@agentshouse/kit 0.1.0-alpha.35 → 0.1.0-alpha.36

package/README.md

@@ -12,7 +12,7 @@ The Skill set Kit installs is Matt Pocock's
 On Linux `amd64` or `arm64`, run the published, versioned bootstrap once:
 
 ```sh
-bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.35/connect-linux.sh)
+bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.36/connect-linux.sh)
 ```
 
 The bootstrap first establishes Docker Engine from what it observes on the
@@ -80,12 +80,12 @@ outcome.
 
 The versioned `bootstrap.json` is the machine-readable command source for this
 release. It is exported from the npm package as `@agentshouse/kit/bootstrap`
-(JSON import) and published byte-for-byte beside `connect-linux.sh` in the
-GitHub release. Its schema version is `1`, its `version` is the Kit package
+(JSON import) and published byte-for-byte beside `connect-linux.sh` and `connect-windows.ps1`
+in the GitHub release. Its schema version is `1`, its `version` is the Kit package
 version, and `hosts` contains only bootstrap scripts published in that release.
 The package exports only the `./bootstrap` subpath; `./package.json` and source
-subpaths are not exported. For this release, only `hosts.linux` exists. In this
-schema example, `<version>` stands for the package's version:
+subpaths are not exported. For this release, `hosts.linux` and `hosts.windows`
+exist. In this schema example, `<version>` stands for the package's version:
 
 ```json
 {
@@ -99,6 +99,14 @@ schema example, `<version>` stands for the package's version:
         "url": "https://github.com/agentshouse/kit/releases/download/v<version>/connect-linux.sh"
       },
       "workspace": { "argument": "--workspace", "quoting": "posix" }
+    },
+    "windows": {
+      "command": "& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v<version>/connect-windows.ps1)))",
+      "asset": {
+        "name": "connect-windows.ps1",
+        "url": "https://github.com/agentshouse/kit/releases/download/v<version>/connect-windows.ps1"
+      },
+      "workspace": { "argument": "--workspace", "quoting": "powershell" }
     }
   }
 }
@@ -107,10 +115,13 @@ schema example, `<version>` stands for the package's version:
 `command` is complete for the default workspace. To show a selected absolute
 workspace, append the declared `workspace.argument` and the path as one POSIX
 shell-quoted argument. For example, `/home/user/My Agents' House` becomes
-`--workspace '/home/user/My Agents'\'' House'`. Quote the entire path before
+`--workspace '/home/user/My Agents'\'' House'`. A `powershell` workspace is one
+single-quoted PowerShell string with each `'` doubled: `C:\Users\Alice\Alice's Room`
+becomes `--workspace 'C:\Users\Alice\Alice''s Room'`. Quote the entire path before
 adding it to a copyable shell command; never interpolate it as shell syntax.
-The bootstrap validates an absolute workspace root and encodes it as one Docker
+`connect-linux.sh` validates an absolute workspace root and encodes it as one Docker
 `--mount` CSV source field, including commas and double quotes in the name.
+`connect-windows.ps1` refuses a workspace root containing a comma.
 The package manifest contains no image digest: the release workflow
 fills the immutable image digest into the published script after the package
 has been built.
@@ -154,7 +165,9 @@ On a Mac with Apple silicon or an Intel chip, run the same
 correctly even from a terminal running under Rosetta.
 
 The bootstrap first establishes Docker Desktop from what it observes. A Docker
-Desktop that already answers is used as it is. Without
+Desktop that already answers is used as it is. Another Docker engine that
+answers, such as Colima's or OrbStack's, is refused before Kit home exists,
+because `docker info` does not report it as Docker Desktop. Without
 `/Applications/Docker.app` it follows Docker's
 [command-line installation](https://docs.docker.com/desktop/setup/install/mac-install/):
 it downloads `Docker.dmg` for the chip from `desktop.docker.com`, attaches it
@@ -176,6 +189,67 @@ browser, and no Kit container uses the host network. A loopback House needs
 Docker Desktop's host networking enabled. A `--workspace` root must be a
 directory Docker Desktop shares, such as one under `/Users`.
