@commonlyai/cli 0.1.232 → 0.1.233

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.232",
+  "version": "0.1.233",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -90,6 +90,9 @@ import { prepareCommitAttribution } from '../lib/commit-attribution.js';
 import { detectBwrap } from '../lib/sandbox/bwrap.js';
 import { resolvePublicSandboxMode } from '../lib/sandbox/mode.js';
 import { hostSandboxRefusal, windowsSandboxMessage } from '../lib/sandbox/host-check.js';
+import {
+  UNSANDBOXED_NOTICE, hostUnconfinedForRun, runOptedInUnsandboxed, unsandboxedFlagRefusal,
+} from '../lib/sandbox/windows-unsandboxed.js';
 import { prepareMcpBeforeFirstPoll } from '../lib/mcp-first-run.js';
 import { installedCliVersion, startUpdateNotice } from '../lib/update-check.js';
 import { createSeatStop } from '../lib/seat-stop.js';
@@ -1581,6 +1584,9 @@ export const performRun = ({
   instanceId = 'default',
   podId = null,
   environment = null,
+  // D245: the user's own Windows opt-in for this run; reaches the adapter's
+  // spawn context only (never the environment).
+  hostUnconfined = false,
   workspacePath = null,
   intervalMs = 5000,
   log = () => {},
@@ -2109,7 +2115,7 @@ export const performRun = ({
     // failed read is not: it throws, so the event stays unacked and comes back
     // through the spawn-retry backoff instead of being refused for good.
     if (placement.reason) {
-      const turnRefusal = hostSandboxRefusal({ environment: placement.environment, adapterName: adapter.name });
+      const turnRefusal = hostSandboxRefusal({ environment: placement.environment, adapterName: adapter.name, hostUnconfined });
       if (turnRefusal && placement.readError) {
         throw Object.assign(
           new Error(`turn deferred, because its pods could not be read: ${placement.readError.message}`, {
@@ -2336,6 +2342,8 @@ export const performRun = ({
         memoryLongTerm,
         memoryWithheld,
         environment: placement.environment,
+        // Only when set, so every other spawn context stays as it was.
+        ...(hostUnconfined === true ? { hostUnconfined: true } : {}),
         onSkillsLinked: ({ mounted, conflicted }) => {
           skillMount = {
             mounted: [...new Set([...serverSkills.mounted, ...mounted.map(reportedSkillName)])],
@@ -4218,7 +4226,15 @@ Docs:
     .option('--cascade-reset <ms>', `Silence window that clears the streak (env ${CASCADE_ENV_VARS.resetMs}, default ${CASCADE_DEFAULTS.resetMs})`)
     .option('--refusal-handoff <agent>', 'Agent to @mention when the model provider refuses a request\'s content; the request is acked as refused, never retried')
     .option('--allow <grants>', 'On first run of an agent that works in its folder, also let it edit files and run commands (write) and/or fetch web pages (web), comma-separated. Commands reach the network.')
+    .option('--unsandboxed', 'Native Windows only: run this agent without a sandbox, with your own access to files and commands. It gets no connector grants.')
     .action(async (name, opts) => {
+      if (opts.unsandboxed) {
+        const flagRefusal = unsandboxedFlagRefusal();
+        if (flagRefusal) {
+          console.error(`${stamp()} [${name}] ${flagRefusal}`);
+          process.exit(1);
+        }
+      }
       let allow;
       try {
         allow = parseAllowGrants(opts.allow);
@@ -4258,9 +4274,21 @@ Docs:
         bootstrapped = true;
       }
 
