@commonlyai/cli 0.1.232 → 0.1.233

package/src/lib/daemon-service-windows.js

@@ -0,0 +1,256 @@
+/**
+ * D245: the Windows form of `commonly daemon install` (ADR-026 D1).
+ *
+ * macOS has launchd and Linux has systemd; Windows has Task Scheduler. A
+ * per-user task needs no administrator, so the install stays a one-liner a
+ * person can run in their own PowerShell. The shape mirrors the other two:
+ *
+ * - The task starts at this user's logon (a LogonTrigger naming the user; a
+ *   trigger for ANY user's logon needs an administrator).
+ * - Keep-alive lives in the launcher, a PowerShell script that loops on
+ *   `node <cli> daemon run --foreground`: it restarts on every exit except 77
+ *   and 78, the same codes `RestartPreventExitStatus=77 78` exempts on systemd
+ *   (a revoked key and a bad local registration). Task Scheduler's own
+ *   "restart on failure" fires when a task fails to START, not when its
+ *   program exits non-zero, so it cannot be the keep-alive.
+ * - A one-minute repeating trigger with `IgnoreNew` is the watchdog for the
+ *   launcher itself: while the task runs it starts nothing, and if the
+ *   launcher is killed the next minute brings it back.
+ * - On 77/78 the launcher disables the task before it exits, so the watchdog
+ *   does not restart a daemon that has been told to stop. That is launchd's
+ *   "park on a successful exit" in Task Scheduler's terms; `daemon start` and
+ *   `daemon restart` enable it again.
+ *
+ * A task cannot carry environment variables, so the provider keys the seats
+ * need (TASK-049) go in a JSON file the launcher loads before it starts node.
+ * The file is written through the same 0600-at-creation writer as the unit
+ * files, and its ACL is then narrowed to this user (best effort; the profile
+ * directory is already private by default).
+ *
+ * Windows has no Seatbelt or bwrap, so a daemon-run seat here is unconfined.
+ * That is stated on the BYO page and in docs/agents/daemon-service-windows.md.
+ */
+
+import { join } from 'path';
+
+export const WINDOWS_TASK_NAME = 'CommonlyDaemon';
+
+export const windowsServicePaths = (home) => {
+  const dir = join(home, '.commonly', 'daemon', 'service');
+  return {
+    kind: 'schtasks',
+    // The task definition doubles as the "is it installed" record, the way the
+    // plist and the unit file do on the other two platforms.
+    file: join(dir, 'commonly-daemon-task.xml'),
+    launcher: join(dir, 'commonly-daemon.ps1'),
+    envFile: join(dir, 'service-env.json'),
+    taskName: WINDOWS_TASK_NAME,
+  };
+};
+
+const xmlEscape = (value) => String(value)
+  .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+  .replace(/"/g, '&quot;');
+
+// A PowerShell single-quoted string ends at ANY of the four single-quote
+// characters it recognises (' and the curly ‘ ’ ‚ ‛), and each is escaped by
+// doubling. A user named O'Brien, or a path with a curly quote in it, would
+// otherwise close the string and run the rest of the path as script.
+export const psQuote = (value) => `'${String(value).replace(/['‘’‚‛]/g, (q) => q + q)}'`;
+
+export const windowsLauncherScript = ({ nodePath, cliPath, logPath, envFile, taskName = WINDOWS_TASK_NAME }) => `# Commonly daemon launcher. Written by \`commonly daemon install\`; re-run that command instead of editing this file.
+# It loads the service environment, then keeps \`commonly daemon run\` alive: every exit restarts it after 5 s,
+# except 77 (this computer's key was revoked) and 78 (no valid local registration), which disable the task and stop.
+$ErrorActionPreference = 'Continue'
+$node = ${psQuote(nodePath)}
+$cli = ${psQuote(cliPath)}
+$log = ${psQuote(logPath)}
+$envFile = ${psQuote(envFile)}
+$task = ${psQuote(taskName)}
+if (Test-Path -LiteralPath $envFile) {
