fix(desktop): resolve Doctor install shell and command detection on Windows

[wpfleger96]

Summary

Doctor menu installs on Windows fail with failed to spawn shell: The system cannot find the path specified. (os error 3) for all three runtimes (Goose, Claude Code, Codex). Five phases addressed:

• Phase A — install shell selection: install_shell_command() hardcoded /bin/zsh / /bin/bash, which don't exist on Windows. Now resolves Git Bash via resolve_bash_path() — a bash-requiring variant that skips BUZZ_SHELL (since install commands use bash-only -l -c syntax) and falls through to GIT_BASH → PATH scan → derive-from-git → well-known → registry. Adds CREATE_NO_WINDOW on Windows, and fixes the timeout-kill path to use taskkill instead of the unix-only libc::kill. A BUZZ_SHELL=pwsh user gets a green Doctor prereq (agents work fine) but installs use the Git Bash fallback chain.

• Phase B — per-OS install commands: Claude and Codex get cli_install_commands_windows delegating to their official install.ps1 via powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "irm <url> | iex". Goose unchanged (its script is already Windows-aware). cli_install_commands_for_os() accessor selects the right commands per platform.

• Phase C — Windows command resolution: resolve_command_uncached now tries .cmd and .bat candidates on Windows so npm-generated shims (e.g. codex-acp.cmd in %APPDATA%\npm) are discoverable. common_binary_paths() includes %APPDATA%\npm and %LOCALAPPDATA%\Programs\OpenAI\Codex\bin. login_shell_candidates() falls back to Git Bash (via resolve_bash_path(), skipping non-bash BUZZ_SHELL) instead of the hardcoded /bin/zsh, /bin/bash. fetch_login_shell_path_inner() returns None on Windows to prevent POSIX-format PATH from leaking into native-process consumers.

• Phase D — BUZZ_SHELL contract split: Two named resolvers with distinct contracts. resolve_git_bash_path() honors BUZZ_SHELL (any executable: cmd, pwsh) — called by discover_git_bash() for the Doctor readiness gate; git_bash_available() inlines the same chain with overrides for its distinct parameter needs. resolve_bash_path() skips BUZZ_SHELL entirely and requires a bash-compatible shell — called by resolve_install_shell() and login_shell_candidates(). Two regression tests in git_bash.rs prove both contracts hold simultaneously.

• Phase E — deterministic Windows test isolation: resolve_git_bash_inner takes an explicit check_registry toggle; resolve_git_bash_no_registry test helper disables the ambient HKLM/HKCU\SOFTWARE\GitForWindows lookup so test_no_git_bash_resolved_returns_none passes deterministically on CI runners with Git for Windows installed. test_cmd_shim_resolves_from_path calls resolve_command_uncached through PATH mutation under lock_path_mutex (replacing the prior tautological assertion). install_shell_from pure seam enables direct testing of the Option → Result error mapping against GIT_BASH_INSTALL_HINT.

Files changed

• desktop/src-tauri/src/commands/agent_discovery.rs — install_shell_command → Result, resolve_install_shell() delegates to install_shell_from() seam, Windows CREATE_NO_WINDOW + taskkill timeout kill, tests
• desktop/src-tauri/src/managed_agents/discovery.rs — cli_install_commands_windows field, cli_install_commands_for_os(), .cmd/.bat resolution, login_shell_candidates() calls resolve_bash_path(), POSIX PATH guard
• desktop/src-tauri/src/managed_agents/discovery/tests.rs — deterministic .cmd resolver test, registry-disabled no-shell test, install_shell_from error-mapping tests
• desktop/src-tauri/src/managed_agents/git_bash.rs — resolve_git_bash_path() (readiness, called by discover_git_bash) + resolve_bash_path() (install/login-shell), resolve_git_bash_inner with check_registry toggle, resolve_git_bash_no_registry test helper, GIT_BASH_INSTALL_HINT, BUZZ_SHELL bypass regression tests
• desktop/src-tauri/src/managed_agents/mod.rs — pub(crate) mod git_bash visibility
• desktop/scripts/check-file-sizes.mjs — file-size overrides

Accepted residual

• If the resolved bash lacks curl (e.g. bare Cygwin), the goose installer fails with a clear curl error.
• BUZZ_SHELL=pwsh + no Git Bash anywhere = prereq green but installs fail with the Doctor hint. Correct semantic per design: install scripts are bash/PowerShell, not arbitrary shells.

[wesbillman]

Blocking Windows shell-contract issue: the new install/login-shell path reuses the Doctor resolver, but that resolver intentionally treats BUZZ_SHELL=cmd and BUZZ_SHELL=pwsh as valid. These install commands are bash syntax and are always invoked with -l -c, so a user with either documented override still gets a broken Doctor install path. Please make the install/login-shell resolver require a bash-compatible executable (or bypass a non-bash BUZZ_SHELL and continue to Git Bash), with a Windows regression for BUZZ_SHELL=cmd/pwsh. The rest of the platform-specific command/shim work looks sound, and current CI is green.