karajan-code 1.36.1 → 1.38.0

package/src/prompts/hu-reviewer.js

@@ -131,6 +131,61 @@ export function normalizeAcceptanceCriteria(criteria) {
   return criteria.map(detectAcFormat);
 }
 
+/**
+ * Build a prompt that asks the AI to decompose a complex task into 2-5 formal HUs.
+ * Each HU follows the role/goal/benefit format with acceptance criteria and optional dependencies.
+ * @param {string} task - The complex task description to decompose.
+ * @returns {string} The assembled decomposition prompt.
+ */
+export function buildDecompositionPrompt(task) {
+  const sections = [SUBAGENT_PREAMBLE];
+
+  sections.push("## Task Decomposition");
+  sections.push(
+    "You are a senior product owner. Decompose the following complex task into 2-5 independent, implementable user stories (HUs).",
+    "Each HU must be small enough to implement in a single iteration and must follow the role/goal/benefit format."
+  );
+
+  sections.push(`## Task to Decompose\n${task}`);
+
+  sections.push(
+    "Return a single valid JSON object and nothing else.",
+    `JSON schema: {"stories":[{"id":string,"title":string,"role":string,"goal":string,"benefit":string,"acceptanceCriteria":[string],"dependsOn":[string]}]}`,
+    "Rules:",
+    "- Generate between 2 and 5 HUs",
+    "- Each id must be unique, formatted as HU-DECOMP-NNN (e.g. HU-DECOMP-001)",
+    "- dependsOn is an array of other HU ids from this decomposition that must be completed first (empty array if no dependencies)",
+    "- acceptanceCriteria should be concrete, testable statements",
+    "- Order stories so that dependencies are respected (a story should only depend on stories with lower ids)"
+  );
+
+  return sections.join("\n\n");
+}
+
+/**
+ * Parse the output from a decomposition prompt.
+ * @param {string} raw - Raw text output from the agent.
+ * @returns {Array<{id: string, title: string, role: string, goal: string, benefit: string, acceptanceCriteria: string[], dependsOn: string[]}>|null}
+ */
+export function parseDecompositionOutput(raw) {
+  const parsed = extractFirstJson(raw);
+  if (!parsed || !Array.isArray(parsed.stories)) return null;
+
+  const stories = parsed.stories
+    .filter(s => s && s.id && s.title)
+    .map(s => ({
+      id: s.id,
+      title: s.title,
+      role: s.role || "developer",
+      goal: s.goal || s.title,
+      benefit: s.benefit || "",
+      acceptanceCriteria: Array.isArray(s.acceptanceCriteria) ? s.acceptanceCriteria : [],
+      dependsOn: Array.isArray(s.dependsOn) ? s.dependsOn : []
+    }));
+
+  return stories.length > 0 ? stories : null;
+}
+
 /**
  * Parse the raw output from the HU reviewer agent.
  * @param {string} raw - Raw text output from the agent.

package/src/prompts/triage.js

@@ -11,7 +11,8 @@ const ROLE_DESCRIPTIONS = [
   { role: "security", description: "Audits code for security vulnerabilities. Checks auth, input validation, injection risks." },
   { role: "refactorer", description: "Cleans up and refactors code after the main implementation." },
   { role: "reviewer", description: "Reviews the code diff for quality issues. Standard quality gate." },
-  { role: "architect", description: "Designs solution architecture — layers, patterns, data model, API contracts, tradeoffs. Activate when task creates new module/app, affects data model/APIs, complexity is medium/complex, or design is ambiguous." }
+  { role: "architect", description: "Designs solution architecture — layers, patterns, data model, API contracts, tradeoffs. Activate when task creates new module/app, affects data model/APIs, complexity is medium/complex, or design is ambiguous." },
+  { role: "hu-reviewer", description: "Certifies user stories before coding. Activate for medium/complex tasks that need story decomposition." }
 ];
 
