kenaz 0.3.23 → 0.3.24

package/core/.claude/hooks/worktree-create.js

@@ -491,7 +491,8 @@ function gcStaleWorktrees(repo, keepPath, opts) {
       // Windows recurses through junctions on delete and would empty the MAIN
       // checkout's node_modules (measured; see unlinkNodeModulesLinks). This
       // also covers pre-TASK_1844 worktrees where agents hand-built junctions.
-      unlinkNodeModulesLinks(p);
+      const unl = unlinkNodeModulesLinks(p);
+      if (unl.failed.length) { diag(name + ' KEPT — cannot unlink: ' + unl.failed.slice(0, 3).join(', ')); continue; }
       // Lock-resilient removal: try git remove --force, fall back to fs.rmSync
       // with retries, then prune. If still locked -> log to stderr (observable)
       // but never throw (GC must remain non-blocking).
@@ -646,7 +647,7 @@ function ensureWorktreeIgnores(worktreePath, relPath) {
 }
 
 /**
- * Unlink node_modules junctions/symlinks inside `root` (a worktree about to be
+ * Unlink EVERY junction/symlink (any name, any depth) inside `root` (a worktree about to be
  * removed). MUST run before any `git worktree remove`: Git for Windows RECURSES
  * THROUGH junctions when deleting and EMPTIES THE LINK TARGET — measured
  * 2026-08-13 (TASK_1844 control test): a junction into the source repo's
@@ -657,27 +658,8 @@ function ensureWorktreeIgnores(worktreePath, relPath) {
  * left for the normal removal path. Best-effort: never throws.
  */
 function unlinkNodeModulesLinks(root) {
-  const walk = (dir, depth) => {
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const ent of entries) {
-      const p = path.join(dir, ent.name);
-      if (ent.name === 'node_modules') {
-        try {
-          if (fs.lstatSync(p).isSymbolicLink()) {
-            try { fs.unlinkSync(p); } catch { fs.rmdirSync(p); }
-          }
-        } catch { /* best-effort */ }
-        continue;
-      }
-      let isDir = false;
-      try { const st = fs.lstatSync(p); isDir = st.isDirectory() && !st.isSymbolicLink(); }
-      catch { continue; }
-      if (!isDir || NODE_MODULES_SCAN_PRUNE.has(ent.name)) continue;
-      if (depth + 1 <= NODE_MODULES_SCAN_DEPTH) walk(p, depth + 1);
-    }
-  };
-  walk(root, 0);
+  // TASK_2485: ONE implementation (lstat walk, every link, any name/depth) lives in worktree-reclaim.js.
+  return require('../../.formation/tools/worktree-reclaim.js').unlinkAllLinks(root); // {removed, failed}
 }
 
 /**

package/core/.claude/hooks/worktree-remove.js

@@ -51,40 +51,14 @@ function gitTopLevel(dir) {
 // falsified by the control test above — keep this note so nobody re-litigates
 // it in either direction without re-measuring.)
 //
-// DUPLICATED from worktree-create.js ON PURPOSE — do not "deduplicate" via
-// require('./worktree-create.js'): this hook is wired as `node -e
-// "require(...)"`, so inside a required worktree-create.js
-// require.main === undefined, which its entry dispatch treats as "I am the
-// WorktreeCreate hook" → it would consume our stdin JSON and CREATE a spurious
-// worktree in the middle of a remove.
-const NM_SCAN_DEPTH = 3;
-const NM_SCAN_PRUNE = new Set([
-  '.git', 'node_modules', '.next', 'target', 'dist', 'build', 'out',
-  'vendor', 'worktrees', '.kenaz-worktrees',
-]);
-
+// TASK_2485: the unlink walk is shared (worktree-reclaim.js unlinkAllLinks): every
+// symlink/junction at any depth, because git recurses through ALL of them. Do not
+// require('./worktree-create.js') here: this hook is wired as `node -e "require(...)"`,
+// so inside a required worktree-create.js require.main === undefined, which its entry
+// dispatch treats as "I am the WorktreeCreate hook" and would CREATE a worktree.
 function unlinkNodeModulesLinks(root) {
-  const walk = (dir, depth) => {
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const ent of entries) {
-      const p = path.join(dir, ent.name);
-      if (ent.name === 'node_modules') {
-        try {
-          if (fs.lstatSync(p).isSymbolicLink()) {
-            try { fs.unlinkSync(p); } catch { fs.rmdirSync(p); }
-          }
-        } catch { /* best-effort */ }
-        continue;
-      }
-      let isDir = false;
-      try { const st = fs.lstatSync(p); isDir = st.isDirectory() && !st.isSymbolicLink(); }
-      catch { continue; }
-      if (!isDir || NM_SCAN_PRUNE.has(ent.name)) continue;
-      if (depth + 1 <= NM_SCAN_DEPTH) walk(p, depth + 1);
-    }
-  };
-  try { walk(root, 0); } catch { /* best-effort */ }
+  try { return require('../../.formation/tools/worktree-reclaim.js').unlinkAllLinks(root); }
+  catch { return { removed: [], failed: ['(unlink helper unavailable)'] }; }
 }
 
 /** Find the branch checked out in `worktreePath` via `git worktree list --porcelain`. */
@@ -164,7 +138,7 @@ function main() {
     // TASK_1844: MUST unlink node_modules junctions before the git removal —
     // Git for Windows traverses junctions on delete (measured; see header
     // comment above unlinkNodeModulesLinks). fs.rmSync below is safe as-is.
-    unlinkNodeModulesLinks(worktreePath);
+    if (unlinkNodeModulesLinks(worktreePath).failed.length) process.exit(0); // refuse: a surviving link would be traversed
     gitTry(repo, ['worktree', 'remove', '--force', worktreePath]);
     gitTry(repo, ['worktree', 'prune']);
     if (branch) gitTry(repo, ['branch', '-D', branch]);

package/core/.formation/tools/dispatch-detail/worktree-subagent-mode.md

@@ -15,7 +15,12 @@ waiting for a green build. The commit command (built by
 paths (`.kenaz/sessions`, `.kenaz/specialist`, `.formation/.dispatch-branch`,
 `.formation/analytics`) — never hand-type `git add -A` to replace it, and
 never delete the worktree yourself even after committing; the main thread
-owns worktree lifecycle.
+owns worktree lifecycle. When the main thread (or an agent told to clean up)
+must remove one, the only safe command is
+`node <core>/.formation/tools/worktree-reclaim.js remove <path>`: dispatch
+worktrees hold junctions into the main repo (node_modules, workspace links),
+and on Windows `git worktree remove --force` follows every one of them and
+empties the target (TASK_2485).
 
 ## Why "sending a message ends execution" is a hard rule
 

package/core/.formation/tools/utils.js

@@ -63,10 +63,9 @@ function linkNodeModulesBestEffort(projectRoot, worktreePath) {
  * target (the main checkout's node_modules). Never throws.
  */
 function unlinkNodeModulesBestEffort(worktreePath) {
-  const hook = _loadWorktreeCreateHook();
-  if (!hook || typeof hook.unlinkNodeModulesLinks !== 'function') return;
-  try { hook.unlinkNodeModulesLinks(worktreePath); }
-  catch (e) { console.warn(`   ⚠️  node_modules unlink failed: ${(e && e.message) || 'unknown'}`); }
+  // TASK_2485: unlinks EVERY link (any name/depth); returns {removed, failed}. failed != [] => do not remove.
+  try { return require('./worktree-reclaim').unlinkAllLinks(worktreePath); }
+  catch (e) { console.warn(`   ⚠️  link unlink failed: ${(e && e.message) || 'unknown'}`); return { removed: [], failed: ['(unlink helper unavailable)'] }; }
 }
 
 /**
@@ -848,7 +847,8 @@ function removeWorktree(projectRoot, worktreePath, maxRetries = 3) {
   // TASK_1844/TASK_2030: MUST run before any `git worktree remove` -- Git for
   // Windows recurses through a node_modules junction/symlink on removal and
   // empties the link target (the main checkout's node_modules).
-  unlinkNodeModulesBestEffort(worktreePath);
+  const unl = unlinkNodeModulesBestEffort(worktreePath);
+  if (unl.failed.length) { console.warn(`   ⚠️  not removing ${worktreePath}: link(s) survive unlink: ${unl.failed.slice(0, 3).join(', ')}`); return false; }
   for (let i = 0; i < maxRetries; i++) {
     try {
       execSync(`git worktree remove --force "${worktreePath}"`, {

package/core/.formation/tools/worktree-reclaim.js

@@ -73,6 +73,66 @@ function walkTree(root) {
   return { size, newest, links, managedLinks };
 }
 
