@runweave/server-linux-x64 0.1.4 → 0.1.5

package/payload/backend/index.cjs

@@ -1,4 +1,4 @@
-/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261107T223213775Z-f6afc191","sourceRevision":"f6afc191b5f9be76aa35a6ee494a0d752c21af08","sourceDirty":false,"builtAt":"2026-11-07T22:32:13.775Z","contentSha256":"2e4f6c4cdcdd6f94f4107fdbd126d69b5d6f38db3fb3a319148588a4b4b457c4"};
+/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261108T004030826Z-168d13f1","sourceRevision":"168d13f138a29af9055863e4ccec018125af5644","sourceDirty":false,"builtAt":"2026-11-08T00:40:30.826Z","contentSha256":"394f0c720b78d371bf221f4f8905acd58f0bc74de7937f0bf692d45c61f0fabb"};
 const __IMPORT_META_URL__ = require('url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;
@@ -63470,7 +63470,6 @@ function createScreenRecordingRouter(service, auth) {
 // backend/src/routes/server-management.ts
 var import_express3 = __toESM(require_express2(), 1);
 var import_node_crypto5 = require("node:crypto");
-var import_node_fs7 = require("node:fs");
 var import_node_path9 = __toESM(require("node:path"), 1);
 
 // packages/config-node/src/context.ts
@@ -63492,21 +63491,57 @@ var ConfigurationError = class extends Error {
 
 // packages/config-node/src/private-file.ts
 var import_node_fs = require("node:fs");
+
+// packages/config-node/src/windows-permissions.ts
+var import_node_child_process = require("node:child_process");
+function assertWindowsPrivatePath(file) {
+  if (process.platform !== "win32") return;
+  const script = `
+$ErrorActionPreference = 'Stop'
+# Use .NET directly: a parent pwsh may export a PSModulePath incompatible with Windows PowerShell.
+$acl = if ([IO.Directory]::Exists($env:RUNWEAVE_PRIVATE_PATH)) {
+  [IO.Directory]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH)
+} else { [IO.File]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH) }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'owner' }
+foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { throw 'access' }
+}
+`;
+  try {
+    (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+      env: { ...process.env, RUNWEAVE_PRIVATE_PATH: file },
+      stdio: "ignore",
+      timeout: 1e4,
+      windowsHide: true
+    });
+  } catch {
+    throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file]);
+  }
+}
+
+// packages/config-node/src/private-file.ts
 function assertPrivateDirectory(directory3) {
   const stat20 = (0, import_node_fs.lstatSync)(directory3);
-  if (!stat20.isDirectory() || stat20.isSymbolicLink() || stat20.mode & 63 || typeof process.getuid === "function" && stat20.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  if (!stat20.isDirectory() || stat20.isSymbolicLink() || process.platform !== "win32" && stat20.mode & 63 || typeof process.getuid === "function" && stat20.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(directory3);
 }
-function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024) {
+function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024, file) {
   const stat20 = (0, import_node_fs.fstatSync)(fd);
   if (!stat20.isFile() || stat20.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat20.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if (stat20.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && stat20.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform === "win32") {
+    if (!file) throw new ConfigurationError("CONFIG_PRIVATE_PATH_REQUIRED");
+    assertWindowsPrivatePath(file);
+  }
   if (stat20.size > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
 }
 function readPrivateFile(file, maxBytes = 1024 * 1024) {
   const fd = (0, import_node_fs.openSync)(file, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW);
   try {
-    assertPrivateDescriptor(fd, maxBytes);
+    assertPrivateDescriptor(fd, maxBytes, file);
     const source2 = (0, import_node_fs.readFileSync)(fd, "utf8");
     if (Buffer.byteLength(source2) > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
     return source2;
@@ -63581,15 +63616,27 @@ function assertOwnedPath(context, value) {
   }
 }
 
