@poolzin/pool-bot 2026.2.0 → 2026.2.2

package/dist/memory/manager.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
+import fsSync from "node:fs";
 import path from "node:path";
 import chokidar from "chokidar";
 import { resolveAgentDir, resolveAgentWorkspaceDir } from "../agents/agent-scope.js";
@@ -11,9 +12,11 @@ import { resolveUserPath } from "../utils.js";
 import { createEmbeddingProvider, } from "./embeddings.js";
 import { DEFAULT_GEMINI_EMBEDDING_MODEL } from "./embeddings-gemini.js";
 import { DEFAULT_OPENAI_EMBEDDING_MODEL } from "./embeddings-openai.js";
+import { DEFAULT_VOYAGE_EMBEDDING_MODEL } from "./embeddings-voyage.js";
 import { OPENAI_BATCH_ENDPOINT, runOpenAiEmbeddingBatches, } from "./batch-openai.js";
 import { runGeminiEmbeddingBatches } from "./batch-gemini.js";
-import { buildFileEntry, chunkMarkdown, ensureDir, hashText, isMemoryPath, listMemoryFiles, normalizeRelPath, parseEmbedding, } from "./internal.js";
+import { runVoyageEmbeddingBatches } from "./batch-voyage.js";
+import { buildFileEntry, chunkMarkdown, ensureDir, hashText, isMemoryPath, listMemoryFiles, normalizeExtraMemoryPaths, parseEmbedding, remapChunkLines, runWithConcurrency, } from "./internal.js";
 import { bm25RankToScore, buildFtsQuery, mergeHybridResults } from "./hybrid.js";
 import { searchKeyword, searchVector } from "./manager-search.js";
 import { ensureMemoryIndexSchema } from "./memory-schema.js";
@@ -53,6 +56,7 @@ export class MemoryIndexManager {
     fallbackReason;
     openAi;
     gemini;
+    voyage;
     batch;
     batchFailureCount = 0;
     batchFailureLastError;
@@ -120,6 +124,7 @@ export class MemoryIndexManager {
         this.fallbackReason = params.providerResult.fallbackReason;
         this.openAi = params.providerResult.openAi;
         this.gemini = params.providerResult.gemini;
+        this.voyage = params.providerResult.voyage;
         this.sources = new Set(params.settings.sources);
         this.db = this.openDatabase();
         this.providerKey = this.computeProviderKey();
@@ -257,13 +262,51 @@ export class MemoryIndexManager {
         return this.syncing;
     }
     async readFile(params) {
-        const relPath = normalizeRelPath(params.relPath);
-        if (!relPath || !isMemoryPath(relPath)) {
+        const rawPath = params.relPath.trim();
+        if (!rawPath) {
             throw new Error("path required");
         }
-        const absPath = path.resolve(this.workspaceDir, relPath);
-        if (!absPath.startsWith(this.workspaceDir)) {
-            throw new Error("path escapes workspace");
+        const absPath = path.isAbsolute(rawPath)
+            ? path.resolve(rawPath)
+            : path.resolve(this.workspaceDir, rawPath);
+        const relPath = path.relative(this.workspaceDir, absPath).replace(/\\/g, "/");
+        const inWorkspace = relPath.length > 0 && !relPath.startsWith("..") && !path.isAbsolute(relPath);
+        const allowedWorkspace = inWorkspace && isMemoryPath(relPath);
+        let allowedAdditional = false;
+        if (!allowedWorkspace && this.settings.extraPaths.length > 0) {
+            const additionalPaths = normalizeExtraMemoryPaths(this.workspaceDir, this.settings.extraPaths);
+            for (const additionalPath of additionalPaths) {
+                try {
+                    const stat = await fs.lstat(additionalPath);
+                    if (stat.isSymbolicLink()) {
+                        continue;
+                    }
+                    if (stat.isDirectory()) {
+                        if (absPath === additionalPath || absPath.startsWith(`${additionalPath}${path.sep}`)) {
+                            allowedAdditional = true;
+                            break;
+                        }
+                        continue;
+                    }
+                    if (stat.isFile()) {
+                        if (absPath === additionalPath && absPath.endsWith(".md")) {
+                            allowedAdditional = true;
+                            break;
+                        }
+                    }
+                }
+                catch { }
+            }
+        }