+/**
+ * TASK_2485: unlink EVERY symlink/junction under `root` (any name, any depth, also inside a real
+ * node_modules). lstat walk: a link is removed as a link and never entered. Measured on Windows:
+ * `git worktree remove --force` traverses every junction and empties its target (the main repo's
+ * node_modules, backend/.env, tracked files); fs.rmSync, Git Bash rm -rf and cmd rmdir /s do not.
+ * @returns {{removed:string[], failed:string[]}} paths relative to root
+ */
+function unlinkAllLinks(root) {
+  const removed = []; const failed = [];
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    let names;
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const name of names) {
+      const p = path.join(dir, name);
+      let st;
+      try { st = fs.lstatSync(p); } catch { continue; }
+      const rel = path.relative(root, p).replace(/\\/g, '/');
+      if (st.isSymbolicLink()) {
+        try { fs.unlinkSync(p); } catch { try { fs.rmdirSync(p); } catch { failed.push(rel); continue; } }
+        removed.push(rel);
+      } else if (st.isDirectory()) stack.push(p);
+    }
+  }
+  return { removed, failed };
+}
+
+/**
+ * The one safe removal: unlink all links, re-scan, then remove (git worktree remove --force when
+ * registered, fs.rmSync for orphan dirs). Refuses (ok:false) when a link survives or the path is
+ * not a worktree of this repo / under .formation/worktrees or .claude/worktrees.
+ * @returns {{ok:boolean, registered:boolean, unlinked:string[], reason?:string}}
+ */
+function safeRemoveWorktree(repo, target) {
+  const abs = path.resolve(target);
+  const { main, worktrees } = listRegisteredWorktrees(repo);
+  const registered = worktrees.some((w) => norm(w.path) === norm(abs));
+  const inside = (...dir) => { const rel = path.relative(path.join(repo, ...dir), abs); return !!rel && !rel.startsWith('..') && !path.isAbsolute(rel); };
+  const res = { ok: false, registered, unlinked: [] };
+  if (norm(abs) === norm(main.path)) return { ...res, reason: 'is the main checkout' };
+  if (!registered && !inside('.formation', 'worktrees') && !inside('.claude', 'worktrees')) return { ...res, reason: 'not a registered worktree and not under .formation/worktrees or .claude/worktrees' };
+  if (!fs.existsSync(abs) && !registered) return { ...res, ok: true, reason: 'already gone' };
+  const first = unlinkAllLinks(abs);
+  res.unlinked = first.removed;
+  const again = unlinkAllLinks(abs);
+  if (first.failed.length || again.removed.length || again.failed.length) {
+    return { ...res, reason: `cannot unlink: ${[...first.failed, ...again.removed, ...again.failed].slice(0, 5).join(', ')}` };
+  }
+  const rm = () => fs.rmSync(abs, { recursive: true, force: true, maxRetries: 3 });
+  try {
+    if (registered) {
+      try { git(main.path, ['worktree', 'remove', '--force', abs]); } catch { if (fs.existsSync(abs)) rm(); }
+    } else rm();
+  } catch (e) { return { ...res, reason: `remove failed: ${String(e.message).split('\n')[0]}` }; }
+  try { git(main.path, ['worktree', 'prune']); } catch { /* non-fatal */ }
+  const gone = !fs.existsSync(abs);
+  return { ...res, ok: gone, reason: gone ? undefined : 'directory still present (locked file?)' };
+}
+
 /** Uncommitted content beyond telemetry. Compares content (CRLF-only changes do not count). */
 function dirtyContent(wt) {
   const dirty = [];
@@ -177,7 +237,7 @@ function removeWorktree(repo, w, opts = {}) {
   const { main } = listRegisteredWorktrees(repo);
   // Drop dispatch's own node_modules links first: `git worktree remove` would
   // traverse a junction and empty its target (the main checkout's node_modules).
-  (opts.unlinkManaged || require('./utils').unlinkNodeModulesBestEffort)(w.path);
+  (opts.unlinkManaged || unlinkAllLinks)(w.path);
   const left = walkTree(w.path);
   if (left.links.length || left.managedLinks.length) {
     log(`KEPT ${w.path}: links still present after unlink: ${[...left.links, ...left.managedLinks].slice(0, 3).join(', ')}`);
@@ -256,4 +316,15 @@ function formatReport(evald) {
   ].join('\n')).join('\n') || '(no worktrees)';
 }
 
-module.exports = { evaluateWorktrees, ensureWorktreeSpace, reclaimAllEligible, listRegisteredWorktrees, formatReport, DEFAULT_MIN_IDLE_MS };
+// CLI for agents: node worktree-reclaim.js remove <path>   (never raw `git worktree remove` / rm -rf)
+if (require.main === module) {
+  const target = process.argv[2] === 'remove' ? process.argv[3] : null;
+  if (!target) { process.stderr.write('usage: node worktree-reclaim.js remove <worktree-or-orphan-dir>\n'); process.exit(2); }
+  let repo;
+  try { repo = path.dirname(git(process.cwd(), ['rev-parse', '--path-format=absolute', '--git-common-dir']).trim()); } catch { process.stderr.write('run from inside the repo\n'); process.exit(2); }
+  const r = safeRemoveWorktree(repo, target);
+  process.stdout.write(`${r.ok ? 'REMOVED' : 'REFUSED'} ${path.resolve(target)}${r.unlinked.length ? ` (unlinked ${r.unlinked.length} link(s): ${r.unlinked.slice(0, 5).join(', ')})` : ''}${r.reason ? ` - ${r.reason}` : ''}\n`);
+  process.exit(r.ok ? 0 : 1);
+}
+
+module.exports = { unlinkAllLinks, safeRemoveWorktree, evaluateWorktrees, ensureWorktreeSpace, reclaimAllEligible, listRegisteredWorktrees, formatReport, DEFAULT_MIN_IDLE_MS };

package/core/.formation/tools/worktree-reclaim.test.js

@@ -180,3 +180,116 @@ test('re-dispatch of a reclaimed card recreates the worktree from its branch wit
     assert.strictEqual(fs.readFileSync(path.join(wt, 'f8.txt'), 'utf8'), 'work 8\n');
   } finally { cleanup(root); }
 });
+
+// ── TASK_2485: removal must never traverse a link into the main repo ─────────────────────────────
+// Measured (Windows, Git for Windows): `git worktree remove --force` follows EVERY junction (any name,
+// any depth, also inside a real node_modules) and empties its target; fs.rmSync, Git Bash rm -rf and
+// cmd rmdir /s do not. Control = the same fixture removed with the raw git command.
+const { safeRemoveWorktree, unlinkAllLinks } = require('./worktree-reclaim');
+const IS_WIN = process.platform === 'win32';
+
+function mainFixture() {
+  const { root, repo } = makeRepo();
+  fs.mkdirSync(path.join(repo, 'backend'));
+  fs.writeFileSync(path.join(repo, 'backend', 'a.js'), 'tracked');
+  fs.writeFileSync(path.join(repo, '.gitignore'), '.kenaz/tasks\n.formation/worktrees\nnode_modules\n.env\n');
+  g(repo, 'add', '-A'); g(repo, 'commit', '-qm', 'backend');
+  fs.writeFileSync(path.join(repo, 'backend', '.env'), 'SECRET'); // untracked, unrecoverable
+  fs.mkdirSync(path.join(repo, 'node_modules', '@gameark'), { recursive: true });
+  fs.mkdirSync(path.join(repo, 'node_modules', '.bin'));
+  fs.writeFileSync(path.join(repo, 'node_modules', '.bin', 'x'), 'bin');
+  fs.symlinkSync(path.join(repo, 'backend'), path.join(repo, 'node_modules', '@gameark', 'backend'), 'junction'); // workspace link
+  return { root, repo };
+}
+const lostFiles = (repo) => ['backend/.env', 'backend/a.js', 'node_modules/.bin/x'].filter((f) => !fs.existsSync(path.join(repo, f)));
+// where the dangerous link sits inside the dispatch worktree (createWorktree already links node_modules)
+const VARIANTS = {
+  'node_modules junction (dispatch)': () => {},
+  'link not named node_modules': (wt, repo) => fs.symlinkSync(path.join(repo, 'node_modules'), path.join(wt, 'shared'), 'junction'),
+  'link deeper than NODE_MODULES_SCAN_DEPTH': (wt, repo) => { const d = path.join(wt, 'a', 'b', 'c', 'd', 'e'); fs.mkdirSync(d, { recursive: true }); fs.symlinkSync(path.join(repo, 'backend'), path.join(d, 'deep'), 'junction'); },
+  'workspace junction inside a real node_modules': (wt, repo) => { fs.rmSync(path.join(wt, 'node_modules'), { recursive: true, force: true }); fs.mkdirSync(path.join(wt, 'node_modules', '@gameark'), { recursive: true }); fs.symlinkSync(path.join(repo, 'backend'), path.join(wt, 'node_modules', '@gameark', 'backend'), 'junction'); },
+};
+function dispatchWt(repo, name, variant) {
+  const wt = path.join(repo, '.formation', 'worktrees', name);
+  const q = quiet(); createWorktree(repo, wt, `task/${name}`); q();
+  VARIANTS[variant](wt, repo);
+  return wt;
+}
+
+for (const variant of Object.keys(VARIANTS)) {
+  test(`2485 ${variant}: raw git worktree remove loses main files (control), safe removal keeps them`, () => {
+    const ctl = mainFixture();
+    const t = mainFixture();
+    try {
+      const wtc = dispatchWt(ctl.repo, 'ctl', variant);
+      try { g(ctl.repo, 'worktree', 'remove', '--force', wtc); } catch { /* may stop on a locked file */ }
+      const lost = lostFiles(ctl.repo);
+      console.log(`  control (${variant}): raw 'git worktree remove --force' lost in MAIN repo: ${lost.length ? lost.join(', ') : '(nothing)'}`);
+      if (IS_WIN) assert.ok(lost.length > 0, 'control must lose files, else the fixture proves nothing');
+
+      const wt = dispatchWt(t.repo, 'trt', variant);
+      const r = safeRemoveWorktree(t.repo, wt);
+      assert.ok(r.ok, JSON.stringify(r));
+      assert.ok(r.unlinked.length > 0);
+      assert.ok(!fs.existsSync(wt));
+      assert.deepStrictEqual(lostFiles(t.repo), []);
+      assert.strictEqual(fs.readFileSync(path.join(t.repo, 'backend', '.env'), 'utf8'), 'SECRET');
+      assert.ok(!g(t.repo, 'worktree', 'list').includes('trt'));
+    } finally { cleanup(ctl.root); cleanup(t.root); }
+  });
+}
+
+test('2485 orphan dir under .formation/worktrees (not registered) is removed safely, links unlinked first', () => {
+  const { root, repo } = mainFixture();
+  try {
+    const orphan = path.join(repo, '.formation', 'worktrees', 'orphan');
+    fs.mkdirSync(path.join(orphan, 'node_modules', '@gameark'), { recursive: true });
+    fs.symlinkSync(path.join(repo, 'backend'), path.join(orphan, 'node_modules', '@gameark', 'backend'), 'junction');
+    fs.symlinkSync(path.join(repo, 'node_modules'), path.join(orphan, 'node_modules2'), 'junction');
+    assert.ok(!g(repo, 'worktree', 'list').includes('orphan'));
+    const r = safeRemoveWorktree(repo, orphan);
+    assert.ok(r.ok && !r.registered, JSON.stringify(r));
+    assert.strictEqual(r.unlinked.length, 2);
+    assert.ok(!fs.existsSync(orphan));
+    assert.deepStrictEqual(lostFiles(repo), []);
+  } finally { cleanup(root); }
+});
+
+test('2485 safeRemoveWorktree refuses the main checkout and paths outside worktree dirs', () => {
+  const { root, repo } = mainFixture();
+  try {
+    const other = path.join(root, 'elsewhere'); fs.mkdirSync(other);
+    assert.strictEqual(safeRemoveWorktree(repo, repo).ok, false);
+    assert.strictEqual(safeRemoveWorktree(repo, other).ok, false);
+    assert.ok(fs.existsSync(other));
+    assert.deepStrictEqual(lostFiles(repo), []);
+  } finally { cleanup(root); }
+});
+
+test('2485 a link that cannot be unlinked is refused and named, nothing removed', () => {
+  const { root, repo } = mainFixture();
+  try {
+    const wt = dispatchWt(repo, 'stuck', 'link not named node_modules');
+    const realUnlink = fs.unlinkSync; const realRmdir = fs.rmdirSync;
+    fs.unlinkSync = () => { throw new Error('locked'); }; fs.rmdirSync = () => { throw new Error('locked'); };
+    let r;
+    try { r = safeRemoveWorktree(repo, wt); } finally { fs.unlinkSync = realUnlink; fs.rmdirSync = realRmdir; }
+    assert.strictEqual(r.ok, false);
+    assert.match(r.reason, /cannot unlink: /);
+    assert.ok(fs.existsSync(wt));
+    assert.deepStrictEqual(lostFiles(repo), []);
+  } finally { cleanup(root); }
+});
+
+test('2485 CLI: worktree-reclaim.js remove <path> works from inside the repo', () => {
+  const { root, repo } = mainFixture();
+  try {
+    const wt = dispatchWt(repo, 'cli', 'link not named node_modules');
+    const out = require('child_process').spawnSync(process.execPath, [path.join(__dirname, 'worktree-reclaim.js'), 'remove', wt], { cwd: repo, encoding: 'utf8' });
+    assert.strictEqual(out.status, 0, out.stdout + out.stderr);
+    assert.match(out.stdout, /REMOVED/);
+    assert.ok(!fs.existsSync(wt));
+    assert.deepStrictEqual(lostFiles(repo), []);
+    void unlinkAllLinks;
+  } finally { cleanup(root); }
+});

