@cruxy/cli 0.29.2 → 0.29.4

package/dist/agent/loop.js

@@ -1,6 +1,7 @@
 import { CruxyError, providerUnsupported } from "../errors/index.js";
 import { resolveTaskModel, } from "../routing/index.js";
 import { buildSystemPrompt } from "./prompts.js";
+import { resolveShell } from "../tools/shell/resolve-shell.js";
 /** Tools whose successful call is a file change (drives the `on-file-change`
  * hook). Kept in sync with the file-mutating tool set. */
 const FILE_MUTATING_TOOLS = new Set(["write_file", "edit_file", "apply_patch"]);
@@ -45,6 +46,10 @@ async function driveLoop(args, renderer, routed) {
     let messages = [...args.messages];
     const usage = { input_tokens: 0, output_tokens: 0 };
     const maxIterations = config.agent.maxIterations;
+    // Resolve the host shell up front (JC#8) so a Windows box with no usable shell
+    // fails loud NOW (CRUXY_E_NO_SHELL) rather than mid-task, and the model gets the
+    // dialect directive from turn 1. Memoized, so run_command / run_tests reuse it.
+    const shellPlan = resolveShell(config.shell);
     // The tool catalogue and environment are stable across the loop, so build the
     // system prompt once. The builder degrades gracefully when git is null.
     const system = buildSystemPrompt({
@@ -60,6 +65,7 @@ async function driveLoop(args, renderer, routed) {
         recalledMemory: args.recalledMemory ?? null,
         planMode: args.planMode ?? false,
         subagent: args.subagent ?? false,
+        shellDialect: shellPlan.dialect,
     });
     let iterations = 0;
     for (let i = 0; i < maxIterations; i++) {

package/dist/agent/prompts.d.ts

@@ -6,6 +6,7 @@
  * dynamic environment block, so the model always knows where it is, what it
  * can do, and how it's expected to behave.
  */
+import type { ShellDialect } from "../tools/shell/resolve-shell.js";
 export interface ToolSummary {
     name: string;
 }
@@ -38,6 +39,13 @@ export interface PromptContext {
     planMode?: boolean;
     /** Subagent run (C.14): inject the bounded-subtask directive. */
     subagent?: boolean;
+    /**
+     * The resolved shell's command dialect (from resolve-shell.ts). When it is not
+     * a POSIX shell — e.g. PowerShell, because no Git Bash was found on Windows —
+     * a directive tells the model to emit that dialect instead of bash. Absent /
+     * "posix" → no directive (bash-isms are correct there; a nudge would be wrong).
+     */
+    shellDialect?: ShellDialect;
 }
 /** Assemble the full system prompt for a session. */
 export declare function buildSystemPrompt(ctx: PromptContext): string;

package/dist/agent/prompts.js

@@ -70,6 +70,29 @@ function renderEnvironment(ctx) {
     }
     return `## Environment\n${lines.join("\n")}`;
 }
+/**
+ * The command-dialect directive (JC#4). Emitted ONLY for a non-POSIX shell:
+ * under bash / Git Bash the model's default bash syntax is correct, so a "use
+ * PowerShell" nudge would be actively wrong. Keeps the model from emitting
+ * bash-isms that a Windows PowerShell/cmd shell would silently mis-run.
+ */
+function renderShellDialect(dialect) {
+    if (!dialect || dialect === "posix")
+        return null;
+    if (dialect === "powershell") {
+        return `## Shell dialect
+\`run_command\` and \`run_tests\` execute through **PowerShell**, not a POSIX/bash shell. Emit native PowerShell:
+- Sequence with \`;\`; run-on-success with \`if ($?) { ... }\` — NOT bash \`&&\` / \`||\`.
+- Environment variables are \`$env:NAME\` (read) and \`$env:NAME = "v"\` (set) — never \`$NAME\` or \`export NAME=\`.
+- Discard output with \`2>$null\` / \`| Out-Null\`, not \`2>/dev/null\`; no heredocs or single-quote-escaping tricks.
+Cross-platform tools (npm, pnpm, git, cargo, node, python) take the same arguments here as anywhere.`;
+    }
+    return `## Shell dialect
+\`run_command\` and \`run_tests\` execute through **cmd.exe**, not a POSIX/bash shell. Emit native cmd:
+- Sequence with \`&\`; environment variables are \`%NAME%\`; set them with \`set NAME=value\`.
+- No bash constructs (\`export\`, single-quoted strings, \`2>/dev/null\`, heredocs).
+Cross-platform tools (npm, git, cargo, node) take the same arguments here as anywhere.`;
+}
 function renderTools(tools) {
     if (tools.length === 0) {
         return "## Tools\nNo tools are available this session; respond in text only.";
@@ -89,6 +112,9 @@ export function buildSystemPrompt(ctx) {
     const approval = "Side-effecting actions (file writes, shell commands) require the user's approval; destructive or irreversible actions are flagged distinctly.";
     const core = CORE.replace("${APPROVAL_CLAUSE}", approval);
     const sections = [core, renderEnvironment(ctx), renderTools(ctx.tools)];
+    const dialect = renderShellDialect(ctx.shellDialect);
+    if (dialect)
+        sections.push(dialect);
     if (ctx.planMode)
         sections.push(PLAN_MODE_SECTION);
     if (ctx.subagent)

