@akira-tl/forgerelay 0.10.3 → 0.10.4

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [0.10.4] - 2026-09-06
+
+### Added
+
+- Added execution-owned Command Shell Runtime identity across Relay and Composite Workspaces so mixed-platform and mixed-shell operations expose the shell of the ForgeRelay instance that actually owns execution.
+
+### Changed
+
+- Made Doctor, Agent/tool descriptions, Workspace UI, Instructions state, and product documentation consistently shell-aware while preserving the public Core `bash` tool name for Host compatibility.
+- Made explicit non-Bash POSIX selections report their compatibility boundary instead of silently implying Bash semantics.
+
+### Fixed
+
+- Completed real packaged Windows product acceptance for PowerShell 7, Windows PowerShell 5.1, and `cmd.exe`, including editable shell Instructions and elevated-startup protection, while hardening the acceptance harness against Windows native-module handle retention and host-specific fixture assumptions.
+
 ## [0.10.3] - 2026-09-06
 
 ### Added

package/README.md

@@ -25,7 +25,7 @@ on your machine.
 
 ## Quick start
 
-ForgeRelay requires Node `>=22.19 <27`, npm, Git, and a Bash-compatible shell.
+ForgeRelay requires Node `>=22.19 <27`, npm, Git, and a supported Command Shell Runtime. Bash is the primary POSIX compatibility target; zsh and POSIX sh can be selected explicitly. On Windows, PowerShell 7, Windows PowerShell 5.1, and cmd.exe are first-class native runtimes.
 
 Install it globally:
 
@@ -139,7 +139,7 @@ bash({ workspaceId: "cws_...", member: "compute", command: "python train.py" })
 ```
 
 ForgeRelay does not merge member filesystems, Git state, Hooks, Skills, processes,
-or audit facts, and it never infers a member from the tool type or purpose text.
+shell/platform identity, privilege state, or audit facts, and it never infers a member from the tool type or purpose text. `memberContext.executionContext` reports the selected member's actual execution platform and Command Shell Runtime; it overrides the Gateway shell identity for commands routed to that member.
 The Composite Activity Panel presents member operations in one Host Turn while the
 actual facts remain owned by the member Workspace. `close_workspace` on a Composite
 Workspace now preserves the Composite identity and member topology as `closed`; a
@@ -293,12 +293,12 @@ See [Security Model](docs/security.md) for the full boundary and threat model.
 
 | Platform | Status | Notes |
 | --- | --- | --- |
-| Linux | Supported | Requires Node, npm, Git, and Bash. |
-| macOS | Supported | Requires Node, npm, Git, and Bash. |
-| Windows with PowerShell 7 (`pwsh`) | Supported | Agent commands, Hooks, and PTY execution use one native `pwsh` runtime without loading the user profile. |
-| Windows with Windows PowerShell 5.1 (`powershell.exe`) | Supported | Agent commands, Hooks, and PTY execution use the selected 5.1 runtime with 5.1-specific syntax guidance. |
-| Windows with `cmd.exe` | Supported for Agent commands and Hooks | ForgeRelay preserves cmd syntax and reports the selected runtime explicitly; PTY/packaged-launcher lifecycle coverage is completed separately. |
-| Windows with Git Bash, WSL, MSYS2, or Cygwin Bash | Supported | Bash remains available as a compatibility path. |
+| Linux | Supported | Bash is the primary POSIX compatibility target; zsh and POSIX sh are explicit native choices with shell-specific compatibility guidance. |
+| macOS | Supported | Bash is the primary POSIX compatibility target; zsh and POSIX sh are explicit native choices with shell-specific compatibility guidance. |
+| Windows with PowerShell 7 (`pwsh`) | Supported | Agent commands, Hooks, pipe/PTY execution, packaged launcher, and editable shell Instructions use one native `pwsh` runtime without loading the user profile. |
+| Windows with Windows PowerShell 5.1 (`powershell.exe`) | Supported | Agent commands, Hooks, pipe/PTY execution, packaged launcher, and editable shell Instructions use the selected 5.1 runtime with 5.1-specific syntax guidance. |
+| Windows with `cmd.exe` | Supported | Agent commands, Hooks, pipe/ConPTY execution, packaged `.cmd` launcher, and editable shell Instructions preserve cmd syntax and runtime identity. |
+| Windows with Git Bash, WSL, MSYS2, or Cygwin Bash | Compatibility path | Bash remains available when the selected executable provides the expected Bash command language. |
 
 You can check the local runtime with:
 

package/capabilities/shell-processes/GUIDE.md