+      // D245: on native Windows the user may choose to run without an OS
+      // sandbox, by typing the flag or by installing the daemon with it (the
+      // marker is read only by the seats that daemon spawns). Nothing from the
+      // server decides this, and the environment never carries it: the seat
+      // keeps its trust and tool policy, and only the OS jail is skipped.
+      const hostUnconfined = hostUnconfinedForRun({
+        optedIn: runOptedInUnsandboxed({ flag: opts.unsandboxed === true }),
+        adapterName: record.adapter,
+        environment: record.environment,
+      });
+      if (hostUnconfined) console.warn(`${stamp()} [${name}] ${UNSANDBOXED_NOTICE}`);
+
       // Every turn of a seat this host cannot confine would fail, so say so
       // once, before a token file is written or a poll is made.
-      const hostRefusal = hostSandboxRefusal({ environment: record.environment, adapterName: record.adapter });
+      const hostRefusal = hostSandboxRefusal({ environment: record.environment, adapterName: record.adapter, hostUnconfined });
       if (hostRefusal) {
         console.error(`${stamp()} [${name}] ${hostRefusal}`);
         process.exit(1);
@@ -4349,6 +4377,7 @@ Docs:
         instanceId: record.instanceId,
         podId: record.podId,
         environment: record.environment || null,
+        hostUnconfined,
         workspacePath: record.workspacePath || null,
         intervalMs: parseInt(opts.interval, 10),
         ...cascadeOverridesFromOpts(opts),

package/src/commands/daemon.js

@@ -38,6 +38,10 @@ import {
   servicePaths,
 } from '../lib/daemon-service.js';
 import { daemonLogsDir, daemonSeatLogPath, readLogTail } from '../lib/daemon-logs.js';
+import { watchWindowsLauncher } from '../lib/daemon-service-windows.js';
+import {
+  UNSANDBOXED_FLAG, clearUnsandboxedOptIn, hostSandboxReport, loadUnsandboxedOptIn, saveUnsandboxedOptIn, unsandboxedFlagRefusal,
+} from '../lib/sandbox/windows-unsandboxed.js';
 import { loadDaemonState, saveDaemonState } from '../lib/daemon-state.js';
 import {
   CLEAR_SCREEN, renderDaemonWatch, shouldRedraw, WATCH_INTERVAL_MS,
@@ -433,21 +437,44 @@ Examples:
 
   daemon
     .command('install')
-    .description('Register the daemon as a login service (launchd/systemd); on Linux, also turn on lingering so it starts at boot')
-    .action(async () => {
+    .description('Register the daemon as a login service (launchd, systemd, or a Windows scheduled task); on Linux, also turn on lingering so it starts at boot')
+    .option(UNSANDBOXED_FLAG, 'Native Windows only: the agents this daemon runs have no sandbox, and run with your own access to files and commands. They get no connector grants. Install again without it to turn it off.')
+    .action(async (opts) => {
       try {
+        if (opts.unsandboxed) {
+          const flagRefusal = unsandboxedFlagRefusal();
+          if (flagRefusal) throw new Error(flagRefusal);
+        }
         // A service without a credential just crash-loops at boot.
         requireDaemonRecord();
+        // D245: this command is the only writer of the opt-in, and installing
+        // without the flag is how it is turned off. Written before the task
+        // starts, so the first seats it spawns already read the answer.
+        // N3: the marker's state before this install, so a failed install can
+        // put it back rather than leave an opt-in with no daemon behind it.
+        const optedInBefore = loadUnsandboxedOptIn();
+        if (opts.unsandboxed) {
+          saveUnsandboxedOptIn();
+          console.log('Agents this daemon runs will have no sandbox: they act with your own access to files and commands, and get no connector grants. To turn this off, run: commonly daemon install');
+        } else if (clearUnsandboxedOptIn()) {
+          console.log('Turned off running without a sandbox: on Windows, agents this daemon runs are refused again until you choose otherwise.');
+        }
         // Same class one layer over (TASK-049): a service without the SEATS'
         // provider key comes up clean, and every pi seat then dies inside its
         // adapter. The keys are captured here because this is the only moment
         // the operator's shell is in reach; the ones that are missing are named
         // by installDaemonService rather than left to be discovered per seat.
-        const installed = await installDaemonService({
-          ...serviceDeps(),
-          providerKeyEnvNames: providerKeyEnvNames(),
-          optionalEnvNames: [UPDATE_CHECK_OPT_OUT_ENV],
-        });
+        let installed;
+        try {
+          installed = await installDaemonService({
+            ...serviceDeps(),
+            providerKeyEnvNames: providerKeyEnvNames(),
+            optionalEnvNames: [UPDATE_CHECK_OPT_OUT_ENV],
+          });
+        } catch (error) {
+          if (optedInBefore) saveUnsandboxedOptIn(); else clearUnsandboxedOptIn();
+          throw error;
+        }
         console.log(installSummary(installed));
       } catch (error) {
         console.error(`Daemon install failed: ${error.message}`);
@@ -464,6 +491,10 @@ Examples:
       } catch (error) {
         console.error(`Daemon uninstall failed: ${error.message}`);
         process.exitCode = 1;
+      } finally {
+        // N4: an uninstall that half-failed still turns the opt-in off; a
+        // later install has to ask for it again.
+        clearUnsandboxedOptIn();
       }
     });
 
