@bitkyc08/opencodex 2.17.1-preview.20260814 → 2.19.0

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "ea31a2eb2b20c73612941be94d65d765e871282cb0a2410de5f34417f890dbd1"
+      "sha256": "4b1881e599a19c6a02309927d634f2bf2a45a93da5762d63e37e5795d103713e"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -46,7 +46,7 @@
     },
     {
       "path": "src/adapters/client-fingerprint.ts",
-      "sha256": "6954cdf0885a7b55d179926117239c90e7f938b23ffd8c1b02392d183df4a253"
+      "sha256": "6494cb40aefb337db3584489d1544d7ae623445dd3c81e5e34a30c77312f4e69"
     },
     {
       "path": "src/adapters/command-code.ts",
@@ -102,7 +102,7 @@
     },
     {
       "path": "src/adapters/cursor/live-transport.ts",
-      "sha256": "7cc03eea3bb6b8ebd99dd134546e997d3eaf10e7c430a1bd7a0e3e283607ccef"
+      "sha256": "247e48058e2d22e282d2d49652cde998c5d13f36197898562510d99746993711"
     },
     {
       "path": "src/adapters/cursor/mcp-config.ts",
@@ -150,7 +150,7 @@
     },
     {
       "path": "src/adapters/cursor/protobuf-events.ts",
-      "sha256": "a5732084a5562242b7184321723ecf1a6e0009080d69f82fbea3ac66969d135f"
+      "sha256": "16faa16a8f5eeb5022a2f7332bd0739189bf3cd5b6dc1267730b14a78786bc08"
     },
     {
       "path": "src/adapters/cursor/protobuf-request.ts",
@@ -166,7 +166,7 @@
     },
     {
       "path": "src/adapters/cursor/tool-definitions.ts",
-      "sha256": "be643963a3f36fe2c68bafb3f3a82ba5e9b59114d689f79cf83383c5852ff34f"
+      "sha256": "95b440c3456085df1216ed1eb2659025edfc49e6ba121bd8231b46f32fa88870"
     },
     {
       "path": "src/adapters/cursor/transport-retry.ts",
@@ -186,7 +186,7 @@
     },
     {
       "path": "src/adapters/google-antigravity-wire.ts",
-      "sha256": "1d4b78e8002aba15e94e222ab5e0b4adf1a1a2754922ff967c5be2acaa16a3dc"
+      "sha256": "1fa3361241026926754656cf8300ce513fefac86020d796cb985018192499797"
     },
     {
       "path": "src/adapters/google-errors.ts",
@@ -210,7 +210,7 @@
     },
     {
       "path": "src/adapters/google.ts",
-      "sha256": "b2e57cd169f7b2a044624d64df557aff05424c06c026ffd055f0e009770325a4"
+      "sha256": "7905d7c039bebc63a2fa968fc934570d5dedf882c474087bcf4d55e317641e63"
     },
     {
       "path": "src/adapters/identity.ts",
@@ -298,11 +298,11 @@
     },
     {
       "path": "src/bridge.ts",
-      "sha256": "137c6d4b5cc3e7c932fed242b5200469171ae786b4835bec7f667f15a1d79a75"
+      "sha256": "47ccd936f3abd32d98ea9f044d35acd353b16ee1c9f0f0542f4b519f63f52221"
     },
     {
       "path": "src/chat/inbound.ts",
-      "sha256": "747105ce3fb5cff8d5a8020e5df2a481fa218321a957717c2f6db0417e9fe690"
+      "sha256": "fe115207f0d5a4cf397e7e46a81b772f405363bd623481dc3fd4b2eec4bbf87e"
     },
     {
       "path": "src/chat/outbound.ts",
@@ -462,7 +462,7 @@
     },
     {
       "path": "src/cli/index.ts",
-      "sha256": "63e8747afb606295340bd30598d7112b75efb2a89353234a874df42c5fc7e1a7"
+      "sha256": "d8c530cd151adc3ecbc243a63d5297c8c18001345aaaa708842d854e854faa6a"
     },
     {
       "path": "src/cli/init.ts",
@@ -606,7 +606,7 @@
     },
     {
       "path": "src/codex/app-server-processes.ts",
-      "sha256": "66f866e499edc75d7530a1a9230e77e7d9f6553579c64141ba73630f6ea91a7d"
+      "sha256": "4c55315be736f3e8fb0e19569d96d1235592d07a10fd243aa16a9d6925227f5f"
     },
     {