-// packages/config-node/src/owner.ts
+// packages/config-node/src/platform.ts
 var import_node_fs3 = require("node:fs");
+function syncDirectory(directory3) {
+  if (process.platform === "win32") return;
+  const fd = (0, import_node_fs3.openSync)(directory3, "r");
+  try {
+    (0, import_node_fs3.fsyncSync)(fd);
+  } finally {
+    (0, import_node_fs3.closeSync)(fd);
+  }
+}
+
+// packages/config-node/src/owner.ts
+var import_node_fs4 = require("node:fs");
 var import_node_path3 = __toESM(require("node:path"), 1);
 var import_node_os3 = __toESM(require("node:os"), 1);
 var import_node_crypto2 = require("node:crypto");
 var import_fs_native_extensions = require("fs-native-extensions");
 function ownerDirectory(context) {
   const directory3 = context.kind === "stable" ? import_node_path3.default.join(import_node_os3.default.userInfo().homedir, ".runweave", "runtime") : import_node_path3.default.join(context.configRoot, "runtime");
-  (0, import_node_fs3.mkdirSync)(directory3, { recursive: true, mode: 448 });
+  (0, import_node_fs4.mkdirSync)(directory3, { recursive: true, mode: 448 });
   assertPrivateDirectory(import_node_path3.default.dirname(directory3));
   assertPrivateDirectory(directory3);
   return directory3;
@@ -63598,11 +63645,11 @@ function registerStableConfigurationRoot(context) {
   if (context.kind !== "stable") return;
   const directory3 = ownerDirectory(context);
   const registry2 = import_node_path3.default.join(directory3, "stable-root.json");
-  const registryFd = (0, import_node_fs3.openSync)(import_node_path3.default.join(directory3, "stable-root.lock"), import_node_fs3.constants.O_CREAT | import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NOFOLLOW, 384);
+  const registryFd = (0, import_node_fs4.openSync)(import_node_path3.default.join(directory3, "stable-root.lock"), import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(registryFd);
+    assertPrivateDescriptor(registryFd, void 0, import_node_path3.default.join(directory3, "stable-root.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(registryFd)) throw new ConfigurationError("CONFIG_ROOT_REGISTRATION_BUSY");
-    if ((0, import_node_fs3.existsSync)(registry2)) {
+    if ((0, import_node_fs4.existsSync)(registry2)) {
       let stored;
       try {
         stored = JSON.parse(readPrivateFile(registry2));
@@ -63612,34 +63659,29 @@ function registerStableConfigurationRoot(context) {
       if (!stored || typeof stored !== "object" || !("root" in stored) || stored.root !== canonicalPath(context.configRoot)) throw new ConfigurationError("CONFIG_STABLE_ROOT_CONFLICT");
     } else {
       const temporary = `${registry2}.${(0, import_node_crypto2.randomUUID)()}.tmp`;
-      const file = (0, import_node_fs3.openSync)(temporary, "wx", 384);
-      try {
-        (0, import_node_fs3.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
-        (0, import_node_fs3.fsyncSync)(file);
-      } finally {
-        (0, import_node_fs3.closeSync)(file);
-      }
-      (0, import_node_fs3.renameSync)(temporary, registry2);
-      const parent = (0, import_node_fs3.openSync)(directory3, "r");
+      const file = (0, import_node_fs4.openSync)(temporary, "wx", 384);
       try {
-        (0, import_node_fs3.fsyncSync)(parent);
+        (0, import_node_fs4.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
+        (0, import_node_fs4.fsyncSync)(file);
       } finally {
-        (0, import_node_fs3.closeSync)(parent);
+        (0, import_node_fs4.closeSync)(file);
       }
+      (0, import_node_fs4.renameSync)(temporary, registry2);
+      syncDirectory(directory3);
     }
   } finally {
-    (0, import_node_fs3.closeSync)(registryFd);
+    (0, import_node_fs4.closeSync)(registryFd);
   }
 }
 function withUpgradeGate(context, shared, run2) {
   const directory3 = ownerDirectory(context);
-  const fd = (0, import_node_fs3.openSync)(import_node_path3.default.join(directory3, "configuration-upgrade.lock"), import_node_fs3.constants.O_CREAT | import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs4.openSync)(import_node_path3.default.join(directory3, "configuration-upgrade.lock"), import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path3.default.join(directory3, "configuration-upgrade.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(fd, 0, 0, { shared })) throw new ConfigurationError("CONFIG_UPGRADE_BUSY");
     return run2();
   } finally {
-    (0, import_node_fs3.closeSync)(fd);
+    (0, import_node_fs4.closeSync)(fd);
   }
 }
 function withConfigurationUpgradeOwnership(context, run2, ignoredRoles = []) {
@@ -63647,16 +63689,16 @@ function withConfigurationUpgradeOwnership(context, run2, ignoredRoles = []) {
     const directory3 = ownerDirectory(context);
     const held = [];
     try {
-      for (const file of (0, import_node_fs3.readdirSync)(directory3).filter((name) => name.endsWith(".owner.lock"))) {
+      for (const file of (0, import_node_fs4.readdirSync)(directory3).filter((name) => name.endsWith(".owner.lock"))) {
         if (ignoredRoles.includes(file.replace(/\.owner\.lock$/, ""))) continue;
-        const fd = (0, import_node_fs3.openSync)(import_node_path3.default.join(directory3, file), import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NOFOLLOW);
+        const fd = (0, import_node_fs4.openSync)(import_node_path3.default.join(directory3, file), import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW);
         held.push(fd);
-        assertPrivateDescriptor(fd);
+        assertPrivateDescriptor(fd, void 0, import_node_path3.default.join(directory3, file));
         if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_UPGRADE_CONSUMER_RUNNING", [file.replace(/\.owner\.lock$/, "")]);
       }
       return run2();
     } finally {
-      for (const fd of held) (0, import_node_fs3.closeSync)(fd);
+      for (const fd of held) (0, import_node_fs4.closeSync)(fd);
     }
   });
 }
@@ -63665,16 +63707,16 @@ function acquireConfigurationOwner(context, role) {
 }
 function acquireOwner(context, role) {
   const directory3 = ownerDirectory(context);
-  const fd = (0, import_node_fs3.openSync)(import_node_path3.default.join(directory3, `${role}.owner.lock`), import_node_fs3.constants.O_CREAT | import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs4.openSync)(import_node_path3.default.join(directory3, `${role}.owner.lock`), import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW, 384);
   let closed = false;
   const release = () => {
     if (!closed) {
       closed = true;
-      (0, import_node_fs3.closeSync)(fd);
+      (0, import_node_fs4.closeSync)(fd);
     }
   };
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path3.default.join(directory3, `${role}.owner.lock`));
     if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_INSTANCE_ALREADY_RUNNING", [role]);
     registerStableConfigurationRoot(context);
     return { release };
@@ -63997,7 +64039,7 @@ function migrateConfigurationDocument(document2) {
 }
 