@@ -590,11 +621,18 @@ Examples:
             chmodSync(seatLog, 0o600);
             return spawn(process.execPath, [process.argv[1], 'agent', 'run', agentName], {
               stdio: ['ignore', out, out],
+              // Windows: never flash a console window per seat (no-op elsewhere).
+              windowsHide: true,
               env: { ...process.env, COMMONLY_MANAGED_RUNNER: '1' },
             });
           },
           loadToken: loadAgentToken,
           saveToken: saveAgentToken,
+          // Native Windows has no OS sandbox for any adapter, so it never
+          // reports 'default': Codex there runs on its own profiles only, and a
+          // removed marker must not read as "confined" while seats may still run.
+          // An older daemon sends nothing, which leaves the server's record.
+          machineReport: () => ({ sandbox: hostSandboxReport() }),
           runtimeInventory: async () => {
             if (!cachedInventory || Date.now() - inventoryCheckedAt > 300_000) {
               cachedInventory = await collectRuntimeInventory(getAdapter);
@@ -640,6 +678,14 @@ Examples:
         };
         process.on('SIGINT', shutdown);
         process.on('SIGTERM', shutdown);
+        // D245: under the Windows launcher, the launcher's exit is the stop signal.
+        watchWindowsLauncher({
+          onGone: (pid) => {
+            // stdout and stderr already swallow EPIPE (armed with the watch).
+            try { stampLog(`launcher ${pid} has exited`); } catch { /* stdout is gone */ }
+            shutdown();
+          },
+        });
       } catch (error) {
         console.error(`Daemon run failed: ${error.message}`);
         const badConfig = !record || error.message.startsWith('Daemon credential file');
@@ -676,6 +722,7 @@ Examples:
         });
         const lastSeen = machine.lastSeenAt ? new Date(machine.lastSeenAt).toLocaleString() : 'never';
         console.log(`${machine.name}: ${machine.status} (last heartbeat: ${lastSeen})`);
+        if (loadUnsandboxedOptIn()) console.log('Sandbox: unsandboxed (opted in). Agents run with your own access and get no connector grants. Turn off: commonly daemon install');
         if (opts.verbose) {
           const local = loadDaemonState();
           if (!local) {

package/src/lib/adapters/claude.js

@@ -100,6 +100,7 @@ import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
 import { PUBLIC_WITHHELD_TOOLS } from '../public-withheld-tools.js';
 import { isShippedCommonlyMcpCommand } from '../declared-mcp-guard.js';
 import { isAnswerableToolError, PUBLIC_MCP_NOT_READY_CODE, PUBLIC_TOOL_FAILED_CODE } from '../public-tool-error.js';
+import { resolveLaunch, resolveMcpCommand, resolveWindowsCommandWithReason } from '../windows-command.js';
 