+        if (!allowedWorkspace && !allowedAdditional) {
+            throw new Error("path required");
+        }
+        if (!absPath.endsWith(".md")) {
+            throw new Error("path required");
+        }
+        const stat = await fs.lstat(absPath);
+        if (stat.isSymbolicLink() || !stat.isFile()) {
+            throw new Error("path required");
         }
         const content = await fs.readFile(absPath, "utf-8");
         if (!params.from && !params.lines) {
@@ -307,19 +350,20 @@ export class MemoryIndexManager {
                 entry.chunks = row.c ?? 0;
                 bySource.set(row.source, entry);
             }
-            return sources.map((source) => ({ source, ...bySource.get(source) }));
+            return sources.map((source) => Object.assign({ source }, bySource.get(source)));
         })();
         return {
             backend: "builtin",
             files: files?.c ?? 0,
             chunks: chunks?.c ?? 0,
-            dirty: this.dirty,
+            dirty: this.dirty || this.sessionsDirty,
             workspaceDir: this.workspaceDir,
             dbPath: this.settings.store.path,
             provider: this.provider.id,
             model: this.provider.model,
             requestedProvider: this.requestedProvider,
             sources: Array.from(this.sources),
+            extraPaths: this.settings.extraPaths,
             sourceCounts,
             cache: this.cache.enabled
                 ? {
@@ -560,13 +604,27 @@ export class MemoryIndexManager {
         }
     }
     ensureWatcher() {
-        if (!this.sources.has("memory") || !this.settings.sync.watch || this.watcher)
+        if (!this.sources.has("memory") || !this.settings.sync.watch || this.watcher) {
             return;
-        const watchPaths = [
+        }
+        const additionalPaths = normalizeExtraMemoryPaths(this.workspaceDir, this.settings.extraPaths)
+            .map((entry) => {
+            try {
+                const stat = fsSync.lstatSync(entry);
+                return stat.isSymbolicLink() ? null : entry;
+            }
+            catch {
+                return null;
+            }
+        })
+            .filter((entry) => Boolean(entry));
+        const watchPaths = new Set([
             path.join(this.workspaceDir, "MEMORY.md"),
+            path.join(this.workspaceDir, "memory.md"),
             path.join(this.workspaceDir, "memory"),
-        ];
-        this.watcher = chokidar.watch(watchPaths, {
+            ...additionalPaths,
+        ]);
+        this.watcher = chokidar.watch(Array.from(watchPaths), {
             ignoreInitial: true,
             awaitWriteFinish: {
                 stabilityThreshold: this.settings.sync.watchDebounceMs,
@@ -765,7 +823,7 @@ export class MemoryIndexManager {
         return this.sessionsDirty && this.sessionsDirtyFiles.size > 0;
     }
     async syncMemoryFiles(params) {
-        const files = await listMemoryFiles(this.workspaceDir);
+        const files = await listMemoryFiles(this.workspaceDir, this.settings.extraPaths);
         const fileEntries = await Promise.all(files.map(async (file) => buildFileEntry(file, this.workspaceDir)));
         log.debug("memory sync: indexing memory files", {
             files: fileEntries.length,
@@ -805,7 +863,7 @@ export class MemoryIndexManager {
                 });
             }
         });
-        await this.runWithConcurrency(tasks, this.getIndexConcurrency());
+        await runWithConcurrency(tasks, this.getIndexConcurrency());
         const staleRows = this.db
             .prepare(`SELECT path FROM files WHERE source = ?`)
             .all("memory");
@@ -895,7 +953,7 @@ export class MemoryIndexManager {
                 });
             }
         });
-        await this.runWithConcurrency(tasks, this.getIndexConcurrency());
+        await runWithConcurrency(tasks, this.getIndexConcurrency());
         const staleRows = this.db
             .prepare(`SELECT path FROM files WHERE source = ?`)
             .all("sessions");
@@ -1011,7 +1069,8 @@ export class MemoryIndexManager {
         const batch = this.settings.remote?.batch;
         const enabled = Boolean(batch?.enabled &&
