@livx.cc/agentx 0.99.78 → 0.99.79

package/dist/index.js

@@ -405,6 +405,40 @@ var init_redact = __esm({
   }
 });
 
+// src/hostPath.ts
+function toVfsPath(p, platform = currentPlatform()) {
+  if (!isWinPaths(platform) || typeof p !== "string") return p;
+  let s = p.replace(/\\/g, "/");
+  s = s.replace(/^\/\/\?\/UNC\//i, "//").replace(/^\/\/\?\//, "");
+  const drive = /^([A-Za-z]):(?=\/|$)/.exec(s);
+  if (drive) return `/${drive[1].toLowerCase()}${s.slice(2) || "/"}`.replace(/\/+$/, "") || "/";
+  if (/^\/\/[^/]/.test(s)) return `/unc/${s.slice(2)}`;
+  return s;
+}
+function toHostPath(vpath, platform = currentPlatform()) {
+  if (!isWinPaths(platform)) return vpath;
+  const segs = vpath.split("/").filter(Boolean);
+  if (segs.length >= 1 && /^[A-Za-z]$/.test(segs[0])) return `${segs[0].toUpperCase()}:\\${segs.slice(1).join("\\")}`;
+  if (segs.length >= 3 && segs[0].toLowerCase() === "unc") return `\\\\${segs.slice(1).join("\\")}`;
+  return null;
+}
+function winSegmentProblem(seg) {
+  if (seg.includes(":")) return "alternate data stream / drive-relative name";
+  if (/[. ]$/.test(seg) && seg !== "." && seg !== "..") return "trailing dot or space";
+  if (WIN_DEVICE.test(seg)) return "reserved device name";
+  if (/[<>"|?*\x00-\x1f]/.test(seg)) return "invalid character";
+  return null;
+}
+var currentPlatform, isWinPaths, WIN_DEVICE;
+var init_hostPath = __esm({
+  "src/hostPath.ts"() {
+    "use strict";
+    currentPlatform = () => typeof process !== "undefined" && process.platform || "browser";
+    isWinPaths = (platform = currentPlatform()) => platform === "win32";
+    WIN_DEVICE = /^(con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³]|conin\$|conout\$)(\..*)?$/i;
+  }
+});
+
 // src/tools.structured.ts
 function ckAbort(signal) {
   if (signal?.aborted) throw new Error("aborted");
@@ -447,7 +481,7 @@ async function walkFiles(fs, dir, signal, out = [], st, depth = 0) {
 }
 function scanRoots(fs, path, opts) {
   const asked = path == null ? [] : (Array.isArray(path) ? path : [path]).map((p) => String(p)).filter(Boolean);
-  const roots = (asked.length ? asked : opts?.roots?.length ? opts.roots : [fsCwd(fs)]).map((r) => r.length > 1 && r.endsWith("/") ? r.slice(0, -1) : r);
+  const roots = (asked.length ? asked : opts?.roots?.length ? opts.roots : [fsCwd(fs)]).map((r) => toVfsPath(r)).map((r) => r.length > 1 && r.endsWith("/") ? r.slice(0, -1) : r);
   return [...new Set(roots)].filter((r, _i, all) => !all.some((other) => other !== r && r.startsWith(`${other}/`)));
 }
 function scanNote(states) {
@@ -676,6 +710,7 @@ function parentDir(abs) {
   return i <= 0 ? "/" : abs.slice(0, i);
 }
 async function mkdirp(fs, dir) {
+  dir = toVfsPath(dir);
   if (dir === "/" || await fs.exists(dir)) return;
   await mkdirp(fs, parentDir(dir));
   if (!await fs.exists(dir)) await fs.createDir(dir);
@@ -736,6 +771,7 @@ var init_tools_structured = __esm({
   "src/tools.structured.ts"() {
     "use strict";
     init_redact();
+    init_hostPath();
     DEFAULT_SKIP_DIRS = ["node_modules", ".git", "dist", ".tmp"];
     DEFAULT_MAX_DEPTH = 24;
     SCAN_PARAMS = {
@@ -2019,20 +2055,58 @@ var NodeDiskFilesystem;
 var init_NodeDiskFilesystem = __esm({
   "src/NodeDiskFilesystem.ts"() {
     "use strict";
+    init_hostPath();
     NodeDiskFilesystem = class _NodeDiskFilesystem {
       constructor(baseDir, opts = {}) {
         this.baseDir = baseDir;
         this.opts = { denySymlinks: true, ...opts };
+        this.drives = this.win && (baseDir === "/" || baseDir === "\\");
       }
       baseDir;
       cwd = "/";
       opts;
+      win = isWinPaths();
+      /** Windows + baseDir '/': the VFS root is the machine (drives as first segment), not a directory. */
+      drives;
       /** Ensure the root dir exists. */
       async init() {
+        if (this.drives) return;
         await fsp.mkdir(this.baseDir, { recursive: true });
       }
       real(vpath) {
-        return np.join(this.baseDir, "." + vpath);
+        if (!this.win) return np.join(this.baseDir, "." + vpath);
+        for (const seg of vpath.split("/")) {
+          const why = seg && winSegmentProblem(seg);
+          if (why) throw new Error(`File not found: ${vpath} (${why})`);
+        }
+        if (!this.drives) return np.join(this.baseDir, "." + vpath);
+        const host = toHostPath(vpath);
+        if (!host) throw new Error(`File not found: ${vpath}`);