 // See codex.js for the rationale on bumping the default + env override.
 // Keeping both adapters in lockstep so any wrapper agent runtime has the
@@ -145,6 +146,9 @@ const PUBLIC_DENIED_TOOLS = [
   'WebSearch',
   'WebFetch',
   'Bash',
+  // Claude Code's shell tool on Windows. dontAsk and the Read(./**) allowlist
+  // already refuse it; named here so the deny list holds on its own (D245).
+  'PowerShell',
   'Write',
   'Edit',
   'NotebookEdit',
@@ -158,6 +162,7 @@ const isConfinedTrust = (trust) => trust === 'public' || trust === 'workspace';
 // WebFetch alone: WebSearch, NotebookEdit and Task stay denied at every tier.
 // Bash and Write land wherever the jail lets them, so the jail, not this list,
 // bounds a write.
+const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
 const WORKSPACE_ALLOW_TOOLS = {
   write: ['Edit', 'Write', 'Bash'],
   web: ['WebFetch'],
@@ -210,6 +215,10 @@ const withWorkspaceGit = (ctx) => {
   };
 };
 const PUBLIC_SAFE_ENV = /^(?:PATH|LANG|LC_[A-Z_]+|TERM|USER|LOGNAME|NO_COLOR|CI|SSL_CERT_FILE|SSL_CERT_DIR)$/;
+// D245: what a Windows process needs to start at all, find its own login and
+// open a socket. Windows keys are case-insensitive (Path, SystemRoot), so this
+// one is matched without case. None of these carries a secret.
+const PUBLIC_SAFE_ENV_WIN32 = /^(?:PATH|PATHEXT|SYSTEMROOT|SYSTEMDRIVE|WINDIR|COMSPEC|TEMP|TMP|USERPROFILE|USERNAME|USERDOMAIN|HOMEDRIVE|HOMEPATH|APPDATA|LOCALAPPDATA|PROGRAMDATA|PROGRAMFILES|PROGRAMFILES\(X86\)|COMMONPROGRAMFILES|NUMBER_OF_PROCESSORS|PROCESSOR_ARCHITECTURE|OS)$/i;
 
 const statOrNull = async (path) => {
   try {
@@ -379,12 +388,13 @@ const prepareWorkspaceBwrapClaudeState = async (ctx) => {
   return { statePath, tmpPath, configPath, loginPath };
 };
 
-const buildClaudeEnv = (input, state, expansionEnv = {}, credentialFile = null, publicSeat = false) => {
+const buildClaudeEnv = (input, state, expansionEnv = {}, credentialFile = null, publicSeat = false, platform = process.platform) => {
   const source = input || process.env;
   const output = state || publicSeat ? {} : { ...source };
   if (state || publicSeat) {
+    const safe = platform === 'win32' ? PUBLIC_SAFE_ENV_WIN32 : PUBLIC_SAFE_ENV;
     for (const [key, value] of Object.entries(source)) {
-      if (PUBLIC_SAFE_ENV.test(key)) output[key] = value;
+      if (safe.test(key) || PUBLIC_SAFE_ENV.test(key)) output[key] = value;
     }
   }
   if (state) {
@@ -412,20 +422,38 @@ const buildClaudeEnv = (input, state, expansionEnv = {}, credentialFile = null,
 
 const absoluteToolDeny = (path) => `Read(/${path}/**)`;
 
+// D245: Claude Code matches permission paths in POSIX form on Windows
+// (C:\Users\ada becomes /c/Users/ada), so an absolute deny written from a
+// Windows path would match nothing.
+const permissionPath = (path, platform) => (platform === 'win32'
+  ? path.replace(/\\/g, '/').replace(/^([A-Za-z]):/, (_, drive) => `/${drive.toLowerCase()}`)
+  : path);
+
 // The tools that read or write the seat's agent-wide memory.
 const MEMORY_TOOLS = Object.freeze(['commonly_read_agent_memory', 'commonly_write_agent_memory', 'commonly_save_my_memory']);
 
