feat(ru-fork): Windows spawn hardening, {cli} session-id copy, smarter installer, MCP probe

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.

[ru-code-dev]

Spawn policy

• Route every process spawn through a shared policy (resolveSpawn): shell:false by default for executables (fixes project-add on Windows, upstream [codex] Avoid shell for system executables pingdotgg/t3code#2950), optional bash-routing via --windows-use-bash-for= / RU_FORK_WINDOWS_USE_BASH_FOR, and shell:true only when a caller explicitly asks for it. Add ProcessSpawnError and move processRunner onto Effect's ChildProcessSpawner.
• RepositoryIdentityResolver: classify git health instead of swallowing failures — git missing/unspawnable and timeouts surface as real problems, "not a repo" stays quiet, and None results aren't cached so a later git init is picked up.
• terminal/Manager: detect live subprocess activity inside a Windows PTY via powershell.exe so a session isn't torn down while work is still running.
• ServerEnvironment(Label): resolve the environment label through the spawn policy and normalize git output.

Copy {cli} session id

• Thread right-click "Copy" now copies the underlying {cli} session id, parsed from the assistant message id (assistant:assistant::...), so a dialog can be resumed in the {cli} with --resume <id>. Scans the thread's messages newest->oldest, falls back to latestTurn, then to the internal thread id; brand-neutral via CLI_DISPLAY_NAME.

Installer / CLI resolution

• install: smarter shell-profile handling. When no shell rc file exists, create the right one for the user's login shell (.bash_profile for Git Bash/bash, .zshrc for zsh) and write PATH there. Make PATH setup non-fatal — warn instead of abort when no rc is writable (the bin still runs via its full path), distinguishing "no rc at all" (create one) from "rc is read-only" (warn).
• resolve.ts: fix Windows cli.js path matching. Canonicalize an MSYS/Git-Bash .install-dir record (/c/...) to native form (C:...) and compare case-insensitively, so the recorded path matches the home-bin copy and Windows installs don't trip a false SOURCES_DISAGREE.

MCP probe (new, throwaway)

• mcp-probe/: self-contained harness proving the planned MCP-management engine contract (settings overlay via the {cli}'s system-settings-path env + --allowed-mcp-server-names) against the real {cli} 0.13.1 binary, before building the CQRS/projection/reactor subsystem. Ships stdio + HTTP mock servers, a monitor, and probe-close.mjs; pins @modelcontextprotocol/sdk in the workspace catalog.

Tests

• Add/expand processRunner, RepositoryIdentityResolver and ServerEnvironmentLabel coverage; touch OrchestrationEngine and ProjectionSnapshotQuery suites.