+        return host;
+      }
+      /** Windows machine root ('/' when baseDir is '/'): a synthetic directory listing the drives. */
+      isDriveRoot(vpath) {
+        return this.drives && vpath === "/";
+      }
+      /** Windows: refuse an 8.3 short name (`ENV~1` opens `.env`) — the only alias that needs the disk to
+       *  detect. Only segments that look like one (`~<digit>`) cost a lookup: the OS's long name for that
+       *  component must be the name that was asked for. */
+      assertLongNames(real) {
+        if (!this.win || !/~\d/.test(real)) return;
+        const root = np.parse(real).root;
+        const parts = real.slice(root.length).split(/[\\/]/).filter(Boolean);
+        let cur = root;
+        for (const part of parts) {
+          cur = np.join(cur, part);
+          if (!/~\d/.test(part)) continue;
+          let long;
+          try {
+            long = np.basename(realpathSync2.native(cur));
+          } catch {
+            return;
+          }
+          if (long.toLowerCase() !== part.toLowerCase()) throw new Error("File not found: short (8.3) name not permitted");
+        }
       }
       // Verified non-symlink DIRECTORY components, with a short TTL: tree walks (Glob/Grep) hit the same
       // parents thousands of times; re-lstat'ing each per op is the dominant syscall cost. The 1s window
@@ -2042,11 +2116,13 @@ var init_NodeDiskFilesystem = __esm({
       static VERIFY_TTL_MS = 1e3;
       /** Throw if any existing component of `real` is a symlink (escape vector). */
       async assertNoSymlink(real) {
+        this.assertLongNames(real);
         if (!this.opts.denySymlinks) return;
-        const rel = np.relative(this.baseDir, real);
-        if (rel === "" || rel.startsWith("..")) return;
+        const base = this.drives ? np.parse(real).root : this.baseDir;
+        const rel = np.relative(base, real);
+        if (rel === "" || rel.startsWith("..") || np.isAbsolute(rel)) return;
         const parts = rel.split(np.sep);
-        let cur = this.baseDir;
+        let cur = base;
         const now3 = Date.now();
         for (let i = 0; i < parts.length; i++) {
           cur = np.join(cur, parts[i]);
@@ -2066,13 +2142,13 @@ var init_NodeDiskFilesystem = __esm({
         }
       }
       resolvePath(path, cwd) {
-        return PathResolver.resolve(path, cwd || this.cwd);
+        return PathResolver.resolve(toVfsPath(path), toVfsPath(cwd || this.cwd));
       }
       getCwd() {
         return this.cwd;
       }
       setCwd(path) {
-        this.cwd = PathResolver.normalize(path);
+        this.cwd = PathResolver.normalize(toVfsPath(path));
       }
       async readFile(path) {
         const r = this.real(this.resolvePath(path));
@@ -2146,8 +2222,10 @@ var init_NodeDiskFilesystem = __esm({
         }
       }
       async readDir(path) {
-        const r = this.real(this.resolvePath(path));
+        const v = this.resolvePath(path);
+        if (this.isDriveRoot(v)) return this.listDrives();
         try {
+          const r = this.real(v);
           await this.assertNoSymlink(r);
           return await fsp.readdir(r);
         } catch {
@@ -2167,8 +2245,10 @@ var init_NodeDiskFilesystem = __esm({
         await fsp.mkdir(r);
       }
       async exists(path) {
-        const r = this.real(this.resolvePath(path));
+        const v = this.resolvePath(path);
+        if (this.isDriveRoot(v)) return true;
         try {
+          const r = this.real(v);
           await this.assertNoSymlink(r);
           await fsp.stat(r);
           return true;
@@ -2178,8 +2258,10 @@ var init_NodeDiskFilesystem = __esm({
       }
       async stat(path) {
         let s;
-        const r = this.real(this.resolvePath(path));
+        const v = this.resolvePath(path);
+        if (this.isDriveRoot(v)) return { created: /* @__PURE__ */ new Date(0), modified: /* @__PURE__ */ new Date(0), size: 0, permissions: "drwxr-xr-x", isExecutable: false };
         try {
+          const r = this.real(v);
           await this.assertNoSymlink(r);
           s = await fsp.stat(r);
         } catch {
@@ -2194,8 +2276,10 @@ var init_NodeDiskFilesystem = __esm({
         };
       }
       async isDirectory(path) {
-        const r = this.real(this.resolvePath(path));
+        const v = this.resolvePath(path);
+        if (this.isDriveRoot(v)) return true;
         try {
+          const r = this.real(v);
           await this.assertNoSymlink(r);