-const buildPublicClaudePolicyArgs = (mcpToolPatterns, { trust, allow = [], memoryWithheld = false } = {}) => {
-  const home = homedir();
+const buildPublicClaudePolicyArgs = (mcpToolPatterns, {
+  trust, allow = [], memoryWithheld = false, platform = process.platform, home: homeOverride = null,
+  noShell = false,
+} = {}) => {
+  const home = homeOverride || homedir();
+  const deny = (sub) => absoluteToolDeny(permissionPath(join(home, sub), platform));
   // `allow` is already narrowed to a workspace seat's grants (workspaceGrants).
-  const granted = allow.flatMap((grant) => WORKSPACE_ALLOW_TOOLS[grant] || []);
+  // D245: with no OS jail (native Windows, --unsandboxed) a shell would run
+  // with the user's whole access and could read the seat's own token from its
+  // environment, so `write` grants edits only there.
+  // With no jail the edit tools are also scoped to the working folder: a bare
+  // Edit/Write could reach the user's profile (a Startup script, ~/.claude).
+  const granted = allow.flatMap((grant) => WORKSPACE_ALLOW_TOOLS[grant] || [])
+    .filter((tool) => !(noShell && SHELL_TOOLS.has(tool)))
+    .map((tool) => (noShell && (tool === 'Edit' || tool === 'Write') ? `${tool}(./**)` : tool));
   const deniedReads = [
-    absoluteToolDeny(join(home, '.commonly')),
-    absoluteToolDeny(join(home, '.claude')),
-    absoluteToolDeny(join(home, '.codex')),
-    absoluteToolDeny(join(home, '.ssh')),
-    absoluteToolDeny(join(home, '.aws')),
-    absoluteToolDeny(join(home, '.config')),
+    deny('.commonly'),
+    deny('.claude'),
+    deny('.codex'),
+    deny('.ssh'),
+    deny('.aws'),
+    deny('.config'),
     'Read(//private/tmp/**)',
     'Read(./.commonly/**)',
     'Read(./.codex/**)',
@@ -465,7 +493,7 @@ const buildPublicClaudePolicyArgs = (mcpToolPatterns, { trust, allow = [], memor
     '--no-chrome',
     '--permission-mode', 'dontAsk',
     '--allowedTools', 'Read(./**)', ...granted, ...mcpToolPatterns,
-    '--disallowedTools', ...PUBLIC_DENIED_TOOLS.filter((tool) => !granted.includes(tool)),
+    '--disallowedTools', ...PUBLIC_DENIED_TOOLS.filter((tool) => !granted.some((g) => g === tool || g.startsWith(`${tool}(`))),
     ...deniedReads, ...workspaceDenies, ...memoryDenies, ...withheldDenies,
   ];
 };
@@ -638,11 +666,15 @@ const runClaude = ({
   cmd, args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn, onSpawn, controls = {}, ownGroup = false,
   transcriptPath = null, firstOutputMs = firstOutputWindowMs(), lockProbe, stallKillGraceMs = STALL_KILL_GRACE_MS,
   processTable = readProcessTable, survivorIo, modelStream = true, turnReap = turnReapEnabled(),
+  commandResolution = {},
 }) => new Promise((resolve, reject) => {
   // Every process the turn starts inherits this marker however it detaches,
   // so what it leaves running is stopped once the turn has closed.
   const turn = markTurn(env ?? process.env, { enabled: turnReap });
-  const proc = spawnInOwnGroup(spawnImpl, cmd, args, {
+  // On Windows an npm `claude.cmd` is read, not run through cmd.exe: the
+  // prompt in `args` is pod content (#2141). Off Windows this is identity.
+  const launch = resolveLaunch(cmd, args, { env: turn.env, ...commandResolution });
+  const proc = spawnInOwnGroup(spawnImpl, launch.command, launch.args, {
     cwd,
     env: turn.env,
     stdio: ['ignore', 'pipe', 'pipe'],
@@ -871,7 +903,11 @@ const buildMcpConfig = (mcpServers, ctx = {}) => {
     const entry = { type: server.transport || 'stdio' };
     if (server.url) entry.url = server.url;
     if (spawnCommand) {
-      const [command, ...args] = spawnCommand;
+      // Win32 only: claude spawns this without a shell, so an `npx.cmd` is
+      // resolved to its target here (#2141). Identity on every other platform.
+      const [command, ...args] = resolveMcpCommand(spawnCommand, ctx.commandResolution, {
+        label: 'claude', name: server.name,
+      });
       entry.command = command;
       if (args.length) entry.args = args;
     }
@@ -966,11 +1002,14 @@ const createMcpConfig = async (mcpServers, ctx = {}) => {
 const withClaudePath = (input) => {
   const output = { ...(input || process.env) };
   const localBin = join(homedir(), '.local', 'bin');
-  const entries = String(output.PATH || '')
+  // Windows keys are case-insensitive, and a child given both `Path` and a
+  // new `PATH` keeps only one of them, so update the key that is already there.
+  const key = Object.keys(output).find((k) => k.toUpperCase() === 'PATH') || 'PATH';
+  const entries = String(output[key] || '')
     .split(delimiter)
     .filter(Boolean);
   if (!entries.includes(localBin)) entries.push(localBin);
-  output.PATH = entries.join(delimiter);
+  output[key] = entries.join(delimiter);
   return output;
 };
 
