kenaz 0.3.22 → 0.3.24

package/core/dashboard/scripts/install-kenaz-cli.js

@@ -14,7 +14,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const http = require('http');
-const { spawnSync } = require('child_process');
+const { spawnSync, spawn } = require('child_process');
 
 const ENV_KEY = 'CLAUDE_CODE_PLUGIN_DIRS';
 const BACKUP = 'settings.json.bak-kenaz-peer'; // shared with the Rust path on purpose: one backup of the pristine file
@@ -22,6 +22,9 @@ const MIN_CLI = [2, 1, 287];
 const SEP = process.platform === 'win32' ? ';' : ':';
 const TASK_NAME = 'KenazServer';
 const LABEL = 'ai.kenaz.server';
+const RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';
+const BATTERY_PS = '$s = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero); Set-ScheduledTask -TaskName ' + TASK_NAME + ' -Settings $s';
+const linuxUser = () => { try { return os.userInfo().username; } catch (_) { return process.env.USER || ''; } };
 
 const norm = (e) => {
   const s = String(e).trim().replace(/\\/g, '/').replace(/\/+$/, '');
@@ -113,9 +116,14 @@ function unregisterStatusline(file, dry) {
 // agent-flow curl/node posts) duplicate what plugins/kenaz/hooks/hooks.json now runs. Single owner = the plugin, so
 // once it is registered these are removed (first write backs up the pristine file to settings.json.bak-kenaz-peer).
 const DASH_HOOK = /_user-scope\.js|[\\/]\.claude[\\/]hooks[\\/][\w.-]+\.js|\/api\/rust\/agent-flow\/hook/;
+// Field report 2026-10-19: Kenaz never wrote hooks into the user's own ~/.claude/hooks, so a hook there is the user's.
+const HOME_HOOKS = /(^|["'\s])(~|\$\{?HOME\}?|%USERPROFILE%)[\\/]\.claude[\\/]hooks[\\/]/i;
+const slashLower = (s) => s.replace(/\\/g, '/').toLowerCase();
 /** @returns number of hook commands retired */
 function retireDashboardHooks(file, dry) {
   if (!fs.existsSync(file)) return 0;
+  const homeHooks = slashLower(path.join(path.dirname(file), 'hooks')) + '/';
+  const isDash = (c) => DASH_HOOK.test(c) && !HOME_HOOKS.test(c) && !slashLower(c).includes(homeHooks);
   const v = loadSettings(file);
   if (!v.hooks || typeof v.hooks !== 'object' || Array.isArray(v.hooks)) return 0;
   let n = 0;
@@ -124,7 +132,7 @@ function retireDashboardHooks(file, dry) {
     const groups = [];
     for (const g of v.hooks[ev]) {
       if (!g || !Array.isArray(g.hooks)) { groups.push(g); continue; }
-      const kept = g.hooks.filter((h) => !(h && typeof h.command === 'string' && DASH_HOOK.test(h.command)));
+      const kept = g.hooks.filter((h) => !(h && typeof h.command === 'string' && isDash(h.command)));
       n += g.hooks.length - kept.length;
       if (kept.length) groups.push(kept.length === g.hooks.length ? g : { ...g, hooks: kept });
     }
@@ -136,20 +144,22 @@ function retireDashboardHooks(file, dry) {
 
 function claudeVersion() {
   const r = process.platform === 'win32' // one string with shell (.cmd shim): args + shell:true is deprecated (DEP0190)
-    ? spawnSync('claude --version', { encoding: 'utf8', shell: true, timeout: 15000 })
-    : spawnSync('claude', ['--version'], { encoding: 'utf8', timeout: 15000 });
+    ? spawnSync('claude --version', { windowsHide: true, encoding: 'utf8', shell: true, timeout: 15000 })
+    : spawnSync('claude', ['--version'], { windowsHide: true, encoding: 'utf8', timeout: 15000 });
   return r.status === 0 ? parseVersion(r.stdout) : null;
 }
 