@@ -48,6 +48,8 @@ PTY 依赖 optional `node-pty`。缺少该依赖时 ForgeRelay 会明确报错
 
 ## Platform notes
 
-ForgeRelay 在 Windows 上原生支持 PowerShell 7 (`pwsh`) 与 Windows PowerShell 5.1 (`powershell.exe`) 的 Agent、Hook 和 PTY 执行，也支持 `cmd.exe` 作为 Agent 命令与 Hook 的一等 Command Shell Runtime。Agent 命令与 Hooks 始终复用已选择的 runtime，不会为了兼容性静默切换到 Bash 或 PowerShell；PowerShell runtime 不加载用户 profile。公共工具名仍保留为 `bash` 以兼容 Host contract，实际命令语言以 ForgeRelay 报告的 Command Shell Runtime 为准。`cmd.exe` 的 PTY/ConPTY 与 packaged `.cmd` launcher lifecycle 属于下一阶段验收，不应由本阶段的非 TTY 支持推断。Git Bash、WSL、MSYS2 或 Cygwin Bash 仍可作为 Bash 兼容路径。用 `forgerelay doctor` 检查当前 shell identity、version 与 executable。
+ForgeRelay 在 Windows 上原生支持 PowerShell 7 (`pwsh`)、Windows PowerShell 5.1 (`powershell.exe`) 与 `cmd.exe` 的 Agent、Hook、pipe/PTY 生命周期和 packaged launcher。Agent 命令与 Hooks 始终复用已选择的 runtime，不会为了兼容性静默切换到 Bash、PowerShell 或 cmd；PowerShell runtime 不加载用户 profile。公共工具名仍保留为 `bash` 以兼容 Host contract，实际命令语言以 ForgeRelay 报告的 Command Shell Runtime 为准。Git Bash、WSL、MSYS2 或 Cygwin Bash 仍可作为 Bash 兼容路径。
+
+Linux/macOS 以 Bash 作为主要 POSIX 兼容目标；zsh 与 POSIX sh 可以显式选择，并要求 Agent/Hook 使用对应语法。fish 可以被识别和配置用于显式兼容性测试，但本版本不启用 native fish execution，ForgeRelay 也不会静默改用 Bash。Relay / Composite 场景下，以 `open_workspace.executionContext` / `memberContext.executionContext` 中 Execution ForgeRelay 的 platform、shell 和 privilege 为准。用 `forgerelay doctor` 检查本机 shell identity、version、executable、compatibility boundary 与 Shell Instructions 状态。
 
 Shell 可以作为用户开发任务的一部分修改普通项目文件，但始终受 ForgeRelay core mutation/safety contract 约束。涉及 privileged OS files、credentials、configuration 或外部硬件持久写入时，不要用本指南替代 core authorization/safety 规则。

package/dist/cli/setup-support.js

@@ -185,18 +185,3 @@ export function checkGitAvailable() {
         return `unavailable (${message})`;
     }
 }
-export function checkBashShell() {
-    try {
-        const { execFileSync } = require("node:child_process");
-        const command = process.env.BASH?.trim() || "bash";
-        const version = execFileSync(command, ["--version"], {
-            encoding: "utf8",
-            windowsHide: true,
-        }).split(/\r?\n/, 1)[0]?.trim();
-        return version ? `${command} (${version})` : command;
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        return `unavailable (${message})`;
-    }
-}

package/dist/cli/shell/setup.js

@@ -77,8 +77,11 @@ export function commandShellCompatibilityWarning(family) {
     if (family === "zsh") {
         return "zsh is supported as an explicit command runtime, but Bash remains ForgeRelay's primary POSIX compatibility target. Agent commands and Hooks must use zsh syntax.";
     }
+    if (family === "sh") {
+        return "POSIX sh is supported as an explicit command runtime, but Bash remains ForgeRelay's primary POSIX compatibility target. Agent commands and Hooks must use portable sh syntax and must not assume Bash-only features.";
+    }
     if (family === "fish") {
-        return "fish may be selected explicitly, but ForgeRelay compatibility is less mature than Bash and native fish execution is not enabled until its runtime adapter is available. Agent commands and Hooks must use fish syntax when enabled.";
+        return "fish may be selected explicitly for configuration/testing, but native fish command execution is not enabled in this release. ForgeRelay will not silently substitute Bash or another shell.";
     }
     return undefined;
 }

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { createRequire } from "node:module";
 import { stdin as input, stdout as output } from "node:process";
 import { spawn } from "node:child_process";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, writeFileSync } from "node:fs";
 import { readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -23,9 +23,10 @@ import { shutdownHttpServer } from "./mcp/server/transport/server-shutdown.js";
 import { publicEndpointUrl } from "./mcp/oauth/public-url.js";
 import { assertRuntimePrivilegeAllowed, detectRuntimePrivilege, elevatedRuntimeWarning, formatRuntimePrivilege, } from "./runtime/security/runtime-privilege.js";
 import { formatCommandShellRuntime } from "./runtime/shell/command-shell-runtime.js";
+import { commandShellCompatibilityWarning } from "./cli/shell/setup.js";
 import { authenticateRemote, defaultRemoteAlias, isRemoteMcpUnauthorized, normalizeRemoteServiceTarget, refreshRemoteAuthentication, verifyRemoteMcp, } from "./workspaces/relay/auth/remote-auth.js";
 import { defaultSshRouteAlias, parseSshRoute, readRemoteOwnerToken, withRemoteServiceEndpoint, } from "./workspaces/relay/transport/remote-transport.js";