 // packages/config-node/src/store.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var import_node_path5 = __toESM(require("node:path"), 1);
 var import_node_crypto3 = require("node:crypto");
 var import_yaml = __toESM(require_dist(), 1);
@@ -64192,10 +64234,11 @@ function parseConfigurationYaml(source2, context) {
   return { document: document2, value, digest: (0, import_node_crypto3.createHash)("sha256").update(source2).digest("hex"), issues: validateDomains(value, context) };
 }
 function assertPrivateFile(file, fd) {
-  const stat20 = fd === void 0 ? (0, import_node_fs4.lstatSync)(file) : (0, import_node_fs4.fstatSync)(fd);
+  const stat20 = fd === void 0 ? (0, import_node_fs5.lstatSync)(file) : (0, import_node_fs5.fstatSync)(fd);
   if (!stat20.isFile() || stat20.isSymbolicLink() || stat20.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat20.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if ((stat20.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && (stat20.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(file);
   if (stat20.size > MAX_BYTES) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE", [], { line: 1, column: 1 });
 }
 var ConfigurationStore = class {
@@ -64205,30 +64248,29 @@ var ConfigurationStore = class {
   }
   file;
   read() {
-    if (!(0, import_node_fs4.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
-    const root = (0, import_node_fs4.lstatSync)(this.context.configRoot);
-    if (!root.isDirectory() || root.isSymbolicLink() || root.mode & 63 || typeof process.getuid === "function" && root.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+    if (!(0, import_node_fs5.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
+    assertPrivateDirectory(this.context.configRoot);
     assertPrivateFile(this.file);
-    const fd = (0, import_node_fs4.openSync)(this.file, import_node_fs4.constants.O_RDONLY | import_node_fs4.constants.O_NOFOLLOW);
+    const fd = (0, import_node_fs5.openSync)(this.file, import_node_fs5.constants.O_RDONLY | import_node_fs5.constants.O_NOFOLLOW);
     try {
       assertPrivateFile(this.file, fd);
-      return parseConfigurationYaml((0, import_node_fs4.readFileSync)(fd, "utf8"), this.context);
+      return parseConfigurationYaml((0, import_node_fs5.readFileSync)(fd, "utf8"), this.context);
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
   }
   locked(run2) {
-    (0, import_node_fs4.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
-    const dirStat = (0, import_node_fs4.lstatSync)(this.context.configRoot);
+    (0, import_node_fs5.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
+    const dirStat = (0, import_node_fs5.lstatSync)(this.context.configRoot);
     if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || typeof process.getuid === "function" && dirStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_OWNER_MISMATCH");
-    if ((dirStat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
-    const fd = (0, import_node_fs4.openSync)(import_node_path5.default.join(this.context.configRoot, "settings.lock"), import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW, 384);
+    assertPrivateDirectory(this.context.configRoot);
+    const fd = (0, import_node_fs5.openSync)(import_node_path5.default.join(this.context.configRoot, "settings.lock"), import_node_fs5.constants.O_CREAT | import_node_fs5.constants.O_RDWR | import_node_fs5.constants.O_NOFOLLOW, 384);
     try {
       assertPrivateFile(import_node_path5.default.join(this.context.configRoot, "settings.lock"), fd);
       if (!(0, import_fs_native_extensions2.tryLock)(fd)) throw new ConfigurationError("CONFIG_WRITE_BUSY");
       return run2();
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
   }
   publish(document2, previous, backupId) {
@@ -64238,41 +64280,35 @@ var ConfigurationStore = class {
     const temporary = `${this.file}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
     if (previous !== void 0) {
       const backupRoot = import_node_path5.default.join(this.context.configRoot, "config-backups");
-      (0, import_node_fs4.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
-      const backupStat = (0, import_node_fs4.lstatSync)(backupRoot);
-      if (!backupStat.isDirectory() || backupStat.isSymbolicLink() || backupStat.mode & 63 || typeof process.getuid === "function" && backupStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_BACKUP_ROOT_INVALID");
+      (0, import_node_fs5.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
+      assertPrivateDirectory(backupRoot);
       const backup = import_node_path5.default.join(backupRoot, backupId ?? `${Date.now()}-${(0, import_node_crypto3.randomUUID)()}.yaml`);
-      const fd2 = (0, import_node_fs4.openSync)(backup, "wx", 384);
+      const fd2 = (0, import_node_fs5.openSync)(backup, "wx", 384);
       try {
-        (0, import_node_fs4.writeFileSync)(fd2, previous);
-        (0, import_node_fs4.fsyncSync)(fd2);
+        (0, import_node_fs5.writeFileSync)(fd2, previous);
+        (0, import_node_fs5.fsyncSync)(fd2);
       } finally {
-        (0, import_node_fs4.closeSync)(fd2);
+        (0, import_node_fs5.closeSync)(fd2);
       }
     }
-    const fd = (0, import_node_fs4.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs5.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs4.writeFileSync)(fd, source2);
-      (0, import_node_fs4.fsyncSync)(fd);
+      (0, import_node_fs5.writeFileSync)(fd, source2);
+      (0, import_node_fs5.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
     try {
-      (0, import_node_fs4.renameSync)(temporary, this.file);
-      const parent = (0, import_node_fs4.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs4.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs4.closeSync)(parent);
-      }
+      (0, import_node_fs5.renameSync)(temporary, this.file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs4.existsSync)(temporary)) (0, import_node_fs4.unlinkSync)(temporary);
+      if ((0, import_node_fs5.existsSync)(temporary)) (0, import_node_fs5.unlinkSync)(temporary);
     }
     return checked;
   }
   initialize(value) {
     return this.locked(() => {
-      if ((0, import_node_fs4.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
+      if ((0, import_node_fs5.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
       if (Object.keys(issues).length) throw new ConfigurationError("CONFIG_VALIDATION_FAILED", Object.values(issues).flat().map((item) => item.path));
@@ -64312,9 +64348,9 @@ var ConfigurationStore = class {
   }
   backups() {
     const root = import_node_path5.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs4.existsSync)(root)) return [];
+    if (!(0, import_node_fs5.existsSync)(root)) return [];
     assertPrivateDirectory(root);
-    return (0, import_node_fs4.readdirSync)(root).filter((id7) => /^\d+-[a-f0-9-]+\.yaml$/.test(id7)).sort().reverse().map((id7) => {
+    return (0, import_node_fs5.readdirSync)(root).filter((id7) => /^\d+-[a-f0-9-]+\.yaml$/.test(id7)).sort().reverse().map((id7) => {
       try {
         const backup = this.readBackup(id7);
         return { id: id7, revision: backup.value.revision, schemaVersion: backup.value.schemaVersion, compatible: true };
@@ -64392,23 +64428,18 @@ var ConfigurationStore = class {
   recordUpgrade(value) {
     const file = import_node_path5.default.join(this.context.configRoot, "config-upgrade.json");
     const temporary = `${file}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-    const fd = (0, import_node_fs4.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs5.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs4.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
-      (0, import_node_fs4.fsyncSync)(fd);
+      (0, import_node_fs5.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
+      (0, import_node_fs5.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
     try {
-      (0, import_node_fs4.renameSync)(temporary, file);
-      const parent = (0, import_node_fs4.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs4.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs4.closeSync)(parent);
-      }
+      (0, import_node_fs5.renameSync)(temporary, file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs4.existsSync)(temporary)) (0, import_node_fs4.unlinkSync)(temporary);
+      if ((0, import_node_fs5.existsSync)(temporary)) (0, import_node_fs5.unlinkSync)(temporary);
     }
   }
   upgrade(expected) {
@@ -64417,7 +64448,7 @@ var ConfigurationStore = class {
       if (preview.expectedRevision !== expected.revision || preview.expectedDigest !== expected.digest) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       if (!preview.changed) {
         const receiptFile = import_node_path5.default.join(this.context.configRoot, "config-upgrade.json");
-        if ((0, import_node_fs4.existsSync)(receiptFile)) {
+        if ((0, import_node_fs5.existsSync)(receiptFile)) {
           const receipt = JSON.parse(readPrivateFile(receiptFile));
           if (isConfigurationObject(receipt) && receipt.phase === "prepared" && receipt.plannedDigest === expected.digest)
             this.recordUpgrade({ ...receipt, phase: "committed", savedRevision: expected.revision, digest: expected.digest });
@@ -64451,9 +64482,9 @@ var ConfigurationStore = class {
   previous(keys) {
     const current = this.read();
     const root = import_node_path5.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs4.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
+    if (!(0, import_node_fs5.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
     assertPrivateDirectory(root);
-    const candidates = (0, import_node_fs4.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
+    const candidates = (0, import_node_fs5.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
     for (const candidate of candidates) {
       const file = import_node_path5.default.join(root, candidate);
       const previous = parseConfigurationYaml(readPrivateFile(file), this.context);
@@ -64465,7 +64496,7 @@ var ConfigurationStore = class {
   }
   migrate(value, expected) {
     return this.locked(() => {
-      const current = (0, import_node_fs4.existsSync)(this.file) ? this.read() : null;
+      const current = (0, import_node_fs5.existsSync)(this.file) ? this.read() : null;
       if (current ? !expected || current.value.revision !== expected.revision || current.digest !== expected.digest : expected !== null) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
@@ -64679,14 +64710,14 @@ function configurationPath(key2, relativeDefault) {
 }
 
 // packages/config-node/src/research-mcp.ts
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var import_node_path7 = __toESM(require("node:path"), 1);
 function researchMcpHome() {
   return import_node_path7.default.join(resolveConfigurationContext().configRoot, "research-mcp");
 }
 function readResearchMcpInstallation() {
   const file = import_node_path7.default.join(researchMcpHome(), "installation.json");
-  if (!(0, import_node_fs5.existsSync)(file)) return null;
+  if (!(0, import_node_fs6.existsSync)(file)) return null;
   const value = JSON.parse(readPrivateFile(file));
   if (value.version !== 1 || value.instanceId !== resolveConfigurationContext().instanceId || typeof value.enabled !== "boolean" || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || ![value.entry, value.node, value.cwd].every((v) => typeof v === "string" && import_node_path7.default.isAbsolute(v)) || typeof value.sourceRevision !== "string" || typeof value.releaseId !== "string" || !Number.isFinite(value.installedAt) || value.tunnel !== null && (!value.tunnel || !/^[a-zA-Z0-9_-]+$/.test(value.tunnel.profile) || ![value.tunnel.executable, value.tunnel.profileDir, value.tunnel.healthFile].every((v) => typeof v === "string" && import_node_path7.default.isAbsolute(v)))) {
     throw new Error("Invalid research MCP installation identity");
@@ -64695,7 +64726,7 @@ function readResearchMcpInstallation() {
 }
 
 // packages/config-node/src/runtime-status.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 var import_node_os4 = __toESM(require("node:os"), 1);
 
