Windows platform support: (#16)

- Justfile: [windows] recipes for build-hyperlight, resolve-hyperlight-dir, start-debug
- Justfile: runtime-cflags forward-slash fix for clang cross-compilation
- build-binary.js: .cmd launcher, platform-aware post-build output
- plugins: O_NOFOLLOW fallback (Windows lacks O_NOFOLLOW, relies on lstat pre-check)
- agent/index.ts: pathToFileURL for ESM plugin imports on Windows
- build.rs: forward-slash CFLAGS for clang on Windows
- code-validator/guest: win32-x64-msvc NAPI target
- .gitattributes: enforce LF line endings across platforms

VM resource management:
- sandbox/tool.js: invalidateSandbox() now calls dispose() on LoadedJSSandbox
  and JSSandbox for deterministic VM cleanup instead of relying on V8 GC
- Updated hyperlight-js dep to include dispose() API

Error handling:
- agent/event-handler.ts: suppress duplicate 'Tool execution failed' messages
- sandbox/tool.js: MMIO error detection in compilation and runtime paths
- agent/index.ts: surrogate pool env vars (HYPERLIGHT_INITIAL/MAX_SURROGATES)

Test fixes (Windows compatibility):
- tests: symlink EPERM skip for Windows (path-jail, fs-read, fs-write)
- tests/dts-sync: rmSync instead of shell rm -rf
- tests/pattern-loader: unique tmpdir per test to avoid Windows EBUSY locks

CI:
- pr-validate.yml: Windows WHP matrix
- publish.yml: Windows build support

Security:
- npm audit fix across all workspaces (picomatch, brace-expansion)
- plugin-system/manager.ts: simplified ternary

Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>

Author: simongdavies

builtin-modules/ooxml-core.json

@@ -3,8 +3,8 @@
   "description": "Shared OOXML infrastructure - units, colors, themes, Content_Types, relationships",
   "author": "system",
   "mutable": false,
-  "sourceHash": "sha256:1e939013c13555bc",
-  "dtsHash": "sha256:9f88e7c59a56854c",
+  "sourceHash": "sha256:b5f017fe2d4e2ed3",
+  "dtsHash": "sha256:6aac85502082bf89",
   "importStyle": "named",
   "hints": {
     "overview": "Low-level OOXML infrastructure. Most users should use ha:pptx instead.",

builtin-modules/pptx-charts.json

@@ -3,8 +3,8 @@
   "description": "OOXML DrawingML chart generation - bar, pie, line charts for PPTX presentations",
   "author": "system",
   "mutable": false,
-  "sourceHash": "sha256:5c521ce93ff39626",
-  "dtsHash": "sha256:5f653830226c3554",
+  "sourceHash": "sha256:4174b6f03be2e0fb",
+  "dtsHash": "sha256:4353b8263dc99405",
   "importStyle": "named",
   "hints": {
     "overview": "Chart generation for PPTX. Always used with ha:pptx.",

builtin-modules/pptx-tables.json

@@ -3,8 +3,8 @@
   "description": "Styled tables for PPTX presentations - headers, borders, alternating rows",
   "author": "system",
   "mutable": false,
-  "sourceHash": "sha256:0739a7db5a8ab428",
-  "dtsHash": "sha256:82d903ffbf4dfb1e",
+  "sourceHash": "sha256:2d58934ed7df9fe1",
+  "dtsHash": "sha256:3ba75bbc44353467",
   "importStyle": "named",
   "hints": {
     "overview": "Table generation for PPTX. Always used with ha:pptx.",

builtin-modules/pptx.json

@@ -3,8 +3,8 @@
   "description": "PowerPoint PPTX presentation builder - slides, text, shapes, themes, layouts",
   "author": "system",
   "mutable": false,
-  "sourceHash": "sha256:093b19522e994756",
-  "dtsHash": "sha256:2107e369816b4bd5",
+  "sourceHash": "sha256:23569540a0f8622f",
+  "dtsHash": "sha256:27520514e4401465",
   "importStyle": "named",
   "hints": {
     "overview": "Core PPTX slide building. Charts in ha:pptx-charts, tables in ha:pptx-tables.",

builtin-modules/src/types/ha-modules.d.ts

@@ -27,7 +27,7 @@
     "fmt:check": "prettier --check \"src/**/*.ts\" \"tests/**/*.ts\" \"plugins/**/*.ts\" \"builtin-modules/**/*.js\"",
     "check": "npm run fmt:check && npm run typecheck && npm run test",
     "prepare": "node -e \"if(require('fs').existsSync('scripts/build-modules.js'))require('child_process').execSync('npm run build:modules',{stdio:'inherit'})\"",
-    "postinstall": "node -e \"var fs=require('fs'),cp=require('child_process');if(fs.existsSync('scripts/patch-vscode-jsonrpc.js')){cp.execSync('node scripts/patch-vscode-jsonrpc.js',{stdio:'inherit'});cp.execSync('node scripts/check-native-runtime.js',{stdio:'inherit'})}\""
+    "postinstall": "node -e \"var fs=require('fs'),cp=require('child_process');if(fs.existsSync('scripts/patch-vscode-jsonrpc.js')){cp.execSync('node scripts/patch-vscode-jsonrpc.js',{stdio:'inherit'});cp.execSync('node scripts/check-native-runtime.js',{stdio:'inherit'});}\""
   },
   "dependencies": {
     "@github/copilot-sdk": "^0.1.32",

package.json

@@ -426,10 +426,10 @@ writeFileSync(launcherCjsPath, launcherCjs);
 // Node.js launcher (works everywhere, used as npm bin entry)
 const nodeLauncher = `#!/usr/bin/env node
 import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const cjs = join(__dirname, '..', 'lib', 'hyperagent-launcher.cjs');
-await import('file://' + cjs.replace(/\\\\/g, '/'));
+await import(pathToFileURL(cjs).href);
 `;
 const nodeLauncherPath = join(BIN_DIR, "hyperagent");
 writeFileSync(nodeLauncherPath, nodeLauncher);
@@ -494,7 +494,7 @@ To run (option 3 - add to PATH permanently via System Properties):
   ${launcherPath}
 
 To run (option 2 - add to PATH):
-  export PATH="${BIN_DIR}:\\$PATH"
+  export PATH="${BIN_DIR}:$PATH"
   hyperagent
 
 To run (option 3 - symlink):

scripts/build-binary.js

@@ -23,8 +23,16 @@ describe("pattern-loader", () => {
   afterEach(() => {
     try {
       rmSync(TMP_DIR, { recursive: true, force: true });
-    } catch {
-      // Windows: Defender/indexer may hold a lock — not worth failing the test
+    } catch (err: unknown) {
+      // Windows Defender/indexer can hold file locks — only swallow those
+      const code = (err as NodeJS.ErrnoException).code;
+      if (
+        process.platform === "win32" &&
+        (code === "EBUSY" || code === "EPERM")
+      ) {
+        return;
+      }
+      throw err;
     }
   });