@akon-labs/nexus-cli 0.1.9 → 0.1.11-rc.2

package/docs/mcp.md

@@ -0,0 +1,178 @@
+# MCP
+
+Nexus includes a native Model Context Protocol client. No extension package is required.
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `/mcp` | Open the server, connection, authentication, and direct-tool panel |
+| `/mcp status` | Show text server status |
+| `/mcp setup` | Discover existing configurations, import them, or add a known server |
+| `/mcp reconnect [server]` | Reconnect one server or every server |
+| `/mcp tools` | List discovered MCP tools |
+| `/mcp prompts` | List MCP prompts and their generated slash commands |
+| `/mcp enable <server>` | Enable a server through a project override |
+| `/mcp disable <server>` | Disable a server through a project override |
+| `/mcp logout <server>` | Remove stored OAuth credentials |
+| `/mcp token status\|remove <server>` | Inspect or remove an OS-stored bearer token |
+| `/mcp-auth [server]` | Open OAuth management or authenticate one server |
+
+Project configuration and project overrides are available only in trusted projects. Global MCP remains available in untrusted projects.
+
+## Configuration
+
+Nexus loads configuration in this order; later definitions override earlier definitions with the same server name:
+
+1. `~/.config/nexus/mcp.json`
+2. `.nexus/mcp.json` for trusted projects
+
+Both files use an `mcpServers` object and optional `settings` and `imports` fields.
+
+### Local stdio server
+
+```json
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "."],
+      "env": {
+        "LOG_LEVEL": "info"
+      },
+      "lifecycle": "lazy"
+    }
+  }
+}
+```
+
+### Hosted HTTP server with OAuth
+
+```json
+{
+  "mcpServers": {
+    "notion": {
+      "url": "https://mcp.notion.com/mcp",
+      "auth": "oauth",
+      "protocolVersion": "auto"
+    }
+  }
+}
+```
+
+### Bearer authentication
+
+Prefer an environment variable instead of storing a token in JSON:
+
+```json
+{
+  "mcpServers": {
+    "internal": {
+      "url": "https://mcp.example.com/mcp",
+      "auth": "bearer",
+      "bearerTokenEnv": "INTERNAL_MCP_TOKEN"
+    }
+  }
+}
+```
+
+Header and environment values support `${NAME}`, `$env:NAME`, and `{env:NAME}` interpolation. A value beginning with `!` executes a trusted command and uses its output as the secret; `!!` escapes a literal leading `!`.
+
+### Import another client’s configuration
+
+```json
+{
+  "imports": ["cursor", "claude-code", "codex", "opencode", "vscode"],
+  "mcpServers": {}
+}
+```
+
+Imports are explicit. Nexus never requires another client or package at runtime.
+
+## Server options
+
+Common server fields include:
+
+- Transport: `command`, `args`, `env`, `cwd`, `url`, `headers`, or `socket`
+- Authentication: `auth`, `oauth`, `bearerTokenEnv`, `bearerTokenStore`, `requestHeadersCommand`
+- Lifecycle: `lazy`, `eager`, `keep-alive`, or `lazy-keep-alive`
+- Discovery: `includeTools`, `excludeTools`, `exposeResources`, `searchKeywords`
+- Tool surface: `directTools`, `toolPrefix`, `approveTools`
+- Runtime: `idleTimeout`, `requestTimeoutMs`, `protocolVersion`, `debug`, `trace`
+- State: `disabled: true`
+
+Only one transport—`command`, `url`, or `socket`—may be configured per server.
+
+## Tool surfaces
+
+Nexus always provides the `mcp` gateway tool for status, discovery, descriptions, authentication, connections, and individual calls. It also provides `mcpScript`, a bounded worker for multi-call JavaScript orchestration.
+
+Frequently used MCP tools can be registered directly:
+
+```json
+{
+  "mcpServers": {
+    "github": {
+      "url": "https://example.com/mcp",
+      "directTools": ["search_issues", "get_issue"]
+    }
+  },
+  "settings": {
+    "toolPrefix": "server"
+  }
+}
+```
+
+Direct-tool metadata is cached and refreshed when servers reconnect or publish list-change notifications. The `/mcp` panel can enable direct tools without restarting the current session.
+
+## Protocol capabilities
+
+The native runtime supports:
+
+- stdio, Streamable HTTP, legacy SSE fallback, and Unix-domain sockets
+- modern protocol negotiation with legacy compatibility
+- tools, resources, prompts, server instructions, and list-change notifications
+- OAuth 2.1 with PKCE, dynamic client registration, client credentials, and manual remote completion
+- secure OS credential storage for OAuth and optional bearer tokens
+- MCP sampling with user approval
+- form and URL elicitation
+- MCP Apps/AppBridge resources in a sandboxed local viewer
+- bounded output with private spill files
+- lazy startup, idle shutdown, keep-alive recovery, and stale-session reconnection
+- per-tool approval gates and metadata-only protocol tracing
+
+Connection failures are non-fatal: Nexus reports the failed server and continues with the remaining tools.
+
+## Settings
+
+Useful top-level settings include:
+
+```json
+{
+  "settings": {
+    "directTools": false,
+    "scriptMode": true,
+    "autoAuth": false,
+    "sampling": true,
+    "elicitation": true,
+    "idleTimeout": 10,
+    "mcpFooterStatus": "full",
+    "outputGuard": true,
+    "toolResultRendering": "compact"
+  },
+  "mcpServers": {}
+}
+```
+
+## Environment controls
+
+| Variable | Purpose |
+|----------|---------|
+| `MCP_DIRECT_TOOLS` | Override direct-tool selection; use `__none__` to disable it |
+| `MCP_OUTPUT_GUARD` | Enable or disable bounded MCP output |
+| `MCP_OAUTH_CALLBACK_PORT` | Set the local OAuth callback port |
+| `MCP_OAUTH_DIR` | Legacy plaintext credential import directory only |
+| `MCP_UI_VIEWER` | Select `browser`, `glimpse`, or `none` |
+| `MCP_UI_DEBUG` | Enable MCP UI debug logging |
+
+Nexus consumes MCP servers; it does not expose Nexus itself as an MCP server.