package/core/.specialist/Ansuz/RULES.md

@@ -80,7 +80,11 @@ the real defect BEFORE carding or dispatching.
   (ok, exitCode, lastMessage, commits; `no commits` = failure), then verify and merge `executor.branchName` as usual.
   In a `kenaz launch` session (KENAZ_PROVIDER set), Claude subagents also come as an executor block (adapter `claude`, they use the user's Claude quota).
 - Worktree subagents must commit; cleanup deletes uncommitted edits. Remove Kenaz worktrees only
-  via .formation/tools/worktree-reclaim.js (it unlinks node_modules junctions first).
+  via `node <core>/.formation/tools/worktree-reclaim.js remove <path>` (registered worktrees and orphan dirs under
+  .formation/worktrees or .claude/worktrees). It unlinks EVERY junction/symlink (any name, any depth) first and
+  refuses if one survives. Never hand-run `git worktree remove --force`, `rm -rf`, `rmdir /s` or
+  `Remove-Item -Recurse` on a worktree: on Windows git follows junctions and empties the MAIN repo's
+  node_modules, backend/.env and tracked files (TASK_2485, field report 2026-10-20).
 
 ## Skill moments (TASK_2375)
 Call these with the Skill tool yourself (name may carry the `kenaz:` prefix in a plugin session); nobody types them. Transcript audit: dev/research/skill-routing/AUDIT.md.

package/core/KENAZ_CORE_VERSION

@@ -1 +1 @@
-0.3.23
+0.3.24

package/core/dashboard/scripts/install-kenaz-cli.js

@@ -14,7 +14,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const http = require('http');
-const { spawnSync } = require('child_process');
+const { spawnSync, spawn } = require('child_process');
 
 const ENV_KEY = 'CLAUDE_CODE_PLUGIN_DIRS';
 const BACKUP = 'settings.json.bak-kenaz-peer'; // shared with the Rust path on purpose: one backup of the pristine file
@@ -22,6 +22,7 @@ const MIN_CLI = [2, 1, 287];
 const SEP = process.platform === 'win32' ? ';' : ':';
 const TASK_NAME = 'KenazServer';
 const LABEL = 'ai.kenaz.server';
+const RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';
 const BATTERY_PS = '$s = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero); Set-ScheduledTask -TaskName ' + TASK_NAME + ' -Settings $s';
 const linuxUser = () => { try { return os.userInfo().username; } catch (_) { return process.env.USER || ''; } };
 
@@ -115,9 +116,14 @@ function unregisterStatusline(file, dry) {
 // agent-flow curl/node posts) duplicate what plugins/kenaz/hooks/hooks.json now runs. Single owner = the plugin, so
 // once it is registered these are removed (first write backs up the pristine file to settings.json.bak-kenaz-peer).
 const DASH_HOOK = /_user-scope\.js|[\\/]\.claude[\\/]hooks[\\/][\w.-]+\.js|\/api\/rust\/agent-flow\/hook/;
+// Field report 2026-10-19: Kenaz never wrote hooks into the user's own ~/.claude/hooks, so a hook there is the user's.
+const HOME_HOOKS = /(^|["'\s])(~|\$\{?HOME\}?|%USERPROFILE%)[\\/]\.claude[\\/]hooks[\\/]/i;
+const slashLower = (s) => s.replace(/\\/g, '/').toLowerCase();
 /** @returns number of hook commands retired */
 function retireDashboardHooks(file, dry) {
   if (!fs.existsSync(file)) return 0;
+  const homeHooks = slashLower(path.join(path.dirname(file), 'hooks')) + '/';
+  const isDash = (c) => DASH_HOOK.test(c) && !HOME_HOOKS.test(c) && !slashLower(c).includes(homeHooks);
   const v = loadSettings(file);
   if (!v.hooks || typeof v.hooks !== 'object' || Array.isArray(v.hooks)) return 0;
   let n = 0;
@@ -126,7 +132,7 @@ function retireDashboardHooks(file, dry) {
     const groups = [];
     for (const g of v.hooks[ev]) {
       if (!g || !Array.isArray(g.hooks)) { groups.push(g); continue; }
-      const kept = g.hooks.filter((h) => !(h && typeof h.command === 'string' && DASH_HOOK.test(h.command)));
+      const kept = g.hooks.filter((h) => !(h && typeof h.command === 'string' && isDash(h.command)));
       n += g.hooks.length - kept.length;
       if (kept.length) groups.push(kept.length === g.hooks.length ? g : { ...g, hooks: kept });
     }
@@ -146,12 +152,14 @@ function claudeVersion() {
 // ---- service definitions (pure; the OS calls are in service* below) ----
 function launcherPaths(home) {
   const d = path.join(home, '.kenaz');
-  return { dir: d, vbs: path.join(d, 'kenaz-server.vbs'), log: path.join(d, 'kenaz-server.log') };
+  return { dir: d, log: path.join(d, 'kenaz-server.log') };
 }
 const q = (s) => '"' + s + '"';
-function winVbs(bin, core) { // hidden window, env for task tools; server binds loopback by default
-  return 'Set sh = WScript.CreateObject("WScript.Shell")\r\nsh.Environment("Process")("KENAZ_SOURCE_DIR") = "' + core + '"\r\n' +
-    'sh.Run """' + bin + '""", 0, False\r\n';
+// TASK_2478: kenaz-server is a no-console binary on Windows and takes the core dir as an argument (no launcher script).
+function winRunCmd(bin, core) { return q(bin) + ' --source-dir ' + q(core); }
+// TASK_2478 migration: the old script-host launchers (antivirus flagged them); removed on install and uninstall.
+function legacyLaunchers(home, roaming) {
+  return [path.join(home, '.kenaz', 'kenaz-server.vbs'), path.join(roaming, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'KenazServer.vbs')]; // legacy-vbs-cleanup
 }
 // launchd and systemd start the server with a bare PATH (/usr/bin:/bin...), so `node` from Homebrew,
 // nvm or /usr/local was not found and every MCP tool that runs a node script failed with
@@ -197,8 +205,7 @@ function servicePlan(home, bin, core, platform = process.platform, caps = { syst
   const L = launcherPaths(home);
   if (platform === 'win32') {
     const roaming = home === os.homedir() && process.env.APPDATA ? process.env.APPDATA : path.join(home, 'AppData', 'Roaming');
-    const startup = path.join(roaming, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'KenazServer.vbs');
-    return { kind: 'windows', files: [[L.vbs, winVbs(bin, core)]], fallbackFile: startup };
+    return { kind: 'windows', files: [], bin, core, runCmd: winRunCmd(bin, core), legacy: legacyLaunchers(home, roaming) };
   }
   if (platform === 'darwin') {
     const p = path.join(home, 'Library', 'LaunchAgents', LABEL + '.plist');
@@ -241,8 +248,7 @@ function restartHint(plan, uid = defaultUid()) {
   if (plan.kind === 'launchd') return 'launchctl kickstart -k gui/' + uid + '/' + LABEL;
   if (plan.kind === 'systemd') return 'systemctl --user restart kenaz-server';
   if (plan.kind === 'cron' || plan.kind === 'manual') return stopCmd(plan) + '; ' + detachedStartCmd(plan);
-  // the launcher works for both the scheduled task and the Startup-folder fallback (no admin rights needed)
-  return 'end kenaz-server.exe in Task Manager, then run: wscript.exe ' + q(plan.files && plan.files[0] ? plan.files[0][0] : 'kenaz-server.vbs');
+  return 'end kenaz-server.exe in Task Manager, then run: ' + plan.runCmd;
 }
 function serviceRestart(plan, dry, log, run = sh, uid = defaultUid()) {
   if (plan.kind === 'cron' || plan.kind === 'manual') { // no supervisor: start it (stopOwnServer freed the old one)
@@ -297,12 +303,13 @@ async function verifyRuntime(plan, expected, log, opts = {}) {
   return 'unreachable';
 }
 
