@hybridlabor-api/aos 4.7.0 → 4.7.2

package/skills/global_config/agenttrail/bin/agenttrail.mjs

@@ -20,6 +20,8 @@ const spawningPaths = new Set()
 let openBrowser = process.stdout.isTTY ? true : false
 let noOpen = false
 let hooksOnly = false
+const MAX_BODY_BYTES = 64 * 1024
+const MAX_CONTROL_BODY_BYTES = 4 * 1024
 let assumeYes = false
 let removeFlag = false
 let printFlag = false
@@ -57,6 +59,42 @@ for (let i = 0; i < argv.length; i++) {
 const planPath = planArg ? path.resolve(repo, planArg) : path.join(repo, 'PLAN.md')
 const atDir = path.join(repo, '.agenttrail')
 
+function realDirectory(value) {
+  if (typeof value !== 'string' || value.length === 0) return null
+  try {
+    const resolved = fs.realpathSync(path.resolve(value))
+    return fs.statSync(resolved).isDirectory() ? resolved : null
+  } catch {
+    return null
+  }
+}
+
+function isWithin(root, candidate) {
+  const relativePath = path.relative(root, candidate)
+  return relativePath === '' || (relativePath !== '..' && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath))
+}
+
+function allowedSpawnDirectory(value) {
+  const target = realDirectory(value)
+  if (!target) return null
+  const roots = [repo]
+  for (const board of Array.isArray(boards) ? boards : []) if (board && board.repoPath) roots.push(board.repoPath)
+  try {
+    for (const file of fs.readdirSync(path.join(os.homedir(), '.agenttrail'))) {
+      if (!file.endsWith('.json')) continue
+      try {
+        const state = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.agenttrail', file), 'utf8'))
+        if (state && typeof state.repoPath === 'string') roots.push(state.repoPath)
+      } catch {}
+    }
+  } catch {}
+  for (const root of roots) {
+    const realRoot = realDirectory(root)
+    if (realRoot && isWithin(realRoot, target)) return target
+  }
+  return null
+}
+
 async function askYesNo(q) {
   if (assumeYes || !process.stdin.isTTY) return true
   const rl = (await import('node:readline')).createInterface({ input: process.stdin, output: process.stdout })
@@ -71,7 +109,7 @@ function copyToClipboard(text) {
   return import('node:child_process').then(cp => new Promise(res => {
     const cmd = process.platform === 'darwin' ? 'pbcopy' : 'xclip'
     const args = process.platform === 'darwin' ? [] : ['-selection', 'clipboard']
-    const p = cp.spawn(cmd, args, { stdio: ['pipe', 'ignore', 'ignore'] })
+    const p = cp.spawn(cmd, args, { stdio: ['pipe', 'ignore', 'ignore'], shell: false })
     p.on('error', () => res(false)); p.on('close', () => res(true))
     p.stdin.end(text)
   })).catch(() => false)
@@ -87,8 +125,17 @@ if (cmd === 'ask') { process.exit(await askFlow()) }
 // each daemon keeps only events whose cwd lives inside its repo. Never blocks
 // the agent: 400ms cap, failures are silent.
 async function relayHook() {
-  let raw = ''
-  try { for await (const c of process.stdin) raw += c } catch {}
+  const chunks = []
+  let size = 0
+  try {
+    for await (const chunk of process.stdin) {
+      const buffer = Buffer.from(chunk)
+      size += buffer.length
+      if (size > MAX_BODY_BYTES) return
+      chunks.push(buffer)
+    }
+  } catch {}
+  const raw = Buffer.concat(chunks).toString('utf8')
   if (!raw) return
   // AOS patch: --agent <name> tags the hook event with the calling harness
   let body = raw
@@ -291,6 +338,28 @@ function relToRepo(p) {
   const r = path.resolve(String(p))
   return r === repo ? '' : r.startsWith(repo + path.sep) ? r.slice(repo.length + 1) : null
 }
+// AOS patch: native plan/todo tools across harnesses, normalized to the
+// {content, status} shape the frontend's run-todo rendering already expects.
+// - Claude: `TodoWrite`, input {todos:[{content,status}]}
+// - OpenCode: its real tool id is `todowrite` (verified live via `opencode
+//   run --format json`), but mcsc's opencode.js adapter title-cases the raw
+//   tool name before it reaches this hook (`part.tool.charAt(0).toUpperCase()
+//   + part.tool.slice(1)`), so it arrives here as `Todowrite`. Same input
+//   shape as Claude's, plus an extra `priority` field we ignore.
