@akira-tl/forgerelay 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [0.10.1] - 2026-09-05
+
+### Added
+
+- Added native PowerShell 7 (`pwsh`) execution for Agent commands, Hooks, and PTY sessions with one versioned Command Shell Runtime, no-profile invocation, PowerShell-native command semantics, and Windows packaged-shim acceptance in cloud CI.
+- Added an exact-release-tag PowerShell guidance Skill seeded into the ForgeRelay config Skills directory without bundling prompt templates into the npm package or overwriting user edits.
+
 ## [0.10.0] - 2026-09-05
 
 ### Added

package/README.md

@@ -295,8 +295,9 @@ See [Security Model](docs/security.md) for the full boundary and threat model.
 | --- | --- | --- |
 | Linux | Supported | Requires Node, npm, Git, and Bash. |
 | macOS | Supported | Requires Node, npm, Git, and Bash. |
-| Windows with Git Bash, WSL, MSYS2, or Cygwin Bash | Supported | Git Bash is the simplest native Windows setup. |
-| Windows PowerShell or `cmd.exe` only | Not supported yet | Install Git Bash or use WSL. |
+| Windows with PowerShell 7 (`pwsh`) | Supported | Agent commands and Hooks use one native `pwsh` runtime without loading the user profile. |
+| Windows with Git Bash, WSL, MSYS2, or Cygwin Bash | Supported | Bash remains available as a compatibility path. |
+| Windows PowerShell 5.1 (`powershell.exe`) or `cmd.exe` only | Not supported yet | These runtimes are separate follow-up stages. |
 
 You can check the local runtime with:
 

package/capabilities/shell-processes/GUIDE.md

@@ -48,6 +48,6 @@ PTY 依赖 optional `node-pty`。缺少该依赖时 ForgeRelay 会明确报错
 
 ## Platform notes
 
-ForgeRelay shell runtime 需要 Bash。Windows 上原生 PowerShell 和 `cmd.exe` 当前不是该 runtime 的执行 shell；使用 Git Bash、WSL、MSYS2 或 Cygwin Bash，并用 `forgerelay doctor` 检查环境。
+ForgeRelay 在 Windows 上支持 PowerShell 7 (`pwsh`) 作为原生 Command Shell Runtime；非 TTY Agent 命令与 Hooks 使用同一个 `pwsh`，禁止加载用户 profile，PTY 也复用同一 executable。公共工具名仍保留为 `bash` 以兼容 Host contract，实际命令语言以 ForgeRelay 报告的 Command Shell Runtime 为准。Windows PowerShell 5.1 (`powershell.exe`) 与 `cmd.exe` 仍属于后续 runtime 阶段；Git Bash、WSL、MSYS2 或 Cygwin Bash 仍可作为 Bash 兼容路径。用 `forgerelay doctor` 检查当前 shell identity、version 与 executable。
 
 Shell 可以作为用户开发任务的一部分修改普通项目文件，但始终受 ForgeRelay core mutation/safety contract 约束。涉及 privileged OS files、credentials、configuration 或外部硬件持久写入时，不要用本指南替代 core authorization/safety 规则。

