devill · Aug 21, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -5,7 +5,17 @@ on:
   pull_request:
 jobs:
   build:
-    runs-on: ubuntu-latest
+    # Windows is a supported platform, so it is gated the same as Linux rather
+    # than checked by hand — every POSIX assumption in this tool (a `bash -c`
+    # spawn, a `.venv/bin`, a backslash quoted for a shell, an argv budget
+    # measured against ARG_MAX) reads as correct on a Mac and breaks there.
+    # `fail-fast: false` because one platform's failure is not the other's, and
+    # cancelling the second run hides half the answer.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -37,17 +47,30 @@ jobs:
         run: |
           corepack enable pnpm
           pnpm install --frozen-lockfile
-      - name: Install pmd
-        # The java plugin's sensor and its spec cases need the real PMD on PATH.
-        # PMD publishes no checksum beside the zip (only a GPG signature), and a
-        # checksum fetched from the same origin as the artifact proves nothing
-        # anyway — so the digest is pinned here, next to the version it belongs
-        # to. Bumping PMD means replacing both lines together.
+      # The java plugin's sensor and its spec cases need the real PMD on PATH.
+      # PMD publishes no checksum beside the zip (only a GPG signature), and a
+      # checksum fetched from the same origin as the artifact proves nothing
+      # anyway — so the digest is pinned here, next to the version it belongs
+      # to. Bumping PMD means replacing all three lines that carry it.
+      - name: Install pmd (Linux)
+        if: runner.os == 'Linux'
         run: |
           curl -fsSLo /tmp/pmd.zip https://github.com/pmd/pmd/releases/download/pmd_releases%2F7.26.0/pmd-dist-7.26.0-bin.zip
           echo "9f55cb7ff0e9f9a66dd2f005eaa370e84c8a4cd971b134aa14a930c4a283ebc9  /tmp/pmd.zip" | sha256sum -c -
           unzip -q /tmp/pmd.zip -d /tmp/pmd
           echo "/tmp/pmd/pmd-bin-7.26.0/bin" >> "$GITHUB_PATH"
+      - name: Install pmd (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $url = 'https://github.com/pmd/pmd/releases/download/pmd_releases%2F7.26.0/pmd-dist-7.26.0-bin.zip'
+          Invoke-WebRequest -Uri $url -OutFile "$env:RUNNER_TEMP\pmd.zip"
+          $digest = (Get-FileHash "$env:RUNNER_TEMP\pmd.zip" -Algorithm SHA256).Hash.ToLower()
+          if ($digest -ne '9f55cb7ff0e9f9a66dd2f005eaa370e84c8a4cd971b134aa14a930c4a283ebc9') {
+            throw "pmd checksum mismatch: $digest"
+          }
+          Expand-Archive "$env:RUNNER_TEMP\pmd.zip" -DestinationPath "$env:RUNNER_TEMP\pmd"
+          "$env:RUNNER_TEMP\pmd\pmd-bin-7.26.0\bin" | Out-File -FilePath $env:GITHUB_PATH -Append
       - name: Test
         run: uv run pytest
       # Dogfooding: habit-hooks gates its own source. Without this the tool can

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,65 @@
 # Changelog
 
+## 1.4.0rc1
+
+Native Windows support. Reported by @FrankRaiser (#133) and @imalliaras (#134),
+neither of whom could get a run to complete.
+
+### Fixed
+
+- **habit-hooks runs on native Windows.** Every sensor was spawned through
+  `bash -c`, which Windows has not got — and where `bash` does resolve there it
+  is usually `C:\Windows\System32\bash.exe`, the WSL launcher, which answers
+  about a different filesystem. Nine of the eleven shipped sensors and
+  transformers never needed a shell; the other two only needed one to reach
+  `jq`. All eleven now spell `argv` and are spawned directly.
+
+- **Nothing decodes in the console's codepage any more.** Every guide, config
+  and spec file this tool reads is UTF-8 and now says so. On a cp1252 console
+  the first guide it rendered killed the run with a `UnicodeDecodeError` (#133);
+  the same bug hit any non-UTF-8 locale, including `LC_ALL=C` on Linux. The
+  streams it writes are UTF-8 too, so a printed block's box-drawing characters
+  cannot fail on the way out.
+
+- **A tool installed as `.cmd` or `.bat` is found.** Windows appends only `.exe`
+  to a bare command name, so `jscpd.CMD`, `knip.cmd` and `pmd.bat` were cleared
+  at setup and unreachable at run time. One lookup now answers both questions.
+
+- **`init` no longer offers an install it cannot run.** Its install command went
+  through `shell=True`, which on Windows is `cmd.exe`, and `cmd.exe` does not
+  understand the quotes in `uv tool install 'habit-hooks[python]'`.
+
+- **A wedged sensor still says why.** Windows raises its timeout carrying no
+  output at all, so the notice quoted back nothing where the tool had explained
+  itself.
+
+### Changed
+
+- **`jq` is no longer a dependency of any plugin.** The `ruff` and `eslint`
+  sensors piped their tool through it; both are now helpers beside their spec,
+  like every other sensor here. The only install hint we could offer was
+  `brew install jq`.
+
+- **A sensor spec may spell `argv = [...]`.** It is spawned as written, with no
+  shell, and it is the only form that runs on native Windows. `command = "..."`
+  remains for a plugin needing syntax a list cannot carry, and is refused off
+  POSIX rather than spawned into a shell that is not there.
+
+- **`eslint` and `knip` are found in the project, not on `PATH`.** They are
+  resolved from `node_modules` and run through Node directly, so a globally
+  installed copy is no longer used — the shipped eslint config could never have
+  worked with one, since it resolves its plugins from the project. `init` names
+  `npm install --save-dev eslint knip` when they are missing.
+
+- **An argument that `cmd.exe` would read as syntax is refused.** A `.bat` or
+  `.cmd` is run through `cmd.exe`, and sensor arguments are filenames out of
+  whatever branch is checked out.
+
+### Known limits
+
+- The executable documentation under `docs/` is POSIX shell and is skipped on
+  Windows (#137). The tool's own test suite runs there in full.
+
 ## 1.3.1
 
 Discoverability and documentation. No behaviour changes.