+// - Codex: `update_plan`, input {explanation?, plan:[{step,status}]}. NOT
+//   verified live (Codex CLI's `--json` stream errored on auth in the
+//   environment this was built in, see report.md) — mapped on Codex's
+//   publicly documented tool contract; re-verify once Codex is authenticated.
+function normalizeTodos(toolName, input) {
+  if (!input) return null
+  if ((toolName === 'TodoWrite' || toolName === 'Todowrite') && Array.isArray(input.todos)) {
+    return input.todos.map(t => ({ content: t.content, status: t.status }))
+  }
+  if (toolName === 'update_plan' && Array.isArray(input.plan)) {
+    return input.plan.map(t => ({ content: t.step, status: t.status }))
+  }
+  return null
+}
 function handleHookEvent(ev) {
   const cwd = ev.cwd || ''
   if (!(cwd === repo || cwd.startsWith(repo + path.sep))) return false
@@ -327,9 +396,8 @@ function handleHookEvent(ev) {
     run.recentTools.unshift({ name: ev.tool_name, detail: toolDetail(ev.tool_input), at: Date.now(), ms: Date.now() - started })
     if (run.recentTools.length > 8) run.recentTools.length = 8
     run.currentTool = null
-    if (ev.tool_name === 'TodoWrite' && ev.tool_input && Array.isArray(ev.tool_input.todos)) {
-      run.todos = ev.tool_input.todos.map(t => ({ content: t.content, status: t.status }))
-    }
+    const todos = normalizeTodos(ev.tool_name, ev.tool_input)
+    if (todos) run.todos = todos
     const rel = relToRepo(ev.tool_input && (ev.tool_input.file_path || ev.tool_input.notebook_path))
     if (rel) {
       heatFile(rel, Date.now())
@@ -503,15 +571,39 @@ function planStaleness() {
   const fresh = Date.now() - activity.at < 15 * 60e3
   return gap > 20 * 60e3 && fresh ? { stale: true, minutes: Math.round(gap / 60e3) } : { stale: false }
 }
+// AOS patch: when no plan file exists yet, synthesize one synthetic
+// component card per live run that has native todos (any harness — see
+// normalizeTodos above) so the board renders instead of the empty
+// "Waiting for the plan" state. A real plan file always wins outright: this
+// only runs when planText is empty, and never mixes with parsed.nodes.
+function syntheticPlanNodes() {
+  if (planText.length) return []
+  const out = []
+  for (const r of liveRuns()) {
+    if (!r.todos || !r.todos.length) continue
+    const id = 'live-' + r.id.replace(/[^a-z0-9]/gi, '').toLowerCase().slice(0, 20)
+    const done = r.todos.filter(t => t.status === 'completed').length
+    const status = r.todos.some(t => t.status === 'in_progress') ? 'active' : done === r.todos.length ? 'done' : 'pending'
+    out.push({
+      id, title: `${r.agent}'s live todos`, level: 'component', parent: null,
+      needs: [], links: [], files: [], tech: '', by: r.agent, kind: '', url: '',
+      status, synthetic: true,
+      touchedAt: r.lastEventAt, recent: [], filesList: [],
+    })
+  }
+  return out
+}
 function model() {
   if (treeDirty) { tree = buildTree(repo); treeDirty = false }
   // AOS patch: include planFile (relative path) and aosPlan (boolean) for AOS UI customization
   const planFile = planArg ? path.relative(repo, planPath).split(path.sep).join('/') : undefined
   const aosPlan = Boolean(planArg)
+  const realPlanNodes = parsed.nodes.map(n => n.level === 'component' ? { ...n, touchedAt: compTouched[n.id] || null, recent: compRecent[n.id] || [], filesList: compFilesFor(n.id) } : n)
+  const planNodes = realPlanNodes.length ? realPlanNodes : syntheticPlanNodes()
   return {
     boards, port,
     runs: liveRuns(),
-    session, plan: parsed.nodes.map(n => n.level === 'component' ? { ...n, touchedAt: compTouched[n.id] || null, recent: compRecent[n.id] || [], filesList: compFilesFor(n.id) } : n), tree,
+    session, plan: planNodes, tree,
     planTitle: parsed.title,
     hasPlan: planText.length > 0, treeTruncated,
     activity, recentActivity, planMtime, handoffs, asks, hotFiles: hotFiles(), cycles, // AOS patch: asks ride along so the open map updates live