+  $cfg = Get-Content -LiteralPath $envFile -Raw -Encoding UTF8 | ConvertFrom-Json
+  foreach ($p in $cfg.PSObject.Properties) { [Environment]::SetEnvironmentVariable($p.Name, [string]$p.Value, 'Process') }
+}
+$env:Path = (Split-Path -Parent $node) + ';' + $env:Path
+# Ending the task kills this script, not the node it started. The daemon watches this pid and
+# exits (stopping its seats) once it is gone, so stop, restart and reinstall leave no daemon behind.
+$env:COMMONLY_DAEMON_LAUNCHER_PID = "$PID"
+# Read node's output as UTF-8; Windows PowerShell 5.1 otherwise decodes it in the console code page.
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+while ($true) {
+  & $node $cli daemon run --foreground 2>&1 | ForEach-Object { "$_" } | Add-Content -LiteralPath $log -Encoding UTF8
+  $code = $LASTEXITCODE
+  if ($code -eq 77 -or $code -eq 78) {
+    & schtasks.exe /Change /TN $task /DISABLE | Out-Null
+    if ($LASTEXITCODE -eq 0) { exit $code }
+    # The task could not be disabled, so exiting would let the watchdog start
+    # it again within a minute. Park here instead; stop or uninstall ends it.
+    "commonly daemon exited $code and the task could not be disabled; parked" | Add-Content -LiteralPath $log -Encoding UTF8
+    while ($true) { Start-Sleep -Seconds 3600 }
+  }
+  Start-Sleep -Seconds 5
+}
+`;
+
+// UTF-8 with a BOM: Windows PowerShell 5.1 reads a BOM-less .ps1 in the ANSI
+// code page, which would mangle a non-ASCII user name in any of the paths.
+export const encodeLauncher = (script) => Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), Buffer.from(script, 'utf8')]);
+
+export const POWERSHELL = '%SystemRoot%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+
+export const windowsTaskXml = ({ launcher, userId, home }) => `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>Commonly local agent daemon (ADR-026). Installed by: commonly daemon install</Description>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${xmlEscape(userId)}</UserId>
+    </LogonTrigger>
+    <TimeTrigger>
+      <Repetition>
+        <Interval>PT1M</Interval>
+        <StopAtDurationEnd>false</StopAtDurationEnd>
+      </Repetition>
+      <StartBoundary>2026-01-01T00:00:00</StartBoundary>
+      <Enabled>true</Enabled>
+    </TimeTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${xmlEscape(userId)}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>false</Hidden>
+    <RunOnlyIfIdle>false</RunOnlyIfIdle>
+    <WakeToRun>false</WakeToRun>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Priority>7</Priority>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${xmlEscape(POWERSHELL)}</Command>
+      <Arguments>${xmlEscape(`-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "${launcher}"`)}</Arguments>
+      <WorkingDirectory>${xmlEscape(home)}</WorkingDirectory>
+    </Exec>
+  </Actions>
+</Task>
+`;
+
+// schtasks reads a task file as UTF-16; the declaration above says so, and the
+// bytes must agree with it (little-endian, with the BOM).
+export const encodeTaskXml = (xml) => Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(xml, 'utf16le')]);
+
+// Task Scheduler names a user DOMAIN\user. A bare name resolves too, but the
+// qualified one cannot be mistaken for a same-named account on the domain.
+export const windowsUserId = ({ env = process.env, lookupUsername }) => {
+  if (env.USERNAME) return env.USERDOMAIN ? `${env.USERDOMAIN}\\${env.USERNAME}` : env.USERNAME;
+  return lookupUsername();
+};
+
+export const installWindowsService = async ({
+  home, nodePath, cliPath, logPath, providerEnv, env, writeFile, execCmd, lookupUsername, warn,
+}) => {
+  const target = windowsServicePaths(home);
+  const userId = windowsUserId({ env, lookupUsername });