@@ -980,6 +1019,10 @@ const withClaudePath = (input) => {
 // PATH but cannot reach the user's `~/.local/bin` without an absolute path
 // argv[0], even when that directory is bound read-only into the sandbox.
 const resolveClaudePath = (env = process.env) => {
+  // Windows has no `which`; the shim-aware resolver finds the same file.
+  if (process.platform === 'win32') {
+    return resolveWindowsCommandWithReason('claude', { env: withClaudePath(env) }).source || 'claude';
+  }
   // Defensive: spawnSync can return undefined under aggressive mocks (the
   // adapters.claude.environment.test.mjs suite stubs child_process so no real
   // process runs). Treat any failure mode as "use the bare command name."
@@ -1022,6 +1065,16 @@ const claudeInstallRefusal = (claudeBin) => new Error(
   + `\`${claudeBin}\` could not be resolved`,
 );
 
+/**
+ * D245: native Windows has no OS jail, and the user chose to run without one
+ * (`--unsandboxed`). Read from the spawn context only, set by `agent run`, never
+ * from the environment. The seat keeps its trust, so everything the trust
+ * brings except the jail still applies.
+ */
+const policyOnlyHost = (ctx) => ctx.hostUnconfined === true
+  && (ctx._platform || process.platform) === 'win32'
+  && isConfinedTrust(ctx.environment?.sandbox?.trust);
+
 const prepareArgv = async (innerArgv, ctx) => {
   const env = ctx.environment;
   const claudeEnv = withClaudePath(ctx.claudeEnv);
@@ -1078,6 +1131,22 @@ const prepareArgv = async (innerArgv, ctx) => {
         }
       })
     : [];
+  if (policyOnlyHost(ctx)) {
+    // The bwrap branch's policy, without the jail: on a host with no OS
+    // isolation the tool policy is the whole boundary, so it is never dropped.
+    innerArgv = [
+      ...innerArgv,
+      ...buildPublicClaudePolicyArgs(allowedPatterns, {
+        ...(sandboxTrust === 'workspace' ? { trust: sandboxTrust, allow: grants } : {}),
+        memoryWithheld: ctx.memoryWithheld === true,
+        platform: ctx._platform || process.platform,
+        home: ctx._home || null,
+        noShell: true,
+      }),
+      ...(ctx.publicSkillArgs || []),
+    ];
+    return { cmd: 'claude', args: innerArgv, env: claudeEnv };
+  }
   // A public trust MUST resolve to an enforced mode. Absent mode is resolved
   // above; anything else that lands here (the literal 'none', a typo, a
   // non-string) used to fall through to the bare `claude` spawn below — an
@@ -1230,10 +1299,19 @@ export default {
 