package/dist/cli/commands/mcp.js

@@ -131,7 +131,7 @@ export function mcpCommand() {
             ]);
         }
         const io = defaultOnboardingIO(shouldUseColor(process.stderr));
-        io.write(`${t.strong(`credential for "${server}"`)} ${t.muted(`(stored as "${ref}" in ~/.cruxy/credentials.json, 0600)`)}\n`);
+        io.write(`${t.strong(`credential for "${server}"`)} ${t.muted(`(stored as "${ref}" in ~/.cruxy/credentials.json, owner-only)`)}\n`);
         io.write(`${t.muted("paste the bearer token (input hidden): ")}`);
         const token = (await io.readSecret()).trim();
         if (!token) {

package/dist/cli/commands/test.js

@@ -25,6 +25,7 @@ export function testCommand() {
             cwd,
             timeoutMs: config.shell.timeoutMs,
             captureBytes: config.test.captureBytes,
+            shell: config.shell,
         });
         const seconds = (result.durationMs / 1000).toFixed(1);
         if (result.passed) {

package/dist/config/credentials.d.ts

@@ -9,11 +9,10 @@ export declare function readCredential(provider: string, file?: string): string
  * secret is sourced from. Never throws.
  */
 export declare function readMcpCredential(ref: string, file?: string): string | undefined;
-/** Persist MCP bearer token for credential name `ref`. Same 0600/0700 as keys. */
+/** Persist MCP bearer token for credential name `ref`. Same owner-only guarantee. */
 export declare function writeMcpCredential(ref: string, token: string, file?: string): void;
 /**
- * Persist `key` for `provider`, merging into any existing store. The file is
- * written `0600` and its directory `0700` so the secret is owner-only — enforced
- * with an explicit `chmod` after write (mkdir/write modes are umask-masked).
+ * Persist `key` for `provider`, merging into any existing store. Written
+ * owner-only (see {@link writeInto}); refuses loudly if that can't be enforced.
  */
 export declare function writeCredential(provider: string, key: string, file?: string): void;