+  writeFile(target.envFile, `${JSON.stringify(Object.fromEntries(providerEnv), null, 2)}\n`);
+  try {
+    await execCmd(['icacls', target.envFile, '/inheritance:r', '/grant:r', `${userId}:F`]);
+  } catch (error) {
+    warn(`Could not narrow the permissions on ${target.envFile} (${error.message}). It holds your provider keys; it sits in your profile, which only you can read by default.`);
+  }
+  writeFile(target.launcher, encodeLauncher(windowsLauncherScript({ nodePath, cliPath, logPath, envFile: target.envFile })));
+  writeFile(target.file, encodeTaskXml(windowsTaskXml({ launcher: target.launcher, userId, home })));
+  // A running launcher keeps the environment it started with, so end it first
+  // (an absent task fails by design) and start the new definition after.
+  await execCmd(['schtasks', '/End', '/TN', target.taskName]).catch(() => {});
+  await execCmd(['schtasks', '/Create', '/TN', target.taskName, '/XML', target.file, '/F']);
+  await execCmd(['schtasks', '/Run', '/TN', target.taskName]);
+  return target;
+};
+
+export const LAUNCHER_PID_ENV = 'COMMONLY_DAEMON_LAUNCHER_PID';
+
+const pidAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === 'EPERM';
+  }
+};
+
+/**
+ * `schtasks /End` terminates the launcher only; the node it started would
+ * keep running, unsupervised and invisible to the task (seen on windows-latest,
+ * 11-04: a stopped task left its daemon checking in). A daemon started by the
+ * launcher therefore polls the launcher's pid and calls `onGone` once it has
+ * exited. Returns a stop function; does nothing outside the launcher.
+ */
+export const watchWindowsLauncher = ({
+  env = process.env,
+  platform = process.platform,
+  isAlive = pidAlive,
+  onGone,
+  everyMs = 2000,
+  setIntervalFn = setInterval,
+  clearIntervalFn = clearInterval,
+  streams = [process.stdout, process.stderr],
+}) => {
+  const pid = Number(env[LAUNCHER_PID_ENV]);
+  if (platform !== 'win32' || !Number.isInteger(pid) || pid <= 0) return () => {};
+  // The launcher holds this process's stdout and stderr. Once it exits, any
+  // log line (a poll, a heartbeat) fails with EPIPE, and an unhandled stream
+  // error would end the daemon before it stops its seats. So the streams
+  // swallow errors from the moment the watch is armed, not only after the
+  // launcher's exit is noticed up to two seconds later.
+  for (const stream of streams) stream?.on?.('error', () => {});
+  const timer = setIntervalFn(() => {
+    if (isAlive(pid)) return;
+    clearIntervalFn(timer);
+    onGone(pid);
+  }, everyMs);
+  if (typeof timer?.unref === 'function') timer.unref();
+  return () => clearIntervalFn(timer);
+};
+
+export const uninstallWindowsService = async ({ home, execCmd, removeFile, existsFile }) => {
+  const target = windowsServicePaths(home);
+  await execCmd(['schtasks', '/End', '/TN', target.taskName]).catch(() => {});
+  await execCmd(['schtasks', '/Delete', '/TN', target.taskName, '/F']).catch(() => {});
+  for (const file of [target.file, target.launcher, target.envFile]) {
+    if (existsFile(file)) removeFile(file);
+  }
+  return target;
+};
+
+export const windowsServiceAction = async ({ action, home, execCmd }) => {
+  const target = windowsServicePaths(home);
+  const name = target.taskName;
+  if (action === 'stop') {
+    // Disabled first, so the one-minute watchdog cannot start it again.
+    await execCmd(['schtasks', '/Change', '/TN', name, '/DISABLE']);
+    await execCmd(['schtasks', '/End', '/TN', name]).catch(() => {});
+    return target;
+  }
+  if (action === 'restart') await execCmd(['schtasks', '/End', '/TN', name]).catch(() => {});
+  await execCmd(['schtasks', '/Change', '/TN', name, '/ENABLE']);
+  await execCmd(['schtasks', '/Run', '/TN', name]);
+  return target;
+};

