nomarmy 0.1.0-alpha.18 → 0.1.0-alpha.19

package/README.md

@@ -16,6 +16,7 @@ AI coding workers are confident. Their "done, all tests pass" is a claim, not ev
 ## TL;DR
 
 1. **Have** Git, Node 24.16+ (or 26.1+) and [Podman](https://podman.io). On macOS, give Podman 8 GiB: `brew install podman && podman machine init --memory 8192 && podman machine start`.
+   Windows is supported with the engine in WSL2. Follow the [Windows setup](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md#windows).
 2. **Install and set up:**
    ```bash
    npm install -g nomarmy@alpha
@@ -74,7 +75,7 @@ Developed and maintained by Rayson Technologies. This is an alpha (`0.1.0-alpha`
 
 | | |
 |---|---|
-| [Install](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md) | Every setup: hosted (API keys and subscriptions), a local model on macOS, Linux, Windows or DGX Spark, a shared model server, Bedrock |
+| [Install](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md) | Every setup: hosted (API keys and subscriptions), a local model on macOS, Linux, [Windows with the engine in WSL2](https://github.com/rayson-tech/nomarmy/blob/main/docs/install.md#windows) or DGX Spark, a shared model server, Bedrock |
 | [Example setup](https://github.com/rayson-tech/nomarmy/blob/main/docs/setup/example.md) | Claude Code, Codex and an API key, command by command |
 | [Agents and the army](https://github.com/rayson-tech/nomarmy/blob/main/docs/agents-and-army.md) | Where a job can run, who does what, usage limits, picking an agent |
 | [`/feature` runs](https://github.com/rayson-tech/nomarmy/blob/main/docs/feature-runs.md) | A feature end to end, and watching what nomArmy is doing |

package/bin/nomarmy.mjs

@@ -18,11 +18,13 @@ import { buildConfigProposal } from "../lib/propose.mjs";
 import { detectHardware } from "../lib/hardware.mjs";
 import { readGGUFMetadata, resolveModelPath, totalSplitBytes } from "../lib/gguf.mjs";
 import { recommend, customRecommendation, evaluateConfig, bytesPerKvElementForCacheTypes, MIN_CONTEXT_PER_NOM } from "../lib/sizing.mjs";
-import { connectClaude, connectCodex, connectCursor, cursorAlreadyConnected, deriveWorkerModelEnv, defaultInstallDir, installMcpCopy, SCOPES, claudeUserScoped, portableServerLaunch } from "../lib/connect.mjs";
+import { windowsFrontEnd, dropWindowsPath, markWindowsCoordinator, pickDistro, resolveWslNomarmy, mcpBridgeLaunch, writeWindowsSettings } from "../lib/wsl.mjs";
+import { windowsPlan, windowsForward, windowsSetup, windowsDoctor } from "../lib/wsl-cli.mjs";
+import { connectViaWsl, connectClaude, connectCodex, connectCursor, cursorAlreadyConnected, deriveWorkerModelEnv, defaultInstallDir, installMcpCopy, SCOPES, claudeUserScoped, portableServerLaunch } from "../lib/connect.mjs";
 import { compareVersions, readPackageVersion, readInstallVersions, copyIsStale } from "../lib/install-freshness.mjs";
 import { loadJobRecords, computeStats, formatStats, formatStatsSummary, parseSince, resolveRepo, agentLookup } from "../lib/stats.mjs";
 import { requestJobStop } from "../lib/openclaw-run.mjs";
-import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings } from "../lib/validators.mjs";
+import { loadValidators, saveJevKey, removeJev, jevSettings, askJev, validatorsPath, JEV_CHECKS, saveJudge, removeJudge, judgeSettings, judgeAgentChoices, chooseJudgeAgent, confirmJudgeHostTools } from "../lib/validators.mjs";
 import { probeModel } from "../lib/model-probe.mjs";
 import { ID_RE, AUTH_ENV_NAME_RE, OPENCLAW_PROVIDER_ID_RE, openclawProviderId, isNativeProviderType } from "../lib/dispatch-schema.mjs";
 import { loadAgents, readAgentsFile, writeAgentsFile, agentsConfigPath, apiAgentAsPoolEntry, describeAgent as describeAgentLabel, agentRunsToolsOnHost, agentProviderId, AGENT_KINDS, API_PROVIDER_TYPES, RESERVED_AGENT_NAMES, BUILTIN_LOCAL_AGENT } from "../lib/agents.mjs";
@@ -40,8 +42,22 @@ import { recordProbeSuccess } from "../lib/health.mjs";
 import { pruneJobRuntime } from "../lib/prune.mjs";
 import { SUBSCRIPTION_VENDORS, parseOpenclawVersion, versionAtLeast, parseCatalogModels, parseCliLoginStatus, probeOutcome, parseMuseAuthDescriptor, extractMintedKey } from "../lib/subscription-setup.mjs";
 import { ensureOpenClawOnPath } from "../lib/openclaw-path.mjs";
+import { THINKING_LEVELS } from "../lib/thinking.mjs";
+import { fileURLToPath } from "node:url";
+// Inside WSL, only the distro's own tools (see lib/wsl.mjs).
+dropWindowsPath();
+// The Windows front end: whatever it forwards knows the coordinators are on Windows.
+if (windowsFrontEnd()) markWindowsCoordinator();
 // OpenClaw in ~/.npm-global/bin (no writable npm prefix) is found without the operator editing PATH.
 ensureOpenClawOnPath();
+// Windows starts the engine as `wsl.exe --exec <node> nomarmy.mjs`, with no
+// login shell, so an nvm Node's directory isn't on PATH. Children that need
+// `node` (install.sh, OpenClaw's `#!/usr/bin/env node`) get the one running.
+{
+  const nodeDir = path.dirname(process.execPath);
+  const entries = (process.env.PATH ?? "").split(path.delimiter);
+  if (!entries.includes(nodeDir)) process.env.PATH = [nodeDir, ...entries.filter(Boolean)].join(path.delimiter);
+}
 