 export function buildTriagePrompt({ task, instructions, availableRoles }) {
@@ -37,13 +38,14 @@ export function buildTriagePrompt({ task, instructions, availableRoles }) {
       "- **refactorer**: Enable only when explicitly requested or when the task is a refactoring task.",
       "- **reviewer**: Enable for most tasks as a quality gate. Disable only for trivial, single-line changes.",
       "- **architect**: Enable when creating new modules/apps, changing data models or APIs, medium/complex tasks, or when design approach is ambiguous. Disable for simple fixes, doc-only, or CSS-only changes.",
+      "- **hu-reviewer**: Enable for medium/complex tasks that benefit from story decomposition and certification. Disable for trivial/simple tasks, doc-only, or CSS-only changes.",
       "",
       "Note: coder is ALWAYS active — you don't need to decide on it."
     ].join("\n"),
     "Classify the task complexity, determine its taskType, recommend only the necessary pipeline roles, and assess whether the task should be decomposed into smaller subtasks.",
     "Keep the reasoning short and practical.",
     "Return a single valid JSON object and nothing else.",
-    'JSON schema: {"level":"trivial|simple|medium|complex","roles":["planner|researcher|refactorer|reviewer|tester|security|architect"],"taskType":"sw|infra|doc|add-tests|refactor","reasoning":string,"shouldDecompose":boolean,"subtasks":string[]}',
+    'JSON schema: {"level":"trivial|simple|medium|complex","roles":["planner|researcher|refactorer|reviewer|tester|security|architect|hu-reviewer"],"taskType":"sw|infra|doc|add-tests|refactor","reasoning":string,"shouldDecompose":boolean,"subtasks":string[]}',
     `## Task\n${task}`
   );
 

package/src/utils/display.js

@@ -47,6 +47,20 @@ const ICONS = {
   "budget:update": "\ud83d\udcb8",
   "iteration:end": "\u23f1\ufe0f",
   "session:end": "\ud83c\udfc1",
+  "discover:start": "\ud83d\udd0e",
+  "discover:end": "\ud83d\udd0e",
+  "architect:start": "\ud83c\udfdb\ufe0f",
+  "architect:end": "\ud83c\udfdb\ufe0f",
+  "hu-reviewer:start": "\ud83d\udcdd",
+  "hu-reviewer:end": "\ud83d\udcdd",
+  "impeccable:start": "\ud83c\udfa8",
+  "impeccable:end": "\ud83c\udfa8",
+  "audit:start": "\ud83d\udccb",
+  "audit:end": "\ud83d\udccb",
+  "sonarcloud:start": "\u2601\ufe0f",
+  "sonarcloud:end": "\u2601\ufe0f",
+  "preflight:start": "\ud83d\udee1\ufe0f",
+  "preflight:end": "\ud83d\udee1\ufe0f",
   question: "\u2753"
 };
 
@@ -95,24 +109,37 @@ export function printHeader({ task, config }) {
   console.log();
 }
 
+/* ── Helper: executor/provider tag ───────────────────────────── */
+
+function formatExecutor(detail) {
+  if (!detail) return '';
+  const provider = detail.provider || '';
+  const type = detail.executorType || '';
+  if (provider) return `  ${ANSI.dim}${provider}${ANSI.reset}`;
+  if (type === 'local') return `  ${ANSI.dim}local${ANSI.reset}`;
+  if (type === 'system') return `  ${ANSI.dim}system${ANSI.reset}`;
+  return '';
+}
+
 /* ── Helper: role start/end one-liners ───────────────────────── */
 
 function roleStart(icon, label, provider) {
   console.log(`  \u251c\u2500 ${icon} ${label} (${provider || "?"}) running...`);
 }
 
-function roleEnd(status, label, elapsed) {
-  console.log(`  \u251c\u2500 ${status} ${label} completed  ${elapsed}`);
+function roleEnd(status, label, elapsed, executor) {
+  console.log(`  \u251c\u2500 ${status} ${label} completed${executor || ''}  ${elapsed}`);
 }
 