       "path": "src/codex/auth-api.ts",
@@ -906,7 +906,7 @@
     },
     {
       "path": "src/codex/shim.ts",
-      "sha256": "f39249f3748a1c35b116677a0583704cba02cc99e3f320ac46356a24983d250c"
+      "sha256": "f779c71050a1b2c3d6c08c22dbb6597d393a106f20a27566cc949203dbdad837"
     },
     {
       "path": "src/codex/subagent-defaults.ts",
@@ -930,7 +930,7 @@
     },
     {
       "path": "src/codex/user-identity.ts",
-      "sha256": "f16cc31184e7e00128545f9c6b59664ed17f0a5f08c606cf3731f752493a1f23"
+      "sha256": "e2cb675b208f7ad2fdd64c5d05d9c439511f786f3887ea5cb54d87b6fe7fe8a2"
     },
     {
       "path": "src/codex/warmup.ts",
@@ -966,7 +966,7 @@
     },
     {
       "path": "src/config.ts",
-      "sha256": "d98507303396605a2f698448295572038d6f30f3593af58910d04ecec918e9b8"
+      "sha256": "142ca0d8026b63ddceb2b347b4f27dd6912b908ccf351016352e9423445fa2ef"
     },
     {
       "path": "src/generated/model-metadata.ts",
@@ -1530,7 +1530,7 @@
     },
     {
       "path": "src/lib/errors.ts",
-      "sha256": "0e0a2b5117cf32f981256ec550e1fcf43dc181c026258736a9ef65ec9046a47d"
+      "sha256": "39613acb1eaae98fa448296a9ea6e55e246e7348aebf3110d775ac05febae7df"
     },
     {
       "path": "src/lib/eventstream-decoder.ts",
@@ -1666,7 +1666,7 @@
     },
     {
       "path": "src/lib/token-estimate.ts",
-      "sha256": "2c3cc4b8193166ca100197ca22202b06ac98c02547ffe32f3e0f8720190b9897"
+      "sha256": "c90473299655c86ef0118f5a265a71c100bf92e52172d6464a16c8f6ea300ca5"
     },
     {
       "path": "src/lib/tool-argument-integers.ts",
@@ -1694,15 +1694,19 @@
     },
     {
       "path": "src/lib/windows-elevation.ts",
-      "sha256": "9ef8a94484a6c4a95d3270aa10302f8e747ce54efed926c640f0cbdac13e6c27"
+      "sha256": "eeb579420c42318232ffdf924dba46d3ec172fb7dd8d83930a2985dfbc875d4a"
     },
     {
       "path": "src/lib/windows-secret-acl.ts",
-      "sha256": "beefa22c1aef684743785fecd75cad6cd84bf8acdf035a16e64930ac3402da4c"
+      "sha256": "6cbb7d5a6d9e5a1d73058af79ac02611e5cebc01fc49c7daf39ab8b0f9b41f53"
+    },
+    {
+      "path": "src/lib/windows-text.ts",
+      "sha256": "b5b4505de8b0e99df6548e2c6359e57066378b3e1e7ef3fe210e8ecd4aec8367"
     },
     {
       "path": "src/lib/windows-user-principal.ts",
-      "sha256": "4830ed6cfeb040fb25603cd0f98079b56c46b8e325dc4bac0771ecd118a51cd4"
+      "sha256": "c8974defc31bc73364c57ef906befd5142e32467655cefbcf8f764db6ef5c896"
     },
     {
       "path": "src/lib/winsw.ts",
@@ -1770,7 +1774,7 @@
     },
     {
       "path": "src/oauth/index.ts",
-      "sha256": "cbe370cd31412914b4cd2f565fd519eb45897ebd4ec7284503f68926017e127d"
+      "sha256": "e42ad175a0eaf9a4ab524066ee825e81b4cd16c3671cb2051968f87a56c46cb7"
     },
     {
       "path": "src/oauth/key-providers.ts",
@@ -1810,7 +1814,7 @@
     },
     {
       "path": "src/oauth/store.ts",
-      "sha256": "dda6e0d1d63ef43291aba437fc63749808a85ca039bfbf3e98b82b0368718f4a"
+      "sha256": "61c14ad05498f0146aec503f8618a4249d8064967377c6c782437276c9ab0ac5"
     },
     {
       "path": "src/oauth/token-guardian.ts",
@@ -1838,7 +1842,7 @@
     },
     {
       "path": "src/providers/antigravity-models.ts",
-      "sha256": "cbe65f34a127ad44fd8f6bd2214553b238449b4f10d948d5ed67f4b163964874"
+      "sha256": "005e17707703842d91d9b18aa6f28375bda6b49efff07cb7642c597ee0bcdc8b"