-function serviceInstall(plan, dry, log, run = sh, uid) {
+function serviceInstall(plan, dry, log, run = sh, uid, spawnFn = spawn) {
   const sh = run; // injectable for tests; shadows the module-level spawnSync wrapper inside this function
   for (const [f, body] of plan.files) { log('write ' + f); if (!dry) { fs.mkdirSync(path.dirname(f), { recursive: true }); fs.writeFileSync(f, body); } }
   if (plan.kind === 'windows') {
-    const tr = 'wscript.exe ' + q(plan.files[0][0]);
-    log('schtasks /Create /TN ' + TASK_NAME + ' /SC ONLOGON /TR ' + tr + ' /F  (fallback: ' + plan.fallbackFile + ')');
+    const tr = plan.runCmd;
+    log('schtasks /Create /TN ' + TASK_NAME + ' /SC ONLOGON /TR ' + tr + ' /F  (fallback: ' + RUN_KEY + '\\' + TASK_NAME + ')');
+    removeLegacy(plan, dry, log);
     if (dry) return;
     const r = sh('schtasks', ['/Create', '/TN', TASK_NAME, '/SC', 'ONLOGON', '/TR', tr, '/F']);
     if (r.status === 0) {
@@ -311,13 +318,13 @@ function serviceInstall(plan, dry, log, run = sh, uid) {
       const b = sh('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', BATTERY_PS]);
       if (b.status !== 0) log('WARNING: could not set the task to run on battery (exit ' + b.status + '); on a laptop the server may not start unplugged. Run in PowerShell: ' + BATTERY_PS);
       sh('schtasks', ['/Run', '/TN', TASK_NAME]);
-    } else { // ONLOGON tasks can need elevation: a Startup-folder launcher is the per-user equivalent
-      fs.mkdirSync(path.dirname(plan.fallbackFile), { recursive: true });
-      fs.copyFileSync(plan.files[0][0], plan.fallbackFile);
-      sh('wscript.exe', [plan.files[0][0]]);
+    } else { // ONLOGON tasks can need elevation: an HKCU Run value is the per-user equivalent
+      sh('reg', ['add', RUN_KEY, '/v', TASK_NAME, '/t', 'REG_SZ', '/d', plan.runCmd, '/f']);
+      const c = spawnFn(plan.bin, ['--source-dir', plan.core], { detached: true, stdio: 'ignore', windowsHide: true });
+      c.on('error', () => {}); c.unref();
       // schtasks' stderr is in the console's OEM code page (garbled when echoed); the usual cause is
-      // missing admin rights for /SC ONLOGON. The Startup-folder launcher starts at logon the same way.
-      log('schtasks needs administrator rights here (exit ' + r.status + '); installed the Startup-folder launcher instead (also starts at logon)');
+      // missing admin rights for /SC ONLOGON. The Run value starts the server at logon the same way.
+      log('schtasks needs administrator rights here (exit ' + r.status + '); registered the HKCU Run value instead (also starts at logon)');
     }
   } else if (plan.kind === 'launchd') {
     log('launchctl load -w ' + plan.unit); if (!dry) sh('launchctl', ['load', '-w', plan.unit]);
@@ -340,11 +347,16 @@ function serviceInstall(plan, dry, log, run = sh, uid) {
     serviceRestart(plan, dry, log, sh, uid);
   }
 }
+function removeLegacy(plan, dry, log) {
+  for (const f of plan.legacy || []) if (fs.existsSync(f)) { log('remove ' + f + ' (old launcher)'); if (!dry) fs.rmSync(f, { force: true }); }
+}
 function serviceUninstall(plan, dry, log, run = sh) {
   if (plan.kind === 'windows') {
     log('schtasks /End + /Delete /TN ' + TASK_NAME);
     if (!dry) { run('schtasks', ['/End', '/TN', TASK_NAME]); run('schtasks', ['/Delete', '/TN', TASK_NAME, '/F']); }
-    if (fs.existsSync(plan.fallbackFile)) { log('remove ' + plan.fallbackFile); if (!dry) fs.rmSync(plan.fallbackFile, { force: true }); }
+    log('reg delete ' + RUN_KEY + ' /v ' + TASK_NAME);
+    if (!dry) run('reg', ['delete', RUN_KEY, '/v', TASK_NAME, '/f']); // not-found is fine
+    removeLegacy(plan, dry, log);
   } else if (plan.kind === 'launchd') {
     log('launchctl unload ' + plan.unit); if (!dry) run('launchctl', ['unload', '-w', plan.unit]);
   } else if (plan.kind === 'cron' || plan.kind === 'manual') {
@@ -358,7 +370,7 @@ function serviceUninstall(plan, dry, log, run = sh) {
 function serviceStatus(plan, run = sh) {
   if (plan.kind === 'cron') { const c = readCron(run); return c && c.includes(CRON_MARK) ? 'cron @reboot entry present' : 'not installed'; }
   if (plan.kind === 'manual') return 'manual (no systemd user session, no crontab)';
-  if (plan.kind === 'windows') return run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (fs.existsSync(plan.fallbackFile) ? 'startup launcher present' : 'not installed');
+  if (plan.kind === 'windows') return run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (run('reg', ['query', RUN_KEY, '/v', TASK_NAME]).status === 0 ? 'Run key present' : 'not installed');
   if (plan.kind === 'systemd') return run('systemctl', ['--user', 'is-active', 'kenaz-server']).stdout.trim() || 'not installed';
   return fs.existsSync(plan.unit) ? 'plist present' : 'not installed';
 }
@@ -366,10 +378,9 @@ function serviceStatus(plan, run = sh) {
 /** Which mechanism keeps the server running on this machine (for `kenaz doctor`). Read-only, all via `run`. */
 function detectServiceMode(home, core, run = sh, platform = process.platform) {
   if (platform === 'win32') {
-    const plan = servicePlan(home, '', core, 'win32');
     if (run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0) return { mode: 'windows task', detail: 'scheduled task ' + TASK_NAME };
-    if (fs.existsSync(plan.fallbackFile)) return { mode: 'startup launcher', detail: plan.fallbackFile };
-    return { mode: 'manual', detail: 'no scheduled task or Startup launcher; run `kenaz install`' };
+    if (run('reg', ['query', RUN_KEY, '/v', TASK_NAME]).status === 0) return { mode: 'run key', detail: RUN_KEY + '\\' + TASK_NAME };
+    return { mode: 'manual', detail: 'no scheduled task or Run key; run `kenaz install`' };
   }
   if (platform === 'darwin') {
     const p = servicePlan(home, '', core, 'darwin').unit;
@@ -468,4 +479,4 @@ function main(argv, out = console.log, getVersion = claudeVersion, deps = {}) {
 }
 
 if (require.main === module) process.exit(main(process.argv.slice(2)));
-module.exports = { main, verifyRuntime, healthOnce, serviceInstall, serviceRestart, restartHint, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, registerStatusline, unregisterStatusline, retireDashboardHooks, servicePlan, detectServiceMode, probeLinux, cronLine, CRON_MARK, winVbs, launchdPlist, systemdUnit, parseVersion, cmpVersion };
+module.exports = { main, verifyRuntime, healthOnce, serviceInstall, serviceUninstall, serviceRestart, restartHint, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, registerStatusline, unregisterStatusline, retireDashboardHooks, servicePlan, detectServiceMode, probeLinux, cronLine, CRON_MARK, winRunCmd, RUN_KEY, launchdPlist, systemdUnit, parseVersion, cmpVersion };