package/src/lib/daemon-service.js

@@ -1,7 +1,8 @@
 /**
  * ADR-026 D1: install-once service registration for the resident daemon.
  *
- * macOS gets a launchd LaunchAgent, Linux a systemd user unit. Both run the
+ * macOS gets a launchd LaunchAgent, Linux a systemd user unit, Windows a
+ * per-user Task Scheduler task (daemon-service-windows.js). All three run the
  * exact interpreter + CLI entry that executed `daemon install`, resolved at
  * install time — a PATH lookup at boot would race version managers and
  * silently run a different install than the one the user tested.
@@ -14,17 +15,20 @@ import { randomBytes } from 'crypto';
 import { existsSync, renameSync, unlinkSync, writeFileSync } from 'fs';
 import { homedir, userInfo } from 'os';
 import { join, dirname, resolve } from 'path';
+import {
+  installWindowsService, uninstallWindowsService, windowsServiceAction, windowsServicePaths,
+} from './daemon-service-windows.js';
 
 export const LAUNCHD_LABEL = 'me.commonly.daemon';
 export const SYSTEMD_UNIT = 'commonly-daemon.service';
 
 export const daemonLogPath = (home = homedir()) => join(home, '.commonly', 'logs', 'daemon', 'daemon.log');
 
-export const servicePaths = (platform = process.platform, home = homedir()) => (
-  platform === 'darwin'
-    ? { kind: 'launchd', file: join(home, 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) }
-    : { kind: 'systemd', file: join(home, '.config', 'systemd', 'user', SYSTEMD_UNIT) }
-);
+export const servicePaths = (platform = process.platform, home = homedir()) => {
+  if (platform === 'darwin') return { kind: 'launchd', file: join(home, 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`) };
+  if (platform === 'win32') return windowsServicePaths(home);
+  return { kind: 'systemd', file: join(home, '.config', 'systemd', 'user', SYSTEMD_UNIT) };
+};
 
 const xmlEscape = (value) => String(value)
   .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
@@ -287,7 +291,22 @@ export const installDaemonService = async ({
   const missing = missingProviderKeys({ names: providerKeyEnvNames, env });
 
   let startsAtBoot = false;
-  if (target.kind === 'launchd') {
+  if (target.kind === 'schtasks') {
+    // A logon task, like a LaunchAgent: it starts when this user logs in.
+    mkdirp(dirname(target.launcher));
+    await installWindowsService({
+      home,
+      nodePath,
+      cliPath,
+      logPath: daemonLogPath(home),
+      providerEnv,
+      env,
+      writeFile,
+      execCmd,
+      lookupUsername,
+      warn,
+    });
+  } else if (target.kind === 'launchd') {
     // The mode and the atomicity are the WRITER's, not an ordering rule here:
     // `writeServiceFile` creates a 0600 sibling and renames it over the target,
     // so no chmod is needed on this path and no half-written unit is ever
@@ -335,6 +354,11 @@ export const uninstallDaemonService = async ({
     log('No installed daemon service found.');
     return null;
   }
+  if (target.kind === 'schtasks') {
+    await uninstallWindowsService({ home, execCmd, removeFile, existsFile });
+    log(`Removed the ${target.taskName} scheduled task and its files (${dirname(target.file)}).`);
+    return target;
+  }
   if (target.kind === 'launchd') {
     await execCmd(['launchctl', 'unload', '-w', target.file]).catch(() => {});
   } else {
@@ -352,6 +376,7 @@ const serviceAction = async ({
   execCmd,
 }) => {
   const target = servicePaths(platform, home);
+  if (target.kind === 'schtasks') return windowsServiceAction({ action, home, execCmd });
   if (target.kind === 'launchd') {
     if (action === 'start') {
       // `install` already loads the plist. A second `start` should be

package/src/lib/daemon-store.js

@@ -64,14 +64,19 @@ const validateRecord = (record) => {
   return record;
 };
 
-export const loadDaemonRecord = () => {
+export const loadDaemonRecord = ({ platform = process.platform } = {}) => {
   const path = daemonRecordPath();
   const dir = daemonDir();
   if (!existsSync(path)) return null;
-  if ((statSync(dir).mode & 0o077) !== 0) {
+  // D245: Windows has no POSIX mode bits. Node reports every file there as
+  // 0o666 (0o444 when read-only) whatever its ACL, so this check refused every
+  // registration on Windows. Access there is the ACL's job; the record sits in
+  // the user's profile, which only that user (and administrators) can read.
+  const posix = platform !== 'win32';
+  if (posix && (statSync(dir).mode & 0o077) !== 0) {
     throw new Error(`Daemon credential directory permissions are insecure at ${dir}. Set them to 0700 before running the daemon.`);
   }
-  if ((statSync(path).mode & 0o077) !== 0) {
+  if (posix && (statSync(path).mode & 0o077) !== 0) {
     throw new Error(`Daemon credential file permissions are insecure at ${path}. Set them to 0600 before running the daemon.`);
   }
   try {