 
+## Connect a Windows computer
+
+On Windows 11 `amd64`, run the published, versioned bootstrap once in
+PowerShell:
+
+```powershell
+& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.36/connect-windows.ps1)))
+```
+
+It runs in the Windows PowerShell 5.1 that Windows ships and needs no change to
+its execution policy. It reads the edition, build and processor from Windows
+itself and refuses Windows Server, Windows 10, a Windows 11 build older than
+23H2 (build 22631), which [Docker Desktop requires](https://docs.docker.com/desktop/setup/install/windows-install/),
+and Windows on ARM, each with its cause. There is no native Windows Kit and no
+Windows container.
+
+The bootstrap then establishes Docker Desktop and its WSL 2 engine from what it
+observes. A Docker Desktop that already answers with Linux containers on its
+WSL 2 engine is used as it is. Otherwise, when `wsl --version` does not answer,
+it runs Microsoft's [`wsl --install --no-distribution`](https://learn.microsoft.com/windows/wsl/basic-commands#install),
+which asks you to approve administrator rights in the ordinary Windows prompt,
+and stops until you restart Windows; a WSL older than the 2.1.5 Docker Desktop
+requires is brought up to date with `wsl --update` the same way. Without
+Docker Desktop in `%ProgramFiles%\Docker\Docker` or
+`%LOCALAPPDATA%\Programs\DockerDesktop`, it downloads Docker Desktop's
+installer from `desktop.docker.com` and runs its
+[per-user installation](https://docs.docker.com/desktop/setup/install/windows-install/#install-from-the-command-line),
+`install --user --quiet`, which needs no administrator rights and does not
+accept Docker's Subscription Service Agreement for you. It starts Docker
+Desktop, including one a restart left stopped, and waits up to five minutes for
+it to answer while you accept its terms or finish what its window asks.
+Declined administrator rights, a pending restart, a failed download or
+installer, or a Docker Desktop that is still not ready each stop the bootstrap
+with their cause and change nothing further; running the same command again
+continues from that state. Docker Desktop's Windows containers, another Docker
+engine or Docker Desktop's Hyper-V engine are refused.
+
+Everything after that is [the Linux journey](#connect-a-linux-computer):
+the same immutable `linux/amd64` image, owner-only `%USERPROFILE%\.house-kit`
+and `%USERPROFILE%\AgentsHouse` or one `--workspace` root such as
+`--workspace 'D:\Agents'`, mounted as the Kit home and `/agents/house`,
+identity reuse, `unless-stopped`, and House Login in the host browser. As on a
+Mac, login's container publishes one callback port on `127.0.0.1` for an HTTPS
+House, and a loopback House needs Docker Desktop's host networking. Kit home and
+the workspace are restricted to your Windows account alone. A path with a comma
+is refused, because this bootstrap cannot pass one to a Docker mount from
+Windows PowerShell. The containers run as the image's own user, since Windows
+has no Linux user id to map. Run it from the 64-bit Windows PowerShell; from an
+administrator PowerShell it still makes your own account the owner of both
+directories. Append `kit` and a command, or run `house git push … --owner`
+from beneath the workspace, to forward it as on Linux, with each argument
+passed unchanged; with the output redirected, a hidden prompt still echoes
+what you type, so leave the output on the terminal when a command asks for a
+token. Each run and forwarded command leaves its exit status in
+`$LASTEXITCODE` and never closes the PowerShell window.
+
+This recipe is authored from Microsoft's and Docker's documentation and checked
+off Windows: the Windows PowerShell 5.1 syntax check and the release packaging
+tests in this repository. No Windows computer has run it yet;
+the one real Windows 11 installation is owed at the final MVP candidate.