           return (await fsp.stat(r)).isDirectory();
         } catch {
@@ -2203,14 +2287,20 @@ var init_NodeDiskFilesystem = __esm({
         }
       }
       async isFile(path) {
-        const r = this.real(this.resolvePath(path));
         try {
+          const r = this.real(this.resolvePath(path));
           await this.assertNoSymlink(r);
           return (await fsp.stat(r)).isFile();
         } catch {
           return false;
         }
       }
+      /** Windows machine root: the drive letters that are mounted (`/c`, `/d`, …). */
+      async listDrives() {
+        const letters = "abcdefghijklmnopqrstuvwxyz".split("");
+        const up = await Promise.all(letters.map((l) => fsp.stat(`${l.toUpperCase()}:\\`).then(() => true, () => false)));
+        return letters.filter((_, i) => up[i]);
+      }
     };
   }
 });
@@ -2227,6 +2317,7 @@ var init_JailedFilesystem = __esm({
   "src/JailedFilesystem.ts"() {
     "use strict";
     init_tools_structured();
+    init_hostPath();
     JailedFilesystem = class {
       constructor(inner, options) {
         this.inner = inner;
@@ -2240,8 +2331,10 @@ var init_JailedFilesystem = __esm({
       denyRe;
       roRe;
       confineRe;
+      /** Resolved VFS path — host-path syntax (Windows `C:\…`, backslashes) is normalized FIRST, so the
+       *  deny/readonly/confine globs always match the path that is actually opened. */
       abs(path) {
-        return this.inner.resolvePath(path, this.inner.getCwd());
+        return this.inner.resolvePath(toVfsPath(path), this.inner.getCwd());
       }
       /** Throw if reading `path` is not permitted (denied or out of confinement). */
       guardRead(op, path) {
@@ -2326,7 +2419,7 @@ var init_JailedFilesystem = __esm({
         return entries.filter((name) => this.visible(abs === "/" ? `/${name}` : `${abs}/${name}`));
       }
       resolvePath(path, cwd) {
-        return this.inner.resolvePath(path, cwd ?? this.inner.getCwd());
+        return this.inner.resolvePath(toVfsPath(path), cwd ?? this.inner.getCwd());
       }
       getCwd() {
         return this.inner.getCwd();
@@ -2444,6 +2537,125 @@ var init_shell_sandbox = __esm({
   }
 });
 
+// src/platform.ts
+import { spawnSync as spawnSync2, execFile } from "child_process";
+import { statSync as statSync4 } from "fs";
+import * as np2 from "path";
+function specFor(bin) {
+  const name = np2.basename(bin).toLowerCase().replace(/\.exe$/, "");
+  if (name === "powershell" || name === "pwsh") {
+    const pre = "$ProgressPreference='SilentlyContinue';[Console]::OutputEncoding=[Text.Encoding]::UTF8;$OutputEncoding=[Text.Encoding]::UTF8;";
+    return {
+      bin,
+      kind: "powershell",
+      label: name === "pwsh" ? "PowerShell (pwsh)" : "Windows PowerShell",
+      args: (c) => ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(pre + c, "utf16le").toString("base64")]
+    };
+  }
+  if (name === "cmd") return { bin, kind: "cmd", label: "cmd.exe", args: (c) => ["/d", "/s", "/c", `"${c}"`], spawnOptions: { windowsVerbatimArguments: true } };
+  return { bin, kind: "sh", label: /bash/.test(name) && /git/i.test(bin) ? "Git Bash" : name, args: (c) => ["-c", c] };
+}
+function findGitBash(env = process.env) {
+  const roots = [];
+  const git2 = findOnPath("git", env);
+  if (git2) {
+    const dir = np2.dirname(git2);
+    const up = (p, n) => {
+      for (let i = 0; i < n; i++) p = np2.dirname(p);
+      return p;
+    };
+    roots.push(/[\\/](mingw(32|64)|ucrt64|clang(32|64|arm64))[\\/]bin$/i.test(dir) ? up(dir, 2) : up(dir, 1));
+  }
+  for (const base of [env.ProgramFiles, env["ProgramFiles(x86)"], env.ProgramW6432, env.LOCALAPPDATA && np2.join(env.LOCALAPPDATA, "Programs")])
+    if (base) roots.push(np2.join(base, "Git"));
+  for (const r of roots) {
+    const b = np2.join(r, "bin", "bash.exe");
+    if (isFile(b)) return b;
+  }
+  return void 0;
+}
+function defaultShell() {
+  if (!IS_WIN) return POSIX_SH;
+  if (_shell) return _shell;
+  const override = process.env.AGENTX_SHELL;
+  if (override && (isFile(override) || findOnPath(override))) return _shell = specFor(isFile(override) ? override : findOnPath(override));
+  const bash = findGitBash();
+  if (bash) return _shell = specFor(bash);
+  const sysRoot = process.env.SystemRoot || "C:\\Windows";
+  const ps = np2.join(sysRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  if (isFile(ps)) return _shell = specFor(ps);