package/src/lib/daemon-supervisor.js

@@ -65,6 +65,9 @@ export const createDaemonSupervisor = ({
   loadToken, // (agentName) => token record | null
   saveToken, // (agentName, record) => void
   runtimeInventory = async () => undefined,
+  // Machine-level facts for the check-in, read locally each beat (D245: the
+  // Windows unsandboxed opt-in). Never derived from anything the server sent.
+  machineReport = () => ({}),
   resolveAdapter, // async (runtime) => adapter name for THIS machine
   persistState = () => {}, // (agentStates) => void; must not persist secrets
   log = () => {},
@@ -555,7 +558,11 @@ export const createDaemonSupervisor = ({
   const heartbeat = async () => {
     if (stopped || now() < reconnectAfter) return;
     try {
-      await client.post(`/api/machines/${record.machineDbId}/heartbeat`, { agents: agentStates(), runtimeInventory: await runtimeInventory() });
+      await client.post(`/api/machines/${record.machineDbId}/heartbeat`, {
+        ...machineReport(),
+        agents: agentStates(),
+        runtimeInventory: await runtimeInventory(),
+      });
       connectionRestored();
     } catch (error) {
       connectionFailure(error, 'heartbeat failed');

package/src/lib/grant-broker-guard.js

@@ -184,13 +184,21 @@ export const confinementReason = (environment, adapter, platform = process.platf
   const declared = sandbox;
   if (declared.mode === 'none') return 'sandbox_mode_none';
   if (effectiveSandboxTrust(declared.trust) !== 'public') return 'sandbox_trust_not_public';
+  // D245: native Windows has no OS jail for any adapter. Claude there runs
+  // only by the user's --unsandboxed (policy without a jail), and Codex runs on
+  // its own profiles with no Commonly sandbox, so neither carries a grant.
+  if (platform === 'win32') return 'sandbox_mode_unenforceable';
   const mode = resolvePublicSandboxMode(declared, platform);
   if (typeof mode !== 'string' || !ENFORCING_MODES.has(mode)) return 'sandbox_mode_unenforceable';
   return null;
 };
 
-const detailFor = (reason, adapter, environment) => {
+const detailFor = (reason, adapter, environment, platform = process.platform) => {
   const drop = 'or drop the grant broker from this seat';
+  if (reason === 'sandbox_mode_unenforceable' && platform === 'win32') {
+    return 'native Windows has no sandbox Commonly can enforce, so no agent on this computer gets connector grants;'
+      + ` run the agent on macOS or Linux to use grants, ${drop}`;
+  }
   if (reason === 'adapter_cannot_confine') {
     return `the seat runs the '${adapter || 'unresolved'}' adapter, which is not approved to receive the grant broker;`
       + ' move this seat to the claude or codex'
@@ -245,7 +253,7 @@ export const withholdGrantBroker = (environment, adapter, {
       code: GRANT_BROKER_REFUSAL_CODE,
       decidedBy: 'daemon',
       reason,
-      detail: detailFor(reason, adapter, environment),
+      detail: detailFor(reason, adapter, environment, platform),
     }, withheld);
   }
   return { ...environment, mcp: kept };

package/src/lib/native-runtime-inventory.js

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { readFile, stat } from 'node:fs/promises';
 import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { resolveWindowsCommandWithReason } from './windows-command.js';
 
 export const claudeEffortsFromHelp = (help) => {
   const section = String(help).match(/--effort\s+<[^>]+>([\s\S]*?)(?=\n\s+--|$)/)?.[1];
@@ -17,8 +18,14 @@ export const codexModelsFromCache = (cache) => {
     // Only levels supported by every advertised model are offered globally.
     efforts: levels.length ? levels[0].filter((level) => levels.every((list) => list.includes(level))) : [] };
 };
-export const claudeRuntimeInventory = async ({ spawnSyncImpl = spawnSync, env = process.env } = {}) => {
-  const result = spawnSyncImpl('claude', ['--help'], {
+export const claudeRuntimeInventory = async ({
+  spawnSyncImpl = spawnSync, env = process.env, commandResolution = {},
+} = {}) => {
+  // Windows: an npm `claude.cmd` is resolved to its target, never run through
+  // a shell (#2141). Elsewhere this is `claude --help`, unchanged.
+  const located = resolveWindowsCommandWithReason('claude', { env, ...commandResolution });
+  if (!located.command) return { models: null, efforts: [] };
+  const result = spawnSyncImpl(located.command, [...located.args, '--help'], {
     encoding: 'utf8', timeout: 5000, maxBuffer: 128 * 1024, cwd: tmpdir(), env,
   });
   return { models: null, efforts: result.status === 0 ? claudeEffortsFromHelp(result.stdout) : [] };

