@stevecastaneda/paseo-progress 1.14.2 → 1.14.4

package/index.client.tsx

@@ -4,7 +4,6 @@ import { ProgressPanel } from "./client/panel";
 import { contributePills, progressPanel } from "./client/pills";
 import { QuestionSettings } from "./client/settings";
 import { ProgressLanguageProvider } from "./client/language";
-import { addPageScreen } from "./client/page-screen";
 import { PdfPanel } from "./client/pdf";
 import { showsPdfs } from "./shared/attachments";
 import { CHAT_ROW_KIND, CHAT_ROW_VERSION, chatRowSchema, transformChatRow } from "./client/chat-row";
@@ -20,7 +19,11 @@ export default function contribute(client: PluginClientContext) {
     title: "Progress",
     icon: "ListChecks",
     locations: [panel.location],
-    Component: (props) => <ProgressLanguageProvider><ProgressPanel {...props} openSettings={() => client.openSettings(SETTINGS_ID)} /></ProgressLanguageProvider>,
+    Component: (props) => (
+      <ProgressLanguageProvider>
+        <ProgressPanel {...props} openSettings={() => client.openSettings(SETTINGS_ID)} />
+      </ProgressLanguageProvider>
+    ),
   });
   const stopCommand = client.addCommandCenterItem({
     id: "open-progress",
@@ -33,32 +36,44 @@ export default function contribute(client: PluginClientContext) {
     },
   });
 
-  const stopPdf = showsPdfs(Platform.OS) ? client.addFilePanel({
-    id: "pdf",
-    title: "PDF",
-    icon: "BookOpenText",
-    files: { extensions: ["pdf"] },
-    Component: (props) => <ProgressLanguageProvider><PdfPanel {...props} /></ProgressLanguageProvider>,
-  }) : () => {};
-  const stopPage = addPageScreen(client);
+  const stopPdf = showsPdfs(Platform.OS)
+    ? client.addFilePanel({
+        id: "pdf",
+        title: "PDF",
+        icon: "BookOpenText",
+        files: { extensions: ["pdf"] },
+        Component: (props) => (
+          <ProgressLanguageProvider>
+            <PdfPanel {...props} />
+          </ProgressLanguageProvider>
+        ),
+      })
+    : () => {};
   const stopSettings = client.addSettingsScreen({
     id: SETTINGS_ID,
     title: "Settings",
     icon: "Settings",
-    Component: (props) => <ProgressLanguageProvider><QuestionSettings {...props} /></ProgressLanguageProvider>,
+    Component: (props) => (
+      <ProgressLanguageProvider>
+        <QuestionSettings {...props} />
+      </ProgressLanguageProvider>
+    ),
   });
   const stopTransformer = client.addTimelineTransformer({ id: "tool-calls", query: { itemType: "tool_call" }, transform: transformChatRow });
   const stopRenderer = client.addTimelineRenderer({
     kind: CHAT_ROW_KIND,
     version: CHAT_ROW_VERSION,
     schema: chatRowSchema,
-    Component: (props) => <ProgressLanguageProvider><ChatRowView {...props} /></ProgressLanguageProvider>,
+    Component: (props) => (
+      <ProgressLanguageProvider>
+        <ChatRowView {...props} />
+      </ProgressLanguageProvider>
+    ),
   });
 
   return () => {
     void stopTransformer();
     void stopRenderer();
-    stopPage();
     void stopPdf();
     void stopSettings();
     void stopPanel();

package/index.server.ts

@@ -6,7 +6,25 @@ import { mirrorQuestionMode } from "./server/question-mode";
 import { handleInstallSkill, handleReadSkill, handleSkillStatus, repairSkill } from "./server/skill";
 import { attachProgressTools, handleToolsStatus } from "./server/tool";
 import { handleDismissWhatsNew, handleGetWhatsNew } from "./server/whats-new";
-import { canOpenOnHost, dismissWhatsNew, getAttention, getDashboard, getLauncherStatus, getSkillStatus, getToolsStatus, getWhatsNew, installLauncher, installSkill, listFolders, readSkill, markPanelOpened, openDeliverable, previewDeliverable, readDeliverablePiece, setHistoryFolder } from "./shared/rpc";
+import {
+  canOpenOnHost,
+  dismissWhatsNew,
+  getAttention,
+  getDashboard,
+  getLauncherStatus,
+  getSkillStatus,
+  getToolsStatus,
+  getWhatsNew,
+  installLauncher,
+  installSkill,
+  listFolders,
+  readSkill,
+  markPanelOpened,
+  openDeliverable,
+  previewDeliverable,
+  readDeliverablePiece,
+  setHistoryFolder,
+} from "./shared/rpc";
 import { displaySettings, questionSettings } from "./shared/settings";
 