package/dist/config/credentials.js

@@ -1,13 +1,23 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { CREDENTIALS_FILE_NAME } from "../constants.js";
+import { credentialsUnprotected } from "../errors/index.js";
+import { logger } from "../utils/logger.js";
+import { enforceOwnerOnly, isOwnerOnly } from "./owner-only.js";
 import { globalDir } from "./paths.js";
 /**
  * The credentials store (U.6) — the one place a provider API key is persisted.
  * It lives **outside** `config.json` on purpose: config is secret-free by design
  * ("the API key comes from env"), so secrets get their own file with restrictive
- * permissions (`0600`, dir `0700`), the same shape as gh/aws/npm. `resolveApiKey`
- * reads it as a fallback after the environment.
+ * permissions, the same shape as gh/aws/npm. `resolveApiKey` reads it as a
+ * fallback after the environment.
+ *
+ * "Restrictive" means **owner-only**: POSIX `0600` (dir `0700`), and on Windows
+ * an NTFS ACL granting only the current user (POSIX modes are meaningless there —
+ * see {@link enforceOwnerOnly}). The guarantee is enforced AND verified on every
+ * write; if it cannot be established the write is refused loudly
+ * (`CRUXY_E_CREDENTIALS_UNPROTECTED`) rather than persisting a secret at
+ * permissions we could not secure.
  */
 /** Bumped if the on-disk shape ever changes. */
 const CREDENTIALS_VERSION = 1;
@@ -15,6 +25,26 @@ const CREDENTIALS_VERSION = 1;
 export function credentialsPath() {
     return join(globalDir(), CREDENTIALS_FILE_NAME);
 }
+/** Paths already warned about this process, so a loose-perms warning fires once. */
+const warnedLoosePerms = new Set();
+/**
+ * Best-effort: warn (never refuse) if an existing store is readable beyond its
+ * owner, so an upgrade from a build that couldn't secure it isn't silently
+ * insecure — and isn't bricked either. Fires at most once per path per process.
+ */
+function warnIfLoosePerms(file) {
+    if (warnedLoosePerms.has(file))
+        return;
+    warnedLoosePerms.add(file);
+    try {
+        if (existsSync(file) && !isOwnerOnly(file)) {
+            logger.warn(`credentials store ${file} is not owner-only — other users on this machine may be able to read it. Re-run \`cruxy login\` (or re-store the MCP credential) to repair its permissions.`);
+        }
+    }
+    catch {
+        // Perms could not be inspected — stay silent rather than cry wolf.
+    }
+}
 /** Parse the store at `file`, or `null` if absent/unreadable/malformed. */
 function readStore(file) {
     if (!existsSync(file))
@@ -35,6 +65,7 @@ function readStore(file) {
 }
 /** The stored key for `provider`, or `undefined`. Never throws. */
 export function readCredential(provider, file = credentialsPath()) {
+    warnIfLoosePerms(file);
     const store = readStore(file);
     const key = store?.keys[provider];
     return typeof key === "string" && key !== "" ? key : undefined;
@@ -46,52 +77,74 @@ export function readCredential(provider, file = credentialsPath()) {
  * secret is sourced from. Never throws.
  */
 export function readMcpCredential(ref, file = credentialsPath()) {
+    warnIfLoosePerms(file);
     const store = readStore(file);
     const token = store?.mcp?.[ref];
     return typeof token === "string" && token !== "" ? token : undefined;
 }
-/** Persist MCP bearer token for credential name `ref`. Same 0600/0700 as keys. */
+/** Persist MCP bearer token for credential name `ref`. Same owner-only guarantee. */
 export function writeMcpCredential(ref, token, file = credentialsPath()) {
     writeInto(file, (store) => {
         store.mcp ??= {};
         store.mcp[ref] = token;
-    });
+    }, "mcp");
 }
 /**
- * Persist `key` for `provider`, merging into any existing store. The file is
- * written `0600` and its directory `0700` so the secret is owner-only — enforced
- * with an explicit `chmod` after write (mkdir/write modes are umask-masked).
+ * Persist `key` for `provider`, merging into any existing store. Written
+ * owner-only (see {@link writeInto}); refuses loudly if that can't be enforced.
  */
 export function writeCredential(provider, key, file = credentialsPath()) {
     writeInto(file, (store) => {
         store.keys[provider] = key;
-    });
+    }, "provider");
 }
 /**
- * Merge `mutate` into the store and persist it owner-only: dir `0700`, file
- * `0600`, enforced with an explicit `chmod` after write (mkdir/write modes are
- * umask-masked). The one write path shared by every credential namespace.
+ * Merge `mutate` into the store and persist it owner-only. The one write path
+ * shared by every credential namespace, and the single place the owner-only
+ * guarantee is enforced:
+ *
+ *   1. The DIRECTORY is made owner-only FIRST, before any secret is written — so
+ *      the file inherits owner-only at creation (no window where it exists under
+ *      inherited permissions), and if the directory can't be secured we refuse
+ *      before a secret ever touches disk.
+ *   2. The new content is written to a temp file, made owner-only + VERIFIED,
+ *      then atomically renamed over the target. A failure removes the temp and
+ *      leaves any existing store untouched — never a torn or clobbered write.
+ *
+ * Enforcement runs on every write, so a pre-existing store with loose
+ * permissions is repaired in place. If owner-only cannot be established the write
+ * is refused with `CRUXY_E_CREDENTIALS_UNPROTECTED` (`kind` tailors the
+ * remediation: provider keys → env var; MCP tokens → no env fallback).
  */
-function writeInto(file, mutate) {
+function writeInto(file, mutate, kind) {
     const dir = dirname(file);
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    mkdirSync(dir, { recursive: true });
     try {
-        chmodSync(dir, 0o700);
+        enforceOwnerOnly(dir, { directory: true });
     }
-    catch {
-        // Best-effort on platforms without POSIX modes (e.g. Windows).
+    catch (err) {
+        // Refuse BEFORE writing any secret — nothing sensitive has hit disk yet.
+        throw credentialsUnprotected(kind, dir, err);
     }
     const store = readStore(file) ?? { version: CREDENTIALS_VERSION, keys: {} };
     store.version = CREDENTIALS_VERSION;
     mutate(store);
-    writeFileSync(file, JSON.stringify(store, null, 2) + "\n", {
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n", {
         encoding: "utf8",
         mode: 0o600,
     });
     try {
-        chmodSync(file, 0o600);
+        enforceOwnerOnly(tmp, { directory: false }); // sets + verifies, or throws
+        renameSync(tmp, file); // atomic replace; the owner-only ACL moves with it
     }
-    catch {
-        // Best-effort (see above).
+    catch (err) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            // The temp may already be gone; the target store is untouched regardless.
+        }
+        throw credentialsUnprotected(kind, file, err);
     }
 }