 // ---- service definitions (pure; the OS calls are in service* below) ----
 function launcherPaths(home) {
   const d = path.join(home, '.kenaz');
-  return { dir: d, vbs: path.join(d, 'kenaz-server.vbs'), log: path.join(d, 'kenaz-server.log') };
+  return { dir: d, log: path.join(d, 'kenaz-server.log') };
 }
 const q = (s) => '"' + s + '"';
-function winVbs(bin, core) { // hidden window, env for task tools; server binds loopback by default
-  return 'Set sh = WScript.CreateObject("WScript.Shell")\r\nsh.Environment("Process")("KENAZ_SOURCE_DIR") = "' + core + '"\r\n' +
-    'sh.Run """' + bin + '""", 0, False\r\n';
+// TASK_2478: kenaz-server is a no-console binary on Windows and takes the core dir as an argument (no launcher script).
+function winRunCmd(bin, core) { return q(bin) + ' --source-dir ' + q(core); }
+// TASK_2478 migration: the old script-host launchers (antivirus flagged them); removed on install and uninstall.
+function legacyLaunchers(home, roaming) {
+  return [path.join(home, '.kenaz', 'kenaz-server.vbs'), path.join(roaming, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'KenazServer.vbs')]; // legacy-vbs-cleanup
 }
 // launchd and systemd start the server with a bare PATH (/usr/bin:/bin...), so `node` from Homebrew,
 // nvm or /usr/local was not found and every MCP tool that runs a node script failed with
@@ -195,8 +205,7 @@ function servicePlan(home, bin, core, platform = process.platform, caps = { syst
   const L = launcherPaths(home);
   if (platform === 'win32') {
     const roaming = home === os.homedir() && process.env.APPDATA ? process.env.APPDATA : path.join(home, 'AppData', 'Roaming');
-    const startup = path.join(roaming, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'KenazServer.vbs');
-    return { kind: 'windows', files: [[L.vbs, winVbs(bin, core)]], fallbackFile: startup };
+    return { kind: 'windows', files: [], bin, core, runCmd: winRunCmd(bin, core), legacy: legacyLaunchers(home, roaming) };
   }
   if (platform === 'darwin') {
     const p = path.join(home, 'Library', 'LaunchAgents', LABEL + '.plist');
@@ -208,7 +217,7 @@ function servicePlan(home, bin, core, platform = process.platform, caps = { syst
   const p = path.join(home, '.config', 'systemd', 'user', 'kenaz-server.service');
   return { kind: 'systemd', files: [[p, systemdUnit(bin, core)]], unit: p };
 }
-const sh = (cmd, args, opts) => spawnSync(cmd, args, { encoding: 'utf8', ...(opts || {}) });
+const sh = (cmd, args, opts) => spawnSync(cmd, args, { windowsHide: true, encoding: 'utf8', ...(opts || {}) });
 
 // crontab -l: null = no crontab binary; '' = binary present, no crontab yet. All through the injected `run`.
 function readCron(run) {
@@ -239,8 +248,7 @@ function restartHint(plan, uid = defaultUid()) {
   if (plan.kind === 'launchd') return 'launchctl kickstart -k gui/' + uid + '/' + LABEL;
   if (plan.kind === 'systemd') return 'systemctl --user restart kenaz-server';
   if (plan.kind === 'cron' || plan.kind === 'manual') return stopCmd(plan) + '; ' + detachedStartCmd(plan);
-  // the launcher works for both the scheduled task and the Startup-folder fallback (no admin rights needed)
-  return 'end kenaz-server.exe in Task Manager, then run: wscript.exe ' + q(plan.files && plan.files[0] ? plan.files[0][0] : 'kenaz-server.vbs');
+  return 'end kenaz-server.exe in Task Manager, then run: ' + plan.runCmd;
 }
 function serviceRestart(plan, dry, log, run = sh, uid = defaultUid()) {
   if (plan.kind === 'cron' || plan.kind === 'manual') { // no supervisor: start it (stopOwnServer freed the old one)
@@ -295,22 +303,28 @@ async function verifyRuntime(plan, expected, log, opts = {}) {
   return 'unreachable';
 }
 