+
 ## Building the package
 
 The repository checkout is the development source. Build the package that can

package/bin/connect-linux.sh

@@ -228,6 +228,8 @@ esac
 [[ "$WORKSPACE" == /* ]] || refuse 'workspace root must be an absolute path'
 if [[ "$RUNTIME" == 'Docker Desktop' ]]; then
   establish_docker_desktop "$CHIP"
+  DOCKER_SYSTEM=$(docker info --format '{{.OperatingSystem}}' 2>/dev/null) || refuse "Docker Desktop does not answer: $(docker_cause)"
+  [[ "$DOCKER_SYSTEM" == 'Docker Desktop' ]] || refuse "Docker answers from $DOCKER_SYSTEM, not Docker Desktop; stop that engine or switch Docker to Docker Desktop, then rerun this bootstrap"
 else
   establish_docker_engine
 fi

package/bin/connect-windows.ps1

@@ -0,0 +1,430 @@
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+
+$Image = 'ghcr.io/agentshouse/kit@sha256:__IMAGE_DIGEST__'
+$Name = 'house-kit'
+$BootstrapArguments = @($args | ForEach-Object { [string]$_ })
+$MinimumBuild = 22631
+$MinimumWsl = [version]'2.1.5'
+$DesktopInstaller = 'https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe'
+$DesktopWaitSeconds = 300
+
+function Stop-Bootstrap([string] $Cause) {
+  throw "kit_bootstrap_refused: $Cause"
+}
+
+function Exit-Bootstrap([int] $Status) {
+  throw "kit_bootstrap_exit: $Status"
+}
+
+function Invoke-Native([string] $Command, [string[]] $NativeArguments) {
+  $ErrorActionPreference = 'Continue'
+  $output = @(& $Command @NativeArguments 2>&1 | ForEach-Object { "$_" })
+  [pscustomobject]@{ Status = $LASTEXITCODE; Output = $output }
+}
+
+function ConvertTo-NativeArgument([string] $Value) {
+  if ((Get-Variable -Name PSNativeCommandArgumentPassing -ValueOnly -ErrorAction SilentlyContinue) -in @('Windows', 'Standard')) { return $Value }
+  if ($Value -eq '') { return '""' }
+  $escaped = $Value -replace '(\\*)"', '$1$1\"'
+  if ($PSVersionTable.PSEdition -eq 'Desktop' -and $Value -match '\s') { $escaped = $escaped -replace '(\\+)$', '$1$1' }
+  $escaped
+}
+
+function Invoke-Docker {
+  & docker @args
+  if ($LASTEXITCODE -ne 0) { Exit-Bootstrap $LASTEXITCODE }
+}
+
+function Read-Docker {
+  $read = [pscustomobject]@{ Answers = $false; Platform = ''; System = ''; Kernel = ''; Cause = 'the docker command is not installed' }
+  if (-not (Get-Command docker -CommandType Application -ErrorAction SilentlyContinue)) { return $read }
+  $result = Invoke-Native docker @('info', '--format', '{{.OSType}}/{{.Architecture}}|{{.OperatingSystem}}|{{.KernelVersion}}')
+  $line = @($result.Output | Where-Object { $_ -match '^[a-z]+/[a-z0-9_]+\|' })
+  if ($result.Status -ne 0 -or $line.Count -eq 0) {
+    $read.Cause = @($result.Output | Where-Object { $_ })[-1]
+    return $read
+  }
+  $fields = $line[0].Split('|')
+  $read.Answers = $true
+  $read.Platform = $fields[0]
+  $read.System = $fields[1]
+  $read.Kernel = $fields[2]
+  $read
+}
+
+function Invoke-Elevated([string] $FilePath, [string[]] $ElevatedArguments, [string] $Failure, [int[]] $Accepted = @(0)) {
+  try {
+    $process = Start-Process -FilePath $FilePath -ArgumentList $ElevatedArguments -Verb RunAs -Wait -PassThru
+  } catch {
+    Stop-Bootstrap "$Failure; Windows did not grant administrator rights: $($_.Exception.Message); rerun this bootstrap and approve the prompt"
+  }
+  if ($Accepted -notcontains $process.ExitCode) {
+    Stop-Bootstrap "$Failure (exit $($process.ExitCode)); rerun this bootstrap"
+  }
+}
+
+function Get-WslVersion {
+  if (-not (Get-Command wsl.exe -CommandType Application -ErrorAction SilentlyContinue)) { return $null }
+  $result = Invoke-Native wsl.exe @('--version')
+  if ($result.Status -ne 0) { return $null }
+  if ((($result.Output -join "`n") -replace "`0", '') -match '(\d+)\.(\d+)\.(\d+)') {
+    return [version]"$($Matches[1]).$($Matches[2]).$($Matches[3])"
+  }
+  $null
+}
+
+function Initialize-Wsl {
+  $version = Get-WslVersion
+  if ($null -eq $version) {
+    Write-Host 'Installing WSL through wsl --install --no-distribution; Windows asks you to approve administrator rights.'
+    Invoke-Elevated 'wsl.exe' @('--install', '--no-distribution') 'WSL could not be installed' @(0, 3010)
+    Stop-Bootstrap 'WSL is installed and needs a Windows restart; restart Windows, then rerun this bootstrap'
+  }
+  if ($version -lt $MinimumWsl) {
+    Write-Host "Updating WSL $version through wsl --update; Windows asks you to approve administrator rights."