@@ -64942,14 +64973,14 @@ function validateLocalRuntimeStatusReport(value, source2) {
 function readNativeHostRuntimeStatusReport() {
   const root = import_node_path8.default.join(import_node_os4.default.homedir(), "Library", "Application Support", "RemoteDesk");
   const file = import_node_path8.default.join(root, "runtime-status.json");
-  if (!(0, import_node_fs6.existsSync)(file)) return null;
+  if (!(0, import_node_fs7.existsSync)(file)) return null;
   assertPrivateDirectory(root);
-  return { report: validateLocalRuntimeStatusReport(JSON.parse(readPrivateFile(file, 64 * 1024)), "remote-desktop-host"), receivedAt: (0, import_node_fs6.statSync)(file).mtimeMs };
+  return { report: validateLocalRuntimeStatusReport(JSON.parse(readPrivateFile(file, 64 * 1024)), "remote-desktop-host"), receivedAt: (0, import_node_fs7.statSync)(file).mtimeMs };
 }
 function readNativeHostSharingEnabled() {
   const root = import_node_path8.default.join(import_node_os4.default.homedir(), "Library", "Application Support", "RemoteDesk");
   const file = import_node_path8.default.join(root, "local-host.json");
-  if (!(0, import_node_fs6.existsSync)(file)) return false;
+  if (!(0, import_node_fs7.existsSync)(file)) return false;
   assertPrivateDirectory(root);
   const value = JSON.parse(readPrivateFile(file, 16 * 1024));
   if (value.schemaVersion !== 1 || typeof value.running !== "boolean") throw new Error("Invalid native Host sharing intent");
@@ -64958,13 +64989,13 @@ function readNativeHostSharingEnabled() {
 function readLocalRuntimeStatusReport(source2) {
   const root = directory();
   const file = import_node_path8.default.join(root, `${source2}.json`);
-  if (!(0, import_node_fs6.existsSync)(file)) return null;
+  if (!(0, import_node_fs7.existsSync)(file)) return null;
   assertPrivateDirectory(root);
   const value = JSON.parse(readPrivateFile(file, 256 * 1024));
   if (value.instanceId !== configuration().context.instanceId) throw new Error("Local runtime status instance mismatch");
   const report2 = validateLocalRuntimeStatusReport(value.report, source2);
   if (value.stopped === true && report2.items.some((item) => item.state !== "disabled")) throw new Error("Invalid stopped owner report");
-  return { report: report2, receivedAt: (0, import_node_fs6.statSync)(file).mtimeMs, stopped: value.stopped === true };
+  return { report: report2, receivedAt: (0, import_node_fs7.statSync)(file).mtimeMs, stopped: value.stopped === true };
 }
 function readInstalledRuntimeBuild(entry) {
   if (!entry || !import_node_path8.default.isAbsolute(entry)) return null;
@@ -64976,23 +65007,23 @@ function readInstalledRuntimeBuild(entry) {
       const root = entry.slice(0, index);
       const relative = entry.slice(index + marker.length).split(import_node_path8.default.sep).slice(1);
       const pointer = import_node_path8.default.join(root, "current.json");
-      if ((0, import_node_fs6.existsSync)(pointer)) {
-        const selected = JSON.parse((0, import_node_fs6.readFileSync)(pointer, "utf8"));
+      if ((0, import_node_fs7.existsSync)(pointer)) {
+        const selected = JSON.parse((0, import_node_fs7.readFileSync)(pointer, "utf8"));
         if (!/^[a-zA-Z0-9._-]+$/.test(selected.releaseId) || [".", ".."].includes(selected.releaseId)) return null;
         entry = import_node_path8.default.join(root, "releases", selected.releaseId, ...relative);
       }
     }
-    fd = (0, import_node_fs6.openSync)(entry, "r");
+    fd = (0, import_node_fs7.openSync)(entry, "r");
     const buffer = Buffer.alloc(8192);
-    const length = (0, import_node_fs6.readSync)(fd, buffer, 0, buffer.length, 0);
+    const length = (0, import_node_fs7.readSync)(fd, buffer, 0, buffer.length, 0);
     const match = buffer.subarray(0, length).toString("utf8").split("\n", 1)[0]?.match(/var __RUNWEAVE_BUILD_INFO__=(\{.*\});/);
     const metadata = import_node_path8.default.join(import_node_path8.default.dirname(entry), "release.json");
-    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs6.readFileSync)((0, import_node_fs6.existsSync)(metadata) ? metadata : import_node_path8.default.join(import_node_path8.default.dirname(entry), "build-info.json"), "utf8"));
+    const value = match ? JSON.parse(match[1]) : JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_fs7.existsSync)(metadata) ? metadata : import_node_path8.default.join(import_node_path8.default.dirname(entry), "build-info.json"), "utf8"));
     return typeof value.version === "string" && typeof value.buildId === "string" ? value : null;
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) (0, import_node_fs6.closeSync)(fd);
+    if (fd !== void 0) (0, import_node_fs7.closeSync)(fd);
   }
 }
 
@@ -65093,10 +65124,7 @@ function createServerManagementRouter(runtime, registry2) {
         "server",
         "management-token"
       );
-      const stat20 = (0, import_node_fs7.lstatSync)(file);
-      if (!stat20.isFile() || stat20.mode & 63 || stat20.uid !== process.getuid?.())
-        throw new Error("Invalid management token file");
-      const expected = Buffer.from((0, import_node_fs7.readFileSync)(file, "utf8").trim());
+      const expected = Buffer.from(readPrivateFile(file, 4096).trim());
       const actual = Buffer.from(req.header("x-runweave-server-token") ?? "");
       if (!expected.length || actual.length !== expected.length || !(0, import_node_crypto5.timingSafeEqual)(expected, actual))
         throw new Error("Invalid token");
@@ -69895,7 +69923,7 @@ function isCodexConversationContext(value) {
 }
 
 // backend/src/voice/codex-app-server-client.ts
-var import_node_child_process = require("node:child_process");
+var import_node_child_process2 = require("node:child_process");
 var import_node_fs10 = require("node:fs");
 var import_node_os6 = __toESM(require("node:os"), 1);
 var import_node_path15 = __toESM(require("node:path"), 1);
@@ -70367,7 +70395,7 @@ var CodexAppServerClient = class {
     this.stdoutBuffer = "";
     this.stderrBuffer = "";
     const launchPlan = resolveCodexLaunchPlan(process.env, this.provider);
-    const child = (0, import_node_child_process.spawn)(launchPlan.command, launchPlan.args, {
+    const child = (0, import_node_child_process2.spawn)(launchPlan.command, launchPlan.args, {
       env: buildCodexProcessEnv(process.env, launchPlan),
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -71839,10 +71867,6 @@ function normalizeCommand(command) {
 }
 function resolveDefaultTerminalCommand() {
   if (process.platform === "win32") {
-    const configured2 = process.env.COMSPEC?.trim();
-    if (configured2) {
-      return configured2;
-    }
     return "powershell.exe";
   }
   const configured = process.env.SHELL?.trim();
@@ -72275,7 +72299,7 @@ function isDisabledColorFlag(value) {
 // backend/src/terminal/tmux/process.ts
 var import_node_fs16 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
-var import_node_child_process2 = require("node:child_process");
+var import_node_child_process3 = require("node:child_process");
 var import_node_crypto13 = require("node:crypto");
 var import_node_os8 = __toESM(require("node:os"), 1);
 var import_node_path24 = __toESM(require("node:path"), 1);
@@ -72557,7 +72581,7 @@ function shellQuote2(value) {
 }
 
