=Get-Item -LiteralPath $cursor -Force
+  if(($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0){throw 'REPARSE_POINT'}
+ }
+ $next=[IO.Path]::GetDirectoryName($cursor)
+ if($next -eq $cursor){break};$cursor=$next
+}
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User
+if($env:SBERPAY_ACL_ACTION -eq 'create' -and !(Test-Path -LiteralPath $p)){
+ $acl=New-Object Security.AccessControl.DirectorySecurity
+ $acl.SetOwner($sid);$acl.SetAccessRuleProtection($true,$false)
+ foreach($id in @($sid.Value,'S-1-5-18','S-1-5-32-544')){
+  $principal=New-Object Security.Principal.SecurityIdentifier($id)
+  $rule=New-Object Security.AccessControl.FileSystemAccessRule($principal,'FullControl','ContainerInherit,ObjectInherit','None','Allow')
+  $acl.AddAccessRule($rule)
+ }
+ [IO.Directory]::CreateDirectory($p,$acl)|Out-Null
+}
+$acl=Get-Acl -LiteralPath $p
+$rules=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|ForEach-Object{
+ @{sid=$_.IdentityReference.Value;allow=($_.AccessControlType -eq 'Allow');rights=[int]$_.FileSystemRights}
+})
+@{owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;currentUser=$sid.Value;reparse=$false;rules=$rules}|ConvertTo-Json -Compress -Depth 5
+`;
+function windowsAclCommand(path, action, env = process.env) {
+  const root2 = env.SystemRoot;
+  if (!root2 || !win32.isAbsolute(root2)) throw Error("WINDOWS_SYSTEM_ROOT_MISSING");
+  return { file: win32.join(root2, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")], env: { SystemRoot: root2, SBERPAY_ACL_PATH: path, SBERPAY_ACL_ACTION: action } };
+}
+function inspect(path, policy, action) {
+  const c = windowsAclCommand(path, action);
+  const r = spawnSync(c.file, c.args, { env: c.env, encoding: "utf8", windowsHide: true, timeout: 1e4, maxBuffer: 128 * 1024 });
+  if (r.error || r.status !== 0) throw Error("WINDOWS_ACL_CHECK_FAILED");
+  let value;
+  try {
+    value = JSON.parse(r.stdout.trim().replace(/^\uFEFF/, ""));
+  } catch {
+    throw Error("WINDOWS_ACL_CHECK_FAILED");
+  }
+  assertWindowsAcl(value, policy);
+}
+function assertWindowsPrivatePath(path) {
+  inspect(path, "private", "inspect");
+}
+function ensureWindowsPrivateDirectory(path) {
+  inspect(path, "private", "create");
+}
+
+// packages/cli/src/report/platform.ts
+import { posix, win32 as win322 } from "node:path";
+import { createHash } from "node:crypto";
+var bashQuote = (s) => "'" + s.replaceAll("'", "'\\''") + "'";
+function diagnosticLauncherCommand(platform, launcher, node2) {
+  return platform === "win32" ? "& " + [node2, launcher].map((s) => "'" + s.replaceAll("'", "''") + "'").join(" ") : bashQuote(launcher);
+}
+function skillFileHashes(skill, files, platform = process.platform) {
+  const paths = platform === "win32" ? win322 : posix;
+  return Object.fromEntries(files.flatMap((f) => {
+    const rel = paths.relative(skill, f.path);
+    return rel && !paths.isAbsolute(rel) && rel !== ".." && !rel.startsWith(".." + paths.sep) ? [[rel.split(paths.sep).join("/"), createHash("sha256").update(f.text).digest("hex")]] : [];
+  }));
+}
+function renderDiagnosticSkill(source2, platform, launcher, node2) {
+  if (platform === "win32") source2 = source2.replace(/(\{\{diagnosticLauncher\}\} auth complete --json) <<'TOKEN'\n([\s\S]*?)\nTOKEN/g, "@'\n$2\n'@ | $1").replace(/\\\r?\n\s*/g, " ");
+  return source2.replaceAll("{{diagnosticLauncher}}", diagnosticLauncherCommand(platform, launcher, node2)) + (platform === "win32" ? "\n\u041D\u0430 Windows \u043A\u043E\u043C\u0430\u043D\u0434\u044B \u0432\u044B\u0448\u0435 \u0432\u044B\u043F\u043E\u043B\u043D\u044F\u044E\u0442\u0441\u044F \u0432 PowerShell. \u0414\u043B\u044F Claude Code SessionStart hook \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044F Git Bash; CLAUDE_ENV_FILE \u0441\u043E\u0434\u0435\u0440\u0436\u0438\u0442 Bash export, \u0430 \u043D\u0435 PowerShell.\n" : "");
+}
+
+// packages/cli/src/core/paths.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+function cliPaths(env = process.env) {
+  const home = env.SBERPAY_CLI_HOME;
+  if (home) return { configDir: join(home, "config"), cacheDir: join(home, "cache"), stateDir: join(home, "state") };
+  const h = homedir();
+  return {
+    configDir: join(env.XDG_CONFIG_HOME ?? join(h, ".config"), "sberpay-cli"),
+    cacheDir: join(env.XDG_CACHE_HOME ?? join(h, ".cache"), "sberpay-cli"),
+    stateDir: join(env.XDG_STATE_HOME ?? join(h, ".local", "state"), "sberpay-cli")
+  };
+}
+
+// packages/cli/src/core/privatePath.ts
+import { lstatSync } from "node:fs";
+import { open as open2 } from "node:fs/promises";
+function assertPrivateFile(path, info) {
+  const named = lstatSync(path);
+  if (!info.isFile() || !named.isFile() || named.isSymbolicLink() || info.ino !== named.ino || info.dev !== named.dev) throw Error("UNSAFE_FILE");
+  if (process.platform === "win32") assertWindowsPrivatePath(path);
+  else if (process.getuid && info.uid !== process.getuid() || info.mode & 63) throw Error("UNSAFE_FILE");
+}
+async function syncDirectory(path) {
+  if (process.platform === "win32") return;
+  const f = await open2(path, "r");
+  try {
+    await f.sync();
+  } finally {
+    await f.close();
+  }
+}
+
+// packages/cli/src/paymentMode/state.ts