@@ -593,14 +685,14 @@ function throttleBroadcast() {
 }
 
 // ---------- sibling boards (multi-repo: one daemon per repo, boards link to each other) ----------
-let boards = [{ port, project: path.basename(repo), self: true }]
+let boards = [{ port, project: path.basename(repo), self: true, repoPath: repo }]
 async function discoverBoards() {
-  const found = [{ port, project: session.project, self: true }]
+  const found = [{ port, project: session.project, self: true, repoPath: repo }]
   await Promise.allSettled(Array.from({ length: 15 }, (_, i) => 5330 + i).filter(p => p !== port).map(async p => {
     try {
       const r = await fetch(`http://127.0.0.1:${p}/whoami`, { signal: AbortSignal.timeout(300) })
       const j = await r.json()
-      if (j && j.project) found.push({ port: p, project: j.project, self: false })
+      if (j && j.project) found.push({ port: p, project: j.project, self: false, repoPath: j.repoPath })
     } catch {}
   }))
   boards = found.sort((a, b) => a.port - b.port)
@@ -662,9 +754,18 @@ const server = http.createServer((req, res) => {
     res.writeHead(200, { 'content-type': 'text/html' }).end(fs.readFileSync(indexPath, 'utf8'))
   } else if (u.pathname.startsWith('/production_artifacts/')) {
     // AOS patch: serve pipeline artifacts so a card's relative `url:` (e.g. an archify diagram) opens
-    const root = path.join(repo, 'production_artifacts')
-    const f = path.resolve(repo, '.' + decodeURIComponent(u.pathname))
-    if (!f.startsWith(root + path.sep) || !fs.statSync(f, { throwIfNoEntry: false })?.isFile()) { res.writeHead(404).end(); return }
+    let root
+    let f
+    try {
+      root = fs.realpathSync(path.join(repo, 'production_artifacts'))
+      f = fs.realpathSync(path.resolve(repo, '.' + decodeURIComponent(u.pathname)))
+    } catch {
+      res.writeHead(404).end()
+      return
+    }
+    let isFile = false
+    try { isFile = fs.statSync(f).isFile() } catch {}
+    if (!isWithin(root, f) || !isFile) { res.writeHead(404).end(); return }
     const type = f.endsWith('.html') ? 'text/html' : f.endsWith('.svg') ? 'image/svg+xml' : f.endsWith('.json') ? 'application/json' : 'text/plain'
     res.writeHead(200, { 'content-type': type + '; charset=utf-8' }).end(fs.readFileSync(f))
   } else if (u.pathname === '/whoami') {
@@ -701,30 +802,27 @@ const server = http.createServer((req, res) => {
       res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: true, prompt: BACKFILL_PROMPT }))
     }).catch(e => res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: false, error: String(e) })))
   } else if (u.pathname === '/setup-board' && req.method === 'POST') {
-    let body = ''
-    req.on('data', c => body += c)
-    req.on('end', async () => {
+    readCapped(req, res, async body => {
       let out = { ok: false, error: 'no board there' }
       try {
-        const p = Number(JSON.parse(body).port)
-        out = await fetch(`http://127.0.0.1:${p}/setup`, { method: 'POST', signal: AbortSignal.timeout(5000) }).then(r => r.json())
+        const p = Number(JSON.parse(body || '{}').port)
+        if (!Number.isInteger(p) || p < 1 || p > 65535) out = { ok: false, error: 'bad port' }
+        else out = await fetch(`http://127.0.0.1:${p}/setup`, { method: 'POST', signal: AbortSignal.timeout(5000) }).then(r => r.json())
       } catch {}
       res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(out))
-    })
+    }, MAX_CONTROL_BODY_BYTES)
   } else if (u.pathname === '/spawn' && req.method === 'POST') {
-    let body = ''
-    req.on('data', c => body += c)
-    req.on('end', async () => {
+    readCapped(req, res, async body => {
       let out = { ok: false, error: 'bad request' }
       try {
-        const p = path.resolve(String(JSON.parse(body).path || ''))
-        if (!fs.existsSync(p) || !fs.statSync(p).isDirectory()) out = { ok: false, error: 'not a folder on this machine' }
