Windows support (builds on #31)

[AndrewKirkovski]

Fixes #5. Builds on #31 by @makiisthenes.

The first commit is #31 unchanged, rebased onto current main (0.6.0, after the Tree-sitter change). Their authorship is kept. The commits after it fix the gaps I found while testing #31 on a real Windows machine.

What this adds on top of #31

• One place for storage paths. The config and cache folder logic was copied into auth.ts, index.ts and filesystem.ts. It now lives in storageDirectory() in @repo/core/storage, so the protected-path list always matches where jg actually writes.
• bun run build works on Windows. scripts/package-notices.mjs split resolved paths on /, so the build failed on Windows. This does not affect published packages, which are built on Ubuntu.
• Tests run on Windows.
  • New unit tests cover every platform branch of storageDirectory().
  • provider-protocol.mjs passes its preload to --import as a file URL. Node rejects a bare C:\ path.
  • POSIX-only fixtures (file modes, chmod 0, mkfifo, pty, filenames with a newline) are guarded with one posix flag in test/helpers/docker.ts.
  • The link-escape and cycle checks now create junctions, so they run on Windows without symlink privilege. POSIX ignores the junction type.
• Docs. The READMEs now list Windows and the %APPDATA%\jevgrep and %LOCALAPPDATA%\jevgrep locations. They also note that Windows relies on profile permissions rather than POSIX modes.

Verification

On Windows 11 with Node 22.22 and Bun 1.3.11:

• check-types and lint pass.
• bun test over the test-suite.sh paths: 54 pass, 0 fail (the rest are Docker-gated).
• With JEVGREP_TEST_IN_DOCKER=1 forced: 119 pass, 0 fail, 4 skipped as POSIX-only.
• node --test packages/core/test-node/provider-protocol.mjs: 18/18 pass.
• npm pack, then npm install -g from the tarball. jg --version and jg files work. An end-to-end run against a local fake provider also works:
  • auth --stdin saves the key to %APPDATA%\jevgrep.
  • The search returns both relevant Python files with Tree-sitter declarations.
  • The cache lands in %LOCALAPPDATA%\jevgrep, and a repeat search makes 0 provider requests.
  • A junction pointing outside the root is excluded, and no .env or ignored content is uploaded.
• jg skill passes the correct arguments to npx.cmd and returns its exit code.

On Linux, run in Docker from the same branch:

• bash scripts/test-docker.sh bash scripts/test-suite.sh passes.
• bash scripts/test-installed.sh: 40/40 pass.

Known limits

• There is no Windows CI job. The repo has no PR CI today, so I did not add one.
• On Windows, test/parser/parity.test.ts needs python3 and test/release.test.mjs needs a tar that accepts C: paths. Both are environment requirements, not product issues.
• jg skill uses shell: true on Windows because Node cannot spawn npx.cmd without a shell. Agent names are validated before use. Node 24 may print a deprecation warning for this, which I have not checked.

[makiisthenes]

@dzhng he has made sure it is tested

[makiisthenes]

Please don't squash commit

[AndrewKirkovski]

Additionally hand tested skill itself, seems working

[dzhng]

Thank you @AndrewKirkovski for building on #31, fixing the Windows build and storage paths, and testing the actual installed CLI on Windows. Thank you @makiisthenes for the original implementation and collaboration. All four commits from this PR are included in #47 with both authorships preserved, without squashing them. Closing this PR as integrated through #47; the work ships in v0.8.0.