-function serviceInstall(plan, dry, log, run = sh, uid) {
+function serviceInstall(plan, dry, log, run = sh, uid, spawnFn = spawn) {
   const sh = run; // injectable for tests; shadows the module-level spawnSync wrapper inside this function
   for (const [f, body] of plan.files) { log('write ' + f); if (!dry) { fs.mkdirSync(path.dirname(f), { recursive: true }); fs.writeFileSync(f, body); } }
   if (plan.kind === 'windows') {
-    const tr = 'wscript.exe ' + q(plan.files[0][0]);
-    log('schtasks /Create /TN ' + TASK_NAME + ' /SC ONLOGON /TR ' + tr + ' /F  (fallback: ' + plan.fallbackFile + ')');
+    const tr = plan.runCmd;
+    log('schtasks /Create /TN ' + TASK_NAME + ' /SC ONLOGON /TR ' + tr + ' /F  (fallback: ' + RUN_KEY + '\\' + TASK_NAME + ')');
+    removeLegacy(plan, dry, log);
     if (dry) return;
     const r = sh('schtasks', ['/Create', '/TN', TASK_NAME, '/SC', 'ONLOGON', '/TR', tr, '/F']);
-    if (r.status === 0) sh('schtasks', ['/Run', '/TN', TASK_NAME]);
-    else { // ONLOGON tasks can need elevation: a Startup-folder launcher is the per-user equivalent
-      fs.mkdirSync(path.dirname(plan.fallbackFile), { recursive: true });
-      fs.copyFileSync(plan.files[0][0], plan.fallbackFile);
-      sh('wscript.exe', [plan.files[0][0]]);
+    if (r.status === 0) {
+      // Task Scheduler defaults refuse to start on battery and stop the task when going on battery:
+      // a laptop unplugged at logon never got the server (TASK_2468). Re-running install fixes an old task.
+      const b = sh('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', BATTERY_PS]);
+      if (b.status !== 0) log('WARNING: could not set the task to run on battery (exit ' + b.status + '); on a laptop the server may not start unplugged. Run in PowerShell: ' + BATTERY_PS);
+      sh('schtasks', ['/Run', '/TN', TASK_NAME]);
+    } else { // ONLOGON tasks can need elevation: an HKCU Run value is the per-user equivalent
+      sh('reg', ['add', RUN_KEY, '/v', TASK_NAME, '/t', 'REG_SZ', '/d', plan.runCmd, '/f']);
+      const c = spawnFn(plan.bin, ['--source-dir', plan.core], { detached: true, stdio: 'ignore', windowsHide: true });
+      c.on('error', () => {}); c.unref();
       // schtasks' stderr is in the console's OEM code page (garbled when echoed); the usual cause is
-      // missing admin rights for /SC ONLOGON. The Startup-folder launcher starts at logon the same way.
-      log('schtasks needs administrator rights here (exit ' + r.status + '); installed the Startup-folder launcher instead (also starts at logon)');
+      // missing admin rights for /SC ONLOGON. The Run value starts the server at logon the same way.
+      log('schtasks needs administrator rights here (exit ' + r.status + '); registered the HKCU Run value instead (also starts at logon)');
     }
   } else if (plan.kind === 'launchd') {
     log('launchctl load -w ' + plan.unit); if (!dry) sh('launchctl', ['load', '-w', plan.unit]);
@@ -326,14 +340,23 @@ function serviceInstall(plan, dry, log, run = sh, uid) {
   } else {
     log('systemctl --user enable --now kenaz-server');
     if (!dry) { sh('systemctl', ['--user', 'daemon-reload']); sh('systemctl', ['--user', 'enable', '--now', 'kenaz-server']); }
+    // Without linger the user service starts only at login (headless boxes: never). Best effort.
+    const u = linuxUser();
+    log('loginctl enable-linger ' + u);
+    if (!dry && sh('loginctl', ['enable-linger', u]).status !== 0) log('WARNING: could not enable linger; the server starts at boot only after you log in. Run: loginctl enable-linger ' + u + ' (may need sudo)');
     serviceRestart(plan, dry, log, sh, uid);
   }
 }
+function removeLegacy(plan, dry, log) {
+  for (const f of plan.legacy || []) if (fs.existsSync(f)) { log('remove ' + f + ' (old launcher)'); if (!dry) fs.rmSync(f, { force: true }); }
+}
 function serviceUninstall(plan, dry, log, run = sh) {
   if (plan.kind === 'windows') {
     log('schtasks /End + /Delete /TN ' + TASK_NAME);
     if (!dry) { run('schtasks', ['/End', '/TN', TASK_NAME]); run('schtasks', ['/Delete', '/TN', TASK_NAME, '/F']); }
-    if (fs.existsSync(plan.fallbackFile)) { log('remove ' + plan.fallbackFile); if (!dry) fs.rmSync(plan.fallbackFile, { force: true }); }
+    log('reg delete ' + RUN_KEY + ' /v ' + TASK_NAME);
+    if (!dry) run('reg', ['delete', RUN_KEY, '/v', TASK_NAME, '/f']); // not-found is fine
+    removeLegacy(plan, dry, log);
   } else if (plan.kind === 'launchd') {
     log('launchctl unload ' + plan.unit); if (!dry) run('launchctl', ['unload', '-w', plan.unit]);
   } else if (plan.kind === 'cron' || plan.kind === 'manual') {
@@ -347,7 +370,7 @@ function serviceUninstall(plan, dry, log, run = sh) {
 function serviceStatus(plan, run = sh) {
   if (plan.kind === 'cron') { const c = readCron(run); return c && c.includes(CRON_MARK) ? 'cron @reboot entry present' : 'not installed'; }
   if (plan.kind === 'manual') return 'manual (no systemd user session, no crontab)';
-  if (plan.kind === 'windows') return run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (fs.existsSync(plan.fallbackFile) ? 'startup launcher present' : 'not installed');
+  if (plan.kind === 'windows') return run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (run('reg', ['query', RUN_KEY, '/v', TASK_NAME]).status === 0 ? 'Run key present' : 'not installed');
   if (plan.kind === 'systemd') return run('systemctl', ['--user', 'is-active', 'kenaz-server']).stdout.trim() || 'not installed';
   return fs.existsSync(plan.unit) ? 'plist present' : 'not installed';
 }
@@ -355,17 +378,20 @@ function serviceStatus(plan, run = sh) {
 /** Which mechanism keeps the server running on this machine (for `kenaz doctor`). Read-only, all via `run`. */
 function detectServiceMode(home, core, run = sh, platform = process.platform) {
   if (platform === 'win32') {
-    const plan = servicePlan(home, '', core, 'win32');
     if (run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0) return { mode: 'windows task', detail: 'scheduled task ' + TASK_NAME };
-    if (fs.existsSync(plan.fallbackFile)) return { mode: 'startup launcher', detail: plan.fallbackFile };
-    return { mode: 'manual', detail: 'no scheduled task or Startup launcher; run `kenaz install`' };
+    if (run('reg', ['query', RUN_KEY, '/v', TASK_NAME]).status === 0) return { mode: 'run key', detail: RUN_KEY + '\\' + TASK_NAME };
+    return { mode: 'manual', detail: 'no scheduled task or Run key; run `kenaz install`' };
   }
   if (platform === 'darwin') {
     const p = servicePlan(home, '', core, 'darwin').unit;
     return fs.existsSync(p) ? { mode: 'launchd', detail: p } : { mode: 'manual', detail: 'no launchd agent; run `kenaz install`' };
   }
   const unit = servicePlan(home, '', core, 'linux').unit;
-  if (fs.existsSync(unit) && probeLinux(run).systemd) return { mode: 'systemd', detail: unit };
+  if (fs.existsSync(unit) && probeLinux(run).systemd) {
+    const u = linuxUser();
+    const off = /Linger=no/.test(run('loginctl', ['show-user', u, '-p', 'Linger']).stdout || '');
+    return off ? { mode: 'systemd', detail: unit + '; linger is off, the server starts only after login: run loginctl enable-linger ' + u, warn: true } : { mode: 'systemd', detail: unit };
+  }
   const c = readCron(run);
   if (c && c.includes(CRON_MARK)) return { mode: 'cron', detail: '@reboot crontab entry (no systemd user session)' };
   return { mode: 'manual', detail: 'no systemd unit or cron entry; run `kenaz install`' };
@@ -453,4 +479,4 @@ function main(argv, out = console.log, getVersion = claudeVersion, deps = {}) {
 }
 
