fix(ci): use sha256sum on Windows and improve A2UI path resolution

scripts/bundle-a2ui.sh

@@ -23,10 +23,20 @@ collect_files() {
 }
 
 compute_hash() {
+  # Use sha256sum on Linux/Windows (Git Bash), shasum on macOS
+  local sha_cmd
+  if command -v sha256sum &>/dev/null; then
+    sha_cmd="sha256sum"
+  elif command -v shasum &>/dev/null; then
+    sha_cmd="shasum -a 256"
+  else
+    echo "No sha256 tool found (sha256sum or shasum)" >&2
+    exit 1
+  fi
   collect_files \
     | LC_ALL=C sort -z \
-    | xargs -0 shasum -a 256 \
-    | shasum -a 256 \
+    | xargs -0 $sha_cmd \
+    | $sha_cmd \
     | awk '{print $1}'
 }
 

src/canvas-host/a2ui.ts

@@ -18,6 +18,25 @@ export function resetA2uiCache(): void {
   resolvingA2uiRoot = null;
 }
 
+async function findRepoRoot(startDir: string): Promise<string | null> {
+  let dir = startDir;
+  for (let i = 0; i < 10; i++) {
+    try {
+      const pkgPath = path.join(dir, "package.json");
+      await fs.stat(pkgPath);
+      // Verify it's the clawdbot package
+      const pkg = JSON.parse(await fs.readFile(pkgPath, "utf8"));
+      if (pkg.name === "clawdbot") return dir;
+    } catch {
+      // not found, go up
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
 async function resolveA2uiRoot(): Promise<string | null> {
   const here = path.dirname(fileURLToPath(import.meta.url));
   const candidates = [
@@ -32,6 +51,12 @@ async function resolveA2uiRoot(): Promise<string | null> {
   if (process.execPath) {
     candidates.unshift(path.resolve(path.dirname(process.execPath), "a2ui"));
   }
+  // Find repo root by walking up from `here` (handles vitest/vite transforms).
+  const repoRoot = await findRepoRoot(here);
+  if (repoRoot) {
+    candidates.push(path.resolve(repoRoot, "src/canvas-host/a2ui"));
+    candidates.push(path.resolve(repoRoot, "dist/canvas-host/a2ui"));
+  }
 
   for (const dir of candidates) {
     try {