claude-code-session-manager 0.104.2 → 0.106.0

package/src/main/lib/customerFeedbackInbox.cjs

@@ -0,0 +1,286 @@
+// @ts-check
+/**
+ * customerFeedbackInbox — OWNER side of customer feedback.
+ *
+ * With an owner token configured (env SM_FEEDBACK_OWNER_TOKEN or
+ * ~/.claude/session-manager/customer-feedback-owner.json) this machine incrementally pulls every
+ * submission for the session-manager slug from bilko.run into a local mirror, sets item status on
+ * the host, and records which local Epic an item became. No token = customer machine (ownerMode
+ * false). The token is only ever sent as a bearer header and never appears in errors or the mirror.
+ */
+'use strict';
+
+const path = require('node:path');
+const fsp = require('node:fs/promises');
+const atomicFs = require('./atomicFs.cjs');
+const schedulerPaths = require('./schedulerPaths.cjs');
+const { resolveFeedbackBase, fromWireType, FEEDBACK_SLUG } = require('./customerFeedbackClient.cjs');
+
+const STATUSES = /** @type {const} */ (['open', 'in_progress', 'resolved', 'wontfix']);
+const MAX_NOTE = 500;
+const MAX_ITEMS = 2000;
+const PAGE_LIMIT = 500;
+const MAX_PAGES = 10;
+const TIMEOUT_MS = 15000;
+const SCHEMA_VERSION = 1;
+const NO_TOKEN = 'Feedback owner token not configured';
+const NO_STATUS_SUPPORT = 'Host does not support feedback status yet (or unknown id)';
+const HIDDEN = new Set(['archived', 'deleted']);
+
+/**
+ * @typedef {{ id: string, receivedAt: string|number|null, tag: string, title: string, body: string,
+ *   clientVersion: string|null, clientPlatform: string|null, moderation: string|null, status: string,
+ *   statusNote: string|null, statusAt: string|number|null, epicId: string|null }} InboxItem
+ * @typedef {{ items: InboxItem[], nextSince: string|null, nextModeratedSince: string|null }} Store
+ * @typedef {{ fetchImpl?: typeof fetch, storeFile?: string, ownerFile?: string,
+ *   env?: Record<string, string|undefined>, now?: () => number }} Deps
+ */
+
+/** @param {Deps} [deps] */
+function ctx(deps) {
+  const d = deps || {};
+  return {
+    fetchImpl: d.fetchImpl || globalThis.fetch,
+    storeFile: d.storeFile || path.join(schedulerPaths.schedulerHome(), 'customer-feedback-inbox.json'),
+    ownerFile: d.ownerFile || path.join(schedulerPaths.schedulerHome(), 'customer-feedback-owner.json'),
+    env: d.env || process.env,
+    now: d.now || Date.now,
+  };
+}
+
+/** @param {Deps} [deps] @returns {{ token: string, projectCwd: string|null }|null} */
+function loadOwnerConfig(deps) {
+  const c = ctx(deps);
+  const envToken = (c.env.SM_FEEDBACK_OWNER_TOKEN || '').trim();
+  if (envToken) return { token: envToken, projectCwd: c.env.SM_FEEDBACK_OWNER_PROJECT_CWD || null };
+  try {
+    const j = JSON.parse(require('node:fs').readFileSync(c.ownerFile, 'utf8'));
+    const token = j && typeof j.token === 'string' ? j.token.trim() : '';
+    if (token) return { token, projectCwd: typeof j.projectCwd === 'string' && j.projectCwd ? j.projectCwd : null };
+  } catch { /* missing or corrupt = not an owner */ }
+  return null;
+}
+
+/** Never includes the token. @param {Deps} [deps] */
+function getOwnerInfo(deps) {
+  const cfg = loadOwnerConfig(deps);
+  return { ownerMode: !!cfg, projectCwd: cfg ? cfg.projectCwd : null };
+}
+
+/** @param {string} file @returns {Promise<Store>} */
+async function readStore(file) {
+  try {
+    const j = JSON.parse(await fsp.readFile(file, 'utf8'));
+    if (j && Array.isArray(j.items)) {
+      return {
+        items: j.items.filter((/** @type {unknown} */ i) => i && typeof i === 'object'),
+        nextSince: typeof j.nextSince === 'string' ? j.nextSince : null,
+        nextModeratedSince: typeof j.nextModeratedSince === 'string' ? j.nextModeratedSince : null,
+      };
+    }
+  } catch { /* missing or corrupt reads as empty */ }
+  return { items: [], nextSince: null, nextModeratedSince: null };
+}
+
+let writeQueue = Promise.resolve();
+/**
+ * Serialized read-modify-write over the mirror.
+ * @template T
+ * @param {string} file
