fix: Support Windows

[ofek]

Fixes

• A user-scope test sandboxed only HOME, but on Windows the home directory comes from USERPROFILE, so the sandbox did nothing and the test ran against the developer's real configuration, moving their installed skills into a temp directory and deleting them on teardown. It now sandboxes both and asserts the sandbox took effect, so a future gap fails the test instead of the machine. It was honestly a grueling experience to reconstruct all of the custom skills stored in ~\.claude\skills that I was working on for the past year and I was only able to recover about half.
• Three POSIX-only path assumptions made local path: and git: skill sources unusable on Windows.
  • The check that a source stays inside the project root compared raw strings and expected a forward slash, so on Windows it matched nothing and called every source outside the project. It now compares resolved paths segment by segment.
  • The cache key built from a repository location kept the backslashes and drive letter, producing a key that was itself an absolute path, which the cache rejects. Keys now use forward slashes and turn a drive root into a leading segment, so C:\repo and D:\repo stay distinct.
  • Config validation allowed an absolute POSIX path but not a drive letter, so a source failed on the next read of agents.toml even after it had resolved. It now accepts both.

Other changes

• Replacing a real skills directory with a symlink could silently delete skills. The migration moves every entry it can into the managed directory and skips any whose name is already taken, and the recursive delete that followed removed exactly those skipped entries. Install now stops before the delete and names the colliding entries, so a collision is something you resolve rather than something you lose.
• Local git sources are now trusted like local path sources. They read files already on disk and have no domain to match, so any configured trust policy rejected them and named no domain the user could add, leaving them unusable short of turning trust off. UNC paths stay gated: //server/share looks absolute but names a remote host over SMB, which is what the domain allowlist exists for. This applies to POSIX too, where an absolute local git source was rejected the same way.
• A drive letter only means a local directory on Windows. Elsewhere git reads the colon as a remote host and tries to connect to a machine named for the drive, so these are now rejected before the clone with a message that says why.
• Three copies of the check for whether a path stays inside a directory had drifted apart, two of them using a looser test that rejects a real directory whose name starts with two dots. All three now share one predicate.

Verification

❯ pnpm -r --reporter=append-only lint
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
Scope: 2 of 3 workspace projects
packages/dotagents-lib lint$ oxlint src --deny-warnings
packages/dotagents-lib lint: Found 0 warnings and 0 errors.
packages/dotagents-lib lint: Finished in 11ms on 29 files with 91 rules using 16 threads.
packages/dotagents-lib lint: Done
packages/dotagents lint$ oxlint src --deny-warnings
packages/dotagents lint: Found 0 warnings and 0 errors.
packages/dotagents lint: Finished in 15ms on 88 files with 91 rules using 16 threads.
packages/dotagents lint: Done
❯ pnpm -r --reporter=append-only typecheck
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.
Scope: 2 of 3 workspace projects
packages/dotagents-lib typecheck$ tsc -b --emitDeclarationOnly
packages/dotagents-lib typecheck: Done
packages/dotagents typecheck$ tsc -b --emitDeclarationOnly
packages/dotagents typecheck: Done
❯ pnpm -r exec vitest run --silent --reporter=minimal
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.

 RUN  v4.1.10 C:/Users/ofek/.worktrees/dotagents/reverent-mclaren-573ae8/packages/dotagents-lib


 Test Files  14 passed (14)
      Tests  324 passed (324)
   Start at  14:19:17
   Duration  16.33s (transform 1.50s, setup 0ms, import 3.18s, tests 30.61s, environment 3ms)


 RUN  v4.1.10 C:/Users/ofek/.worktrees/dotagents/reverent-mclaren-573ae8/packages/dotagents


 Test Files  33 passed (33)
      Tests  532 passed | 2 skipped (534)
   Start at  14:19:34
   Duration  35.74s (transform 6.40s, setup 0ms, import 20.22s, tests 104.43s, environment 6ms)

[vercel]

@ofek is attempting to deploy a commit to the Sentry Team on Vercel.

A member of the Team first needs to authorize it.