package/dist/cli/init.js

@@ -4,6 +4,7 @@ import { publicEndpointUrl } from "../mcp/oauth/public-url.js";
 import { expandHomePath } from "../mcp/filesystem/roots.js";
 import { detectLauncherCommandShell, } from "../runtime/shell/command-shell-runtime.js";
 import { seedShellInstructionFiles, shellInstructionFamiliesToSeed, } from "../runtime/instructions/shell-instructions.js";
+import { seedPowerShellSkill, } from "../runtime/instructions/powershell-skill.js";
 import { installManagedLanguageServers, installedManagedLanguageServers, managedLanguageServerOptions, } from "../lsp/runtime/managed-language-servers.js";
 import { generateInstanceId, generateOwnerToken, loadForgeRelayFiles, resolveSubagentsFlag, writeForgeRelayAuth, writeForgeRelayConfig, } from "../runtime/config/user-config.js";
 import { classifyClientFacingBaseUrl, compactPublicBaseUrlConfig, hasInsecureLanBaseUrl, isLoopbackBindAddress, normalizePublicBaseUrlsInput, setupBindAddress, SetupCancelledError, textPrompt, validateHttpsProxyBaseUrls, validateLanClientFacingBaseUrls, validatePort, } from "./setup-support.js";
@@ -159,6 +160,7 @@ export async function runInit({ force, version }) {
         const shellInstructionFamilies = shellInstructionFamiliesToSeed(process.platform, commandShell.family);
         let shellInstructions = files.config.shellInstructions;
         let shellInstructionSeedResults = [];
+        let powerShellSkillSeedResult;
         if (shellInstructionFamilies.length > 0) {
             const shellInstructionsAnswer = await prompts.confirm({
                 message: "Load ForgeRelay-provided extra Instructions for this command shell?",
@@ -177,6 +179,15 @@ export async function runInit({ force, version }) {
                 prompts.note(failedShellInstructions.map((result) => `${result.family}: ${result.error ?? "download failed"}\n${result.sourceUrl}`).join("\n\n"), "Shell Instructions unavailable");
             }
         }
+        if (commandShell.family === "pwsh") {
+            powerShellSkillSeedResult = await seedPowerShellSkill({
+                configDir: files.dir,
+                version,
+            });
+            if (powerShellSkillSeedResult.status === "failed") {
+                prompts.note(`${powerShellSkillSeedResult.error ?? "download failed"}\n${powerShellSkillSeedResult.sourceUrl}`, "PowerShell Skill unavailable");
+            }
+        }
         const installedManaged = installedManagedLanguageServers(files.dir);
         const selectedManaged = await prompts.multiselect({
             message: "Which Language Servers should ForgeRelay manage with npm?",
@@ -244,6 +255,9 @@ export async function runInit({ force, version }) {
                     ...shellInstructionSeedResults.map((result) => `Shell Instructions ${result.family}: ${result.status} (${result.path})`),
                 ]
                 : []),
+            ...(powerShellSkillSeedResult
+                ? [`PowerShell Skill: ${powerShellSkillSeedResult.status} (${powerShellSkillSeedResult.path})`]
+                : []),
             ...clientFacingBaseUrls.map((baseUrl, index) => `${index === 0 ? "Client-facing MCP URL" : "Client-facing MCP alias"}: ${publicEndpointUrl(baseUrl, "mcp").toString()}`),
         ];
         if (networkMode === "ssh") {

package/dist/mcp/process/process-platform.js

@@ -14,7 +14,7 @@ const defaultProcessTreeRuntime = {
 export function resolveShellCommand(command, platform = process.platform, environment = process.env) {
     return resolveShellCommandForRuntime(command, resolveCompatibilityCommandShellRuntime(platform, environment));
 }
-export function resolveShellCommandForRuntime(command, runtime) {
+export function resolveShellCommandForRuntime(command, runtime, options = {}) {
     // Agent and Hook commands must not source the user's interactive/login shell
     // configuration. ForgeRelay already inherits PATH and other environment from
     // the process that launched the server; re-running zsh/bash as a login shell
@@ -35,8 +35,18 @@ export function resolveShellCommandForRuntime(command, runtime) {
             return { executable: runtime.executable, args: ["-f", "-c", command] };
         case "sh":
             return { executable: runtime.executable, args: ["-c", command] };
-        case "fish":
         case "pwsh":
+            return {
+                executable: runtime.executable,
+                args: [
+                    "-NoLogo",
+                    "-NoProfile",
+                    ...(options.interactive ? [] : ["-NonInteractive"]),
+                    "-Command",
+                    command,
+                ],
+            };
+        case "fish":
         case "powershell":
             throw new Error(`Command shell runtime ${runtime.family} is identified but native execution support is not enabled in this release stage. ForgeRelay will not silently execute the command through another shell.`);
     }

package/dist/mcp/process/process-sessions.js

@@ -470,7 +470,7 @@ export class ProcessManager {
         catch {
             throw new Error("PTY support requires the optional node-pty dependency.");
         }
-        const shell = resolveShellCommandForRuntime(input.command, this.commandShellRuntime);
+        const shell = resolveShellCommandForRuntime(input.command, this.commandShellRuntime, { interactive: true });
         let pty;
         try {
             pty = nodePty.spawn(shell.executable, shell.args, {