+ * @param {(s: Store) => T} mutate mutates the store in place, returns a result
+ * @returns {Promise<T>}
+ */
+function mutateStore(file, mutate) {
+  const run = async () => {
+    const store = await readStore(file);
+    const result = mutate(store);
+    store.items = sortItems(store.items).slice(0, MAX_ITEMS);
+    await atomicFs.writeJsonAtomic(file, { schemaVersion: SCHEMA_VERSION, ...store }, { mode: 0o600 });
+    return result;
+  };
+  const tail = writeQueue.then(run, run);
+  writeQueue = tail.then(() => {}, () => {});
+  return tail;
+}
+
+/** @param {InboxItem[]} items */
+function sortItems(items) {
+  const t = (/** @type {InboxItem} */ i) => (i.receivedAt == null ? 0 : (typeof i.receivedAt === 'number' ? i.receivedAt : Date.parse(i.receivedAt) || 0));
+  return items.slice().sort((a, b) => t(b) - t(a));
+}
+
+/** @param {string} s @param {string} token */
+function redact(s, token) {
+  return token ? s.split(token).join('[redacted]') : s;
+}
+
+/** @param {unknown} e @param {string} token */
+function netError(e, token) {
+  return `Could not reach the feedback service: ${redact(e instanceof Error ? e.message : String(e), token)}`;
+}
+
+/** @param {Response} res @param {string} fallback */
+async function errorText(res, fallback) {
+  try {
+    /** @type {any} */
+    const j = await res.json();
+    if (j && typeof j.error === 'string' && j.error) return j.error;
+  } catch { /* no body */ }
+  return fallback;
+}
+
+/** @param {number} status */
+function httpError(status) {
+  if (status === 401) return 'Feedback owner token was rejected (401).';
+  if (status === 503) return 'Host has no feedback owner token configured (503).';
+  return `Feedback service returned ${status}.`;
+}
+
+/** @param {any} w @param {InboxItem|undefined} prev @returns {InboxItem} */
+function toItem(w, prev) {
+  const client = w.client && typeof w.client === 'object' ? w.client : {};
+  const st = w.status && typeof w.status === 'object' ? w.status : null;
+  return {
+    id: w.id,
+    receivedAt: w.receivedAt ?? null,
+    tag: fromWireType(String(w.type)),
+    title: String(w.title ?? ''),
+    body: String(w.description ?? ''),
+    clientVersion: typeof client.version === 'string' ? client.version : null,
+    clientPlatform: typeof client.platform === 'string' ? client.platform : null,
+    moderation: w.moderation && typeof w.moderation.action === 'string' ? w.moderation.action : null,
+    status: st && typeof st.value === 'string' ? st.value : 'open',
+    statusNote: st && typeof st.note === 'string' ? st.note : null,
+    statusAt: st ? (st.at ?? null) : null,
+    epicId: prev && prev.epicId ? prev.epicId : null,
+  };
+}
+
+/**
+ * @param {Deps} [deps]
+ * @returns {Promise<{ ok: true, fetched: number, pages: number } | { ok: false, error: string }>}
+ */
+async function pull(deps) {
+  const cfg = loadOwnerConfig(deps);
+  if (!cfg) return { ok: false, error: NO_TOKEN };
+  const c = ctx(deps);
+  const base = `${resolveFeedbackBase()}/api/projects/${FEEDBACK_SLUG}/feedback`;
+  const prior = await readStore(c.storeFile);
+  let since = prior.nextSince;
+  let moderatedSince = prior.nextModeratedSince;
+  /** @type {any[]} */
+  const fetched = [];
+  let pages = 0;
+  try {
+    for (; pages < MAX_PAGES;) {
+      const qs = new URLSearchParams();
+      if (since) qs.set('since', since);
+      if (moderatedSince) qs.set('moderatedSince', moderatedSince);
+      qs.set('images', 'none');
+      qs.set('limit', String(PAGE_LIMIT));
+      const res = await c.fetchImpl(`${base}?${qs.toString()}`, {
+        headers: { authorization: `Bearer ${cfg.token}` },
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+      });
+      if (!res.ok) return { ok: false, error: await errorText(res, httpError(res.status)) };
+      /** @type {any} */
+      const j = await res.json().catch(() => null);
+      if (!j || !Array.isArray(j.items)) return { ok: false, error: 'Feedback service returned an unexpected response.' };
+      pages++;