+import { lstatSync as lstatSync2, readFileSync, openSync as openSync2, closeSync as closeSync2, fstatSync, constants } from "node:fs";
+import { join as join2 } from "node:path";
+
 // packages/cli/src/core/atomicFile.ts
-import { mkdirSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, rmSync } from "node:fs";
-import { dirname } from "node:path";
+import { mkdirSync, existsSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, rmSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
 import { randomUUID } from "node:crypto";
 function atomicJson(path, value) {
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  if (process.platform === "win32") {
+    ensureWindowsPrivateDirectory(dirname2(path));
+    if (existsSync(path)) assertWindowsPrivatePath(path);
+  } else mkdirSync(dirname2(path), { recursive: true, mode: 448 });
   const temp = `${path}.${randomUUID()}.tmp`;
   try {
     const fd = openSync(temp, "wx", 384);
@@ -21325,7 +21434,7 @@ function atomicJson(path, value) {
     }
     renameSync(temp, path);
     if (process.platform !== "win32") {
-      const dir = openSync(dirname(path), "r");
+      const dir = openSync(dirname2(path), "r");
       try {
         fsyncSync(dir);
       } finally {
@@ -21384,8 +21493,9 @@ function invalid() {
   throw new CliError(EXIT.CONFIG_OR_NETWORK, "PAYMENT_MODE_INVALID", "PAYMENT_MODE_INVALID: \u043D\u0430\u0441\u0442\u0440\u043E\u0439\u043A\u0430 \u0440\u0435\u0436\u0438\u043C\u0430 \u043E\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0438\u043B\u0438 \u043F\u043E\u0432\u0440\u0435\u0436\u0434\u0435\u043D\u0430; \u0438\u0441\u043F\u043E\u043B\u044C\u0437\u0443\u0439\u0442\u0435 payment-mode set.");
 }
 function checkDir(paths) {
-  const s = lstatSync(paths.configDir);
-  if (!s.isDirectory() || s.isSymbolicLink() || (s.mode & 63) !== 0) invalid();
+  const s = lstatSync2(paths.configDir);
+  if (!s.isDirectory() || s.isSymbolicLink() || process.platform !== "win32" && (s.mode & 63) !== 0) invalid();
+  if (process.platform === "win32") assertWindowsPrivatePath(paths.configDir);
 }
 function readPaymentMode(paths) {
   try {
@@ -21393,7 +21503,8 @@ function readPaymentMode(paths) {
     const fd = openSync2(modeFile(paths), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
     try {
       const s = fstatSync(fd);
-      if (!s.isFile() || s.size > 4096 || (s.mode & 63) !== 0) invalid();
+      assertPrivateFile(modeFile(paths), s);
+      if (s.size > 4096) invalid();
       return PaymentModeStateSchema.parse(JSON.parse(readFileSync(fd, "utf8")));
     } finally {
       closeSync2(fd);
@@ -21404,8 +21515,8 @@ function readPaymentMode(paths) {
 }
 
 // packages/cli/src/core/fileLock.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2, renameSync as renameSync2, existsSync } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2, renameSync as renameSync2, existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function processAlive(pid) {
   if (!Number.isSafeInteger(pid) || pid <= 0) return void 0;
@@ -21442,7 +21553,7 @@ function owner(path) {
   }
 }
 async function withFileLock(path, fn, timeoutMs = 5e3) {
-  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  mkdirSync2(dirname3(path), { recursive: true, mode: 448 });
   const nonce = randomUUID2(), deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -21469,7 +21580,7 @@ async function withFileLock(path, fn, timeoutMs = 5e3) {
         } finally {
           if (acquired) rmSync2(reaper, { recursive: true, force: true });
         }
-        if (!existsSync(path)) continue;
+        if (!existsSync2(path)) continue;
       }
       if (Date.now() >= deadline)
         throw new CliError(EXIT.CONFIG_OR_NETWORK, "BINDING_BUSY", "\u0414\u0440\u0443\u0433\u0430\u044F \u043A\u043E\u043C\u0430\u043D\u0434\u0430 \u0432\u043B\u0430\u0434\u0435\u0435\u0442 \u0441\u043E\u0441\u0442\u043E\u044F\u043D\u0438\u0435\u043C \u0438\u043B\u0438 \u0432\u043B\u0430\u0434\u0435\u043B\u0435\u0446 \u0431\u043B\u043E\u043A\u0438\u0440\u043E\u0432\u043A\u0438 \u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043D. \u041F\u043E\u0432\u0442\u043E\u0440\u0438\u0442\u0435 \u043F\u043E\u0437\u0436\u0435.");
@@ -21485,7 +21596,7 @@ async function withFileLock(path, fn, timeoutMs = 5e3) {
 
 // packages/cli/src/probe/journal.ts
 import {
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync4,
   rmSync as rmSync3,
@@ -21493,7 +21604,7 @@ import {
   openSync as openSync4,
   fsyncSync as fsyncSync3,
   closeSync as closeSync4,
-  lstatSync as lstatSync3
+  lstatSync as lstatSync4
 } from "node:fs";
 import { join as join5 } from "node:path";
 
@@ -21519,7 +21630,7 @@ import {
   closeSync as closeSync3,
   fsyncSync as fsyncSync2,
   fstatSync as fstatSync2,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
   openSync as openSync3,
   readFileSync as readFileSync3,
@@ -21536,14 +21647,16 @@ function journalError() {
   );
 }
 function privateDir(path) {
-  mkdirSync3(path, { recursive: true, mode: 448 });
-  const s = lstatSync2(path);
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(path);
+  else mkdirSync3(path, { recursive: true, mode: 448 });
+  const s = lstatSync3(path);