 // backend/src/terminal/tmux/process.ts
-var execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process3.execFile);
 var TmuxProcess = class {
   execFileImpl;
   env;
@@ -75388,7 +75412,7 @@ var ResourceCounters = class {
 };
 
 // backend/src/resource-monitor/sampler.ts
-var import_node_child_process3 = require("node:child_process");
+var import_node_child_process4 = require("node:child_process");
 var import_node_crypto17 = require("node:crypto");
 var import_node_os10 = __toESM(require("node:os"), 1);
 var import_node_path25 = __toESM(require("node:path"), 1);
@@ -75449,7 +75473,7 @@ function signedBatteryCurrent(value) {
 // backend/src/resource-monitor/sampler.ts
 function runCommand(command, args, signal) {
   return new Promise((resolve, reject) => {
-    (0, import_node_child_process3.execFile)(
+    (0, import_node_child_process4.execFile)(
       command,
       args,
       {
@@ -78499,12 +78523,12 @@ async function readFinalReply(read, event, signal) {
 }
 
 // backend/src/task-supervision/deliverables.ts
-var import_node_child_process4 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 var import_node_fs18 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
 var import_node_path28 = __toESM(require("node:path"), 1);
 var import_node_util2 = require("node:util");
-var run = (0, import_node_util2.promisify)(import_node_child_process4.execFile);
+var run = (0, import_node_util2.promisify)(import_node_child_process5.execFile);
 var MAX_ITEMS = 5;
 var MAX_DOCUMENT_BYTES = 24e3;
 var MAX_TOTAL_BYTES = 48e3;
@@ -79673,7 +79697,7 @@ var import_promises16 = require("node:fs/promises");
 var import_node_path30 = __toESM(require("node:path"), 1);
 
 // backend/src/evolution/providers/process-runner.ts
-var import_node_child_process5 = require("node:child_process");
+var import_node_child_process6 = require("node:child_process");
 var import_node_path29 = __toESM(require("node:path"), 1);
 
 // backend/src/evolution/providers/output.ts
@@ -79759,7 +79783,7 @@ async function runProviderProcess(params) {
     params.request.workingDirectory,
     "last-message.json"
   );
-  const child = (0, import_node_child_process5.spawn)(
+  const child = (0, import_node_child_process6.spawn)(
     params.binary,
     [...params.args, "--output-last-message", outputFile, "-"],
     {
@@ -81773,12 +81797,12 @@ var feedbackSchema = external_exports.object({
 var cwdSchema = external_exports.string().trim().min(1).max(4e3);
 
 // backend/src/repository/identity.ts
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process7 = require("node:child_process");
 var import_node_crypto28 = require("node:crypto");
 var import_promises20 = require("node:fs/promises");
 var import_node_path36 = __toESM(require("node:path"), 1);
 var import_node_util3 = require("node:util");
-var exec = (0, import_node_util3.promisify)(import_node_child_process6.execFile);
+var exec = (0, import_node_util3.promisify)(import_node_child_process7.execFile);
 async function resolveRepositoryIdentity(cwd) {
   if (!import_node_path36.default.isAbsolute(cwd)) throw new Error("repository_cwd_must_be_absolute");
   const env = { ...process.env };
@@ -85415,7 +85439,7 @@ function createAuthRouter(authService, options) {
 var import_express21 = __toESM(require_express2(), 1);
 
 // backend/src/terminal/git/home-branch-status.ts
-var import_node_child_process7 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var import_promises23 = require("node:fs/promises");
 var import_node_util5 = require("node:util");
 
@@ -85428,7 +85452,7 @@ var BranchUpdatesTargetChangedError = class extends Error {
     super("Branch updates target changed");
   }
 };
-var exec2 = (0, import_node_util5.promisify)(import_node_child_process7.execFile);
+var exec2 = (0, import_node_util5.promisify)(import_node_child_process8.execFile);
 var TTL = 10 * 6e4;
 var RECHECK_TTL = 2e3;
 async function git(cwd, args) {
@@ -86287,7 +86311,7 @@ function createAgentModelCatalogRouter(service) {
 var import_express25 = __toESM(require_express2(), 1);
 
 // backend/src/race/race-service.ts
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 var import_node_crypto35 = require("node:crypto");
 
 // packages/shared/src/terminal/project-context.ts
@@ -87067,7 +87091,7 @@ function delay5(ms) {
 }
 
 // backend/src/race/race-worktree-supply.ts
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var import_promises26 = require("node:fs/promises");
 var import_node_path44 = __toESM(require("node:path"), 1);
 var MAX_GIT_OUTPUT_BYTES = 4 * 1024 * 1024;
@@ -87080,7 +87104,7 @@ var RaceWorktreeSupplyError = class extends Error {
 };
 function runGit(cwd, args, timeout = 3e4) {
   return new Promise((resolve, reject) => {
-    (0, import_node_child_process8.execFile)(
+    (0, import_node_child_process9.execFile)(
       "git",
       ["-C", cwd, ...args],
       {
@@ -87357,7 +87381,7 @@ function parseTraexModels(output) {
 }
 function listTraexModels() {
   return new Promise((resolve) => {
-    (0, import_node_child_process9.execFile)(
+    (0, import_node_child_process10.execFile)(
       "traex",
       ["models"],
       {
@@ -90519,7 +90543,7 @@ function registerBrowserAssistanceRoutes(router, manager, options) {
 }
 
 // backend/src/terminal/preview/change-content.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var import_node_crypto42 = require("node:crypto");
 var import_node_fs24 = require("node:fs");
 var import_promises27 = require("node:fs/promises");
@@ -90559,7 +90583,7 @@ function detectImageMimeType(buffer, filePath) {
 }
 
 // backend/src/terminal/preview/change-content.ts
-var exec3 = (0, import_node_util6.promisify)(import_node_child_process10.execFile);
+var exec3 = (0, import_node_util6.promisify)(import_node_child_process11.execFile);
 var TEXT_LIMIT = 1024 * 1024;
 async function git2(root, args, maxBuffer = 1024 * 1024) {
   return (await exec3("git", args, {
@@ -90698,11 +90722,11 @@ async function readChangeContent(options) {
 }
 
 // backend/src/terminal/preview/git.ts
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var import_promises28 = require("node:fs/promises");
 var import_node_path47 = __toESM(require("node:path"), 1);
 var import_node_util7 = require("node:util");
-var execFileAsync2 = (0, import_node_util7.promisify)(import_node_child_process11.execFile);
+var execFileAsync2 = (0, import_node_util7.promisify)(import_node_child_process12.execFile);
 var GitRepositoryMissingError = class extends TerminalPreviewError {
   constructor() {
     super("This project is not a Git repository.", 400);
@@ -90995,11 +91019,11 @@ var import_promises30 = require("node:fs/promises");
 var import_node_path49 = __toESM(require("node:path"), 1);
 