     },
     {
       "path": "src/providers/api-keys.ts",
@@ -1866,7 +1870,7 @@
     },
     {
       "path": "src/providers/free-directory.ts",
-      "sha256": "cdcdb72b65bf2655bf9a8dd0a9b77d76ac35ebc8082c1065816a4fc9d785d2c4"
+      "sha256": "e984f4a79b202e702f4e73386c479fbe96293e6e99ac97d91ddd410e15999087"
     },
     {
       "path": "src/providers/github-copilot-transport.ts",
@@ -1938,7 +1942,7 @@
     },
     {
       "path": "src/providers/registry.ts",
-      "sha256": "7d6a712c9ae027d409c2d367ba77c13ceba46ecaab8199a68c3984c9ea5c4c04"
+      "sha256": "89cc6f2a0fb31b3b05df612e86f396682bc0e7e50bf4d9d733b870ed1307a880"
     },
     {
       "path": "src/providers/slug-codec.ts",
@@ -1982,11 +1986,11 @@
     },
     {
       "path": "src/responses/spill-store.ts",
-      "sha256": "c0cd3343d0803eb6d14203f19d6ee38f33110042d8aa896cc9f60bd422ca8f21"
+      "sha256": "a1239057ea7a156c562222a6f385a3bbd3f324cf346964cb6aae8185f47a3e34"
     },
     {
       "path": "src/responses/state.ts",
-      "sha256": "59952393060143aae734770fbf78761a8cc69e5b6335c6452bdf5ac7da686bb4"
+      "sha256": "761a96f2839ee22f7cea11f037424a13bd1dedb0f747f1bc35a81c91ca9b0bbd"
     },
     {
       "path": "src/responses/tool-groups.ts",
@@ -2106,7 +2110,7 @@
     },
     {
       "path": "src/server/chat-completions.ts",
-      "sha256": "7f3b9b2f0e9850e687d672266f7e6976f634b151ddbcf729b2373c5d31ef51cc"
+      "sha256": "31a6edac0e224e98bdfa3c46197388f5ef8067e2be2e25751b2a23fb7a1cdc96"
     },
     {
       "path": "src/server/claude-messages.ts",
@@ -2118,7 +2122,7 @@
     },
     {
       "path": "src/server/effort-policy.ts",
-      "sha256": "7ca86f1bdd5ab6e6cd58cf3fbb65a6c076359f4bc05a6c790ccceb05d071e350"
+      "sha256": "1678af1658f000101cb2c5f3273388953e642fbaf7e85771d425d057c4fd2a6f"
     },
     {
       "path": "src/server/github-copilot-responses-repair.ts",
@@ -2138,7 +2142,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "cc6461e629f1f5e373d81ebee0720a9ba85c7deedded457bbd398ac962e0e404"
+      "sha256": "e909c5777cac73894273ab6ce9a0e635dc55a74de726cc6a6f71c4409a695ba2"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2206,7 +2210,7 @@
     },
     {
       "path": "src/server/management/logs-usage-routes.ts",
-      "sha256": "645c8902e0d3b589a5b20a7d607fb9b40197f34a4c73945a4bf9fd91336bf15e"
+      "sha256": "0f4b36868f53fe7314ba5393f1270045eb8d260058620ab34f4aa343ce0b4b80"
     },
     {
       "path": "src/server/management/model-routes.ts",
@@ -2310,7 +2314,7 @@
     },
     {
       "path": "src/server/request-log.ts",
-      "sha256": "036af24421d796ba82cd52c8ed97dbead949a471c9a212fe74f1aed2b87edf8a"
+      "sha256": "e7111d92152cdedf0e771d719bddee0150124d14bcac13610662dcbed3b75869"
     },
     {
       "path": "src/server/responses-custom-tool-repair.ts",
@@ -2362,15 +2366,19 @@
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "b8e42c1e0be113256d7318ee6dc3dc4cb7d045867e9e5412ccdfd64fa07111cb"
+      "sha256": "d4eb9b247e29412896578bd59492a0983681210439d19188b992011b4963992d"
     },
     {
       "path": "src/server/responses/encrypted-payload.ts",
-      "sha256": "d0f83a3a8f5bdce327fe32e744f8bfbc8695e7cb2981a1dffc67daf8aa302d93"
+      "sha256": "0e48bc0b453fc6b037d334d06a6454af46d8214f29b286a197d0bfdee138e215"
     },
     {
