From d24be9fed427cd05d4655ddfd84523ea4c412898 Mon Sep 17 00:00:00 2001
From: HelpMe <marvin@highcard.dev>
Date: Tue, 14 Jul 2026 00:50:53 +0200
Subject: [PATCH 1/2] Fix WSL worker callback routing

---
 Makefile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 488287a..c39dec9 100644
--- a/Makefile
+++ b/Makefile
@@ -9,7 +9,9 @@ KIND_VERSION ?= v0.27.0
 GO_BIN ?= $(shell go env GOPATH)/bin
 DRUID_K8S_NAMESPACE ?= druid
 DRUID_WORKER_CALLBACK_LISTEN ?= 0.0.0.0:8083
-DRUID_WORKER_CALLBACK_URL ?= http://host.k3d.internal:8083
+DRUID_IS_WSL ?= $(shell if grep -qi microsoft /proc/sys/kernel/osrelease 2>/dev/null; then printf 1; fi)
+DRUID_HOST_SERVICES_IP ?= $(if $(DRUID_IS_WSL),$(shell ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.* src \([^ ]*\).*/\1/p' | head -n 1),)
+DRUID_WORKER_CALLBACK_URL ?= $(if $(DRUID_IS_WSL),$(if $(strip $(DRUID_HOST_SERVICES_IP)),http://$(strip $(DRUID_HOST_SERVICES_IP)):8083,$(error Unable to determine the WSL callback address; set DRUID_WORKER_CALLBACK_URL explicitly)),http://host.k3d.internal:8083)
 DRUID_WATCH_ARGS ?= daemon --runtime kubernetes --listen 127.0.0.1:8081 --public-listen 127.0.0.1:8082 --worker-callback-listen $(DRUID_WORKER_CALLBACK_LISTEN) --worker-callback-url $(DRUID_WORKER_CALLBACK_URL) --unsafe-allow-unauthenticated-management --unsafe-allow-unauthenticated-public --k8s-namespace $(DRUID_K8S_NAMESPACE) --k8s-pull-image $(DRUID_K8S_PULL_IMAGE)
 
 generate-api: ## Generate API types from OpenAPI spec

From 3fe5022bce45bdd137a17024b486afa77f1411b1 Mon Sep 17 00:00:00 2001
From: HelpMe <marvin@highcard.dev>
Date: Fri, 17 Jul 2026 01:53:23 +0200
Subject: [PATCH 2/2] Separate Windows daemon startup

---
 .github/workflows/pr.yml |  1 +
 AGENTS.md                | 28 ++++++++++++++++++++++++++++
 Makefile                 |  9 +++++----
 scripts/watch-windows.sh | 26 ++++++++++++++++++++++++++
 4 files changed, 60 insertions(+), 4 deletions(-)
 create mode 100644 AGENTS.md
 create mode 100755 scripts/watch-windows.sh

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index d6e62af..9dd13c0 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -53,6 +53,7 @@ jobs:
             .docker/druid-install-command.sh
 
   prerelease:
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     needs: [unit-tests, integration-tests, validate-api, build]
     outputs:
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..28fca3b
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,28 @@
+# Druid CLI Agent Guide
+
+## Local daemon command selection
+
+Keep the normal Linux and macOS development path on the existing command:
+
+```bash
+make watch
+```
+
+That command uses `http://host.k3d.internal:8083` for Kubernetes worker
+callbacks and must remain free of Windows or WSL auto-detection.
+
+When Docker Desktop runs on Windows and the repository is executed inside
+WSL2, use the explicit Windows command instead:
+
+```bash
+make watch-windows
+```
+
+The Windows command derives the current WSL source address and passes its
+callback URL to the unchanged `make watch` implementation. Set
+`DRUID_HOST_SERVICES_IP` to override address discovery, or set
+`DRUID_WORKER_CALLBACK_URL` to override the complete callback URL.
+
+Do not use `make watch-windows` on native Linux or macOS. Keep future
+platform-specific setup additive instead of adding OS detection to `make
+watch`.
diff --git a/Makefile b/Makefile
index c39dec9..e1339db 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: test build k3d-build-pull-image watch test-integration test-integration-docker test-integration-kubernetes kind-integration-up kind-integration-down
+.PHONY: test build k3d-build-pull-image watch watch-windows test-integration test-integration-docker test-integration-kubernetes kind-integration-up kind-integration-down
 