package/dist/runtime/instructions/powershell-skill.js

@@ -0,0 +1,65 @@
+import { constants as fsConstants } from "node:fs";
+import { access, mkdir, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+const TEMPLATE_REPOSITORY_RAW = "https://raw.githubusercontent.com/Akira-TL/forgerelay";
+const POWERSHELL_SKILL_PATH = "templates/skills/powershell/SKILL.md";
+export function powerShellSkillPath(configDir) {
+    return join(resolve(configDir), "skills", "powershell", "SKILL.md");
+}
+export function powerShellSkillTemplateUrl(version) {
+    const normalizedVersion = version.trim().replace(/^v/, "");
+    if (!normalizedVersion)
+        throw new Error("ForgeRelay version is required to fetch the PowerShell Skill.");
+    return `${TEMPLATE_REPOSITORY_RAW}/v${encodeURIComponent(normalizedVersion)}/${POWERSHELL_SKILL_PATH}`;
+}
+export async function seedPowerShellSkill(options) {
+    const path = powerShellSkillPath(options.configDir);
+    const sourceUrl = powerShellSkillTemplateUrl(options.version);
+    if (!options.reset && await fileExists(path)) {
+        return { path, status: "preserved", sourceUrl };
+    }
+    await mkdir(join(resolve(options.configDir), "skills", "powershell"), {
+        recursive: true,
+        mode: 0o700,
+    });
+    const fetchText = options.fetchText ?? fetchSkillText;
+    try {
+        const content = await fetchText(sourceUrl);
+        if (!content.trim())
+            throw new Error("template response was empty");
+        await writeFile(path, content.endsWith("\n") ? content : `${content}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: options.reset ? "w" : "wx",
+        });
+        return { path, status: "created", sourceUrl };
+    }
+    catch (error) {
+        if (!options.reset && await fileExists(path)) {
+            return { path, status: "preserved", sourceUrl };
+        }
+        return {
+            path,
+            status: "failed",
+            sourceUrl,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+async function fetchSkillText(url) {
+    const response = await fetch(url, {
+        headers: { "user-agent": "forgerelay-powershell-skill" },
+    });
+    if (!response.ok)
+        throw new Error(`HTTP ${response.status} while fetching ${url}`);
+    return response.text();
+}
+async function fileExists(path) {
+    try {
+        await access(path, fsConstants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/runtime/shell/command-shell-runtime.js