       "path": "src/server/responses/fetch-helpers.ts",
-      "sha256": "c0dd5255a485b23fcef54378cd1ea2eac40f7824952050f8e9db9c3d02f0e2d2"
+      "sha256": "1043b5b66d5d8c43bd3600200d86cbd6bb5af5614bc4fa17bebc2134b854ca99"
+    },
+    {
+      "path": "src/server/responses/input-admission.ts",
+      "sha256": "961168288033b3bb4f1b9542e7ab329a0350d2c5fc44036d2e6cf39355d3b26c"
     },
     {
       "path": "src/server/responses/passthrough-error.ts",
@@ -2378,7 +2386,7 @@
     },
     {
       "path": "src/server/responses/policy-fallback.ts",
-      "sha256": "64592e4c703941f9d860d0f575a7944f16dbca487b08fd8d2536e0b92f188fca"
+      "sha256": "7f824ac3b25fa7b9716e81daec7fbfab75bd1c08098ab8195b22404922dae856"
     },
     {
       "path": "src/server/responses/terminal-guard.ts",
@@ -2390,7 +2398,7 @@
     },
     {
       "path": "src/server/responses/ws-upstream.ts",
-      "sha256": "f697ac29a3b1965c4d77531abd69ed382d938ed503c951834205cffe6d8e9757"
+      "sha256": "9d76c39ae90cb8a2256a851fddd25c8d508816689a2768d9d578ff1ee908ae61"
     },
     {
       "path": "src/server/search.ts",
@@ -2430,11 +2438,11 @@
     },
     {
       "path": "src/service-manager-probe.ts",
-      "sha256": "ec12b537eccc4310ad07ea504da84e99331ded66e233bb0e54945f8b781bf932"
+      "sha256": "debddd154561e93532edb423bf53dc917c6619ea980d7061368c22a512b29200"
     },
     {
       "path": "src/service.ts",
-      "sha256": "1438465d669c54759319ed6a689517967ed8fc66463870dda547ac123d43c0df"
+      "sha256": "da173595e82233c5b20b78026255027004f0eea388fc66a7bf073229dd69e45e"
     },
     {
       "path": "src/stall-timeout.ts",
@@ -2506,11 +2514,11 @@
     },
     {
       "path": "src/tray/windows.ts",
-      "sha256": "3ca49da1758a7d82be178f4370bed3f1a62bfd052d83b6f79575c19b1d69c1bd"
+      "sha256": "d571ce0ea715feeb5aebd1f623a06b604f7b1e7f3445fca6ea755bd871415746"
     },
     {
       "path": "src/types.ts",
-      "sha256": "b04403f46247c96634d0c8c6344c1ecc44979980b0456c28140e3aa1da4ab6ca"
+      "sha256": "4eccad9a6a250af4255297f55de0a8b4fd31058e7f4ea0068eeba4a744f7a3fd"
     },
     {
       "path": "src/update/badge.ts",
@@ -2522,7 +2530,7 @@
     },
     {
       "path": "src/update/job.ts",
-      "sha256": "af0aeb7c8c3f24fd93306d0def7695482b1a0792268c2e67dcb76b586e4ffa85"
+      "sha256": "60bb9f289105ff55fbf96d15de28e3305ad881f1fcd1f0b2a216eff50e7ff498"
     },
     {
       "path": "src/update/notify.ts",
@@ -2570,7 +2578,7 @@
     },
     {
       "path": "src/usage/summary.ts",
-      "sha256": "393dd15c9ef4aa7e597bdb0005658595bb567271b559414f203d2a4f81223842"
+      "sha256": "7c73078f67bb6b14f8448b794cd1e622f47517f5686efe1cd3553580afe98122"
     },
     {
       "path": "src/usage/totals.ts",
@@ -2598,7 +2606,7 @@
     },
     {
       "path": "src/vision/index.ts",
-      "sha256": "b3c27892a17ea2176c2b6361830800772a6efea5681fff570b3ca5da77626bbc"
+      "sha256": "eec04f8b8e21e3e0f894eda6a194947e3e4f91129e9b089f31c1a5f98a781bd6"
     },
     {
       "path": "src/vision/reasoning.ts",
@@ -2622,7 +2630,7 @@
     },
     {
       "path": "src/web-search/index.ts",
-      "sha256": "d8f043b344f916c63ae8d09323a2f894c1c98b76feae7921e67152fcc1db4b5f"
+      "sha256": "5334eb4bf0a970693eca2fa7e38cacef23c1ec5b79692383aa7364db2c011144"
     },
     {
       "path": "src/web-search/loop.ts",