 // Add a new coordinator: add its name here, teach commandExists/connectTarget
 // about it below (a JSON-file target like Cursor has no PATH binary to check
@@ -71,7 +87,7 @@ const repoDir = path.resolve(value("repo", process.cwd()));
 // through the job's requested reasoning); `--no-thinking` is always false.
 // Returns undefined when none of these flags were passed at all, so the
 // caller can tell "not touched" apart from "explicitly set".
-const THINKING_LEVELS = ["low", "medium", "high"];
+// Every level OpenClaw accepts (lib/thinking.mjs).
 function resolveThinkingFlag() {
   const level = value("thinking");
   if (level && THINKING_LEVELS.includes(level)) return level;
@@ -159,7 +175,7 @@ Usage: nomarmy <command> [options]
                             [--update-mcp] (api); --provider --model
                             --owner (subscription); and optionally
                             --max-concurrent --context-window
-                            --thinking [low|medium|high] --no-thinking
+                            --thinking [minimal|low|medium|high|xhigh|adaptive|max|ultra] --no-thinking
                   update <name>
                             change the model (picked from what OpenClaw
                             lists; a subscription gets a real test call),
@@ -252,7 +268,9 @@ Usage: nomarmy <command> [options]
                   and review flags. From verified records, never reports.
   validators <list|add jev|test jev|remove jev|add judge|test judge|remove judge>
                   Optional semantic checks from a model you configure with
-                  your own key. Today: Jev (TypeSafe). \`add jev\` asks for the
+                  your own key. Jev checks focused claims with TypeSafe;
+                  Judge reviews diffs with one of your configured agents.
+                  Setup asks for any consent it needs. \`add jev\` asks for the
                   key without echoing it (or reads --key-stdin), saves it
                   where only you can read it, and makes one test call. Its
                   answers only add review flags, and it sends excerpts of
@@ -463,7 +481,9 @@ async function cmdInit() {
 // This file's own location, not --repo (the target repo being scanned) --
 // setup/model need to find THIS package's config/ and scripts/ as siblings
 // of bin/, the same way select-model.mjs resolves its own root.
-const nomarmyRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), "..");
+// fileURLToPath, not URL.pathname: on Windows that gave "/C:/Users/Jason%20Pugh/...",
+// a stray slash and an encoded space, and connect failed copying from C:\\C:\\...
+const nomarmyRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
 /** Read one KEY=VALUE line's value, or null if the file or key doesn't exist. */
 function readEnvValue(filePath, key) {
@@ -653,6 +673,13 @@ function cmdInstall() {
 }
 
