feat(dep_ensure): complete Windows bootstrap — dep_ensure + install.ps1 + detection (#27845)

* feat(dep_ensure): complete Windows bootstrap — dep_ensure + install.ps1 + detection

dep_ensure.py gains Windows awareness: PowerShell invocation, platform-
specific browser detection, (path, shell) tuple returns.

install.ps1 gains -Ensure/-PostInstall modes using npm -g --prefix
(aligned with install.sh) and agent-browser install for Chromium.

browser_tool.py gains node/ in candidate dirs for Windows .cmd shims.
Both install scripts bundled in pip wheel.

Tracking: #27826

* fix(install.ps1): add --ignore-scripts to npm install for camofox

@askjo/camofox-browser has a dependency (impit) whose postinstall
script runs `npx only-allow pnpm`, which fails under npm. Adding
--ignore-scripts avoids the spurious failure without affecting
functionality.

Tracking: #27826

* fix: remove duplicate install scripts from git

CI already copies scripts/install.{sh,ps1} into hermes_cli/scripts/
during wheel build. No need to commit copies — .gitignore keeps them
out, _find_install_script() falls back to scripts/ for git-clone users.

Tracking: #27826

* fix: address review — remove env_extra, fix ps1 error handling

- Remove unused env_extra parameter from ensure_dependency()
- Invoke-EnsureMode node case now uses Test-Node consistently
- Install-AgentBrowser uses throw instead of exit 1

tests/hermes_cli/test_dep_ensure.py

@@ -16,7 +16,7 @@ def test_ensure_dependency_returns_false_when_missing_noninteractive():
     from hermes_cli.dep_ensure import ensure_dependency
     with patch("hermes_cli.dep_ensure.shutil") as mock_shutil:
         mock_shutil.which.return_value = None
-        with patch("hermes_cli.dep_ensure._find_install_script", return_value=None):
+        with patch("hermes_cli.dep_ensure._find_install_script", return_value=(None, None)):
             result = ensure_dependency("node", interactive=False)
             assert result is False
 
@@ -27,9 +27,11 @@ def test_find_install_script_from_checkout(tmp_path):
     scripts_dir = tmp_path / "scripts"
     scripts_dir.mkdir()
     (scripts_dir / "install.sh").write_text("#!/bin/bash", encoding="utf-8")
-    result = _find_install_script(package_dir=tmp_path / "hermes_cli", repo_root=tmp_path)
-    assert result is not None
-    assert result.name == "install.sh"
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False):
+        path, shell = _find_install_script(package_dir=tmp_path / "hermes_cli", repo_root=tmp_path)
+    assert path is not None
+    assert path.name == "install.sh"
+    assert shell == "bash"
 