+  return _shell = specFor(process.env.ComSpec || "cmd.exe");
+}
+function shellFor(shell) {
+  if (!IS_WIN) return shell ? { ...POSIX_SH, bin: shell } : POSIX_SH;
+  return shell && isFile(shell) ? specFor(shell) : defaultShell();
+}
+function killTree(pid, signal) {
+  if (!pid) return false;
+  if (!IS_WIN) {
+    try {
+      process.kill(-pid, signal);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  try {
+    const r = spawnSync2("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 1e4 });
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+async function winTreeCpuSeconds(root) {
+  const script = 'Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $([uint64]$_.UserModeTime + [uint64]$_.KernelModeTime)" }';
+  const out = await new Promise((res, rej) => execFile(
+    "powershell.exe",
+    ["-NoProfile", "-NonInteractive", "-Command", script],
+    { timeout: 15e3, windowsHide: true },
+    (e, so) => e ? rej(e) : res(String(so))
+  ));
+  const rows = out.split(/\r?\n/).map((l) => l.trim().split(/\s+/)).filter((r) => r.length === 3).map(([pid, ppid, ticks]) => ({ pid: Number(pid), ppid: Number(ppid), sec: Number(ticks) / 1e7 }));
+  const inTree = new Set(rows.filter((r) => r.pid === root).map((r) => r.pid));
+  for (let grew = true; grew; ) {
+    grew = false;
+    for (const r of rows) if (!inTree.has(r.pid) && inTree.has(r.ppid) && r.pid !== r.ppid) {
+      inTree.add(r.pid);
+      grew = true;
+    }
+  }
+  let total;
+  for (const r of rows) if (inTree.has(r.pid) && Number.isFinite(r.sec)) total = (total ?? 0) + r.sec;
+  return total;
+}
+function findOnPath(cmd, env = process.env) {
+  const exts = IS_WIN && !/\.[^\\/.]+$/.test(cmd) ? (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const cands = (base) => exts.map((e) => base + e);
+  if (/[\\/]/.test(cmd)) return cands(cmd).find(isFile);
+  const PATH = env.PATH ?? env.Path ?? "";
+  for (const dir of PATH.split(np2.delimiter)) {
+    if (!dir) continue;
+    for (const p of cands(np2.join(dir, cmd))) if (isFile(p)) return p;
+  }
+  return void 0;
+}
+var IS_WIN, POSIX_SH, isFile, _shell, DETACH_OPTIONS;
+var init_platform = __esm({
+  "src/platform.ts"() {
+    "use strict";
+    IS_WIN = process.platform === "win32";
+    POSIX_SH = { bin: "/bin/sh", args: (c) => ["-c", c], label: "/bin/sh", kind: "sh" };
+    isFile = (p) => {
+      try {
+        return statSync4(p).isFile();
+      } catch {
+        return false;
+      }
+    };
+    DETACH_OPTIONS = IS_WIN ? { windowsHide: true } : { detached: true };
+  }
+});
+
 // src/tools.shell.ts
 var tools_shell_exports = {};
 __export(tools_shell_exports, {
@@ -2453,19 +2665,14 @@ __export(tools_shell_exports, {
   makeShellJobTools: () => makeShellJobTools,
   parsePsTime: () => parsePsTime,
   psGroupCpuSeconds: () => psGroupCpuSeconds,
-  sumTreeCpu: () => sumTreeCpu
+  sumTreeCpu: () => sumTreeCpu,
+  windowsShellNote: () => windowsShellNote
 });
 function killGroup(proc, signal) {
-  if (!proc?.pid) return false;
-  try {
-    process.kill(-proc.pid, signal);
-    return true;
-  } catch {
-    return false;
-  }
+  return killTree(proc?.pid, signal);
 }
 async function spawnArgvFor(command, cwd, osSandbox) {
-  if (!osSandbox) return { bin: "/bin/sh", args: ["-c", command] };
+  if (!osSandbox) return shellArgv(defaultShell(), command);
   const opts = osSandbox === true ? {} : osSandbox;
   const wrapper = await findSandboxWrapper();
   const wrapped = wrapper ? sandboxArgv(command, cwd, opts, process.platform, process.env.TMPDIR) : null;
@@ -2493,9 +2700,17 @@ function parsePsTime(t) {
   return Number(m[1] ?? 0) * 86400 + Number(m[2] ?? 0) * 3600 + Number(m[3]) * 60 + Number(m[4]);
 }
 async function psGroupCpuSeconds(pgid) {
+  if (IS_WIN) {
+    try {
+      return await winTreeCpuSeconds(pgid);
+    } catch (e) {
+      log9.debug(`cpu probe failed for ${pgid}: ${e}`);
+      return void 0;
+    }
+  }
   try {
-    const { execFile } = await import("child_process");
-    const out = await new Promise((res, rej) => execFile("ps", ["-A", "-o", "pid=,ppid=,pgid=,time="], { timeout: 5e3, env: { ...process.env, LC_ALL: "C" } }, (e, so) => e ? rej(e) : res(String(so))));
+    const { execFile: execFile2 } = await import("child_process");
+    const out = await new Promise((res, rej) => execFile2("ps", ["-A", "-o", "pid=,ppid=,pgid=,time="], { timeout: 5e3, env: { ...process.env, LC_ALL: "C" } }, (e, so) => e ? rej(e) : res(String(so))));