   inventory: () => claudeRuntimeInventory({ env: withClaudePath(process.env) }),
 
-  async detect() {
+  // `opts` is a test seam only: `_commandResolution` overrides the Windows
+  // resolver's platform/env/fs. Production calls detect() with no argument.
+  async detect(opts = {}) {
     try {
       const claudeEnv = withClaudePath(process.env);
-      const res = spawnSync('claude', ['--version'], {
+      const resolution = { env: claudeEnv, ...opts._commandResolution };
+      const located = resolveWindowsCommandWithReason('claude', resolution);
+      if (!located.command) {
+        // Windows only: a `claude.cmd` this CLI cannot read safely, or none.
+        process.stderr.write(`claude adapter: ${located.reason}\n`);
+        return null;
+      }
+      const res = spawnSync(located.command, [...located.args, '--version'], {
         encoding: 'utf8', timeout: 5000,
         env: claudeEnv,
       });
@@ -1242,7 +1320,8 @@ export default {
       const version = (res.stdout || '').trim().split(/\s+/)[0] || 'unknown';
       // Best-effort resolve of the binary path for clearer UX ("claude detected
       // at /usr/local/bin/claude"). Falls back to the bare command name on
-      // platforms without `which` (e.g. Windows).
+      // platforms without `which`. On Windows the resolver already found it.
+      if (located.source) return { path: located.source, version };
       const where = spawnSync('which', ['claude'], {
         encoding: 'utf8',
         env: claudeEnv,
@@ -1342,11 +1421,13 @@ export default {
     let mcpConfig = null;
     let publicClaudeState = null;
     let publicSkillArgs = [];
-    const publicNativeSandbox = publicTrust
+    // D245: no jail to prepare for on a policy-only Windows host.
+    const jailed = !policyOnlyHost(ctx);
+    const publicNativeSandbox = jailed && publicTrust
       && PUBLIC_SANDBOX_MODES.has(resolvePublicSandboxMode(ctx.environment?.sandbox));
-    const publicBwrapSandbox = publicTrust
+    const publicBwrapSandbox = jailed && publicTrust
       && resolvePublicSandboxMode(ctx.environment?.sandbox) === 'bwrap';
-    const workspaceBwrapSandbox = ctx.environment?.sandbox?.trust === 'workspace'
+    const workspaceBwrapSandbox = jailed && ctx.environment?.sandbox?.trust === 'workspace'
       && resolvePublicSandboxMode(ctx.environment?.sandbox) === 'bwrap';
     try {
       // Trust is normalized at entry (legacy `internal` reads as public). The
@@ -1383,6 +1464,7 @@ export default {
           instanceUrl: ctx.instanceUrl,
           agentName: ctx.agentName,
           publicSeat: publicTrust,
+          commandResolution: { env: withClaudePath(ctx.env), ...ctx._commandResolution },
         });
       }
       if (mcpConfig?.unavailableMcp.length) throw publicMcpUnavailableError(mcpConfig.unavailableMcp);
@@ -1392,6 +1474,7 @@ export default {
         mcpConfig?.expansionEnv,
         mcpConfig?.credential?.path || null,
         publicTrust,
+        ctx._platform || process.platform,
       );
       if ((publicNativeSandbox || publicBwrapSandbox) && ctx.commitAttributionEnv) {
         Object.assign(claudeEnv, ctx.commitAttributionEnv);
@@ -1427,6 +1510,7 @@ export default {
         processTable: ctx._processTable,
         survivorIo: ctx._survivorIo,
         turnReap: ctx._turnReap,
+        commandResolution: ctx._commandResolution, // test seam only
       });
       // TASK-440: the context this turn left, read from the transcript the
       // child wrote under its own env (an isolated HOME for public seats).
@@ -1472,6 +1556,7 @@ export default {
             mcpConfig?.expansionEnv,
             mcpConfig?.credential?.path || null,
             publicTrust,
+            ctx._platform || process.platform,
           ),
         };
         if ((publicNativeSandbox || publicBwrapSandbox) && ctx.commitAttributionEnv) {
@@ -1496,6 +1581,7 @@ export default {
           processTable: ctx._processTable,
           survivorIo: ctx._survivorIo,
           turnReap: ctx._turnReap,
+          commandResolution: ctx._commandResolution, // test seam only
         });
         const contextTokens = claudeContextTokens({
           cwd: physicalPath(ctx.cwd), sessionId: freshId,

package/src/lib/adapters/codex.js

@@ -79,6 +79,7 @@ import { resolveSkillSource, skillsAsText } from '../skill-prompt.js';
 import { isLegacySandboxTrust, normalizeSandboxTrust, refuseWorkspaceTrust } from '../environment.js';
 import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
 import { PUBLIC_WITHHELD_TOOLS } from '../public-withheld-tools.js';
+import { resolveLaunch, resolveMcpCommand, resolveWindowsCommandWithReason } from '../windows-command.js';
 