+      fetched.push(...j.items.filter((/** @type {any} */ i) => i && typeof i.id === 'string' && i.id));
+      if (typeof j.nextSince === 'string') since = j.nextSince;
+      if (typeof j.nextModeratedSince === 'string') moderatedSince = j.nextModeratedSince;
+      if (j.items.length < PAGE_LIMIT) break;
+    }
+  } catch (e) {
+    return { ok: false, error: netError(e, cfg.token) };
+  }
+  const finalSince = since;
+  const finalModerated = moderatedSince;
+  await mutateStore(c.storeFile, (store) => {
+    const byId = new Map(store.items.map((i) => [i.id, i]));
+    for (const w of fetched) byId.set(w.id, toItem(w, byId.get(w.id)));
+    store.items = [...byId.values()];
+    store.nextSince = finalSince;
+    store.nextModeratedSince = finalModerated;
+  });
+  return { ok: true, fetched: fetched.length, pages };
+}
+
+/**
+ * @param {{ includeHidden?: boolean }} [opts] @param {Deps} [deps]
+ * @returns {Promise<{ ok: true, items: InboxItem[] } | { ok: false, error: string }>}
+ */
+async function list(opts, deps) {
+  if (!loadOwnerConfig(deps)) return { ok: false, error: NO_TOKEN };
+  const store = await readStore(ctx(deps).storeFile);
+  const includeHidden = !!(opts && opts.includeHidden);
+  const items = sortItems(store.items).filter((i) => includeHidden || !(i.moderation && HIDDEN.has(i.moderation)));
+  return { ok: true, items };
+}
+
+/**
+ * @param {string} id @param {string} status @param {string} [note] @param {Deps} [deps]
+ * @returns {Promise<{ ok: true, item: InboxItem|null } | { ok: false, error: string }>}
+ */
+async function setStatus(id, status, note, deps) {
+  const cfg = loadOwnerConfig(deps);
+  if (!cfg) return { ok: false, error: NO_TOKEN };
+  if (typeof id !== 'string' || !id) return { ok: false, error: 'Feedback id is required.' };
+  if (!STATUSES.includes(/** @type {any} */ (status))) return { ok: false, error: `Status must be one of: ${STATUSES.join(', ')}.` };
+  if (note !== undefined && note !== null && (typeof note !== 'string' || note.length > MAX_NOTE)) {
+    return { ok: false, error: `Note must be ${MAX_NOTE} characters or fewer.` };
+  }
+  const c = ctx(deps);
+  try {
+    const res = await c.fetchImpl(`${resolveFeedbackBase()}/api/projects/${FEEDBACK_SLUG}/feedback/${encodeURIComponent(id)}/status`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', authorization: `Bearer ${cfg.token}` },
+      body: JSON.stringify(note ? { status, note } : { status }),
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    if (res.status === 404) return { ok: false, error: NO_STATUS_SUPPORT };
+    if (res.status !== 200) return { ok: false, error: await errorText(res, httpError(res.status)) };
+    /** @type {any} */
+    const j = await res.json().catch(() => null);
+    const statusAt = j && j.statusAt != null ? j.statusAt : c.now();
+    const item = await mutateStore(c.storeFile, (store) => {
+      const it = store.items.find((i) => i.id === id);
+      if (!it) return null;
+      it.status = status;
+      it.statusNote = note || null;
+      it.statusAt = statusAt;
+      return it;
+    });
+    return { ok: true, item };
+  } catch (e) {
+    return { ok: false, error: netError(e, cfg.token) };
+  }
+}
+
+/**
+ * Local-only: record which Epic an item was turned into.
+ * @param {string} id @param {string} epicId @param {Deps} [deps]
+ * @returns {Promise<{ ok: true } | { ok: false, error: string }>}
+ */
+async function linkEpic(id, epicId, deps) {
+  if (!loadOwnerConfig(deps)) return { ok: false, error: NO_TOKEN };
+  if (typeof epicId !== 'string' || !epicId) return { ok: false, error: 'Epic id is required.' };
+  const found = await mutateStore(ctx(deps).storeFile, (store) => {
+    const it = store.items.find((i) => i.id === id);
+    if (!it) return false;
+    it.epicId = epicId;
+    return true;
+  });
+  return found ? { ok: true } : { ok: false, error: 'Unknown feedback id.' };
+}
+
+module.exports = {
+  STATUSES,
+  loadOwnerConfig,
+  getOwnerInfo,
+  pull,
+  list,
+  setStatus,
+  linkEpic,
+};