             ((this.openAi && this.provider.id === "openai") ||
-                (this.gemini && this.provider.id === "gemini")));
+                (this.gemini && this.provider.id === "gemini") ||
+                (this.voyage && this.provider.id === "voyage")));
         return {
             enabled,
             wait: batch?.wait ?? true,
@@ -1031,7 +1090,9 @@ export class MemoryIndexManager {
             ? DEFAULT_GEMINI_EMBEDDING_MODEL
             : fallback === "openai"
                 ? DEFAULT_OPENAI_EMBEDDING_MODEL
-                : this.settings.model;
+                : fallback === "voyage"
+                    ? DEFAULT_VOYAGE_EMBEDDING_MODEL
+                    : this.settings.model;
         const fallbackResult = await createEmbeddingProvider({
             config: this.cfg,
             agentDir: resolveAgentDir(this.cfg, this.agentId),
@@ -1046,6 +1107,7 @@ export class MemoryIndexManager {
         this.provider = fallbackResult.provider;
         this.openAi = fallbackResult.openAi;
         this.gemini = fallbackResult.gemini;
+        this.voyage = fallbackResult.voyage;
         this.providerKey = this.computeProviderKey();
         this.batch = this.resolveBatchConfig();
         log.warn(`memory embeddings: switched to fallback provider (${fallback})`, { reason });
@@ -1402,7 +1464,7 @@ export class MemoryIndexManager {
         if (this.provider.id === "openai" && this.openAi) {
             const entries = Object.entries(this.openAi.headers)
                 .filter(([key]) => key.toLowerCase() !== "authorization")
-                .sort(([a], [b]) => a.localeCompare(b))
+                .toSorted(([a], [b]) => a.localeCompare(b))
                 .map(([key, value]) => [key, value]);
             return hashText(JSON.stringify({
                 provider: "openai",
@@ -1417,7 +1479,7 @@ export class MemoryIndexManager {
                 const lower = key.toLowerCase();
                 return lower !== "authorization" && lower !== "x-goog-api-key";
             })
-                .sort(([a], [b]) => a.localeCompare(b))
+                .toSorted(([a], [b]) => a.localeCompare(b))
                 .map(([key, value]) => [key, value]);
             return hashText(JSON.stringify({
                 provider: "gemini",
@@ -1435,8 +1497,78 @@ export class MemoryIndexManager {
         if (this.provider.id === "gemini" && this.gemini) {
             return this.embedChunksWithGeminiBatch(chunks, entry, source);
         }
+        if (this.provider.id === "voyage" && this.voyage) {
+            return this.embedChunksWithVoyageBatch(chunks, entry, source);
+        }
         return this.embedChunksInBatches(chunks);
     }
+    async embedChunksWithVoyageBatch(chunks, entry, source) {
+        const voyage = this.voyage;
+        if (!voyage) {
+            return this.embedChunksInBatches(chunks);
+        }
+        if (chunks.length === 0) {
+            return [];
+        }
+        const cached = this.loadEmbeddingCache(chunks.map((chunk) => chunk.hash));
+        const embeddings = Array.from({ length: chunks.length }, () => []);
+        const missing = [];
+        for (let i = 0; i < chunks.length; i += 1) {
+            const chunk = chunks[i];
+            const hit = chunk?.hash ? cached.get(chunk.hash) : undefined;
+            if (hit && hit.length > 0) {
+                embeddings[i] = hit;
+            }
+            else if (chunk) {
+                missing.push({ index: i, chunk });
+            }
+        }
+        if (missing.length === 0) {
+            return embeddings;
+        }
+        const requests = [];
+        const mapping = new Map();
+        for (const item of missing) {
+            const chunk = item.chunk;
+            const customId = hashText(`${source}:${entry.path}:${chunk.startLine}:${chunk.endLine}:${chunk.hash}:${item.index}`);
+            mapping.set(customId, { index: item.index, hash: chunk.hash });
+            requests.push({
+                custom_id: customId,
+                body: {
+                    input: chunk.text,
+                },
+            });
+        }