+    Invoke-Elevated 'wsl.exe' @('--update') 'WSL could not be updated'
+  }
+}
+
+function Find-DockerDesktop {
+  foreach ($location in @((Join-Path $env:ProgramFiles 'Docker\Docker'), (Join-Path $env:LOCALAPPDATA 'Programs\DockerDesktop'))) {
+    if (Test-Path -LiteralPath (Join-Path $location 'Docker Desktop.exe') -PathType Leaf) { return $location }
+  }
+  $null
+}
+
+function Add-DockerPath([string] $Location) {
+  if (-not (Get-Command docker -CommandType Application -ErrorAction SilentlyContinue)) {
+    $env:PATH = "$env:PATH;$(Join-Path $Location 'resources\bin')"
+  }
+}
+
+function Install-DockerDesktop {
+  $download = Join-Path ([IO.Path]::GetTempPath()) ([IO.Path]::GetRandomFileName())
+  [void][IO.Directory]::CreateDirectory($download)
+  try {
+    $installer = Join-Path $download 'Docker Desktop Installer.exe'
+    Write-Host 'Downloading Docker Desktop for Windows from docker.com.'
+    try {
+      Invoke-WebRequest -UseBasicParsing -Uri $DesktopInstaller -OutFile $installer
+    } catch {
+      Stop-Bootstrap "Docker Desktop could not be downloaded: $($_.Exception.Message)"
+    }
+    Write-Host 'Installing Docker Desktop for this Windows account.'
+    try {
+      $process = Start-Process -FilePath $installer -ArgumentList @('install', '--user', '--quiet') -Wait -PassThru
+    } catch {
+      Stop-Bootstrap "the Docker Desktop installer could not be started: $($_.Exception.Message)"
+    }
+    if ($process.ExitCode -ne 0) { Stop-Bootstrap "the Docker Desktop installer did not finish (exit $($process.ExitCode))" }
+  } finally {
+    Remove-Item -LiteralPath $download -Recurse -Force -ErrorAction SilentlyContinue
+  }
+}
+
+function Initialize-DockerDesktop {
+  $location = Find-DockerDesktop
+  if ($location) { Add-DockerPath $location }
+  $docker = Read-Docker
+  if ($docker.Answers) { return $docker }
+  if ($Forwarding) {
+    if (-not $location) { Stop-Bootstrap 'House Kit is not installed; run this bootstrap without arguments first' }
+    Stop-Bootstrap "Docker Desktop does not answer: $($docker.Cause); start Docker Desktop, then rerun this command"
+  }
+  Initialize-Wsl
+  if (-not $location) {
+    Install-DockerDesktop
+    $location = Find-DockerDesktop
+    if (-not $location) { Stop-Bootstrap 'Docker Desktop is not where its installer puts it; rerun this bootstrap' }
+    Add-DockerPath $location
+  }
+  Write-Host 'Starting Docker Desktop; accept its terms or finish its setup if its window asks.'
+  try {
+    Start-Process -FilePath (Join-Path $location 'Docker Desktop.exe')
+  } catch {
+    Stop-Bootstrap "Docker Desktop could not be started: $($_.Exception.Message)"
+  }
+  $waited = 0
+  while (-not ($docker = Read-Docker).Answers) {
+    if ($waited -ge $DesktopWaitSeconds) {
+      Stop-Bootstrap "Docker Desktop is not ready: $($docker.Cause); finish what its window asks, then rerun this bootstrap"
+    }
+    Start-Sleep -Seconds 2
+    $waited += 2
+  }
+  $docker
+}
+
+function Protect-Directory([string] $Path) {
+  if ($Path.Contains(',')) { Stop-Bootstrap "$Path contains a comma, which this bootstrap cannot pass to a Docker mount from Windows PowerShell" }
+  $item = Get-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue
+  if ($item -and ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { Stop-Bootstrap "$Path is a symbolic link" }
+  $created = -not $item
+  if ($created) {
+    try { [void][IO.Directory]::CreateDirectory($Path) } catch { Stop-Bootstrap "$Path could not be created" }
+    $item = Get-Item -LiteralPath $Path -Force
+  }
+  if (-not $item.PSIsContainer) { Stop-Bootstrap "$Path is not a directory" }
+  $owner = (Get-Acl -LiteralPath $Path).GetOwner([Security.Principal.SecurityIdentifier]).Value