package/src/main/lib/customerFeedbackIpc.cjs

@@ -0,0 +1,43 @@
+// @ts-check
+'use strict';
+
+const REFRESH_DELAY_MS = 30_000;
+
+/**
+ * Renderer-facing IPC for the customer-feedback client + owner inbox.
+ * Handlers return the libs' `{ ok, ... }` results unchanged.
+ * @param {{ ipcMain?: any, client?: any, inbox?: any, setTimeoutImpl?: typeof setTimeout }} [deps]
+ */
+function registerCustomerFeedbackHandlers(deps = {}) {
+  const ipcMain = deps.ipcMain || require('electron').ipcMain;
+  const { schemas: s, validated: v } = require('../ipcSchemas.cjs');
+  const client = deps.client || require('./customerFeedbackClient.cjs');
+  const inbox = deps.inbox || require('./customerFeedbackInbox.cjs');
+  const timer = deps.setTimeoutImpl || setTimeout;
+
+  ipcMain.handle('customerFeedback:submit', v(s.customerFeedbackSubmit, (p) => client.submit(p)));
+  ipcMain.handle('customerFeedback:list', () => client.list());
+  ipcMain.handle('customerFeedback:refresh-status', () => client.refreshStatuses());
+  ipcMain.handle('customerFeedback:mark-seen', v(s.customerFeedbackMarkSeen, ({ ids }) => client.markSeen(ids)));
+  ipcMain.handle('customerFeedback:owner-info', () => inbox.getOwnerInfo());
+  ipcMain.handle('customerFeedback:inbox-pull', () => inbox.pull());
+  ipcMain.handle('customerFeedback:inbox-list', v(s.customerFeedbackInboxList, ({ includeHidden }) => inbox.list({ includeHidden })));
+  ipcMain.handle('customerFeedback:inbox-set-status', v(s.customerFeedbackInboxSetStatus, ({ id, status, note }) => inbox.setStatus(id, status, note)));
+  ipcMain.handle('customerFeedback:inbox-link-epic', v(s.customerFeedbackInboxLinkEpic, ({ id, epicId }) => inbox.linkEpic(id, epicId)));
+
+  // One-shot deferred refresh so users see resolutions without opening anything.
+  try {
+    const t = timer(() => {
+      Promise.resolve()
+        .then(() => client.refreshStatuses())
+        .catch((/** @type {any} */ e) => {
+          console.warn('[customerFeedback] boot status refresh failed:', e && e.name ? e.name : 'error');
+        });
+    }, REFRESH_DELAY_MS);
+    if (t && typeof t.unref === 'function') t.unref();
+  } catch {
+    /* never throw at boot */
+  }
+}
+
+module.exports = { registerCustomerFeedbackHandlers, REFRESH_DELAY_MS };

