fix: remove Git CLI dependency and hide Windows command windows

scripts/core-boundaries/rules/feature-rules.mjs

@@ -75,7 +75,7 @@ export const optionalDependencyFeatureOwnerRules = [
       { depName: 'bitfun-runtime-ports', ownerFeatures: ['remote-connect', 'remote-ssh', 'remote-ssh-concrete', 'script-tool-runtime'] },
       {
         depName: 'bitfun-services-core',
-        ownerFeatures: ['browser-control', 'git', 'mcp', 'miniapp-runtime', 'process-tree', 'remote-connect', 'review-platform', 'workspace-search'],
+        ownerFeatures: ['browser-control', 'git', 'mcp', 'miniapp-runtime', 'process-tree', 'remote-connect', 'remote-ssh-concrete', 'review-platform', 'workspace-search'],
       },
       { depName: 'bzip2', ownerFeatures: ['speech'] },
       { depName: 'chrono', ownerFeatures: ['debug-log', 'git', 'remote-connect', 'remote-ssh-concrete', 'review-platform', 'speech'] },

src/apps/desktop/resources/worker_host.js

@@ -133,7 +133,11 @@ async function dispatch(method, params) {
       if (allow.length > 0 && !allow.some((a) => a.toLowerCase() === base.toLowerCase())) {
         throw new Error('Command not in allowlist');
       }
-      const opts = { cwd: params.cwd || appDir, timeout: params.timeout || 30000 };
+      const opts = {
+        cwd: params.cwd || appDir,
+        timeout: params.timeout || 30000,
+        windowsHide: process.platform === 'win32'
+      };
       const { stdout, stderr } = await execAsync(params.command || '', opts);
       return { stdout, stderr, exit_code: 0 };
     }

src/crates/assembly/core/src/agentic/memories/workspace.rs

@@ -340,9 +340,6 @@ fn map_memory_workspace_git_error(
         MemoryWorkspaceGitError::Join { source } => {
             BitFunError::service(format!("{join_context}: {source}"))
         }
-        error @ MemoryWorkspaceGitError::UnsupportedGitStatus { .. } => {
-            BitFunError::service(error.to_string())
-        }
         error => BitFunError::io(error.to_string()),
     }
 }

src/crates/execution/agent-runtime/src/native_hooks/engine.rs

@@ -181,6 +181,13 @@ async fn run_hook_command(
     if let Some(cwd) = existing_dir(cwd) {
         process.current_dir(cwd);
     }
+    #[cfg(windows)]
+    {
+        use std::os::windows::process::CommandExt;
+
+        const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+        process.as_std_mut().creation_flags(CREATE_NO_WINDOW);
+    }
     process
         .stdin(Stdio::piped())
         .stdout(Stdio::piped())

src/crates/services/services-core/Cargo.toml

@@ -21,6 +21,7 @@ serde_json = { workspace = true }
 serde_yaml = { workspace = true, optional = true }
 base64 = { workspace = true }
 chrono = { workspace = true }
+git2 = { workspace = true }
 dunce = { workspace = true, optional = true }
 zip = { workspace = true, optional = true }
 thiserror = { workspace = true }
@@ -43,6 +44,10 @@ windows = { workspace = true, features = [
     "Win32_System_Threading",
 ] }
 
+# Keep libgit2 self-contained on Unix, matching the product assembly dependency.
+[target.'cfg(not(windows))'.dependencies]
+git2 = { workspace = true, features = ["vendored-openssl"] }
+
 [target.'cfg(unix)'.dependencies]
 libc = { workspace = true }