 
 def test_find_install_script_from_wheel(tmp_path):
@@ -38,6 +40,124 @@ def test_find_install_script_from_wheel(tmp_path):
     bundled = tmp_path / "hermes_cli" / "scripts"
     bundled.mkdir(parents=True)
     (bundled / "install.sh").write_text("#!/bin/bash", encoding="utf-8")
-    result = _find_install_script(package_dir=tmp_path / "hermes_cli", repo_root=tmp_path)
-    assert result is not None
-    assert result.name == "install.sh"
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False):
+        path, shell = _find_install_script(package_dir=tmp_path / "hermes_cli", repo_root=tmp_path)
+    assert path is not None
+    assert path.name == "install.sh"
+    assert shell == "bash"
+
+
+def test_find_install_script_prefers_ps1_on_windows(tmp_path):
+    """On Windows, _find_install_script should find install.ps1."""
+    scripts_dir = tmp_path / "hermes_cli" / "scripts"
+    scripts_dir.mkdir(parents=True)
+    (scripts_dir / "install.ps1").write_text("# fake")
+    (scripts_dir / "install.sh").write_text("# fake")
+    from hermes_cli.dep_ensure import _find_install_script
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", True):
+        path, shell = _find_install_script(package_dir=tmp_path / "hermes_cli")
+        assert path == scripts_dir / "install.ps1"
+        assert shell == "powershell"
+
+
+def test_find_install_script_returns_sh_on_posix(tmp_path):
+    """On POSIX, _find_install_script should find install.sh."""
+    scripts_dir = tmp_path / "hermes_cli" / "scripts"
+    scripts_dir.mkdir(parents=True)
+    (scripts_dir / "install.ps1").write_text("# fake")
+    (scripts_dir / "install.sh").write_text("# fake")
+    from hermes_cli.dep_ensure import _find_install_script
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False):
+        path, shell = _find_install_script(package_dir=tmp_path / "hermes_cli")
+        assert path == scripts_dir / "install.sh"
+        assert shell == "bash"
+
+
+def test_find_install_script_falls_back_to_repo_root(tmp_path):
+    """When no bundled script, check repo root."""
+    repo_root = tmp_path / "repo"
+    (repo_root / "scripts").mkdir(parents=True)
+    (repo_root / "scripts" / "install.sh").write_text("# fake")
+    from hermes_cli.dep_ensure import _find_install_script
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False):
+        path, shell = _find_install_script(package_dir=tmp_path / "hermes_cli", repo_root=repo_root)
+        assert path == repo_root / "scripts" / "install.sh"
+        assert shell == "bash"
+
+
+def test_find_install_script_returns_none_when_missing(tmp_path):
+    from hermes_cli.dep_ensure import _find_install_script
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False):
+        result = _find_install_script(package_dir=tmp_path / "x", repo_root=tmp_path / "y")
+        assert result == (None, None)
+
+
+def test_has_system_browser_checks_windows_names():
+    from hermes_cli.dep_ensure import _has_system_browser
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", True), \
+         patch("hermes_cli.dep_ensure.shutil") as mock_shutil:
+        mock_shutil.which.side_effect = lambda name: "/fake/msedge.exe" if name == "msedge" else None
+        assert _has_system_browser() is True
+
+
+def test_has_system_browser_checks_posix_names():
+    from hermes_cli.dep_ensure import _has_system_browser
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False), \
+         patch("hermes_cli.dep_ensure.shutil") as mock_shutil:
+        mock_shutil.which.return_value = None
+        assert _has_system_browser() is False
+
+
+def test_has_hermes_agent_browser_windows_path(tmp_path):
+    node_dir = tmp_path / "node"
+    node_dir.mkdir(parents=True)
+    (node_dir / "agent-browser.cmd").write_text("@echo off")
+    from hermes_cli.dep_ensure import _has_hermes_agent_browser
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", True), \
+         patch("hermes_constants.get_hermes_home", return_value=tmp_path):
+        assert _has_hermes_agent_browser() is True
+
+
+def test_has_hermes_agent_browser_posix_path(tmp_path):
+    bin_dir = tmp_path / "node" / "bin"
+    bin_dir.mkdir(parents=True)
+    (bin_dir / "agent-browser").write_text("#!/bin/sh")
+    from hermes_cli.dep_ensure import _has_hermes_agent_browser
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False), \
+         patch("hermes_constants.get_hermes_home", return_value=tmp_path):
+        assert _has_hermes_agent_browser() is True
+
+
+def test_has_hermes_agent_browser_legacy_node_modules_path(tmp_path):
+    """Legacy git-clone installs put agent-browser in $HERMES_HOME/node_modules/.bin/."""
+    bin_dir = tmp_path / "node_modules" / ".bin"
+    bin_dir.mkdir(parents=True)
+    (bin_dir / "agent-browser").write_text("#!/bin/sh")
+    from hermes_cli.dep_ensure import _has_hermes_agent_browser
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", False), \
+         patch("hermes_constants.get_hermes_home", return_value=tmp_path):
+        assert _has_hermes_agent_browser() is True
+
+
+def test_ensure_dependency_uses_powershell_on_windows(tmp_path):
+    from hermes_cli.dep_ensure import ensure_dependency
+    scripts_dir = tmp_path / "scripts"
+    scripts_dir.mkdir(parents=True)
+    (scripts_dir / "install.ps1").write_text("# fake")
+    with patch("hermes_cli.dep_ensure._IS_WINDOWS", True), \
+         patch("hermes_cli.dep_ensure._DEP_CHECKS", {"node": lambda: False}), \
+         patch("hermes_cli.dep_ensure._find_install_script", return_value=(scripts_dir / "install.ps1", "powershell")), \
+         patch("hermes_cli.dep_ensure.shutil") as mock_shutil, \
+         patch("hermes_constants.get_hermes_home", return_value=tmp_path / "fakehome"), \
+         patch("subprocess.run") as mock_run, \
+         patch("sys.stdin") as mock_stdin:
+        mock_shutil.which.side_effect = lambda name: "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" if name == "powershell" else None
+        mock_stdin.isatty.return_value = False
+        mock_run.return_value = type("R", (), {"returncode": 0})()
+        ensure_dependency("node", interactive=False)
+        cmd = mock_run.call_args[0][0]
+        assert "powershell" in cmd[0].lower()
+        assert "-Ensure" in cmd
+        assert cmd[cmd.index("-Ensure") + 1] == "node"
+        assert "-HermesHome" in cmd
+        assert str(tmp_path / "fakehome") in cmd