   if (!s.isDirectory() || s.isSymbolicLink() || process.platform !== "win32" && ((s.mode & 63) !== 0 || s.uid !== process.getuid?.()))
     journalError();
 }
 function registryDir(paths) {
-  mkdirSync3(paths.stateDir, { recursive: true, mode: 448 });
-  if (lstatSync2(paths.stateDir).isSymbolicLink()) journalError();
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(paths.stateDir);
+  else mkdirSync3(paths.stateDir, { recursive: true, mode: 448 });
+  if (lstatSync3(paths.stateDir).isSymbolicLink()) journalError();
   const dir = join4(paths.stateDir, "payment-probes");
   privateDir(dir);
   return dir;
@@ -21560,6 +21673,12 @@ function syncDir(dir) {
 function openPrivate(path, flags) {
   const fd = openSync3(path, flags | (constants2.O_NOFOLLOW ?? 0), 384);
   const s = fstatSync2(fd);
+  try {
+    assertPrivateFile(path, s);
+  } catch {
+    closeSync3(fd);
+    journalError();
+  }
   if (!s.isFile() || s.nlink !== 1 || s.size > MAX_FILE || process.platform !== "win32" && ((s.mode & 63) !== 0 || s.uid !== process.getuid?.())) {
     closeSync3(fd);
     journalError();
@@ -21710,7 +21829,7 @@ function lockError(code) {
 }
 function ownerAlive(lock) {
   try {
-    if (lstatSync3(lock).isSymbolicLink()) journalError();
+    if (lstatSync4(lock).isSymbolicLink()) journalError();
     const raw = readFileSync4(join5(lock, "owner.json"), "utf8");
     if (raw.length > 256) journalError();
     const pid = JSON.parse(raw).pid;
@@ -21729,7 +21848,7 @@ function ownerAlive(lock) {
 async function exclusive(paths, recover, fn, installing2 = false) {
   const dir = registryDir(paths), lock = join5(dir, ".lock");
   let recovered = false;
-  if (existsSync2(lock)) {
+  if (existsSync3(lock)) {
     if (ownerAlive(lock)) lockError("PROBE_BUSY");
     if (!recover) lockError("PROBE_STALE_LOCK");
     try {
@@ -21765,7 +21884,7 @@ async function exclusive(paths, recover, fn, installing2 = false) {
     }
     syncDir(lock);
     syncDir(dir);
-    if (!installing2 && existsSync2(join5(paths.configDir, "../..", "install-pending.json")))
+    if (!installing2 && existsSync3(join5(paths.configDir, "../..", "install-pending.json")))
       throw new CliError(EXIT.CONFIG_OR_NETWORK, "INSTALL_IN_PROGRESS", "\u0423\u0441\u0442\u0430\u043D\u043E\u0432\u043A\u0430 \u043D\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043D\u0430");
     return await fn();
   } finally {
@@ -21780,29 +21899,8 @@ var withPaymentLock = (paths, fn, installing2 = false) => exclusive(paths, insta
   return fn();
 }, installing2);
 
-// packages/cli/src/report/installTransaction.ts
-var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import { mkdir as mkdir2, open as open3, rename as rename2, rm as rm2, lstat as lstat2, readFile } from "node:fs/promises";
-import { join as join6, dirname as dirname3 } from "node:path";
-import { createHash, randomUUID as randomUUID3 } from "node:crypto";
-
-// packages/cli/src/report/transport.ts
-import { constants as constants3 } from "node:fs";
-import { open as open2, lstat, rename, rm, mkdir } from "node:fs/promises";
-
-// packages/case-protocol/src/index.ts
-var MAX_ZIP = 20 * 1024 * 1024;
-var MAX_EXPANDED = 100 * 1024 * 1024;
-var CaseId = external_exports.uuid();
-var Receipt = external_exports.object({ schemaVersion: external_exports.literal(1), caseId: CaseId, sha256: external_exports.string().regex(/^[a-f0-9]{64}$/), bytes: external_exports.number().int().positive().max(MAX_ZIP), status: external_exports.literal("accepted"), acceptedAt: external_exports.iso.datetime() }).strict();
-var ConversationSource = external_exports.union([
-  external_exports.object({ attached: external_exports.literal(true).optional(), identity: external_exports.literal("verified"), coverage: external_exports.enum(["partial", "complete"]) }),
-  external_exports.object({ attached: external_exports.literal(false), identity: external_exports.enum(["verified", "ambiguous", "unavailable"]), coverage: external_exports.enum(["unavailable", "unsupported", "failed"]), warnings: external_exports.array(external_exports.string()).min(1).refine((items) => items.includes("HISTORY_NOT_ATTACHED")) })
-]);
-var Manifest = external_exports.object({ schemaVersion: external_exports.union([external_exports.literal(1), external_exports.literal(2)]), caseId: CaseId, scope: external_exports.enum(["current_session", "purchase_episode"]), sources: external_exports.object({ conversation: ConversationSource, cli: external_exports.object({ coverage: external_exports.enum(["partial", "unavailable"]) }) }), redaction: external_exports.object({ version: external_exports.literal(1), status: external_exports.literal("best_effort") }), files: external_exports.array(external_exports.object({ path: external_exports.string(), bytes: external_exports.number().int().nonnegative(), sha256: external_exports.string().regex(/^[a-f0-9]{64}$/) }).strict()).length(5) });
-
 // packages/cli/src/report/storage.ts
-import { lstatSync as lstatSync4, mkdirSync as mkdirSync5, readdirSync as readdirSync2, unlinkSync } from "node:fs";
+import { lstatSync as lstatSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync2, unlinkSync } from "node:fs";
 
 // packages/cli/src/report/bindingFiles.ts
 var BindingError = class extends Error {