+  if (-not $created -and $owner -ne $User.Value) { Stop-Bootstrap "$Path is not owned by this User" }
+  try {
+    $security = New-Object Security.AccessControl.DirectorySecurity
+    if ($owner -ne $User.Value) { $security.SetOwner($User) }
+    $security.SetAccessRuleProtection($true, $false)
+    $security.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($User, 'FullControl', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
+    $item.SetAccessControl($security)
+  } catch {
+    Stop-Bootstrap "$Path could not be owner-protected"
+  }
+  $item.FullName.TrimEnd('\')
+}
+
+function Write-Text([string] $Path, [string] $Text) {
+  [IO.File]::WriteAllText($Path, $Text, (New-Object Text.UTF8Encoding($false)))
+}
+
+function Read-Inspect([string] $Format) {
+  $value = & docker inspect --format $Format $Name
+  if ($LASTEXITCODE -ne 0) { Exit-Bootstrap $LASTEXITCODE }
+  "$value"
+}
+
+function Read-Source([string] $Destination) {
+  $source = Read-Inspect ('{{range .Mounts}}{{if eq .Destination `' + $Destination + '`}}{{.Source}}{{end}}{{end}}')
+  if ($source -match '^/run/desktop/mnt/host/([a-z])(/.*)?$') { $source = "$($Matches[1].ToUpper()):$($Matches[2] -replace '/', '\')" }
+  $source
+}
+
+function Test-Container {
+  (Invoke-Native docker @('container', 'inspect', $Name)).Status -eq 0
+}
+
+function Invoke-Login([string[]] $LoginArguments) {
+  if ($LoginArguments -contains '--manual') {
+    Invoke-Docker run -i --rm @Network @Common login @LoginArguments
+    return
+  }
+  & docker run @Published --rm @Network @Common login @LoginArguments --host-browser | ForEach-Object {
+    if ($_ -like 'Open *') {
+      Write-Host 'Opening House Login in the host browser.'
+      try { Start-Process -FilePath $_.Substring(5) } catch { Stop-Bootstrap 'host browser did not open; rerun with --manual' }
+    } else {
+      Write-Host $_
+    }
+  }
+  if ($LASTEXITCODE -ne 0) { Exit-Bootstrap $LASTEXITCODE }
+}
+
+function Start-Resident {
+  $resident = @()
+  if (-not $House.StartsWith('https://')) { $resident = @('--network', 'host') }
+  Invoke-Docker run -d --name $Name --restart unless-stopped @resident --mount $KitHomeMount --mount $WorkspaceMount --label "agentshouse.house=$House" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 $Image resident | Out-Null
+}
+
+function Connect-Kit {
+  $House = 'https://agents.house'
+  $Workspace = $null
+  $Manual = $false
+  $Skills = 'true'
+  $WorkspaceSelected = $false
+  $HouseSelected = $false
+  $Forwarding = $false
+  $Forwarded = 'kit'
+  $Forward = @()
+  $Arguments = $BootstrapArguments
+  if ($Arguments.Count -gt 0 -and ($Arguments[0] -ceq 'kit' -or $Arguments[0] -ceq 'house')) {
+    $Forwarding = $true
+    $Forwarded = $Arguments[0]
+    $Forward = @($Arguments | Select-Object -Skip 1 | ForEach-Object { ConvertTo-NativeArgument $_ })
+    $Arguments = @()
+  }
+  for ($index = 0; $index -lt $Arguments.Count; $index++) {
+    $argument = $Arguments[$index]
+    if ($argument -ceq '--workspace' -or $argument -ceq '--house') {
+      if ($index + 1 -ge $Arguments.Count) { Stop-Bootstrap "$argument requires one value" }
+      $index++
+      if ($argument -ceq '--workspace') {
+        if ($WorkspaceSelected) { Stop-Bootstrap 'supply exactly one workspace root' }
+        $Workspace = $Arguments[$index]
+        $WorkspaceSelected = $true
+      } else {
+        if ($HouseSelected) { Stop-Bootstrap 'supply exactly one House origin' }
+        $House = $Arguments[$index]
+        $HouseSelected = $true
+      }
+    } elseif ($argument -ceq '--manual') {
+      $Manual = $true
+    } elseif ($argument -ceq '--no-skills') {
+      $Skills = 'false'
+    } else {
+      Stop-Bootstrap "unknown argument $argument"
+    }
+  }
+
