Fix Windows WinError 2 by resolving git robustly, plus analysis fixes

The packaged Windows .exe invoked a bare "git" and died with
"[WinError 2] The system cannot find the file specified" on machines
without Git on PATH. New api/git_exe.py resolves git through
HACKDEEPWIKI_GIT -> managed MinGit -> PATH -> common Windows install
dirs, and on Windows provisions a SHA-256-verified portable MinGit
(pinned in build/components.json) into the data root on first use.
All git subprocess call sites (data_pipeline, memory/evolution,
code_agent) now go through it, and the opencode child env gets the
managed git on PATH.

Also applies the full-project analysis findings:
- engraphis_integration: missing `import re` made _strip_markdown raise
  NameError, silently skipping every wiki-content ingest into memory.
- anthropic_client: the error generator closed over the unbound except
  variable `e`, yielding NameError instead of the API error message.
- bedrock_client: get_event_loop() -> get_running_loop().
- docker_tools: semgrep CWE ids were computed but never surfaced; now
  appended to the finding description.
- ruff cleanup across api/ (unused imports, import order, dead locals,
  ambiguous `l` names, semicolon statements).
- i18n: all 9 non-English locales completed against en.json (14-44
  missing keys each) with a vitest key-sync test to keep them complete.

Author: kroryan

api/agent_loop.py

@@ -26,8 +26,8 @@
 from typing import Any, AsyncIterator, Awaitable, Callable, Optional
 
 from api.anthropic_client import AnthropicClient
-from api.openai_client import OpenAIClient
 from api.litellm_client import LiteLLMClient
+from api.openai_client import OpenAIClient
 from api.provider_streaming import stream_provider_response
 from api.search_tool import ToolHandler, native_tool_name_to_prefix
 from api.stream_events import SendProcess, ThinkingSink, encode_process

api/anthropic_client.py

@@ -12,14 +12,13 @@
   Anthropic requires for OAuth-authenticated requests.
 """
 
-from typing import Any, AsyncIterator, Dict
 import json
 import logging
 import os
+from typing import Any, AsyncIterator, Dict
 
 import aiohttp
 import requests
-
 from adalflow.core.model_client import ModelClient
 from adalflow.core.types import ModelType
 
@@ -284,9 +283,12 @@ async def error_response_generator():
                     data = await response.json()
         except Exception as e:
             log.error(f"Error calling Anthropic API: {str(e)}")
+            # Bind the message now: Python unbinds `e` when the except block
+            # ends, and the generator runs after that (NameError otherwise).
+            error_message = f"Error calling Anthropic API: {str(e)}"
 
             async def exception_generator():
-                yield f"Error calling Anthropic API: {str(e)}"
+                yield error_message
             return exception_generator()
 
         text = self._extract_text(data)

api/azureai_client.py

@@ -1,27 +1,26 @@
 """AzureOpenAI ModelClient integration."""
 
+import logging
 import os
+import re
+import sys
 from typing import (
-    Dict,
-    Sequence,
-    Optional,
-    List,
     Any,
-    TypeVar,
     Callable,
+    Dict,
     Generator,
-    Union,
+    List,
     Literal,
+    Optional,
+    Sequence,
+    TypeVar,
+    Union,
 )
-import re
 
-import logging
 import backoff
 
 # optional import
-from adalflow.utils.lazy_import import safe_import, OptionalPackages
-
-import sys
+from adalflow.utils.lazy_import import OptionalPackages, safe_import
 
 openai = safe_import(OptionalPackages.OPENAI.value[0], OptionalPackages.OPENAI.value[1])
 # Importing all Azure packages together
@@ -35,32 +34,33 @@
     sys.modules[name] = module
 
 # Use the modules as if they were imported normally
+from adalflow.components.model_client.utils import parse_embedding_response
+from adalflow.core.model_client import ModelClient
+from adalflow.core.types import (
+    CompletionUsage,
+    EmbedderOutput,
+    GeneratorOutput,
+    ModelType,
+    TokenLogProb,
+)
 from azure.identity import DefaultAzureCredential, get_bearer_token_provider
 