 if (require.main === module) process.exit(main(process.argv.slice(2)));
-module.exports = { main, verifyRuntime, healthOnce, serviceInstall, serviceRestart, restartHint, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, registerStatusline, unregisterStatusline, retireDashboardHooks, servicePlan, detectServiceMode, probeLinux, cronLine, CRON_MARK, winVbs, launchdPlist, systemdUnit, parseVersion, cmpVersion };
+module.exports = { main, verifyRuntime, healthOnce, serviceInstall, serviceUninstall, serviceRestart, restartHint, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, registerStatusline, unregisterStatusline, retireDashboardHooks, servicePlan, detectServiceMode, probeLinux, cronLine, CRON_MARK, winRunCmd, RUN_KEY, launchdPlist, systemdUnit, parseVersion, cmpVersion };

package/core/dev/scripts/check-file-size.js

@@ -103,7 +103,7 @@ function countLines(text) {
 }
 
 function git(args, cwd) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  const result = spawnSync('git', args, { windowsHide: true, cwd, encoding: 'utf8' });
   return result;
 }
 

package/core/dev/scripts/ci-feedback.js

@@ -40,7 +40,7 @@ const TASK_API = path.join(ROOT, '.collaboration', 'core', 'task-api.js');
 // ─────────────────────────────────────────
 
 function runTaskApi(...args) {
-  const result = spawnSync('node', [TASK_API, ...args], {
+  const result = spawnSync('node', [TASK_API, ...args], { windowsHide: true,
     encoding: 'utf8',
     timeout: 15000,
     cwd: ROOT,

package/core/dev/scripts/gc-agent-worktrees.js

@@ -72,11 +72,11 @@ const DRY_RUN = !process.argv.includes('--apply');
 // ─── Git helpers (GEN-008: dynamic root, never hardcoded) ────────────────────
 
 function gitRoot() {
-  return execSync('git rev-parse --show-toplevel', { encoding: 'utf8' }).trim();
+  return execSync('git rev-parse --show-toplevel', { windowsHide: true, encoding: 'utf8' }).trim();
 }
 
 function currentBranch() {
-  return execSync('git rev-parse --abbrev-ref HEAD', { encoding: 'utf8' }).trim();
+  return execSync('git rev-parse --abbrev-ref HEAD', { windowsHide: true, encoding: 'utf8' }).trim();
 }
 
 /**
@@ -84,7 +84,7 @@ function currentBranch() {
  * Uses exit code of `git merge-base --is-ancestor <commit> HEAD`.
  */
 function isAncestorOfHead(tipCommit) {
-  const result = spawnSync('git', ['merge-base', '--is-ancestor', tipCommit, 'HEAD'], {
+  const result = spawnSync('git', ['merge-base', '--is-ancestor', tipCommit, 'HEAD'], { windowsHide: true,
     encoding: 'utf8',
   });
   return result.status === 0;
@@ -95,7 +95,7 @@ function isAncestorOfHead(tipCommit) {
  * Each entry: { path, head, branch, locked, lockReason }
  */
 function listWorktrees() {
-  const raw = execSync('git worktree list --porcelain', { encoding: 'utf8' });
+  const raw = execSync('git worktree list --porcelain', { windowsHide: true, encoding: 'utf8' });
   const entries = [];
   let current = null;
 