+        const p = allowedSpawnDirectory(JSON.parse(body || '{}').path)
+        if (!p) out = { ok: false, error: 'spawn target is outside the allowed workspace' }
         else {
           let already = null
           for (const b of boards) {
             try {
               const w = await fetch(`http://127.0.0.1:${b.port}/whoami`, { signal: AbortSignal.timeout(300) }).then(r => r.json())
-              if (w.repoPath === p) { already = b.port; break }
+              if (w.repoPath && realDirectory(w.repoPath) === p) { already = b.port; break }
             } catch {}
           }
           if (already) out = { ok: true, already }
@@ -732,7 +830,7 @@ const server = http.createServer((req, res) => {
           else {
             spawningPaths.add(p); setTimeout(() => spawningPaths.delete(p), 30000)
             const cp = await import('node:child_process')
-            const child = cp.spawn(process.execPath, [fileURLToPath(import.meta.url), p, '--no-open'], { detached: true, stdio: 'ignore' })
+            const child = cp.spawn(process.execPath, [fileURLToPath(import.meta.url), p, '--no-open'], { detached: true, stdio: 'ignore', shell: false })
             child.unref()
             setTimeout(discoverBoards, 2500)
             setTimeout(discoverBoards, 6000)
@@ -741,11 +839,13 @@ const server = http.createServer((req, res) => {
         }
       } catch {}
       res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(out))
-    })
+    }, MAX_CONTROL_BODY_BYTES)
   } else if (u.pathname === '/nudge') {
     const cwd = u.searchParams.get('cwd') || ''
     const st = planStaleness()
-    const mine = cwd === repo || cwd.startsWith(repo + path.sep)
+    const candidate = realDirectory(cwd)
+    const root = realDirectory(repo)
+    const mine = !!(candidate && root && isWithin(root, candidate))
     res.writeHead(200, { 'content-type': 'text/plain' }).end(mine && st.stale
       ? `Note from agenttrail: PLAN.md in this repo is ${st.minutes} minutes behind the code. Re-verify task statuses against what you and other sessions actually changed, mark your current task [~], and keep files: globs current.`
       : '')
@@ -766,12 +866,10 @@ const server = http.createServer((req, res) => {
     clients.add(res)
     req.on('close', () => clients.delete(res))
   } else if (u.pathname === '/hook' && req.method === 'POST') {
-    let body = ''
-    req.on('data', c => body += c)
-    req.on('end', () => {
-      try { if (handleHookEvent(JSON.parse(body))) hookTick() } catch {}
+    readCapped(req, res, body => {
+      try { if (handleHookEvent(JSON.parse(body || '{}'))) hookTick() } catch {}
       res.writeHead(200).end()
-    })
+    }, MAX_CONTROL_BODY_BYTES)
   } else if (u.pathname === '/ask' && req.method === 'POST') {
     // AOS patch: ask engine — register a question the human answers on the map.
     // Pure relay: an answer here never runs anything (go-gate keeps sole authority).
@@ -833,16 +931,29 @@ const server = http.createServer((req, res) => {
   } else res.writeHead(404).end()
 })
 // AOS patch: body reader for the ask/answer routes, capped at 4 KB
-function readCapped(req, res, cb) {
-  let body = ''
+function readCapped(req, res, cb, maxBytes = MAX_CONTROL_BODY_BYTES) {
+  const chunks = []
+  let size = 0
   let done = false
-  req.on('data', c => {
+  req.on('data', chunk => {
+    if (done) return
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))
+    size += buffer.length
+    if (size > maxBytes) {
+      done = true
+      chunks.length = 0
+      res.writeHead(413, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: false, error: 'body too large' }))
+      req.destroy()
+      return
+    }
+    chunks.push(buffer)
+  })
+  req.on('end', () => {
     if (done) return
-    body += c
-    if (body.length > 4096) { done = true; body = ''; res.writeHead(413, { 'content-type': 'application/json' }).end(JSON.stringify({ ok: false, error: 'body too large' })); req.destroy() }