 /* ── Helper: pass/fail stage result ─────────────────────────── */
 
 function passFailStage(detail, label, failDefault, elapsed) {
+  const executor = formatExecutor(detail);
   if (detail?.ok === false) {
     const summary = detail?.summary || failDefault;
-    console.log(`  \u251c\u2500 ${ANSI.red}\u274c ${label}: ${summary}${ANSI.reset}  ${elapsed}`);
+    console.log(`  \u251c\u2500 ${ANSI.red}\u274c ${label}: ${summary}${ANSI.reset}${executor}  ${elapsed}`);
   } else {
-    console.log(`  \u251c\u2500 ${ANSI.green}\u2705 ${label}: passed${ANSI.reset}  ${elapsed}`);
+    console.log(`  \u251c\u2500 ${ANSI.green}\u2705 ${label}: passed${ANSI.reset}${executor}  ${elapsed}`);
   }
 }
 
@@ -270,49 +297,52 @@ const EVENT_HANDLERS = {
     roleStart(icon, "Planner", event.detail?.planner);
   },
 
-  "planner:end": (_event, _icon, elapsed, status) => {
-    roleEnd(status, "Planner", elapsed);
+  "planner:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Planner", elapsed, formatExecutor(event.detail));
   },
 
   "coder:start": (event, icon) => {
     roleStart(icon, "Coder", event.detail?.coder);
   },
 
-  "coder:end": (_event, _icon, elapsed, status) => {
-    roleEnd(status, "Coder", elapsed);
+  "coder:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Coder", elapsed, formatExecutor(event.detail));
   },
 
   "refactorer:start": (event, icon) => {
     roleStart(icon, "Refactorer", event.detail?.refactorer);
   },
 
-  "refactorer:end": (_event, _icon, elapsed, status) => {
-    roleEnd(status, "Refactorer", elapsed);
+  "refactorer:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Refactorer", elapsed, formatExecutor(event.detail));
   },
 
   "tdd:result": (event, icon) => {
     const tdd = event.detail || {};
     const label = tdd.ok ? `${ANSI.green}PASS${ANSI.reset}` : `${ANSI.red}FAIL${ANSI.reset}`;
     const files = tdd.sourceFiles === undefined ? "" : ` (${tdd.sourceFiles} src, ${tdd.testFiles} test)`;
-    console.log(`  \u251c\u2500 ${icon} TDD policy: ${label}${files}`);
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 ${icon} TDD policy: ${label}${files}${executor}`);
   },
 
   "researcher:start": (event, icon) => {
     console.log(`  \u251c\u2500 ${icon} Researcher (${event.detail?.researcher || "?"}) investigating...`);
   },
 
-  "researcher:end": (_event, _icon, elapsed, status) => {
-    roleEnd(status, "Researcher", elapsed);
+  "researcher:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Researcher", elapsed, formatExecutor(event.detail));
   },
 
-  "sonar:start": (_event, icon) => {
-    console.log(`  \u251c\u2500 ${icon} SonarQube scanning...`);
+  "sonar:start": (event, icon) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 ${icon} SonarQube scanning...${executor}`);
   },
 
   "sonar:end": (event, _icon, elapsed, status) => {
     const gate = event.detail?.gateStatus || "?";
     const gateColor = gate === "OK" ? ANSI.green : ANSI.red;
-    console.log(`  \u251c\u2500 ${status} Quality gate: ${gateColor}${gate}${ANSI.reset}  ${elapsed}`);
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 ${status} Quality gate: ${gateColor}${gate}${ANSI.reset}${executor}  ${elapsed}`);
   },
 
   "reviewer:start": (event, icon) => {
@@ -321,11 +351,12 @@ const EVENT_HANDLERS = {
 