package/dist/config/owner-only.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Make `path` owner-only, or throw. On Windows the ACL is verified after the
+ * edit (both the `icacls` exit code AND a read-back), so a returned call is a
+ * genuine guarantee, never a best-effort attempt.
+ *
+ * @throws if owner-only permissions cannot be established (non-zero `icacls`,
+ *   an unresolvable SID, a filesystem without ACLs/modes, …).
+ */
+export declare function enforceOwnerOnly(path: string, opts?: {
+    directory?: boolean;
+}): void;
+/**
+ * Whether `path` is currently owner-only. POSIX: no group/other bits. Windows:
+ * best-effort — the ACL names no broad principal (Everyone / Authenticated
+ * Users / Users). Used both to verify {@link enforceOwnerOnly} and to warn on a
+ * pre-existing store with loose permissions. Returns `true` when it genuinely
+ * cannot tell (a missing tool), so a warning path never cries wolf.
+ */
+export declare function isOwnerOnly(path: string): boolean;

package/dist/config/owner-only.js

@@ -0,0 +1,114 @@
+import { execFileSync } from "node:child_process";
+import { chmodSync, statSync } from "node:fs";
+/**
+ * Cross-platform "owner-only" file/dir permissions — the one place that knows
+ * how to make a path readable by nobody but its owner, and how to check whether
+ * it already is.
+ *
+ * POSIX is `chmod` (`0600` file / `0700` dir). Windows has no POSIX modes —
+ * `fs.chmod` there only toggles the read-only attribute and never touches the
+ * NTFS ACL (a libuv limitation), so it is worthless for confidentiality. The
+ * Windows equivalent is an ACL edit via `icacls`: strip the inherited ACEs (the
+ * only source of "others" access on a fresh file) and grant Full to exactly the
+ * current user's SID.
+ *
+ * Every function here THROWS rather than swallowing a failure — the caller (the
+ * credential store) turns that into a loud refusal to persist a secret it can't
+ * secure. Nothing here silently claims success.
+ */
+const isWindows = process.platform === "win32";
+/** `undefined` = not yet resolved, `null` = resolution failed this process. */
+let cachedSid;
+/**
+ * The current user's SID (e.g. `S-1-5-21-…`) via `whoami /user`, resolved once
+ * and cached. We grant to the SID — never a name — so the ACL is correct
+ * regardless of the machine's display language (`BUILTIN\Users` etc. localise).
+ * Returns `null` if it cannot be determined.
+ */
+function currentUserSid() {
+    if (cachedSid !== undefined)
+        return cachedSid;
+    try {
+        const out = execFileSync("whoami", ["/user", "/fo", "csv", "/nh"], {
+            encoding: "utf8",
+        });
+        const m = out.match(/S-1-[0-9-]+/);
+        cachedSid = m ? m[0] : null;
+    }
+    catch {
+        cachedSid = null;
+    }
+    return cachedSid;
+}
+/**
+ * Make `path` owner-only, or throw. On Windows the ACL is verified after the
+ * edit (both the `icacls` exit code AND a read-back), so a returned call is a
+ * genuine guarantee, never a best-effort attempt.
+ *
+ * @throws if owner-only permissions cannot be established (non-zero `icacls`,
+ *   an unresolvable SID, a filesystem without ACLs/modes, …).
+ */
+export function enforceOwnerOnly(path, opts = {}) {
+    const directory = opts.directory ?? false;
+    if (isWindows) {
+        const sid = currentUserSid();
+        if (!sid) {
+            throw new Error("could not resolve the current user's SID (whoami failed) — cannot set an owner-only ACL");
+        }
+        // /inheritance:r removes inherited ACEs (where any "others" access comes
+        // from); /grant:r replaces the DACL with exactly this one grant. A directory
+        // grant carries (OI)(CI) so files created inside inherit owner-only at birth.
+        // The SID must be written `*S-1-…` — a bare token is read as an account NAME
+        // ("No mapping between account names and security IDs" otherwise).
+        const principal = `*${sid}`;
+        const grant = directory ? `${principal}:(OI)(CI)F` : `${principal}:F`;
+        try {
+            execFileSync("icacls", [path, "/inheritance:r", "/grant:r", grant], {
+                stdio: ["ignore", "ignore", "pipe"],
+            });
+        }
+        catch (err) {
+            const stderr = err.stderr?.toString().trim();
+            throw new Error(`icacls could not restrict "${path}"${stderr ? `: ${stderr}` : ""}`);
+        }
+    }
+    else {
+        chmodSync(path, directory ? 0o700 : 0o600);
+    }
+    // Verify the end state rather than trust the set — the guarantee is the point.
+    if (!isOwnerOnly(path)) {
+        throw new Error(`"${path}" is not owner-only after attempting to restrict it`);
+    }
+}
+/**
+ * Whether `path` is currently owner-only. POSIX: no group/other bits. Windows:
+ * best-effort — the ACL names no broad principal (Everyone / Authenticated
+ * Users / Users). Used both to verify {@link enforceOwnerOnly} and to warn on a
+ * pre-existing store with loose permissions. Returns `true` when it genuinely
+ * cannot tell (a missing tool), so a warning path never cries wolf.
+ */
+export function isOwnerOnly(path) {
+    if (!isWindows) {
+        return (statSync(path).mode & 0o077) === 0;
+    }
+    let out;
+    try {
+        out = execFileSync("icacls", [path], { encoding: "utf8" });
+    }
+    catch {
+        return true; // can't inspect → don't raise a false alarm
+    }
+    // `icacls <path>` resolves SIDs to names (locale-dependent on non-English
+    // Windows, hence best-effort): flag the well-known broad principals by name
+    // and by SID for the cases icacls leaves a SID unresolved.
+    const broad = [
+        /\bEveryone\b/i,
+        /\bAuthenticated Users\b/i,
+        /\bBUILTIN\\Users\b/i,
+        /\\Users:/i,
+        /S-1-1-0/, // Everyone
+        /S-1-5-11/, // Authenticated Users
+        /S-1-5-32-545/, // BUILTIN\Users
+    ];
+    return !broad.some((re) => re.test(out));
+}