@@ -21819,18 +21917,41 @@ var BindingError = class extends Error {
 
 // packages/cli/src/report/storage.ts
 function privateDir2(path) {
-  mkdirSync5(path, { recursive: true, mode: 448 });
-  const info = lstatSync4(path);
-  if (!info.isDirectory() || info.isSymbolicLink() || process.getuid && info.uid !== process.getuid() || info.mode & 63) throw new BindingError("UNSAFE_REPORT_DIRECTORY");
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(path);
+  else mkdirSync5(path, { recursive: true, mode: 448 });
+  const info = lstatSync5(path);
+  if (!info.isDirectory() || info.isSymbolicLink() || process.getuid && info.uid !== process.getuid() || process.platform !== "win32" && info.mode & 63) throw new BindingError("UNSAFE_REPORT_DIRECTORY");
   return path;
 }
 
+// packages/cli/src/report/installTransaction.ts
+var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
+import { mkdir as mkdir2, open as open4, rename as rename2, rm as rm2, lstat as lstat2, readFile } from "node:fs/promises";
+import { join as join6, dirname as dirname4 } from "node:path";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
+
+// packages/cli/src/report/transport.ts
+import { constants as constants3 } from "node:fs";
+import { open as open3, lstat, rename, rm, mkdir } from "node:fs/promises";
+
+// packages/case-protocol/src/index.ts
+var MAX_ZIP = 20 * 1024 * 1024;
+var MAX_EXPANDED = 100 * 1024 * 1024;
+var CaseId = external_exports.uuid();
+var Receipt = external_exports.object({ schemaVersion: external_exports.literal(1), caseId: CaseId, sha256: external_exports.string().regex(/^[a-f0-9]{64}$/), bytes: external_exports.number().int().positive().max(MAX_ZIP), status: external_exports.literal("accepted"), acceptedAt: external_exports.iso.datetime() }).strict();
+var ConversationSource = external_exports.union([
+  external_exports.object({ attached: external_exports.literal(true).optional(), identity: external_exports.literal("verified"), coverage: external_exports.enum(["partial", "complete"]) }),
+  external_exports.object({ attached: external_exports.literal(false), identity: external_exports.enum(["verified", "ambiguous", "unavailable"]), coverage: external_exports.enum(["unavailable", "unsupported", "failed"]), warnings: external_exports.array(external_exports.string()).min(1).refine((items) => items.includes("HISTORY_NOT_ATTACHED")) })
+]);
+var Manifest = external_exports.object({ schemaVersion: external_exports.union([external_exports.literal(1), external_exports.literal(2)]), caseId: CaseId, scope: external_exports.enum(["current_session", "purchase_episode"]), sources: external_exports.object({ conversation: ConversationSource, cli: external_exports.object({ coverage: external_exports.enum(["partial", "unavailable"]) }) }), redaction: external_exports.object({ version: external_exports.literal(1), status: external_exports.literal("best_effort") }), files: external_exports.array(external_exports.object({ path: external_exports.string(), bytes: external_exports.number().int().nonnegative(), sha256: external_exports.string().regex(/^[a-f0-9]{64}$/) }).strict()).length(5) });
+
 // packages/cli/src/report/transport.ts
 async function privateRead(path, limit) {
-  const file2 = await open2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+  const file2 = await open3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
   try {
     const info = await file2.stat();
-    if (!info.isFile() || process.getuid && info.uid !== process.getuid() || info.mode & 63 || info.size > limit) throw Error("UNSAFE_FILE");
+    assertPrivateFile(path, info);
+    if (info.size > limit) throw Error("UNSAFE_FILE");
     const buffer = Buffer.alloc(info.size);
     let at = 0;
     while (at < buffer.length) {
@@ -21846,12 +21967,13 @@ async function privateRead(path, limit) {
 var configSchema = external_exports.object({ endpoint: external_exports.string().url(), token: external_exports.string().min(32).max(512).regex(/^[A-Za-z0-9_-]+$/) }).strict();
 
 // packages/cli/src/report/installTransaction.ts
-var hash2 = (s) => createHash("sha256").update(s).digest("hex");
+var hash2 = (s) => createHash2("sha256").update(s).digest("hex");
 async function durableWrite(path, text, mode = 384) {
-  await mkdir2(dirname3(path), { recursive: true, mode: 448 });
+  if (process.platform === "win32") privateDir2(dirname4(path));
+  else await mkdir2(dirname4(path), { recursive: true, mode: 448 });
   const temp = path + "." + randomUUID3() + ".tmp";
   try {
-    const f = await open3(temp, "wx", mode);
+    const f = await open4(temp, "wx", mode);
     try {
       await f.writeFile(text);
       await f.sync();
@@ -21859,21 +21981,16 @@ async function durableWrite(path, text, mode = 384) {
       await f.close();
     }
     await rename2(temp, path);
-    const d = await open3(dirname3(path), "r");
-    try {
-      await d.sync();
-    } finally {
-      await d.close();
-    }
+    await syncDirectory(dirname4(path));
   } finally {
     await rm2(temp, { force: true });
   }
 }
 async function withInstallLock(root2, fn) {
-  await mkdir2(root2, { recursive: true, mode: 448 });
+  privateDir2(root2);
   let release;
   try {
