fix: CI verde no repo público — skips de harness/ ausente + Windows (npm .cmd, CRLF, paths nativos)

- fda-lock.test: os 3 testes que copiam shims de harness/ (checkout
  gitignorado, ausente no CI) ganham skip com motivo — padrão do
  consistency.test.js; teste EPERM vira skip em win32 (kill(1,0) é POSIX)
- quality.mjs: spawn com shell no win32 — npm é shim .cmd e o Node >=20.12
  recusa spawná-lo sem shell; TODOS os gates de qualidade quebravam em
  Windows nativo
- fia-launch-check: helper rel() com barras normalizadas nos relatórios
  (theme_tokens, raw_functions, dangerous_html)
- fia-permissions.test: core.autocrlf false nos repos temporários (o global
  do runner Windows restaurava CRLF no revert)
- fia-pi-viewer.test: assert do slug normaliza separador do join()
- .gitattributes: eol=lf repo-wide (templates são stampados byte a byte)

Dívida registrada em lessons.md: agent-*.mjs spawnam claude/pi/cursor-agent
(também shims .cmd) — FIA em Windows nativo segue não validada.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: elberrd

.gitattributes

@@ -0,0 +1,5 @@
+# LF everywhere, on every platform. The repo ships a Node CLI plus templates
+# that are stamped byte-for-byte into student projects — a CRLF checkout on
+# Windows (git autocrlf) would change what gets stamped AND break tests that
+# compare file content after git operations.
+* text=auto eol=lf

fia-templates/modules/quality.mjs

@@ -31,6 +31,10 @@ async function runSpec(spec, run) {
         cwd: run.repoRoot,
         env: run.env,
         stdio: ['ignore', 'pipe', 'pipe'],
+        // npm/npx are .cmd shims on Windows and Node (>= 20.12) refuses to
+        // spawn those without a shell. POSIX keeps the direct, quoting-safe
+        // spawn.
+        shell: process.platform === 'win32',
       });
       child.stdout?.on('data', (d) => (stdout += d));
       child.stderr?.on('data', (d) => (stderr += d));

fia-templates/scripts/fia-launch-check.mjs

@@ -191,6 +191,9 @@ function listFiles(dir, exts, acc = [], depth = 0) {
 export function runLaunchChecks(root = process.cwd(), opts = {}) {
   root = resolve(root);
   const aiDocsDir = opts.aiDocsDir || process.env.FIA_AI_DOCS || join(root, 'ai-docs');
+  // Repo-relative path for reports — always forward slashes, so a finding
+  // reads the same (and diffs the same) on Windows and POSIX.
+  const rel = (f) => f.slice(root.length + 1).replaceAll('\\', '/');
   const checks = [];
   const add = (section, id, level, status, label, detail = null, fix = null) =>
     checks.push({ section, id, level, status, label, ...(detail ? { detail } : {}), ...(fix ? { fix } : {}) });
@@ -360,7 +363,7 @@ export function runLaunchChecks(root = process.cwd(), opts = {}) {
       for (const dir of uiDirs) {
         for (const f of listFiles(dir, ['.tsx', '.jsx'])) {
           if (/[/\\]emails?[/\\]/.test(f)) continue; // react-email inlines styles by design
-          if (hex.test(readIf(f) || '')) offenders.push(f.slice(root.length + 1));
+          if (hex.test(readIf(f) || '')) offenders.push(rel(f));
         }
       }
       add('Work', 'theme_tokens', 'warn', offenders.length === 0 ? 'pass' : 'fail', 'No hardcoded hex colors in UI components', offenders.length ? offenders.slice(0, 5).join(', ') + (offenders.length > 5 ? ` (+${offenders.length - 5})` : '') : null, offenders.length ? 'use the theme CSS variables — raw hex is invisible to /theme (design-system skill, rule 8)' : null);
@@ -417,15 +420,15 @@ export function runLaunchChecks(root = process.cwd(), opts = {}) {
     for (const f of convexFiles) {
       if (/[/\\]lib[/\\]/.test(f)) continue;
       const src = readIf(f) || '';
-      if (/=\s*(query|mutation)\s*\(/.test(src)) rawFns.push(f.slice(root.length + 1));
+      if (/=\s*(query|mutation)\s*\(/.test(src)) rawFns.push(rel(f));
     }
     add('Security', 'raw_functions', 'warn', rawFns.length === 0 ? 'pass' : 'fail', 'No raw query/mutation outside convex/lib', rawFns.length ? rawFns.slice(0, 5).join(', ') : null, rawFns.length ? 'use authedQuery/authedMutation (security skill, pillar 1)' : null);
   } else {
     add('Security', 'raw_functions', 'info', 'skip', 'No raw query/mutation outside convex/lib', 'stack does not use Convex', null);
   }
 