package/docs/pi-subagents.md

@@ -0,0 +1,75 @@
+# Subagents (bundled pi-subagents) with worker-scope billing
+
+Nexus ships [pi-subagents](https://github.com/nicobailon/pi-subagents) inside the CLI.
+Nothing to install: every session has the `subagent` tool, the built-in agents
+(`scout`, `researcher`, `worker`, `reviewer`, `oracle`, `delegate`), the fleet view,
+and the `/parallel-research`, `/review-loop` and `/council` workflows.
+
+## Two-tier billing, automatically
+
+The orchestrator (your session) bills the Hub's **orchestrator** deployment. Every
+subagent child bills the **worker** deployment, because the CLI marks each child
+spawned by pi-subagents as a delegated worker: the child self-mints a one-time worker
+grant per model turn (`POST /llm/worker-grants`) and the gateway consumes it and
+reserves the request as `worker`. Minting is fail-closed — a child whose grant is
+missing sends an invalid sentinel and the gateway rejects the request, so a child can
+never silently bill as orchestrator.
+
+Agents listed in `NEXUS_BIG_MODEL_AGENTS` (default `oracle`) are deliberately left
+unmarked and bill the orchestrator deployment. That is the escalation path: ask
+`oracle` when a subagent needs the big model.
+
+Model identity stays server-side in the Hub's experiment groups; swapping deployments
+never touches agent configuration.
+
+## Orchestrator policy
+
+With bundled subagents active, the orchestrator session:
+
+- **cannot run `bash`, `write`, or `edit` directly** — implementation, shell, tests and
+  long tool loops go through `subagent` (this is the cost guarantee);
+- keeps **unlimited** direct reads, greps and GitNexus graph queries;
+- is told to fan out `scout`/`researcher` subagents (or `/parallel-research`) for
+  broad research and to run long investigations in the background.
+
+`NEXUS_PARENT_POLICY=off` restores direct mutating tools for one session.
+
+## Limits follow pi-subagents
+
+No concurrency, spawn, or timeout limits are layered on top of pi-subagents: its own
+defaults apply (20 concurrent children per run, 4 per parallel group, 64 spawns per
+run, 30-minute run deadline). Capacity is the Hub's concern — the gateway caps in-flight
+requests per user by role (orchestrator and worker separately), so a fan-out of cheap
+workers never competes with the orchestrator's own turn.
+
+The web search tool is registered under pi-web-access's canonical name `web_search`,
+so pi-subagents' builtin `researcher` and any other pi package that expects it work
+unmodified.
+
+## Legacy `delegate_task`
+
+The Hub-driven `delegate_task` worker is no longer registered by default. Set
+`NEXUS_DELEGATION_MODE=internal` to get it back (its 5-minute worker timeout and
+single-worker cap apply there).
+
+## Environment knobs
+
+| Variable | Default | Effect |
+|---|---|---|
+| `NEXUS_DELEGATION_MODE` | `external` | `internal` re-enables `delegate_task` instead of bundled subagents. |
+| `NEXUS_BUNDLED_PACKAGES` | on | `off` stops loading CLI-bundled packages (pi-subagents) and flips delegation to internal. |
+| `NEXUS_BIG_MODEL_AGENTS` | `oracle` | Comma-separated agents that bill the orchestrator deployment. Empty string puts every agent on the worker deployment. |
+| `NEXUS_WORKER_SCOPE` | on | `off` leaves all children on the orchestrator deployment. |
+| `NEXUS_PARENT_POLICY` | on | `off` lets the orchestrator run bash/write/edit directly. |
+| `NEXUS_SUBAGENT_BINARY` | this CLI | Executable pi-subagents spawns for children (alias of `PI_SUBAGENT_PI_BINARY`). Any `NEXUS_SUBAGENT_X` maps to `PI_SUBAGENT_X`; explicit `PI_*` wins. |
+
+A user-installed `npm:pi-subagents` package (project or global) replaces the bundled
+copy, so pinning a different version still works.
+
+## Verification
+
+`test/suite/bundled-subagents.test.ts` covers child marking, tiering, the binary
+default and the orchestrator policy; `test/suite/worker-scope-stub-hub.test.ts` drives
+a stub Hub end to end and asserts the exact grant/scope headers per persona.
+`scripts/nexus-subagent-worker` remains as an optional wrapper for builds that cannot
+mark children in-process.