   "reviewer:end": (event, _icon, elapsed) => {
     const review = event.detail || {};
+    const executor = formatExecutor(event.detail);
     if (review.approved) {
-      console.log(`  \u251c\u2500 ${ANSI.green}\u2705 Review: APPROVED${ANSI.reset}  ${elapsed}`);
+      console.log(`  \u251c\u2500 ${ANSI.green}\u2705 Review: APPROVED${ANSI.reset}${executor}  ${elapsed}`);
     } else {
       const count = review.blockingCount || 0;
-      console.log(`  \u251c\u2500 ${ANSI.red}\u274c Review: REJECTED (${count} blocking)${ANSI.reset}`);
+      console.log(`  \u251c\u2500 ${ANSI.red}\u274c Review: REJECTED (${count} blocking)${ANSI.reset}${executor}`);
       if (review.issues) {
         for (const issue of review.issues) {
           console.log(`  \u2502   ${ANSI.dim}${issue}${ANSI.reset}`);
@@ -334,16 +365,18 @@ const EVENT_HANDLERS = {
     }
   },
 
-  "tester:start": (_event, icon) => {
-    console.log(`  \u251c\u2500 ${icon} Tester evaluating...`);
+  "tester:start": (event, icon) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 ${icon} Tester evaluating...${executor}`);
   },
 
   "tester:end": (event, _icon, elapsed) => {
     passFailStage(event.detail, "Tester", "issues found", elapsed);
   },
 
-  "security:start": (_event, icon) => {
-    console.log(`  \u251c\u2500 ${icon} Security auditing...`);
+  "security:start": (event, icon) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 ${icon} Security auditing...${executor}`);
   },
 
   "security:end": (event, _icon, elapsed) => {
@@ -351,7 +384,8 @@ const EVENT_HANDLERS = {
   },
 
   "solomon:start": (event, icon) => {
-    console.log(`  \u251c\u2500 ${icon} Solomon arbitrating ${event.detail?.conflictStage || "?"} conflict...`);
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 ${icon} Solomon arbitrating ${event.detail?.conflictStage || "?"} conflict...${executor}`);
   },
 
   "solomon:end": (event, _icon, elapsed) => {
@@ -422,6 +456,82 @@ const EVENT_HANDLERS = {
     console.log(`${ANSI.dim}Resume with: kj resume ${event.sessionId} --answer "<response>"${ANSI.reset}`);
   },
 
+  "preflight:start": (event) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 \ud83d\udee1\ufe0f Preflight checks running...${executor}`);
+  },
+
+  "preflight:end": (event, _icon, elapsed) => {
+    const executor = formatExecutor(event.detail);
+    const ok = event.status === "ok";
+    const statusIcon = ok ? `${ANSI.green}\u2705` : `${ANSI.red}\u274c`;
+    console.log(`  \u251c\u2500 ${statusIcon} Preflight: ${event.message}${ANSI.reset}${executor}  ${elapsed}`);
+  },
+
+  "discover:start": (event, icon) => {
+    const provider = event.detail?.provider || event.detail?.discover || "?";
+    console.log(`  \u251c\u2500 ${icon || "\ud83d\udd0e"} Discover (${provider}) analyzing...`);
+  },
+
+  "discover:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Discover", elapsed, formatExecutor(event.detail));
+  },
+
+  "architect:start": (event) => {
+    const provider = event.detail?.provider || event.detail?.architect || "?";
+    console.log(`  \u251c\u2500 \ud83c\udfdb\ufe0f Architect (${provider}) designing...`);
+  },
+
+  "architect:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Architect", elapsed, formatExecutor(event.detail));
+  },
+
+  "hu-reviewer:start": (event) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 \ud83d\udcdd HU Reviewer certifying...${executor}`);
+  },
+
+  "hu-reviewer:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "HU Reviewer", elapsed, formatExecutor(event.detail));
+  },
+
+  "impeccable:start": (event) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 \ud83c\udfa8 Impeccable auditing design...${executor}`);
+  },
+
+  "impeccable:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Impeccable", elapsed, formatExecutor(event.detail));
+  },
+
+  "audit:start": (event) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 \ud83d\udccb Final audit running...${executor}`);
+  },
+
+  "audit:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "Audit", elapsed, formatExecutor(event.detail));
+  },
+
+  "sonarcloud:start": (event) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 \u2601\ufe0f SonarCloud scanning...${executor}`);
+  },
+
+  "sonarcloud:end": (event, _icon, elapsed, status) => {
+    roleEnd(status, "SonarCloud", elapsed, formatExecutor(event.detail));
+  },
+
+  "guard:output": (event) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 \ud83d\udee1\ufe0f ${event.message}${executor}`);
+  },
+
+  "guard:perf": (event) => {
+    const executor = formatExecutor(event.detail);
+    console.log(`  \u251c\u2500 \u26a1 ${event.message}${executor}`);
+  },
+
   "pipeline:tracker": (event) => {
     const trackerStages = event.detail?.stages || [];
     console.log(`  ${ANSI.dim}\u250c Pipeline${ANSI.reset}`);