+        const batchResult = await this.runBatchWithFallback({
+            provider: "voyage",
+            run: async () => await runVoyageEmbeddingBatches({
+                client: voyage,
+                agentId: this.agentId,
+                requests,
+                wait: this.batch.wait,
+                concurrency: this.batch.concurrency,
+                pollIntervalMs: this.batch.pollIntervalMs,
+                timeoutMs: this.batch.timeoutMs,
+                debug: (message, data) => log.debug(message, { ...data, source, chunks: chunks.length }),
+            }),
+            fallback: async () => await this.embedChunksInBatches(chunks),
+        });
+        if (Array.isArray(batchResult)) {
+            return batchResult;
+        }
+        const byCustomId = batchResult;
+        const toCache = [];
+        for (const [customId, embedding] of byCustomId.entries()) {
+            const mapped = mapping.get(customId);
+            if (!mapped) {
+                continue;
+            }
+            embeddings[mapped.index] = embedding;
+            toCache.push({ hash: mapped.hash, embedding });
+        }
+        this.upsertEmbeddingCache(toCache);
+        return embeddings;
+    }
     async embedChunksWithOpenAiBatch(chunks, entry, source) {
         const openAi = this.openAi;
         if (!openAi) {
@@ -1623,35 +1755,6 @@ export class MemoryIndexManager {
                 clearTimeout(timer);
         }
     }
-    async runWithConcurrency(tasks, limit) {
-        if (tasks.length === 0)
-            return [];
-        const resolvedLimit = Math.max(1, Math.min(limit, tasks.length));
-        const results = Array.from({ length: tasks.length });
-        let next = 0;
-        let firstError = null;
-        const workers = Array.from({ length: resolvedLimit }, async () => {
-            while (true) {
-                if (firstError)
-                    return;
-                const index = next;
-                next += 1;
-                if (index >= tasks.length)
-                    return;
-                try {
-                    results[index] = await tasks[index]();
-                }
-                catch (err) {
-                    firstError = err;
-                    return;
-                }
-            }
-        });
-        await Promise.allSettled(workers);
-        if (firstError)
-            throw firstError;
-        return results;
-    }
     async withBatchFailureLock(fn) {
         let release;
         const wait = this.batchFailureLock;
@@ -1749,6 +1852,9 @@ export class MemoryIndexManager {
     async indexFile(entry, options) {
         const content = options.content ?? (await fs.readFile(entry.absPath, "utf-8"));
         const chunks = chunkMarkdown(content, this.settings.chunking).filter((chunk) => chunk.text.trim().length > 0);
+        if (options.source === "sessions" && "lineMap" in entry) {
+            remapChunkLines(chunks, entry.lineMap);
+        }
         const embeddings = this.batch.enabled
             ? await this.embedChunksWithBatch(chunks, entry, options.source)
             : await this.embedChunksInBatches(chunks);

package/dist/memory/search-manager.js

@@ -1,4 +1,40 @@
+import { createSubsystemLogger } from "../logging/subsystem.js";
+import { resolveMemoryBackendConfig } from "./backend-config.js";
+const log = createSubsystemLogger("memory");
+const QMD_MANAGER_CACHE = new Map();
 export async function getMemorySearchManager(params) {
+    const resolved = resolveMemoryBackendConfig(params);
+    if (resolved.backend === "qmd" && resolved.qmd) {
+        const cacheKey = buildQmdCacheKey(params.agentId, resolved.qmd);
+        const cached = QMD_MANAGER_CACHE.get(cacheKey);
+        if (cached) {
+            return { manager: cached };
+        }
+        try {
+            // @ts-expect-error qmd-manager is an optional module that may not exist at build time
+            const { QmdMemoryManager } = await import("./qmd-manager.js");
+            const primary = await QmdMemoryManager.create({
+                cfg: params.cfg,
+                agentId: params.agentId,
+                resolved,
+            });