package/docs/quickstart.md

@@ -47,7 +47,7 @@ GitNexus credentials are stored in `~/.config/nexus/auth.json`.
 
 ## Configure a model provider
 
-Nexus supports provider subscriptions, API keys, and local Ollama models through `/byok`.
+Nexus supports other provider subscriptions and API keys through `/byok`.
 
 ### Option 1: subscription or stored API key
 

package/docs/usage.md

@@ -37,10 +37,11 @@ Type `/` in the editor to open command completion. Extensions can register custo
 | Command | Description |
 |---------|-------------|
 | `/login` | Sign in to GitNexus |
-| `/byok [provider\|ollama]` | Configure a cloud provider, API key, or local Ollama model |
+| `/byok [provider]` | Use another subscription or cloud provider |
 | `/logout` | Remove stored model-provider credentials |
 | `/gitnexus-status` | Show the GitNexus connection status |
 | [`/llama`](llama-cpp.md) | Download, load, and unload llama.cpp router models |
+| `/nexus-agent` | Switch back to Nexus Agent |
 | `/model` | Switch models |
 | `/scoped-models` | Enable/disable models for Ctrl+P cycling |
 | `/settings` | Thinking level, theme, message delivery, transport |

package/examples/extensions/pi-subagents-worker-policy.ts

@@ -0,0 +1,86 @@
+/**
+ * worker-policy — parent-session delegation policy for the pi-subagents swap.
+ *
+ * Replaces the old delegate_task parent gating (review-only allowlist + 8-call
+ * read budget) with the tuning we settled on:
+ *   - HARD-block mutating tools on the orchestrator (bash/write/edit): all
+ *     implementation goes through the `subagent` tool.
+ *   - NO read budget: reads, greps and gitnexus graph calls are cheap on
+ *     cached input and capping them measurably hurt output quality.
+ *   - Prompt-level steering for everything else.
+ *
+ * Scope guards: the policy applies only to the top-level orchestrator session
+ * on the gitnexus/auto model. It must never fire inside delegated workers or
+ * pi-subagents children (they do the mutating work), and NEXUS_PARENT_POLICY=off
+ * disables it entirely.
+ */
+
+// Nexus-branded env aliases: users configure NEXUS_SUBAGENT_*; we map them
+// onto the PI_SUBAGENT_* names the upstream pi-subagents package reads.
+// Explicit PI_* values win (they are the wire format, aliases are sugar).
+if (process.env.NEXUS_SUBAGENT_BINARY?.trim() && !process.env.PI_SUBAGENT_PI_BINARY?.trim()) {
+	process.env.PI_SUBAGENT_PI_BINARY = process.env.NEXUS_SUBAGENT_BINARY;
+}
+for (const [key, value] of Object.entries(process.env)) {
+	if (!key.startsWith("NEXUS_SUBAGENT_") || key === "NEXUS_SUBAGENT_BINARY" || !value?.trim()) continue;
+	const target = `PI_SUBAGENT_${key.slice("NEXUS_SUBAGENT_".length)}`;
+	if (!process.env[target]?.trim()) process.env[target] = value;
+}
+
+// Self-contained activation: plain `nexus` in this repo gets worker-scope
+// billing with no shell setup. Explicit env always wins over these defaults.
+const WORKER_WRAPPER = `${process.env.HOME}/.local/bin/nexus-subagent-worker`;
+if (!process.env.PI_SUBAGENT_PI_BINARY?.trim()) {
+	process.env.PI_SUBAGENT_PI_BINARY = WORKER_WRAPPER;
+}
+if (!process.env.NEXUS_BIG_MODEL_AGENTS?.trim()) {
+	process.env.NEXUS_BIG_MODEL_AGENTS = "oracle";
+}
+if (!process.env.NEXUS_DELEGATION_MODE?.trim()) {
+	process.env.NEXUS_DELEGATION_MODE = "external";
+}
+
+const BLOCKED_PARENT_TOOLS = new Set(["bash", "write", "edit", "delegate_task"]);
+
+const POLICY_PROMPT = [
+	"",
+	"Delegation policy: you are the orchestrator. Perform implementation, mutation,",
+	"shell commands, tests, and long repetitive tool loops through the `subagent`",
+	"tool (worker/reviewer/scout agents). Direct bash/write/edit are disabled in",
+	"this session. Reading files and querying the GitNexus graph directly is fine",
+	"and unlimited — prefer graph queries (gitnexus_query/context/impact) to locate",
+	"code before delegating. Keep planning, user communication, and final review here.",
+].join("\n");
+
+function isAuto(model: { provider?: string; id?: string } | undefined): boolean {
+	return model?.provider === "gitnexus" && model?.id === "auto";
+}
+
+function policyDisabled(): boolean {
+	return (
+		process.env.NEXUS_PARENT_POLICY === "off" ||
+		process.env.NEXUS_INTERNAL_DELEGATED_WORKER === "1" ||
+		Boolean(process.env.PI_SUBAGENT_CHILD_AGENT?.trim())
+	);
+}
+
+export default function workerPolicy(pi: any) {
+	if (policyDisabled()) return;
+
+	pi.on("before_agent_start", (event: any) => {
+		if (policyDisabled()) return;
+		return { systemPrompt: `${event.systemPrompt}\n${POLICY_PROMPT}` };
+	});
+
+	pi.on("tool_call", (event: any, ctx: any) => {
+		if (policyDisabled() || !isAuto(ctx?.model)) return;
+		if (!BLOCKED_PARENT_TOOLS.has(event.toolName)) return;
+		return {
+			block: true,
+			reason:
+				"This orchestrator session does not run mutating tools directly. " +
+				"Use the `subagent` tool (worker for implementation, reviewer for checks, " +
+				"scout for exploration) to execute this, then review its report.",
+		};
+	});
+}