-import { assertSupportedNode, checkBashShell, checkGitAvailable, checkSqliteNative, nodeVersionStatus, normalizeOptionalPublicBaseUrl, } from "./cli/setup-support.js";
+import { assertSupportedNode, checkGitAvailable, checkSqliteNative, nodeVersionStatus, normalizeOptionalPublicBaseUrl, } from "./cli/setup-support.js";
 const require = createRequire(import.meta.url);
 async function main(argv) {
     assertSupportedNode();
@@ -353,7 +354,6 @@ async function runDoctor() {
     console.log(`Platform: ${process.platform} ${process.arch}`);
     console.log(`Runtime privilege: ${formatRuntimePrivilege(detectRuntimePrivilege())}`);
     console.log(`Git: ${checkGitAvailable()}`);
-    console.log(`Bash shell: ${checkBashShell()}`);
     console.log(`SQLite native dependency: ${checkSqliteNative()}`);
     try {
         const config = loadConfig();
@@ -362,6 +362,14 @@ async function runDoctor() {
         console.log(`Client-facing base URL: ${config.publicBaseUrl}`);
         console.log(`Client-facing MCP URL: ${publicEndpointUrl(config.publicBaseUrl, "mcp").toString()}`);
         console.log(`Command shell: ${formatCommandShellRuntime(config.commandShellRuntime)}`);
+        console.log(`Command shell executable: ${config.commandShellRuntime.executable}`);
+        console.log(`Command shell source: ${config.commandShellRuntime.source}`);
+        const shellCompatibilityWarning = commandShellCompatibilityWarning(config.commandShellRuntime.family);
+        console.log(`Command shell compatibility: ${shellCompatibilityWarning ?? "native supported runtime"}`);
+        console.log(`Shell Instructions: ${config.shellInstructionsEnabled ? "enabled" : "disabled"}` +
+            (config.shellInstructionPath
+                ? ` (${config.shellInstructionPath}; ${existsSync(config.shellInstructionPath) ? "available" : "unavailable"})`
+                : " (not applicable)"));
         console.log(`Tool mode: ${config.toolMode}`);
         console.log(`Widgets: ${config.widgets}`);
         console.log(`Trust proxy: ${config.proxyTrust === false ? "off" : config.proxyTrust.join(", ")}`);

package/dist/mcp/server/workspace/runtime/workspace-open-presentation.js

@@ -9,6 +9,7 @@ import { formatUnavailableSubagentProvider } from "../../../../subagents/provide
 import { capabilityContextFor } from "../../core/capability-support.js";
 import { redactSkillDiagnosticPaths } from "../../core/schemas.js";
 import { logToolCall, workspaceLogContext } from "../../core/tool-support.js";
+import { buildExecutionShellContext } from "../../../server-instructions.js";
 export const workspaceTaskUsageInstruction = "Use workspace.tasks proactively for work that spans multiple steps or sessions: create or update Tasks to preserve useful next steps and current state, and read its summary when resuming relevant unfinished work. Do not query it mechanically on every open_workspace call.";
 export async function presentLocalWorkspaceOpen(options, input, contextData) {
     const { config, forgerelayVersion: FORGERELAY_VERSION, workspaces, workspaceTasks, reviewCheckpoints, capabilityRegistry, subagentProviders, hooks, rememberWorkspacePanelState, } = options;
@@ -75,6 +76,15 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
         path: formatAgentsPath(instruction.path, workspace.root),
         status: instruction.status,
     }));
+    const rawShellInstruction = config.shellInstructionPath
+        ? workspace.workspaceInstructions.find((instruction) => instruction.path === config.shellInstructionPath)
+        : undefined;
+    const executionContext = buildExecutionShellContext(config, rawShellInstruction
+        ? {
+            path: formatAgentsPath(rawShellInstruction.path, workspace.root),
+            status: rawShellInstruction.status,
+        }
+        : undefined);
     const bootstrapComponents = new Set(effectiveBootstrapContextComponents);
     const visibleSkills = bootstrapComponents.has("skills") ? cardSkills : [];
     const visibleSkillDiagnostics = bootstrapComponents.has("skillDiagnostics")
@@ -95,8 +105,8 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
             : undefined,
     ].filter(Boolean).join(" ");
     const cardInstruction = config.skillsEnabled
-        ? `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches an available skill, load it with read(path=\"skills://<name>\") before proceeding. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction}`
-        : `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction}`;