+            if (primary) {
+                const wrapper = new FallbackMemoryManager({
+                    primary,
+                    fallbackFactory: async () => {
+                        const { MemoryIndexManager } = await import("./manager.js");
+                        return await MemoryIndexManager.get(params);
+                    },
+                }, () => QMD_MANAGER_CACHE.delete(cacheKey));
+                QMD_MANAGER_CACHE.set(cacheKey, wrapper);
+                return { manager: wrapper };
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            log.warn(`qmd memory unavailable; falling back to builtin: ${message}`);
+        }
+    }
     try {
         const { MemoryIndexManager } = await import("./manager.js");
         const manager = await MemoryIndexManager.get(params);
@@ -9,3 +45,140 @@ export async function getMemorySearchManager(params) {
         return { manager: null, error: message };
     }
 }
+class FallbackMemoryManager {
+    deps;
+    onClose;
+    fallback = null;
+    primaryFailed = false;
+    lastError;
+    cacheEvicted = false;
+    constructor(deps, onClose) {
+        this.deps = deps;
+        this.onClose = onClose;
+    }
+    async search(query, opts) {
+        if (!this.primaryFailed) {
+            try {
+                return await this.deps.primary.search(query, opts);
+            }
+            catch (err) {
+                this.primaryFailed = true;
+                this.lastError = err instanceof Error ? err.message : String(err);
+                log.warn(`qmd memory failed; switching to builtin index: ${this.lastError}`);
+                await this.deps.primary.close?.().catch(() => { });
+                // Evict the failed wrapper so the next request can retry QMD with a fresh manager.
+                this.evictCacheEntry();
+            }
+        }
+        const fallback = await this.ensureFallback();
+        if (fallback) {
+            return await fallback.search(query, opts);
+        }
+        throw new Error(this.lastError ?? "memory search unavailable");
+    }
+    async readFile(params) {
+        if (!this.primaryFailed) {
+            return await this.deps.primary.readFile(params);
+        }
+        const fallback = await this.ensureFallback();
+        if (fallback) {
+            return await fallback.readFile(params);
+        }
+        throw new Error(this.lastError ?? "memory read unavailable");
+    }
+    status() {
+        if (!this.primaryFailed) {
+            return this.deps.primary.status();
+        }
+        const fallbackStatus = this.fallback?.status();
+        const fallbackInfo = { from: "qmd", reason: this.lastError ?? "unknown" };
+        if (fallbackStatus) {
+            const custom = fallbackStatus.custom ?? {};
+            return {
+                ...fallbackStatus,
+                fallback: fallbackInfo,
+                custom: {
+                    ...custom,
+                    fallback: { disabled: true, reason: this.lastError ?? "unknown" },
+                },
+            };
+        }
+        const primaryStatus = this.deps.primary.status();
+        const custom = primaryStatus.custom ?? {};
+        return {
+            ...primaryStatus,
+            fallback: fallbackInfo,
+            custom: {
+                ...custom,
+                fallback: { disabled: true, reason: this.lastError ?? "unknown" },
+            },
+        };
+    }
+    async sync(params) {
+        if (!this.primaryFailed) {
+            await this.deps.primary.sync?.(params);
+            return;
+        }
+        const fallback = await this.ensureFallback();
+        await fallback?.sync?.(params);
+    }
+    async probeEmbeddingAvailability() {
+        if (!this.primaryFailed) {
+            return await this.deps.primary.probeEmbeddingAvailability();
+        }
+        const fallback = await this.ensureFallback();
+        if (fallback) {
+            return await fallback.probeEmbeddingAvailability();
+        }
+        return { ok: false, error: this.lastError ?? "memory embeddings unavailable" };
+    }
+    async probeVectorAvailability() {
+        if (!this.primaryFailed) {
