fix(windows): hasAuth cross-platform + findClaudePath prefer .cmd/.exe

Two more production fixes surfaced during the full native-Windows E2E
(not the deterministic-only smoke): the previous pass verified unit
tests + deterministic setup but hadn't installed Claude Code natively
on Windows to run a real LLM-backed setup.

1. src/cli.ts hasAuth(): split PATH with a hardcoded ':' separator
   (POSIX-only — Windows uses ';') and looked for a bare-name file
   'claude' (Windows executables need .exe/.cmd/.bat/.ps1 suffix).
   Result: hasAuth returned false on Windows even when Claude Code
   was installed via `npm install -g` and on PATH, bailing out of
   setup with "No Claude authentication found." Delegated to the
   existing findClaudePath() helper which already handles PATH.delimiter,
   PATHEXT suffixes, and standard-install locations cross-platform —
   no divergence between what hasAuth sees and what the scanners
   will try to use.

2. src/utils/agent-options.ts findClaudePath(): `where.exe claude` on
   Windows returns EVERY match from PATH including the bare-name
   shebang file that npm ships for Unix compatibility (e.g.
   C:\node\claude with no extension alongside C:\node\claude.cmd).
   Our prior code took the first line — the bare-name file — which
   the Claude Agent SDK / cmd.exe cannot execute. Now we filter the
   where.exe output to prefer entries ending in .cmd/.exe/.bat/.ps1
   on Windows, falling back to the first entry if nothing matches.
   POSIX behavior unchanged.

Linux: npm test 511/511 pass; full E2E on a real repo clone
(tmp/axme-e2e, 79 .ts files) — setup LLM-scanned 28 decisions + 13
presets = 41 total, $0.92, 203s; Claude session with Bash + Read
tools, SessionEnd hook fired, detached audit worker ran to
audit_complete. No regression.

Author: George-iam

src/cli.ts

@@ -143,19 +143,19 @@ function generateClaudeMd(projectPath: string, isWorkspace: boolean): void {
 
 /**
  * Check if Claude auth is available.
- * Checks: ANTHROPIC_API_KEY, or claude binary exists on disk.
+ * Checks: ANTHROPIC_API_KEY, or a locatable `claude` CLI (which is evidence
+ * the user has either an API key or a signed-in Claude subscription).
+ *
+ * Delegates to findClaudePath() so the PATH-separator (":" vs ";"), executable
+ * suffixes (".cmd", ".exe" on Windows), and standard-install locations are all
+ * handled the same way scanner agents resolve the binary — no divergence.
  */
 function hasAuth(): boolean {
   if (process.env.ANTHROPIC_API_KEY) return true;
-
-  // Check common claude binary locations directly (no shell needed)
-  const { env } = process;
-  const pathDirs = (env.PATH || "").split(":");
-  for (const dir of pathDirs) {
-    if (existsSync(join(dir, "claude"))) return true;
-  }
-
-  return false;
+  // findClaudePath already checks AXME_CLAUDE_EXECUTABLE, CLAUDE_CODE_ENTRYPOINT,
+  // PATH lookup, standard install locations, and nvm dirs, cross-platform.
+  const { findClaudePath } = require("./utils/agent-options.js") as typeof import("./utils/agent-options.js");
+  return !!findClaudePath();
 }
 
 /**

src/utils/agent-options.ts

@@ -55,8 +55,17 @@ export function findClaudePath(): string | undefined {
   try {
     const lookup = process.platform === "win32" ? "where.exe claude" : "which claude";
     const p = execSync(lookup, { encoding: "utf-8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] }).trim();
-    // `where` may return multiple lines (one per match); take the first.
-    const first = p.split(/\r?\n/)[0].trim();
+    const lines = p.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    // On Windows, `where.exe claude` returns every matching entry including
+    // the bare-name shebang file that npm ships for Unix compatibility
+    // (e.g. C:\node\claude with no extension). cmd.exe / the Agent SDK
+    // cannot execute such files — they need .cmd/.exe/.bat/.ps1. Pick the
+    // first Windows-executable from the list; fall back to the first entry
+    // only if nothing else matches (unlikely but keeps behaviour defined).
+    const preferred = process.platform === "win32"
+      ? lines.find((r) => /\.(cmd|exe|bat|ps1)$/i.test(r))
+      : undefined;
+    const first = preferred ?? lines[0];
     if (first && existsSync(first)) {
       _claudePath = first;
       return _claudePath;