web3dev1337 · web3dev1337 · Mar 8, 2026 · Mar 5, 2026 · Mar 8, 2026 · Mar 8, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -226,8 +226,6 @@ Because `main` is usually checked out in the `master/` worktree, **do not try to
 
 ## 🚨 CRITICAL: READ THESE FILES 🚨
 **2. Read `CODEBASE_DOCUMENTATION.md`** - Contains system docs and file locations (READ THE ENTIRE FILE)
-**3. Read `COMPLETE_IMPLEMENTATION.md`** - Multi-workspace system overview (ESSENTIAL)
-**4. Read `PR_SUMMARY.md`** - Technical implementation details (FOR CHANGES)
 
 ## 🚨 CRITICAL: ALWAYS CREATE A PR WHEN DONE 🚨
 **When you complete ANY feature or fix, you MUST create a pull request using `gh pr create`. This is mandatory. Add "Create PR" as your final checklist item to ensure you never forget.**
@@ -287,7 +285,7 @@ Commander Claude is a special Claude Code instance that runs from the orchestrat
 
 **Read the full Commander instructions:**
 ```bash
-cat ~/GitHub/tools/automation/claude-orchestrator/master/COMMANDER_CLAUDE.md
+cat ~/GitHub/tools/automation/claude-orchestrator/master/docs/COMMANDER_CLAUDE.md
 ```
 
 ### Port Detection (MANDATORY — do this first)
@@ -413,6 +411,7 @@ Workspaces are stored in `~/.orchestrator/workspaces/`. Each workspace has:
 
 ### Important Files to Read First
 - `CODEBASE_DOCUMENTATION.md`: Comprehensive system overview
+- `docs/COMMANDER_CLAUDE.md`: Commander AI API reference
 - `server/index.js`: Main backend entry point
 - `package.json`: Dependencies and scripts
 - `src-tauri/src/main.rs`: Tauri app entry point