@@ -21,23 +21,31 @@ export function resolveCommandShellRuntime(input) {
  * strict precedence resolver above: new configuration should call
  * resolveCommandShellRuntime instead of inventing another fallback.
  */
-export function resolveConfiguredCommandShellRuntime(preference, platform = process.platform, environment = process.env) {
+export function resolveConfiguredCommandShellRuntime(preference, platform = process.platform, environment = process.env, metadata = {}) {
     const legacyExplicit = environment.FORGERELAY_COMMAND_SHELL?.trim();
+    let runtime;
     if (legacyExplicit) {
         const explicit = normalizeCommandShellSelection({ executable: legacyExplicit }, platform, environment, true);
-        return resolveCommandShellRuntime({ explicit });
+        runtime = resolveCommandShellRuntime({ explicit });
     }
-    if (!preference)
-        return resolveCompatibilityCommandShellRuntime(platform, environment);
-    if (preference.mode === "pinned") {
+    else if (!preference) {
+        runtime = resolveCompatibilityCommandShellRuntime(platform, environment);
+    }
+    else if (preference.mode === "pinned") {
         const explicit = normalizeCommandShellSelection(preference, platform, environment, true);
-        return resolveCommandShellRuntime({ explicit });
+        runtime = resolveCommandShellRuntime({ explicit });
+    }
+    else {
+        const launcher = detectLauncherCommandShell({ platform, environment });
+        if (launcher) {
+            runtime = resolveCommandShellRuntime({ launcher });
+        }
+        else {
+            const recordedFallback = normalizeCommandShellSelection(preference, platform, environment, true);
+            runtime = resolveCommandShellRuntime({ recordedFallback });
+        }
     }
-    const launcher = detectLauncherCommandShell({ platform, environment });
-    if (launcher)
-        return resolveCommandShellRuntime({ launcher });
-    const recordedFallback = normalizeCommandShellSelection(preference, platform, environment, true);
-    return resolveCommandShellRuntime({ recordedFallback });
+    return enrichConfiguredCommandShellRuntime(runtime, metadata.probePowerShell7Version ?? probePowerShell7Version);
 }
 export function resolveCompatibilityCommandShellRuntime(platform = process.platform, environment = process.env) {
     if (platform === "win32") {
@@ -121,6 +129,41 @@ export function formatCommandShellRuntime(runtime) {
 export function snapshotCommandShellRuntime(runtime) {
     return { ...runtime, capabilities: [...runtime.capabilities] };
 }
+function enrichConfiguredCommandShellRuntime(runtime, powerShell7VersionProbe) {
+    if (runtime.family !== "pwsh")
+        return runtime;
+    const version = powerShell7VersionProbe(runtime.executable).trim();
+    const major = Number.parseInt(version.split(".", 1)[0] ?? "", 10);
+    if (!version || !Number.isInteger(major)) {
+        throw new Error(`Unable to determine PowerShell 7 version from ${runtime.executable}.`);
+    }
+    if (major < 7) {
+        throw new Error(`Configured pwsh runtime must be PowerShell 7 or newer; detected ${version} at ${runtime.executable}.`);
+    }
+    return {
+        ...runtime,
+        version,
+        capabilities: Array.from(new Set([
+            ...runtime.capabilities,
+            "profile-isolation",
+            "pipeline-chain-operators",
+        ])),
+    };
+}
+function probePowerShell7Version(executable) {
+    const result = spawnSync(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", "$PSVersionTable.PSVersion.ToString()"], { encoding: "utf8", windowsHide: true, timeout: 5_000 });
+    if (result.error) {
+        throw new Error(`Unable to query PowerShell 7 version from ${executable}: ${result.error.message}`);
+    }
+    if (result.status !== 0) {
+        const detail = result.stderr?.trim();
+        throw new Error(`Unable to query PowerShell 7 version from ${executable}: exited with code ${result.status ?? "unknown"}${detail ? `: ${detail}` : ""}.`);
+    }
+    const version = result.stdout?.trim();
+    if (!version)
+        throw new Error(`Unable to query PowerShell 7 version from ${executable}: no version was reported.`);
+    return version;
+}
 export function commandShellAgentInstruction(runtime) {
     if (runtime.family === "bash")
         return "";

package/docs/gotchas.md

@@ -162,10 +162,12 @@ ForgeRelay does not intentionally leave the source checkout in a merge-conflict
 
 ## Windows shell commands fail
 
-ForgeRelay shell execution requires Bash. Native PowerShell and `cmd.exe` command
-execution are not currently supported by the shell runtime.
+ForgeRelay supports PowerShell 7 (`pwsh`) as a native Windows Command Shell Runtime.
+Agent commands and Hooks share that runtime and do not load the user PowerShell profile.
+Windows PowerShell 5.1 (`powershell.exe`) and `cmd.exe` remain separate follow-up runtimes.
+Git Bash, WSL, MSYS2, and Cygwin Bash also remain supported compatibility paths.
 
