test(ripgrep diagnostic): add Windows-path coverage + appRoot validation

Two polish items from review:

- getRipgrepDiagnostic now early-returns an explanatory message
  when vscode.env.appRoot is empty, instead of silently producing
  a report with a meaningless path probe. Closes Rule 5 (input
  validation) gap from the JPL audit.
- New test exercises the .asar->.asar.unpacked substitution on
  Windows-style backslash paths. The regex already handles both
  separators via [\\/], this just pins it.

Author: 0xMink

src/services/ripgrep/__tests__/diagnostic.spec.ts

@@ -130,4 +130,27 @@ describe("getRipgrepDiagnostic", () => {
 		}
 		expect(report).not.toContain("✓ ")
 	})
+
+	it("rewrites node_modules.asar to node_modules.asar.unpacked on Windows paths (backslash separator)", async () => {
+		// Pure string-substitution test: the literal `win32-x64` segment is
+		// not derived from process.platform/arch, so this runs on any host.
+		const rgPath = "C:\\app\\node_modules.asar\\@vscode\\ripgrep-universal\\bin\\win32-x64\\rg.exe"
+		const substituted = "C:\\app\\node_modules.asar.unpacked\\@vscode\\ripgrep-universal\\bin\\win32-x64\\rg.exe"
+		ripgrepMock.value = { rgPath }
+		fsMock.existing = new Set([substituted])
+
+		const report = await getRipgrepDiagnostic("C:\\app")
+
+		expect(report).toContain(`after .asar→.asar.unpacked: ${substituted}`)
+		expect(report).toContain("fileExistsAtPath: true")
+	})
+
+	it("returns an explanatory report when vscode.env.appRoot is empty", async () => {
+		const report = await getRipgrepDiagnostic("")
+
+		expect(report).toContain("vscode.env.appRoot: (empty)")
+		expect(report).toContain("Cannot run diagnostic")
+		// path probe should NOT have run
+		expect(report).not.toContain("--- step 2: path probe under appRoot ---")
+	})
 })

src/services/ripgrep/diagnostic.ts

@@ -37,6 +37,18 @@ function probeCandidates(vscodeAppRoot: string): readonly string[] {
  * reports which ones exist on disk.
  */
 export async function getRipgrepDiagnostic(vscodeAppRoot: string): Promise<string> {
+	if (!vscodeAppRoot || vscodeAppRoot.trim() === "") {
+		return [
+			`Zoo Code Ripgrep Diagnostic (${new Date().toISOString()})`,
+			`vscode.version: ${vscode.version}`,
+			`vscode.env.appRoot: (empty)`,
+			``,
+			`Cannot run diagnostic: vscode.env.appRoot is empty. This usually means`,
+			`the extension activated outside a VS Code-style host (e.g., a remote`,
+			`extension host that doesn't expose appRoot). The require-interceptor`,
+			`path may still work; the path-probe step requires a valid appRoot.`,
+		].join("\n")
+	}
 	const lines: string[] = [
 		`Zoo Code Ripgrep Diagnostic (${new Date().toISOString()})`,
 		`vscode.version: ${vscode.version}`,