package/dist/config/schema.d.ts

@@ -105,13 +105,34 @@ export declare const ShellConfigSchema: z.ZodObject<{
     timeoutMs: z.ZodDefault<z.ZodNumber>;
     /** Cap on combined stdout+stderr bytes captured; the rest is truncated. */
     maxOutputBytes: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Explicit shell to run commands through, overriding platform detection. A
+     * path (`/bin/bash`, `C:\\Program Files\\Git\\bin\\bash.exe`, `pwsh`). When
+     * set it WINS over the Git Bash → PowerShell tiering (see resolve-shell.ts):
+     * the user owns the choice. Unset → POSIX uses the default shell; Windows
+     * probes for Git Bash, then PowerShell, then fails loud (CRUXY_E_NO_SHELL).
+     */
+    executable: z.ZodOptional<z.ZodString>;
+    /**
+     * The command dialect of `executable`, so the model is told which syntax to
+     * emit. Only sniffed automatically for unambiguous basenames (bash/sh →
+     * posix, pwsh/powershell → powershell, cmd → cmd); set this for anything else
+     * or the override is rejected (CRUXY_E_CONFIG_INVALID). Ignored without
+     * `executable`.
+     */
+    dialect: z.ZodOptional<z.ZodEnum<["posix", "powershell", "cmd"]>>;
 }, "strict", z.ZodTypeAny, {
     timeoutMs: number;
     maxOutputBytes: number;
+    executable?: string | undefined;
+    dialect?: "posix" | "powershell" | "cmd" | undefined;
 }, {
     timeoutMs?: number | undefined;
     maxOutputBytes?: number | undefined;
+    executable?: string | undefined;
+    dialect?: "posix" | "powershell" | "cmd" | undefined;
 }>;
+export type ShellConfig = z.infer<typeof ShellConfigSchema>;
 /** Context-window management: when to compact the running conversation. */
 export declare const ContextConfigSchema: z.ZodObject<{
     /** Approximate model context budget, in tokens (heuristic estimate). */
@@ -1096,12 +1117,32 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         /** Cap on combined stdout+stderr bytes captured; the rest is truncated. */
         maxOutputBytes: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Explicit shell to run commands through, overriding platform detection. A
+         * path (`/bin/bash`, `C:\\Program Files\\Git\\bin\\bash.exe`, `pwsh`). When
+         * set it WINS over the Git Bash → PowerShell tiering (see resolve-shell.ts):
+         * the user owns the choice. Unset → POSIX uses the default shell; Windows
+         * probes for Git Bash, then PowerShell, then fails loud (CRUXY_E_NO_SHELL).
+         */
+        executable: z.ZodOptional<z.ZodString>;
+        /**
+         * The command dialect of `executable`, so the model is told which syntax to
+         * emit. Only sniffed automatically for unambiguous basenames (bash/sh →
+         * posix, pwsh/powershell → powershell, cmd → cmd); set this for anything else
+         * or the override is rejected (CRUXY_E_CONFIG_INVALID). Ignored without
+         * `executable`.
+         */
+        dialect: z.ZodOptional<z.ZodEnum<["posix", "powershell", "cmd"]>>;
     }, "strict", z.ZodTypeAny, {
         timeoutMs: number;
         maxOutputBytes: number;
+        executable?: string | undefined;
+        dialect?: "posix" | "powershell" | "cmd" | undefined;
     }, {
         timeoutMs?: number | undefined;
         maxOutputBytes?: number | undefined;
+        executable?: string | undefined;
+        dialect?: "posix" | "powershell" | "cmd" | undefined;
     }>>;
     context: z.ZodDefault<z.ZodObject<{
         /** Approximate model context budget, in tokens (heuristic estimate). */
@@ -1796,6 +1837,22 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     approval: {
         mode: "prompt";
     };
+    mcp: {
+        startupTimeout: number;
