fix(setup): avoid termios setup crash on Windows

[scwf]

Summary

• Use the shared stable_user_id() helper for qwen/kiro/hermes/kimi native bridge temp roots so imports do not require POSIX os.getuid().
• Skip POSIX uid/mode checks in the shared secure-dir validation when uid semantics are unavailable.
• Fall back from raw termios onboarding menus to numbered prompts on Windows while preserving wizard back navigation.

Testing

• python -m pytest tests/onboarding/test_interactive.py tests/onboarding/test_wizard.py tests/test_claude_native_bridge.py::test_ensure_secure_dir_succeeds_without_getuid tests/test_qwen_native_bridge.py -q -k "not rejects_symlinked_ancestor"

Also verified locally on Windows with the installed omnigent tool:

• omnigent server start; omnigent server status; omnigent server stop
• @('q') | omnigent setup

[scwf]

@cursor plz review this pr

[cursor]

PR Review: Fix Windows native startup fallbacks

Verdict: Approve. This is a focused, well-scoped fix for real Windows startup blockers. The approach matches existing conventions (stable_user_id(), tempfile.gettempdir(), numbered-menu fallbacks) and the tests cover the new behavior well.

---

What this fixes

Three separate Windows failures are addressed:

1. Import-time crashes — qwen, kiro, hermes, and kimi native bridges called os.getuid() at module load, which does not exist on Windows.
2. Bridge dir validation false positives — _ensure_secure_dir() in claude_native_bridge.py used getattr(os, "getuid", lambda: -1)(), so on Windows my_uid was always -1 and uid checks would reject every existing directory.
3. Onboarding UX — termios/tty are unavailable on Windows; setup menus now fall back to numbered prompts instead of crashing.

---

Code review by area

Native bridge temp roots

Switching the four lagging bridges to stable_user_id() + tempfile.gettempdir() aligns them with the rest of the native bridge modules (claude, cursor, goose, etc.).

On POSIX this preserves historical behavior (stable_user_id() returns the numeric uid; gettempdir() respects TMPDIR). On Windows it produces a stable, path-safe namespace under the system temp dir. Using gettempdir() instead of os.environ.get("TMPDIR", "/tmp") is also a small improvement on non-Unix systems where /tmp is wrong.

_ensure_secure_dir() uid/mode guards

    getuid = getattr(os, "getuid", None)
    my_uid = getuid() if getuid is not None else None
    for ancestor in ancestors:
        ...
        if my_uid is not None and st.st_uid != my_uid:
            ...
        if my_uid is not None and (st.st_mode & 0o077) != 0:
            os.chmod(ancestor, 0o700)

This is the right tradeoff: symlink and directory-type checks still run everywhere; uid/mode enforcement is skipped only where POSIX uid semantics do not apply. The old lambda: -1 fallback was actively harmful on Windows.

Onboarding fallbacks

• interactive.select() — catches ImportError for termios/tty on a TTY; existing termios.error handling remains as a second fallback.
• wizard._arrow_menu() — same pattern, reusing the existing numbered fallback.
• wizard._text_prompt() — degrades to click.prompt, consistent with the non-TTY path.
• _safe() encoding round-trip in _select_fallback() — sensible fix for legacy console encodings (e.g. GBK); the test with "not installed ✗" → "not installed ?" is a good regression guard.

---

Strengths

• Minimal diff — only the modules that were actually broken; other bridges already used stable_user_id().
• Good test design — test_native_bridge_roots_do_not_require_getuid uses a subprocess to delete os.getuid before import, which correctly simulates Windows without platform-specific CI.
• Author verification — manual Windows checks for omnigent server start/status/stop and omnigent setup add confidence beyond unit tests.
• Test fix — test_claude_native_bridge.subprocess_bridge_root now uses claude_native_bridge._BRIDGE_ROOT instead of hardcoding /tmp/omnigent-{uid}, which keeps it correct cross-platform.

---

Minor suggestions (non-blocking)

1. Wizard fallback tests — interactive.py gets two new tests; wizard.py gets the same termios fallback but no dedicated coverage. A small test mirroring test_select_falls_back_when_termios_is_unavailable for _arrow_menu would close that gap.

2. _ensure_secure_dir without getuid — Consider a targeted unit test that stubs out getuid and asserts bridge dir creation succeeds. The subprocess import test covers the other bridges; claude’s secure-dir logic is the subtlest part of this PR.

3. _safe() scope — The nested helper is recreated on every _select_fallback() call. Fine for onboarding; could be module-level if you want to avoid the closure, but not worth blocking on.

4. Windows security note (documented tradeoff) — Skipping mode checks on Windows means bridge dirs rely on OS ACLs rather than 0o700. That is reasonable given the platform, but worth keeping in mind if Windows native harnesses become more widely used.

---

Testing

I could not run the full suite in this environment (missing project dependencies like sqlalchemy). The PR’s stated test commands are appropriate:

python -m pytest tests/onboarding/test_interactive.py tests/test_native_bridge_platform.py -q
python -m pytest tests/onboarding/test_interactive.py tests/test_native_bridge_platform.py tests/test_qwen_native_bridge.py -q -k "not rejects_symlinked_ancestor"

The -k "not rejects_symlinked_ancestor" exclusion is reasonable if that test is POSIX-specific symlink semantics.

---

Summary

This PR correctly unblocks Windows native startup with consistent patterns, fixes a latent bug in _ensure_secure_dir()’s fake-uid fallback, and improves onboarding resilience on non-POSIX terminals. I would merge it; the wizard test gap is the only item I’d optionally follow up on.

  

[scwf]

@codex plz review this pr

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd4b7e4e90

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve back navigation in the Windows menu fallback

On Windows this new ImportError path is used for normal TTY menus because termios/tty are unavailable, but _arrow_menu_fallback only accepts numeric choices and never raises _GoBack. Most wizard menus use the default allow_back=True and callers rely on _GoBack to move to the previous step, so Windows users can get stuck completing the current menu flow or aborting the whole setup instead of going back; please add an explicit fallback back option such as q that raises _GoBack when allow_back is enabled.

Useful? React with 👍 / 👎.

[scwf]

@codex updeted，plz review again

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41cd2849eb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".