feat(workspaces): native cross-platform bootstrap — bundle git (dugite) + port bash to Node

.github/workflows/release.yml

@@ -171,6 +171,13 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Fail loud if dugite's postinstall was skipped (e.g. dropped from
+      # pnpm.onlyBuiltDependencies) — otherwise node_modules/dugite/git/ is
+      # silently empty and workspace creation breaks at runtime, not build.
+      - name: Verify bundled git (dugite) was fetched
+        run: |
+          node -e "const{existsSync}=require('fs');const{dirname,join}=require('path');const g=join(dirname(require.resolve('dugite/package.json')),'git');if(!existsSync(g)){console.error('dugite embedded git MISSING at '+g);process.exit(1)}console.log('dugite embedded git OK '+g)"
+
       - name: Build Alice + UTA + desktop shell
         run: pnpm electron:build
 

CLAUDE.md

@@ -67,7 +67,9 @@ Notes:
 
 ### Cross-platform note
 
-Workspace bootstrap scripts (`src/workspaces/templates/*/bootstrap.sh`) are bash-based. On Windows they require `bash` from Git for Windows (default install) or WSL2. `workspace-creator.ts` already platform-branches the spawn so the same script paths work on win32 — when adding a new template, write bash as usual, but **don't** add POSIX-only commands without checking they ship with Git for Windows's bundled MSYS env (sed/cp/mkdir/basename/printf/source/[[ ]] all work; obscure tools like `jq` do not). See README's *Windows* section for the user-facing story.
+Workspace bootstrap is **cross-platform Node** — built-in templates ship `src/workspaces/templates/<name>/bootstrap.mjs` (plain ESM, no TypeScript syntax). The launcher (`workspace-creator.ts` `runScript`) spawns them on the Electron-bundled Node (`process.execPath` + `ELECTRON_RUN_AS_NODE`), and **all git goes through bundled git** (`dugite`) via `_common.mjs`'s `git()` helper. Net effect: workspace creation works on a **bare Windows or bare Mac** — no bash, no Git for Windows, no system git. When adding a template, write a `bootstrap.mjs` that imports `../_common.mjs` (`initWorkspaceDir` / `copyReadme` / `setupGitExcludes` / `git`) and routes every git call through `git()` — never `spawn('git')`.
+
+`bootstrap.sh` is still supported as a **fallback** for third-party/satellite templates that ship bash (`template-registry` prefers `.mjs`, falls back to `.sh`); those only run where `bash` is on PATH (Git for Windows / WSL2). Don't add new `.sh` bootstraps for in-repo templates. The critical packaging invariant: `dugite` must stay in `pnpm.onlyBuiltDependencies` (its postinstall fetches the per-platform git; drop it and `node_modules/dugite/git/` is silently empty — release CI asserts it's present). See README's *Windows* section for the user-facing story.
 
 ## Subsystem guides
 

package.json

@@ -50,6 +50,7 @@
     "ajv": "^8.18.0",
     "ccxt": "^4.5.38",
     "decimal.js": "^10.6.0",
+    "dugite": "3.2.2",
     "grammy": "^1.40.0",
     "hono": "^4.12.21",
     "longbridge": "^4.0.5",
@@ -98,7 +99,8 @@
   "pnpm": {
     "onlyBuiltDependencies": [
       "node-pty",
-      "electron"
+      "electron",
+      "dugite"
     ],
     "overrides": {
       "@alpacahq/alpaca-trade-api>axios": "^0.32.0",

src/core/paths.ts

@@ -64,9 +64,8 @@ export function uiBundlePath(): string {
  * default/ does: dev points to repo source, packaged points to wherever
  * the bundler copied the templates inside .app/Contents/Resources/.
  *
- * NOTE: For packaged .app distribution, build.files in package.json must
- * include `src/workspaces/templates/**` (currently DOES NOT — workspace
- * spawning will fail until that's added; tracked in TODO).
+ * `build.files` in package.json ships `src/workspaces/templates/**`, so the
+ * `.mjs` bootstraps + their READMEs land in the packaged .app.
  */
 export function templatesPath(): string {
   return resolve(APP_RESOURCES_HOME, 'src', 'workspaces', 'templates')