-    release = await import_proper_lockfile.default.lock(root2, { lockfilePath: join6(root2, ".setup-lock"), realpath: false, stale: 5e3, update: 1e3, retries: 0 });
+    release = await import_proper_lockfile.default.lock(root2, { lockfilePath: join6(root2, ".setup-lock"), realpath: false, stale: process.platform === "win32" ? 12e4 : 5e3, update: 1e3, retries: 0 });
   } catch (e) {
     if (e.code === "ELOCKED") throw Error("INSTALL_BUSY");
     throw e;
@@ -21935,22 +22052,17 @@ async function applyInstallFiles(root2, buildId, files, finish) {
   for (const file2 of files) await durableWrite(file2.path, file2.text, file2.mode);
   await finish();
   await rm2(journal);
-  const d = await open3(root2, "r");
-  try {
-    await d.sync();
-  } finally {
-    await d.close();
-  }
+  await syncDirectory(root2);
 }
 
 // packages/cli/src/report/openEnrollment.ts
 import { generateKeyPairSync as generateKeyPairSync2, createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, randomUUID as randomUUID5, sign as sign2 } from "node:crypto";
-import { open as open5, rename as rename4, rm as rm4, lstat as lstat3 } from "node:fs/promises";
+import { open as open6, rename as rename4, rm as rm4, lstat as lstat3 } from "node:fs/promises";
 import { join as join8 } from "node:path";
 
 // packages/cli/src/report/enrollment.ts
-import { generateKeyPairSync, createHash as createHash2, createPrivateKey, createPublicKey, randomUUID as randomUUID4, sign } from "node:crypto";
-import { open as open4, rename as rename3, rm as rm3 } from "node:fs/promises";
+import { generateKeyPairSync, createHash as createHash3, createPrivateKey, createPublicKey, randomUUID as randomUUID4, sign } from "node:crypto";
+import { open as open5, rename as rename3, rm as rm3 } from "node:fs/promises";
 import { join as join7 } from "node:path";
 import { request as httpsRequest } from "node:https";
 var DIAGNOSTIC_ENDPOINT = "https://aiplatilka.ru/case-reports";
@@ -21984,36 +22096,28 @@ var enrollmentPost = (path, body) => new Promise((resolve2, reject) => {
   request.on("error", reject);
   request.end(bytes);
 });
-async function syncDir2(dir) {
-  const f = await open4(dir, "r");
-  try {
-    await f.sync();
-  } finally {
-    await f.close();
-  }
-}
 async function enrollInvitation(path, env = process.env, request = enrollmentPost) {
   try {
     const invite = Invitation.parse(JSON.parse((await privateRead(path, 8192)).toString("utf8")));
-    const hash4 = createHash2("sha256").update(invite.token).digest("hex");
+    const hash4 = createHash3("sha256").update(invite.token).digest("hex");
     const dir = privateDir2(cliPaths(env).configDir);
     const statePath = join7(dir, "report-installation.json");
     try {
       const pair = generateKeyPairSync("ed25519");
-      const file2 = await open4(statePath, "wx", 384);
+      const file2 = await open5(statePath, "wx", 384);
       try {
         await file2.writeFile(JSON.stringify({ invitationHash: hash4, installationId: randomUUID4(), privateKey: pair.privateKey.export({ format: "pem", type: "pkcs8" }), publicKey: pair.publicKey.export({ format: "pem", type: "spki" }) }));
         await file2.sync();
       } finally {
         await file2.close();
       }
-      await syncDir2(dir);
+      await syncDirectory(dir);
     } catch (error62) {
       if (error62.code !== "EEXIST") throw error62;
     }
     const state = State.parse(JSON.parse((await privateRead(statePath, 8192)).toString("utf8")));
     if (state.invitationHash !== hash4 || createPublicKey(state.privateKey).export({ format: "pem", type: "spki" }).toString() !== state.publicKey) throw Error("INSTALLATION_CONFLICT");
-    await syncDir2(dir);
+    await syncDirectory(dir);
     const body = { inviteToken: invite.token, installationId: state.installationId, publicKey: state.publicKey };
     const challenge = external_exports.object({ challenge: external_exports.string().max(2048) }).strict().parse(await request("/v1/enroll/challenge", body));
     const signature = sign(null, Buffer.from("sberpay-enroll-v1\n" + challenge.challenge), createPrivateKey(state.privateKey)).toString("base64url");
@@ -22021,7 +22125,7 @@ async function enrollInvitation(path, env = process.env, request = enrollmentPos
     if (response.installationId !== state.installationId) throw Error("INSTALLATION_MISMATCH");
     const temp = join7(dir, `.upload-${randomUUID4()}.tmp`);
     try {
-      const file2 = await open4(temp, "wx", 384);
+      const file2 = await open5(temp, "wx", 384);
       try {
         await file2.writeFile(JSON.stringify({ endpoint: DIAGNOSTIC_ENDPOINT, token: response.token }));
         await file2.sync();
@@ -22029,7 +22133,7 @@ async function enrollInvitation(path, env = process.env, request = enrollmentPos
         await file2.close();
       }
       await rename3(temp, join7(dir, "report-upload.json"));
-      await syncDir2(dir);
+      await syncDirectory(dir);
     } finally {
       await rm3(temp, { force: true });
     }
@@ -22043,14 +22147,6 @@ async function enrollInvitation(path, env = process.env, request = enrollmentPos
 var State2 = external_exports.object({ schemaVersion: external_exports.literal(1), installationId: external_exports.uuid(), privateKey: external_exports.string().max(256), publicKey: external_exports.string().max(256) }).strict();
