agenthub/WINDOWS_CONTINUE.md

Continue on Windows — Claude Code session prompt

Point Claude Code (running on the Windows machine) at this file: "Read WINDOWS_CONTINUE.md and follow it."

You are Claude Code on a fresh Windows machine, working on ReBreak — a gambling-addiction recovery app (German DiGA medical-device track). ReBreak protects a user's own devices, with consent, from gambling sites via DNS/DoH filtering. This is legitimate, consensual, self-applied recovery software.

Your job this session: validate + debug the Windows device-protection, and get this machine working as an AgentHub client so it syncs with the Mac. Do NOT work on the AgentHub package itself — a separate "hub" agent on the Mac owns that.

Where we are

• Windows desktop protection lives in apps/rebreak-magic-win (Tauri 2 / Rust): a self-elevating setup applying DoH/DNS/firewall/browser policies, plus a SYSTEM tamper-service (watchdog).
• We ran a DNS-only validation on this machine via pilots/tsk-0003-windows.ps1 (in the agenthub repo). It pairs with staging, registers the device, applies protection. The protection talks to staging.rebreak.org over the internet — independent of the LAN.
• AgentHub = the team's coordination layer. The hub server runs on the Mac at http://192.168.178.30:3377 (single source of truth; Mac firewall off, server up).
• Problem observed: the pilot ran, but its AgentHub calls (claim/done/memory) did NOT reach the Mac (TSK-0003 still open, no memory entry). Likely cause: either agenthub CLI not globally linked on this fresh machine, or this machine can't reach the Mac over the LAN.

Tasks (in order)

1. Confirm LAN connectivity to the Mac hub:

   Invoke-RestMethod http://192.168.178.30:3377/status
   

   • Returns { body: "# Project Status..." } → LAN OK, proceed.
   • Times out → network issue. Diagnose: Test-NetConnection 192.168.178.30 -Port 3377; confirm both machines' ipconfig show 192.168.178.x (same subnet / same WLAN, no guest-net isolation).
2. Ensure the agenthub CLI exists here:

   agenthub --version
   

   • "not recognized" → in the agenthub clone dir: pnpm build then npm link (or pnpm link --global).
   • Then: $env:AGENTHUB_SERVER="http://192.168.178.30:3377"; agenthub task list → should list TSK-0001..0006 from the Mac.
3. Verify the protection actually works:

   Resolve-DnsName lotto.de            # blocked/empty = protection active
   Get-DnsClientDohServerAddress       # should show DoH on 178.105.101.137
   

   If inactive, re-run pilots\tsk-0003-windows.ps1 (one UAC prompt) and capture the ==== DONE ==== line.
4. Debug rebreak-magic-win if needed — apps/rebreak-magic-win/src-tauri/: protection-core/src/lib.rs (DoH/firewall apply), setup.rs (SYSTEM tamper-service install), service/src/main.rs (watchdog). CLI pilot is DNS-only; fail-closed tamper-service = TSK-0005.
5. Report back via AgentHub so the Mac sees it:

   agenthub task claim TSK-0003 --agent windows-claude
   agenthub memory add --title "TSK-0003 Windows validation" --category implementation --content "<what worked / what broke / exact errors>"
   agenthub task done TSK-0003   # only if protection verified working
   

Key facts

• AgentHub hub (Mac): http://192.168.178.30:3377 — set $env:AGENTHUB_SERVER to it if auto-discovery fails.
• Staging backend: https://staging.rebreak.org. Test pairing code: 000000 (debug bypass, test-only — to be env-gated/removed).
• DoH host: dns.rebreak.org → 178.105.101.137.
• The agenthub clone on this machine appears to live under OneDrive — OneDrive can spuriously dirty git working trees ("commit before pull"). To force-sync the agenthub tool: git fetch origin; git reset --hard origin/main; pnpm build.

Deliverable

Summarize: Is the Windows protection solid? What broke? What's needed for a production-grade fail-closed Windows protection (tamper-service)? Put the summary in AgentHub memory so the Mac side picks it up.