 // Default timeout for a single codex spawn (exec mode).
 //
@@ -183,7 +184,13 @@ const buildMcpOverrideArgs = (mcpServers, ctx = {}) => {
       credentialFile: ctx.credentialFile,
       label: 'codex',
     }).env;
-    const [command, ...rest] = spawnCommand.map((a) => substitutePlaceholders(a, ctx));
+    // Win32 only: codex spawns the server without a shell, so an `npx.cmd` is
+    // resolved to its target here (#2141). Identity on every other platform.
+    const [command, ...rest] = resolveMcpCommand(
+      spawnCommand.map((a) => substitutePlaceholders(a, ctx)),
+      ctx.commandResolution,
+      { label: 'codex', name: server.name },
+    );
     // The doc block above promises bearer tokens never ride in argv, and this is
     // the place that had to hold it: an env value that carries the token is
     // diverted to env_vars, but a COMMAND ARGUMENT has no such route — codex
@@ -734,7 +741,7 @@ const CODEX_PROVIDER_KEY_ENVS = [
 // `ownGroup`: see runClaude in claude.js.
 const runCodex = ({
   args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn, onSpawn, controls = {}, ownGroup = false,
-  turnReap = turnReapEnabled(),
+  turnReap = turnReapEnabled(), commandResolution = {},
 }) => new Promise((resolve, reject) => {  // stdio: ['ignore', 'pipe', 'pipe'] — without this, child_process.spawn
   // defaults stdin to a fresh pipe. Codex 0.125.0's `exec` then blocks on
   // `Reading additional input from stdin...` because it sees an open pipe
@@ -744,7 +751,11 @@ const runCodex = ({
   // argv prompt as intended. Surfaced live during ADR-005 Phase 2 smoke.
   // What the turn leaves running is stopped once it has closed (see claude.js).
   const turn = markTurn(env ?? process.env, { enabled: turnReap });
-  const proc = spawnInOwnGroup(spawnImpl, 'codex', args, { cwd, env: turn.env, stdio: ['ignore', 'pipe', 'pipe'] }, { ownGroup });
+  // On Windows `npm i -g @openai/codex` leaves a `codex.cmd`; it is read and
+  // its target spawned directly, never through cmd.exe, because the prompt is
+  // the last argv element and is pod content (#2141). Identity elsewhere.
+  const launch = resolveLaunch('codex', args, { env: turn.env, ...commandResolution });
+  const proc = spawnInOwnGroup(spawnImpl, launch.command, launch.args, { cwd, env: turn.env, stdio: ['ignore', 'pipe', 'pipe'] }, { ownGroup });
   observeSpawn(proc, onSpawn, controls);
   let stderr = '';
   let timedOut = false;
@@ -798,9 +809,17 @@ export default {
 
   inventory: codexRuntimeInventory,
 
-  async detect() {
+  // `opts` is a test seam only: `_commandResolution` overrides the Windows
+  // resolver's platform/env/fs. Production calls detect() with no argument.
+  async detect(opts = {}) {
     try {
-      const res = spawnSync('codex', ['--version'], { encoding: 'utf8', timeout: 5000 });
+      const located = resolveWindowsCommandWithReason('codex', opts._commandResolution);
+      if (!located.command) {
+        // Windows only: a `codex.cmd` this CLI cannot read safely, or none.
+        process.stderr.write(`codex adapter: ${located.reason}\n`);
+        return null;
+      }
+      const res = spawnSync(located.command, [...located.args, '--version'], { encoding: 'utf8', timeout: 5000 });
       if (res.error || res.status !== 0) return null;
       // `codex --version` prints e.g. "codex-cli 0.125.0" — last token is
       // the version. Defensive against future format tweaks: if no
@@ -808,6 +827,7 @@ export default {
       const stdout = (res.stdout || '').trim();
       const versionMatch = stdout.match(/(\d+\.\d+(?:\.\d+)?)/);
       const version = versionMatch ? versionMatch[1] : (stdout || 'unknown');
+      if (located.source) return { path: located.source, version };
       const where = spawnSync('which', ['codex'], { encoding: 'utf8' });
       const path = where.status === 0 ? (where.stdout || '').trim() || 'codex' : 'codex';
       return { path, version };
@@ -854,6 +874,7 @@ export default {
         instanceUrl: ctx.instanceUrl,
         credentialFile: credential?.path || null,
         publicSeat: sandbox?.trust === 'public',
+        commandResolution: { env: ctx.env || process.env, ...ctx._commandResolution },
       });
       if (mcp.unavailableMcp.length) throw publicMcpUnavailableError(mcp.unavailableMcp);
       // A derived record stores `trust: 'public'` and no mode (the block is
@@ -927,6 +948,7 @@ export default {
         spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(args.slice(args.indexOf('exec') + (args[args.indexOf('exec') + 1] === 'resume' ? 3 : 1), -1), { modelFlag: '--model', valueFlags: ['-c', '-o', '--permission-profile'], codex: true }), // test seam only — do not use in production
         ownGroup: wantsOwnProcessGroup(ctx),
         turnReap: ctx._turnReap,
+        commandResolution: ctx._commandResolution, // test seam only
       });
 
       let text = '';