 var Credential2 = external_exports.object({ schemaVersion: external_exports.literal(1), installationId: external_exports.uuid(), owner: external_exports.string(), token: external_exports.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict();
 var Upload = external_exports.object({ endpoint: external_exports.literal(DIAGNOSTIC_ENDPOINT), token: external_exports.string().min(32).max(512).regex(/^[A-Za-z0-9_-]+$/) }).strict();
-async function syncDir3(dir) {
-  const f = await open5(dir, "r");
-  try {
-    await f.sync();
-  } finally {
-    await f.close();
-  }
-}
 async function enrollOpen(env = process.env, request = enrollmentPost) {
   const dir = privateDir2(cliPaths(env).configDir), statePath = join8(dir, "report-open-installation.json");
   try {
@@ -22071,7 +22167,7 @@ async function enrollOpen(env = process.env, request = enrollmentPost) {
     if (e.code !== "ENOENT") throw e;
     const pair = generateKeyPairSync2("ed25519"), temp = statePath + "." + randomUUID5() + ".tmp";
     try {
-      const f = await open5(temp, "wx", 384);
+      const f = await open6(temp, "wx", 384);
       try {
         await f.writeFile(JSON.stringify({ schemaVersion: 1, installationId: randomUUID5(), privateKey: pair.privateKey.export({ format: "pem", type: "pkcs8" }), publicKey: pair.publicKey.export({ format: "pem", type: "spki" }) }));
         await f.sync();
@@ -22079,7 +22175,7 @@ async function enrollOpen(env = process.env, request = enrollmentPost) {
         await f.close();
       }
       await rename4(temp, statePath);
-      await syncDir3(dir);
+      await syncDirectory(dir);
     } finally {
       await rm4(temp, { force: true });
     }
@@ -22091,7 +22187,7 @@ async function enrollOpen(env = process.env, request = enrollmentPost) {
   } catch {
     throw Error("INSTALLATION_STATE_INVALID");
   }
-  await syncDir3(dir);
+  await syncDirectory(dir);
   try {
     const body = { installationId: state.installationId, publicKey: state.publicKey };
     const c = external_exports.object({ challenge: external_exports.string().max(2048) }).strict().parse(await request("/v2/enroll/challenge", body));
@@ -22100,7 +22196,7 @@ async function enrollOpen(env = process.env, request = enrollmentPost) {
     if (response.installationId !== state.installationId || response.owner !== "installation:" + state.installationId) throw Error("INSTALLATION_MISMATCH");
     const temp = join8(dir, ".upload-" + randomUUID5() + ".tmp");
     try {
-      const f = await open5(temp, "wx", 384);
+      const f = await open6(temp, "wx", 384);
       try {
         await f.writeFile(JSON.stringify({ endpoint: DIAGNOSTIC_ENDPOINT, token: response.token }));
         await f.sync();
@@ -22108,7 +22204,7 @@ async function enrollOpen(env = process.env, request = enrollmentPost) {
         await f.close();
       }
       await rename4(temp, join8(dir, "report-upload.json"));
-      await syncDir3(dir);
+      await syncDirectory(dir);
     } finally {
       await rm4(temp, { force: true });
     }
@@ -22118,8 +22214,65 @@ async function enrollOpen(env = process.env, request = enrollmentPost) {
   }
 }
 
+// packages/cli/src/report/windowsSender.ts
+import { win32 as win323 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+var windowsArgument = (s) => '"' + s.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1") + '"';
+function windowsSenderConfig(home, launcher, node2) {
+  if (!win323.isAbsolute(launcher) || !win323.isAbsolute(node2) || /[\0\r\n]/.test(launcher + node2)) throw Error("INVALID_SENDER_PATH");
+  return { path: win323.join(home, ".local", "share", "sberpay-diagnostic", "sender-task.json"), text: JSON.stringify({ name: "SberPay.Diagnostic." + createHash4("sha256").update(launcher.toLowerCase()).digest("hex").slice(0, 24), node: node2, launcher, arguments: windowsArgument(launcher) + " report flush --json" }) };
+}
+var SCRIPT2 = String.raw`
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=New-Object System.Text.UTF8Encoding($false)
+$c=Get-Content -LiteralPath $env:SBERPAY_SENDER_CONFIG -Raw -Encoding UTF8|ConvertFrom-Json
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$service=New-Object -ComObject 'Schedule.Service'
+$service.Connect()
+$folder=$service.GetFolder('\')
+$source='sberpay-diagnostic:'+ $c.launcher
+$existing=$null
+try{$existing=$folder.GetTask($c.name)}catch{$e=$_.Exception;while($e.InnerException){$e=$e.InnerException};if($e.HResult -ne -2147024894){throw}}
+if($existing){
+ if($existing.Definition.RegistrationInfo.Source -cne $source -or $existing.Definition.Principal.UserId -ne $sid){throw 'SENDER_TASK_CONFLICT'}
+}
+$task=$service.NewTask(0)
+$task.RegistrationInfo.Source=$source
+$task.RegistrationInfo.Description='Deliver queued SberPay diagnostic cases'
+$task.Principal.UserId=$sid
+$task.Principal.LogonType=3
+$task.Principal.RunLevel=0
+$task.Settings.Enabled=$true
+$task.Settings.StartWhenAvailable=$true
+$task.Settings.DisallowStartIfOnBatteries=$false
+$task.Settings.StopIfGoingOnBatteries=$false
+$task.Settings.MultipleInstances=2
+# Each upload has its own deadline; never kill a sequential queue before later cases.
