Detection reported installed npm-global agents (Claude Code, Codex) as
'binary not found on PATH' on Windows, and an authed Hermes desktop as
'NOT AUTHED'. Two root causes:
1. resolvePath() used POSIX-only 'command -v'/'which', and
execFile/spawn('claude', ...) cannot resolve npm's .cmd shims via
PATHEXT -> ENOENT -> installed:false. Add resolveBin() (where.exe on
Windows, preferring .exe > .cmd > .bat) and route detection + both
spawn call sites through the resolved path.
2. Hermes desktop on Windows stores its login under %LOCALAPPDATA%\hermes not ~/.hermes/. Add localAppData() and check both (presence-only).
Windows .cmd shims are launched via a new spawnAgent() helper that invokes
cmd.exe with an argv ARRAY (shell:false) instead of shell:true, so the
untrusted prompt is never re-parsed by cmd.exe -> no command-injection surface.
No new deps; typecheck clean.
psigho