+  if ($Image -notmatch '^ghcr\.io/agentshouse/kit@sha256:[0-9a-f]{64}$') { Stop-Bootstrap 'this bootstrap has not been published with an immutable image digest' }
+  if ($env:OS -ne 'Windows_NT') { Stop-Bootstrap 'this bootstrap is for Windows 11; run connect-linux.sh on Linux and macOS' }
+  if (-not [Environment]::Is64BitProcess) { Stop-Bootstrap 'this is a 32-bit PowerShell; run this bootstrap from the 64-bit Windows PowerShell' }
+  $system = Get-CimInstance -ClassName Win32_OperatingSystem
+  if ([int]$system.ProductType -ne 1) { Stop-Bootstrap "$($system.Caption) is a Windows Server edition; this bootstrap supports Windows 11 on amd64" }
+  if ([int]$system.BuildNumber -lt 22000) { Stop-Bootstrap "$($system.Caption) is not Windows 11; this bootstrap supports Windows 11 on amd64" }
+  if ([int]$system.BuildNumber -lt $MinimumBuild) { Stop-Bootstrap "Docker Desktop needs Windows 11 23H2 (build $MinimumBuild) or later, not build $($system.BuildNumber); update Windows, then rerun this bootstrap" }
+  $processor = [int]@(Get-CimInstance -ClassName Win32_Processor)[0].Architecture
+  if ($processor -ne 9) {
+    $described = @{ 0 = 'x86'; 5 = 'ARM'; 12 = 'ARM64' }[$processor]
+    if (-not $described) { $described = "architecture $processor" }
+    Stop-Bootstrap "Windows on $described is not supported; this bootstrap supports Windows 11 on amd64"
+  }
+  if ($WorkspaceSelected -and $Workspace -notmatch '^[A-Za-z]:\\') { Stop-Bootstrap 'workspace root must be an absolute path' }
+
+  $docker = Initialize-DockerDesktop
+  if (-not $docker.Platform.StartsWith('linux/')) { Stop-Bootstrap "Docker runs $($docker.Platform.Split('/')[0]) containers; switch Docker Desktop to Linux containers, then rerun this bootstrap" }
+  if ($docker.System -ne 'Docker Desktop') { Stop-Bootstrap "Docker answers from $($docker.System), not Docker Desktop; stop that engine or switch Docker to Docker Desktop, then rerun this bootstrap" }
+  if ($docker.Kernel -notlike '*WSL2*') { Stop-Bootstrap "Docker Desktop does not use its WSL 2 engine; turn on Use the WSL 2 based engine in its settings, then rerun this bootstrap" }
+  if ($docker.Platform -ne 'linux/x86_64' -and $docker.Platform -ne 'linux/amd64') { Stop-Bootstrap "host linux/amd64 does not match Docker Desktop $($docker.Platform)" }
+  if ($Forwarding) {
+    if (-not (Test-Container)) { Stop-Bootstrap 'House Kit is not installed; run this bootstrap without arguments first' }
+    $Workspace = Read-Source '/agents/house'
+    if ($Workspace -notmatch '^[A-Za-z]:\\' -or -not (Test-Path -LiteralPath $Workspace -PathType Container)) {
+      Stop-Bootstrap "the installed Kit's workspace root $Workspace is not a directory on this computer; rerun this bootstrap without arguments"
+    }
+  }
+  if (-not $Workspace) { $Workspace = Join-Path $env:USERPROFILE 'AgentsHouse' }
+
+  $User = [Security.Principal.WindowsIdentity]::GetCurrent().User
+  $kitHome = Protect-Directory (Join-Path $env:USERPROFILE '.house-kit')
+  $Workspace = Protect-Directory $Workspace
+  $KitHomeMount = "type=bind,src=$kitHome,dst=/kit-home"
+  $WorkspaceMount = "type=bind,src=$Workspace,dst=/agents/house"
+  $credential = Join-Path $kitHome 'credential'
+  $environment = Join-Path $kitHome 'environment'
+  $bound = Join-Path $kitHome 'house'
+  $configuration = Join-Path $kitHome 'kit.json'
+  if (((Test-Path -LiteralPath $credential) -or (Test-Path -LiteralPath $environment)) -and -not (Test-Path -LiteralPath $bound)) {
+    Stop-Bootstrap 'stored House origin is missing for an enrolled Environment'
+  }
+  if (Test-Path -LiteralPath $bound) {
+    $boundHouse = @([IO.File]::ReadAllLines($bound))
+    if ($boundHouse.Count -eq 0) { Stop-Bootstrap 'stored House origin is unreadable' }
+    if ($HouseSelected -and $House -cne $boundHouse[0]) { Stop-Bootstrap 'this Environment is bound to another House origin' }