 export default function contribute(server: PluginServerContext) {

package/package.json

@@ -1,7 +1,15 @@
 {
   "name": "@stevecastaneda/paseo-progress",
-  "version": "1.14.2",
+  "version": "1.14.4",
   "description": "A live progress dashboard per worktree for Paseo, drawn from a file agents write with the Progress tools or the paseo-progress command.",
+  "keywords": [
+    "coding-agents",
+    "dashboard",
+    "paseo",
+    "paseo-plugin",
+    "progress"
+  ],
+  "homepage": "https://github.com/stevecastaneda/paseo-plugins/tree/main/progress#readme",
   "license": "MIT",
   "author": "Steve Castaneda",
   "repository": {
@@ -9,18 +17,6 @@
     "url": "git+https://github.com/stevecastaneda/paseo-plugins.git",
     "directory": "progress"
   },
-  "homepage": "https://github.com/stevecastaneda/paseo-plugins/tree/main/progress#readme",
-  "keywords": [
-    "paseo",
-    "paseo-plugin",
-    "progress",
-    "dashboard",
-    "coding-agents"
-  ],
-  "type": "module",
-  "engines": {
-    "node": "^22.18.0 || >=23.6.0"
-  },
   "files": [
     "paseo-plugin.json",
     "OVERVIEW.md",
@@ -36,6 +32,7 @@
     "tsconfig.json",
     "!**/*.test.ts"
   ],
+  "type": "module",
   "publishConfig": {
     "access": "public"
   },
@@ -47,7 +44,8 @@
     "check:windows": "node scripts/windows-check.mjs",
     "build:cli": "rm -rf dist && esbuild server/cli.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/server/cli.js --log-level=warning",
     "prepack": "npm run build:cli",
-    "postpack": "rm -rf dist"
+    "postpack": "rm -rf dist",
+    "security-review": "node ../scripts/security-review.mjs"
   },
   "devDependencies": {
     "@getpaseo/client": "0.14.0",
@@ -60,5 +58,8 @@
     "react-native": "0.81.5",
     "typescript": "^5.9.3",
     "zod": "^4.4.3"
+  },
+  "engines": {
+    "node": "^22.18.0 || >=23.6.0"
   }
 }

package/server/cli.ts

@@ -36,7 +36,14 @@ interface Command {
   usage: string;
   summary: string;
   options?: Record<string, { type: "string" | "boolean"; multiple?: boolean }>;
-  run(args: { positionals: string[]; values: Record<string, string | boolean | Array<string | boolean> | undefined>; state: State; cwd: string; root: string; mode: QuestionMode }): { event: EventDraft; message: string };
+  run(args: {
+    positionals: string[];
+    values: Record<string, string | boolean | Array<string | boolean> | undefined>;
+    state: State;
+    cwd: string;
+    root: string;
+    mode: QuestionMode;
+  }): { event: EventDraft; message: string };
 }
 
 const USAGE_NAME = "paseo-progress";
@@ -91,7 +98,7 @@ const URL_PATTERN = /^[a-z][a-z\d+.-]*:\/\//i;
 function parseFile(raw: string, cwd: string, root: string) {
   const isUrl = URL_PATTERN.test(raw);
   let index = isUrl ? raw.lastIndexOf("=") : raw.indexOf("=");
-  while (isUrl && index !== -1 && /[?&][^=&#]*$/.test(raw.slice(0, index))) index = raw.lastIndexOf("=", index - 1);
+  if (isUrl) while (index !== -1 && /[?&][^=&#]*$/.test(raw.slice(0, index))) index = raw.lastIndexOf("=", index - 1);
   const target = (index === -1 ? raw : raw.slice(0, index)).trim();
   const label = index === -1 ? undefined : raw.slice(index + 1).trim() || undefined;
   if (!target) throw new UsageError(`--file needs a path or URL, got "${raw}".`);
@@ -177,6 +184,10 @@ function addedByOthersText(tickets: Ticket[], dashboard: Dashboard): string {
   ].join("\n");
 }
 