package/core/dev/scripts/gc-agent-worktrees.js

@@ -365,7 +365,8 @@ function main() {
     // checkout's node_modules). Reuse the hook's helper (never copy it). If it is
     // unavailable, refuse to remove rather than risk traversal.
     try {
-      require(path.join(__dirname, '..', '..', '.claude', 'hooks', 'worktree-create.js')).unlinkNodeModulesLinks(wt.path);
+      const unl = require(path.join(__dirname, '..', '..', '.claude', 'hooks', 'worktree-create.js')).unlinkNodeModulesLinks(wt.path);
+      if (unl.failed.length) throw new Error('link(s) survive unlink: ' + unl.failed.slice(0, 3).join(', '));
     } catch (err) {
       console.log(` FAILED (node_modules unlink unavailable, not removing): ${err.message.trim()}`);
       failedCount++;

package/core/dev/scripts/peer-identity-e2e.js

@@ -195,7 +195,9 @@ async function main() {
   const missing = Object.entries({ relay: BIN.relay, relayOld: BIN.relayOld, server: BIN.server, serverOldSrc: BIN.serverOldSrc }).filter(([, p]) => !fs.existsSync(p));
   if (missing.length) { console.error(`missing binaries: ${missing.map(([k, p]) => `${k}=${p}`).join(', ')}`); return 2; }
   for (const p of Object.values(PORT)) if (!(await portFree(p))) { console.error(`port ${p} busy; aborting`); return 2; }
-  TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'kenaz-peer-e2e-'));
+  // TASK_2480: not under os.tmpdir() - the server refuses to register (and prunes) projects in the OS temp dir
+  fs.mkdirSync(path.join(REPO, '.tmp'), { recursive: true });
+  TMP = fs.mkdtempSync(path.join(REPO, '.tmp', 'kenaz-peer-e2e-'));
   const runId = path.basename(TMP);
   console.log(`peer-identity-e2e: temp dir ${TMP}${CONTROL ? ' (control run: wrong fingerprint in scenario 3)' : ''}`);
   const gitBefore = gitState();

package/core/dev/scripts/windows-hide-guard.test.js

@@ -34,8 +34,9 @@ function walk(dir, exts, out = []) {
   return out;
 }
 
-// plugins/kenaz/hooks/core-resolve.js is generated (gitignored) from .claude/hooks/core-resolve.js
-const isGenerated = (rel) => rel === 'plugins/kenaz/hooks/core-resolve.js';
+// generated (gitignored) copies of scanned sources: core-resolve.js from .claude/hooks, packages/kenaz/vendor/ from
+// dashboard/scripts by packages/kenaz/scripts/stage.js at pack time (a stale local copy must not fail the guard)
+const isGenerated = (rel) => rel === 'plugins/kenaz/hooks/core-resolve.js' || rel.startsWith('packages/kenaz/vendor/');
 
 function matchParen(src, open) {
   let depth = 0, q = null;
@@ -95,3 +96,17 @@ test('Rust: no raw Command::new in production code outside common/process.rs', (
   console.log(`rust violations: ${bad.length}`);
   assert.deepStrictEqual(bad, []);
 });
+
+// TASK_2478: no script-host autostart (antivirus flags schtasks ONLOGON + wscript + .vbs). The only allowed mentions
+// are the migration cleanup of the old launcher files, marked `legacy-vbs-cleanup` on the same line.
+test('Node: shipped JS neither runs wscript nor writes a .vbs (outside the marked migration cleanup)', () => {
+  const files = ['dashboard/scripts', 'packages/kenaz', 'plugins'].flatMap((d) => walk(d, ['.js', '.cjs', '.mjs'])).filter((f) => !isGenerated(f));
+  const bad = [];
+  for (const f of files) {
+    fs.readFileSync(path.join(ROOT, f), 'utf8').split('\n').forEach((ln, i) => {
+      if (/wscript|cscript|\.vbs\b/i.test(ln) && !ln.includes('legacy-vbs-cleanup')) bad.push(`${f}:${i + 1}`);
+    });
+  }
+  console.log(`script-host violations: ${bad.length}`);
+  assert.deepStrictEqual(bad, []);
+});

package/core/plugins/kenaz/hooks/hooks.json

@@ -60,6 +60,15 @@
           }
         ]
       },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" worktree-guard"
+          }
+        ]
+      },
       {
         "matcher": "Agent|Task",
         "hooks": [

package/core/plugins/kenaz/hooks/kenaz-hook.js

@@ -35,6 +35,7 @@ const HOOKS = {
   'memory-guard':   { kind: 'script', file: 'memory-guard.js', call: 'main', minMode: 'full' },
   'vendor-agent-guard': { kind: 'script', file: 'vendor-agent-guard.js', call: 'main', minMode: 'assist' },
   'peer-session-fill': { kind: 'script', file: 'peer-session-fill.js', call: 'main', minMode: 'assist' },
+  'worktree-guard': { kind: 'inline', file: 'worktree-guard.js', minMode: 'assist' }, // TASK_2485: runs from the plugin itself, needs no core
   'task-bridge':    { kind: 'script', file: 'task-bridge.js', minMode: 'assist' },
 };
 
@@ -59,14 +60,14 @@ function startServer(dir) {
     const meta = JSON.parse(fs.readFileSync(path.join(home, '.kenaz', 'install.json'), 'utf8'));
     const bin = meta && meta.serverBin;
     if (!bin || !fs.existsSync(bin)) return false;
-    const vbs = path.join(home, '.kenaz', 'kenaz-server.vbs');
     const core = coreDir(dir);
     const env = Object.assign({}, process.env, core ? { KENAZ_SOURCE_DIR: core } : {});
     const opts = { env, detached: true, stdio: 'ignore', windowsHide: true };
     const viaNode = /\.js$/.test(bin); // a script (tests) runs under node; the real server is a binary
     let child;
     if (process.platform === 'win32') {
-      child = fs.existsSync(vbs) ? spawn('wscript.exe', [vbs], opts) : viaNode ? spawn(process.execPath, [bin], opts) : spawn(bin, [], opts);
+      const args = core ? ['--source-dir', core] : []; // TASK_2478: no console, core dir as an argument
+      child = viaNode ? spawn(process.execPath, [bin, ...args], opts) : spawn(bin, args, opts);
     } else {
       const log = path.join(home, '.kenaz', 'kenaz-server.log');
       const sq = (v) => "'" + String(v).replace(/'/g, "'\\''") + "'";
@@ -140,6 +141,11 @@ function main() {
     if (spec.kind === 'session-start') {
       return post(JSON.stringify({ hook_event_name: 'SessionStart', session_id: process.env.SESSION_ID || 'unknown', project_path: dir }), () => {});
     }
+    if (spec.kind === 'inline') {
+      const out = require('./' + spec.file).decide(JSON.parse(stdin || '{}'));
+      if (out) process.stdout.write(JSON.stringify(out));
+      return;
+    }
     run(spec, stdin, dir);
   };
   if (!spec.backend) return go();