@@ -199,7 +199,7 @@ function listUntrackedAgentDirs(root, trackedPaths) {
 function listDanglingAgentBranches(trackedBranches) {
   let raw = '';
   try {
-    raw = execSync('git branch --list "worktree-agent-*" --format="%(refname:short)"', { encoding: 'utf8' });
+    raw = execSync('git branch --list "worktree-agent-*" --format="%(refname:short)"', { windowsHide: true, encoding: 'utf8' });
   } catch {
     return [];
   }
@@ -209,7 +209,7 @@ function listDanglingAgentBranches(trackedBranches) {
     const b = line.trim();
     if (!b || trackedSet.has(b)) continue;
     let tip = '';
-    try { tip = execSync(`git rev-parse "${b}"`, { encoding: 'utf8' }).trim(); } catch { /* ignore */ }
+    try { tip = execSync(`git rev-parse "${b}"`, { windowsHide: true, encoding: 'utf8' }).trim(); } catch { /* ignore */ }
     out.push({ branch: b, tip, integrated: tip ? isAncestorOfHead(tip) : false });
   }
   return out;
@@ -354,7 +354,7 @@ function main() {
     // Unlock if locked (harness may have left lock even after pid is gone)
     if (wt.locked) {
       try {
-        execSync(`git worktree unlock "${wt.path}"`, { encoding: 'utf8' });
+        execSync(`git worktree unlock "${wt.path}"`, { windowsHide: true, encoding: 'utf8' });
       } catch {
         // unlock may fail if git disagrees — proceed, remove --force handles it
       }
@@ -365,7 +365,8 @@ function main() {
     // checkout's node_modules). Reuse the hook's helper (never copy it). If it is
     // unavailable, refuse to remove rather than risk traversal.
     try {
-      require(path.join(__dirname, '..', '..', '.claude', 'hooks', 'worktree-create.js')).unlinkNodeModulesLinks(wt.path);
+      const unl = require(path.join(__dirname, '..', '..', '.claude', 'hooks', 'worktree-create.js')).unlinkNodeModulesLinks(wt.path);
+      if (unl.failed.length) throw new Error('link(s) survive unlink: ' + unl.failed.slice(0, 3).join(', '));
     } catch (err) {
       console.log(` FAILED (node_modules unlink unavailable, not removing): ${err.message.trim()}`);
       failedCount++;
@@ -374,7 +375,7 @@ function main() {
 
     // Remove worktree (--force bypasses remaining lock metadata)
     try {
-      execSync(`git worktree remove --force "${wt.path}"`, { encoding: 'utf8' });
+      execSync(`git worktree remove --force "${wt.path}"`, { windowsHide: true, encoding: 'utf8' });
     } catch (err) {
       console.log(` FAILED (worktree remove): ${err.message.trim()}`);
       failedCount++;
@@ -384,7 +385,7 @@ function main() {
     // Delete the branch (best-effort; branch may already be deleted or missing)
     if (wt.branch) {
       try {
-        execSync(`git branch -D "${wt.branch}"`, { encoding: 'utf8' });
+        execSync(`git branch -D "${wt.branch}"`, { windowsHide: true, encoding: 'utf8' });
       } catch {
         // Branch may already be deleted — not an error
       }
@@ -396,7 +397,7 @@ function main() {
 
   // Prune stale worktree admin dirs (idempotent, always safe)
   try {
-    execSync('git worktree prune', { encoding: 'utf8' });
+    execSync('git worktree prune', { windowsHide: true, encoding: 'utf8' });
     console.log('\n  git worktree prune  done');
   } catch (err) {
     console.log(`\n  git worktree prune  FAILED (non-fatal): ${err.message.trim()}`);
@@ -419,7 +420,7 @@ function main() {
   for (const b of danglingBranches) {
     if (!b.integrated) continue; // keep not-in-HEAD branches for salvage
     try {
-      execSync(`git branch -D "${b.branch}"`, { encoding: 'utf8' });
+      execSync(`git branch -D "${b.branch}"`, { windowsHide: true, encoding: 'utf8' });
       danglingDeleted++;
     } catch { /* already gone — not an error */ }
   }

package/core/dev/scripts/kenaz-session.js

@@ -218,7 +218,7 @@ function parseCliArgs(argv) {
 function resolveExecutableWindows(whereFn) {
   whereFn = whereFn || function runWhere() {
     try {
-      return cp.execSync('where claude', { encoding: 'utf8' });
+      return cp.execSync('where claude', { windowsHide: true, encoding: 'utf8' });
     } catch (e) {
       return '';
     }
@@ -263,13 +263,13 @@ function escapeCmdExe(exe) {
 
 function launch(exec, cwd, argv) {
   if (exec.useShell) {
-    return cp.spawn(escapeCmdExe(exec.command), argv.map(escapeCmdArg), {
+    return cp.spawn(escapeCmdExe(exec.command), argv.map(escapeCmdArg), { windowsHide: true,
       cwd,
       stdio: 'inherit',
       shell: true,
     });
   }
-  return cp.spawn(exec.command, argv, { cwd, stdio: 'inherit', shell: false });
+  return cp.spawn(exec.command, argv, { windowsHide: true, cwd, stdio: 'inherit', shell: false });
 }
 