-Use Git Bash, WSL, MSYS2, or Cygwin Bash, then run:
+Check the selected runtime with:
 
 ```bash
 forgerelay doctor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",
@@ -42,6 +42,7 @@
     "debug:accept:relay": "node scripts/debug/relay-accept.mjs",
     "traffic:audit": "node --import tsx scripts/debug/traffic/traffic-audit.mjs",
     "lsp:interop": "node scripts/lsp/interop.mjs",
+    "pwsh:accept": "node scripts/ci/pwsh-acceptance.mjs",
     "wiki:check": "node scripts/wiki/sync.mjs check",
     "wiki:publish": "node scripts/wiki/sync.mjs publish",
     "architecture:check": "node scripts/ci/architecture.mjs",
@@ -52,7 +53,7 @@
     "release:push-ready": "node scripts/release/push-ready.mjs",
     "postinstall": "node scripts/fix-node-pty-permissions.mjs",
     "start": "node dist/cli.js serve",
-    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/runtime/config/config.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
+    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/runtime/config/config.test.ts && tsx src/runtime/instructions/powershell-skill.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "release:check": "node scripts/release-version.mjs check",
     "release:tag-check": "node scripts/release-version.mjs tag",

package/scripts/ci/pwsh-acceptance.mjs

@@ -0,0 +1,308 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+if (process.platform !== "win32") {
+  console.log("PowerShell 7 packaged acceptance skipped outside Windows.");
+  process.exit(0);
+}
+
+const npmCli = process.env.npm_execpath;
+if (!npmCli) throw new Error("pwsh acceptance must run through npm so npm_execpath is available");
+
+const root = await mkdtemp(join(tmpdir(), "forgerelay-pwsh-acceptance-"));
+try {
+  const pwsh = resolvePowerShell7();
+  const version = powerShellVersion(pwsh);
+  const major = Number.parseInt(version.split(".", 1)[0] ?? "", 10);
+  assert.ok(Number.isInteger(major) && major >= 7, `PowerShell 7 acceptance requires pwsh >= 7; got ${version}`);
+
+  const runtime = {
+    family: "pwsh",
+    executable: pwsh,
+    source: "explicit",
+    version,
+    capabilities: [
+      "powershell-command-language",
+      "powershell-core",
+      "profile-isolation",
+      "pipeline-chain-operators",
+    ],
+  };
+
+  await exerciseAgentRuntime(runtime);
+  await exerciseHookRuntime(runtime);
+  await exercisePackagedPowerShellShim(pwsh, version);
+
+  console.log(`PowerShell 7 acceptance passed with ${pwsh} (${version}).`);
+} finally {
+  await rm(root, { recursive: true, force: true });
+}
+
+function resolvePowerShell7() {
+  const result = spawnSync("where.exe", ["pwsh.exe"], {
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error("Windows release acceptance requires PowerShell 7 (pwsh.exe) on PATH.");
+  }
+  const executable = result.stdout?.split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+  if (!executable) throw new Error("where.exe reported no pwsh.exe path.");
+  return executable;
+}
+
+function powerShellVersion(executable) {
+  const result = spawnSync(
+    executable,
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", "$PSVersionTable.PSVersion.ToString()"],
+    { encoding: "utf8", windowsHide: true },
+  );
+  if (result.error || result.status !== 0) {
+    throw new Error(`Unable to query ${executable} version: ${result.error?.message ?? result.stderr ?? result.status}`);
+  }
+  const version = result.stdout?.trim();
+  if (!version) throw new Error(`${executable} did not report a version.`);
+  return version;
+}
+
+async function exerciseAgentRuntime(runtime) {
+  const { ProcessManager } = await import("../../dist/mcp/process/process-sessions.js");
+  const manager = new ProcessManager({ commandShellRuntime: runtime });
+  const originalMarker = process.env.FORGERELAY_PWSH_ACCEPTANCE;
+  process.env.FORGERELAY_PWSH_ACCEPTANCE = "inherited environment";
+  try {
+    const node = powerShellLiteral(process.execPath);
+    const semantics = await manager.start({
+      workspaceId: "pwsh-agent",
+      cwd: process.cwd(),
+      command: [
+        'Write-Output "env=$env:FORGERELAY_PWSH_ACCEPTANCE"',
