feat(devcontainer): drive wmux from a container over the TCP bridge - #166

`wmux config path` built the path from the caller's own home directory:

    console.log(`${os.homedir()}\.wmux\config.toml`)

That only holds when the CLI runs on the same Windows box as wmux. Run it from
WSL, or from a devcontainer over the bridge, and it prints
`/home/vscode\.wmux\config.toml` — not the file wmux reads, and not a
well-formed path on either OS. Editing "the config file" there edits nothing,
which is a long way to walk before finding out why a setting had no effect.

loadUserConfig() already records the real path and `config.get` returns it, so
ask. The local guess stays as the answer when no instance is reachable, but
built with path.join so it is at least self-consistent with the filesystem the
CLI is actually on.

`wmux locales path` cannot be fixed the same way — `config.get` carries no
locales directory, so there is nothing to ask the instance for. The commit
after this one gives both fallbacks a spelling that is at least well-formed for
the OS in hand; the locales one can still name the wrong file when the CLI and
wmux are on opposite sides of the WSL boundary.

The test spawns dist/cli/wmux.js, and compiles it first. It originally spawned
resources/cli/wmux.js on the grounds that that is what a released wmux runs,
which turns out not to be so: package.json's `bin`, electron-builder's
extraResources and step 7 of the release process all name dist/cli/wmux.js.
resources/cli/wmux.js is a checked-in copy of that build with nothing enforcing
the copy — it is 1519 diff lines behind a build of master's own src/ as of
1.0.0 — so a test spawning it asserts against whatever was committed last
rather than against the branch under test. Building in beforeAll costs ~3s and
is needed either way: dist/ is gitignored and `npm test` runs ahead of
`npm run build:main`.

Co-Authored-By: Claude <noreply@anthropic.com>
(cherry picked from commit 16b0d4c, opened as part of #166)

`bashPathCandidates()` offered `/c`, `/mnt/c`, `/cygdrive/c` in that fixed
order, and `toBashPath()` documented Git Bash's `/c` as preferred outright.
That is right on a Windows box with Git for Windows and wrong everywhere else:
in a Linux checkout — a container, WSL, a CI runner — the bash on PATH mounts a
Windows drive at `/mnt/c` if it can see one at all, and leading with a spelling
that never resolves puts the fallback branch in charge.

So the order is now conditional on `process.platform` while the set stays
fixed: Git Bash first on Windows, the WSL mount first elsewhere, all three
always offered, and the probe still decides. `toBashPath()`'s comment is
qualified to match — off Windows there is no Git Bash to prefer.

`bashExists()` probes through a login shell (`-lc`) so it sees the environment
the orchestrator scripts are run under rather than a bare non-interactive one,
and names $0 `_`, which is what it is — a placeholder, not the shell.

`orchestration-status-vocab.test.ts` gains a `bashExists(hookPath)` term in its
skip condition. `hasBash()` alone only says a bash exists; it does not say that
bash can see the hook script, which is the thing the suite needs and the case
this change exists to handle. Unreachable now skips loudly instead of failing
on a path the shell cannot open.

`bash-path.test.ts` moves in the same commit because it cannot survive the
helper change on its own — it pinned the Git-Bash-first order literally, and
four of its assertions go red on Linux and macOS the moment the order becomes
conditional. Splitting the two would leave a commit that fails `npm test` for
anyone not on Windows. Rewritten so the invariant and the variant are asserted
separately: the spelling set order-independently with `arrayContaining` plus a
length, the order once against the same `process.platform` condition the helper
uses. The probe-driven case gains a Git Bash counterpart to the WSL one, so
"the probe decides, not the ordering" is covered from both directions.

On a Linux run neither suite changes result — both are green before and after,
and the status-vocab suite still executes rather than skipping. The change is
for the hosts where the reachable bash is not the one the ordering assumed;
verifying that half needs a Windows box with WSL bash but no Git Bash.

This is stlindenau/wmux@c693c06's test-helper hunks plus 64fb8d8, from the
branch in #166.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

First of the three splits of #166.

`wmux config path` rebuilt the path from the caller's own home directory,
which only holds when the CLI runs on the same Windows box as wmux. From
WSL or a container over the bridge it printed `/home/vscode\.wmux\config.toml`
— not the file wmux reads, and not well-formed on either OS. It now asks
the instance, which already records the real path, and keeps the local
guess only for when nothing answers.

Both no-instance fallbacks now take their separator from the home
directory in hand rather than from process.platform, because the case
that matters is exactly where those two disagree.

Also repairs the bash-path helper's test: the candidate ORDER is now
conditional on the platform (a Linux bash mounts a Windows drive at
/mnt/c, not /c), so the test that pinned Git-Bash-first literally had to
move with it or go red off Windows.

Co-Authored-By: stlindenau <stlindenau@users.noreply.github.com>

#166)

Second of the three splits of #166. Generated from master's own src/.

resources/shell-integration/ is a checked-in copy of src/shell-integration/
with nothing keeping it in step, and all three files had drifted. The
PowerShell one is the serious case: its copy predates #72, so
Send-WmuxMessage sends V1 lines with no auth token prefix — and the pipe
server rejects every V1 command but ping without one. Anything running
that copy reports no cwd, no git branch, no shell state and no PR, and has
no way to notice, because the pipe answers `unauthorized` into a void.