   const uiFiles = [...listFiles(join(root, 'app'), ['.tsx', '.ts']), ...listFiles(join(root, 'components'), ['.tsx'])];
-  const danger = uiFiles.filter((f) => /dangerouslySetInnerHTML/.test(readIf(f) || '')).map((f) => f.slice(root.length + 1));
+  const danger = uiFiles.filter((f) => /dangerouslySetInnerHTML/.test(readIf(f) || '')).map(rel);
   add('Security', 'dangerous_html', 'warn', danger.length === 0 ? 'pass' : 'fail', 'No dangerouslySetInnerHTML', danger.slice(0, 5).join(', ') || null, danger.length ? 'never with user content — React escapes by default' : null);
 
   const httpTs = readIf(join(root, 'convex', 'http.ts'));

test/fda-lock.test.js

@@ -1,7 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, cpSync, readFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, mkdirSync, writeFileSync, cpSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import {
@@ -14,6 +14,10 @@ import { acquireLock } from '../fia-templates/modules/session.mjs';
 
 const SCRIPT = join(import.meta.dirname, '..', 'fia-templates', 'scripts', 'fda-lock.mjs');
 const SHIM = join(import.meta.dirname, '..', 'harness', '.claude', 'hooks', 'fda-lock.mjs');
+// The shims live in the harness — a SEPARATE repo checked out here only in
+// dev (gitignored, absent on a fresh clone/CI). Same pattern as
+// consistency.test.js: skip, never fail, when the checkout is missing.
+const NO_HARNESS = 'harness/ not present (nested repo, absent on fresh checkout)';
 
 /** A temp project root, optionally holding imp/data/.fda.lock with `lock`. */
 function projectWith(lock) {
@@ -131,7 +135,7 @@ test('renderWarn shows fda_id, runner and start time', () => {
   assert.match(text, /2026-08-13T12:00:00Z/);
 });
 
-test('harness shim: silent without FIA, delegates when imp/ exists', () => {
+test('harness shim: silent without FIA, delegates when imp/ exists', { skip: !existsSync(SHIM) && NO_HARNESS }, () => {
   // No imp/scripts → import fails → exit 0, no output, nothing blocked.
   const bare = projectWith(LIVE);
   mkdirSync(join(bare, '.claude', 'hooks'), { recursive: true });
@@ -186,7 +190,7 @@ function runCursorShim(root, payload, env = {}) {
   return JSON.parse(r.stdout);
 }
 
-test('cursor hook: denies a repo write while a run is live, allows reads', () => {
+test('cursor hook: denies a repo write while a run is live, allows reads', { skip: !existsSync(CURSOR_SHIM) && NO_HARNESS }, () => {
   const root = cursorProject(LIVE);
   const deny = runCursorShim(root, { command: 'rm src/app.ts', workspace_roots: [root], cwd: root });
   assert.equal(deny.permission, 'deny');
@@ -197,7 +201,7 @@ test('cursor hook: denies a repo write while a run is live, allows reads', () =>
   assert.deepEqual(read, { permission: 'allow' });
 });
 