 // ---- main ----

package/core/dev/scripts/peer-identity-e2e.js

@@ -59,12 +59,12 @@ function start(name, exe, args, env, cwd) {
 }
 async function stop(p) {
   if (!p || p.exited) return;
-  if (process.platform === 'win32') spawnSync('taskkill', ['/PID', String(p.pid), '/T', '/F'], { stdio: 'ignore' }); // our PID only
+  if (process.platform === 'win32') spawnSync('taskkill', ['/PID', String(p.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' }); // our PID only
   else p.child.kill('SIGKILL');
   await until(`${p.name} exit`, () => p.exited, 15000, 100).catch(() => {});
 }
 function sh(cmd, args, env) {
-  const r = spawnSync(cmd, args, { env: { ...process.env, ...env }, encoding: 'utf8' });
+  const r = spawnSync(cmd, args, { windowsHide: true, env: { ...process.env, ...env }, encoding: 'utf8' });
   return { code: r.status, out: `${r.stdout || ''}${r.stderr || ''}`.trim() };
 }
 function sqlite(file, readOnly = true) {
@@ -195,7 +195,9 @@ async function main() {
   const missing = Object.entries({ relay: BIN.relay, relayOld: BIN.relayOld, server: BIN.server, serverOldSrc: BIN.serverOldSrc }).filter(([, p]) => !fs.existsSync(p));
   if (missing.length) { console.error(`missing binaries: ${missing.map(([k, p]) => `${k}=${p}`).join(', ')}`); return 2; }
   for (const p of Object.values(PORT)) if (!(await portFree(p))) { console.error(`port ${p} busy; aborting`); return 2; }
-  TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'kenaz-peer-e2e-'));
+  // TASK_2480: not under os.tmpdir() - the server refuses to register (and prunes) projects in the OS temp dir
+  fs.mkdirSync(path.join(REPO, '.tmp'), { recursive: true });
+  TMP = fs.mkdtempSync(path.join(REPO, '.tmp', 'kenaz-peer-e2e-'));
   const runId = path.basename(TMP);
   console.log(`peer-identity-e2e: temp dir ${TMP}${CONTROL ? ' (control run: wrong fingerprint in scenario 3)' : ''}`);
   const gitBefore = gitState();
@@ -398,5 +400,5 @@ async function main() {
   return bad ? 1 : 0;
 }
 
-process.on('SIGINT', () => { for (const p of procs) if (!p.exited) { if (process.platform === 'win32') spawnSync('taskkill', ['/PID', String(p.pid), '/T', '/F'], { stdio: 'ignore' }); else p.child.kill('SIGKILL'); } process.exit(130); });
+process.on('SIGINT', () => { for (const p of procs) if (!p.exited) { if (process.platform === 'win32') spawnSync('taskkill', ['/PID', String(p.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' }); else p.child.kill('SIGKILL'); } process.exit(130); });
 main().then((c) => process.exit(c), (e) => { console.error(e); process.exit(1); });

package/core/dev/scripts/run-rust-tests.js

@@ -142,7 +142,7 @@ function main() {
   const build = spawnSync(
     'cargo',
     ['test', '--lib', '--no-run', '--message-format=json'],
-    { cwd: crateDir, encoding: 'utf8', shell: false, maxBuffer: 256 * 1024 * 1024, env }
+    { windowsHide: true, cwd: crateDir, encoding: 'utf8', shell: false, maxBuffer: 256 * 1024 * 1024, env }
   );
   if (build.status !== 0) {
     const compilerErrors = renderCompilerErrors(build.stdout);
@@ -180,7 +180,7 @@ function main() {
   }
 
   // 3. Run the artifact directly.
-  const run = spawnSync(testExe, exeArgs, { stdio: 'inherit' });
+  const run = spawnSync(testExe, exeArgs, { windowsHide: true, stdio: 'inherit' });
   process.exit(run.status ?? 1);
 }
 

package/core/dev/scripts/skill-routing-replay.js

@@ -36,7 +36,7 @@ function evaluate(streamText, expected) {
 }
 
 function copyRepo(dest) {
-  const files = execFileSync('git', ['ls-files', '-z'], { cwd: REPO, encoding: 'utf8', maxBuffer: 1 << 28 }).split('\0').filter(Boolean);
+  const files = execFileSync('git', ['ls-files', '-z'], { windowsHide: true, cwd: REPO, encoding: 'utf8', maxBuffer: 1 << 28 }).split('\0').filter(Boolean);
   for (const f of files) {
     const from = path.join(REPO, f);
     if (!fs.existsSync(from)) continue;
@@ -49,11 +49,11 @@ function runScenario(sc, opts) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'skill-replay-'));
   try {
     copyRepo(dir);
-    execFileSync('git', ['init', '-q'], { cwd: dir });
+    execFileSync('git', ['init', '-q'], { windowsHide: true, cwd: dir });
     const prompt = (sc.prefix === undefined ? '/Ansuz ' : sc.prefix) + sc.message;
     // Prompt goes on stdin: with shell:true (needed on Windows) argv is concatenated unquoted, which split the message.
     const r = spawnSync('claude', ['-p', '--output-format', 'stream-json', '--verbose', '--max-turns', String(opts.maxTurns)],
-      { cwd: dir, input: prompt, encoding: 'utf8', maxBuffer: 1 << 28, timeout: opts.timeoutMs, shell: process.platform === 'win32' });
+      { windowsHide: true, cwd: dir, input: prompt, encoding: 'utf8', maxBuffer: 1 << 28, timeout: opts.timeoutMs, shell: process.platform === 'win32' });
     const ev = evaluate(r.stdout || '', sc.expected);
     return { id: sc.id, expected: sc.expected, hit: ev.hit, calls: ev.calls, exit: r.status, error: r.error && r.error.message };
   } finally {