+        requestTimeout: number;
+        servers: Record<string, {
+            args: string[];
+            env: Record<string, string>;
+            command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+        }>;
+        enabled: boolean;
+        maxToolsPerServer: number;
+        maxDescriptionChars: number;
+        maxSchemaBytes: number;
+    };
     subagent: {
         maxDepth: number;
         maxConcurrency: number;
@@ -1814,6 +1871,8 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     shell: {
         timeoutMs: number;
         maxOutputBytes: number;
+        executable?: string | undefined;
+        dialect?: "posix" | "powershell" | "cmd" | undefined;
     };
     agent: {
         maxIterations: number;
@@ -1879,22 +1938,6 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         map: Partial<Record<"main-turn" | "subagent" | "plan" | "commit-msg" | "classify" | "summarize", "kavi" | "vaani" | "mira">>;
         default?: "kavi" | "vaani" | "mira" | undefined;
     };
-    mcp: {
-        startupTimeout: number;
-        requestTimeout: number;
-        servers: Record<string, {
-            args: string[];
-            env: Record<string, string>;
-            command?: string | undefined;
-            credentialRef?: string | undefined;
-            url?: string | undefined;
-            headers?: Record<string, string> | undefined;
-        }>;
-        enabled: boolean;
-        maxToolsPerServer: number;
-        maxDescriptionChars: number;
-        maxSchemaBytes: number;
-    };
     web: {
         provider: "tavily";
         timeoutMs: number;
@@ -1951,6 +1994,22 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     approval?: {
         mode?: "prompt" | undefined;
     } | undefined;
+    mcp?: {
+        startupTimeout?: number | undefined;
+        requestTimeout?: number | undefined;
+        servers?: Record<string, {
+            command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
+        }> | undefined;
+        enabled?: boolean | undefined;
+        maxToolsPerServer?: number | undefined;
+        maxDescriptionChars?: number | undefined;
+        maxSchemaBytes?: number | undefined;
+    } | undefined;
     subagent?: {
         maxDepth?: number | undefined;
         maxConcurrency?: number | undefined;
@@ -1969,6 +2028,8 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     shell?: {
         timeoutMs?: number | undefined;
         maxOutputBytes?: number | undefined;
+        executable?: string | undefined;
+        dialect?: "posix" | "powershell" | "cmd" | undefined;
     } | undefined;
     agent?: {
         maxIterations?: number | undefined;
@@ -2034,22 +2095,6 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         map?: Partial<Record<"main-turn" | "subagent" | "plan" | "commit-msg" | "classify" | "summarize", "kavi" | "vaani" | "mira">> | undefined;
         default?: "kavi" | "vaani" | "mira" | undefined;
     } | undefined;
-    mcp?: {
-        startupTimeout?: number | undefined;
-        requestTimeout?: number | undefined;
-        servers?: Record<string, {
-            command?: string | undefined;
-            credentialRef?: string | undefined;
-            url?: string | undefined;
-            args?: string[] | undefined;
-            env?: Record<string, string> | undefined;
-            headers?: Record<string, string> | undefined;
-        }> | undefined;
-        enabled?: boolean | undefined;
-        maxToolsPerServer?: number | undefined;
-        maxDescriptionChars?: number | undefined;
-        maxSchemaBytes?: number | undefined;
-    } | undefined;
     web?: {
         provider?: "tavily" | undefined;
         timeoutMs?: number | undefined;

