@warlock.js/ai-workspace 5.44.0 → 5.46.0

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@warlock.js/ai-workspace` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.45.0 - 2026-11-05
+
+### Added
+
+- `resolveShell()` reports which PowerShell it found: `ResolvedShell` gains `edition` (`"desktop"` for Windows PowerShell 5.1, `"core"` for PowerShell 7+; exported type `PowerShellEdition`) and `version` (`"5.1"` for Windows PowerShell; for `pwsh` when `ShellHost.powershellVersion` is supplied). Windows PowerShell 5.1 gets the label `Windows PowerShell 5.1 (powershell)` and its own `"powershell5"` dialect, whose parser refuses `&&` and `||` with "Windows PowerShell 5.1 cannot run &&; use ; or run each command in its own call instead.". `run_shell`'s description for that dialect no longer promises chaining.
+- `onAsk` decisions: `remember` accepts one pattern or an array, so a line that asks about several commands can approve them all. `workspace.shell.remembered()` lists the remembered patterns and `workspace.shell.forget(pattern)` removes one. A configured deny still beats them.
+- `onAsk` decisions: `reason?: string` is appended to the `run_shell` refusal the model reads, cut at 500 characters with a `[truncated]` marker.
+- A flat `spilledTo?: string[]` on every `run_shell`, `shell_output`, `read_file`, `grep` and `glob` result that spilled output to disk, and a spilled head-and-tail text now ends with a `[full output saved to …]` line. The `use-a-workspace` skill documents each tool's result shape.
+
+### Changed
+
+- On Windows, `interpreter: "auto"` now picks `pwsh` (PowerShell 7+), then Git Bash, then Windows PowerShell 5.1, then `cmd.exe`, so a machine with Git for Windows and only PowerShell 5.1 runs `&&` lines under bash instead of failing in PowerShell.
+
 ## 5.44.0 - 2026-11-05
 