package/native/win32/build.mjs

@@ -0,0 +1,95 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const sourceFile = path.join(scriptDir, "src", "hidden-spawn.c");
+const hostArch = process.arch === "arm64" ? "arm64" : "x64";
+const temporaryDir = mkdtempSync(path.join(tmpdir(), "nexus-hidden-spawn-"));
+
+function removeTemporaryDir() {
+	rmSync(temporaryDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+}
+
+process.on("exit", removeTemporaryDir);
+
+function quoteBatch(value) {
+	return `"${value.replaceAll('"', '""')}"`;
+}
+
+function findVisualStudioDevCmd() {
+	const candidates = [];
+	const programFilesX86 = process.env["ProgramFiles(x86)"];
+	if (programFilesX86) {
+		const vswhere = path.join(programFilesX86, "Microsoft Visual Studio", "Installer", "vswhere.exe");
+		if (existsSync(vswhere)) {
+			const result = spawnSync(
+				vswhere,
+				["-latest", "-products", "*", "-requires", "Microsoft.VisualStudio.Component.VC.Tools.x86.x64", "-property", "installationPath"],
+				{ encoding: "utf8" },
+			);
+			for (const line of (result.stdout ?? "").split(/\r?\n/)) {
+				const installationPath = line.trim();
+				if (installationPath) candidates.push(path.join(installationPath, "Common7", "Tools", "VsDevCmd.bat"));
+			}
+		}
+	}
+	for (const base of [process.env.ProgramFiles, programFilesX86]) {
+		if (!base) continue;
+		for (const edition of ["BuildTools", "Community", "Professional", "Enterprise"]) {
+			candidates.push(path.join(base, "Microsoft Visual Studio", "2022", edition, "Common7", "Tools", "VsDevCmd.bat"));
+			candidates.push(path.join(base, "Microsoft Visual Studio", "18", edition, "Common7", "Tools", "VsDevCmd.bat"));
+		}
+	}
+	return candidates.find((candidate) => existsSync(candidate));
+}
+
+const vsDevCmd = findVisualStudioDevCmd();
+if (!vsDevCmd) {
+	throw new Error("Microsoft C++ Build Tools are required to build hidden-spawn.exe (VsDevCmd.bat not found).");
+}
+
+const buildDir = path.join(temporaryDir, "msvc");
+const temporaryOutput = path.join(buildDir, "hidden-spawn.exe");
+mkdirSync(buildDir, { recursive: true });
+const batchFile = path.join(buildDir, "build.cmd");
+const msvcArch = hostArch === "arm64" ? "arm64" : "x64";
+writeFileSync(
+	batchFile,
+	[
+		"@echo off",
+		`call ${quoteBatch(vsDevCmd)} -no_logo -arch=${msvcArch} -host_arch=${msvcArch}`,
+		"if errorlevel 1 exit /b %errorlevel%",
+		[
+			"cl",
+			"/nologo",
+			"/TC",
+			"/W4",
+			"/O1",
+			"/GS-",
+			`/Fe:${quoteBatch(temporaryOutput)}`,
+			quoteBatch(sourceFile),
+			"/link",
+			"/SUBSYSTEM:WINDOWS",
+			"/ENTRY:entry",
+			"/NODEFAULTLIB",
+			"kernel32.lib",
+			"/OPT:REF",
+			"/OPT:ICF",
+		].join(" "),
+		"if errorlevel 1 exit /b %errorlevel%",
+	].join("\r\n"),
+);
+
+const result = spawnSync("cmd.exe", ["/d", "/s", "/c", batchFile], { cwd: buildDir, stdio: "inherit" });
+if (result.error) throw result.error;
+if (result.status !== 0) throw new Error(`cl.exe failed with exit code ${result.status ?? 1}`);
+
+const outputDir = path.join(scriptDir, "prebuilds", `win32-${hostArch}`);
+mkdirSync(outputDir, { recursive: true });
+const output = path.join(outputDir, "hidden-spawn.exe");
+copyFileSync(temporaryOutput, output);
+chmodSync(output, 0o755);
+console.log(`Built ${output}`);