+    $House = $boundHouse[0]
+  }
+  if ($House -notmatch '^(https://|http://127\.0\.0\.1:|http://localhost:)') { Stop-Bootstrap 'House origin must use HTTPS or local loopback HTTP' }
+  if (-not $Forwarding) {
+    try {
+      if (-not (Test-Path -LiteralPath $configuration)) {
+        Write-Text $configuration "{`"availability`":`"intermittent`",`"execution_authority`":`"allow`",`"migrators`":[],`"instances`":[],`"clients`":[],`"host`":null,`"skills`":$Skills}`n"
+      } else {
+        $text = [IO.File]::ReadAllText($configuration)
+        if ($text -match '"skills"\s*:') {
+          $text = $text -replace '("skills"\s*:\s*)(true|false)', "`${1}$Skills"
+        } else {
+          $text = $text -replace '^(\s*)\{', "`${1}{`"skills`":$Skills,"
+        }
+        Write-Text $configuration $text
+      }
+    } catch {
+      Stop-Bootstrap 'kit.json could not be updated'
+    }
+    if ([IO.File]::ReadAllText($configuration) -notmatch "`"skills`"\s*:\s*$Skills") { Stop-Bootstrap 'kit.json could not be updated' }
+  }
+  $Network = @('--network', 'host')
+  $Published = @()
+  if ($House.StartsWith('https://')) {
+    $Network = @()
+    $port = Get-Random -Minimum 49152 -Maximum 65536
+    $Published = @('--publish', "127.0.0.1:${port}:$port", '--env', "HOUSE_KIT_LOGIN_PORT=$port")
+  }
+  $Common = @('--mount', $KitHomeMount, '--mount', $WorkspaceMount, '--env', 'HOME=/kit-home', '--env', 'HOUSE_KIT_HOME=/kit-home', '--env', 'HOUSE_KIT_CONTAINER=1', '--env', "HOUSE_KIT_HOSTNAME=$([Net.Dns]::GetHostName())", $Image)
+
+  if (Test-Container) {
+    $installed = Read-Inspect '{{.Config.Image}}'
+    if ($Forwarding -and $installed -cne $Image) { Stop-Bootstrap 'an installed Kit uses a different image; rerun this bootstrap without arguments to update it' }
+    if ((Read-Inspect '{{.HostConfig.RestartPolicy.Name}}') -cne 'unless-stopped') { Stop-Bootstrap 'the installed Kit has a different lifecycle' }
+    if ((Read-Inspect '{{len .Mounts}}') -cne '2') { Stop-Bootstrap 'the installed Kit has unexpected mounts' }
+    if ((Read-Source '/kit-home') -ine $kitHome) { Stop-Bootstrap 'the installed Kit uses another Kit home' }
+    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/kit-home`}}{{.Type}}/{{.RW}}{{end}}{{end}}') -cne 'bind/true') { Stop-Bootstrap 'the installed Kit home is not a writable bind mount' }
+    if ((Read-Source '/agents/house') -ine $Workspace) { Stop-Bootstrap 'the installed Kit uses another workspace root' }
+    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/agents/house`}}{{.Type}}/{{.RW}}{{end}}{{end}}') -cne 'bind/true') { Stop-Bootstrap 'the installed workspace is not a writable bind mount' }
+    if ((Read-Inspect '{{index .Config.Labels `agentshouse.house`}}') -cne $House) { Stop-Bootstrap 'the installed Kit uses another House origin' }
+    if (-not ((Test-Path -LiteralPath $credential) -and (Test-Path -LiteralPath $environment) -and (Test-Path -LiteralPath $bound))) { Stop-Bootstrap 'the installed Kit has no enrolled authority' }
+    if ($Forwarding) {
+      if ($Forwarded -ceq 'kit' -and $Forward.Count -gt 0 -and $Forward[0] -ceq 'login') {
+        Invoke-Login @($Forward | Select-Object -Skip 1)
+        return
+      }
+      $placed = @()
+      $entry = @()
+      if ($Forwarded -ceq 'house') {
+        $here = (Get-Location).ProviderPath.TrimEnd('\')
+        if ($here -ine $Workspace -and -not $here.StartsWith("$Workspace\", [StringComparison]::OrdinalIgnoreCase)) {
+          Stop-Bootstrap "the current directory is outside the workspace $Workspace"
+        }
+        $placed = @('--workdir', "/agents/house$($here.Substring($Workspace.Length).Replace('\', '/'))")
+        $entry = @('--entrypoint', 'house')
+      }