package/src/lib/sandbox/bwrap.js

@@ -34,7 +34,13 @@ const expandHome = (p) => {
 // Never advise `sandbox.mode: none` here: a public seat refuses it, and the
 // mechanisms that do exist are named instead.
 const MACOS_MESSAGE = 'bwrap is Linux-only. On macOS a public seat runs under Seatbelt '
-  + '(sandbox.mode workspace or read-only); Windows has no supported sandbox yet, so use WSL 2.';
+  + '(sandbox.mode workspace or read-only).';
+// D245: Windows has no sandbox for agents, and WSL does not give Claude Code
+// one either (host-check.js linuxClaudeMessage), so the only honest way
+// forward named here is the user's own opt-in (sandbox/windows-unsandboxed.js).
+const WINDOWS_MESSAGE = 'bwrap is Linux-only, and native Windows has no sandbox for agents yet. '
+  + 'To run this agent without one, with your own access to files and commands, add --unsandboxed.';
+const nonLinuxMessage = (platform) => (platform === 'win32' ? WINDOWS_MESSAGE : MACOS_MESSAGE);
 
 const DEFAULT_RO_BINDS = [
   '/etc/ssl/certs',
@@ -55,7 +61,7 @@ const NAMESPACE_PROBE = ['--unshare-all', '--ro-bind', '/', '/', 'true'];
 
 export const detectBwrap = ({ spawn = spawnSync, platform = process.platform } = {}) => {
   if (platform !== 'linux') {
-    return { available: false, error: MACOS_MESSAGE };
+    return { available: false, error: nonLinuxMessage(platform) };
   }
   try {
     const res = spawn('bwrap', ['--version'], { encoding: 'utf8' });
@@ -98,7 +104,7 @@ export const detectBwrap = ({ spawn = spawnSync, platform = process.platform } =
  */
 export const wrapArgvWithBwrap = (innerArgv, env, opts = {}) => {
   if (process.platform !== 'linux') {
-    throw new Error(MACOS_MESSAGE);
+    throw new Error(nonLinuxMessage(process.platform));
   }
   if (!Array.isArray(innerArgv) || innerArgv.length === 0) {
     throw new Error('wrapArgvWithBwrap requires a non-empty innerArgv');

package/src/lib/sandbox/host-check.js

@@ -21,6 +21,9 @@ import { PUBLIC_SANDBOX_MODES, resolvePublicSandboxMode } from './mode.js';
 import { detectBwrap as defaultDetectBwrap } from './bwrap.js';
 import { detectSeatbelt as defaultDetectSeatbelt } from './seatbelt.js';
 