+function shown(value: unknown) {
+  return typeof value === "object" ? ((value as FileLink).path ?? (value as FileLink).url) : value;
+}
+
 const commands: Record<string, Command> = {
   start: {
     usage: `start "<title>" [--subtitle <text>] [--item-label <word>]`,
@@ -192,7 +203,8 @@ const commands: Record<string, Command> = {
   },
   finish: {
     usage: `finish "<outcome>"`,
-    summary: "Close the run with a one-line outcome. Every ticket must be done or skipped, no question open, nothing flagged stuck. New work after this needs start.",
+    summary:
+      "Close the run with a one-line outcome. Every ticket must be done or skipped, no question open, nothing flagged stuck. New work after this needs start.",
     run({ positionals, state }) {
       const outcome = required(positionals[0], "outcome");
       if (!state.dashboard.run) throw new UsageError("No run to finish.");
@@ -203,7 +215,8 @@ const commands: Record<string, Command> = {
   },
   "ticket add": {
     usage: `ticket add "<title>" --estimate <minutes> [--status <status>] [--waits-for <id>] [--source <path or http(s) URL>[=<label>]]`,
-    summary: "Add a ticket. Prints its id (T01, T02, ...). --waits-for names a ticket it can't start before; that is the order of work, not a blocker. --source is where the ticket is written up, like its spec file or issue link.",
+    summary:
+      "Add a ticket. Prints its id (T01, T02, ...). --waits-for names a ticket it can't start before; that is the order of work, not a blocker. --source is where the ticket is written up, like its spec file or issue link.",
     options: { estimate: { type: "string" }, status: { type: "string" }, "waits-for": { type: "string" }, source: { type: "string" } },
     run({ positionals, values, state, cwd, root }) {
       const waitsFor = values["waits-for"] === undefined ? undefined : existingTicket(state, stringOption(values["waits-for"])).id;
@@ -221,7 +234,15 @@ const commands: Record<string, Command> = {
   "ticket update": {
     usage: `ticket update <id> [--status <status>] [--stage <name>] [--title <text>] [--estimate <minutes>] [--note <text>] [--waits-for <id>] [--source <path or http(s) URL>[=<label>]]`,
     summary: `Change a ticket. Statuses: ${TICKET_STATUSES.join(", ")}. --stage names the step in progress, like Build or Fixes ("" clears it). --waits-for names a ticket it can't start before ("" clears it); waiting is not stuck, so don't mark it blocked for that. --source is where the ticket is written up ("" clears it).`,
-    options: { status: { type: "string" }, stage: { type: "string" }, title: { type: "string" }, estimate: { type: "string" }, note: { type: "string" }, "waits-for": { type: "string" }, source: { type: "string" } },
+    options: {
+      status: { type: "string" },
+      stage: { type: "string" },
+      title: { type: "string" },
+      estimate: { type: "string" },
+      note: { type: "string" },
+      "waits-for": { type: "string" },
+      source: { type: "string" },
+    },
     run({ positionals, values, state, cwd, root }) {
       const ticket = existingTicket(state, positionals[0]);
       const rawWaitsFor = values["waits-for"] === undefined ? undefined : String(values["waits-for"]).trim();
@@ -229,7 +250,8 @@ const commands: Record<string, Command> = {
       if (waitsFor && waitsFor === ticket.id) throw new UsageError(`${ticket.id} can't wait for itself.`);
       // Refuse a loop (T01 waits for T02 waits for T01): neither could ever start.
       for (let next = waitsFor ? state.dashboard.tickets.find((entry) => entry.id === waitsFor) : undefined, seen = 0; next?.waitsFor && seen < 1000; seen++) {
-        if (next.waitsFor === ticket.id) throw new UsageError(`${ticket.id} can't wait for ${waitsFor}: ${next.id} already waits for ${ticket.id}, so neither could start.`);
+        if (next.waitsFor === ticket.id)
+          throw new UsageError(`${ticket.id} can't wait for ${waitsFor}: ${next.id} already waits for ${ticket.id}, so neither could start.`);