 async function cmdSetup() {
+  if (windowsFrontEnd()) {
+    process.exitCode = await windowsSetup(argv, { ask: async (prompt) => {
+      const rl = createInterface({ input, output });
+      try { return await rl.question(prompt); } finally { rl.close(); }
+    } });
+    return;
+  }
   if (flag("status") || (!flag("choose") && !flag("hosted") && !flag("llama-url") && !json)) {
     if (flag("status") || !process.stdin.isTTY) {
       const steps = setupChecklist();
@@ -1870,6 +1897,9 @@ async function cmdConnect() {
   const requested = argv.slice(1).filter((a, i) => !a.startsWith("--") && !flagValues.has(i + 1));
   const scope = value("scope", "user");
   if (!SCOPES.includes(scope)) throw new Error(`--scope must be one of ${SCOPES.join(", ")}, got "${scope}".`);
+  const nativeWindows = windowsFrontEnd();
+  if (nativeWindows && scope !== "user") throw new Error("per-repo registration on Windows isn't supported yet; use the default --scope user");
+  if (nativeWindows && flag("copy-only")) throw new Error("Windows runs nomArmy inside WSL; run nomarmy connect <target> instead of --copy-only");
   let projectDir = null;
   if (scope !== "user") {
     try { projectDir = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); }
@@ -1904,6 +1934,17 @@ async function cmdConnect() {
     }
     try {
       if (!json) console.log(c.bold(`\n🍪 Connecting nomArmy to ${target}...`));
+      if (nativeWindows) {
+        const capture = (cmd, args, opts = {}) => execFileSync(cmd, args, { stdio: ["ignore", "pipe", "pipe"], ...opts });
+        const distro = pickDistro({ run: capture });
+        const resolved = resolveWslNomarmy({ distro, run: capture });
+        const launch = mcpBridgeLaunch({ distro, ...resolved });
+        const result = connectViaWsl({ target, distro, launch, run, nomarmyRoot });
+        writeWindowsSettings({ distro, ...resolved });
+        results.push({ target, connected: true, ...result });
+        if (!json) console.log(c.green(`✓ Registered nomArmy with ${target}, running inside WSL (${distro})`));
+        continue;
+      }
       const result = connectTarget(target, { nomarmyRoot, run, scope, projectDir });
       results.push({ target, connected: true, ...result });
       if (!json) console.log(c.green(`✓ Registered nomarmy-local-worker with ${target}${scope === "user" ? "." : scope === "local" ? ` for ${projectDir} only (not committed).` : ` in ${path.relative(projectDir, result.configPath ?? path.join(projectDir, ".mcp.json"))}, for everyone who clones this repository.`}`));
@@ -2887,16 +2928,58 @@ async function cmdValidatorsJudge(sub) {
   const resolve = () => judgeSettings({ agents, providerOf: agentProviderId, runsOnHost: agentRunsToolsOnHost });
   const probe = async (settings) => probeModel({ provider: settings.provider, model: settings.model, stateRoot: process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents") });
   if (sub === "add") {
-    const agent = value("agent"), model = value("model");
-    if (!agent || !model) throw new Error("Usage: nomarmy validators add judge --agent <name> --model <model> [--host-tools]");
+    let agent = value("agent"), model = value("model"), dominantBuilderVendor = null;
+    let rl = null;
+    const question = async (prompt) => {
+      rl ??= createInterface({ input, output });
+      return rl.question(c.bold(prompt));
+    };
+    if (!agent) {
+      if (!process.stdin.isTTY || json) throw new Error("Usage: nomarmy validators add judge --agent <name> --model <model> [--host-tools]");
+      const roles = loadArmy({ projectDir: repoDir }).army.roles;
+      const guided = judgeAgentChoices({ agents, roles, providerOf: agentProviderId, runsOnHost: agentRunsToolsOnHost });
+      dominantBuilderVendor = guided.dominantBuilderVendor;
+      if (!guided.choices.length) throw new Error("No api or subscription agents are configured in agents.yml.");
+      agent = (await chooseJudgeAgent({ choices: guided.choices, ask: question, write: (line) => console.log(line) })).name;
+    }
     if (!agents[agent]) throw new Error(`"${agent}" isn't an agent in agents.yml. Agents: ${Object.keys(agents).join(", ") || "(none)"}`);
-    if (agentRunsToolsOnHost(agents[agent]) && !flag("host-tools")) throw new Error(`agent "${agent}" runs its tools on this machine, and a judge reads text the worker wrote. Pass --host-tools to accept that, or pick a sandboxed agent (an api key, Codex, Muse).`);
-    const saved = saveJudge({ agent, model, hostTools: flag("host-tools") });
+    if (!model) {
+      if (!process.stdin.isTTY || json) throw new Error("Usage: nomarmy validators add judge --agent <name> --model <model> [--host-tools]");
+      const listed = catalogModelsFor(agentProviderId(agents[agent]));
+      if (listed.length) {
+        console.log(`Models for ${agent}:`);
+        listed.forEach((item, index) => console.log(`  ${index + 1}. ${item}`));
+      }
+      const fallback = agents[agent].model ?? "";
+      const answer = String(await question(`Model id${fallback ? ` [${fallback}]` : ""}: `)).trim();
+      model = /^\d+$/.test(answer) && listed[Number(answer) - 1] ? listed[Number(answer) - 1] : answer || fallback;
+      if (!model) { rl?.close(); throw new Error("A model id is required."); }
+    }
+    let hostTools = flag("host-tools");
+    if (agentRunsToolsOnHost(agents[agent]) && !hostTools) {
+      if (!process.stdin.isTTY || json) {
+        const quote = (arg) => /^[A-Za-z0-9_./:-]+$/.test(arg) ? arg : `'${arg.replaceAll("'", `'\\''`)}'`;
+        const rerun = ["nomarmy", ...argv, "--host-tools"].map(quote).join(" ");
+        throw new Error(`agent "${agent}" runs its tools on this machine, and a judge reads text the worker wrote. Refusing without explicit consent. Re-run: ${rerun}`);
+      }
+      const allowed = await confirmJudgeHostTools({ agent, ask: question, write: (line) => console.log(line) });
+      if (!allowed) { rl?.close(); console.log(c.dim("Canceled; nothing written.")); return; }
+      hostTools = true;
+    }
+    rl?.close();
+    const saved = saveJudge({ agent, model, hostTools });
     const settings = resolve();
     if (settings?.problem) throw new Error(settings.problem);
     const test = await probe(settings);
     if (json) return out({ saved: true, configPath: saved.configPath, test: test.ok ? "pass" : test.refused ? "refused" : "inconclusive", reason: test.reason });
     console.log(c.green(`✓ The judge is ${agent}/${model}, in ${saved.configPath}.`));
+    if (dominantBuilderVendor === null) {
+      try {
+        const roles = loadArmy({ projectDir: repoDir }).army.roles;
+        dominantBuilderVendor = judgeAgentChoices({ agents, roles, providerOf: agentProviderId, runsOnHost: agentRunsToolsOnHost }).dominantBuilderVendor;
+      } catch { /* no readable army means there is no builder comparison */ }
+    }
+    if (dominantBuilderVendor && agentProviderId(agents[agent]) === dominantBuilderVendor) console.log(c.yellow("Note: this judge uses the same vendor as most build roles, so its verdicts are not independent of those builders."));
     console.log(test.ok ? c.green("✓ Test call answered. New implement jobs use it; restart open coordinator sessions to pick it up.") : c.red(`✗ Test call ${test.refused ? "refused" : "didn't answer"}: ${test.reason ?? "no answer"}`));
     if (!test.ok) process.exitCode = 1;
     return;
@@ -2930,11 +3013,18 @@ function cmdMcp() {
 const commands = { stats: cmdStats, validators: cmdValidators, mcp: cmdMcp, scan: cmdScan, validate: cmdValidate, sizing: cmdSizing, init: cmdInit, setup: cmdSetup, install: cmdInstall, model: cmdModel, agents: cmdAgents, army: cmdArmy, jobs: cmdJobs, statusline: cmdStatusline, health: cmdHealth, config: cmdConfig, update: cmdUpdate, connect: cmdConnect, sandbox: cmdSandbox, start: cmdStart, stop: cmdStop, uninstall: cmdUninstall, help: () => usage(0) };
 // doctor command
 async function cmdDoctor() {
+  if (windowsFrontEnd()) {
+    process.exitCode = windowsDoctor({ json, argv });
+    return;
+  }
   // Import lazily to avoid circular dependencies
   const { runDoctor } = await import("../lib/doctor.mjs");
   await runDoctor({ json, exit: true, env: installEnv() });
 }
 commands.doctor = cmdDoctor;
+if (windowsFrontEnd() && windowsPlan(argv) === "FORWARD") {
+  process.exit(windowsForward(argv));
+}
 if (!command && !flag("help")) {
   // New users typed `nomarmy` and got the whole command reference.
   console.log(`${c.bold("nomArmy")}: bounded coding workers with independently verified results.\n\n  New here?   ${c.cyan("nomarmy setup")}   walks you through it, one step at a time\n  All commands: ${c.cyan("nomarmy help")}\n  Docs: https://github.com/rayson-tech/nomarmy`);