package/src/lib/errors.ts

@@ -43,6 +43,25 @@ function isSubscriptionGateMessage(text: string): boolean {
   );
 }
 
+function isLocalAclHardeningMessage(text: string): boolean {
+  const secretPathHardening = text.includes("secret path") && (
+    text.includes("acl") ||
+    text.includes("harden") ||
+    text.includes("permission") ||
+    text.includes("access denied") ||
+    text.includes("inheritance")
+  );
+  return (
+    text.includes("icacls") ||
+    text.includes("acl hardening") ||
+    text.includes("ntfs") ||
+    secretPathHardening ||
+    text.includes("inheritance:r") ||
+    /\bwindows\b.*\bacl\b/.test(text) ||
+    text.includes("/grant:r")
+  );
+}
+
 function isAuthenticationMessage(text: string): boolean {
   const accessDeniedWithCredentialCue = (
     text.includes("access denied") ||
@@ -170,6 +189,11 @@ export function classifyError(status: number, type: string, message: string): Oc
   if (type === "origin_rejected") {
     return { message, type: "invalid_request_error", code: "origin_rejected" };
   }
+  // Local ACL setup failures can contain provider-like auth wording (for example
+  // "access denied" or "authentication") but represent unavailable infrastructure.
+  if (status === 503 && isLocalAclHardeningMessage(text)) {
+    return { message, type: "server_error", code: "upstream_server_error" };
+  }
   // HTTP 401 and explicit auth failures are authoritative even when provider text
   // also advertises an upgrade or subscription.
   if (
@@ -280,6 +304,9 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
     lower.includes("too many requests") ||
     lower.includes("throttling")
   ) return 429;
+  // Local Windows filesystem hardening is infrastructure, not provider authentication.
+  // Keep this ahead of auth/permission and timeout keyword inference.
+  if (isLocalAclHardeningMessage(lower)) return 503;
   // Strong authentication signals win when a message contains mixed auth and
   // subscription/permission wording.
   if (isAuthenticationMessage(lower)) return 401;

package/src/lib/token-estimate.ts

@@ -55,15 +55,32 @@ function cjkRatio(text: string): number {
   return sampled === 0 ? 0 : cjk / sampled;
 }
 
+/**
+ * Cap an estimated token count at a model's context window (codex-router PR #140).
+ *
+ * A request the provider answered cannot have exceeded the window, so the estimate is never
+ * allowed to claim it did: the estimate only ever substitutes a reported-zero (or missing)
+ * input count, and a value above the window would be provably false. Positive or missing
+ * reported counts are never rewritten here — this bounds the heuristic estimate itself.
+ * Non-positive or non-integer windows (unknown model) leave the estimate untouched.
+ */
+export function capEstimateAtContextWindow(estimate: number, contextWindow: number | undefined): number {
+  return typeof contextWindow === "number" && Number.isInteger(contextWindow) && contextWindow > 0
+    ? Math.min(estimate, contextWindow)
+    : estimate;
+}
+
 /**
  * Estimate the token count of a text blob. Pure and deterministic.
  * Returns 0 for empty/whitespace-free-empty input; otherwise ceil(length / ratio), min 1.
+ * When `contextWindow` is a positive integer the estimate is capped at it: a request the
+ * provider answered cannot have exceeded the window, so the estimate must not claim it did.
  */
-export function estimateTokens(text: string, modelId?: string): number {
+export function estimateTokens(text: string, modelId?: string, contextWindow?: number): number {
   if (!text) return 0;
   const len = text.length;
   if (len === 0) return 0;
   let ratio = charsPerToken(modelId);
   if (cjkRatio(text) > CJK_RATIO_THRESHOLD) ratio = Math.min(ratio, CJK_CHARS_PER_TOKEN);
-  return Math.max(1, Math.ceil(len / ratio));
+  return capEstimateAtContextWindow(Math.max(1, Math.ceil(len / ratio)), contextWindow);
 }

package/src/lib/windows-elevation.ts

@@ -612,6 +612,43 @@ export function runWindowsElevated(file: string, args: string[]): Promise<number
   return startPowerShellCommand(script).completion.then(result => result.exitCode);
 }
 