-test('cursor hook: dead lock, missing runtime, own run tree and bad stdin all allow', () => {
+test('cursor hook: dead lock, missing runtime, own run tree and bad stdin all allow', { skip: !existsSync(CURSOR_SHIM) && NO_HARNESS }, () => {
   const dead = cursorProject(DEAD);
   assert.deepEqual(runCursorShim(dead, { command: 'rm src/x.ts', workspace_roots: [dead] }), {
     permission: 'allow',
@@ -249,10 +253,16 @@ test('acquireLock: refuses a live holder, replaces a dead one, atomic create', (
   assert.equal(JSON.parse(readFileSync(join(garbage, 'imp', 'data', '.fda.lock'), 'utf8')).fda_id, 'stolen');
 });
 
-test('acquireLock: EPERM means ALIVE — a lock held by another user is never stolen', () => {
-  // pid 1 (launchd/init) exists and belongs to root: kill(1, 0) from an
-  // unprivileged test process raises EPERM. The writer must treat that as a
-  // live run — exactly like the reader (activeFdaLock) — and refuse.
-  const root = projectWith({ pid: 1, fda_id: 'rooted', runner: 'fda_build', started_at: '2026-08-13T12:00:00Z' });
-  assert.throws(() => acquireLock(join(root, 'imp', 'data'), 'newrun'), /already active/);
-});
+test(
+  'acquireLock: EPERM means ALIVE — a lock held by another user is never stolen',
+  // kill(1, 0) → EPERM is POSIX (pid 1 = launchd/init, owned by root). On
+  // Windows there is no deterministic pid that raises EPERM for a test.
+  { skip: process.platform === 'win32' && 'POSIX-only: no deterministic EPERM pid on Windows' },
+  () => {
+    // pid 1 (launchd/init) exists and belongs to root: kill(1, 0) from an
+    // unprivileged test process raises EPERM. The writer must treat that as a
+    // live run — exactly like the reader (activeFdaLock) — and refuse.
+    const root = projectWith({ pid: 1, fda_id: 'rooted', runner: 'fda_build', started_at: '2026-08-13T12:00:00Z' });
+    assert.throws(() => acquireLock(join(root, 'imp', 'data'), 'newrun'), /already active/);
+  },
+);

test/fia-permissions.test.js

@@ -10,6 +10,9 @@ function initGitRepo(root) {
   execFileSync('git', ['init'], { cwd: root, stdio: 'ignore' });
   execFileSync('git', ['config', 'user.email', 'fia@test.dev'], { cwd: root, stdio: 'ignore' });
   execFileSync('git', ['config', 'user.name', 'FIA Test'], { cwd: root, stdio: 'ignore' });
+  // Windows runners default autocrlf=true globally — a revert would restore
+  // CRLF bytes and break the literal content comparisons below.
+  execFileSync('git', ['config', 'core.autocrlf', 'false'], { cwd: root, stdio: 'ignore' });
   writeFileSync(join(root, 'README.md'), '# test\n');
   execFileSync('git', ['add', 'README.md'], { cwd: root, stdio: 'ignore' });
   execFileSync('git', ['commit', '-m', 'init'], { cwd: root, stdio: 'ignore' });

test/fia-pi-viewer.test.js

@@ -133,7 +133,9 @@ test('pi sessions: quiet-but-recent is idle, only real silence is finished', ()
 
 test('pi helpers: project slug dir and subagent name parsing', () => {
   assert.equal(
-    piSessionsDirFor('/Users/x/proj', '/home/u'),
+    // join() is platform-native (backslashes on Windows); the slug logic is
+    // what this asserts, so normalize the separators before comparing.
+    piSessionsDirFor('/Users/x/proj', '/home/u').replaceAll('\\', '/'),
     '/home/u/.pi/agent/sessions/--Users-x-proj--',
   );
   assert.equal(agentFromSessionName('subagent-start-mapper-5e8a33b2-02c5-44fa-8ed8-f8fccd67bdd1'), 'start-mapper');