package/src/main/lib/defaultShell.cjs

@@ -0,0 +1,36 @@
+'use strict';
+
+const path = require('node:path');
+
+/**
+ * Pick the interactive shell for a terminal tab. Pure: every host fact comes in
+ * through `platform` / `env` / `exists` so it is testable for any OS.
+ *
+ * win32: PowerShell 7 (`pwsh.exe`) when found on PATH or under
+ * %ProgramFiles%\PowerShell\7, else the Windows PowerShell 5.1 that ships with
+ * every install. POSIX: `$SHELL` (or /bin/bash) as an interactive login shell.
+ *
+ * @param {{ platform: string, env: Record<string, string | undefined>, exists: (p: string) => boolean }} opts
+ * @returns {{ file: string, args: string[] }}
+ */
+function defaultShell({ platform, env, exists }) {
+  if (platform !== 'win32') {
+    return { file: env.SHELL || '/bin/bash', args: ['-il'] };
+  }
+  const w = path.win32;
+  const pathDirs = (env.PATH || env.Path || '').split(';').filter(Boolean);
+  const programFiles = env.ProgramFiles || 'C:\\Program Files';
+  const candidates = [
+    ...pathDirs.map((d) => w.join(d, 'pwsh.exe')),
+    w.join(programFiles, 'PowerShell', '7', 'pwsh.exe'),
+  ];
+  const pwsh = candidates.find((p) => exists(p));
+  if (pwsh) return { file: pwsh, args: ['-NoLogo'] };
+  const systemRoot = env.SystemRoot || env.windir || 'C:\\Windows';
+  return {
+    file: w.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+    args: ['-NoLogo'],
+  };
+}
+
+module.exports = { defaultShell };

package/src/main/lib/definitionOfDone.cjs

@@ -16,6 +16,7 @@ const { splitFrontmatter } = require('./prdFrontmatter.cjs');
 const { resolvePrdWriteDir } = require('./prdLocations.cjs');
 const schedulerPaths = require('./schedulerPaths.cjs');
 const atomicFs = require('./atomicFs.cjs');
+const { resolveSpawn } = require('./winSpawn.cjs');
 
 // Regex identifying meta/dod slugs that must NOT influence the batchKey.
 // This is the load-bearing loop-avoidance filter: when the gate job itself
@@ -771,10 +772,13 @@ function runOneGateCommand(cmd, { cwd, env }) {
     const label = cmd.argv.join(' ');
     let child;
     try {
-      child = spawn(cmd.argv[0], cmd.argv.slice(1), {
+      const childEnv = { ...env, ...cmd.env };
+      const sp = resolveSpawn(cmd.argv[0], cmd.argv.slice(1), { env: childEnv });
+      child = spawn(sp.command, sp.args, {
         cwd,
-        env: { ...env, ...cmd.env },
+        env: childEnv,
         stdio: ['ignore', 'pipe', 'pipe'],
+        ...(sp.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
         // No shell:true — the sequence was tokenized by tokenizeNoShell.
       });
     } catch {

package/src/main/lib/delegationReadiness.cjs

@@ -24,6 +24,7 @@ const { writeJson, addAllowedRoot } = require('../config.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./cleanEnv.cjs');
 const { shimPath: guardShimPath, resolveShimTarget, ensureGuardShimsOrError } = require('./guardShims.cjs');
 const { resolveProjectRoot } = require('./opsOwnership.cjs');
+const { nodeShellCommand } = require('./appRuntime.cjs');
 
 const SCHEDULER_MCP_NAME = 'session-manager-scheduler';
 const DEV_PLUGIN_ENABLED_KEY = 'session-manager-dev@session-manager';
@@ -49,7 +50,14 @@ function readJsonSafe(absPath, fallback) {
   }
 }
 