package/docker/Dockerfile

@@ -1,9 +1,9 @@
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
     bash ca-certificates curl git jq python3 python3-pip python3-venv ripgrep \
     && rm -rf /var/lib/apt/lists/*
-# node:24-bookworm-slim already ships a non-root "node" user at uid/gid 1000,
+# The node:*-bookworm-slim images ship a non-root "node" user at uid/gid 1000,
 # the same uid this Dockerfile used to try to create a "sandbox" user at.
 # useradd silently failed on every build (masked by `|| true`), so `USER
 # sandbox` below referred to a user that was never actually created --

package/docker/Dockerfile.go

@@ -1,4 +1,4 @@
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive
 # Same base as docker/Dockerfile plus a Go toolchain -- the worker's own
 # tool-calling harness needs Node regardless of the target repo's language.

package/docker/Dockerfile.rust

@@ -1,4 +1,4 @@
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive
 # Same base as docker/Dockerfile plus a Rust toolchain -- the worker's own
 # tool-calling harness needs Node regardless of the target repo's language.

package/install.sh

@@ -130,10 +130,16 @@ if nomarmy_has_local_model; then openclaw plugins install @openclaw/llama-cpp-pr
 # Bedrock credential unless the coder sandbox is already network-isolated.
 "$ROOT/scripts/setup-sandbox.sh"
 "$ROOT/scripts/configure-openclaw.sh" "$NOMARMY_PROFILE"
-if [[ "$WITH_CLAUDE" == 1 ]]; then
-  if command -v claude >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect claude; else echo 'NOTE: Claude Code not found; worker stack installed. Install Claude Code then run: nomarmy connect claude'; fi
+if [[ "${NOMARMY_COORDINATOR_OS:-}" == windows ]]; then
+  # Run from the Windows front end: the coordinators are Windows programs,
+  # registered from Windows, not looked for inside this distro.
+  echo 'NOTE: register your coordinators from Windows PowerShell: nomarmy connect claude (or codex, cursor)'
+else
+  if [[ "$WITH_CLAUDE" == 1 ]]; then
+    if command -v claude >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect claude; else echo 'NOTE: Claude Code not found; worker stack installed. Install Claude Code then run: nomarmy connect claude'; fi
+  fi
+  if command -v codex >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect codex; else echo 'NOTE: Codex not found; run: nomarmy connect codex (after installing Codex)'; fi
 fi
-if command -v codex >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect codex; else echo 'NOTE: Codex not found; run: nomarmy connect codex (after installing Codex)'; fi
 "$ROOT/scripts/verify-install.sh" "$NOMARMY_PROFILE"
 if nomarmy_is_cloud && [[ "${NOMARMY_ORCHESTRATOR_RUNTIME:-}" == "claude-code" ]]; then
   echo

package/lib/agents.mjs

@@ -37,6 +37,7 @@ import { providerEntrySchema, formatDispatchIssues, openclawProviderId, PROVIDER
 export { HOST_TOOL_PROVIDERS, agentRunsToolsOnHost };
 import { findProviderConflicts, describeProviderConflict } from "./subscription-config.mjs";
 import { privateConfigProblem } from "./army.mjs";
+import { THINKING_LEVELS } from "./thinking.mjs";
 