 // backend/src/terminal/preview/search-candidates.ts
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_promises29 = require("node:fs/promises");
 var import_node_path48 = __toESM(require("node:path"), 1);
 var import_node_util8 = require("node:util");
-var execFileAsync3 = (0, import_node_util8.promisify)(import_node_child_process12.execFile);
+var execFileAsync3 = (0, import_node_util8.promisify)(import_node_child_process13.execFile);
 var terminalPreviewLogger = logger.child({ component: "terminal-preview" });
 var RG_SEARCH_TIMEOUT_MS = 15e3;
 var RG_SEARCH_MAX_BUFFER_BYTES = 32 * 1024 * 1024;
@@ -91785,7 +91809,7 @@ async function searchPreviewFolders(params) {
 }
 
 // backend/src/terminal/preview/content-search.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 var import_promises31 = require("node:fs/promises");
 var import_node_path51 = __toESM(require("node:path"), 1);
 var DEFAULT_CONTENT_SEARCH_LIMIT = 50;
@@ -91941,7 +91965,7 @@ function findLiteralRanges(params) {
 function searchContentWithRipgrep(params) {
   throwIfSearchStopped(params.signal);
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process13.spawn)("rg", buildRgContentArgs(params.query), {
+    const child = (0, import_node_child_process14.spawn)("rg", buildRgContentArgs(params.query), {
       cwd: params.projectPath,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -93019,7 +93043,7 @@ function registerTerminalPreviewRoutes(router, terminalSessionManager) {
 }
 
 // backend/src/routes/terminal/projects/index.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var import_node_util9 = require("node:util");
 
 // backend/src/terminal/workspace-service/errors.ts
@@ -93172,7 +93196,7 @@ async function resolveMainBranchInput(raw) {
   const branch = raw?.trim() || null;
   if (branch === null) return null;
   try {
-    const { stdout } = await (0, import_node_util9.promisify)(import_node_child_process14.execFile)("git", ["check-ref-format", "--branch", branch], { timeout: 5e3 });
+    const { stdout } = await (0, import_node_util9.promisify)(import_node_child_process15.execFile)("git", ["check-ref-format", "--branch", branch], { timeout: 5e3 });
     if (stdout.trim() === branch) return branch;
   } catch {
   }
@@ -93350,17 +93374,17 @@ function registerTerminalProjectRoutes(router, terminalSessionManager, options)
 }
 
 // backend/src/terminal/workspace-service/worktree-deletion.ts
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 var import_promises35 = require("node:fs/promises");
 var import_node_path56 = __toESM(require("node:path"), 1);
 
 // backend/src/terminal/workspace-service/dev-session-cleanup.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_promises34 = require("node:fs/promises");
 var import_node_os13 = __toESM(require("node:os"), 1);
 var import_node_path55 = __toESM(require("node:path"), 1);
 var import_node_util10 = require("node:util");
-var execFileAsync4 = (0, import_node_util10.promisify)(import_node_child_process15.execFile);
+var execFileAsync4 = (0, import_node_util10.promisify)(import_node_child_process16.execFile);
 var CLEANUP_TIMEOUT_MS = 3e4;
 function isReleased(manifest) {
   return manifest.state === "stopped" || manifest.state === "failed" && manifest.failure?.leaseRetained === false;
@@ -93484,7 +93508,7 @@ var TerminalWorktreeDeletionError = class extends Error {
 };
 function runGit3(cwd, args) {
   return new Promise((resolve, reject) => {
-    (0, import_node_child_process16.execFile)(
+    (0, import_node_child_process17.execFile)(
       "git",
       ["-C", cwd, ...args],
       {
@@ -95400,6 +95424,7 @@ var TerminalTextAttachmentService = class {
       await handle2.close();
     }
     await (0, import_promises38.rename)(temporary, file);
+    if (process.platform === "win32") return;
     const directory3 = await (0, import_promises38.open)(import_node_path59.default.dirname(file), import_node_fs27.constants.O_RDONLY);
     try {
       await directory3.sync();
@@ -96741,12 +96766,12 @@ function registerTerminalInputRoutes(router, terminalSessionManager, options) {
 var import_node_crypto47 = require("node:crypto");
 
 // backend/src/agent-model-catalog/types.ts
-var import_node_child_process17 = require("node:child_process");
+var import_node_child_process18 = require("node:child_process");
 var CATALOG_COMMAND_TIMEOUT_MS = 15e3;
 var CATALOG_COMMAND_MAX_BUFFER = 8 * 1024 * 1024;
 function runCatalogCommand(command, args, env) {
   return new Promise((resolve, reject) => {
-    (0, import_node_child_process17.execFile)(
+    (0, import_node_child_process18.execFile)(
       command,
       args,
       {
@@ -98441,7 +98466,7 @@ function registerRuntimeStatusRoutes(app, requireAuth, status) {
 var import_express38 = __toESM(require_express2(), 1);
 
 // backend/src/dev-resources/control.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_fs28 = require("node:fs");
 var import_node_path64 = __toESM(require("node:path"), 1);
 var import_node_url2 = require("node:url");
@@ -98469,7 +98494,7 @@ async function runDevResourceControl(payload, onSpawn) {
       ELECTRON_RUN_AS_NODE: "1"
     };
     delete environment2.RUNWEAVE_DEV_SESSION_ID;
-    const child = (0, import_node_child_process18.spawn)(process.execPath, [entry], {
+    const child = (0, import_node_child_process19.spawn)(process.execPath, [entry], {
       stdio: ["pipe", "pipe", "ignore"],
       env: environment2
     });
@@ -110483,7 +110508,7 @@ function createHttpUpgradeRouter(server) {
 
 // backend/src/server/profile-lock.ts
 var import_node_crypto49 = require("node:crypto");
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process20 = require("node:child_process");
 var import_promises42 = require("node:fs/promises");
 var import_node_path66 = __toESM(require("node:path"), 1);
 var BackendProfileLockConflictError = class extends Error {
@@ -110529,7 +110554,7 @@ async function acquireBackendProfileLock(options) {
   const lockFile = getBrowserProfileLockFile(options.profileDir);
   const owner = createBackendProfileLockOwner(options);
   try {
-    owner.processSignature = (0, import_node_child_process19.execFileSync)(
+    owner.processSignature = (0, import_node_child_process20.execFileSync)(
       "/bin/ps",
       ["-p", String(process.pid), "-o", "lstart=", "-o", "command="],
       {
@@ -112986,7 +113011,7 @@ child.once('error',()=>cleanup(1));child.once('close',code=>cleanup(stopped?124:
 `;
 