         next = state.dashboard.tickets.find((entry) => entry.id === next!.waitsFor);
       }
       const event = {
@@ -241,11 +263,10 @@ const commands: Record<string, Command> = {
         stage: stringOption(values.stage),
         note: stringOption(values.note),
         waitsFor,
-        source: values.source === undefined ? undefined : String(values.source).trim() === "" ? "" as const : parseFile(String(values.source), cwd, root),
+        source: values.source === undefined ? undefined : String(values.source).trim() === "" ? ("" as const) : parseFile(String(values.source), cwd, root),
       };
       const changes = Object.entries(event).filter(([key, value]) => key !== "type" && key !== "id" && value !== undefined);
       if (!changes.length) throw new UsageError("Nothing to change. Pass --status, --stage, --title, --estimate, --note, --waits-for, or --source.");
-      const shown = (value: unknown) => (typeof value === "object" ? (value as FileLink).path ?? (value as FileLink).url : value);
       return { event, message: `Updated ${ticket.id}: ${changes.map(([key, value]) => `${key} ${shown(value)}`).join(", ")}` };
     },
   },
@@ -259,7 +280,8 @@ const commands: Record<string, Command> = {
   },
   "question ask": {
     usage: `question ask "<short title>" "<question>" [--option "A=<label> | <consequence>" ...] --recommend <letter or word> [--big "<why, in a few plain words>"] [--background <text>] [--file <path or http(s) URL>[=<label>] ...] [--raised-by <text>] [--ticket <id>]`,
-    summary: "Ask the user a question. Prints its reference (Q1, Q2, ...) and what to do until the answer, which depends on the question mode the user picks in Paseo's Settings: Stop (stop all work until an answer), Work around (build nothing the question affects, work on the rest), or Keep building (build your recommendation now, change course if the user picks another). --recommend is the option you would pick. Add --big with the reason when the question is big; it only changes what you do in Keep building, where a big question holds like Work around. A question is big when one of these holds, and only then: (1) building your recommendation before the answer would mean something leaves this computer: pushing, publishing, deploying, changing live data, sending messages, spending money; (2) the answer sets something people or programs outside this repo will rely on: a saved data format, a database schema, a public API, command or setting name, or removing or renaming something people already use; (3) most of the tickets or steps still ahead would be built on the answer. Every other question is small, large code changes included. When you can't name the test it meets, it's small. Name the test in the --big reason.",
+    summary:
+      "Ask the user a question. Prints its reference (Q1, Q2, ...) and what to do until the answer, which depends on the question mode the user picks in Paseo's Settings: Stop (stop all work until an answer), Work around (build nothing the question affects, work on the rest), or Keep building (build your recommendation now, change course if the user picks another). --recommend is the option you would pick. Add --big with the reason when the question is big; it only changes what you do in Keep building, where a big question holds like Work around. A question is big when one of these holds, and only then: (1) building your recommendation before the answer would mean something leaves this computer: pushing, publishing, deploying, changing live data, sending messages, spending money; (2) the answer sets something people or programs outside this repo will rely on: a saved data format, a database schema, a public API, command or setting name, or removing or renaming something people already use; (3) most of the tickets or steps still ahead would be built on the answer. Every other question is small, large code changes included. When you can't name the test it meets, it's small. Name the test in the --big reason.",