+        '1,2,3 | Measure-Object -Sum | ForEach-Object { Write-Output "sum=$($_.Sum)" }',
+        `$exe = ${node}`,
+        "& $exe -e 'console.log(JSON.stringify(process.argv.slice(1)))' 'native arg with spaces' 'quote\"inside' 'unicode-雪'",
+        "if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }",
+        "$redirect = Join-Path $env:TEMP 'forgerelay-pwsh-redirection.txt'",
+        "'redirected-through-pwsh' > $redirect",
+        "Get-Content $redirect",
+        "Remove-Item $redirect -Force",
+      ].join("; "),
+      yieldTimeMs: 10_000,
+    });
+    assert.equal(semantics.running, false);
+    assert.equal(semantics.exitCode, 0);
+    assert.match(semantics.output, /env=inherited environment/);
+    assert.match(semantics.output, /sum=6/);
+    assert.match(semantics.output, /\["native arg with spaces","quote\\\"inside","unicode-雪"\]/);
+    assert.match(semantics.output, /redirected-through-pwsh/);
+
+    const errorSemantics = await manager.start({
+      workspaceId: "pwsh-agent",
+      cwd: process.cwd(),
+      command: [
+        "Write-Error 'nonterminating-pwsh-error'",
+        "Write-Output 'continued-after-nonterminating-error'",
+        "try { Get-Item 'forgerelay-definitely-missing-item' -ErrorAction Stop; exit 31 } catch { Write-Output 'terminating-error-caught' }",
+      ].join("; "),
+      yieldTimeMs: 10_000,
+    });
+    assert.equal(errorSemantics.exitCode, 0);
+    assert.match(errorSemantics.output, /nonterminating-pwsh-error/);
+    assert.match(errorSemantics.output, /continued-after-nonterminating-error/);
+    assert.match(errorSemantics.output, /terminating-error-caught/);
+
+    const nativeExit = await manager.start({
+      workspaceId: "pwsh-agent",
+      cwd: process.cwd(),
+      command: `$exe = ${node}; & $exe -e 'process.exit(7)'; exit $LASTEXITCODE`,
+      yieldTimeMs: 10_000,
+    });
+    assert.equal(nativeExit.exitCode, 7);
+
+    const background = await manager.start({
+      workspaceId: "pwsh-agent",
+      cwd: process.cwd(),
+      command: "Write-Output 'pwsh-background-start'; Start-Sleep -Milliseconds 250; Write-Output 'pwsh-background-done'",
+      yieldTimeMs: 5,
+    });
+    assert.equal(background.running, true);
+    assert.ok(background.processId);
+    const completed = await manager.write({
+      workspaceId: "pwsh-agent",
+      processId: background.processId,
+      yieldTimeMs: 5_000,
+    });
+    assert.equal(completed.running, false);
+    assert.equal(completed.exitCode, 0);
+    assert.match(completed.output, /pwsh-background-done/);
+
+    const timedOut = await manager.start({
+      workspaceId: "pwsh-agent",
+      cwd: process.cwd(),
+      command: "Start-Sleep -Seconds 30",
+      yieldTimeMs: 5_000,
+      timeoutMs: 100,
+    });
+    assert.equal(timedOut.running, false);
+    assert.equal(timedOut.timedOut, true);
+
+    const interruptible = await manager.start({
+      workspaceId: "pwsh-agent",
+      cwd: process.cwd(),
+      command: "Write-Output 'pwsh-interrupt-ready'; Start-Sleep -Seconds 30",
+      yieldTimeMs: 5,
+    });
+    assert.equal(interruptible.running, true);
+    assert.ok(interruptible.processId);
+    const interrupted = await manager.write({
+      workspaceId: "pwsh-agent",
+      processId: interruptible.processId,
+      chars: "\u0003",
+      yieldTimeMs: 5_000,
+    });
+    assert.equal(interrupted.running, false);
+
+    const pty = await manager.start({
+      workspaceId: "pwsh-agent",
+      cwd: process.cwd(),
+      command: "Write-Output 'pwsh-pty-ok'",
+      tty: true,
+      yieldTimeMs: 10_000,
+    });
+    assert.equal(pty.running, false);
+    assert.equal(pty.exitCode, 0);
+    assert.match(pty.output, /pwsh-pty-ok/);
+  } finally {
+    if (originalMarker === undefined) delete process.env.FORGERELAY_PWSH_ACCEPTANCE;
+    else process.env.FORGERELAY_PWSH_ACCEPTANCE = originalMarker;
+    manager.shutdown();
+  }
+}
+
+async function exerciseHookRuntime(runtime) {
+  const { HookRunner, parseHookConfig } = await import("../../dist/mcp/hooks/hooks.js");