 # from azure.core.credentials import AccessToken
-from openai import AzureOpenAI, AsyncAzureOpenAI, Stream
 from openai import (
     APITimeoutError,
+    AsyncAzureOpenAI,
+    AzureOpenAI,
+    BadRequestError,
     InternalServerError,
     RateLimitError,
+    Stream,
     UnprocessableEntityError,
-    BadRequestError,
 )
 from openai.types import (
     Completion,
     CreateEmbeddingResponse,
 )
-from openai.types.chat import ChatCompletionChunk, ChatCompletion
-
-from adalflow.core.model_client import ModelClient
-from adalflow.core.types import (
-    ModelType,
-    EmbedderOutput,
-    TokenLogProb,
-    CompletionUsage,
-    GeneratorOutput,
-)
-from adalflow.components.model_client.utils import parse_embedding_response
+from openai.types.chat import ChatCompletion, ChatCompletionChunk
 
 log = logging.getLogger(__name__)
 T = TypeVar("T")

api/bedrock_client.py

@@ -1,17 +1,16 @@
 """AWS Bedrock ModelClient integration."""
 
 import asyncio
-import os
 import json
 import logging
 import threading
+from typing import Any, AsyncGenerator, Dict, List, Optional, Sequence
+
+import backoff
 import boto3
 import botocore
-import backoff
-from typing import Dict, Any, Optional, List, Generator, Union, AsyncGenerator, Sequence
-
 from adalflow.core.model_client import ModelClient
-from adalflow.core.types import ModelType, GeneratorOutput, EmbedderOutput
+from adalflow.core.types import EmbedderOutput, ModelType
 
 # Configure logging
 from api.logging_config import setup_logging
@@ -59,10 +58,10 @@ def __init__(
         super().__init__(*args, **kwargs)
         from api.config import (
             AWS_ACCESS_KEY_ID,
-            AWS_SECRET_ACCESS_KEY,
-            AWS_SESSION_TOKEN,
             AWS_REGION,
             AWS_ROLE_ARN,
+            AWS_SECRET_ACCESS_KEY,
+            AWS_SESSION_TOKEN,
         )
 
         self.aws_access_key_id = aws_access_key_id or AWS_ACCESS_KEY_ID
@@ -512,7 +511,7 @@ async def astream(self, api_kwargs: Dict = None, model_type: ModelType = None) -
                 request_body["topP"] = api_kwargs["top_p"]
 
         body = json.dumps(request_body)
-        loop = asyncio.get_event_loop()
+        loop = asyncio.get_running_loop()
         queue: "asyncio.Queue[Any]" = asyncio.Queue()
         _DONE = object()
 

api/cache_eviction.py

@@ -38,9 +38,9 @@
 from typing import Optional
 
 from api.wiki_cache_paths import (
+    LEGACY_WIKI_CACHE_FILE_PREFIX,
     WIKI_CACHE_DIR,
     WIKI_CACHE_FILE_PREFIX,
-    LEGACY_WIKI_CACHE_FILE_PREFIX,
 )
 
 logger = logging.getLogger(__name__)

api/code_agent/binary.py

@@ -18,8 +18,8 @@
 a killed download never leaves a half-written binary behind.
 """
 
-import logging
 import hashlib
+import logging
 import os
 import platform
 import re
@@ -35,8 +35,8 @@
 from contextlib import contextmanager
 from typing import Awaitable, Callable, Optional
 
-from api.data_root import get_data_root
 from api.component_manifest import component_manifest
+from api.data_root import get_data_root
 
 logger = logging.getLogger(__name__)
 

api/code_agent/config.py

@@ -17,12 +17,13 @@
   * disables sharing and self-update (the app manages the binary).
 """
 
-import json
 import hashlib
 import hmac
+import json
 import logging
 import os
 import secrets
+import shutil
 import sys
 from typing import Optional, Tuple
 
@@ -302,6 +303,16 @@ def build_child_env(config_path: str, extra_env: dict, server_password: str) ->
         env["XDG_CONFIG_HOME"] = os.path.join(home, "config")
         env["XDG_CACHE_HOME"] = os.path.join(home, "cache")
         env["XDG_STATE_HOME"] = os.path.join(home, "state")
+    # opencode shells out to git itself; when git only exists as our managed
+    # portable MinGit (Windows machines without Git installed), the child
+    # needs its cmd/ dir on PATH to find it.
+    try:
+        from api.git_exe import resolve_git
+        resolved = resolve_git()
+        if resolved and not shutil.which("git", path=env.get("PATH")):
+            env["PATH"] = os.path.dirname(resolved) + os.pathsep + env.get("PATH", "")
+    except Exception:  # noqa: BLE001 - a git-less env is still usable for editing
+        pass
     return env
 