+        ? `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches an available skill, load it with read(path=\"skills://<name>\") before proceeding. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction} ${executionContext.agentInstruction}`
+        : `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction} ${executionContext.agentInstruction}`;
     const instruction = workspaceReused
         ? effectiveIncludeBootstrapContext
             ? [
@@ -107,6 +117,7 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
                     : "Only Workspace context deltas are included in this response; unchanged bootstrap context is not repeated.",
                 workspaceContextInstruction,
                 workspaceManagementInstruction,
+                executionContext.agentInstruction,
             ].join("\n\n")
             : [
                 `Workspace already open as ${workspace.id}.`,
@@ -114,9 +125,10 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
                 "Continue following the project instructions, nested instruction files, skills, capability guides, agent profiles, and diagnostics previously provided for this workspace. They remain active and are not repeated here.",
                 workspaceContextInstruction,
                 workspaceManagementInstruction,
+                executionContext.agentInstruction,
             ].join("\n\n")
         : workspace.mode === "worktree"
-            ? `Use this workspaceId for subsequent tool calls. Follow the project instructions, nested instruction files, skills, agent profiles, and diagnostics returned for this isolated worktree. ${workspaceManagementInstruction}`
+            ? `Use this workspaceId for subsequent tool calls. Follow the project instructions, nested instruction files, skills, agent profiles, and diagnostics returned for this isolated worktree. ${workspaceManagementInstruction} ${executionContext.agentInstruction}`
             : cardInstruction;
     const resultContent = [
         {
@@ -190,6 +202,7 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
         agentsFiles: cardAgentsFiles,
         availableAgentsFiles: cardAvailableAgentsFiles,
         workspaceInstructions: cardWorkspaceInstructions,
+        executionContext,
         skills: cardSkills,
         agentProviders: cardAgentProviders,
         agents: cardAgents,
@@ -226,6 +239,8 @@ export async function presentLocalWorkspaceOpen(options, input, contextData) {
             capabilityFingerprint,
             contextFingerprint,
             capabilityCatalog,
+            workspaceInstructions: cardWorkspaceInstructions,
+            executionContext,
             ...(bootstrapComponents.has("capabilityGuides")
                 ? { capabilityGuides: visibleCapabilityGuides }
                 : {}),

package/dist/mcp/server/workspace/runtime/workspace-open-schema.js

@@ -150,6 +150,32 @@ export const openWorkspaceToolDefinition = {
         capabilityFingerprint: capabilityFingerprintOutputSchema.optional(),
         contextFingerprint: z.string().optional(),
         capabilityCatalog: z.array(capabilityCatalogOutputSchema).optional(),
+        executionContext: z.object({
+            platform: z.string(),
+            commandShellRuntime: z.object({
+                family: z.enum(["bash", "zsh", "fish", "sh", "pwsh", "powershell", "cmd"]),
+                executable: z.string(),
+                source: z.enum(["explicit", "launcher", "recorded", "compatibility-default"]),
+                version: z.string().optional(),
+                capabilities: z.array(z.string()),
+            }),
+            runtimePrivilege: z.object({
+                level: z.enum(["standard", "elevated", "unknown"]),
+                platform: z.string(),
+                source: z.enum(["posix-euid", "windows-token", "unsupported"]),
+                detail: z.string().optional(),
+            }).optional(),
+            shellInstructions: z.object({
+                enabled: z.boolean(),
+                path: z.string().optional(),
+                status: z.enum(["loaded", "disabled", "unavailable"]).optional(),
+            }),
+            agentInstruction: z.string(),
+        }).optional(),
+        workspaceInstructions: z.array(z.object({
+            path: z.string(),
+            status: z.enum(["loaded", "disabled", "unavailable"]),
+        })).optional(),
         capabilityGuides: z.array(capabilityGuideOutputSchema).optional(),
         agentsFiles: z.array(workspaceAgentsFileOutputSchema).optional(),