+$task.Settings.ExecutionTimeLimit='PT0S'
+$timer=$task.Triggers.Create(1)
+$timer.StartBoundary=(Get-Date).AddMinutes(1).ToString('yyyy-MM-ddTHH:mm:ss')
+$timer.Repetition.Interval='PT5M'
+$timer.Enabled=$true
+$logon=$task.Triggers.Create(9)
+$logon.UserId=$sid
+$logon.Enabled=$true
+$action=$task.Actions.Create(0)
+$action.Path=$c.node
+$action.Arguments=$c.arguments
+$action.WorkingDirectory=[IO.Path]::GetDirectoryName($c.launcher)
+$registered=$folder.RegisterTaskDefinition($c.name,$task,6,$sid,$null,3,$null)
+$read=$folder.GetTask($c.name)
+$d=$read.Definition
+if($d.Settings.ExecutionTimeLimit -ne 'PT0S' -or $d.Settings.MultipleInstances -ne 2 -or !$read.Enabled -or $d.Principal.UserId -ne $sid -or $d.Principal.LogonType -ne 3 -or $d.Principal.RunLevel -ne 0 -or $d.Actions.Count -ne 1 -or $d.Actions.Item(1).Path -cne $c.node -or $d.Actions.Item(1).Arguments -cne $c.arguments -or $d.Triggers.Count -ne 2 -or $d.Triggers.Item(1).Repetition.Interval -ne 'PT5M'){throw 'SENDER_TASK_NOT_ACTIVE'}
+@{status='active';taskName=$c.name}|ConvertTo-Json -Compress
+`;
+function windowsSenderCommand(path, env = process.env) {
+  if (!env.SystemRoot || !win323.isAbsolute(env.SystemRoot)) throw Error("WINDOWS_SYSTEM_ROOT_MISSING");
+  return { file: win323.join(env.SystemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT2, "utf16le").toString("base64")], env: { SystemRoot: env.SystemRoot, SBERPAY_SENDER_CONFIG: path } };
+}
+
 // packages/cli/src/report/sender.ts
-import { join as join9, dirname as dirname4 } from "node:path";
+import { join as join9, dirname as dirname5 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { mkdir as mkdir3, writeFile as writeFile2, lstat as lstat4, rename as rename5, rm as rm5 } from "node:fs/promises";
 import { execFile } from "node:child_process";
@@ -22148,15 +22301,18 @@ Persistent=true
 [Install]
 WantedBy=timers.target
 ` }];
+  if (platform === "win32") return [windowsSenderConfig(home, launcher, node2)];
   return [];
 }
 async function installSender(home, launcher) {
   const files = senderConfig(process.platform, home, launcher, process.execPath);
   for (const f of files) {
-    await mkdir3(dirname4(f.path), { recursive: true, mode: 448 });
+    if (process.platform === "win32") privateDir2(dirname5(f.path));
+    else await mkdir3(dirname5(f.path), { recursive: true, mode: 448 });
     try {
       const s = await lstat4(f.path);
       if (!s.isFile() || s.isSymbolicLink()) throw Error("UNSAFE_SENDER_PATH");
+      if (process.platform === "win32") assertWindowsPrivatePath(f.path);
     } catch (e) {
       if (e.code !== "ENOENT") throw e;
     }
@@ -22175,6 +22331,10 @@ async function installSender(home, launcher) {
       await run("launchctl", ["bootout", domain2 + "/" + label]).catch(() => {
       });
       await run("launchctl", ["bootstrap", domain2, files[0].path]);
+    } else if (process.platform === "win32") {
+      const c = windowsSenderCommand(files[0].path);
+      const result = await run(c.file, c.args, { env: c.env, windowsHide: true, timeout: 3e4, maxBuffer: 65536 });
+      if (JSON.parse(result.stdout.trim().replace(/^\uFEFF/, "")).status !== "active") throw Error("SENDER_TASK_NOT_ACTIVE");
     } else {
       await run("systemctl", ["--user", "daemon-reload"]);
       await run("systemctl", ["--user", "enable", "--now", label + ".timer"]);
@@ -22193,15 +22353,10 @@ var LAST_LISTED_MAJOR = 24;
 import { constants as constants4 } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { homedir as homedir3 } from "node:os";
-import { join as join10, resolve, dirname as dirname5, relative } from "node:path";
-import { mkdir as mkdir4, readFile as readFile2, writeFile as writeFile3, lstat as lstat5, rename as rename6, rm as rm6, cp, open as open6, chmod } from "node:fs/promises";
-import { createHash as createHash3, randomUUID as randomUUID7 } from "node:crypto";
-
-// packages/cli/src/report/claudeHook.ts
-var shellQuote = (text) => `'${text.replace(/'/g, "'\\''")}'`;
-
-// packages/cli/src/report/installer.ts
-var hash3 = (text) => createHash3("sha256").update(text).digest("hex");
+import { join as join10, resolve, dirname as dirname6 } from "node:path";
+import { mkdir as mkdir4, readFile as readFile2, writeFile as writeFile3, lstat as lstat5, rename as rename6, rm as rm6, cp, open as open7, chmod } from "node:fs/promises";
+import { createHash as createHash5, randomUUID as randomUUID7 } from "node:crypto";
+var hash3 = (text) => createHash5("sha256").update(text).digest("hex");
 var Manifest2 = external_exports.object({ schemaVersion: external_exports.literal(1), buildId: external_exports.string().regex(/^[a-f0-9]{64}$/), setupHash: external_exports.string().regex(/^[a-f0-9]{64}$/).optional(), files: external_exports.record(external_exports.string(), external_exports.string().regex(/^[a-f0-9]{64}$/)) }).strict();
 async function regular(path) {
   const s = await lstat5(path);
@@ -22223,7 +22378,7 @@ async function installDiagnostic(source2, home = homedir3(), options = {}) {