package/native/win32/src/hidden-spawn.c

@@ -0,0 +1,157 @@
+/*
+ * Windowless relauncher for Nexus child processes on Windows.
+ *
+ * Node's windowsHide flag asks libuv to both CREATE_NO_WINDOW and SW_HIDE.
+ * SW_HIDE runs after the console window has already been created, so a
+ * console-subsystem child (node.exe, nexus.exe) flashes for a frame. This
+ * process is itself built as SUBSYSTEM:WINDOWS, so spawning it allocates no
+ * console. It then starts the real CLI with CREATE_NO_WINDOW and without
+ * STARTF_USESHOWWINDOW, forwarding the stdio handles it was given.
+ *
+ * No C runtime: the only import is kernel32.
+ */
+
+#include <windows.h>
+
+#define CREATE_NO_WINDOW 0x08000000
+
+static void zero_bytes(void *memory, size_t size) {
+	unsigned char *bytes = (unsigned char *)memory;
+	for (size_t index = 0; index < size; index++) bytes[index] = 0;
+}
+
+/* The compiler emits memset for struct clears. Provide it so /NODEFAULTLIB still links. */
+void *memset(void *destination, int value, size_t count) {
+	unsigned char *bytes = (unsigned char *)destination;
+	while (count-- > 0) *bytes++ = (unsigned char)value;
+	return destination;
+}
+
+static void *heap_alloc(size_t bytes) {
+	return HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bytes);
+}
+
+static void make_inheritable(HANDLE handle) {
+	if (handle != NULL && handle != INVALID_HANDLE_VALUE) {
+		SetHandleInformation(handle, HANDLE_FLAG_INHERIT, HANDLE_FLAG_INHERIT);
+	}
+}
+
+/* Skip the image name libuv placed at the front of this process's command line. */
+static const wchar_t *skip_argv0(const wchar_t *command) {
+	if (*command == L'"') {
+		command++;
+		while (*command != L'\0' && *command != L'"') command++;
+		if (*command == L'"') command++;
+	} else {
+		while (*command != L'\0' && *command != L' ' && *command != L'\t') command++;
+	}
+	while (*command == L' ' || *command == L'\t') command++;
+	return command;
+}
+
+static int append_quoted(wchar_t **cursor, wchar_t *end, const wchar_t *value) {
+	wchar_t *write = *cursor;
+	if (write >= end) return 0;
+	*write++ = L'"';
+	while (*value != L'\0') {
+		if (write >= end - 1) return 0;
+		*write++ = *value++;
+	}
+	if (write >= end) return 0;
+	*write++ = L'"';
+	*cursor = write;
+	return 1;
+}
+
+static int append_raw(wchar_t **cursor, wchar_t *end, const wchar_t *value) {
+	wchar_t *write = *cursor;
+	while (*value != L'\0') {
+		if (write >= end) return 0;
+		*write++ = *value++;
+	}
+	*cursor = write;
+	return 1;
+}
+
+static DWORD read_env(const wchar_t *name, wchar_t *buffer, DWORD capacity) {
