# Fresh adversarial audit r1 — PR #18172

Verdict: **FIX FIRST (verification/publication), no confirmed source defect**. Reviewed the complete `origin/main` (`ab6be13d43`) ... local `HEAD` (`2edca79db5`) diff: five files, +194/-38. The remote PR still points to `177c39e5cf`; checks and its description apply to that older revision. The Windows PowerShell SSH command and npm problem is worth fixing; the current smaller implementation is coherent, but `2edca79db5` is not ready to publish or merge without native acceptance.

Findings: **None confirmed in source.** The remote command is only `sh -s`; `runSshCommand` UTF-8 streams the generated program through stdin. Shell quoting reconstructs CR in arguments, and `printf %b` reconstructs CR/NUL/backslashes in optional command stdin without evaluating the payload. The absent-stdin case attaches `/dev/null`. Existing host callers, including `xcrun simctl push` input, use this path. Windows npm dispatch invokes the selected Node with a standard `npm-cli.js` entry and leads child PATH with that Node directory; POSIX npm dispatch remains direct. No new cancellation or process cleanup code was added. The user-doc change is limited to actual Windows prerequisites.

**Release blocker — missing native proof (not a confirmed code bug):** On a real Windows OpenSSH host with PowerShell as its login shell and documented Git `sh`/Node PATH setup, run this exact head through Test connection, first registry install/hub start, agent start, stop/remove, interruption during install/start, disconnect, and retry. Check exact argument/stdin bytes (including CR, NUL, backslashes, and no trailing newline), child Node selection, diagnostics, locks, and orphan cleanup. Smallest resolution: perform that acceptance run and fix any observed failure before pushing. Linux subprocess tests and a modeled Windows npm branch cannot establish these outcomes.

**Publication blocker — stale PR description/evidence:** The published body claims engine/semver and alternate-runtime selection plus old Windows/macOS test counts, all removed at this local head; its CI belongs to `177c39e5cf`. Smallest resolution after native acceptance: push the accepted revision, replace the description/proof with exact-head behavior and checks, then obtain current-head CI/review. The historical CodeRabbit npm-metadata finding no longer applies because metadata/semver reads were removed. Its host-level handoff test request is addressed by the strengthened public `ready.run` test. Macroscope asked for human review, not a specific source fix.

Independent check: focused `SshDeviceHost.test.ts` and `sshDeviceScript.test.ts` passed (5/5); `git diff --check` passed and checkout remained clean. Handoff records targeted lint, format, and server typecheck passing. No browser, native app, dev server, or real Windows SSH check was run.