+    done = true
+    cb(Buffer.concat(chunks).toString('utf8'))
   })
-  req.on('end', () => { if (!done) { done = true; cb(body) } })
-  req.on('error', () => {})
+  req.on('error', () => { done = true })
 }
 let lastHookTick = 0
 function hookTick() {
@@ -883,7 +994,7 @@ function onListen() {
   }
   if (openBrowser && !noOpen) {
     const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open'
-    import('node:child_process').then(cp => cp.spawn(opener, [`http://localhost:${port}`], { stdio: 'ignore', detached: true }))
+    import('node:child_process').then(cp => cp.spawn(opener, [`http://localhost:${port}`], { stdio: 'ignore', detached: true, shell: false }))
   }
   firstRunFlow()
 }
@@ -970,7 +1081,7 @@ async function upAll() {
   for (const k of known) {
     const live = await fetch(`http://127.0.0.1:${k.port}/whoami`, { signal: AbortSignal.timeout(300) }).then(r => r.json()).catch(() => null)
     if (live) { console.log(`already up: ${k.repo} (:${k.port})`); continue }
-    const child = cp.spawn(process.execPath, [fileURLToPath(import.meta.url), k.repo, '--port', String(k.port), '--no-open'], { detached: true, stdio: 'ignore' })
+    const child = cp.spawn(process.execPath, [fileURLToPath(import.meta.url), k.repo, '--port', String(k.port), '--no-open'], { detached: true, stdio: 'ignore', shell: false })
     child.unref()
     console.log(`started: ${k.repo} (:${k.port})`)
   }

package/skills/global_config/agenttrail/public/index.html

@@ -318,7 +318,8 @@ function renderZero(){
     ${emptyStateBlock}
   </div>`
 }
-function isSkeletonPlan(){return M.plan.filter(n=>n.level==='task').length<=1}
+function isSkeletonPlan(){return M.plan.filter(n=>n.level==='task').length<=1&&!hasSyntheticPlan(M)}
+function hasSyntheticPlan(b){return(b.plan||[]).some(n=>n.synthetic)}
 function boardLayout(b){
   const phases=b.plan.filter(n=>n.level==='component')
   const byId=Object.fromEntries(phases.map(p=>[p.id,p])),depth={},visiting=new Set()
@@ -357,7 +358,7 @@ function regionCardHtml(b,L){
   const live=(b.runs||[]).filter(r=>!r.ended)
   const sq=b.plan.filter(n=>n.level==='component').map((c,i)=>`<rect x="${40+i*30}" y="${h/2+4}" width="20" height="20" rx="5" fill="${c.status==='done'?'#3f7f57':c.status==='blocked'?'var(--danger)':'none'}" stroke="${c.status==='active'?'var(--accent)':'var(--faint)'}" stroke-width="2.5"/>`).join('')
   const marks=live.map((r,i)=>{const ic=agentIcon(r.agent);return ic?`<g transform="translate(${40+i*34} ${h/2+44}) scale(1.1)"><path fill="${agentColor(r.agent)}" d="${ic}"/></g>`:''}).join('')
-  return`<text x="40" y="${h/2-36}" fill="var(--text)" font-size="44" font-weight="650" font-family="var(--font)" letter-spacing="-1">${esc(b.project)}</text>${sq}${marks}${!b.hasPlan?`<text x="40" y="${h/2+44}" fill="var(--faint)" font-size="16" font-family="var(--font)">nothing mapped yet</text><g class="setup-btn" onclick="setupBoard(${b.port})" style="cursor:pointer"><rect x="40" y="${h/2+64}" width="172" height="40" rx="11" fill="var(--accent-bg)" stroke="var(--accent)" stroke-width="1.2"/><text x="126" y="${h/2+89}" text-anchor="middle" fill="var(--accent)" font-size="15.5" font-weight="600" font-family="var(--font)">Set up the map</text></g>`:''}${live.length?`<text x="${w-40}" y="${h/2-36}" text-anchor="end" fill="var(--dim)" font-size="16" font-family="var(--font)">${live.length} running</text>`:''}`