-const SCHEDULER_MCP_FIX_CMD = `claude mcp add ${SCHEDULER_MCP_NAME} --scope user -- node ${SCHEDULER_MCP_SERVER_SCRIPT}`;
+/** Lazy (not a module-load constant) so tests can toggle packaged mode. */
+function schedulerMcpFixCmd() {
+  const cmd = nodeShellCommand(SCHEDULER_MCP_SERVER_SCRIPT);
+  const m = /^ELECTRON_RUN_AS_NODE=1 (.*)$/.exec(cmd);
+  return m
+    ? `claude mcp add ${SCHEDULER_MCP_NAME} --scope user -e ELECTRON_RUN_AS_NODE=1 -- ${m[1]}`
+    : `claude mcp add ${SCHEDULER_MCP_NAME} --scope user -- ${cmd}`;
+}
 
 /**
  * `ok` must mean "an agent in this project can actually reach a working
@@ -79,7 +87,7 @@ function checkSchedulerMcp({ cwd, homeDir }) {
         detail: !isAbsolute
           ? `user-scope ${SCHEDULER_MCP_NAME} registration points at a non-absolute script path (${scriptArg})`
           : `user-scope ${SCHEDULER_MCP_NAME} registration points at a script that no longer exists (${scriptArg})`,
-        fix: SCHEDULER_MCP_FIX_CMD,
+        fix: schedulerMcpFixCmd(),
       };
     }
     return {
@@ -106,7 +114,7 @@ function checkSchedulerMcp({ cwd, homeDir }) {
     label: 'Scheduler MCP server registered',
     ok: false,
     detail: `no ${SCHEDULER_MCP_NAME} entry in ~/.claude.json or ${cwd}/.mcp.json`,
-    fix: SCHEDULER_MCP_FIX_CMD,
+    fix: schedulerMcpFixCmd(),
   };
 }
 
@@ -476,7 +484,7 @@ function checkGuard(def, { cwd, homeDir = os.homedir() }) {
     detail,
     fix: ok
       ? null
-      : `Add a PreToolUse hook to ${cwd}/.claude/settings.json matching ${def.matcher} that runs node ${guardShimPath(def.scriptBasename, homeDir)}${def.nudge ? ' (a nudge, not a hard gate)' : ''}`,
+      : `Add a PreToolUse hook to ${cwd}/.claude/settings.json matching ${def.matcher} that runs ${nodeShellCommand(guardShimPath(def.scriptBasename, homeDir))}${def.nudge ? ' (a nudge, not a hard gate)' : ''}`,
     fixAction: ok ? null : def.fixActionId,
   };
 }
@@ -549,7 +557,7 @@ async function installGuard(def, { cwd, homeDir = os.homedir(), skipShimEnsure =
   }
   const settings = (existing && typeof existing === 'object' && !Array.isArray(existing)) ? existing : {};
 
-  const command = `node ${guardShimPath(def.scriptBasename, homeDir)}`;
+  const command = nodeShellCommand(guardShimPath(def.scriptBasename, homeDir));
   const hooks = (settings.hooks && typeof settings.hooks === 'object') ? settings.hooks : {};
   const preToolUse = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse.slice() : [];
 

package/src/main/lib/gitWorktree.cjs

@@ -1422,14 +1422,16 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths, baseBranc
 