 export const AGENTS_FILENAME = "agents.yml";
 export const AGENT_KINDS = Object.freeze(["local", "api", "subscription"]);
@@ -48,7 +49,7 @@ export const BUILTIN_LOCAL_AGENT = Object.freeze({ kind: "local", slot: "coder"
 const requiredString = () =>
   z.string({ error: typeError("a string") })
     .refine((value) => value.trim().length > 0, { message: "must not be empty" });
-const thinkingSchema = z.union([z.boolean(), z.enum(["low", "medium", "high"])]).default(true);
+const thinkingSchema = z.union([z.boolean(), z.enum(THINKING_LEVELS)]).default(true);
 const positiveInt = () => z.number({ error: typeError("a number") }).int("must be a whole number").positive("must be a positive number");
 
 const localAgentSchema = z.object({

package/lib/connect.mjs

@@ -24,6 +24,8 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { mcpBridgeLaunch } from "./wsl.mjs";
+import { toPosix } from "./path-utils.mjs";
 import { execFileSync } from "node:child_process";
 import { loadAgents } from "./agents.mjs";
 import { globalConfigDir } from "./army.mjs";
@@ -281,7 +283,8 @@ export function excludeFromGit(projectDir, relPaths, run = defaultRun) {
   excludeFile = path.resolve(projectDir, excludeFile);
   const existing = fs.existsSync(excludeFile) ? fs.readFileSync(excludeFile, "utf8") : "";
   const lines = new Set(existing.split("\n").map((l) => l.trim()));
-  const added = relPaths.map((p) => `/${p}`).filter((p) => !lines.has(p));
+  // Git exclude patterns always use forward slashes, including on Windows.
+  const added = relPaths.map((p) => `/${toPosix(p)}`).filter((p) => !lines.has(p));
   if (added.length) {
     fs.mkdirSync(path.dirname(excludeFile), { recursive: true });
     fs.appendFileSync(excludeFile, `${existing && !existing.endsWith("\n") ? "\n" : ""}# nomArmy, registered for this repository only\n${added.join("\n")}\n`);
@@ -294,7 +297,8 @@ export function includeInGit(projectDir, relPaths, run = defaultRun) {
   let excludeFile;
   try { excludeFile = path.resolve(projectDir, String(run("git", ["rev-parse", "--git-path", "info/exclude"], { cwd: projectDir, stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" })).trim()); } catch { return []; }
   if (!fs.existsSync(excludeFile)) return [];
-  const drop = new Set(relPaths.map((p) => `/${p}`));
+  // Match the same portable spelling written by excludeFromGit on Windows.
+  const drop = new Set(relPaths.map((p) => `/${toPosix(p)}`));
   const lines = fs.readFileSync(excludeFile, "utf8").split("\n");
   const removed = lines.filter((l) => drop.has(l.trim()));
   if (removed.length) fs.writeFileSync(excludeFile, lines.filter((l) => !drop.has(l.trim())).join("\n"));
@@ -551,3 +555,29 @@ export function cursorAlreadyConnected(configPath = defaultCursorConfigPath()) {
     return false;
   }
 }
+
+
+// Windows installs only coordinator playbooks. The engine stays in WSL.
+export function connectViaWsl({ target, distro, launch, run = defaultRun, commandsDir = defaultCommandDirs()[target], configPath = defaultCursorConfigPath(), nomarmyRoot }) {
+  if (!["claude", "codex", "cursor"].includes(target)) throw new Error(`unknown connect target: ${target}`);
+  // Revalidate the direct launch before passing any values to a coordinator.
+  const checked = mcpBridgeLaunch({ distro, node: launch?.args?.[3], script: launch?.args?.[4] });
+  if (JSON.stringify(launch) !== JSON.stringify(checked)) throw new Error("Invalid WSL MCP bridge launch");
+  const { command, args } = checked;
+  const env = { ...checked.env, WSLENV: `${checked.env.WSLENV}:NOMARMY_COORDINATOR_OS/u`, NOMARMY_COORDINATOR_OS: "windows" };
+  if (target === "claude") {
+    quietRun(run, "claude", ["mcp", "remove", SERVER_NAME, "--scope", "user"]);
+    run("claude", ["mcp", "add", "--scope", "user", SERVER_NAME, "-e", `WSLENV=${env.WSLENV}`, "-e", `NOMARMY_COORDINATOR_OS=${env.NOMARMY_COORDINATOR_OS}`, "--", command, ...args]);
+  } else if (target === "codex") {
+    quietRun(run, "codex", ["mcp", "remove", SERVER_NAME]);
+    run("codex", ["mcp", "add", SERVER_NAME, "--env", `WSLENV=${env.WSLENV}`, "--env", `NOMARMY_COORDINATOR_OS=${env.NOMARMY_COORDINATOR_OS}`, "--", command, ...args]);
+  } else {
+    const config = readCursorConfig(configPath);
+    if (!config.mcpServers || typeof config.mcpServers !== "object" || Array.isArray(config.mcpServers)) config.mcpServers = {};
+    config.mcpServers[SERVER_NAME] = { command, args, env: { ...env, NOMARMY_PROJECT_DIR: "${workspaceFolder}" } };
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  }
+  const commands = installPlaybooks({ nomarmyRoot, target, dir: commandsDir });
+  return { target, bridge: { distro }, commands };
+}

package/lib/diff-checks.mjs

@@ -29,6 +29,24 @@ export function isDocumentationPath(file) {
   return DOC_EXTENSIONS.has(ext) || DOC_BASENAMES.has(dot > 0 ? base.slice(0, dot) : base);
 }
 