+// D245: the Windows opt-in (windows-unsandboxed.js re-exports it; defined here to avoid an import cycle).
+export const UNSANDBOXED_FLAG = '--unsandboxed';
+
 // The Seatbelt modes come from mode.js, as grant-broker-guard's do, so a mode
 // added there is not silently missing here.
 const SEATBELT_MODES = PUBLIC_SANDBOX_MODES;
@@ -36,7 +39,13 @@ export const windowsSandboxMessage = (adapterName) => {
   // Code (see linuxClaudeMessage).
   return [
     `Commonly runs a connected ${label} inside a sandbox, and has no sandbox for Windows yet,`,
-    'so this agent cannot listen for @mentions from native Windows. Instead:',
+    'so by default this agent cannot listen for @mentions from native Windows. You can:',
+    // D245: the user's own choice, never a default (sandbox/windows-unsandboxed.js).
+    ...(adapterName === 'claude'
+      ? [`  - Run it without an OS sandbox: add ${UNSANDBOXED_FLAG}`
+        + ` (commonly agent run <name> ${UNSANDBOXED_FLAG}, or commonly daemon install ${UNSANDBOXED_FLAG}).`
+        + " It keeps Commonly's restricted tool settings and gets no shell, but nothing at the OS level confines it, and it gets no connector grants."]
+      : []),
     ...(adapterName === 'claude'
       ? ['  - Use Commonly from your own Claude Code sessions: the Connect page shows a PowerShell `claude mcp add` command.']
       : [`  - WSL 2 (Ubuntu): install Node and ${label} inside WSL, run \`sudo apt install bubblewrap\`,`
@@ -66,6 +75,9 @@ export const hostSandboxRefusal = ({
   environment,
   adapterName,
   platform = process.platform,
+  // D245: the user's own opt-in for this run (windows-unsandboxed.js
+  // hostUnconfinedForRun). Never derived from the environment.
+  hostUnconfined = false,
   detectBwrap = defaultDetectBwrap,
   detectSeatbelt = defaultDetectSeatbelt,
 } = {}) => {
@@ -77,7 +89,9 @@ export const hostSandboxRefusal = ({
   const mode = sandbox.mode ?? resolvePublicSandboxMode(sandbox, platform);
   if (mode !== 'bwrap' && !SEATBELT_MODES.has(mode)) return null;
 
-  if (platform === 'win32') return windowsSandboxMessage(adapterName);
+  if (platform === 'win32') {
+    return hostUnconfined === true && adapterName === 'claude' ? null : windowsSandboxMessage(adapterName);
+  }
   // A workspace claude seat falls through to the bubblewrap probe below; the
   // probe failing, for any reason, is a refusal like any other adapter's.
   if (mode === 'bwrap' && adapterName === 'claude' && sandbox.trust !== 'workspace') {