package/core/plugins/kenaz/hooks/worktree-guard.js

@@ -0,0 +1,121 @@
+'use strict';
+// PreToolUse(Bash): deny `git worktree remove`, `rm -r`, `rmdir /s` and `Remove-Item -Recurse` aimed at a
+// directory that contains a symlink/junction (any name, any depth). On Windows `git worktree remove --force`
+// walks THROUGH junctions and empties their targets: field report 2026-10-20 lost node_modules, backend/.env
+// and tracked files of the MAIN repo. Directories without links pass. Fails open on any error or timeout.
+// Safe path: node <core>/.formation/tools/worktree-reclaim.js remove <dir>   (unlinks every link first).
+const fs = require('fs');
+const path = require('path');
+
+const MAX_MS = 2500;
+
+// Quote-aware split into commands (on && || ; | newline), each a token list.
+function commands(line) {
+  const out = []; let tok = ''; let cur = []; let q = null;
+  const endTok = () => { if (tok) cur.push(tok); tok = ''; };
+  const endCmd = () => { endTok(); if (cur.length) out.push(cur); cur = []; };
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (q) { if (c === q) q = null; else tok += c; continue; }
+    if (c === '"' || c === "'") { q = c; continue; }
+    if (c === '\\' && /[ "']/.test(line[i + 1] || '') && process.platform !== 'win32') { tok += line[++i]; continue; }
+    if (/\s/.test(c) && c !== '\n') { endTok(); continue; }
+    if (c === '\n' || c === ';' || c === '|' || c === '&') { endCmd(); continue; }
+    tok += c;
+  }
+  endCmd();
+  return out;
+}
+
+// Directory arguments of a removal command, or [] when the command is not a recursive removal.
+function removalTargets(t) {
+  const base = (s) => s.replace(/^.*[\\/]/, '').replace(/\.exe$/i, '').toLowerCase();
+  const i = t.findIndex((x) => ['git', 'rm', 'rmdir', 'rd', 'remove-item', 'ri', 'del'].includes(base(x)));
+  if (i < 0) return [];
+  const name = base(t[i]); const a = t.slice(i + 1);
+  if (name === 'git') {
+    const k = a.indexOf('worktree');
+    return k >= 0 && a[k + 1] === 'remove' ? a.slice(k + 2).filter((x) => !x.startsWith('-')) : [];
+  }
+  if (name === 'rm') return a.some((x) => /^-[a-z]*[rR]/.test(x) || x === '--recursive') ? a.filter((x) => !x.startsWith('-')) : [];
+  if (name === 'rmdir' || name === 'rd') return a.some((x) => /^\/s$/i.test(x)) ? a.filter((x) => !x.startsWith('/')) : [];
+  // PowerShell: Remove-Item / ri / del with -Recurse
+  if (!a.some((x) => /^-r(ecurse)?$/i.test(x))) return [];
+  const out = []; const valued = /^-(path|literalpath|include|exclude|filter|credential)$/i;
+  for (let j = 0; j < a.length; j++) {
+    if (/^-(path|literalpath)$/i.test(a[j]) && a[j + 1]) { out.push(a[++j]); continue; }
+    if (valued.test(a[j])) { j++; continue; }
+    if (!a[j].startsWith('-')) out.push(a[j]);
+  }
+  return out;
+}
+
+function resolveDir(arg, cwd) {
+  let p = arg;
+  if (/[*?]/.test(p)) return null;
+  const m = /^\/([a-zA-Z])\/(.*)$/.exec(p); // Git Bash /c/Users/...
+  if (m && process.platform === 'win32') p = m[1].toUpperCase() + ':/' + m[2];
+  return path.resolve(cwd || process.cwd(), p);
+}
+
+// First symlink/junction found under dir (lstat walk, never follows), or null.
+function findLink(dir, deadline) {
+  const stack = [dir];
+  while (stack.length) {
+    if (Date.now() > deadline) return null; // too big to prove: fail open
+    const d = stack.pop();
+    let names; try { names = fs.readdirSync(d); } catch { continue; }
+    for (const n of names) {
+      const p = path.join(d, n);
+      let st; try { st = fs.lstatSync(p); } catch { continue; }
+      if (st.isSymbolicLink()) return p;
+      if (st.isDirectory()) stack.push(p);
+    }
+  }
+  return null;
+}
+
+function coreHint(cwd) {
+  try { return require('./core-resolve').resolveCoreDir(cwd) || '<kenaz core>'; } catch (_) { return '<kenaz core>'; }
+}
+
+function decide(input) {
+  if (!input || input.tool_name !== 'Bash') return null;
+  const command = String((input.tool_input && input.tool_input.command) || '');
+  if (!/worktree|rm\b|rmdir|\brd\b|remove-item|\bri\b|\bdel\b/i.test(command)) return null;
+  const deadline = Date.now() + MAX_MS;
+  const cmds = commands(command);
+  // `powershell -Command "Remove-Item ..."` / `bash -c 'rm -rf ..'`: re-parse quoted tokens that hold a whole command
+  for (const t of [...cmds]) for (const tok of t) if (/\s/.test(tok)) cmds.push(...commands(tok));
+  for (const t of cmds) {
+    for (const arg of removalTargets(t)) {
+      const dir = resolveDir(arg, input.cwd);
+      if (!dir) continue;
+      let st; try { st = fs.lstatSync(dir); } catch { continue; }
+      if (!st.isDirectory()) continue; // a link itself, a file, or missing: removing it is safe
+      const link = findLink(dir, deadline);
+      if (!link) continue;
+      return {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason: `Blocked: ${dir} contains a symlink/junction (${path.relative(dir, link)}). ` +
+            '`git worktree remove --force` follows junctions on Windows and empties their targets in the MAIN repo (node_modules, backend/.env, tracked files). ' +
+            'Use the safe remover, which unlinks every link first and refuses if one survives: ' +
+            `node "${coreHint(input.cwd)}/.formation/tools/worktree-reclaim.js" remove "${dir}"`,
+        },
+      };
+    }
+  }
+  return null;
+}
+
+function main() {
+  try {
+    const out = decide(JSON.parse(fs.readFileSync(0, 'utf8') || '{}'));
+    if (out) process.stdout.write(JSON.stringify(out));
+  } catch (_) { /* fail open */ }
+}
+
+if (require.main === module) main();
+module.exports = { decide, main, commands, removalTargets };

package/core/plugins/kenaz/hooks/worktree-guard.test.js

@@ -0,0 +1,75 @@
+'use strict';
+// TASK_2485: the guard denies recursive removal of a dir that holds a junction/symlink, allows link-free dirs.
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { decide } = require('./worktree-guard');
+
+function fixture() {
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'wtguard-')));
+  const target = path.join(root, 'main'); fs.mkdirSync(target);
+  const withLink = path.join(root, 'wt-link'); fs.mkdirSync(path.join(withLink, 'a', 'b'), { recursive: true });
+  fs.symlinkSync(target, path.join(withLink, 'a', 'b', 'anything'), 'junction'); // not named node_modules, nested
+  const plain = path.join(root, 'wt-plain'); fs.mkdirSync(path.join(plain, 'a'), { recursive: true });
+  fs.writeFileSync(path.join(plain, 'a', 'f.txt'), 'x');
+  return { root, withLink, plain, target };
+}
+const bash = (command, cwd) => ({ tool_name: 'Bash', cwd, tool_input: { command } });
+const denied = (r) => r && r.hookSpecificOutput.permissionDecision === 'deny';
+
+test('denies git worktree remove / rm -rf / rmdir /s / Remove-Item -Recurse on a dir holding a junction', () => {
+  const f = fixture();
+  try {
+    const d = f.withLink; const fwd = d.replace(/\\/g, '/');
+    for (const cmd of [
+      `git worktree remove --force "${d}"`,
+      `git -C "${f.root}" worktree remove -f ${fwd}`,
+      `rm -rf "${fwd}"`,
+      `rm -fr ${fwd} && echo done`,
+      `cd ${f.root} && rm -r wt-link`,
+      `rmdir /s /q "${d}"`,
+      `cmd /c rmdir /s /q "${d}"`,
+      `Remove-Item -Recurse -Force "${d}"`,
+      `powershell -Command "Remove-Item -Path '${d}' -Recurse -Force"`,
+    ]) {
+      const r = decide(bash(cmd, f.root));
+      assert.ok(denied(r), `should deny: ${cmd}`);
+      assert.match(r.hookSpecificOutput.permissionDecisionReason, /worktree-reclaim\.js/);
+    }
+  } finally { fs.rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test('same commands on a link-free dir, a missing dir, a link itself and unrelated commands pass (control)', () => {
+  const f = fixture();
+  try {
+    const p = f.plain;
+    for (const cmd of [
+      `git worktree remove --force "${p}"`, `rm -rf "${p.replace(/\\/g, '/')}"`, `rmdir /s /q "${p}"`, `Remove-Item -Recurse -Force "${p}"`,
+      `rm -rf ${path.join(f.root, 'nope')}`, `rm -f ${path.join(f.withLink, 'a', 'b', 'anything')}`, // a plain link/file removal is safe
+      `rm -rf ${f.withLink}/a/b/*`, // glob: cannot resolve, passes
+      `ls ${f.withLink}`, `git status`, `git worktree list`,
+    ]) {
+      assert.strictEqual(decide(bash(cmd, f.root)), null, `should pass: ${cmd}`);
+    }
+    assert.strictEqual(decide({ tool_name: 'Read', tool_input: { command: `rm -rf ${f.withLink}` } }), null);
+  } finally { fs.rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test('through the plugin entry point: deny output for a junction dir, nothing for a plain dir; mode off disables', () => {
+  const f = fixture();
+  try {
+    const hook = path.join(__dirname, 'kenaz-hook.js');
+    const run = (cmd, env = {}) => spawnSync(process.execPath, [hook, 'worktree-guard'], {
+      cwd: f.root, encoding: 'utf8', input: JSON.stringify(bash(cmd, f.root)),
+      env: { ...process.env, CLAUDE_PROJECT_DIR: f.root, KENAZ_MODE: 'full', CLAUDE_CODE_ENTRYPOINT: 'cli', ...env },
+    });
+    const blocked = run(`rm -rf "${f.withLink}"`);
+    assert.strictEqual(blocked.status, 0);
+    assert.strictEqual(JSON.parse(blocked.stdout).hookSpecificOutput.permissionDecision, 'deny');
+    assert.strictEqual(run(`rm -rf "${f.plain}"`).stdout, '');
+    assert.strictEqual(run(`rm -rf "${f.withLink}"`, { KENAZ_MODE: 'off' }).stdout, '');
+  } finally { fs.rmSync(f.root, { recursive: true, force: true }); }
+});

package/core/plugins/kenaz-peer/hooks/register.test.ts

@@ -17,6 +17,7 @@ function setup(on: any, rows: () => unknown[], marker?: () => string | null) {
     const url = String(e.url)
     calls.push(`${e.init?.method ?? 'GET'} ${url}`)
     const reply = (o: unknown) => ({ value: { status: 200, ok: true, headers: {}, text: JSON.stringify(o) } })
+    if (url.includes('/api/health')) return healthOk ? reply({ status: 'ok' }) : { value: { status: 500, ok: false, headers: {}, text: '' } }
     if (url.includes('/pending')) return reply({ messages: delivered ? [] : [msg] })
     if (url.includes('/ack')) { delivered = true; return reply({ acked: ['m1'], already_delivered: [], unknown: [] }) }
     return reply({ ok: true })
@@ -54,7 +55,7 @@ test('heartbeat precedes submit, ack carries the submitted id, second cycle is e
   expect(calls.filter(c => c.includes('/ack')).length).toBe(1)
 })
 