     options: {
       option: { type: "string", multiple: true },
       recommend: { type: "string" },
@@ -315,11 +337,19 @@ const commands: Record<string, Command> = {
       }
       const asRecommended = choice.toLowerCase() === question.recommended.toLowerCase();
       const built = question.state === "building";
-      const next = !built ? "Build it now."
-        : asRecommended ? "Carry on with it."
-        : `Undo the work built on your recommendation and build ${choice} before anything else.`;
+      const next = !built
+        ? "Build it now."
+        : asRecommended
+          ? "Carry on with it."
+          : `Undo the work built on your recommendation and build ${choice} before anything else.`;
       return {
-        event: { type: "question.answer", id: question.id, choice, words: stringOption(values.words), changedCourse: built && !asRecommended ? true : undefined },
+        event: {
+          type: "question.answer",
+          id: question.id,
+          choice,
+          words: stringOption(values.words),
+          changedCourse: built && !asRecommended ? true : undefined,
+        },
         message: `Answered ${question.id}: ${choice}${asRecommended ? " (as you recommended)" : ` (not your recommendation, ${question.recommended})`}. ${next}`,
       };
     },
@@ -346,12 +376,14 @@ const commands: Record<string, Command> = {
         files: files.length ? files : undefined,
         recommend,
       };
-      if (!event.question && !event.background && !event.files && !recommend) throw new UsageError("Nothing to change. Pass --recommend, --background, --question, or --file.");
+      if (!event.question && !event.background && !event.files && !recommend)
+        throw new UsageError("Nothing to change. Pass --recommend, --background, --question, or --file.");
       if (!recommend) return { event, message: `Updated ${question.id} (${question.title})` };
       const rules = QUESTION_MODE_RULES[mode];
-      const next = question.state === "building"
-        ? `Undo the work built on ${question.recommended} and build ${recommend} instead.`
-        : `Mode: ${rules.label}. ${rules.askRule({ recommend, big: Boolean(question.big) })}`;
+      const next =
+        question.state === "building"
+          ? `Undo the work built on ${question.recommended} and build ${recommend} instead.`
+          : `Mode: ${rules.label}. ${rules.askRule({ recommend, big: Boolean(question.big) })}`;
       return { event, message: `${question.id} now recommends ${recommend} (was ${question.recommended}). ${next}` };
     },
   },
@@ -365,7 +397,7 @@ const commands: Record<string, Command> = {
   },
   "deliverable add": {
     usage: `deliverable add "<title>" <path or http(s) URL> [--ticket <id>] [--kind ${DELIVERABLE_KINDS.join("|")}]`,
-    summary: "Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...).",
+    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable opens in Paseo's sandboxed preview, which blocks everything from the web, so put its CSS in the page and embed images as data URIs. In the preview, storage APIs and navigator.clipboard throw an error. The alert, confirm, prompt and window.open calls and form submits do nothing. One syntax error stops a whole script.`,
     options: { ticket: { type: "string" }, kind: { type: "string" } },
     run({ positionals, values, state, cwd, root }) {
       const title = required(positionals[0], "deliverable title");
@@ -478,20 +510,21 @@ const commands: Record<string, Command> = {
 function rootRelative(target: string, cwd: string, root: string): string {
   const absolute = resolve(cwd, target);
   const inside = relative(root, absolute);
-  const suffix = /[\/]$/.test(target) || statSync(absolute, { throwIfNoEntry: false })?.isDirectory() ? "/" : "";
+  const suffix = target.endsWith("/") || statSync(absolute, { throwIfNoEntry: false })?.isDirectory() ? "/" : "";
   if (!inside) return "./";
   return outside(inside) ? absolute + suffix : inside + suffix;
 }
 