package/src/lib/sandbox/windows-unsandboxed.js

@@ -0,0 +1,131 @@
+/**
+ * D245: the user's own opt-in to run an agent without a sandbox on native
+ * Windows.
+ *
+ * Commonly confines a public seat with Seatbelt on macOS and bubblewrap on
+ * Linux (mode.js). Windows has neither, so without this a public Claude Code,
+ * OpenCode or Qwen seat is refused on Windows (host-check.js). The opt-in
+ * keeps that refusal as the default and lets the person at the keyboard choose
+ * otherwise, for this machine only:
+ *
+ * - `commonly agent run <name> --unsandboxed` for one foreground run, or
+ * - `commonly daemon install --unsandboxed`, which writes the marker below; the
+ *   seats that daemon spawns read it. Installing again without the flag, or
+ *   uninstalling, removes it.
+ *
+ * Only a LOCAL action sets it. Nothing the server sends (a seat's declared
+ * environment, an adopted-seat row, a pod's settings) can create the marker or
+ * stand in for the flag: `hostUnconfinedForRun` takes the decision as an
+ * argument, and the adapter reads it from its spawn context, never from the
+ * environment.
+ *
+ * Only the OS jail is skipped. The seat keeps its trust, and with it the
+ * public tool policy (--setting-sources '', --strict-mcp-config, dontAsk,
+ * Read(./**), the denied tools), the sanitized environment and the TASK-294
+ * per-turn placement: on a host with no OS isolation that policy IS the
+ * sandbox. An earlier form of this rewrote the environment to `mode: 'none'`,
+ * which dropped the trust and the policy with it (review of #3388). The
+ * decision now travels as `hostUnconfined` on the adapter's spawn context,
+ * set only by `agent run`, so the environment, stored or derived, never
+ * carries it and nothing the server sends can set it.
+ *
+ * Claude Code only: it is the adapter that applies the public policy without
+ * its jail. OpenCode and Qwen stay refused on Windows, and Codex is never
+ * refused there (it confines with its own profiles). No seat on native Windows
+ * gets the grant broker (grant-broker-guard.js), and the server refuses grant
+ * use for every seat on a machine whose daemon reports the opt-in.
+ */
+
+import { existsSync, readFileSync, rmSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+import { writeServiceFile } from '../daemon-service.js';
+import { UNSANDBOXED_FLAG } from './host-check.js';
+
+export { UNSANDBOXED_FLAG };
+
+export const unsandboxedMarkerPath = (home = homedir()) => join(home, '.commonly', 'daemon', 'unsandboxed.json');
+
+/** The flag is a Windows answer to a Windows gap; anywhere else it is refused. */
+export const unsandboxedFlagRefusal = (platform = process.platform) => (platform === 'win32'
+  ? null
+  : `${UNSANDBOXED_FLAG} is only for native Windows, which has no sandbox for agents yet. On this machine agents run in a sandbox.`);
+
+export const loadUnsandboxedOptIn = ({
+  platform = process.platform, home = homedir(), exists = existsSync, read = readFileSync,
+} = {}) => {
+  if (platform !== 'win32') return false;
+  const file = unsandboxedMarkerPath(home);
+  if (!exists(file)) return false;
+  try {
+    const value = JSON.parse(read(file, 'utf8'));
+    return value?.unsandboxed === true && value?.platform === 'win32';
+  } catch {
+    return false;
+  }
+};
+
+export const saveUnsandboxedOptIn = ({ home = homedir(), writeFile = writeServiceFile, now = () => new Date() } = {}) => {
+  writeFile(unsandboxedMarkerPath(home), `${JSON.stringify({ unsandboxed: true, platform: 'win32', optedInAt: now().toISOString() })}\n`);
+};
+
+export const clearUnsandboxedOptIn = ({ home = homedir(), exists = existsSync, remove = rmSync } = {}) => {
+  const file = unsandboxedMarkerPath(home);
+  if (!exists(file)) return false;
+  remove(file);
+  return true;
+};
+
+/**
+ * Did the user opt in for THIS run? The typed flag, or, for a seat the daemon
+ * spawned, the marker that `daemon install --unsandboxed` wrote. A foreground
+ * run never reads the marker, so installing the daemon unsandboxed does not
+ * quietly change what a hand-started `agent run` does.
+ */
+export const runOptedInUnsandboxed = ({ flag, env = process.env, load = loadUnsandboxedOptIn } = {}) => (
+  flag === true || (env.COMMONLY_MANAGED_RUNNER === '1' && load() === true)
+);
+
+/** The adapters that can run their trust's tool policy without the OS jail. */
+export const POLICY_ONLY_ADAPTERS = new Set(['claude']);
+
+/**
+ * Does this run skip the OS jail? Only on win32, only by the user's own
+ * opt-in, only for an adapter that keeps its policy without the jail, and only
+ * for a seat whose trust brings that policy (public or workspace). A seat with
+ * no confined trust is the owner's own and is never jailed anywhere, so the
+ * opt-in changes nothing for it, and the notice must not promise it a policy.
+ */
+export const hostUnconfinedForRun = ({
+  optedIn, adapterName, environment, platform = process.platform,
+}) => {
+  const trust = environment?.sandbox?.trust;
+  return platform === 'win32' && optedIn === true && POLICY_ONLY_ADAPTERS.has(adapterName)
+    && (trust === 'public' || trust === 'workspace');
+};
+
+/**
+ * What the daemon's check-in says about this host. The server refuses grant
+ * use for every seat on a machine that reports either Windows value.
+ */
+export const hostSandboxReport = ({ platform = process.platform, load = () => loadUnsandboxedOptIn({ platform }) } = {}) => {
+  if (platform !== 'win32') return 'default';
+  return load() === true ? 'unsandboxed-opted-in' : 'native-windows';
+};
+
+/** One plain line for the run log and `daemon status`. */
+export const UNSANDBOXED_NOTICE = 'unsandboxed (opted in): Windows has no sandbox, so nothing at the OS level confines this agent. It keeps Commonly\'s restricted tool settings, gets no shell even with --allow write, and gets no connector grants.';
+
+export default {
+  UNSANDBOXED_FLAG,
+  UNSANDBOXED_NOTICE,
+  clearUnsandboxedOptIn,
+  loadUnsandboxedOptIn,
+  runOptedInUnsandboxed,
+  saveUnsandboxedOptIn,
+  unsandboxedFlagRefusal,
+  unsandboxedMarkerPath,
+  hostUnconfinedForRun,
+  hostSandboxReport,
+};