 VERSION ?= "dev"
 DRUID_K8S_PULL_IMAGE ?= druid:local
@@ -9,9 +9,7 @@ KIND_VERSION ?= v0.27.0
 GO_BIN ?= $(shell go env GOPATH)/bin
 DRUID_K8S_NAMESPACE ?= druid
 DRUID_WORKER_CALLBACK_LISTEN ?= 0.0.0.0:8083
-DRUID_IS_WSL ?= $(shell if grep -qi microsoft /proc/sys/kernel/osrelease 2>/dev/null; then printf 1; fi)
-DRUID_HOST_SERVICES_IP ?= $(if $(DRUID_IS_WSL),$(shell ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.* src \([^ ]*\).*/\1/p' | head -n 1),)
-DRUID_WORKER_CALLBACK_URL ?= $(if $(DRUID_IS_WSL),$(if $(strip $(DRUID_HOST_SERVICES_IP)),http://$(strip $(DRUID_HOST_SERVICES_IP)):8083,$(error Unable to determine the WSL callback address; set DRUID_WORKER_CALLBACK_URL explicitly)),http://host.k3d.internal:8083)
+DRUID_WORKER_CALLBACK_URL ?= http://host.k3d.internal:8083
 DRUID_WATCH_ARGS ?= daemon --runtime kubernetes --listen 127.0.0.1:8081 --public-listen 127.0.0.1:8082 --worker-callback-listen $(DRUID_WORKER_CALLBACK_LISTEN) --worker-callback-url $(DRUID_WORKER_CALLBACK_URL) --unsafe-allow-unauthenticated-management --unsafe-allow-unauthenticated-public --k8s-namespace $(DRUID_K8S_NAMESPACE) --k8s-pull-image $(DRUID_K8S_PULL_IMAGE)
 
 generate-api: ## Generate API types from OpenAPI spec
@@ -57,6 +55,9 @@ watch: ## Run Daemon with auto reload
 	@command -v air >/dev/null 2>&1 || go install github.com/air-verse/air@latest
 	air --build.cmd "CGO_ENABLED=0 go build -ldflags '-X github.com/highcard-dev/daemon/internal.Version=$(VERSION)' -o ./bin/druid ./apps/druid" --build.full_bin "DRUID_REGISTRY_PLAIN_HTTP=true ./bin/druid $(DRUID_WATCH_ARGS)"
 
+watch-windows: ## Run Daemon with auto reload on Windows through WSL
+	./scripts/watch-windows.sh
+
 mock:
 	mockgen -source=internal/core/ports/services_ports.go -destination test/mock/services.go
 
diff --git a/scripts/watch-windows.sh b/scripts/watch-windows.sh
new file mode 100755
index 0000000..0d2b6dd
--- /dev/null
+++ b/scripts/watch-windows.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+callback_url="${DRUID_WORKER_CALLBACK_URL:-}"
+
+if [[ -z "$callback_url" ]]; then
+    host_services_ip="${DRUID_HOST_SERVICES_IP:-}"
+    if [[ -z "$host_services_ip" ]]; then
+        host_services_ip="$({
+            ip -4 route get 1.1.1.1 2>/dev/null \
+                | sed -n 's/.* src \([^ ]*\).*/\1/p' \
+                | head -n 1
+        } || true)"
+    fi
+
+    if [[ -z "$host_services_ip" ]]; then
+        echo "Unable to determine the WSL callback address; set DRUID_WORKER_CALLBACK_URL explicitly." >&2
+        exit 1
+    fi
+
+    callback_url="http://${host_services_ip}:8083"
+fi
+
+exec make -C "$ROOT" watch DRUID_WORKER_CALLBACK_URL="$callback_url"