+/**
+ * Register one scheduled-task definition without exposing a mutable XML pathname to
+ * the elevated process. The XML bytes are fixed in the encoded PowerShell command
+ * before UAC; Register-ScheduledTask receives that string directly after elevation.
+ */
+export function runWindowsElevatedScheduledTaskRegistration(
+  taskName: string,
+  xml: string,
+): Promise<number> {
+  const xmlBase64 = Buffer.from(xml, "utf16le").toString("base64");
+  const inner = [
+    `$taskName = ${psSingleQuote(taskName)}`,
+    `$xmlBase64 = ${psSingleQuote(xmlBase64)}`,
+    "$xml = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($xmlBase64))",
+    "Register-ScheduledTask -TaskName $taskName -Xml $xml -Force -ErrorAction Stop | Out-Null",
+  ].join("; ");
+  const encodedCommand = Buffer.from(inner, "utf16le").toString("base64");
+  const script = [
+    `$p = Start-Process -FilePath ${psSingleQuote(windowsPowerShell())}`,
+    ` -ArgumentList ${psSingleQuote(buildWindowsElevatedArgumentList([
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand",
+      encodedCommand,
+    ]))}`,
+    " -Verb RunAs -WindowStyle Hidden -PassThru -Wait",
+    `if ($null -eq $p) { exit ${OCX_ELEVATED_UAC_CANCELLED} }`,
+    "$null = $p.Handle",
+    `if ($null -eq $p.ExitCode) { exit ${OCX_ELEVATED_PROTOCOL_FAILED} }`,
+    "exit $p.ExitCode",
+  ].join("; ");
+
+  return startPowerShellCommand(script).completion.then(result => result.exitCode);
+}
+
 /**
  * Build the elevated (post-UAC) script: create → run → optional delete rollback.
  * Returns only OpenCodex protocol exit codes (never raw schtasks codes, never 1223).

package/src/lib/windows-secret-acl.ts

@@ -388,6 +388,13 @@ export function forgetEphemeralSecretPath(tempPath: string): void {
   timedOutPaths.delete(`optional:${tempPath}`);
 }
 
+/** Directory counterpart for a proven-absent ephemeral staging root. */
+export function forgetEphemeralSecretDir(tempPath: string): void {
+  hardenedDirectories.delete(tempPath);
+  timedOutPaths.delete(`required:${tempPath}`);
+  timedOutPaths.delete(`optional:${tempPath}`);
+}
+
 /** Test seam: timeout memo sets return to baseline after ephemeral cleanup. */
 export function timedOutSecretPathCountForTests(): number {
   return timedOutPaths.size;