diff --git a/README.md b/README.md
diff --git a/REVIEWS/2026-03-06-anrokx-open-prs.md b/REVIEWS/2026-03-06-anrokx-open-prs.md
@@ -0,0 +1,102 @@
+# AnrokX Open PR Review — 2026-03-06
+
+## Open PRs
+
+| PR | Title | Size | Branch |
+|----|-------|------|--------|
+| **#796** | fix: clean windows onboarding changes against main | +6382/-2785, 12 files | `fix/windows-onboarding-clean-main` |
+| **#791** | fix(windows): prevent updater plugin startup panic | +5/-0, 1 file | `fix/windows-updater-plugin-config-startup` |
+| **#790** | test: fix windows CI recovery cleanup tests | +10/-10, 2 files | `fix/windows-build-verification` |
+| **#788** | feat: add serverOnlyFileWatching user setting | +115/-1, 9 files | `feature/server-only-file-watching` |
+
+## Recently Merged (last 48hrs)
+
+| PR | Title | Merged | Size |
+|----|-------|--------|------|
+| #794 | feat: polish windows onboarding UX and setup detection | Mar 4 | +3245/-476, 9 files |
+| #793 | feat(onboarding): guide dependency setup step-by-step | Mar 3 | +303/-62, 4 files |
+
+---
+
+## PR #796 — Windows Onboarding Wizard (main review)
+
+Full first-run dependency wizard for Windows users. Checks for Git, Node, npm, GitHub CLI, Claude Code, and Codex CLI, then guides install via winget/PowerShell.
+
+### Medium Issues
+
+1. **Dead code: `guidance` variable** (client/app.js) — ~60 lines computing a variable that is never rendered in the template. Remove or wire it up.
+
+2. **Memory leak in `setupActionRuns`** (server/setupActionService.js) — `setupActionRuns` and `latestRunByActionId` Maps grow unboundedly with no cleanup/TTL. Add pruning.
+
+3. **Empty updater `pubkey`** (src-tauri/tauri.conf.json) — `pubkey: ""` prevents the startup panic but could silently accept unsigned updates. Set a real key or remove updater config entirely.
+
+4. **Duplicated Windows tool path logic** — Both `diagnosticsService.js` and `setupActionService.js` independently resolve Windows tool paths (~50 lines each). Extract a shared module to prevent divergence.
+
+5. **`autoCreate: true` behavioral change** (server/workspaceManager.js) — Changed from `false` to `true`. Existing users will see worktrees auto-created on new workspaces. Should be documented in PR description.
+
+6. **`stdout`/`stderr` nulled for ALL platforms** (src-tauri/src/main.rs) — Backend crash output is lost on all platforms, not just Windows. Consider routing to a log file.
+
+### Low Issues
+
+7. **Unescaped `statusText`/`runLabel`/`nextLabel`** in HTML template — Currently safe (hardcoded values) but violates defense-in-depth. Wrap in `escapeHtml()`.
+
+8. **`configureGitIdentity` platform-locked to win32** — `git config --global` works everywhere. The guard is unnecessary.
+
+9. **1,400-line method** (`setupDependencySetupWizard`) — Should be extracted to its own file (e.g. `client/dependency-wizard.js`).
+
+10. **Inline `require('child_process')`** inside route handler in server/index.js — Minor style inconsistency, already required elsewhere.
+
+### What's Good
+
+- Security is solid: URL validation on `open-url` endpoint, `escapeHtml()` used consistently, command injection surface is closed (hardcoded action IDs only)
+- Workspace startup race condition fixed properly with `workspaceSystemReady` promise gate
+- Toast notification system rewrite is a clean improvement over the old inline-style approach
+- Scrollbar theming well-implemented with `@supports` fallback for `color-mix()`
+- ARIA attributes on the onboarding modal
+- CSS specificity fix in notifications.js scopes generic class names properly
+
+### Architecture Note
+
+`setupActionService.js` does NOT follow the singleton class pattern used by every other service (SessionManager, WorkspaceManager, etc.). Uses module-level Maps with plain exported functions. Works fine but breaks consistency.
+
+---
+
+## PR #791 — Updater Plugin Fix
+
+**5 lines.** Adds `plugins.updater.pubkey: ""` to `tauri.conf.json` to prevent Tauri crash on Windows packaged builds. Correct fix for the immediate panic. Same empty pubkey concern as noted in #796 review.
+
+**Note:** This commit is cherry-picked into #796, so if #796 merges first, #791 can be closed as redundant.
+
+---
+
+## PR #790 — Test Fixes
+
+**+10/-10, 2 files.** Updates stale test expectations:
+- `clearAgent` → `markAgentInactive` (matching current behavior)
+- Seeds in-memory state directly instead of mocking `loadWorkspaceState`
+
+Clean, correct, minimal. Should merge.
+
+---
+
+## PR #788 — Server-Only File Watching
+
+**+115/-1, 9 files.** Adds `serverOnlyFileWatching` toggle so client-only file changes don't restart nodemon.
+
+- New `scripts/dev-server.js` launcher reads user-settings.json at startup
+- Settings UI toggle under new "Developer" section
+- Follows existing patterns well
+- Includes `ai-memory/` files that should probably be excluded from the PR
+
+Should merge.
+
+---
+
+## Merge Recommendations
+
+| Priority | PR | Action |
+|----------|----|--------|
+| 1 | **#790** | Merge as-is |