package/src/utils/injection-guard.js

@@ -0,0 +1,171 @@
+/**
+ * Prompt-injection guard for AI-reviewed diffs and PR content.
+ *
+ * Scans text for patterns commonly used to hijack LLM instructions:
+ * directive overrides, role reassignment, invisible Unicode, and
+ * suspiciously large comment blocks that could hide payloads.
+ *
+ * @module utils/injection-guard
+ */
+
+/** Phrases that attempt to override system/reviewer instructions. */
+const DIRECTIVE_PATTERNS = [
+  /ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|rules?|prompts?|guidelines?)/i,
+  /disregard\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|rules?|prompts?)/i,
+  /forget\s+(all\s+)?(previous|prior|your)\s+(instructions?|rules?|context)/i,
+  /override\s+(the\s+)?(system|reviewer|review)\s+(prompt|instructions?|rules?)/i,
+  /do\s+not\s+follow\s+(the\s+)?(above|previous|system)\s+(instructions?|rules?)/i,
+  /new\s+instructions?\s*:/i,
+  /system\s*:\s*you\s+are/i,
+  /\bact\s+as\s+(a\s+)?(different|new|my|an?\s+)/i,
+  /you\s+are\s+now\s+(a\s+)?/i,
+  /from\s+now\s+on\s*(,|\s)?\s*you\s+(will|should|must|are)/i,
+  /pretend\s+(you\s+are|to\s+be)/i,
+  /respond\s+(only\s+)?with\s+["']?approved["']?/i,
+  /always\s+(return|respond|output)\s+.*approved/i,
+  /set\s+approved\s*[=:]\s*true/i,
+  /\bapproved["']?\s*:\s*true\b.*ignore/i,
+  /output\s+the\s+following\s+json/i,
+  /return\s+this\s+exact\s+(json|response|output)/i,
+];
+
+/** Unicode categories that can hide or disguise content. */
+const UNICODE_PATTERNS = [
+  /[\u200B-\u200F]/,   // zero-width spaces, LTR/RTL marks
+  /[\u202A-\u202E]/,   // bidi embedding/override
+  /[\u2066-\u2069]/,   // bidi isolate
+  /[\uFEFF]/,          // BOM mid-text
+  /[\u00AD]{3,}/,      // repeated soft hyphens
+  /[\u2060-\u2064]/,   // invisible operators
+  /[\u{E0000}-\u{E007F}]/u, // tag characters
+];
+
+/** Maximum comment block size (chars) before flagging. */
+const MAX_COMMENT_BLOCK = 2000;
+
+/**
+ * Comment block patterns for common languages.
+ * Each regex captures the full block content.
+ */
+const COMMENT_BLOCK_RE = [
+  /\/\*[\s\S]{0,20000}?\*\//g,        // C-style /* ... */
+  /<!--[\s\S]{0,20000}?-->/g,         // HTML <!-- ... -->
+  /"""\s*[\s\S]{0,20000}?\s*"""/g,    // Python docstrings
+  /'''\s*[\s\S]{0,20000}?\s*'''/g,    // Python docstrings (single)
+  /=begin[\s\S]{0,20000}?=end/g,      // Ruby block comments
+];
+
+/**
+ * @typedef {Object} InjectionFinding
+ * @property {"directive"|"unicode"|"comment_block"} type
+ * @property {string} pattern  - short label of what matched
+ * @property {string} snippet  - excerpt of the offending text (max 120 chars)
+ * @property {number} [line]   - approximate line number (1-based)
+ */
+
+/**
+ * @typedef {Object} GuardResult
+ * @property {boolean} clean        - true if no threats detected
+ * @property {InjectionFinding[]} findings
+ * @property {string} summary       - human-readable one-liner
