sync: auto-sync from GURU-5070 at 2026-06-02 20:40:54

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-02 20:40:54

.claude/memory/MEMORY.md

@@ -39,6 +39,7 @@
 - [1Password — always use service token](feedback_1password_service_token.md) — Source OP_SERVICE_ACCOUNT_TOKEN from SOPS for every `op` call. Desktop-app integration prompts are unacceptable in agent flows.
 - [Point vault-access teammates at SOPS path](feedback_vault_pointer_for_teammates.md) — When relaying infra/credential info to Howard or other vault-access teammates, hand over the SOPS path + key anchors; don't transcribe the entry's fields into the message.
 - [/tmp path mismatch on Windows](feedback_tmp_path_windows.md) — Write tool and Git Bash resolve `/tmp` to DIFFERENT real dirs. Use heredoc or workspace path for JSON payloads handed to curl.
+- [Windows bash command mapping](feedback_windows_bash_mapping.md) — `bash` often resolves to WSL stub instead of Git/MSYS bash required by the harness. Fix by prepending `C:\Program Files\Git\bin` (and usr\bin) to PATH, or source `.claude/scripts/ensure-git-bash.ps1`. Profile has the logic; use plain `bash .claude/scripts/...` after remap. See the helper and this memory file for details.
 - [SQL instance role — verify by connections, not name](feedback_sql_instance_role_by_connection.md) — Standard installed under default `SQLEXPRESS` instance name is real. Prove role with `sys.dm_exec_sessions` + `Get-NetTCPConnection -OwningProcess` before recommending stop/uninstall.
 - [Clear-RecycleBin fails silently as SYSTEM](feedback_clear_recyclebin_system_context.md) — RMM-dispatched cleanup scripts cannot use `Clear-RecycleBin -Force`; the cmdlet uses Shell COM and silently no-ops without an interactive desktop. Enumerate `C:\$Recycle.Bin\<SID>\*` directly.
 - [Graph CA policy reads are eventually consistent](feedback_graph_ca_policy_eventual_consistency.md) — After PATCHing a CA policy (204), wait ~5s before GET-verifying; immediate reads can be stale.

.claude/memory/feedback_windows_bash_mapping.md

@@ -0,0 +1,54 @@
+# Windows Bash Command Mapping (Git Bash vs WSL stub)
+
+## The Issue
+On Windows machines (especially when the AI tool runs in PowerShell context), the `bash` command often resolves to the WSL stub at `C:\Users\...\WindowsApps\bash.exe` instead of the required Git for Windows / MSYS bash.
+
+This breaks the entire ClaudeTools harness:
+- `.claude/scripts/vault.sh`, `sync.sh`, `check-messages.sh`, etc. expect GNU bash features, `/d/claudetools` style paths, etc.
+- Hooks and commands invoke `bash -c '...'`.
+- `self-check` expects: `bash present (GNU bash, version 5.2.37(1)-release (x86_64-pc-msys))`
+
+Symptoms: "Windows Subsystem for Linux has no installed distributions." or scripts failing with path/quoting issues.
+
+## The Fix
+Prepend Git Bash directories to `$env:Path` so plain `bash` resolves to the correct one:
+
+```powershell
+$gitBin = "C:\Program Files\Git\bin"
+$gitUsrBin = "C:\Program Files\Git\usr\bin"
+if ((Test-Path $gitBin) -and ((Get-Command bash -ErrorAction SilentlyContinue).Source -notlike '*Git*bin*bash.exe')) {
+    $env:Path = "$gitBin;$gitUsrBin;" + ($env:Path -replace [regex]::Escape("$gitBin;"), '' -replace [regex]::Escape("$gitUsrBin;"), '')
+}
+```
+
+After this:
+- `Get-Command bash` returns `C:\Program Files\Git\bin\bash.exe`
+- `bash --version` shows the MSYS version
+- Plain invocations like `bash .claude/scripts/vault.sh list` work.
+
+## Project Helper
+Use the reusable script:
+
+```powershell
+. .claude/scripts/ensure-git-bash.ps1
+```
+
+It contains the logic above (idempotent, with verbose/warning).
+
+## Persistence
+The user's PowerShell profile (`$PROFILE`) sources/contains the remap logic so it applies on shell startup.
+
+See: `.claude/scripts/ensure-git-bash.ps1` (the helper) and the profile for the exact code.
+
+## For AI Sessions (Grok or Claude)
+- At the start of any command involving bash/harness scripts, ensure the mapping (source the ps1 or run the snippet).
+- In Grok: the `.grok/skills/windows-bash/SKILL.md` (if present) and this memory entry will be available.
+- Always prefer explicit full path ` "C:\Program Files\Git\bin\bash.exe" .claude/scripts/vault.sh ... ` for critical one-off calls if the env isn't trusted yet.
+- Git Bash terminals (launched directly) already have the correct bash.
+
+## Related
+- See the backslash hook for another Git Bash gotcha: `.claude/hooks/block-backslash-winpath.sh`
+- SSH: always use system OpenSSH (`C:\Windows\System32\OpenSSH\ssh.exe`), never Git's ssh.
+- Profile and PATH ordering is the standard way; do not remove the WindowsApps stub.
+
+This was fixed during a session on GURU-5070 to make Grok tool calls reliable with the harness. Add similar entries for other machine-specific env quirks.