fix: harden cross-platform paths and child-process handling

Replace process.env.HOME fallbacks with os.homedir() in dashboard usage
probes and the hermes plugin profile resolver so unset HOME no longer
yields literal "~" paths. Skip POSIX process-group semantics on Windows
in engine/merger and dashboard-tui's pgrep-based vitest killer. Add
shell: true to npx spawns in CLI skills/extension so .cmd shims resolve
on Windows, and route test:build-exe through cross-env.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/cli/package.json

@@ -45,7 +45,7 @@
     "build:exe:all": "bun run build.ts --all",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --silent=passed-only --reporter=dot",
-    "test:build-exe": "FUSION_TEST_BUILD_EXE=1 vitest run --config vitest.build-exe.config.ts --silent=passed-only --reporter=dot"
+    "test:build-exe": "cross-env FUSION_TEST_BUILD_EXE=1 vitest run --config vitest.build-exe.config.ts --silent=passed-only --reporter=dot"
   },
   "dependencies": {
     "@mariozechner/pi-ai": "^0.70.0",
@@ -82,6 +82,7 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@vitest/coverage-v8": "^3.1.0",
+    "cross-env": "^7.0.0",
     "ink-testing-library": "^4.0.0",
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",

packages/cli/src/commands/dashboard-tui/controller.ts

@@ -272,6 +272,10 @@ export class DashboardTUI {
    * gone by the time we send the signal).
    */
   killVitestProcesses(): { killed: number; pids: number[] } {
+    // pgrep is POSIX-only; Windows path is a no-op above.
+    if (process.platform === "win32") {
+      return { killed: 0, pids: [] };
+    }
     const selfPid = process.pid;
     let pids: number[] = [];
     try {

packages/cli/src/commands/skills.ts

@@ -187,6 +187,7 @@ export async function runSkillsInstall(
   const child = spawn("npx", npxArgs, {
     cwd: process.cwd(),
     stdio: "inherit",
+    shell: true,
   });
 
   const exitCode = await new Promise<number>((resolve, reject) => {

packages/cli/src/extension.ts

@@ -1791,6 +1791,7 @@ export default function kbExtension(pi: ExtensionAPI) {
       const child = spawn("npx", npxArgs, {
         cwd: resolveProjectRoot(ctx.cwd),
         stdio: "pipe",
+        shell: true,
       });
 
       let stderr = "";
@@ -1895,6 +1896,7 @@ export default function kbExtension(pi: ExtensionAPI) {
         stdio: ["ignore", "pipe", "pipe"],
         detached: false,
         env: { ...process.env },
+        shell: true,
       });
 
       dashboardProcess = child;