   try {
     await execGit(['merge', '--ff-only', branch], { cwd, timeout: 30_000 });
-    return { ok: true, integrated: true, fastForward: true };
+    // The branch tip we fast-forwarded to, read from the branch ref (not HEAD,
+    // which a concurrent writer may already have moved).
+    return { ok: true, integrated: true, fastForward: true, sha: await tryResolveCommit(cwd, `${branch}^{commit}`) };
   } catch {
     // Main tree advanced since the worktree branched (a sibling job/Epic
     // merged first) — a real merge commit still lands the branch's commit(s).
   }
   try {
     await execGit(['merge', '--no-ff', '--no-edit', '-m', mergeMessage, branch], { cwd, timeout: 30_000 });
-    return { ok: true, integrated: true, mergeCommit: true };
+    return { ok: true, integrated: true, mergeCommit: true, sha: await readHeadSha(cwd) };
   } catch (e) {
     const stderrText = (e && (e.stderrText || e.message)) || String(e);
     // git refuses this class of merge before ever touching MERGE_HEAD, so
@@ -1452,6 +1454,7 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths, baseBranc
             ok: true,
             integrated: true,
             mergeCommit: true,
+            sha: await readHeadSha(cwd),
             autoResolved: 'identical_working_tree_duplicates',
             resolvedPaths: allPaths,
           };
@@ -1479,7 +1482,7 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths, baseBranc
           await resolveByConcatenation({ cwd, paths });
           await execGit(['add', ...paths], { cwd, timeout: 30_000 });
           await execGit(['commit', '-m', mergeMessage], { cwd, timeout: 30_000 });
-          return { ok: true, integrated: true, mergeCommit: true, autoResolved: 'pure_addition_concat', resolvedPaths: paths };
+          return { ok: true, integrated: true, mergeCommit: true, sha: await readHeadSha(cwd), autoResolved: 'pure_addition_concat', resolvedPaths: paths };
         }
       } catch { /* fall through to the abort */ }
     }

package/src/main/lib/insideHome.cjs

@@ -19,7 +19,8 @@
  * resolved at startup we keep going with the literal value — boot-time
  * self-check in index.cjs surfaces that to the user.
  *
- * Linux + darwin only. No Windows path handling.
+ * win32: containment compares lower-cased, path.win32-normalized paths; UNC
+ * (`\\server\share`) and `\\?\` paths are always outside home.
  */
 'use strict';
 
@@ -52,8 +53,18 @@ function resolveTarget(p) {
   }
 }
 
-function isContained(realPath) {
-  return realPath === HOME_REAL || realPath.startsWith(HOME_REAL + path.sep);
+function isContainedWin32(target, home) {
+  // UNC and \\?\ / \\.\ prefixes can alias any location — never inside home.
+  if (/^[\\/]{2}/.test(target)) return false;
+  const strip = (v) => path.win32.normalize(v).toLowerCase().replace(/[\\/]+$/, '');
+  const t = strip(target);
+  const h = strip(home);
+  return t === h || t.startsWith(h + '\\');
+}
+
+function isContained(realPath, home = HOME_REAL, platform = process.platform) {
+  if (platform === 'win32') return isContainedWin32(realPath, home);
+  return realPath === home || realPath.startsWith(home + path.posix.sep);
 }
 
 function assertInsideHome(p) {
@@ -88,4 +99,4 @@ function checkInsideHome(p) {
   return { ok: true, realPath };
 }
 
-module.exports = { assertInsideHome, checkInsideHome };
+module.exports = { assertInsideHome, checkInsideHome, isContained };