 

api/code_agent/context.py

@@ -57,7 +57,7 @@ def _maybe_backfill_wiki_commit(cached, owner: str, repo: str, repo_type: str,
         return None
     try:
         import json
-        import os
+
         from api.wiki_cache_paths import list_cache_files
 
         files = list_cache_files(repo_type, owner, repo, language)

api/code_agent/manager.py

@@ -39,6 +39,17 @@
 
 logger = logging.getLogger(__name__)
 
+
+def _git() -> str:
+    """Resolved git binary; falls back to bare "git" so these best-effort
+    helpers keep their None-on-failure contract instead of raising."""
+    try:
+        from api.git_exe import git_executable
+        return git_executable()
+    except Exception:
+        return "git"
+
+
 IDLE_SHUTDOWN_SECONDS = 30 * 60
 HEALTH_TIMEOUT_SECONDS = 30
 # Kept small: only used for error surfacing when the process dies.
@@ -119,7 +130,7 @@ def repo_head_commit(repo_dir: str) -> Optional[str]:
     """HEAD commit of a clone, or None for non-git dirs / errors."""
     try:
         out = subprocess.run(
-            ["git", "rev-parse", "HEAD"],
+            [_git(), "rev-parse", "HEAD"],
             cwd=repo_dir, capture_output=True, text=True, timeout=10,
         )
         if out.returncode == 0:
@@ -138,13 +149,13 @@ def repo_worktree_fingerprint(repo_dir: str) -> Optional[str]:
     """
     try:
         head = subprocess.run(
-            ["git", "rev-parse", "HEAD"],
+            [_git(), "rev-parse", "HEAD"],
             cwd=repo_dir,
             capture_output=True,
             timeout=10,
         )
         status = subprocess.run(
-            ["git", "status", "--porcelain=v1", "-z", "--untracked-files=all"],
+            [_git(), "status", "--porcelain=v1", "-z", "--untracked-files=all"],
             cwd=repo_dir,
             capture_output=True,
             timeout=20,
@@ -162,14 +173,14 @@ def _maybe_unshallow(repo_dir: str) -> None:
     just leave the clone shallow (editing still works)."""
     try:
         probe = subprocess.run(
-            ["git", "rev-parse", "--is-shallow-repository"],
+            [_git(), "rev-parse", "--is-shallow-repository"],
             cwd=repo_dir, capture_output=True, text=True, timeout=10,
         )
         if probe.returncode != 0 or probe.stdout.strip() != "true":
             return
         logger.info("Unshallowing clone at %s for code editing...", repo_dir)
         subprocess.run(
-            ["git", "fetch", "--unshallow", "--tags"],
+            [_git(), "fetch", "--unshallow", "--tags"],
             cwd=repo_dir, capture_output=True, text=True, timeout=120,
         )
     except (subprocess.TimeoutExpired, OSError) as e:

api/code_agent/routes.py

@@ -36,29 +36,29 @@
     WebSocketDisconnect,
 )
 
+from api.chat_common import capture_chat_exchange
 from api.code_agent import events as oc_events
 from api.code_agent.binary import (
     OPENCODE_VERSION,
     download_opencode,
     installed_opencode_version,
     resolve_opencode_binary,
 )
+from api.code_agent.config import describe_target, map_provider
 from api.code_agent.context import build_code_session_context
 from api.code_agent.manager import (
     CodeAgentError,
     repo_key_for,
     repo_worktree_fingerprint,
 )
-from api.code_agent.service import code_agent as manager
 from api.code_agent.models import (
     CodeAbortRequest,
     CodeAgentUpdateRequest,
     CodeChatRequest,
     CodeSessionRequest,
     CodeSessionResponse,
 )
-from api.code_agent.config import describe_target, map_provider
-from api.chat_common import capture_chat_exchange
+from api.code_agent.service import code_agent as manager
 from api.security import (
     authorization_is_valid,
     authorize_websocket,