 // backend/src/screen-recording-analysis/provider.ts
-var import_node_child_process20 = require("node:child_process");
+var import_node_child_process21 = require("node:child_process");
 var import_node_util11 = require("node:util");
 var import_promises45 = require("node:fs/promises");
 var import_node_path70 = __toESM(require("node:path"), 1);
@@ -113099,7 +113124,7 @@ var AnalysisProvider = class {
   usage;
   async probe() {
     if (this.probed) return;
-    const { stdout } = await (0, import_node_util11.promisify)(import_node_child_process20.execFile)(this.config.binary, ["exec", "--help"], { timeout: 5e3, maxBuffer: 128 * 1024 });
+    const { stdout } = await (0, import_node_util11.promisify)(import_node_child_process21.execFile)(this.config.binary, ["exec", "--help"], { timeout: 5e3, maxBuffer: 128 * 1024 });
     for (const flag of ["--image", "--output-schema", "--output-last-message", "--ephemeral", "--ignore-user-config"]) if (!stdout.includes(flag)) throw new Error("PROVIDER_UNSUPPORTED");
     this.probed = true;
   }
@@ -113145,7 +113170,7 @@ var AnalysisProvider = class {
       if (value !== void 0) environment2[key2] = value;
     }
     const deadline = Math.min(Date.now() + 12e4, ...manifest.captures.map((frame) => frame.availableUntilMs));
-    const child = (0, import_node_child_process20.spawn)(process.execPath, ["-e", analysisProviderRunner, this.config.binary, JSON.stringify(args), directory3, String(deadline)], { cwd: directory3, stdio: ["pipe", "pipe", "pipe", "ipc"], detached: process.platform !== "win32", env: environment2 });
+    const child = (0, import_node_child_process21.spawn)(process.execPath, ["-e", analysisProviderRunner, this.config.binary, JSON.stringify(args), directory3, String(deadline)], { cwd: directory3, stdio: ["pipe", "pipe", "pipe", "ipc"], detached: process.platform !== "win32", env: environment2 });
     let reason, bytes = 0, killTimer;
     const kill = (force) => {
       if (!child.pid || child.exitCode !== null) return;
@@ -113440,7 +113465,7 @@ var import_node_crypto58 = require("node:crypto");
 
 // backend/src/side-chat/provider.ts
 var import_node_crypto57 = require("node:crypto");
-var import_node_child_process21 = require("node:child_process");
+var import_node_child_process22 = require("node:child_process");
 var import_node_fs31 = require("node:fs");
 var import_node_path72 = __toESM(require("node:path"), 1);
 var import_node_url3 = require("node:url");
@@ -113508,7 +113533,7 @@ var SideChatProvider = class {
     for (const key2 of Object.keys(env)) {
       if (key2.startsWith("RUNWEAVE_") || key2 === "TMUX" || key2 === "TMUX_PANE" || key2.startsWith("CODEX_THREAD") || key2.startsWith("CODEX_INTERNAL")) delete env[key2];
     }
-    const child = (0, import_node_child_process21.spawn)(this.binary, [...args, "app-server", "--stdio"], { cwd, env, stdio: ["pipe", "pipe", "pipe"] });
+    const child = (0, import_node_child_process22.spawn)(this.binary, [...args, "app-server", "--stdio"], { cwd, env, stdio: ["pipe", "pipe", "pipe"] });
     this.child = child;
     this.exit = new Promise((resolve) => child.once("close", () => resolve()));
     child.stdout.setEncoding("utf8");
@@ -114315,7 +114340,8 @@ var ConnectionIdentityService = class _ConnectionIdentityService {
         }
       }
       const stat20 = await (0, import_promises47.lstat)(file);
-      if (!stat20.isFile() || (stat20.mode & 63) !== 0 || stat20.size > 4096) throw new Error("Invalid identity file");
+      if (!stat20.isFile() || process.platform !== "win32" && (stat20.mode & 63) !== 0 || stat20.size > 4096) throw new Error("Invalid identity file");
+      assertWindowsPrivatePath(file);
       const stored = JSON.parse(await (0, import_promises47.readFile)(file, "utf8"));
       if (stored.schemaVersion !== 1 || stored.privateKey?.crv !== "Ed25519" || !stored.privateKey.d) throw new Error("Invalid identity key");
       const key2 = (0, import_node_crypto59.createPrivateKey)({ key: stored.privateKey, format: "jwk" });
@@ -115007,10 +115033,10 @@ var import_node_fs34 = require("node:fs");
 var import_promises51 = __toESM(require("node:fs/promises"), 1);
 var import_node_os17 = __toESM(require("node:os"), 1);
 var import_node_path78 = __toESM(require("node:path"), 1);
-var import_node_child_process22 = require("node:child_process");
+var import_node_child_process23 = require("node:child_process");
 function signature(pid) {
   try {
-    return (0, import_node_child_process22.execFileSync)(
+    return (0, import_node_child_process23.execFileSync)(
       "ps",
       ["-p", String(pid), "-o", "lstart=", "-o", "command="],
       {
@@ -116320,17 +116346,17 @@ var DesktopBadgeAccess = class {
 var import_node_crypto70 = require("node:crypto");
 
 // backend/src/terminal/questions/executor.ts
-var import_node_child_process24 = require("node:child_process");
+var import_node_child_process25 = require("node:child_process");
 var import_node_util13 = require("node:util");
 var import_promises56 = require("node:fs/promises");
 
 // backend/src/terminal/attachments/codex-execution.ts
-var import_node_child_process23 = require("node:child_process");
+var import_node_child_process24 = require("node:child_process");
 var import_node_util12 = require("node:util");
 var import_node_path83 = __toESM(require("node:path"), 1);
 var import_node_url5 = require("node:url");
 var import_promises55 = require("node:fs/promises");
-var exec4 = (0, import_node_util12.promisify)(import_node_child_process23.execFile);
+var exec4 = (0, import_node_util12.promisify)(import_node_child_process24.execFile);
 var directory2 = import_node_path83.default.dirname((0, import_node_url5.fileURLToPath)(__IMPORT_META_URL__));
 var helper = import_node_path83.default.basename(directory2) === "attachments" ? import_node_path83.default.resolve(directory2, "../../../.native-artifacts/resource-sampler") : import_node_path83.default.join(directory2, "resource-sampler");
 async function readCodexProcessArguments(pid) {
@@ -116356,7 +116382,7 @@ async function readCodexProcessArguments(pid) {
 }
 
 // backend/src/terminal/questions/executor.ts
-var exec5 = (0, import_node_util13.promisify)(import_node_child_process24.execFile);
+var exec5 = (0, import_node_util13.promisify)(import_node_child_process25.execFile);
 function remoteSocket(args) {
   const values = /* @__PURE__ */ new Set(["-c", "--config", "-m", "--model", "-p", "--profile", "-C", "--cd", "--enable", "--disable", "--add-dir", "-i", "--image", "--local-provider", "--sandbox", "-s", "--ask-for-approval", "-a"]);
   let socket = null;
@@ -118759,9 +118785,9 @@ function matchesCron(cron, value) {
 }
 
 // backend/src/evolution/providers/availability.ts
-var import_node_child_process25 = require("node:child_process");
+var import_node_child_process26 = require("node:child_process");
 var import_node_util14 = require("node:util");
-var execFileAsync5 = (0, import_node_util14.promisify)(import_node_child_process25.execFile);
+var execFileAsync5 = (0, import_node_util14.promisify)(import_node_child_process26.execFile);
 var PROBE_TIMEOUT_MS = 5e3;
 var CACHE_TTL_MS = 3e4;
 var EvolutionProviderAvailabilityService = class {
@@ -119728,7 +119754,7 @@ async function auditRepositoryMigration(dataDir) {
 // backend/src/evolution/storage/repository-migration-files.ts
 var import_node_os20 = __toESM(require("node:os"), 1);
 var import_node_fs36 = require("node:fs");
-var import_node_child_process26 = require("node:child_process");
+var import_node_child_process27 = require("node:child_process");
 var import_node_fs37 = require("node:fs");
 var import_node_path90 = __toESM(require("node:path"), 1);
 function privateJson(file, value) {
@@ -119741,7 +119767,7 @@ function assertOffline(files) {
   for (const file of files) {
     let output = "";
     try {
-      output = (0, import_node_child_process26.execFileSync)(
+      output = (0, import_node_child_process27.execFileSync)(
         process.platform === "darwin" ? "/usr/sbin/lsof" : "lsof",
         ["-t", "--", file, `${file}-wal`, `${file}-shm`],
         { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
@@ -120674,11 +120700,11 @@ var BatteryAlerts = class {
 var import_node_crypto83 = require("node:crypto");
 