+ */
+
+/**
+ * Scan a text (diff, PR description, comment) for prompt-injection signals.
+ *
+ * @param {string} text - content to scan
+ * @param {Object} [opts]
+ * @param {number} [opts.maxCommentBlock=2000] - flag comment blocks larger than this
+ * @returns {GuardResult}
+ */
+export function scanForInjection(text, opts = {}) {
+  if (!text || typeof text !== "string") {
+    return { clean: true, findings: [], summary: "Nothing to scan" };
+  }
+
+  const maxBlock = opts.maxCommentBlock ?? MAX_COMMENT_BLOCK;
+  /** @type {InjectionFinding[]} */
+  const findings = [];
+
+  // 1. Directive patterns
+  for (const re of DIRECTIVE_PATTERNS) {
+    const match = re.exec(text);
+    if (match) {
+      findings.push({
+        type: "directive",
+        pattern: re.source.slice(0, 60),
+        snippet: excerpt(text, match.index),
+        line: lineAt(text, match.index),
+      });
+    }
+  }
+
+  // 2. Invisible Unicode
+  for (const re of UNICODE_PATTERNS) {
+    const match = re.exec(text);
+    if (match) {
+      const charCode = match[0].codePointAt(0).toString(16).toUpperCase();
+      findings.push({
+        type: "unicode",
+        pattern: `U+${charCode}`,
+        snippet: excerpt(text, match.index),
+        line: lineAt(text, match.index),
+      });
+    }
+  }
+
+  // 3. Oversized comment blocks
+  for (const re of COMMENT_BLOCK_RE) {
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      if (m[0].length > maxBlock) {
+        findings.push({
+          type: "comment_block",
+          pattern: `block ${m[0].length} chars (max ${maxBlock})`,
+          snippet: excerpt(text, m.index),
+          line: lineAt(text, m.index),
+        });
+      }
+    }
+  }
+
+  const clean = findings.length === 0;
+  const summary = clean
+    ? "No injection patterns detected"
+    : `${findings.length} potential injection(s): ${[...new Set(findings.map((f) => f.type))].join(", ")}`;
+
+  return { clean, findings, summary };
+}
+
+/**
+ * Scan a git diff, focusing only on added lines (lines starting with +).
+ * Removed lines cannot inject into the AI prompt.
+ *
+ * @param {string} diff - unified diff content
+ * @param {Object} [opts]
+ * @returns {GuardResult}
+ */
+export function scanDiff(diff, opts = {}) {
+  if (!diff) return { clean: true, findings: [], summary: "Empty diff" };
+
+  // Extract only added lines (skip diff headers like +++ b/file)
+  const addedLines = diff
+    .split("\n")
+    .filter((l) => l.startsWith("+") && !l.startsWith("+++"))
+    .map((l) => l.slice(1))
+    .join("\n");
+
+  return scanForInjection(addedLines, opts);
+}
+
+// --- Helpers ---
+
+function excerpt(text, index) {
+  const start = Math.max(0, index - 20);
+  const end = Math.min(text.length, index + 100);
+  return text.slice(start, end).replace(/\n/g, "\\n").slice(0, 120);
+}
+
+function lineAt(text, index) {
+  return text.slice(0, index).split("\n").length;
+}