package/src/main/lib/killTree.cjs

@@ -0,0 +1,80 @@
+'use strict';
+
+/**
+ * killTree.cjs — cross-platform "kill this child and its descendants" plus the
+ * matching spawn options for children we intend to kill that way.
+ *
+ * POSIX: children are spawned `detached: true` so they lead their own process
+ * group, and `process.kill(-pid, sig)` signals the whole group.
+ * win32: no process groups; `taskkill /PID <pid> /T /F` kills the tree.
+ */
+
+const { execFile: nodeExecFile } = require('node:child_process');
+
+/**
+ * @typedef {object} KillTreeOpts
+ * @property {string} [platform]  defaults to process.platform
+ * @property {(pid: number, signal?: string | number) => unknown} [kill]  defaults to process.kill
+ * @property {(file: string, args: string[], options: object, cb: (err: Error | null) => void) => unknown} [execFile]
+ * @property {(msg: string) => void} [log]  receives taskkill failure messages
+ */
+
+/**
+ * Kill `pid` and its descendants. Never throws.
+ *
+ * Return contract (deliberately synchronous on every platform so POSIX callers
+ * keep their existing control flow):
+ *  - POSIX: true when a signal was delivered (group first, then the bare pid if
+ *    the group kill threw ESRCH/EPERM), false otherwise.
+ *  - win32: taskkill is started fire-and-forget and true is returned
+ *    immediately when it was launched; its eventual non-zero exit is reported
+ *    through `opts.log`, not the return value. The signal is ignored — taskkill
+ *    /F is always forceful.
+ *
+ * @param {number} pid
+ * @param {string | number} [signal]
+ * @param {KillTreeOpts} [opts]
+ * @returns {boolean}
+ */
+function killTree(pid, signal, opts = {}) {
+  const platform = opts.platform || process.platform;
+  const log = typeof opts.log === 'function' ? opts.log : () => {};
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+
+  if (platform === 'win32') {
+    const execFile = opts.execFile || nodeExecFile;
+    try {
+      execFile('taskkill', ['/PID', String(pid), '/T', '/F'], { windowsHide: true }, (err) => {
+        if (err) {
+          try { log(`[killTree] taskkill /PID ${pid} failed: ${err.message}\n`); } catch { /* log must not throw */ }
+        }
+      });
+      return true;
+    } catch (e) {
+      try { log(`[killTree] taskkill spawn failed: ${e && e.message}\n`); } catch { /* log must not throw */ }
+      return false;
+    }
+  }
+
+  const kill = opts.kill || process.kill.bind(process);
+  try { kill(-pid, signal); return true; } catch (e) {
+    const code = e && e.code;
+    if (code !== 'ESRCH' && code !== 'EPERM') return false;
+  }
+  try { kill(pid, signal); return true; } catch { return false; }
+}
+
+/**
+ * spawn() options for a child that killTree() will later kill.
+ * `detached` makes it a process-group leader on POSIX; on win32 it would open a
+ * console window unless `windowsHide` is set.
+ *
+ * @param {{ platform?: string }} [opts]
+ * @returns {{ detached: true, windowsHide?: true }}
+ */
+function detachedSpawnOpts(opts = {}) {
+  const platform = opts.platform || process.platform;
+  return platform === 'win32' ? { detached: true, windowsHide: true } : { detached: true };
+}
+
+module.exports = { killTree, detachedSpawnOpts };

package/src/main/lib/loadGate.cjs

@@ -116,6 +116,7 @@ function createLoadGate({
   auditIntervalMs = AUDIT_INTERVAL_MS,
   escalateAfterMs = JOB_OVERRUN_FLOOR_MS,
   releaseWindowMs = RELEASE_WINDOW_MS,
+  platform = process.platform,
 } = {}) {
   let lastAuditAt = null; // null = never audited; the first gated tick always audits
   let gatedSince = null;
@@ -124,6 +125,21 @@ function createLoadGate({
 
   function evaluate({ bypass = false } = {}) {
     const t = now();
+    if (platform === 'win32') {
+      // os.loadavg() is always [0,0,0] on Windows — the gate is open, not computed.
+      last = {
+        gated: false,
+        bypassed: false,
+        ratio: 0,
+        threshold: typeof threshold === 'function' ? threshold() : threshold,
+        loadavg1: null,
+        cores: cores(),
+        gatedSinceMs: 0,
+        reason: 'loadavg-unavailable-win32',
+        at: new Date(t).toISOString(),
+      };
+      return { ...last, shouldAudit: false, escalate: false };
+    }
     const [l1] = loadavg();
     const c = cores();
     const th = typeof threshold === 'function' ? threshold() : threshold;