 // backend/src/device-monitor/sampler.ts
-var import_node_child_process27 = require("node:child_process");
+var import_node_child_process28 = require("node:child_process");
 var sampleBattery = async (signal) => {
   if (process.platform !== "darwin") return null;
   const output = await new Promise((resolve, reject) => {
-    (0, import_node_child_process27.execFile)(
+    (0, import_node_child_process28.execFile)(
       "/usr/bin/pmset",
       ["-g", "batt"],
       {
@@ -123400,6 +123426,11 @@ function buildPtyEnv(baseEnv, sessionEnv, command) {
   if (!isUnsetEnvValue2(baseEnv.GOOGLE_API_KEY) && merged.GOOGLE_API_KEY === baseEnv.GOOGLE_API_KEY) {
     delete merged.GOOGLE_API_KEY;
   }
+  if (process.platform === "win32" && import_node_path104.default.basename(command).toLowerCase() === "powershell.exe") {
+    for (const key2 of Object.keys(merged)) {
+      if (key2.toLowerCase() === "psmodulepath") delete merged[key2];
+    }
+  }
   normalizePathForAppImage(merged);
   return applyShellIntegration(command, merged);
 }
@@ -123491,7 +123522,10 @@ var PtyService = class {
           ptyProcess.resize(cols, rows);
         },
         signal(signal) {
-          ptyProcess.kill(toTerminalSignal(signal));
+          if (process.platform === "win32") {
+            if (signal === "SIGINT") ptyProcess.write("");
+            else ptyProcess.kill();
+          } else ptyProcess.kill(toTerminalSignal(signal));
         },
         dispose() {
           if (ptyProcess.destroy) {
@@ -125346,12 +125380,12 @@ function hashPrompt2(text3) {
 }
 
 // backend/src/terminal/workspace-service/worktree-project-registry.ts
-var import_node_child_process28 = require("node:child_process");
+var import_node_child_process29 = require("node:child_process");
 var import_promises65 = require("node:fs/promises");
 var import_node_path107 = __toESM(require("node:path"), 1);
 function runGitWorktreeList(projectPath) {
   return new Promise((resolve, reject) => {
-    (0, import_node_child_process28.execFile)(
+    (0, import_node_child_process29.execFile)(
       "git",
       ["-C", projectPath, "worktree", "list", "--porcelain", "-z"],
       { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 },
@@ -127280,7 +127314,7 @@ function isWorkspaceServiceHostnameCandidate(hostname2) {
 }
 
 // backend/src/terminal/workspace-service/owned-process.ts
-var import_node_child_process29 = require("node:child_process");
+var import_node_child_process30 = require("node:child_process");
 var OUTPUT_TAIL_BYTES = 8 * 1024;
 var SUPERVISOR_START_TIMEOUT_MS = 5e3;
 var SUPERVISOR_SOURCE = String.raw`
@@ -127374,7 +127408,7 @@ function signalSupervisor(child) {
   if (child.connected) child.send({ type: "stop" });
 }
 async function startOwnedWorkspaceServiceProcess(input2) {
-  const supervisor = (0, import_node_child_process29.spawn)(process.execPath, ["-e", SUPERVISOR_SOURCE], {
+  const supervisor = (0, import_node_child_process30.spawn)(process.execPath, ["-e", SUPERVISOR_SOURCE], {
     env: { ...process.env, ELECTRON_RUN_AS_NODE: "1" },
     stdio: ["ignore", "pipe", "pipe", "ipc"]
   });
@@ -131930,9 +131964,9 @@ var package_default2 = {
 };
 
 // backend/src/runtime-status/cli-version.ts
-var import_node_child_process30 = require("node:child_process");
+var import_node_child_process31 = require("node:child_process");
 var import_node_util16 = require("node:util");
-var execute = (0, import_node_util16.promisify)(import_node_child_process30.execFile);
+var execute = (0, import_node_util16.promisify)(import_node_child_process31.execFile);
 var cached2 = null;
 var pending = null;
 async function readNodeCliVersion() {
@@ -132405,11 +132439,11 @@ var BackendRuntimeStatusService = class {
 };
 
 // backend/src/scheduled-tasks/providers/capabilities.ts
-var import_node_child_process33 = require("node:child_process");
+var import_node_child_process34 = require("node:child_process");
 var import_node_util18 = require("node:util");
 
 // backend/src/scheduled-tasks/providers/codex-resume.ts
-var import_node_child_process31 = require("node:child_process");
+var import_node_child_process32 = require("node:child_process");
 var import_promises75 = require("node:fs/promises");
 var import_node_util17 = require("node:util");
 
@@ -132440,7 +132474,7 @@ function codexScheduledArgs(config2) {
 }
 
 // backend/src/scheduled-tasks/providers/codex-resume.ts
-var exec6 = (0, import_node_util17.promisify)(import_node_child_process31.execFile);
+var exec6 = (0, import_node_util17.promisify)(import_node_child_process32.execFile);
 async function checkpointCodexResume(threadId, cwd) {
   try {
     const result = await codexAppServerClient.sendRequest("thread/read", {
@@ -132567,7 +132601,7 @@ async function ownsResumeHistory(pid, checkpoint, cwd) {
 }
 
 // backend/src/scheduled-tasks/providers/codex.ts
-var import_node_child_process32 = require("node:child_process");
+var import_node_child_process33 = require("node:child_process");
 var import_promises76 = require("node:fs/promises");
 var import_node_os21 = __toESM(require("node:os"), 1);
 var import_node_path116 = __toESM(require("node:path"), 1);
@@ -132725,7 +132759,7 @@ var CodexScheduledTaskProvider = class {
       ...request2.resumeThreadId ? ["resume", request2.resumeThreadId] : [],
       "-"
     ];
-    const child = (0, import_node_child_process32.spawn)(this.binary, args, {
+    const child = (0, import_node_child_process33.spawn)(this.binary, args, {
       cwd: request2.workingDirectory,
       env: codexScheduledEnvironment(
         process.env,
@@ -132955,7 +132989,7 @@ function waitForExit2(child) {
 }
 
 // backend/src/scheduled-tasks/providers/capabilities.ts
-var execFileAsync6 = (0, import_node_util18.promisify)(import_node_child_process33.execFile);
+var execFileAsync6 = (0, import_node_util18.promisify)(import_node_child_process34.execFile);
 function detectCodexScheduledFeatures(help) {
   return {
     autoReview: help.includes("--approve-for-me"),