-function uiSetup(on: any, rows: unknown[], statusOk = true) {
+function uiSetup(on: any, rows: unknown[], statusOk = true, healthOk = true) {
   const status: unknown[] = []
   const toasts: string[] = []
   on('session.start', async (_$: any, e: any) => ({ cwd: e.cwd }))
@@ -69,6 +70,7 @@ function uiSetup(on: any, rows: unknown[], statusOk = true) {
     if (url.includes('/pending')) return reply({ messages: delivered ? [] : [{ id: 'm1', framed: 'hi', from_node: 'node-b' }] })
     if (url.includes('/ack')) { delivered = true; return reply({ acked: ['m1'] }) }
     if (url.includes('/status')) return statusOk ? reply({ pending_count: 2, sessions: [{ delivery_mode: 'push' }, { delivery_mode: 'none' }] }) : { value: { status: 500, ok: false, headers: {}, text: '' } }
+    if (url.includes('/api/health')) return healthOk ? reply({ status: 'ok' }) : { value: { status: 503, ok: false, headers: {}, text: '' } }
     return reply({ ok: true })
   })
   on('prompt.submit', async (_$: any, e: any) => e)
@@ -90,13 +92,23 @@ test('Ansuz session: status line from /api/peer/status and a toast naming the se
 
 test('Ansuz session with the server down shows kenaz-server down', async ($, on) => {
   const clock = mock.clock(on)
-  const { status } = uiSetup(on, [{ role: 'user', content: '# Ansuz -- Specialist Prompt' }], false)
+  const { status } = uiSetup(on, [{ role: 'user', content: '# Ansuz -- Specialist Prompt' }], false, false)
   await $.session.start(START)
   await clock.advance(5_000)
   await clock.advance(5_000)
   expect(status.some(s => String(s).includes('kenaz-server down'))).toBe(true)
 })
 
+test('TASK_2480: /status failing while /api/health is up shows peer status slow, not down', async ($, on) => {
+  const clock = mock.clock(on)
+  const { status } = uiSetup(on, [{ role: 'user', content: '# Ansuz -- Specialist Prompt' }], false, true)
+  await $.session.start(START)
+  await clock.advance(5_000)
+  await clock.advance(5_000)
+  expect(status.some(s => String(s).includes('peer status slow'))).toBe(true)
+  expect(status.some(s => String(s).includes('kenaz-server down'))).toBe(false)
+})
+
 test('control: non-Ansuz session gets no status and no toast', async ($, on) => {
   const clock = mock.clock(on)
   const { status, toasts } = uiSetup(on, [{ role: 'user', content: 'hello' }])

package/core/plugins/kenaz-peer/hooks/register.ts

@@ -132,7 +132,12 @@ async function refreshStatus($: any): Promise<void> {
   try {
     const root = await project($)
     const st = await jget($, `${BACKEND}/api/peer/status?projectPath=${encodeURIComponent(root)}&limit=1`)
-    if (!st || typeof st !== 'object') { await $.ui.status('Kenaz: kenaz-server down'); return }
+    if (!st || typeof st !== 'object') {
+      // TASK_2480: a failed /status is not "down": only a failed health probe says the server is down.
+      const alive = await jget($, `${BACKEND}/api/health`)
+      await $.ui.status(alive ? 'Kenaz: peer status slow' : 'Kenaz: kenaz-server down')
+      return
+    }
     const name = root.replace(/[\\/]+$/, '').split(/[\\/]/).pop() || root
     const sessions = Array.isArray(st.sessions) ? st.sessions.filter((s: any) => s?.delivery_mode !== 'none') : []
     const pending = Number(st.pending_count) || 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kenaz",
-  "version": "0.3.23",
+  "version": "0.3.24",
   "description": "Install Kenaz (plugin, hooks, kenaz-server) for Claude Code and Codex: npx kenaz install",
   "bin": {
     "kenaz": "bin/kenaz.js"
@@ -20,11 +20,11 @@
     "test": "node --test lib/cli.test.js"
   },
   "optionalDependencies": {
-    "@kenazai/server-darwin-arm64": "0.3.23",
-    "@kenazai/server-darwin-x64": "0.3.23",
-    "@kenazai/server-linux-arm64": "0.3.23",
-    "@kenazai/server-linux-x64": "0.3.23",
-    "@kenazai/server-win32-x64": "0.3.23"
+    "@kenazai/server-darwin-arm64": "0.3.24",
+    "@kenazai/server-darwin-x64": "0.3.24",
+    "@kenazai/server-linux-arm64": "0.3.24",
+    "@kenazai/server-linux-x64": "0.3.24",
+    "@kenazai/server-win32-x64": "0.3.24"
   },
   "license": "UNLICENSED",
   "repository": {

package/vendor/install-kenaz-cli.js

@@ -14,7 +14,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const http = require('http');
-const { spawnSync } = require('child_process');
+const { spawnSync, spawn } = require('child_process');
 
 const ENV_KEY = 'CLAUDE_CODE_PLUGIN_DIRS';
 const BACKUP = 'settings.json.bak-kenaz-peer'; // shared with the Rust path on purpose: one backup of the pristine file
@@ -22,6 +22,7 @@ const MIN_CLI = [2, 1, 287];
 const SEP = process.platform === 'win32' ? ';' : ':';
 const TASK_NAME = 'KenazServer';
 const LABEL = 'ai.kenaz.server';
+const RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';
 const BATTERY_PS = '$s = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero); Set-ScheduledTask -TaskName ' + TASK_NAME + ' -Settings $s';
 const linuxUser = () => { try { return os.userInfo().username; } catch (_) { return process.env.USER || ''; } };
 
@@ -115,9 +116,14 @@ function unregisterStatusline(file, dry) {
 // agent-flow curl/node posts) duplicate what plugins/kenaz/hooks/hooks.json now runs. Single owner = the plugin, so
 // once it is registered these are removed (first write backs up the pristine file to settings.json.bak-kenaz-peer).
 const DASH_HOOK = /_user-scope\.js|[\\/]\.claude[\\/]hooks[\\/][\w.-]+\.js|\/api\/rust\/agent-flow\/hook/;
+// Field report 2026-10-19: Kenaz never wrote hooks into the user's own ~/.claude/hooks, so a hook there is the user's.
+const HOME_HOOKS = /(^|["'\s])(~|\$\{?HOME\}?|%USERPROFILE%)[\\/]\.claude[\\/]hooks[\\/]/i;
+const slashLower = (s) => s.replace(/\\/g, '/').toLowerCase();
 /** @returns number of hook commands retired */
 function retireDashboardHooks(file, dry) {
   if (!fs.existsSync(file)) return 0;
+  const homeHooks = slashLower(path.join(path.dirname(file), 'hooks')) + '/';
+  const isDash = (c) => DASH_HOOK.test(c) && !HOME_HOOKS.test(c) && !slashLower(c).includes(homeHooks);
   const v = loadSettings(file);
   if (!v.hooks || typeof v.hooks !== 'object' || Array.isArray(v.hooks)) return 0;
   let n = 0;
@@ -126,7 +132,7 @@ function retireDashboardHooks(file, dry) {
     const groups = [];
     for (const g of v.hooks[ev]) {
       if (!g || !Array.isArray(g.hooks)) { groups.push(g); continue; }
-      const kept = g.hooks.filter((h) => !(h && typeof h.command === 'string' && DASH_HOOK.test(h.command)));
+      const kept = g.hooks.filter((h) => !(h && typeof h.command === 'string' && isDash(h.command)));
       n += g.hooks.length - kept.length;
       if (kept.length) groups.push(kept.length === g.hooks.length ? g : { ...g, hooks: kept });
     }
@@ -146,12 +152,14 @@ function claudeVersion() {
 // ---- service definitions (pure; the OS calls are in service* below) ----
 function launcherPaths(home) {
   const d = path.join(home, '.kenaz');
-  return { dir: d, vbs: path.join(d, 'kenaz-server.vbs'), log: path.join(d, 'kenaz-server.log') };
+  return { dir: d, log: path.join(d, 'kenaz-server.log') };
 }
 const q = (s) => '"' + s + '"';
-function winVbs(bin, core) { // hidden window, env for task tools; server binds loopback by default
-  return 'Set sh = WScript.CreateObject("WScript.Shell")\r\nsh.Environment("Process")("KENAZ_SOURCE_DIR") = "' + core + '"\r\n' +
-    'sh.Run """' + bin + '""", 0, False\r\n';
+// TASK_2478: kenaz-server is a no-console binary on Windows and takes the core dir as an argument (no launcher script).
+function winRunCmd(bin, core) { return q(bin) + ' --source-dir ' + q(core); }
+// TASK_2478 migration: the old script-host launchers (antivirus flagged them); removed on install and uninstall.
+function legacyLaunchers(home, roaming) {
+  return [path.join(home, '.kenaz', 'kenaz-server.vbs'), path.join(roaming, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'KenazServer.vbs')]; // legacy-vbs-cleanup
 }
 // launchd and systemd start the server with a bare PATH (/usr/bin:/bin...), so `node` from Homebrew,
 // nvm or /usr/local was not found and every MCP tool that runs a node script failed with
@@ -197,8 +205,7 @@ function servicePlan(home, bin, core, platform = process.platform, caps = { syst
   const L = launcherPaths(home);
   if (platform === 'win32') {
     const roaming = home === os.homedir() && process.env.APPDATA ? process.env.APPDATA : path.join(home, 'AppData', 'Roaming');
-    const startup = path.join(roaming, 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup', 'KenazServer.vbs');
-    return { kind: 'windows', files: [[L.vbs, winVbs(bin, core)]], fallbackFile: startup };
+    return { kind: 'windows', files: [], bin, core, runCmd: winRunCmd(bin, core), legacy: legacyLaunchers(home, roaming) };
   }
   if (platform === 'darwin') {
     const p = path.join(home, 'Library', 'LaunchAgents', LABEL + '.plist');
@@ -241,8 +248,7 @@ function restartHint(plan, uid = defaultUid()) {
   if (plan.kind === 'launchd') return 'launchctl kickstart -k gui/' + uid + '/' + LABEL;
   if (plan.kind === 'systemd') return 'systemctl --user restart kenaz-server';
   if (plan.kind === 'cron' || plan.kind === 'manual') return stopCmd(plan) + '; ' + detachedStartCmd(plan);
-  // the launcher works for both the scheduled task and the Startup-folder fallback (no admin rights needed)
-  return 'end kenaz-server.exe in Task Manager, then run: wscript.exe ' + q(plan.files && plan.files[0] ? plan.files[0][0] : 'kenaz-server.vbs');
+  return 'end kenaz-server.exe in Task Manager, then run: ' + plan.runCmd;
 }
 function serviceRestart(plan, dry, log, run = sh, uid = defaultUid()) {
   if (plan.kind === 'cron' || plan.kind === 'manual') { // no supervisor: start it (stopOwnServer freed the old one)
@@ -297,12 +303,13 @@ async function verifyRuntime(plan, expected, log, opts = {}) {
   return 'unreachable';
 }
 