         availableAgentsFiles: z.array(workspaceAvailableAgentsFileOutputSchema).optional(),

package/dist/mcp/server/workspace/runtime/workspace-open.js

@@ -402,6 +402,7 @@ async function handleOpenWorkspace(options, input, extra) {
                 ? `Members: ${composite.members.map((member) => `${member.name} — ${member.purpose}`).join("; ")}.`
                 : "This Composite Workspace currently has no members.",
             "Member names and purposes are structural context and are always returned when this Composite Workspace is opened. context=auto/full/none controls only heavy member bootstrap context, not this Composite identity.",
+            "Composite members may execute on different operating systems and command shells. Never treat one member's shell syntax or privilege level as a Composite-wide default; memberContext.executionContext is authoritative for the selected member and overrides the Gateway shell identity.",
             compositeCapabilityCatalog.length > 0
                 ? `Composite-owned capabilities: ${compositeCapabilityCatalog.map((entry) => entry.name).join(", ")}. Use these without member because their state belongs to the Composite Workspace itself.`
                 : undefined,
@@ -523,6 +524,12 @@ async function handleOpenWorkspace(options, input, extra) {
                 ...(opened.capabilityCatalog !== undefined
                     ? { capabilityCatalog: opened.capabilityCatalog }
                     : {}),
+                ...(opened.executionContext !== undefined
+                    ? { executionContext: opened.executionContext }
+                    : {}),
+                ...(opened.workspaceInstructions !== undefined
+                    ? { workspaceInstructions: opened.workspaceInstructions }
+                    : {}),
                 ...(opened.capabilityGuides !== undefined
                     ? { capabilityGuides: opened.capabilityGuides }
                     : {}),

package/dist/mcp/server-instructions.js

@@ -1,4 +1,4 @@
-import { commandShellAgentInstruction } from "../runtime/shell/command-shell-runtime.js";
+import { commandShellAgentInstruction, formatCommandShellRuntime, snapshotCommandShellRuntime, } from "../runtime/shell/command-shell-runtime.js";
 export const toolNames = {
     openWorkspace: "open_workspace",
     closeWorkspace: "close_workspace",
@@ -11,6 +11,28 @@ export const toolNames = {
     writeStdin: "write_stdin",
     capability: "capability",
 };
+export function buildExecutionShellContext(config, shellInstruction) {
+    const platform = config.runtimePrivilege?.platform ?? process.platform;
+    const commandShellRuntime = snapshotCommandShellRuntime(config.commandShellRuntime);
+    const runtimePrivilege = config.runtimePrivilege
+        ? { ...config.runtimePrivilege }
+        : undefined;
+    const scopeInstruction = [
+        `Execution Workspace runtime: platform=${platform}; shell=${formatCommandShellRuntime(commandShellRuntime)}.`,
+        "For commands routed to this Workspace or Composite member, this execution context overrides the Gateway ForgeRelay shell identity.",
+    ].join(" ");
+    const agentInstruction = joinInstructions(scopeInstruction, commandShellAgentInstruction(commandShellRuntime), runtimePrivilegeInstructions(config));
+    return {
+        platform,
+        commandShellRuntime,
+        ...(runtimePrivilege ? { runtimePrivilege } : {}),
+        shellInstructions: {
+            enabled: config.shellInstructionsEnabled,
+            ...(shellInstruction ? shellInstruction : {}),
+        },
+        agentInstruction,
+    };
+}
 export function buildShellMutationPolicy() {
     return "Shell commands may modify ordinary project files when that is a natural part of the user's requested development task. They may also perform external device or hardware mutations when the user's current request explicitly asks for the actual device-changing operation, including firmware flashing or equivalent persistent device updates; do not infer such authorization from a check, audit, probe, backup, verification, dry-run, or build-only request. Never use shell commands to modify security- or privilege-sensitive operating-system files or credential material such as /etc/sudoers, /etc/passwd, /etc/shadow, PAM or authentication policy, SSH private keys, or equivalent privileged system files. Modify configuration files through shell only when the user's request explicitly calls for that configuration change; do not infer permission merely because changing configuration would be convenient.";