     return sumTreeCpu(out, pgid);
   } catch (e) {
     log9.debug(`ps cpu probe failed for group ${pgid}: ${e}`);
@@ -2546,7 +2761,7 @@ function makeRealShellTool(options) {
       return { ...this, description: rebound.description, run: rebound.run, withCwd: rebound.withCwd };
     },
     get description() {
-      return "Run a shell command via /bin/sh in the working directory. Executes any installed binary \u2014 ls, cat, grep, git, bun, node, curl, scripts, etc. Returns combined stdout+stderr; non-zero exits are prefixed `[exit N]`. Runs non-interactively with no terminal (stdin is /dev/null): commands that prompt for input fail fast rather than hang \u2014 for privileged actions use a non-interactive flag (e.g. `sudo -n`), or ask the user to run the command themselves. " + (options.registry?.adopt ? `A command still running after ${defaultTimeoutMs}ms is NOT killed \u2014 it is handed to a background job and you get its id, so you can keep checking on it (\`[still running]\`). Pass \`timeoutMs\` (max ${maxTimeoutMs}) to wait longer in the foreground, and always bound network commands yourself (e.g. \`curl -m 10\`). ` : `Each command is killed after ${defaultTimeoutMs}ms (result \`[exit 124]\` with whatever output it produced) \u2014 pass \`timeoutMs\` (max ${maxTimeoutMs}) for a legitimately slower command, and always bound network commands yourself (e.g. \`curl -m 10\`). `) + backgroundDoc();
+      return `Run a shell command via ${shellFor(options.shell).label} in the working directory. ` + windowsShellNote(shellFor(options.shell)) + "Executes any installed binary \u2014 ls, cat, grep, git, bun, node, curl, scripts, etc. Returns combined stdout+stderr; non-zero exits are prefixed `[exit N]`. Runs non-interactively with no terminal (stdin is /dev/null): commands that prompt for input fail fast rather than hang \u2014 for privileged actions use a non-interactive flag (e.g. `sudo -n`), or ask the user to run the command themselves. " + (options.registry?.adopt ? `A command still running after ${defaultTimeoutMs}ms is NOT killed \u2014 it is handed to a background job and you get its id, so you can keep checking on it (\`[still running]\`). Pass \`timeoutMs\` (max ${maxTimeoutMs}) to wait longer in the foreground, and always bound network commands yourself (e.g. \`curl -m 10\`). ` : `Each command is killed after ${defaultTimeoutMs}ms (result \`[exit 124]\` with whatever output it produced) \u2014 pass \`timeoutMs\` (max ${maxTimeoutMs}) for a legitimately slower command, and always bound network commands yourself (e.g. \`curl -m 10\`). `) + backgroundDoc();
     },
     // Declared so transports above the agent loop can size their own deadline with headroom (see AgentTool.maxDurationMs).
     maxDurationMs: maxTimeoutMs,
@@ -2570,7 +2785,7 @@ function makeRealShellTool(options) {
         return `Started background job ${id}. Poll output with ShellOutput({id:"${id}"}), check ShellStatus({id:"${id}"}), stop with ShellKill({id:"${id}"}).`;
       }
       const spawn = options.spawn ?? await nodeSpawn();
-      let argv = { bin: options.shell || "/bin/sh", args: ["-c", cmd] };
+      let argv = shellArgv(shellFor(options.shell), cmd);
       if (options.osSandbox) {
         try {
           argv = await spawnArgvFor(cmd, options.cwd, options.osSandbox);
@@ -2605,22 +2820,23 @@ function makeRealShellTool(options) {
         }
       };
       try {
-        return await new Promise((resolve2) => {
+        return await new Promise((resolve3) => {
           let out = "";
           let settled = false;
           const finish = (s) => {
             if (settled) return;
             settled = true;
-            resolve2(s);
+            resolve3(s);
           };
           let proc;
           try {
-            proc = spawn(argv.bin, argv.args, { cwd: options.cwd, env: childEnv(options), signal: ctl.signal, ...DETACHED });
+            if (IS_WIN) ctl.signal.addEventListener("abort", () => killGroup(proc, "SIGKILL"), { once: true });
+            proc = spawn(argv.bin, argv.args, { cwd: options.cwd, env: childEnv(options), signal: ctl.signal, ...DETACHED, ...argv.spawnOptions });
           } catch (e) {
             return finish(`[exit 1] failed to spawn shell: ${e?.message ?? e}`);
           }
           if (ctl.signal.aborted) killGroup(proc, "SIGKILL");
-          else ctl.signal.addEventListener("abort", () => killGroup(proc, "SIGKILL"), { once: true });