+export function isCiConfigPath(file) {
+  const normalized = String(file ?? "").replace(/\\/g, "/").replace(/^\.\//, "");
+  return /^\.github\/(workflows|actions)\//.test(normalized)
+    || normalized === ".github/dependabot.yml"
+    || normalized === ".gitlab-ci.yml"
+    || /^\.circleci\//.test(normalized)
+    || normalized === "azure-pipelines.yml"
+    || /^\.buildkite\//.test(normalized)
+    || normalized === "Jenkinsfile"
+    || normalized === "bitbucket-pipelines.yml";
+}
+
+export function planRegressionProductionFiles(files) {
+  // Local repository tests cannot exercise CI services, so reverting CI
+  // configuration cannot provide useful regression evidence.
+  return (files ?? []).filter((file) => !isDocumentationPath(file) && !isCiConfigPath(file));
+}
+
 export function isTestPath(file) {
   const normalized = String(file ?? "").replace(/\\/g, "/").replace(/^\.\//, "");
   if (!normalized) return false;

package/lib/dispatch-schema.mjs

@@ -16,6 +16,7 @@
 
 import { z } from "zod";
 import { typeError, isMissingField, isUnknownDiscriminator } from "./zod-issues.mjs";
+import { THINKING_LEVELS } from "./thinking.mjs";
 
 const requiredString = () =>
   z
@@ -144,7 +145,7 @@ const urlSchema = () =>
 // OpenClaw names as supported (see parseUnsupportedThinkingError) -- so a
 // level this schema accepts is never a guarantee the provider/model
 // combination honors it today, only what to keep asking for.
-const thinkingSchema = z.union([z.boolean(), z.enum(["low", "medium", "high"])]).default(true);
+const thinkingSchema = z.union([z.boolean(), z.enum(THINKING_LEVELS)]).default(true);
 
 // Optional override for the model's real context window, in tokens. Absent
 // (the common case), lib/dispatch-config.mjs looks this up from OpenClaw's

package/lib/doctor.mjs

@@ -145,12 +145,19 @@ export function checkGitLongPaths(facts) {
  * @param {{podmanFound: boolean}} facts
  * @returns {{ok: boolean, message: string, fix?: string}}
  */
+/** How to install Podman here. On Windows and macOS it runs in a small VM that needs creating once. */
+export function installPodmanHint(platform = process.platform) {
+  if (platform === "win32") return "Install Podman ('winget install RedHat.Podman'), then create its VM once: 'podman machine init --memory 8192' and 'podman machine start' (it uses WSL2)";
+  if (platform === "darwin") return "Install Podman ('brew install podman'), then create its VM once: 'podman machine init --memory 8192' and 'podman machine start'";
+  return "Install Podman with your distro's package manager (e.g. 'sudo apt install podman')";
+}
+
 export function checkPodmanPresent(facts) {
   if (facts.podmanFound) return { ok: true, message: "podman is available." };
   return {
     ok: false,
     message: "podman executable not found.",
-    fix: "Install Podman ('brew install podman' on macOS, or your distro's package manager on Linux) and ensure 'podman' is on your PATH.",
+    fix: `${installPodmanHint(facts.platform)}, and make sure 'podman' is on your PATH.`,
   };
 }
 
@@ -217,7 +224,7 @@ export function checkPodmanDaemon(facts) {
     return {
       ok: false,
       message: "Podman check skipped: podman executable not found.",
-      fix: "Install Podman ('brew install podman' on macOS, or your distro's package manager on Linux), then re-run 'nomarmy doctor'.",
+      fix: `${installPodmanHint(facts.platform)}, then re-run 'nomarmy doctor'.`,
     };
   }
   if (facts.podmanDaemonReachable) {
@@ -248,7 +255,7 @@ export function checkEndpoint(facts) {
     };
   }
   if (execution === "remote") return checkRemoteEndpoint(endpoint);
-  if (execution === "local") return checkLocalEndpoint(endpoint);
+  if (execution === "local") return checkLocalEndpoint(endpoint, facts.platform);
   return {
     ok: false,
     message: `NOMARMY_EXECUTION '${execution}' is not recognized.`,
@@ -266,13 +273,14 @@ function checkRemoteEndpoint(endpoint) {
   };
 }
 