+  return`<text x="40" y="${h/2-36}" fill="var(--text)" font-size="44" font-weight="650" font-family="var(--font)" letter-spacing="-1">${esc(b.project)}</text>${sq}${marks}${(!b.hasPlan&&!hasSyntheticPlan(b))?`<text x="40" y="${h/2+44}" fill="var(--faint)" font-size="16" font-family="var(--font)">nothing mapped yet</text><g class="setup-btn" onclick="setupBoard(${b.port})" style="cursor:pointer"><rect x="40" y="${h/2+64}" width="172" height="40" rx="11" fill="var(--accent-bg)" stroke="var(--accent)" stroke-width="1.2"/><text x="126" y="${h/2+89}" text-anchor="middle" fill="var(--accent)" font-size="15.5" font-weight="600" font-family="var(--font)">Set up the map</text></g>`:(!b.hasPlan&&hasSyntheticPlan(b))?`<text x="40" y="${h/2+44}" fill="var(--faint)" font-size="16" font-family="var(--font)">live from todos, no plan file yet</text>`:''}${live.length?`<text x="${w-40}" y="${h/2-36}" text-anchor="end" fill="var(--dim)" font-size="16" font-family="var(--font)">${live.length} running</text>`:''}`
 }
 const CARD_LOD=0.3
 let _saved=null
@@ -366,7 +367,7 @@ function restoreBoardGlobals(){if(_saved){M=_saved.M;BP=_saved.BP;_saved=null}}
 function renderGraph(){
   const boards=boardsAll()
   if(!boards.length)return
-  if(boards.length===1&&M&&(!M.hasPlan||isSkeletonPlan())){renderZero();return}
+  if(boards.length===1&&M&&((!M.hasPlan&&!hasSyntheticPlan(M))||isSkeletonPlan())){renderZero();return}
   regions={};graphPos={}
   const GAP=160,ROWMAX=3600;let cx=80,cy=80,rowH=0
   let content=''
@@ -381,7 +382,7 @@ function renderGraph(){
     for(const[id,q]of Object.entries(L.pos))graphPos[BP+':'+id]={...q,nodeX:q.nodeX+ox,nodeY:q.nodeY+56+oy}
     const hot=eff.activity&&Date.now()-eff.activity.at<60000
     const cardMode=graphZoom<CARD_LOD||!eff.hasPlan
-    content+=`<g transform="translate(${ox} ${oy})"><rect width="${L.width}" height="${L.height+56}" rx="26" fill="var(--region)" stroke="${hot?'rgba(233,162,59,.5)':'var(--line)'}" stroke-width="1.5"/><text x="28" y="38" fill="var(--faint)" font-size="15" font-weight="600" font-family="var(--mono)" letter-spacing=".08em">${esc((eff.project||'').toUpperCase())}${eff.planStale&&eff.planStale.stale?`<tspan fill="var(--accent)"> · PLAN BEHIND</tspan>`:''}</text>${cardMode?regionCardHtml(eff,L):`<g transform="translate(0 56)">${boardInnerHtml(eff,L)}</g>`}</g>`
+    content+=`<g transform="translate(${ox} ${oy})"><rect width="${L.width}" height="${L.height+56}" rx="26" fill="var(--region)" stroke="${hot?'rgba(233,162,59,.5)':'var(--line)'}" stroke-width="1.5"/><text x="28" y="38" fill="var(--faint)" font-size="15" font-weight="600" font-family="var(--mono)" letter-spacing=".08em">${esc((eff.project||'').toUpperCase())}${eff.planStale&&eff.planStale.stale?`<tspan fill="var(--accent)"> · PLAN BEHIND</tspan>`:''}${hasSyntheticPlan(eff)?`<tspan fill="var(--dim)"> · LIVE TODOS, NO PLAN FILE</tspan>`:''}</text>${cardMode?regionCardHtml(eff,L):`<g transform="translate(0 56)">${boardInnerHtml(eff,L)}</g>`}</g>`
     cx+=L.width+GAP;rowH=Math.max(rowH,L.height+56)
   }
   M=realM;BP=realBP

package/skills/global_config/aos-setup/scripts/aos-doctor.mjs

@@ -52,7 +52,7 @@ const tilde = (p) => (p || '').replace(HOME, '~');
 // `which` does not exist on native Windows; cmd ships `where`, which prints one
 // path per line.
 const which = (bin) => {
-  const probe = process.platform === 'win32' ? 'where' : 'which';
+  const probe = process.platform === 'win32' ? 'where.exe' : 'which';
   try { return tilde(execFileSync(probe, [bin], { encoding: 'utf8' }).trim().split(/\r?\n/)[0]); } catch { return null; }
 };
 const dirCount = (p) => { try { return readdirSync(p, { withFileTypes: true }).filter(d => d.isDirectory()).length; } catch { return 0; } };
@@ -100,7 +100,13 @@ function checkAos() {
 
   if (manifest && NET) {
     try {
-      const latest = execFileSync('npm', ['view', '@hybridlabor-api/aos', 'version'], { encoding: 'utf8', timeout: 8000 }).trim();
+      const npmBin = IS_WIN ? 'npm.cmd' : 'npm';
+      const latest = execFileSync(npmBin, ['view', '@hybridlabor-api/aos', 'version'], {
+        encoding: 'utf8',
+        timeout: 8000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        shell: IS_WIN
+      }).trim();
       add('aos', 'version vs npm', manifest.version === latest, `local v${manifest.version} · npm v${latest}`,
         'npx -y @hybridlabor-api/aos@latest');
     } catch {