package/core/dev/scripts/task1961/selftest.js

@@ -120,7 +120,7 @@ async function testSlowServe() {
     KENAZ_FIXTURE_SLOW_PHASE_MS: '4000',
   });
   const spawnedAt = Date.now();
-  const child = spawn(process.execPath, [SLOW_SERVE], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+  const child = spawn(process.execPath, [SLOW_SERVE], { windowsHide: true, env, stdio: ['ignore', 'pipe', 'pipe'] });
   spawnedPids.push(child.pid);
   let out = '';
   child.stdout.on('data', (d) => (out += d.toString()));
@@ -166,7 +166,7 @@ async function testSlowServe() {
 
 async function testNeverListens() {
   console.log('\n[selftest] never-listens.server.js');
-  const child = spawn(process.execPath, [NEVER_LISTENS], { stdio: ['ignore', 'pipe', 'pipe'] });
+  const child = spawn(process.execPath, [NEVER_LISTENS], { windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
   spawnedPids.push(child.pid);
   let exited = false;
   child.on('exit', () => {

package/core/dev/scripts/windows-hide-guard.test.js

@@ -0,0 +1,112 @@
+'use strict';
+// TASK_2474 guard: every child process Kenaz starts must be hidden on Windows.
+//  - Node: spawn/exec* calls in shipped JS must pass windowsHide (inline in the call, or on an options
+//    object defined in the same file). JS_ALLOW = intentionally visible terminals, with reasons.
+//  - Rust: Command::new in non-test Rust files outside common/process.rs must be hidden_command.
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const JS_DIRS = ['.specialist/tools', '.formation', '.claude/hooks', 'plugins/kenaz/hooks', 'plugins/kenaz/scripts',
+  '.collaboration/core', 'packages/kenaz/lib', 'packages/kenaz/bin', 'dashboard/scripts', 'dev/scripts'];
+const RS_DIR = 'dashboard/src-tauri/src';
+
+// "relative/path.js:line" -> reason. Intentionally visible terminals only.
+const JS_ALLOW = {
+  'dev/scripts/task1961/selftest.js:132': 'false positive: "spawn (took ..." inside a template-string message, not a call',
+};
+// "relative/path.rs" -> reason (whole file may use raw Command::new outside #[cfg(test)]).
+const RS_ALLOW = {
+  'dashboard/src-tauri/src/common/process.rs': 'the hidden_command constructors themselves',
+};
+
+function walk(dir, exts, out = []) {
+  const abs = path.join(ROOT, dir);
+  if (!fs.existsSync(abs)) return out;
+  for (const e of fs.readdirSync(abs, { withFileTypes: true })) {
+    if (['node_modules', '.git', 'target', 'dist', 'fixtures'].includes(e.name)) continue;
+    const rel = dir + '/' + e.name;
+    if (e.isDirectory()) walk(rel, exts, out);
+    else if (exts.some((x) => e.name.endsWith(x)) && !/\.test\.[cm]?js$/.test(e.name)) out.push(rel);
+  }
+  return out;
+}
+
+// generated (gitignored) copies of scanned sources: core-resolve.js from .claude/hooks, packages/kenaz/vendor/ from
+// dashboard/scripts by packages/kenaz/scripts/stage.js at pack time (a stale local copy must not fail the guard)
+const isGenerated = (rel) => rel === 'plugins/kenaz/hooks/core-resolve.js' || rel.startsWith('packages/kenaz/vendor/');
+
+function matchParen(src, open) {
+  let depth = 0, q = null;
+  for (let i = open; i < src.length; i++) {
+    const c = src[i];
+    if (q) { if (c === '\\') i++; else if (c === q) q = null; continue; }
+    if (c === '"' || c === "'" || c === '`') { q = c; continue; }
+    if (c === '(') depth++;
+    else if (c === ')' && --depth === 0) return i;
+  }
+  return src.length;
+}
+
+function scanJs(rel, src) {
+  if (!/child_process/.test(src)) return [];
+  const bad = [];
+  // blank block comments and whole-line // comments (offsets and line numbers preserved)
+  src = src.replace(/\/\*[\s\S]*?\*\//g, (c) => c.replace(/[^\n]/g, ' ')).replace(/^[ \t]*\/\/.*$/gm, (c) => ' '.repeat(c.length));
+  const re = /(?<![\w$.])(?:(?:cp|child_process|childProcess|proc)\.)?(spawn|spawnSync|exec|execSync|execFile|execFileSync)\s*\(/g;
+  let m;
+  while ((m = re.exec(src))) {
+    const open = m.index + m[0].length - 1;
+    const args = src.slice(open, matchParen(src, open) + 1);
+    if (/windowsHide/.test(args)) continue;
+    // options passed as a bare identifier: accept when that identifier is defined with windowsHide in the file
+    const last = args.slice(1, -1).split(',').pop().trim();
+    if (/^[A-Za-z_$][\w$]*$/.test(last) && new RegExp(`${last}\\s*=\\s*\\{[^;]*windowsHide`).test(src)) continue;
+    const line = src.slice(0, m.index).split('\n').length;
+    if (JS_ALLOW[`${rel}:${line}`]) continue;
+    bad.push(`${rel}:${line} ${m[1]}`);
+  }
+  return bad;
+}
+
+function scanRs(rel, src) {
+  if (RS_ALLOW[rel]) return [];
+  const cut = src.search(/#\[cfg\(test\)\]/);
+  const body = cut >= 0 ? src.slice(0, cut) : src;
+  const bad = [];
+  body.split('\n').forEach((ln, i) => {
+    if (/^\s*\/\//.test(ln)) return;
+    if (/Command::new\s*\(/.test(ln) && !/hidden_/.test(ln)) bad.push(`${rel}:${i + 1}`);
+  });
+  return bad;
+}
+
+test('Node: every child_process call passes windowsHide', () => {
+  const files = JS_DIRS.flatMap((d) => walk(d, ['.js', '.cjs', '.mjs'])).filter((f) => !isGenerated(f));
+  const bad = files.flatMap((f) => scanJs(f, fs.readFileSync(path.join(ROOT, f), 'utf8')));
+  console.log(`node violations: ${bad.length}`);
+  assert.deepStrictEqual(bad, []);
+});
+
+test('Rust: no raw Command::new in production code outside common/process.rs', () => {
+  const files = walk(RS_DIR, ['.rs']).filter((f) => !/(^|\/)tests?\.rs$|_tests?\.rs$|\/tests\//.test(f));
+  const bad = files.flatMap((f) => scanRs(f, fs.readFileSync(path.join(ROOT, f), 'utf8')));
+  console.log(`rust violations: ${bad.length}`);
+  assert.deepStrictEqual(bad, []);
+});
+
+// TASK_2478: no script-host autostart (antivirus flags schtasks ONLOGON + wscript + .vbs). The only allowed mentions
+// are the migration cleanup of the old launcher files, marked `legacy-vbs-cleanup` on the same line.
+test('Node: shipped JS neither runs wscript nor writes a .vbs (outside the marked migration cleanup)', () => {
+  const files = ['dashboard/scripts', 'packages/kenaz', 'plugins'].flatMap((d) => walk(d, ['.js', '.cjs', '.mjs'])).filter((f) => !isGenerated(f));
+  const bad = [];
+  for (const f of files) {
+    fs.readFileSync(path.join(ROOT, f), 'utf8').split('\n').forEach((ln, i) => {
+      if (/wscript|cscript|\.vbs\b/i.test(ln) && !ln.includes('legacy-vbs-cleanup')) bad.push(`${f}:${i + 1}`);
+    });
+  }
+  console.log(`script-host violations: ${bad.length}`);
+  assert.deepStrictEqual(bad, []);
+});