No release path reads these files (electron-builder maps src/, and the
dev fallback in getShellIntegrationPath resolves to src/ too), so this
never reached a released install. What reads them is anything consuming
wmux out of a repo checkout, which is how it surfaced.

Co-Authored-By: stlindenau <stlindenau@users.noreply.github.com>

Claude Code increasingly runs in a Linux devcontainer while wmux runs on
Windows. Nothing in that container can open \\.\pipe\wmux, so the CLI, the
hooks and the shell integration all failed silently: no cwd, no git branch,
and a sidebar stuck on "Running" forever.

The bridge from issue #78 is most of the answer already — it just could not
reach the pipe from where it needed to run. Three pieces close the gap:

* connectTransport() learns npiperelay.exe, so `wmux bridge` can run INSIDE
  WSL2 and still reach the Windows pipe over interop. That placement is the
  security property: 0.0.0.0 there is the WSL2 namespace, reachable from
  containers on the host and not from the LAN, with no firewall rule. AF_VSOCK,
  a Windows-side listener and cross-boundary Unix sockets were tried first and
  are documented as rejected in the code.
* The bridge keeps relays warm and tears down half-close-aware. Spawning
  npiperelay measures ~7s on an AV-scanned corporate host, and destroying both
  sides on either 'close' killed the frame of any client that writes and hangs
  up — which is every Claude Code hook. Deadlines gain a floor on the slow
  transports for the same reason; the 5s default sat below the round-trip, so
  calls that had already succeeded were reported as timeouts.
* `wmux raw-v1` gives the bash integration a way to send its V1 lines through
  the CLI's transport instead of a temp file it cannot write to, and
  wmux-hook.js gets the same TCP branch.

report_startup_command is new and rides the same path: a shell declares how to
bring its own surface back, stored per surface, so a restored pane re-enters
its container instead of coming up as a bare WSL prompt.

docs/DEVCONTAINER.md is the standalone setup — one binary, one command, two
environment variables, no vendor tooling.

Two things ride along that were separate commits in #166, because on current
master they have nothing to stand on their own for. The npiperelay lookup
splits PATH on path.delimiter and falls back to process.env.Path — the
Windows spelling — which only matters for the finder this commit introduces;
#168 landed the rest of that change and deliberately left this half behind.
And resources/shell-integration/wmux-bash-integration.sh is updated in step
with its source, which #169 plus the check in 42e3cca now require: the
packaged copy was resynced from a pre-bridge src/, so it has the `wmux` shim
but not the WMUX_REMOTE branch, and leaving it that way fails npm test.

Co-Authored-By: Claude <noreply@anthropic.com>

resources/cli/*.js is a copy of the tsc output in dist/cli/, and 42e3cca made
that an invariant rather than a hope: `npm run verify:resources` compares the
two byte-for-byte and CI runs it after build:main. So this is no longer
bookkeeping that can slip — the branch does not pass without it.

Two files are new. transport-deadline.js and wsl-network.js are shared modules
this branch introduces, and verify-resources compares directories, not a list
of names, so a build output with no copy fails the same way a stale copy does.
electron-builder.json names them too (earlier commit), for a different reason:
the CLI is packaged file-by-file, and a missing sibling is MODULE_NOT_FOUND on
the first line of every hook rather than a degraded feature.

The reason this is readable at all is 42e3cca. In #166 the same regeneration
read +1412/-445, which is what made that PR unreviewable: the checked-in copy
had drifted ~1700 diff lines behind its own source, so the bridge's output was
buried in years of unrelated rot. Regenerating from today's master, the diff is
just the bridge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Third and last split of #166. `wmux bridge` exposes the local pipe on TCP
so a container can drive the wmux running on the Windows host: the
container has no \.\pipe\wmux, so every CLI call and every Claude Code
hook failed silently, and the sidebar sat on "Running" while the agent
idled.

Four things changed since the #166 review, all of them things I asked
for and one of them better than what I asked for:

- The 0.0.0.0 bind is checked rather than assumed. `--wsl` now reads
  `wslinfo --networking-mode` and only picks 0.0.0.0 once it has
  confirmed NAT. Under mirrored networking the distro shares the Windows
  host's real interfaces — LAN and VPN adapters included, gated by the
  Hyper-V firewall rather than the ordinary profile — so it refuses and
  names `--host <addr>`. Unknown is treated as unknown, not folded into
  the NAT default. An explicit --host is always honoured.
- `raw-v1` is an allowlist of the six verbs the shell integration emits,
  not a generic passthrough that would have made every future V1 command
  container-reachable the day it landed. The test derives the expected
  set by scanning the integration's own call sites.
- One transport-derived deadline instead of two spellings. The hook's
  copy did not know about npiperelay, so a hook firing from a WSL shell
  armed the 5s local-pipe timer for a ~7s hop and killed calls that were
  going to succeed.
- Artifacts regenerated, and now readable: 42e3cca turned that commit
  from ~1700 lines of accumulated rot into +443/-36 of actual bridge.

It also found a packaging gap on the way: extraResources ships the CLI
entry points file-by-file, not the directory, so a shared sibling module
is MODULE_NOT_FOUND on the first line of `wmux ping` and of every hook in
an installed build — invisible to `npm run dev`, where the module is
sitting right there in dist/. packaging.test.ts now walks the relative
imports out of each shipped entry point and requires each to be packaged
too. It caught wsl-network.js before review did.

Co-Authored-By: stlindenau <stlindenau@users.noreply.github.com>