+      $terminal = @()
+      if (-not [Console]::IsInputRedirected -and -not [Console]::IsOutputRedirected) { $terminal = @('-t') }
+      if ((Read-Inspect '{{.State.Running}}') -ceq 'true') {
+        & docker exec -i @terminal @placed $Name $Forwarded @Forward
+      } else {
+        & docker run -i @terminal @placed @entry --rm @Network @Common @Forward
+      }
+      Exit-Bootstrap $LASTEXITCODE
+    }
+    if ($installed -cne $Image) {
+      Invoke-Docker pull --quiet --platform linux/amd64 $Image | Out-Null
+      if ((Read-Inspect '{{.State.Running}}') -ceq 'true') { Invoke-Docker exec $Name kit resident drain }
+      Invoke-Docker rm -f $Name | Out-Null
+      Remove-Item -LiteralPath (Join-Path $kitHome 'state\update-drain') -Force -ErrorAction SilentlyContinue
+      Start-Resident
+      Write-Host "House Kit updated for Environment $([IO.File]::ReadAllText($environment).Trim())."
+      return
+    }
+    Invoke-Docker run --rm @Network @Common credential check
+    if ((Read-Inspect '{{.State.Running}}') -ceq 'true') {
+      Write-Host "House Kit is already running for Environment $([IO.File]::ReadAllText($environment).Trim())."
+    } else {
+      Invoke-Docker start $Name | Out-Null
+      Write-Host "House Kit restarted for Environment $([IO.File]::ReadAllText($environment).Trim())."
+    }
+    return
+  }
+
+  Invoke-Docker pull --quiet --platform linux/amd64 $Image | Out-Null
+  if (Test-Path -LiteralPath $credential) {
+    Invoke-Docker run --rm @Network @Common credential check
+  } else {
+    $login = @()
+    if ($HouseSelected) { $login += @('--house', $House) }
+    if ($Manual) { $login += '--manual' }
+    Invoke-Login $login
+  }
+  Invoke-Docker run --rm @Network @Common apply
+  Start-Resident
+  Write-Host "House Kit connected for Environment $([IO.File]::ReadAllText($environment).Trim())."
+}
+
+$consoleEncoding = [Console]::OutputEncoding
+try {
+  try {
+    [Console]::OutputEncoding = New-Object Text.UTF8Encoding($false)
+  } catch {
+    Stop-Bootstrap 'this PowerShell has no console; run this bootstrap from a Windows PowerShell console window'
+  }
+  Connect-Kit
+  $global:LASTEXITCODE = 0
+} catch {
+  $message = "$($_.Exception.Message)"
+  if ($message -match '^kit_bootstrap_exit: (\d+)$') {
+    $global:LASTEXITCODE = [int]$Matches[1]
+  } elseif ($message.StartsWith('kit_bootstrap_refused: ')) {
+    [Console]::Error.WriteLine($message)
+    $global:LASTEXITCODE = 1
+  } else {
+    $global:LASTEXITCODE = 1
+    throw
+  }
+} finally {
+  try { [Console]::OutputEncoding = $consoleEncoding } catch { }
+}

package/bootstrap.json

@@ -1,17 +1,28 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.0-alpha.35",
+  "version": "0.1.0-alpha.36",
   "hosts": {
     "linux": {
-      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.35/connect-linux.sh)",
+      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.36/connect-linux.sh)",
       "asset": {
         "name": "connect-linux.sh",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.35/connect-linux.sh"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.36/connect-linux.sh"
       },
       "workspace": {
         "argument": "--workspace",
         "quoting": "posix"
       }
+    },
+    "windows": {
+      "command": "& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.36/connect-windows.ps1)))",
+      "asset": {
+        "name": "connect-windows.ps1",
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.36/connect-windows.ps1"
+      },
+      "workspace": {
+        "argument": "--workspace",
+        "quoting": "powershell"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/kit",
-  "version": "0.1.0-alpha.35",
+  "version": "0.1.0-alpha.36",
   "license": "MIT",
   "repository": {
     "type": "git",