+| 2 | **#788** | Merge (optionally remove ai-memory files first) |
+| 3 | **#791** | Merge, file follow-up for real pubkey |
+| 4 | **#796** | Address medium issues (dead code, memory leak, escape hardening), then merge |
diff --git a/COMMANDER_CLAUDE.md → docs/COMMANDER_CLAUDE.md b/COMMANDER_CLAUDE.md → docs/COMMANDER_CLAUDE.md
diff --git a/PUBLIC_RELEASE_AUDIT_2026-02-06.md → docs/PUBLIC_RELEASE_AUDIT_2026-02-06.md b/PUBLIC_RELEASE_AUDIT_2026-02-06.md → docs/PUBLIC_RELEASE_AUDIT_2026-02-06.md
diff --git a/DIFF_VIEWER_FEATURES.md → docs/diff-viewer/DIFF_VIEWER_FEATURES.md b/DIFF_VIEWER_FEATURES.md → docs/diff-viewer/DIFF_VIEWER_FEATURES.md
diff --git a/INSTALL_DIFF_VIEWER.md → docs/diff-viewer/INSTALL_DIFF_VIEWER.md b/INSTALL_DIFF_VIEWER.md → docs/diff-viewer/INSTALL_DIFF_VIEWER.md
diff --git a/ADVANCED_DIFF_VIEWER_PLAN.md → docs/historical/ADVANCED_DIFF_VIEWER_PLAN.md b/ADVANCED_DIFF_VIEWER_PLAN.md → docs/historical/ADVANCED_DIFF_VIEWER_PLAN.md
diff --git a/COMPLETE_IMPLEMENTATION.md → docs/historical/COMPLETE_IMPLEMENTATION.md b/COMPLETE_IMPLEMENTATION.md → docs/historical/COMPLETE_IMPLEMENTATION.md
diff --git a/COWORKER_SETUP.md → docs/historical/COWORKER_SETUP.md b/COWORKER_SETUP.md → docs/historical/COWORKER_SETUP.md
diff --git a/COWORKER_SETUP_GUIDE.md → docs/historical/COWORKER_SETUP_GUIDE.md b/COWORKER_SETUP_GUIDE.md → docs/historical/COWORKER_SETUP_GUIDE.md
diff --git a/DOCUMENTATION.md → docs/historical/DOCUMENTATION.md b/DOCUMENTATION.md → docs/historical/DOCUMENTATION.md
diff --git a/FINAL_PLAN.md → docs/historical/FINAL_PLAN.md b/FINAL_PLAN.md → docs/historical/FINAL_PLAN.md
diff --git a/GAP_ANALYSIS_2026-01-17.md → docs/historical/GAP_ANALYSIS_2026-01-17.md b/GAP_ANALYSIS_2026-01-17.md → docs/historical/GAP_ANALYSIS_2026-01-17.md
diff --git a/GIT_STATUS_COMPARISON.md → docs/historical/GIT_STATUS_COMPARISON.md b/GIT_STATUS_COMPARISON.md → docs/historical/GIT_STATUS_COMPARISON.md
diff --git a/IMPLEMENTATION_NOTES.md → docs/historical/IMPLEMENTATION_NOTES.md b/IMPLEMENTATION_NOTES.md → docs/historical/IMPLEMENTATION_NOTES.md
diff --git a/IMPLEMENTATION_PLAN.md → docs/historical/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md → docs/historical/IMPLEMENTATION_PLAN.md
diff --git a/IMPLEMENTATION_STATUS.md → docs/historical/IMPLEMENTATION_STATUS.md b/IMPLEMENTATION_STATUS.md → docs/historical/IMPLEMENTATION_STATUS.md
diff --git a/IMPROVEMENT_ROADMAP.md → docs/historical/IMPROVEMENT_ROADMAP.md b/IMPROVEMENT_ROADMAP.md → docs/historical/IMPROVEMENT_ROADMAP.md
diff --git a/PHASE2_IMPLEMENTATION_PLAN.md → .../historical/PHASE2_IMPLEMENTATION_PLAN.md b/PHASE2_IMPLEMENTATION_PLAN.md → .../historical/PHASE2_IMPLEMENTATION_PLAN.md
diff --git a/PROJECT_CREATION_PLAN.md → docs/historical/PROJECT_CREATION_PLAN.md b/PROJECT_CREATION_PLAN.md → docs/historical/PROJECT_CREATION_PLAN.md
diff --git a/PR_CLEANUP_PLAN.md → docs/historical/PR_CLEANUP_PLAN.md b/PR_CLEANUP_PLAN.md → docs/historical/PR_CLEANUP_PLAN.md
diff --git a/PR_SUMMARY.md → docs/historical/PR_SUMMARY.md b/PR_SUMMARY.md → docs/historical/PR_SUMMARY.md
diff --git a/PUBLIC_RELEASE_AUDIT_2026-02-04.md → ...orical/PUBLIC_RELEASE_AUDIT_2026-02-04.md b/PUBLIC_RELEASE_AUDIT_2026-02-04.md → ...orical/PUBLIC_RELEASE_AUDIT_2026-02-04.md
diff --git a/PUBLIC_RELEASE_AUDIT_2026-02-05.md → ...orical/PUBLIC_RELEASE_AUDIT_2026-02-05.md b/PUBLIC_RELEASE_AUDIT_2026-02-05.md → ...orical/PUBLIC_RELEASE_AUDIT_2026-02-05.md
diff --git a/QUICK_START.md → docs/historical/QUICK_START.md b/QUICK_START.md → docs/historical/QUICK_START.md
diff --git a/QUICK_START_SUMMARY.md → docs/historical/QUICK_START_SUMMARY.md b/QUICK_START_SUMMARY.md → docs/historical/QUICK_START_SUMMARY.md
diff --git a/REVISED_WORKSPACE_PLAN.md → docs/historical/REVISED_WORKSPACE_PLAN.md b/REVISED_WORKSPACE_PLAN.md → docs/historical/REVISED_WORKSPACE_PLAN.md
diff --git a/SETUP_INSTRUCTIONS.md → docs/historical/SETUP_INSTRUCTIONS.md b/SETUP_INSTRUCTIONS.md → docs/historical/SETUP_INSTRUCTIONS.md
diff --git a/SYSTEM_OVERVIEW_PRESENTATION.md → ...istorical/SYSTEM_OVERVIEW_PRESENTATION.md b/SYSTEM_OVERVIEW_PRESENTATION.md → ...istorical/SYSTEM_OVERVIEW_PRESENTATION.md
diff --git a/USAGE_CLARIFICATION.md → docs/historical/USAGE_CLARIFICATION.md b/USAGE_CLARIFICATION.md → docs/historical/USAGE_CLARIFICATION.md
diff --git a/WORKSPACE_ANALYSIS.md → docs/historical/WORKSPACE_ANALYSIS.md b/WORKSPACE_ANALYSIS.md → docs/historical/WORKSPACE_ANALYSIS.md
diff --git a/WINDOWS_BUILD_GUIDE.md → docs/windows/WINDOWS_BUILD_GUIDE.md b/WINDOWS_BUILD_GUIDE.md → docs/windows/WINDOWS_BUILD_GUIDE.md
diff --git a/WINDOWS_QUICK_START.md → docs/windows/WINDOWS_QUICK_START.md b/WINDOWS_QUICK_START.md → docs/windows/WINDOWS_QUICK_START.md
diff --git a/scripts/public-release-audit.js b/scripts/public-release-audit.js
@@ -12,7 +12,7 @@ const publicDocs = [
   'README.md',
   'SECURITY.md',
   'CONTRIBUTING.md',
-  'WINDOWS_QUICK_START.md',
+  'docs/windows/WINDOWS_QUICK_START.md',
   'PLANS/2026-02-06/SELLABLE_WINDOWS_RELEASE_PLAYBOOK.md',
   'scripts/windows-launchers/README.md'
 ];