 async function installLocked(source2, home, options) {
   const enroll = typeof options === "function" ? options : options.enrollInvitation ?? enrollInvitation;
   const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
-  if (!(major > LAST_LISTED_MAJOR || MIN_NODE_MINOR[major] !== void 0 && minor >= MIN_NODE_MINOR[major]) || process.platform === "win32") throw Error("UNSUPPORTED_RUNTIME");
+  if (!(major > LAST_LISTED_MAJOR || MIN_NODE_MINOR[major] !== void 0 && minor >= MIN_NODE_MINOR[major])) throw Error("UNSUPPORTED_RUNTIME");
   source2 = resolve(source2);
   try {
     const info = JSON.parse(await readFile2(join10(source2, "build-info.json"), "utf8"));
@@ -22249,6 +22404,7 @@ async function installLocked(source2, home, options) {
     await regular(join10(packageRoot, path));
     if (hash3(await readFile2(join10(packageRoot, path))) !== digest) throw Error("PACKAGE_HASH_MISMATCH");
   }
+  if (process.platform === "win32" && !manifest.files[`helpers/win32-${process.arch}/sberpay-tpm.exe`]) throw Error("WINDOWS_HELPER_NOT_PACKAGED");
   const root2 = privateDir2(join10(home, ".local", "share", "sberpay-diagnostic"));
   const skill = join10(home, ".agents", "skills", "sberpay-diagnostic");
   const markerPath = join10(root2, "installed.json");
@@ -22319,9 +22475,9 @@ async function installLocked(source2, home, options) {
     try {
       for (const [path] of entries) {
         const target = join10(staged, path);
-        await mkdir4(dirname5(target), { recursive: true, mode: 448 });
+        await mkdir4(dirname6(target), { recursive: true, mode: 448 });
         await cp(join10(packageRoot, path), target, { force: false, errorOnExist: true });
-        await chmod(target, /^helpers\/[^/]+\/sberpay-(se|tpm)$/.test(path) ? 448 : 384);
+        await chmod(target, /^helpers\/[^/]+\/sberpay-(se|tpm)(\.exe)?$/.test(path) ? 448 : 384);
       }
       await rename6(staged, release);
     } finally {
@@ -22337,11 +22493,12 @@ async function installLocked(source2, home, options) {
     if (error62.code !== "ENOENT") throw error62;
   }
   if (hasInvitation) {
-    const invitationFile = await open6(join10(source2, "invitation.json"), constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+    const invitationFile = await open7(join10(source2, "invitation.json"), constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
     try {
       const info = await invitationFile.stat();
       if (!info.isFile() || process.getuid && info.uid !== process.getuid()) throw Error("UNSAFE_INVITATION");
-      await invitationFile.chmod(384);
+      if (process.platform === "win32") assertWindowsPrivatePath(join10(source2, "invitation.json"));
+      else await invitationFile.chmod(384);
     } finally {
       await invitationFile.close();
     }
@@ -22385,11 +22542,14 @@ process.env.SBERPAY_DIAGNOSTIC_CAPTURE="1";
 await import(${JSON.stringify(pathToFileURL(join10(release, "bin", "sberpay-cli.mjs")).href)});
 `;
   const original = await readFile2(join10(release, "skill", "sberpay", "SKILL.md"), "utf8");
-  const text = original.replaceAll("{{diagnosticLauncher}}", shellQuote(launcher));
-  await mkdir4(dirname5(skill), { recursive: true, mode: 448 });
-  await mkdir4(skill, { mode: 448 }).catch((e) => {
-    if (e.code !== "EEXIST") throw e;
-  });
+  const text = renderDiagnosticSkill(original, process.platform, launcher, process.execPath);
+  if (process.platform === "win32") privateDir2(skill);
+  else {
+    await mkdir4(dirname6(skill), { recursive: true, mode: 448 });
+    await mkdir4(skill, { mode: 448 }).catch((e) => {
+      if (e.code !== "EEXIST") throw e;
+    });
+  }
   const managed = [{ path: paymentModeFile, text: JSON.stringify(modeState), mode: 384 }, { path: launcher, text: launcherText, mode: 448 }, { path: join10(skill, "SKILL.md"), text, mode: 384 }];
   for (const [path] of entries) {
     if (!path.startsWith("skill/sberpay/") || path === "skill/sberpay/SKILL.md") continue;
@@ -22420,7 +22580,7 @@ await import(${JSON.stringify(pathToFileURL(join10(release, "bin", "sberpay-cli.
     }
     managed.push({ path: target, text: await readFile2(join10(release, path), "utf8"), mode: 384 });
   }
-  const skillFiles = Object.fromEntries(managed.filter((f) => f.path.startsWith(skill + "/")).map((f) => [relative(skill, f.path), hash3(f.text)]));
+  const skillFiles = skillFileHashes(skill, managed);
   const marker = { buildId: manifest.buildId, stateFormat: 2, skillHash: hash3(text), skillFiles, launcher, profile };
   let sender;
   await applyInstallFiles(root2, manifest.buildId, managed, async () => {
@@ -22432,7 +22592,7 @@ await import(${JSON.stringify(pathToFileURL(join10(release, "bin", "sberpay-cli.
 }
 
 // scripts/diagnostics/npm-entry.mts
-var source = dirname6(dirname6(fileURLToPath2(import.meta.url)));
+var source = dirname7(dirname7(fileURLToPath2(import.meta.url)));
 var root = join11(homedir4(), ".local/share/sberpay-diagnostic");
 try {
   if (process.argv[2] === "setup") {