 function guessKind(target: string, isUrl: boolean, cwd: string): (typeof DELIVERABLE_KINDS)[number] {
   if (isUrl) return "link";
-  if (/[\/]$/.test(target) || statSync(resolve(cwd, target), { throwIfNoEntry: false })?.isDirectory()) return "folder";
+  if (target.endsWith("/") || statSync(resolve(cwd, target), { throwIfNoEntry: false })?.isDirectory()) return "folder";
   if (imageMimeType(target)) return "screenshot";
   return "file";
 }
 
 const SHOW_SUMMARY = "Print the dashboard as text: what the user sees in the Progress panel.";
-const INSTALL_SUMMARY = "Write the paseo-progress launcher (default ~/.local/bin/paseo-progress). It runs this command from whichever copy of the plugin Paseo is running.";
+const INSTALL_SUMMARY =
+  "Write the paseo-progress launcher (default ~/.local/bin/paseo-progress). It runs this command from whichever copy of the plugin Paseo is running.";
 const DEFAULT_LAUNCHER = "~/.local/bin/paseo-progress";
 
 // The agent tools describe themselves with the summaries agents see in --help.
@@ -539,7 +572,7 @@ export async function runCli(argv: string[], options: CliOptions): Promise<numbe
       return 0;
     }
     const target = resolve(options.cwd, (argv[1] ?? DEFAULT_LAUNCHER).replace(/^~(?=$|\/)/, homedir()));
-    out(await installLauncher(target) ? `Installed the launcher at ${target}` : `The launcher at ${target} is already current`);
+    out((await installLauncher(target)) ? `Installed the launcher at ${target}` : `The launcher at ${target} is already current`);
     return 0;
   }
   const twoWord = commands[`${first} ${second}`];
@@ -563,15 +596,20 @@ export async function runCli(argv: string[], options: CliOptions): Promise<numbe
     const root = findRoot(options.cwd);
     const store = await findStore(root);
     const mode = await readQuestionMode();
-    const message = await appendProgress(store.directory, now, (state) => {
-      const finished = state.dashboard.run?.finished;
-      if (finished && command !== commands.start) {
-        throw new UsageError(`The run "${state.dashboard.run!.title}" is finished. Start new work with: ${USAGE_NAME} start "<title>"`);
-      }
-      const { event, message } = command.run({ positionals: parsed.positionals, values: parsed.values, state, cwd: options.cwd, root, mode });
-      const added = command === commands.start ? "" : addedByOthersText(addedByOthers(state.events, state.dashboard, options.agentId), state.dashboard);
-      return { event: { ...event, by: options.agentId }, result: `${message}${added}` };
-    }, (text) => saveRunCopy(root, text));
+    const message = await appendProgress(
+      store.directory,
+      now,
+      (state) => {
+        const finished = state.dashboard.run?.finished;
+        if (finished && command !== commands.start) {
+          throw new UsageError(`The run "${state.dashboard.run!.title}" is finished. Start new work with: ${USAGE_NAME} start "<title>"`);
+        }
+        const { event, message: summary } = command.run({ positionals: parsed.positionals, values: parsed.values, state, cwd: options.cwd, root, mode });
+        const added = command === commands.start ? "" : addedByOthersText(addedByOthers(state.events, state.dashboard, options.agentId), state.dashboard);
+        return { event: { ...event, by: options.agentId }, result: `${summary}${added}` };
+      },
+      (text) => saveRunCopy(root, text),
+    );
     out(message);
     return 0;
   } catch (error) {
@@ -594,7 +632,9 @@ function isMain(): boolean {
 
 if (isMain()) {
   runCli(process.argv.slice(2), { cwd: process.cwd(), agentId: process.env.PASEO_AGENT_ID || undefined }).then(
-    (code) => { process.exitCode = code; },
+    (code) => {
+      process.exitCode = code;
+    },
     (error) => {
       console.error(error instanceof Error ? error.message : error);
       process.exitCode = 1;

package/server/dashboard.ts

@@ -10,10 +10,7 @@ import { findStore, historyFolder, inGitRepo, listFolders, setHistoryFolder } fr
 
 const versions = new WeakMap<Dashboard, { key: string; version: string }>();
 
-export async function handleMarkPanelOpened(
-  input: { workspaceId: string; workspaceDirectory: string },
-  _context: PluginHandlerContext,
-) {
+export async function handleMarkPanelOpened(input: { workspaceId: string; workspaceDirectory: string }, _context: PluginHandlerContext) {
   await markPanelOpened((await findStore(findRoot(input.workspaceDirectory))).directory);
   return {};
 }
@@ -33,7 +30,12 @@ export async function handleGetDashboard(
   const key = JSON.stringify([result.panelOpened, file, savedTo, inRepo]);
   let cached = versions.get(result.dashboard);
   if (!cached || cached.key !== key) {
-    cached = { key, version: createHash("sha1").update(JSON.stringify(result) + key).digest("base64url") };
+    cached = {
+      key,
+      version: createHash("sha1")
+        .update(JSON.stringify(result) + key)
+        .digest("base64url"),
+    };
     versions.set(result.dashboard, cached);
   }
   const { version } = cached;
@@ -41,10 +43,7 @@ export async function handleGetDashboard(
 }
 
 // Just what a message-box pill needs, so polling every workspace stays small.
-export async function handleGetAttention(
-  input: { workspaceId: string; workspaceDirectory: string },
-  _context: PluginHandlerContext,
-): Promise<AttentionResult> {
+export async function handleGetAttention(input: { workspaceId: string; workspaceDirectory: string }, _context: PluginHandlerContext): Promise<AttentionResult> {
   const { configured, dashboard, panelOpened } = await readProgress((await findStore(findRoot(input.workspaceDirectory))).directory);
   return {
     configured,
@@ -55,10 +54,7 @@ export async function handleGetAttention(
   };
 }
 