 }

package/dist/server.js

@@ -13,7 +13,7 @@ import { CodeIntelligenceError } from "./lsp/code-intelligence.js";
 import { installManagedLanguageServers, installedManagedLanguageServers, supportedManagedLanguageServers, } from "./lsp/runtime/managed-language-servers.js";
 import { HookRunner } from "./mcp/hooks/hooks.js";
 import { checkHookConfiguration } from "./mcp/hooks/hook-cli.js";
-import { buildServerInstructions, buildToolDescriptions, toolNames } from "./mcp/server-instructions.js";
+import { buildExecutionShellContext, buildServerInstructions, buildToolDescriptions, toolNames } from "./mcp/server-instructions.js";
 import { IncomingArtifactAdapterRegistry } from "./mcp/artifacts/incoming-artifacts.js";
 import { registerProcessTools } from "./mcp/process/tools.js";
 import { attachCompletedProcessNotices, recordBashCompletion } from "./mcp/process/runtime.js";
@@ -303,6 +303,19 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             artifactDownloadSupported: isArtifactDownloadSupportedPlatform(),
         });
         const capabilityCatalog = capabilityRegistry.catalog(capabilityContextFor(workspace));
+        const workspaceInstructions = workspace.workspaceInstructions.map((instruction) => ({
+            path: formatAgentsPath(instruction.path, workspace.root),
+            status: instruction.status,
+        }));
+        const rawShellInstruction = config.shellInstructionPath
+            ? workspace.workspaceInstructions.find((instruction) => instruction.path === config.shellInstructionPath)
+            : undefined;
+        const executionContext = buildExecutionShellContext(config, rawShellInstruction
+            ? {
+                path: formatAgentsPath(rawShellInstruction.path, workspace.root),
+                status: rawShellInstruction.status,
+            }
+            : undefined);
         const agentsFiles = opened.agentsFiles.map((file) => ({
             path: formatAgentsPath(file.path, workspace.root),
             content: file.content,
@@ -338,6 +351,8 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             contextFingerprint: opened.contextFingerprint,
             capabilityFingerprint,
             capabilityCatalog,
+            workspaceInstructions,
+            executionContext,
             includeBootstrapContext: opened.includeBootstrapContext,
             ...(bootstrapComponents.has("capabilityGuides") ? { capabilityGuides } : {}),
             ...(bootstrapComponents.has("agentsFiles") ? { agentsFiles } : {}),
@@ -347,11 +362,14 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...(bootstrapComponents.has("skillDiagnostics")
                 ? { skillDiagnostics: redactSkillDiagnosticPaths(workspace.skillDiagnostics) }
                 : {}),
-            instruction: opened.includeBootstrapContext
-                ? `Bootstrap context for Composite member ${memberName}. Keep using Composite workspaceId ${compositeWorkspaceId} and pass member=${memberName} for work operations.`
-                : contextPolicy === "none"
-                    ? `Bootstrap context for Composite member ${memberName} was intentionally suppressed by context=none. Keep using Composite workspaceId ${compositeWorkspaceId} with member=${memberName}; request context=auto or context=full when member bootstrap is needed.`
-                    : `Composite member ${memberName} context was already delivered for this Host context; keep using Composite workspaceId ${compositeWorkspaceId} with member=${memberName}.`,
+            instruction: [
+                opened.includeBootstrapContext
+                    ? `Bootstrap context for Composite member ${memberName}. Keep using Composite workspaceId ${compositeWorkspaceId} and pass member=${memberName} for work operations.`
+                    : contextPolicy === "none"
+                        ? `Bootstrap context for Composite member ${memberName} was intentionally suppressed by context=none. Keep using Composite workspaceId ${compositeWorkspaceId} with member=${memberName}; request context=auto or context=full when member bootstrap is needed.`
+                        : `Composite member ${memberName} context was already delivered for this Host context; keep using Composite workspaceId ${compositeWorkspaceId} with member=${memberName}.`,
+                executionContext.agentInstruction,
+            ].join(" "),
         };
     };
     const operationRuntime = createOperationRuntime({