package/core/plugins/kenaz/guidance.md

@@ -2,5 +2,6 @@
 - Code navigation: kenaz_lsp_callers / kenaz_lsp_references / kenaz_lsp_definition / kenaz_lsp_symbols (always pass projectPath). Text search: Grep/Glob.
 - Collaboration: kenaz_peer_send / kenaz_peer_threads (other sessions, other machines, Codex), /kenaz ygg status|join.
 - Rooms: when the user pastes a room key or asks to join/create a room, run `kenaz ygg join <key>` / `kenaz ygg create` yourself (never ask them to type it), then relay the status block and any "restart Claude Code" note.
+- Reporting a Kenaz problem or idea: call kenaz_wish_create (scope kenaz) yourself; it uploads to the Kenaz mother (Alaya) automatically, no user step. Claude Code's SendFeedback tool and /feedback go to Anthropic, never to Kenaz.
 - Reply in the user's language. Commands: /Ansuz, /Amelia, /review, /security, /incident, /spec.
 - Switch: /kenaz off | assist | full (or env KENAZ_MODE). off disables every Kenaz hook.

package/core/plugins/kenaz/hooks/core-resolve.js

@@ -221,7 +221,7 @@ if (require.main === module) {
   if (!result) process.exit(0); // silent -- non-blocking hook
 
   try {
-    execFileSync("node", [result.resolved, ...result.args], { stdio: "inherit" });
+    execFileSync("node", [result.resolved, ...result.args], { stdio: "inherit", windowsHide: true });
   } catch {
     // Hook errors should not block
   }

package/core/plugins/kenaz/hooks/hooks.json

@@ -60,6 +60,15 @@
           }
         ]
       },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" worktree-guard"
+          }
+        ]
+      },
       {
         "matcher": "Agent|Task",
         "hooks": [