+            return await this.deps.primary.probeVectorAvailability();
+        }
+        const fallback = await this.ensureFallback();
+        return (await fallback?.probeVectorAvailability()) ?? false;
+    }
+    async close() {
+        await this.deps.primary.close?.();
+        await this.fallback?.close?.();
+        this.evictCacheEntry();
+    }
+    async ensureFallback() {
+        if (this.fallback) {
+            return this.fallback;
+        }
+        const fallback = await this.deps.fallbackFactory();
+        if (!fallback) {
+            log.warn("memory fallback requested but builtin index is unavailable");
+            return null;
+        }
+        this.fallback = fallback;
+        return this.fallback;
+    }
+    evictCacheEntry() {
+        if (this.cacheEvicted) {
+            return;
+        }
+        this.cacheEvicted = true;
+        this.onClose?.();
+    }
+}
+function buildQmdCacheKey(agentId, config) {
+    return `${agentId}:${stableSerialize(config)}`;
+}
+function stableSerialize(value) {
+    return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => sortValue(entry));
+    }
+    if (value && typeof value === "object") {
+        const sortedEntries = Object.keys(value)
+            .toSorted((a, b) => a.localeCompare(b))
+            .map((key) => [key, sortValue(value[key])]);
+        return Object.fromEntries(sortedEntries);
+    }
+    return value;
+}

package/dist/memory/session-files.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { resolveSessionTranscriptsDirForAgent } from "../config/sessions/paths.js";
+import { redactSensitiveText } from "../logging/redact.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { hashText } from "./internal.js";
 const log = createSubsystemLogger("memory");
@@ -55,7 +56,9 @@ export async function buildSessionEntry(absPath) {
         const raw = await fs.readFile(absPath, "utf-8");
         const lines = raw.split("\n");
         const collected = [];
-        for (const line of lines) {
+        const lineMap = [];
+        for (let jsonlIdx = 0; jsonlIdx < lines.length; jsonlIdx++) {
+            const line = lines[jsonlIdx];
             if (!line.trim())
                 continue;
             let record;
@@ -78,8 +81,10 @@ export async function buildSessionEntry(absPath) {
             const text = extractSessionText(message.content);
             if (!text)
                 continue;
+            const safe = redactSensitiveText(text, { mode: "tools" });
             const label = message.role === "user" ? "User" : "Assistant";
-            collected.push(`${label}: ${text}`);
+            collected.push(`${label}: ${safe}`);
+            lineMap.push(jsonlIdx + 1);
         }
         const content = collected.join("\n");
         return {
@@ -87,8 +92,9 @@ export async function buildSessionEntry(absPath) {
             absPath,
             mtimeMs: stat.mtimeMs,
             size: stat.size,
-            hash: hashText(content),
+            hash: hashText(content + "\n" + lineMap.join(",")),
             content,
+            lineMap,
         };
     }
     catch (err) {

package/dist/node-host/runner.js

@@ -17,10 +17,16 @@ import { ensurePoolbotCliOnPath } from "../infra/path-env.js";
 import { VERSION } from "../version.js";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../utils/message-channel.js";
 import { ensureNodeHostConfig, saveNodeHostConfig } from "./config.js";
+import { withTimeout } from "./with-timeout.js";
 import { GatewayClient } from "../gateway/client.js";
 function resolveExecSecurity(value) {
     return value === "deny" || value === "allowlist" || value === "full" ? value : "allowlist";
 }
+function isCmdExeInvocation(argv) {
+    const bin = argv[0]?.trim().toLowerCase().replace(/\\/g, "/") ?? "";
+    const base = bin.split("/").pop() ?? "";
+    return base === "cmd" || base === "cmd.exe";
+}
 function resolveExecAsk(value) {
     return value === "off" || value === "on-miss" || value === "always" ? value : "on-miss";
 }
@@ -124,26 +130,6 @@ async function ensureBrowserControlService() {
     })();
     return browserControlReady;
 }