package/dist/config/schema.js

@@ -85,6 +85,22 @@ export const ShellConfigSchema = z
     timeoutMs: z.number().int().positive().default(120000),
     /** Cap on combined stdout+stderr bytes captured; the rest is truncated. */
     maxOutputBytes: z.number().int().positive().default(102400),
+    /**
+     * Explicit shell to run commands through, overriding platform detection. A
+     * path (`/bin/bash`, `C:\\Program Files\\Git\\bin\\bash.exe`, `pwsh`). When
+     * set it WINS over the Git Bash → PowerShell tiering (see resolve-shell.ts):
+     * the user owns the choice. Unset → POSIX uses the default shell; Windows
+     * probes for Git Bash, then PowerShell, then fails loud (CRUXY_E_NO_SHELL).
+     */
+    executable: z.string().min(1).optional(),
+    /**
+     * The command dialect of `executable`, so the model is told which syntax to
+     * emit. Only sniffed automatically for unambiguous basenames (bash/sh →
+     * posix, pwsh/powershell → powershell, cmd → cmd); set this for anything else
+     * or the override is rejected (CRUXY_E_CONFIG_INVALID). Ignored without
+     * `executable`.
+     */
+    dialect: z.enum(["posix", "powershell", "cmd"]).optional(),
 })
     .strict();
 /** Context-window management: when to compact the running conversation. */

package/dist/errors/constructors.d.ts

@@ -24,6 +24,15 @@ export declare function configParse(path: string, underlying?: unknown): CruxyEr
 export declare function configInvalid(issues: string, path?: string): CruxyError;
 export declare function authMissingKey(provider: string, envVar: string): CruxyError;
 export declare function authInvalid(underlying?: unknown): CruxyError;
+/**
+ * A credential could not be persisted with owner-only permissions, so it was
+ * NOT written (C.27c). Chiefly a Windows case: the store's ACL could not be
+ * restricted to the current user (non-NTFS filesystem, `icacls`/SID
+ * unavailable), and we refuse to leave a secret at inheritable permissions while
+ * claiming otherwise. Provider keys point at the env-var fallback; MCP tokens
+ * have no such fallback, so the message says so plainly.
+ */
+export declare function credentialsUnprotected(kind: "provider" | "mcp", path: string, underlying?: unknown): CruxyError;
 export declare function gatewayUnreachable(underlying?: unknown): CruxyError;
 export declare function apiError(underlying?: unknown): CruxyError;
 export declare function apiRateLimit(underlying?: unknown): CruxyError;