# test634 — Windows secret shell guidance

Date: 2026-08-09
Issue: #379 (portable guidance half only)
Base: a10c835cbfa622c99b97540f9bc2081a632a60af
Source commit: 6b9da314b19510a11009391452d368f13897e4f8
Docker tag: anet-test634:dev
Docker image: sha256:206d8d1a28affa4c1632171c53a548d755796703570a9ad77db3fd3eb31376f1
Embedded source: TEST634_SOURCE_COMMIT=6b9da314b19510a11009391452d368f13897e4f8
Runner artifact SHA256: bddf02a4f0cd8ba58bfd6a92013b4c3121e29edbe0852f59ccd8644abf156520

## Result

- Platform semantics and both production call sites: 3 pass / 0 fail / 12
  assertions.
- POSIX output retains the existing `export NAME='value'` form and
  bash/zsh/secrets-manager persistence guidance.
- Windows output uses PowerShell `$env:NAME='value'`, escapes a literal single
  quote by doubling it, and points to PowerShell `$PROFILE` or a secrets
  manager. It no longer tells Windows users to edit `.bashrc` or `.zshrc`.
- Both the create-time envRef rewrite and the explicit
  `migrate-token-to-envref` flow call the shared formatter.
- The real production CLI bundles successfully with 197 modules.

## Witnessed red

The pre-implementation tests failed with rc=1 because neither the helper nor
the two production call sites existed. On the exact source commit:

1. Disabling the Windows branch makes the PowerShell behavior test fail
   (`MUTATION_RED: windows-platform-branch rc=1`).
2. Replacing the migration call with a hard-coded POSIX export makes the
   two-call-site wiring test fail (`MUTATION_RED: migrate-wiring rc=1`).

## Explicit non-claim: Windows rename remains blocked

This candidate does not claim to fix the process-discovery half of #379.
`findNodeProcessesByAlias` first runs the Unix-only `ps -eww`; native Windows
therefore fails closed before its slash-only basename branch is reachable.
Additionally, a Windows executable commonly ends in `.exe`, which the current
exact `claude` / `agent-node` comparison does not accept. Fixing only
`split("/")` would be a false green.

A real fix needs a Windows process-table provider (for example a narrowly
scoped PowerShell `Get-CimInstance Win32_Process` adapter), injectable parsing,
and execution on a real Windows host/runner. Linux Docker contract evidence is
not presented as Windows rename evidence.

No process matching, kill behavior, production service, global package,
credential, database, or existing user file was changed.