+	DWORD length = GetEnvironmentVariableW(name, buffer, capacity);
+	if (length == 0 || length >= capacity) return 0;
+	return length;
+}
+
+static DWORD run(void) {
+	wchar_t *target;
+	wchar_t *script;
+	wchar_t *command_line;
+	const wchar_t *tail;
+	wchar_t *cursor;
+	wchar_t *end;
+	STARTUPINFOW startup;
+	PROCESS_INFORMATION process;
+	HANDLE job;
+	JOBOBJECT_EXTENDED_LIMIT_INFORMATION limits;
+	DWORD flags;
+	DWORD exit_code = 1;
+	int have_script;
+
+	target = (wchar_t *)heap_alloc(32768 * sizeof(wchar_t));
+	script = (wchar_t *)heap_alloc(32768 * sizeof(wchar_t));
+	command_line = (wchar_t *)heap_alloc(32768 * sizeof(wchar_t));
+	if (target == NULL || script == NULL || command_line == NULL) return 1;
+
+	if (read_env(L"NEXUS_HIDDEN_SPAWN_TARGET", target, 32768) == 0) return 1;
+	have_script = read_env(L"NEXUS_HIDDEN_SPAWN_SCRIPT", script, 32768) != 0;
+	tail = skip_argv0(GetCommandLineW());
+
+	cursor = command_line;
+	end = command_line + 32767;
+	if (!append_quoted(&cursor, end, target)) return 1;
+	if (have_script) {
+		if (!append_raw(&cursor, end, L" ")) return 1;
+		if (!append_quoted(&cursor, end, script)) return 1;
+	}
+	if (*tail != L'\0') {
+		if (!append_raw(&cursor, end, L" ")) return 1;
+		if (!append_raw(&cursor, end, tail)) return 1;
+	}
+	if (cursor >= end) return 1;
+	*cursor = L'\0';
+
+	zero_bytes(&startup, sizeof startup);
+	startup.cb = sizeof startup;
+	startup.dwFlags = STARTF_USESTDHANDLES;
+	startup.hStdInput = GetStdHandle(STD_INPUT_HANDLE);
+	startup.hStdOutput = GetStdHandle(STD_OUTPUT_HANDLE);
+	startup.hStdError = GetStdHandle(STD_ERROR_HANDLE);
+	make_inheritable(startup.hStdInput);
+	make_inheritable(startup.hStdOutput);
+	make_inheritable(startup.hStdError);
+
+	zero_bytes(&process, sizeof process);
+	flags = CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT | CREATE_SUSPENDED;
+	if (!CreateProcessW(target, command_line, NULL, NULL, TRUE, flags, NULL, NULL, &startup, &process)) {
+		return 1;
+	}
+
+	job = CreateJobObjectW(NULL, NULL);
+	if (job != NULL) {
+		zero_bytes(&limits, sizeof limits);
+		limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+		if (SetInformationJobObject(job, JobObjectExtendedLimitInformation, &limits, sizeof limits)) {
+			AssignProcessToJobObject(job, process.hProcess);
+		}
+	}
+
+	ResumeThread(process.hThread);
+	WaitForSingleObject(process.hProcess, INFINITE);
+	if (!GetExitCodeProcess(process.hProcess, &exit_code)) exit_code = 1;
+	CloseHandle(process.hThread);
+	CloseHandle(process.hProcess);
+	if (job != NULL) CloseHandle(job);
+	return exit_code;
+}
+
+void entry(void) {
+	ExitProcess(run());
+}