-function checkLocalEndpoint(endpoint) {
+function checkLocalEndpoint(endpoint, platform = process.platform) {
   const { url, healthy, error } = endpoint;
   if (healthy) return { ok: true, message: `llama-server is healthy at ${url}.` };
   return {
     ok: false,
     message: `llama-server health check failed at ${url}${error ? `: ${error}` : "."}`,
-    fix: "Start the local worker with './scripts/start-inference.sh' (after 'source scripts/lib.sh && load_profile <profile>'), then re-run 'nomarmy doctor'.",
+    // Most people run jobs on API and subscription agents: say how to choose that, not only how to start a model.
+    fix: `No local model is running. If your jobs run on API keys or subscriptions, choose that with 'nomarmy setup --choose' (hosted). To run a model on this machine: ${platform === "win32" ? "see docs/install.md#windows (the local model needs WSL2 or a native llama.cpp build)" : "'nomarmy start <profile>'"}. Then re-run 'nomarmy doctor'.`,
   };
 }
 

package/lib/execute.mjs

@@ -21,7 +21,7 @@ import { describeRecoveryChanges, reportRecoveryPrompt } from "./worker-prompt.m
 import { parseWorkerReport } from "./report.mjs";
 import { OUTCOMES, COORDINATOR_STATUS_BY_OUTCOME } from "./outcomes.mjs";
 import { resolveOutcome, finalText, workerMetadata, applyRefactorContract, applyVerificationPolicy, HIGH_STAKES_NOTE } from "./outcome.mjs";
-import { parseAddedLineNumbers, isTestPath, isDocumentationPath, detectScopedTestSelectionRisk, detectUnwiredNewDefinitions, detectMislabeledTestNames, detectPossibleSecrets, detectVerificationInputChanges } from "./diff-checks.mjs";
+import { parseAddedLineNumbers, isTestPath, planRegressionProductionFiles, detectScopedTestSelectionRisk, detectUnwiredNewDefinitions, detectMislabeledTestNames, detectPossibleSecrets, detectVerificationInputChanges } from "./diff-checks.mjs";
 
 // ---------------------------------------------------------------------------
 // Job status for polling. `status.json` is written at every phase transition
@@ -286,9 +286,9 @@ export function createExecutor(deps) {
       // profile (resolveVerifyRegression). It doubles verification wall-clock,
       // so it runs only when there's something to re-check: a passing
       // first-pass verification on a diff that touched production code.
-      // Documentation isn't code a test can prove, so it's neither reverted
-      // nor a reason to run the check (isDocumentationPath).
-      const codeFilesChanged = preCommit.testChanges.production_files_changed.filter((f) => !isDocumentationPath(f));
+      // Documentation and CI configuration cannot be proven by local tests,
+      // so neither is reverted or used as a reason to run this check.
+      const codeFilesChanged = planRegressionProductionFiles(preCommit.testChanges.production_files_changed);
       let regressionCheck = null, regressionCheckFatal = false, regressionCheckElapsedMs = null;
       if (verifyRegression && independentVerification.status === "pass" && codeFilesChanged.length > 0) {
         const regressionStartedMs = Date.now();

package/lib/notify.mjs

@@ -4,7 +4,8 @@
 //
 // macOS: nomArmy.app (lib/notifier-app.mjs), which shows nomArmy's own icon,
 // or osascript's `display notification` when the app isn't built (that one
-// shows Script Editor's icon). Linux: notify-send. Anything else, or
+// shows Script Editor's icon). WSL: Windows toast via PowerShell, falling
+// back to Linux notify-send. Other Linux: notify-send. Anything else, or
 // NOMARMY_NOTIFY=0: nothing. Fire-and-forget: a notification must never
 // delay or fail the job that triggered it.
 
@@ -23,6 +24,23 @@ export function appleScriptString(text) {
 export function notificationCommand(title, message, { platform = process.platform, env = process.env, app = null } = {}) {
   if (env.NOMARMY_NOTIFY === "0") return null;
   const t = String(title).slice(0, 120), m = String(message).slice(0, 400);
+  if (env.WSL_DISTRO_NAME) {
+    // EncodedCommand avoids shell/interop quoting. Single-quoted PowerShell
+    // literals and DOM InnerText keep user text out of code and XML markup.
+    const literal = text => `'${text.replace(/['\u2018\u2019\u201a\u201b]/g, quote => quote + quote)}'`;
+    const script = `$ErrorActionPreference = 'Stop'
+[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null
+[Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null
+[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] > $null
+$xml = New-Object Windows.Data.Xml.Dom.XmlDocument
+$xml.LoadXml('<toast><visual><binding template="ToastGeneric"><text/><text/></binding></visual></toast>')
+$text = $xml.GetElementsByTagName('text')
+$text.Item(0).InnerText = ${literal(t)}
+$text.Item(1).InnerText = ${literal(m)}
+$toast = [Windows.UI.Notifications.ToastNotification]::new($xml)
+[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Microsoft.Windows.PowerShell').Show($toast)`;
+    return ["powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")]];
+  }
   if (platform === "darwin" && app) return ["open", ["-g", app.app, "--args", app.spool]];
   if (platform === "darwin") return ["osascript", ["-e", `display notification ${appleScriptString(m)} with title ${appleScriptString(t)}`]];
   if (platform === "linux") return ["notify-send", ["--app-name=nomArmy", t, m]];
@@ -57,10 +75,19 @@ export function notify(title, message, { platform = process.platform, env = proc
   try { if (app && !spoolNotification(app.spool, title, message)) return false; } catch { app = null; }
   const cmd = notificationCommand(title, message, { platform, env, app });
   if (!cmd) return false;
+  let fellBack = false;
+  const fallback = () => {
+    if (fellBack || cmd[0] !== "powershell.exe") return false;
+    fellBack = true;
+    return notify(title, message, { platform, env: { ...env, WSL_DISTRO_NAME: "" }, run, root });
+  };
   try {
+    // Launching PowerShell is also the interop reachability check. Missing or
+    // disabled interop emits error; a failed toast exits nonzero. Both fall back.
     const child = run(cmd[0], cmd[1], { stdio: "ignore", detached: true });
-    child.on?.("error", () => {});
+    child.on?.("error", fallback);
+    child.on?.("exit", (code, signal) => { if (code !== 0 || signal) fallback(); });
     child.unref?.();
     return true;
-  } catch { return false; }
+  } catch { return fallback(); }
 }