+          else if (!IS_WIN) ctl.signal.addEventListener("abort", () => killGroup(proc, "SIGKILL"), { once: true });
           const registry = options.registry;
           if (registry?.adopt) {
             onDeadline = () => {
@@ -2665,6 +2881,12 @@ function makeRealShellTool(options) {
     }
   };
 }
+function windowsShellNote(sh) {
+  if (!IS_WIN) return "";
+  if (sh.kind === "sh") return "This is Windows: the shell is bash (POSIX syntax); drive paths are written /c/Users/\u2026 or C:/Users/\u2026, and Windows programs (.exe/.cmd) run directly. ";
+  if (sh.kind === "powershell") return "This is Windows and the shell is PowerShell \u2014 use PowerShell syntax (`;` not `&&`, `$env:VAR`, Get-ChildItem/Select-String), not bash. ";
+  return "This is Windows and the shell is cmd.exe \u2014 use cmd syntax (`&&`, `%VAR%`, dir/type/findstr), not bash. ";
+}
 function handoffFor(timeoutMs, id, body, notifies) {
   const head = `[still running] exceeded ${timeoutMs}ms, so it was handed to background job ${id} \u2014 NOT killed, it is still going (it is only stopped if it goes silent with no CPU activity for a long time, and then you are told why). Check on it with ShellOutput({id:"${id}"}) / ShellStatus({id:"${id}"}), stop it with ShellKill({id:"${id}"}). ` + (notifies ? "Its completion will be reported to you, so you may continue with other work meanwhile." : "Nothing will tell you when it finishes \u2014 poll it yourself before you rely on its result.");
   return body ? `${head}
@@ -2719,7 +2941,7 @@ ${clean(out) || "(no output yet)"}`;
     }
   ];
 }
-var log9, clean, DETACHED, SECRET_ENV_RE, _spawn, ShellJobRegistry, shellStatus, NO_JOB2;
+var log9, clean, DETACHED, shellArgv, SECRET_ENV_RE, _spawn, ShellJobRegistry, shellStatus, NO_JOB2;
 var init_tools_shell = __esm({
   "src/tools.shell.ts"() {
     "use strict";
@@ -2728,9 +2950,11 @@ var init_tools_shell = __esm({
     init_logging();
     init_shell_sandbox();
     init_tools_jobs();
+    init_platform();
     log9 = forComponent("shell");
     clean = (s) => truncateOutput(redactSecrets(s.replace(/\n+$/, "")));
-    DETACHED = { stdio: ["ignore", "pipe", "pipe"], detached: true };
+    DETACHED = { stdio: ["ignore", "pipe", "pipe"], ...DETACH_OPTIONS };
+    shellArgv = (sh, command) => ({ bin: sh.bin, args: sh.args(command), ...sh.spawnOptions ? { spawnOptions: sh.spawnOptions } : {} });
     SECRET_ENV_RE = /(_API_KEY|_TOKEN|_SECRET|_PASSWORD|_PRIVATE_KEY|^AWS_|^GITHUB_TOKEN$|^OPENAI_|^ANTHROPIC_|^GOOGLE_|^GEMINI_|^GROQ_|^NPM_TOKEN$)/i;
     ShellJobRegistry = class {
       constructor(cfg) {
@@ -2745,8 +2969,8 @@ var init_tools_shell = __esm({
         const h = this.track(command, { idleMs: 0 });
         try {
           const spawn = this.cfg.spawn ?? await nodeSpawn();
-          const argv = this.cfg.osSandbox ? await spawnArgvFor(command, this.cfg.cwd, this.cfg.osSandbox) : { bin: "/bin/sh", args: ["-c", command] };
-          this.attach(h, spawn(argv.bin, argv.args, { cwd: this.cfg.cwd, env: childEnv(this.cfg), ...DETACHED }));
+          const argv = this.cfg.osSandbox ? await spawnArgvFor(command, this.cfg.cwd, this.cfg.osSandbox) : shellArgv(defaultShell(), command);
+          this.attach(h, spawn(argv.bin, argv.args, { cwd: this.cfg.cwd, env: childEnv(this.cfg), ...DETACHED, ...argv.spawnOptions }));
         } catch (e) {
           h.chunk(`failed to spawn: ${e?.message ?? e}`);
           h.finish("error", void 0, e?.message ?? String(e));
@@ -3705,7 +3929,7 @@ init_OverlayFilesystem();
 // src/worktree.ts
 import { spawnSync } from "child_process";
 import { symlinkSync, mkdirSync, statSync as statSync3, readFileSync as readFileSync3, rmSync } from "fs";
-import { join } from "path";
+import { join, resolve as resolve2 } from "path";
 var VALID_SEGMENT = /^[a-zA-Z0-9._-]+$/;
 var MAX_SLUG_LENGTH = 64;
 var GIT_NO_PROMPT_ENV = { GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "" };
@@ -3739,7 +3963,7 @@ function git(args, cwd) {
 }
 function findGitRoot(from) {
   const r = git(["rev-parse", "--show-toplevel"], from);
-  return r.ok ? r.stdout : null;
+  return r.ok ? process.platform === "win32" ? resolve2(r.stdout) : r.stdout : null;
 }
 function readWorktreeHead(worktreePath) {
   try {
@@ -3793,7 +4017,7 @@ function symlinkDirs(repoRoot, worktreePath, dirs) {
       continue;
     }
     try {
-      symlinkSync(src, dst, "dir");