-async function withTimeout(promise, timeoutMs, label) {
-    const resolved = typeof timeoutMs === "number" && Number.isFinite(timeoutMs)
-        ? Math.max(1, Math.floor(timeoutMs))
-        : undefined;
-    if (!resolved)
-        return await promise;
-    let timer;
-    const timeoutPromise = new Promise((_, reject) => {
-        timer = setTimeout(() => {
-            reject(new Error(`${label ?? "request"} timed out`));
-        }, resolved);
-    });
-    try {
-        return await Promise.race([promise, timeoutPromise]);
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
 function isProfileAllowed(params) {
     const { allowProfiles, profile } = params;
     if (!allowProfiles.length)
@@ -422,7 +408,7 @@ export async function runNodeHost(opts) {
         },
     });
     const skillBins = new SkillBinsCache(async () => {
-        const res = (await client.request("skills.bins", {}));
+        const res = await client.request("skills.bins", {});
         const bins = Array.isArray(res?.bins) ? res.bins.map((bin) => String(bin)) : [];
         return bins;
     });
@@ -562,7 +548,7 @@ async function handleInvoke(frame, client, skillBins) {
                 query[key] = typeof value === "string" ? value : String(value);
             }
             const dispatcher = createBrowserRouteDispatcher(createBrowserControlContext());
-            const response = await withTimeout(dispatcher.dispatch({
+            const response = await withTimeout((_signal) => dispatcher.dispatch({
                 method: method === "DELETE" ? "DELETE" : method === "POST" ? "POST" : "GET",
                 path,
                 query,
@@ -597,7 +583,9 @@ async function handleInvoke(frame, client, skillBins) {
                         return file;
                     }
                     catch (err) {
-                        throw new Error(`browser proxy file read failed for ${p}: ${String(err)}`);
+                        throw new Error(`browser proxy file read failed for ${p}: ${String(err)}`, {
+                            cause: err,
+                        });
                     }
                 }));
                 if (loaded.length > 0)
@@ -675,6 +663,7 @@ async function handleInvoke(frame, client, skillBins) {
             env,
             skillBins: bins,
             autoAllowSkills,
+            platform: process.platform,
         });
         analysisOk = allowlistEval.analysisOk;
         allowlistMatches = allowlistEval.allowlistMatches;
@@ -698,6 +687,14 @@ async function handleInvoke(frame, client, skillBins) {
             security === "allowlist" && analysisOk ? allowlistEval.allowlistSatisfied : false;
         segments = analysis.segments;
     }
+    const isWindows = process.platform === "win32";
+    const cmdInvocation = rawCommand
+        ? isCmdExeInvocation(segments[0]?.argv ?? [])
+        : isCmdExeInvocation(argv);
+    if (security === "allowlist" && isWindows && cmdInvocation) {
+        analysisOk = false;
+        allowlistSatisfied = false;
+    }
     const useMacAppExec = process.platform === "darwin";
     if (useMacAppExec) {
         const approvalDecision = params.approvalDecision === "allow-once" || params.approvalDecision === "allow-always"
@@ -853,7 +850,20 @@ async function handleInvoke(frame, client, skillBins) {
         });
         return;
     }
-    const result = await runCommand(argv, params.cwd?.trim() || undefined, env, params.timeoutMs ?? undefined);
+    /* On Windows, avoid spawning via cmd.exe when the allowlist already approved
+     * a single-segment command — run the parsed argv directly instead. */
+    let execArgv = argv;
+    if (security === "allowlist" &&
+        isWindows &&
+        !approvedByAsk &&
+        rawCommand &&
+        analysisOk &&
+        allowlistSatisfied &&
+        segments.length === 1 &&
+        segments[0]?.argv.length > 0) {
+        execArgv = segments[0].argv;
+    }
+    const result = await runCommand(execArgv, params.cwd?.trim() || undefined, env, params.timeoutMs ?? undefined);
     if (result.truncated) {
         const suffix = "... (truncated)";
         if (result.stderr.trim().length > 0) {