package/lib/openclaw-run.mjs

@@ -13,6 +13,7 @@ import { deriveBudgets } from "./budget.mjs";
 import { entryContextPerNom } from "./dispatch-config.mjs";
 import { readClaudeSessionUsage } from "./claude-transcript.mjs";
 import { modelRejection, modelRejectionLine } from "./openclaw-errors.mjs";
+import { nearestThinkingLevel } from "./thinking.mjs";
 
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
 
@@ -580,7 +581,7 @@ export function createOpenClawRunner(deps) {
           // -- never loop on the same level, and never mask a real, unrelated
           // failure as a thinking-level problem it isn't.
           if (unsupported && !unsupported.supported.includes(selected.thinking)) {
-            const fallback = unsupported.supported[0];
+            const fallback = nearestThinkingLevel(selected.thinking, unsupported.supported);
             fs.appendFileSync(path.join(jobDir, "coordinator.log"),
               `${new Date().toISOString()} "${selected.model}" rejected thinking level "${selected.thinking}" (OpenClaw supports: ${unsupported.supported.join(", ")}) -- retrying once with "${fallback}"\n`);
             selected.thinking = fallback; // the manifest's requestedReasoning field should reflect what was ACTUALLY used, not the level that failed

package/lib/path-utils.mjs

@@ -0,0 +1,4 @@
+/** Docker, Git, and repository metadata paths are POSIX paths, even on Windows. */
+export function toPosix(value) {
+  return value.replaceAll("\\", "/");
+}

package/lib/registry-python.mjs

@@ -2,6 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
+import { toPosix } from './path-utils.mjs';
 
 const refuse = (line, kind) => { throw new Error(`registries: Python line ${line}: ${kind} is not allowed with credentials`); };
 function requirement(value, line, cwd) {
@@ -21,7 +22,8 @@ export function requirementsInputs(cwd, roots, validate) {
     try {
       if (!fs.realpathSync(absolute).startsWith(root + path.sep) || !fs.statSync(absolute).isFile()) refuse(line, 'escaping requirements include');
     } catch { refuse(line, 'escaping requirements include'); }
-    source = path.relative(cwd, absolute);
+    // Docker build-context paths must not contain Windows escape backslashes.
+    source = toPosix(path.relative(cwd, absolute));
     if (seen.has(source)) return seen.get(source);
     const index = files.length;
     seen.set(source, index);

package/lib/registry-secrets.mjs

@@ -67,24 +67,36 @@ export function readRegistrySecrets(cwd) {
     const resolved = path.resolve(cwd, source.startsWith("~/") ? path.join(os.homedir(), source.slice(2)) : source);
     let stat, bytes;
     try {
-      stat = fs.statSync(resolved);
+      stat = fs.statSync(resolved, { bigint: true });
       if (!stat.isFile()) fail(ecosystem + " credential must be a regular file");
       bytes = fs.readFileSync(resolved);
     } catch { fail(ecosystem + " credential must be an existing readable regular file"); }
     return {
       ecosystem, id: ecosystem === "go" ? "go-netrc" : ecosystem, source: resolved, format, privatePatterns,
       digest: crypto.createHash("sha256").update(bytes).digest("hex"),
-      device: stat.dev, inode: stat.ino,
+      ...fileIdentity(resolved, stat),
     };
   });
 }
 
+// Same file, hardlinks included. Exact (bigint) IDs, as strings: Windows file
+// IDs are 64-bit (128 on ReFS) and collide once rounded to a double, which
+// flagged unrelated files as the credential on CI. A filesystem that reports
+// no ID (inode 0) falls back to the real path.
+function fileIdentity(file, stat = fs.statSync(file, { bigint: true })) {
+  const real = () => { const p = fs.realpathSync.native(file); return process.platform === "win32" ? p.toLowerCase() : p; };
+  return stat.ino === 0n ? { device: null, inode: null, realPath: real() }
+    : { device: String(stat.dev), inode: String(stat.ino), realPath: null };
+}
+
+const sameFile = (a, b) => a.inode !== null ? a.device === b.device && a.inode === b.inode : a.realPath === b.realPath;
+
 // A selected credential must not also be a dependency input (including hardlinks).
 export function assertNoRegistryCopies(cwd, files, secrets) {
   for (const { source } of files) {
     if (!source) continue;
-    const stat = fs.statSync(path.resolve(cwd, source));
-    if (secrets.some((secret) => secret.device === stat.dev && secret.inode === stat.ino)) {
+    const input = fileIdentity(path.resolve(cwd, source));
+    if (secrets.some((secret) => sameFile(secret, input))) {
       fail("a credential file cannot also be a build-context input");
     }
   }