+      symlinkSync(src, dst, process.platform === "win32" ? "junction" : "dir");
     } catch (e) {
       if (e?.code !== "EEXIST") console.error(`[worktree] symlink ${dir}: ${e?.message ?? e}`);
     }
@@ -4331,6 +4555,10 @@ var AgentOptions = class {
   model = "anthropic/claude-sonnet-4-6";
   systemPrompt = "You are a coding agent operating on a virtual filesystem. Use the `bash` tool to explore (ls, grep, find, cat) and the `Read`/`Edit` tools to view and modify files. Always Read a file before Editing it \u2014 and before overwriting it with `Write` or a whole-file `ApplyEdits`: Write replaces the ENTIRE file, so blindly writing over an existing one destroys its unseen contents. If a file already exists, Read it first, then merge your changes (or Edit the specific part). When multiple tool calls are independent (e.g. several Reads or Greps with no dependency between them), issue them together in a single turn rather than one at a time. When the task is complete, reply with a short summary and make no further tool calls.\nRecovery: every turn's file changes are checkpointed. If the user asks to undo/revert/recover edits (including a file you overwrote), tell them to run `/rewind` (or `/undo` for the last turn) to restore the working tree \u2014 checkpoints cover files you edited even in .gitignored dirs. You cannot run `/rewind` yourself; surface it as the recovery path.\nWhen working with a knowledge base or document workspace: use `RepoMap` with scope \"docs\" to see all document headings and summaries (orient first); use `MemorySearch` to find memories by content when you don't know the exact slug; use `Recall` with multiple slugs to batch-load related facts in one call. Prefer targeted loads over reading everything \u2014 orient \u2192 search \u2192 load \u2192 act.";
   tools = defaultTools();
+  /** claude-code/* only: which agentx tools reach it as the in-process `agentx` MCP server (ccBridge.ts). 'memory' =
+   *  the ones Claude Code has no native twin for (CC_BRIDGED); 'all' = every tool this agent has — for an agent whose
+   *  tools ARE its job (the duplex reflex: Act/Think/Hold…), run with Claude Code's own tools off (providerOptions.tools: []). */
+  ccBridge = "memory";
   maxSteps = 25;
   // --- automatic kill-switches (always on; protect the API budget against runaway loops/abuse) ---
   /** Hard ceiling on accumulated tokens (prompt+completion) across the run; cache READS count at 0.1×
@@ -4926,8 +5154,9 @@ var Agent = class _Agent {
       };
       const cursorPo = isCursorWithTools ? { toolTimeoutMs: effectiveToolTimeoutMs, toolExecutor: hostExec } : void 0;
       const claudeSteerPo = o.model.startsWith("claude-code/") ? { steer: () => this.drainPendingSteers() } : void 0;
-      if (claudeSteerPo && o.providerOptions?.claudeCodeSession && this.activeTools.some((t) => CC_BRIDGED.has(t.name))) {
-        this.ccServer ??= ccToolServer("agentx", () => this.activeTools.filter((t) => CC_BRIDGED.has(t.name)), (n, a) => this.ccExec(n, a));
+      const bridged = (t) => o.ccBridge === "all" || CC_BRIDGED.has(t.name);
+      if (claudeSteerPo && o.providerOptions?.claudeCodeSession && this.activeTools.some(bridged)) {
+        this.ccServer ??= ccToolServer("agentx", () => this.activeTools.filter(bridged), (n, a) => this.ccExec(n, a));
         claudeSteerPo.mcpServers = { ...o.providerOptions?.mcpServers, agentx: this.ccServer };
       }
       if (this.ccServer) this.ccExec = hostExec;
@@ -9134,6 +9363,10 @@ function describeCall(call) {
   const hint = v ? ` (${String(v).replace(/\s+/g, " ").trim().slice(0, 48)})` : "";
   return `${call.name}${hint}`;
 }
+function refusedCall(e) {
+  const code = Number(e?.statusCode ?? e?.status);
+  return code === 401 || code === 403 || /API key|unauthori[sz]ed|authentication|invalid x-api-key|permission denied/i.test(String(e?.message ?? e ?? ""));
+}
 var DuplexAgentOptions = class {
   /** Any ai.libx.js AIClient — shared by all tiers (routed by model). */
   ai;
@@ -9423,12 +9656,26 @@ ${nowLine()}. Anchor every relative or time-sensitive reference \u2014 "today",
       timeoutMs: 3e4,
       failEmptyTurns: false,
       // a silent reflex turn after a dispatch is legitimate — the voice layer repairs it
+      ...this.claudeCodeReflex(),
       ...o.reflexOptions,
       tools,
       // Composed AFTER the spread so the dispatch guard can't be dropped by reflexOptions.