+  const logging = {
+    level: "silent",
+    format: "json",
+    requests: false,
+    assets: false,
+    toolCalls: false,
+    shellCommands: false,
+    trustProxy: false,
+  };
+  const runner = new HookRunner(
+    parseHookConfig({
+      BeforeTool: [{
+        handlers: [{
+          name: "PowerShell policy",
+          command: "if ($env:FORGERELAY_WORKSPACE_ID -ne 'pwsh-hook') { exit 19 }; Write-Error 'pwsh policy denied'; exit 13",
+        }],
+      }],
+    }),
+    logging,
+    process.env,
+    undefined,
+    runtime,
+  );
+
+  await assert.rejects(
+    () => runner.run("BeforeTool", {
+      workspaceId: "pwsh-hook",
+      workspaceRoot: process.cwd(),
+      workspaceMode: "checkout",
+      payload: { tool: "bash", command: "Write-Output 'agent command'" },
+    }),
+    /PowerShell policy exited with code 13: .*pwsh policy denied/i,
+  );
+}
+
+async function exercisePackagedPowerShellShim(pwsh, expectedVersion) {
+  const artifactDir = join(root, "artifact");
+  const prefix = join(root, "prefix");
+  const configDir = join(root, "config");
+  const stateDir = join(root, "state");
+  await Promise.all([
+    mkdir(artifactDir, { recursive: true }),
+    mkdir(prefix, { recursive: true }),
+    mkdir(configDir, { recursive: true }),
+    mkdir(stateDir, { recursive: true }),
+  ]);
+
+  const packed = runNpm(["pack", "--json", "--pack-destination", artifactDir]);
+  const packResult = JSON.parse(packed.stdout);
+  const filename = packResult?.[0]?.filename;
+  if (!filename) throw new Error(`npm pack did not report a package filename: ${packed.stdout}`);
+  const tarball = join(artifactDir, filename);
+  assert.ok(existsSync(tarball), `packed artifact is missing: ${tarball}`);
+
+  runNpm(["install", "--global", "--prefix", prefix, tarball]);
+  const shim = join(prefix, "forgerelay.ps1");
+  assert.ok(existsSync(shim), `npm did not create the PowerShell launcher shim: ${shim}`);
+
+  await writeFile(
+    join(configDir, "config.json"),
+    JSON.stringify({
+      host: "127.0.0.1",
+      port: 7678,
+      allowedRoots: [process.cwd()],
+      stateDir,
+      worktreeRoot: join(root, "worktrees"),
+      commandShell: {
+        mode: "follow-launcher",
+        family: "pwsh",
+        executable: pwsh,
+      },
+      shellInstructions: false,
+    }, null, 2),
+    "utf8",
+  );
+
+  const launcherEnv = {
+    ...process.env,
+    FORGERELAY_CONFIG_DIR: configDir,
+    FORGERELAY_OAUTH_OWNER_TOKEN: "pwsh-acceptance-owner-token-that-is-long-enough",
+  };
+  delete launcherEnv.npm_lifecycle_event;
+  delete launcherEnv.FORGERELAY_COMMAND_SHELL;
+
+  const result = spawnSync(
+    pwsh,
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-File", shim, "doctor"],
+    {
+      cwd: process.cwd(),
+      env: launcherEnv,
+      encoding: "utf8",
+      windowsHide: true,
+    },
+  );
+  if (result.error || result.status !== 0) {
+    throw new Error(`Packaged PowerShell launcher failed: ${result.error?.message ?? result.stderr ?? result.status}`);
+  }
+  assert.match(result.stdout ?? "", new RegExp(`Command shell: pwsh ${escapeRegExp(expectedVersion)} \\(.+; launcher\\)`));
+}
+
+function runNpm(args) {
+  const result = spawnSync(process.execPath, [npmCli, ...args], {
+    cwd: process.cwd(),
+    env: process.env,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error(`npm ${args.join(" ")} failed: ${result.error?.message ?? result.stderr ?? result.status}`);
+  }
+  return result;
+}
+
+function powerShellLiteral(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/scripts/ci/verify.mjs

@@ -14,6 +14,7 @@ runNpm(["run", "release:check"], "Release metadata");
 runNpm(["run", "typecheck"], "Typecheck");
 runNpm(["test"], "Full test suite");
 runNpm(["run", "build"], "Build");
+if (process.platform === "win32") runNpm(["run", "pwsh:accept"], "PowerShell 7 packaged acceptance");
 // The traffic audit is an end-to-end wire-budget check, not a platform feature
 // matrix. Run it once on Linux so regressions are gated without tripling the
 // 7677/7678 server exercise across every CI operating system.