Make watch stop work safely on Windows (#74)

[JordanCoin]

Closes #74. Follow-up to #73 (which fixed watch status on Windows).

What

Makes codemap watch stop actually terminate the daemon on Windows, while guarding against the PID-reuse risk Codex flagged on #73.

• processCommandLine on Windows (was a stub): now queries the full command line via Get-CimInstance Win32_Process — the Windows analog of the Unix ps call — so IsOwnedDaemon can confirm a PID is this repo's watch daemon <root>.
• Platform-specific terminateDaemon:
  • Unix: unchanged — ungated SIGTERM (preserves long-standing behavior + existing tests).
  • Windows: verifies IsOwnedDaemon first, then Kill; returns ErrForeignDaemonPID when ownership can't be confirmed (refuse-when-uncertain).
• Stop: on a stale/foreign PID it clears the bogus watch.pid (so status stops reporting it) but never kills the unrelated process. The stop command reports Watch daemon not running (cleared stale PID file).

Why Windows-only gating

Killing a reused PID is destructive; on Windows we refuse when uncertain. Unix keeps its historical ungated SIGTERM (a reused-PID SIGTERM is far less catastrophic, and gating it would risk refusing to stop a real daemon in environments where process introspection is restricted).

⚠️ Testing limitation

The Windows runtime path (CIM command-line lookup + ownership kill) cannot be exercised in this environment or in CI — the Windows CI job only builds, it doesn't run tests. Verified here:

• GOOS=windows go build + go vet clean.
• Host (Unix) tests green, including a new command-layer test for the foreign-PID branch.

@ScottRosenberg2 — if you're able, verification on real Windows would be valuable:

codemap watch start
codemap watch stop     # should stop the daemon
codemap watch status   # should report not running

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 66.66667% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
watch/state.go	57.89%	6 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR updates the watch stop flow to safely terminate the watch daemon on Windows by verifying PID ownership (to avoid PID-reuse killing an unrelated process), while preserving the existing Unix SIGTERM behavior.

Changes:

• Add a new sentinel error (watch.ErrForeignDaemonPID) and update watch.Stop to clear a stale PID file without killing when ownership can’t be confirmed.
• Implement Windows processCommandLine via PowerShell/CIM and add platform-specific terminateDaemon implementations (gated kill on Windows; SIGTERM on Unix).
• Update the CLI watch stop output and add a command-layer test for the “foreign/stale PID” branch.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
watch/state.go	Introduces ErrForeignDaemonPID and routes stop through terminateDaemon, clearing stale PID files safely.
watch/process_windows.go	Implements CIM-based command-line lookup and Windows-specific gated termination logic.
watch/process_unix.go	Adds Unix terminateDaemon wrapper to preserve historical SIGTERM behavior behind a shared API.
main.go	Prints a user-friendly message when a stale/foreign PID is detected and cleared.
main_more_test.go	Adds a regression test ensuring the CLI reports the stale-PID branch correctly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JordanCoin]

Thanks @copilot — both addressed in the latest commit:

1. TOCTOU: terminateDaemon now classifies ownership against proc.Pid (the exact process it's about to kill) instead of re-reading watch.pid, so a concurrent start/stop can't cause it to validate one PID and kill another.
2. Wording / refuse-when-uncertain: ownership is now three-state (owned / foreign / unknown). ErrForeignDaemonPID is only returned when the command line was read and genuinely didn't match (and Stop clears the stale pid file then). When the command line can't be read, it returns the new ErrDaemonOwnershipUnknown and keeps the pid file — so a real daemon is never orphaned and no unrelated process is killed.

[Copilot]

Thanks @copilot — both addressed in the latest commit:

1. TOCTOU: terminateDaemon now classifies ownership against proc.Pid (the exact process it's about to kill) instead of re-reading `wat...

Confirmed — the implementation in cc89963 correctly addresses both issues:

1. TOCTOU: terminateDaemon calls daemonOwnershipForPID(root, proc.Pid) directly, so it validates the exact PID it's about to kill regardless of any concurrent watch.pid rewrite.
2. Three-state ownership: ownershipOwned → Kill; ownershipForeign (command line read, didn't match) → ErrForeignDaemonPID + pid file cleared; ownershipUnknown (command line unavailable) → ErrDaemonOwnershipUnknown + pid file kept so a real daemon is never orphaned.

All Unix tests pass; GOOS=windows go build is clean.