package/src/utils/os-detect.js

@@ -5,37 +5,46 @@ import os from "node:os";
  */
 export function getPlatform() {
   const platform = os.platform();
-  return platform === "darwin" ? "macos" : "linux";
+  if (platform === "win32") return "windows";
+  if (platform === "darwin") return "macos";
+  return "linux";
 }
 
 const INSTALL_COMMANDS = {
   rtk: {
     macos: "brew install rtk && rtk init --global",
-    linux: "curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh && rtk init --global"
+    linux: "curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh && rtk init --global",
+    windows: "Download from https://github.com/rtk-ai/rtk/releases and add to PATH"
   },
   claude: {
     macos: "npm install -g @anthropic-ai/claude-code",
-    linux: "npm install -g @anthropic-ai/claude-code"
+    linux: "npm install -g @anthropic-ai/claude-code",
+    windows: "npm install -g @anthropic-ai/claude-code"
   },
   codex: {
     macos: "npm install -g @openai/codex",
-    linux: "npm install -g @openai/codex"
+    linux: "npm install -g @openai/codex",
+    windows: "npm install -g @openai/codex"
   },
   gemini: {
     macos: "npm install -g @google/gemini-cli",
-    linux: "npm install -g @google/gemini-cli"
+    linux: "npm install -g @google/gemini-cli",
+    windows: "npm install -g @google/gemini-cli"
   },
   aider: {
     macos: "pipx install aider-chat",
-    linux: "pipx install aider-chat || pip3 install aider-chat"
+    linux: "pipx install aider-chat || pip3 install aider-chat",
+    windows: "pip install aider-chat"
   },
   opencode: {
     macos: "curl -fsSL https://opencode.ai/install | bash",
-    linux: "curl -fsSL https://opencode.ai/install | bash"
+    linux: "curl -fsSL https://opencode.ai/install | bash",
+    windows: "See https://github.com/nicepkg/opencode for Windows install"
   },
   docker: {
     macos: "brew install --cask docker",
-    linux: "sudo apt install docker.io docker-compose-v2 (or see https://docs.docker.com/engine/install/)"
+    linux: "sudo apt install docker.io docker-compose-v2 (or see https://docs.docker.com/engine/install/)",
+    windows: "Download Docker Desktop from https://www.docker.com/products/docker-desktop/"
   }
 };
 

package/src/utils/process.js

@@ -1,12 +1,15 @@
 import { execa } from "execa";
 
+const isWin = process.platform === "win32";
+const KILL_SIGNAL = isWin ? "SIGTERM" : "SIGKILL";
+
 function buildSilenceKilledResult(silenceTimeoutMs, stdout, signal) {
   return {
     exitCode: 143,
     stdout,
     stderr: `Command killed after ${Number(silenceTimeoutMs)}ms without output`,
     timedOut: true,
-    signal: signal || "SIGKILL"
+    signal: signal || KILL_SIGNAL
   };
 }
 
@@ -52,7 +55,7 @@ async function awaitWithTimeout(subprocess, timeout, getStdout) {
   const timeoutResult = new Promise((resolve) => {
     timer = setTimeout(() => {
       try {
-        subprocess.kill("SIGKILL", { forceKillAfterDelay: 1000 });
+        subprocess.kill(KILL_SIGNAL, { forceKillAfterDelay: 1000 });
       } catch {
         // no-op
       }
@@ -61,7 +64,7 @@ async function awaitWithTimeout(subprocess, timeout, getStdout) {
         stdout: getStdout(),
         stderr: `Command timed out after ${timeout}ms`,
         timedOut: true,
-        signal: "SIGKILL"
+        signal: KILL_SIGNAL
       });
     }, timeout);
   });
@@ -94,7 +97,7 @@ export async function runCommand(command, args = [], options = {}) {
     outputSilenceTimer = setTimeout(() => {
       silenceTimedOut = true;
       try {
-        subprocess.kill("SIGKILL", { forceKillAfterDelay: 1000 });
+        subprocess.kill(KILL_SIGNAL, { forceKillAfterDelay: 1000 });
       } catch {
         // no-op
       }