package/src/lib/windows-text.ts

@@ -0,0 +1,106 @@
+/**
+ * Decode bounded text emitted by Windows system tools.
+ *
+ * [Decision Log]
+ * - Purpose: preserve non-ASCII paths when a Windows tool writes the active
+ *   legacy code page instead of UTF-8.
+ * - Existing constraint: generated service assets may be UTF-16, while
+ *   redirected `schtasks` output follows the Windows locale on affected hosts.
+ * - Alternatives considered: replacement-character heuristics and a new
+ *   iconv dependency. The former can reinterpret valid text; the latter widens
+ *   the install/security surface for two small, already-supported codecs.
+ * - Choice: recognize UTF-16 first, accept only strict UTF-8 next, then use the
+ *   locale-appropriate WHATWG decoder (CP949 through `euc-kr`, or Windows-1252
+ *   only for locales that actually use that family). Unknown/unsupported
+ *   locales fail back to the old replacement-preserving UTF-8 result instead
+ *   of guessing another code page or throwing in diagnostics.
+ * - Impact: decoding stays dependency-free and bounded, but this deliberately
+ *   does not guess arbitrary OEM code pages that the runtime cannot identify.
+ */
+
+function trimWindowsText(value: string): string {
+  return value.replace(/^\uFEFF/, "").trim();
+}
+
+function currentWindowsLocale(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().locale;
+  } catch {
+    return "en-US";
+  }
+}
+
+function decodeStrict(buffer: Uint8Array, encoding: string): string | null {
+  try {
+    return trimWindowsText(new TextDecoder(encoding, { fatal: true }).decode(buffer));
+  } catch {
+    return null;
+  }
+}
+
+function decodeUtf16Be(buffer: Uint8Array): string {
+  const payloadLength = buffer.length - 2;
+  const swapped = Buffer.alloc(payloadLength - (payloadLength % 2));
+  for (let i = 2; i + 1 < buffer.length; i += 2) {
+    swapped[i - 2] = buffer[i + 1]!;
+    swapped[i - 1] = buffer[i]!;
+  }
+  return trimWindowsText(swapped.toString("utf16le"));
+}
+
+/**
+ * CP949 is exposed by the Encoding Standard under the `euc-kr` label. Keep the
+ * Western fallback deliberately narrow: treating CP932, CP1250, or CP1251
+ * bytes as Windows-1252 can fabricate a different valid-looking filesystem
+ * path, which is worse than the previous replacement-character refusal.
+ */
+function legacyEncodingForLocale(locale: string): "euc-kr" | "windows-1252" | null {
+  const language = locale.trim().split(/[-_]/, 1)[0]?.toLowerCase();
+  if (language === "ko") return "euc-kr";
+  if (language && WINDOWS_1252_LANGUAGES.has(language)) return "windows-1252";
+  return null;
+}
+
+const WINDOWS_1252_LANGUAGES = new Set([
+  "af", "br", "ca", "co", "cy", "da", "de", "en", "es", "eu", "fi", "fo", "fr",
+  "ga", "gd", "gl", "id", "is", "it", "lb", "ms", "nl", "no", "oc", "pt", "sq",
+  "sv", "sw",
+]);
+
+export interface WindowsTextDecodeOptions {
+  /** Test seam and explicit locale override; production uses the active Intl locale. */
+  readonly locale?: string;
+}
+
+export function decodeWindowsTextBytes(
+  buffer: Uint8Array,
+  options: WindowsTextDecodeOptions = {},
+): string {
+  if (buffer.length === 0) return "";
+
+  const bomUtf16Le = buffer.length >= 2 && buffer[0] === 0xff && buffer[1] === 0xfe;
+  const bomUtf16Be = buffer.length >= 2 && buffer[0] === 0xfe && buffer[1] === 0xff;
+  const looksUtf16Le = buffer.length >= 4
+    && buffer[1] === 0x00
+    && buffer[3] === 0x00
+    && buffer[0] !== 0x00;
+
+  if (bomUtf16Le || looksUtf16Le) {
+    return trimWindowsText(Buffer.from(buffer).toString("utf16le"));
+  }
+  if (bomUtf16Be) return decodeUtf16Be(buffer);
+
+  const utf8 = decodeStrict(buffer, "utf-8");
+  if (utf8 !== null) return utf8;
+
+  const locale = options.locale ?? currentWindowsLocale();
+  const legacyEncoding = legacyEncodingForLocale(locale);
+  if (legacyEncoding !== null) {
+    const legacy = decodeStrict(buffer, legacyEncoding);
+    if (legacy !== null) return legacy;
+  }
+
+  // Preserve the previous fail-soft behavior when the runtime lacks a codec or
+  // the bytes are malformed even for the selected Windows code page.
+  return trimWindowsText(new TextDecoder("utf-8").decode(buffer));
+}

package/src/lib/windows-user-principal.ts

@@ -105,8 +105,6 @@ const POWERSHELL_ARGS = [
   "-NoLogo",
   "-NoProfile",
   "-NonInteractive",
-  "-WindowStyle",
-  "Hidden",
   "-Command",
   SID_EXPRESSION,
 ] as const;

package/src/oauth/index.ts

@@ -1124,7 +1124,7 @@ export async function runLogin(
       await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred);
     } else {
       await (deps.saveCredential ?? saveCredential)(provider, cred, {
-        preserveIdentityless: provider === "kiro" && opts?.forceLogin === true,
+        preserveIdentityless: opts?.forceLogin === true,
       });
     }
     if (provider !== "chatgpt") {