-export async function handleListFolders(
-  input: { workspaceId: string; workspaceDirectory: string; folder: string },
-  _context: PluginHandlerContext,
-) {
+export async function handleListFolders(input: { workspaceId: string; workspaceDirectory: string; folder: string }, _context: PluginHandlerContext) {
   return listFolders(findRoot(input.workspaceDirectory), input.folder);
 }
 

package/server/launcher.ts

@@ -1,6 +1,7 @@
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join, posix, win32 } from "node:path";
+import { writeFileIn } from "./system.ts";
 
 export const PLUGIN_ID = "progress";
 
@@ -8,9 +9,10 @@ export const PLUGIN_ID = "progress";
 // Paseo names for the agents and plugins it starts, PATH, then the app's
 // default install. The launcher script below carries the same list.
 export function paseoCommands(env: NodeJS.ProcessEnv = process.env, platform: NodeJS.Platform = process.platform): string[] {
-  const installed = platform === "win32"
-    ? env.LOCALAPPDATA && win32.join(env.LOCALAPPDATA, "Programs", "Paseo", "resources", "bin", "paseo.cmd")
-    : "/Applications/Paseo.app/Contents/Resources/bin/paseo";
+  const installed =
+    platform === "win32"
+      ? env.LOCALAPPDATA && win32.join(env.LOCALAPPDATA, "Programs", "Paseo", "resources", "bin", "paseo.cmd")
+      : "/Applications/Paseo.app/Contents/Resources/bin/paseo";
   return [env.PASEO_BIN, env.PASEO_CLI, "paseo", installed].filter((cli): cli is string => Boolean(cli));
 }
 
@@ -28,7 +30,7 @@ if (major < 22 || (major === 22 && minor < 18)) {
 // Not require: a package.json with "type": "module" above this folder makes Node load it as ESM.
 const { spawnSync } = process.getBuiltinModule("node:child_process");
 const { existsSync } = process.getBuiltinModule("node:fs");
-const { join } = process.getBuiltinModule("node:path");
+const { dirname, join } = process.getBuiltinModule("node:path");
 
 const windows = process.platform === "win32";
 
@@ -41,11 +43,14 @@ function paseoCommands() {
 }
 
 // On Windows Paseo's command is paseo.cmd, which Node can start, or find on
-// PATH, only through cmd.exe.
+// PATH, only through cmd.exe. cmd.exe looks in the folder it starts in before
+// PATH, so it starts in Node's folder, not the agent's, where a repo could
+// have put its own paseo.cmd.
 function askPaseo(cli) {
+  const options = { cwd: dirname(process.execPath), encoding: "utf8" };
   return windows
-    ? spawnSync('"' + cli + '" plugin ls ${PLUGIN_ID} --json', { shell: true, encoding: "utf8" })
-    : spawnSync(cli, ["plugin", "ls", "${PLUGIN_ID}", "--json"], { encoding: "utf8" });
+    ? spawnSync('"' + cli + '" plugin ls ${PLUGIN_ID} --json', { ...options, shell: true })
+    : spawnSync(cli, ["plugin", "ls", "${PLUGIN_ID}", "--json"], options);
 }
 
 function pluginDirectory() {
@@ -87,11 +92,20 @@ export type LauncherState = "missing" | "current" | "outdated" | "foreign";
 type LauncherFile = { path: string; content: string };
 