-function serviceInstall(plan, dry, log, run = sh, uid) {
+function serviceInstall(plan, dry, log, run = sh, uid, spawnFn = spawn) {
   const sh = run; // injectable for tests; shadows the module-level spawnSync wrapper inside this function
   for (const [f, body] of plan.files) { log('write ' + f); if (!dry) { fs.mkdirSync(path.dirname(f), { recursive: true }); fs.writeFileSync(f, body); } }
   if (plan.kind === 'windows') {
-    const tr = 'wscript.exe ' + q(plan.files[0][0]);
-    log('schtasks /Create /TN ' + TASK_NAME + ' /SC ONLOGON /TR ' + tr + ' /F  (fallback: ' + plan.fallbackFile + ')');
+    const tr = plan.runCmd;
+    log('schtasks /Create /TN ' + TASK_NAME + ' /SC ONLOGON /TR ' + tr + ' /F  (fallback: ' + RUN_KEY + '\\' + TASK_NAME + ')');
+    removeLegacy(plan, dry, log);
     if (dry) return;
     const r = sh('schtasks', ['/Create', '/TN', TASK_NAME, '/SC', 'ONLOGON', '/TR', tr, '/F']);
     if (r.status === 0) {
@@ -311,13 +318,13 @@ function serviceInstall(plan, dry, log, run = sh, uid) {
       const b = sh('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', BATTERY_PS]);
       if (b.status !== 0) log('WARNING: could not set the task to run on battery (exit ' + b.status + '); on a laptop the server may not start unplugged. Run in PowerShell: ' + BATTERY_PS);
       sh('schtasks', ['/Run', '/TN', TASK_NAME]);
-    } else { // ONLOGON tasks can need elevation: a Startup-folder launcher is the per-user equivalent
-      fs.mkdirSync(path.dirname(plan.fallbackFile), { recursive: true });
-      fs.copyFileSync(plan.files[0][0], plan.fallbackFile);
-      sh('wscript.exe', [plan.files[0][0]]);
+    } else { // ONLOGON tasks can need elevation: an HKCU Run value is the per-user equivalent
+      sh('reg', ['add', RUN_KEY, '/v', TASK_NAME, '/t', 'REG_SZ', '/d', plan.runCmd, '/f']);
+      const c = spawnFn(plan.bin, ['--source-dir', plan.core], { detached: true, stdio: 'ignore', windowsHide: true });
+      c.on('error', () => {}); c.unref();
       // schtasks' stderr is in the console's OEM code page (garbled when echoed); the usual cause is
-      // missing admin rights for /SC ONLOGON. The Startup-folder launcher starts at logon the same way.
-      log('schtasks needs administrator rights here (exit ' + r.status + '); installed the Startup-folder launcher instead (also starts at logon)');
+      // missing admin rights for /SC ONLOGON. The Run value starts the server at logon the same way.
+      log('schtasks needs administrator rights here (exit ' + r.status + '); registered the HKCU Run value instead (also starts at logon)');
     }
   } else if (plan.kind === 'launchd') {
     log('launchctl load -w ' + plan.unit); if (!dry) sh('launchctl', ['load', '-w', plan.unit]);
@@ -340,11 +347,16 @@ function serviceInstall(plan, dry, log, run = sh, uid) {
     serviceRestart(plan, dry, log, sh, uid);
   }
 }
+function removeLegacy(plan, dry, log) {
+  for (const f of plan.legacy || []) if (fs.existsSync(f)) { log('remove ' + f + ' (old launcher)'); if (!dry) fs.rmSync(f, { force: true }); }
+}
 function serviceUninstall(plan, dry, log, run = sh) {
   if (plan.kind === 'windows') {
     log('schtasks /End + /Delete /TN ' + TASK_NAME);
     if (!dry) { run('schtasks', ['/End', '/TN', TASK_NAME]); run('schtasks', ['/Delete', '/TN', TASK_NAME, '/F']); }
-    if (fs.existsSync(plan.fallbackFile)) { log('remove ' + plan.fallbackFile); if (!dry) fs.rmSync(plan.fallbackFile, { force: true }); }
+    log('reg delete ' + RUN_KEY + ' /v ' + TASK_NAME);
+    if (!dry) run('reg', ['delete', RUN_KEY, '/v', TASK_NAME, '/f']); // not-found is fine
+    removeLegacy(plan, dry, log);
   } else if (plan.kind === 'launchd') {
     log('launchctl unload ' + plan.unit); if (!dry) run('launchctl', ['unload', '-w', plan.unit]);
   } else if (plan.kind === 'cron' || plan.kind === 'manual') {
@@ -358,7 +370,7 @@ function serviceUninstall(plan, dry, log, run = sh) {
 function serviceStatus(plan, run = sh) {
   if (plan.kind === 'cron') { const c = readCron(run); return c && c.includes(CRON_MARK) ? 'cron @reboot entry present' : 'not installed'; }
   if (plan.kind === 'manual') return 'manual (no systemd user session, no crontab)';
-  if (plan.kind === 'windows') return run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (fs.existsSync(plan.fallbackFile) ? 'startup launcher present' : 'not installed');
+  if (plan.kind === 'windows') return run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0 ? 'scheduled task present' : (run('reg', ['query', RUN_KEY, '/v', TASK_NAME]).status === 0 ? 'Run key present' : 'not installed');
   if (plan.kind === 'systemd') return run('systemctl', ['--user', 'is-active', 'kenaz-server']).stdout.trim() || 'not installed';
   return fs.existsSync(plan.unit) ? 'plist present' : 'not installed';
 }
@@ -366,10 +378,9 @@ function serviceStatus(plan, run = sh) {
 /** Which mechanism keeps the server running on this machine (for `kenaz doctor`). Read-only, all via `run`. */
 function detectServiceMode(home, core, run = sh, platform = process.platform) {
   if (platform === 'win32') {
-    const plan = servicePlan(home, '', core, 'win32');
     if (run('schtasks', ['/Query', '/TN', TASK_NAME]).status === 0) return { mode: 'windows task', detail: 'scheduled task ' + TASK_NAME };
-    if (fs.existsSync(plan.fallbackFile)) return { mode: 'startup launcher', detail: plan.fallbackFile };
-    return { mode: 'manual', detail: 'no scheduled task or Startup launcher; run `kenaz install`' };
+    if (run('reg', ['query', RUN_KEY, '/v', TASK_NAME]).status === 0) return { mode: 'run key', detail: RUN_KEY + '\\' + TASK_NAME };
+    return { mode: 'manual', detail: 'no scheduled task or Run key; run `kenaz install`' };
   }
   if (platform === 'darwin') {
     const p = servicePlan(home, '', core, 'darwin').unit;
@@ -468,4 +479,4 @@ function main(argv, out = console.log, getVersion = claudeVersion, deps = {}) {
 }
 
 if (require.main === module) process.exit(main(process.argv.slice(2)));
-module.exports = { main, verifyRuntime, healthOnce, serviceInstall, serviceRestart, restartHint, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, registerStatusline, unregisterStatusline, retireDashboardHooks, servicePlan, detectServiceMode, probeLinux, cronLine, CRON_MARK, winVbs, launchdPlist, systemdUnit, parseVersion, cmpVersion };
+module.exports = { main, verifyRuntime, healthOnce, serviceInstall, serviceUninstall, serviceRestart, restartHint, claudeVersion, loadSettings, entriesOf, norm, MIN_CLI, registerPlugin, unregisterPlugin, registerStatusline, unregisterStatusline, retireDashboardHooks, servicePlan, detectServiceMode, probeLinux, cronLine, CRON_MARK, winRunCmd, RUN_KEY, launchdPlist, systemdUnit, parseVersion, cmpVersion };