       hooks: composeHooks(this.dispatchGuard(), o.reflexOptions?.hooks)
     });
   }
+  /** A claude-code/* reflex (the keyless stand-in when the fast model's provider has no key): Claude Code runs its own
+   *  tool loop and takes no host tool schemas, so the reflex's tools (Act/Think/Hold…) reach it through the in-process
+   *  `agentx` MCP bridge (ccBridge 'all', which needs a warm session), with Claude Code's OWN tools off (`tools: []`) and
+   *  no other MCP server — the reflex only talks and routes; real work still goes through Act and its policy. */
+  claudeCodeReflex() {
+    const o = this.options;
+    if (!o.reflexModel.startsWith("claude-code/")) return {};
+    const po = o.providerOptionsFor?.(o.reflexModel) ?? {};
+    return {
+      ccBridge: "all",
+      providerOptions: { ...po, claudeCodeSession: po.claudeCodeSession ?? crypto.randomUUID(), tools: [], mcpServers: {}, strictMcpConfig: true }
+    };
+  }
   /** Resolve memory tools + inject index into voice system prompt (once). */
   async initMemory() {
     if (!this.memoryReady) return;
@@ -9593,7 +9840,8 @@ ${nowLine()}. Anchor every relative or time-sensitive reference \u2014 "today",
     await this.drainReflex();
     this.scrubLeakFromTranscript();
     this.scrubHeldText();
-    if (this.silentTurn) await this.ackIfSilent(fallback);
+    if (this.silentTurn && res?.finishReason === "error" && refusedCall(res.error)) this.emitHost({ kind: "text_delta", message: fallback ?? _DuplexAgent.FALLBACK_ERROR });
+    else if (this.silentTurn) await this.ackIfSilent(fallback);
   }
   /** Remove complete stage-direction parentheticals from the UNFORWARDED reflex text (STAGE_DIRECTION_RE).
    *  Only the unforwarded region is touched — already-spoken audio can't be unsent, and splicing before
@@ -9699,6 +9947,7 @@ ${nowLine()}. Anchor every relative or time-sensitive reference \u2014 "today",
    *  hosts/tests key on it. */
   static FALLBACK_ACKS = ["Okay, on it.", "On it.", "Alright, working on it."];
   static FALLBACK_RETRY = ["Sorry, could you say that again?", "Hm, I missed that \u2014 could you say that again?"];
+  static FALLBACK_ERROR = "Sorry, I couldn't answer that \u2014 something went wrong on my side.";
   static FALLBACK_OWN = ["Sorry, I lost my train of thought there \u2014 give me that one more time?", "Hm, I got tangled up \u2014 ask me that once more?"];
   lastFallback = "";
   /** One user turn: the voice agent streams the reply (and may Act/Think). Serialized with re-voice turns.
@@ -10357,14 +10606,14 @@ Another agent just implemented the above. Independently check the CURRENT state
    *  '[task <id> asks] …' and resolves with the user's answer via AnswerTask — or '' on timeout/
    *  task settle (callers map '' to deny / best-judgment). Workers never block forever. */
   parkQuestion(askId, question) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let settled = false;
       const finish = (answer) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
         this.pendingAsks.delete(askId);
-        resolve2(answer);
+        resolve3(answer);
       };
       const timer = setTimeout(() => {
         this.notify("task_ask_timeout", `task ${askId}: question timed out \u2014 proceeding without an answer`);
@@ -11111,11 +11360,11 @@ function buildMcpCatalog(servers) {
   }
   return { specs, routes };
 }
-function searchOverCatalog(servers, specs, routes, resolve2, options) {
+function searchOverCatalog(servers, specs, routes, resolve3, options) {
   const tools = specs.length ? makeMcpToolSearch(specs, (name, args, o) => {
     const r = routes.get(name);
     if (!r) throw new Error(`unknown MCP tool '${name}' \u2014 use ToolSearch to find valid names`);
-    return resolve2(r.server, r.rawName, args ?? {}, o);
+    return resolve3(r.server, r.rawName, args ?? {}, o);
   }, options) : [];
   return { tools, serverNames: servers, toolCount: specs.length };
 }
@@ -11124,9 +11373,9 @@ function makeMcpToolSearchFromMounted(mounted, options) {
   const byName = new Map(mounted.map((m) => [m.name, m]));
   return searchOverCatalog(mounted.map((m) => m.name), specs, routes, (server, rawName, args, o) => byName.get(server).client.callTool(rawName, args, o), options);
 }
-function makeLazyMcpToolSearch(servers, resolve2, options) {
+function makeLazyMcpToolSearch(servers, resolve3, options) {
   const { specs, routes } = buildMcpCatalog(servers);
-  return searchOverCatalog(servers.map((s) => s.name), specs, routes, resolve2, options);
+  return searchOverCatalog(servers.map((s) => s.name), specs, routes, resolve3, options);
 }
 
 // src/hooks.ts