 // PowerShell and cmd run only files with an extension like .cmd, so on
-// Windows a .cmd file beside the launcher runs it with node.
+// Windows a .cmd file beside the launcher runs it with Node. It names the Node
+// that installed it: cmd.exe would look for a bare "node" in the agent's
+// folder first, where a repo could have put its own. Paseo Desktop runs
+// plugins on its own app in Node mode, which the variable turns on. A % in the
+// path is doubled so cmd.exe reads it as written.
 function launcherFiles(path: string, platform: NodeJS.Platform): LauncherFile[] {
   const files = [{ path, content: launcherScript() }];
   if (platform === "win32") {
-    files.push({ path: `${path}.cmd`, content: `@echo off\r\nrem ${MARKER}. Lets PowerShell and cmd run ${basename(path)}.\r\nnode "%~dp0${basename(path)}" %*\r\nexit /b %errorlevel%\r\n` });
+    const node = process.execPath.replaceAll("%", "%%");
+    const asNode = process.versions.electron ? `set "ELECTRON_RUN_AS_NODE=1"\r\n` : "";
+    files.push({
+      path: `${path}.cmd`,
+      content: `@echo off\r\nrem ${MARKER}. Lets PowerShell and cmd run ${basename(path)}.\r\nsetlocal\r\n${asNode}"${node}" "%~dp0${basename(path)}" %*\r\nexit /b %errorlevel%\r\n`,
+    });
   }
   return files;
 }
@@ -118,9 +132,7 @@ export async function installLauncher(path: string, platform: NodeJS.Platform =
   let wrote = false;
   for (const file of files) {
     if (file.state === "current") continue;
-    await mkdir(dirname(file.path), { recursive: true });
-    await writeFile(file.path, file.content);
-    await chmod(file.path, 0o755);
+    await writeFileIn(dirname(file.path), basename(file.path), file.content, { executable: true });
     wrote = true;
   }
   return wrote;
@@ -132,12 +144,16 @@ export async function launcherStatus(path = defaultLauncherPath(), pathEnv = pro
   const files = await fileStates(path, platform);
   const states = files.map((file) => file.state);
   const foreign = files.find((file) => file.state === "foreign");
-  const state: LauncherState = foreign ? "foreign"
-    : states.every((each) => each === "current") ? "current"
-    : states.every((each) => each === "missing") ? "missing" : "outdated";
+  const state: LauncherState = foreign
+    ? "foreign"
+    : states.every((each) => each === "current")
+      ? "current"
+      : states.every((each) => each === "missing")
+        ? "missing"
+        : "outdated";
   // Windows paths ignore case and may end in either slash.
   const paths = platform === "win32" ? win32 : posix;
-  const folder = (dir: string) => platform === "win32" ? dir.replace(/[\\/]+$/, "").toLowerCase() : dir.replace(/\/+$/, "");
+  const folder = (dir: string) => (platform === "win32" ? dir.replace(/[\\/]+$/, "").toLowerCase() : dir.replace(/\/+$/, ""));
   return {
     path: foreign?.path ?? path,
     state,

package/server/lock.ts

@@ -1,4 +1,6 @@
-import { mkdir, rm, stat } from "node:fs/promises";
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+import { createFolderIn, removeIn } from "./system.ts";
 
 const RETRY_MS = 25;
 const WAIT_MS = 10_000;
@@ -7,26 +9,31 @@ const STALE_MS = 30_000;
 
 // Serializes read-then-append so two commands never hand out the same id or
 // interleave a line. mkdir is atomic, so only one process creates the folder.
-export async function withLock<T>(lockPath: string, work: () => Promise<T>): Promise<T> {
+export async function withLock<T>(folder: string, name: string, work: () => Promise<T>): Promise<T> {
+  const lockPath = join(folder, name);
   const started = Date.now();
   while (true) {
     try {
-      await mkdir(lockPath);
+      await createFolderIn(folder, name);
       break;
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
-      const since = await stat(lockPath).then((info) => Date.now() - info.mtimeMs, () => 0);
+      const since = await stat(lockPath).then(
+        (info) => Date.now() - info.mtimeMs,
+        () => 0,
+      );
       if (since > STALE_MS) {
-        await rm(lockPath, { recursive: true, force: true });
+        await removeIn(folder, name, { recursive: true });
         continue;
       }
-      if (Date.now() - started > WAIT_MS) throw new Error(`Timed out waiting for ${lockPath}. If no other progress command is running, delete it.`);
+      if (Date.now() - started > WAIT_MS)
+        throw new Error(`Timed out waiting for ${lockPath}. If no other progress command is running, delete it.`, { cause: error });
       await new Promise((resolve) => setTimeout(resolve, RETRY_MS + Math.random() * RETRY_MS));
     }
   }
   try {
     return await work();
   } finally {
-    await rm(lockPath, { recursive: true, force: true });
+    await removeIn(folder, name, { recursive: true });
   }
 }