 ### Added

package/cjs/index.cjs

@@ -484,8 +484,8 @@ function currentShellHost() {
 	};
 }
 /** The grammar a concrete interpreter reads on `platform`. */
-function dialectOf(interpreter, platform = process.platform) {
-	if (interpreter === "powershell") return "powershell";
+function dialectOf(interpreter, platform = process.platform, edition) {
+	if (interpreter === "powershell") return edition === "desktop" ? "powershell5" : "powershell";
 	if (interpreter === "cmd") return "cmd";
 	return interpreter === "sh" && platform === "win32" ? "cmd" : "posix";
 }
@@ -512,15 +512,23 @@ function findGitBash(host) {
 function powershellNames(host) {
 	return host.platform === "win32" ? ["pwsh", "powershell"] : ["pwsh"];
 }
-function powershellLabel(file) {
-	return file !== void 0 && /pwsh(\.exe)?$/i.test(file) ? "PowerShell 7 (pwsh)" : "PowerShell";
+/** The edition of the PowerShell executable `file`: `powershell.exe` is Windows PowerShell, anything else (`pwsh`) is PowerShell 7+. */
+function editionOf(file) {
+	return /(^|[\\/])powershell(\.exe)?$/i.test(file) ? "desktop" : "core";
+}
+function powershellLabel(edition) {
+	if (edition === "desktop") return "Windows PowerShell 5.1 (powershell)";
+	return edition === "core" ? "PowerShell 7 (pwsh)" : "PowerShell";
 }
 /**
 * Resolve a shell policy's `interpreter` (and `interpreterPath`) to the
 * concrete shell that will run lines, and the grammar they are checked with.
 *
-* `"auto"` picks `pwsh`, then Windows PowerShell, then Git Bash (found next to
-* `git`), then `cmd.exe` on Windows and `bash`, then `sh` elsewhere. An explicit interpreter whose executable
+* `"auto"` picks, on Windows, `pwsh` (PowerShell 7+), then Git Bash (found next
+* to `git`), then Windows PowerShell 5.1, then `cmd.exe`; elsewhere `bash`,
+* then `sh`. Windows PowerShell 5.1 gets its own dialect (`"powershell5"`)
+* because it cannot run `&&` / `||`; `edition` and `version` say which one
+* was found. An explicit interpreter whose executable
 * is not on `PATH` keeps its name and has no `file`, so the spawn reports the
 * missing shell instead of quietly running another one.
 *
@@ -540,10 +548,12 @@ function resolveShell(shell, host = currentShellHost()) {
 	if (requested === "auto") {
 		if (explicit !== void 0) interpreter = /(^|[\\/])(pwsh|powershell)(\.exe)?$/i.test(explicit) ? "powershell" : /(^|[\\/])cmd(\.exe)?$/i.test(explicit) ? "cmd" : /(^|[\\/])bash(\.exe)?$/i.test(explicit) ? "bash" : "sh";
 		else if (host.platform === "win32") {
-			const powershell = findOnPath(powershellNames(host), host);
-			const gitBash = powershell === void 0 ? findGitBash(host) : void 0;
-			interpreter = powershell !== void 0 ? "powershell" : gitBash !== void 0 ? "bash" : "cmd";
-			file = powershell ?? gitBash;
+			const core = findOnPath(["pwsh"], host);
+			const gitBash = core === void 0 ? findGitBash(host) : void 0;
+			const desktop = core === void 0 && gitBash === void 0 ? findOnPath(["powershell"], host) : void 0;
+			const found = core ?? gitBash ?? desktop;
+			interpreter = core !== void 0 || desktop !== void 0 ? "powershell" : gitBash !== void 0 ? "bash" : "cmd";
+			file = found;
 		} else {
 			const bash = findOnPath(["bash"], host);
 			interpreter = bash !== void 0 ? "bash" : "sh";
@@ -555,16 +565,20 @@ function resolveShell(shell, host = currentShellHost()) {
 		else if (interpreter === "bash") file = findOnPath(["bash"], host) ?? (host.platform === "win32" ? findGitBash(host) : void 0);
 		else if (interpreter === "cmd" && host.platform === "win32") file = process.env.ComSpec ?? "cmd.exe";
 	}
+	const edition = interpreter === "powershell" && file !== void 0 ? editionOf(file) : void 0;
+	const version = edition === "desktop" ? "5.1" : edition === "core" && file !== void 0 ? host.powershellVersion?.(file) : void 0;
 	const labels = {
 		none: "none",
 		sh: host.platform === "win32" ? "cmd.exe" : "sh",
 		bash: "bash",
 		cmd: "cmd.exe",
-		powershell: powershellLabel(file)
+		powershell: powershellLabel(edition)
 	};
 	return {
 		interpreter,
-		dialect: dialectOf(interpreter, host.platform),
+		dialect: dialectOf(interpreter, host.platform, edition),
+		...edition !== void 0 ? { edition } : {},
+		...version !== void 0 ? { version } : {},
 		...file !== void 0 ? { file } : {},
 		label: labels[interpreter]
 	};
@@ -644,10 +658,11 @@ function unsupported$1(message) {
 	return new PowerShellRefusal("unsupported-syntax", message);
 }
 var PowerShellParser = class PowerShellParser {
-	constructor(src, commands = [], depth = 0) {
+	constructor(src, commands = [], depth = 0, chaining = true) {
 		this.src = src;
 		this.commands = commands;
 		this.depth = depth;
+		this.chaining = chaining;
 		this.pos = 0;
 	}
 	atEnd() {
@@ -689,6 +704,7 @@ var PowerShellParser = class PowerShellParser {
 	}
 	readListOperator() {
 		const char = this.peek();
+		if (!this.chaining && (char === "&" && this.peek(1) === "&" || char === "|" && this.peek(1) === "|")) throw unsupported$1(`Windows PowerShell 5.1 cannot run ${char}${char}; use ; or run each command in its own call instead.`);
 		if (char === "&" && this.peek(1) === "&") {
 			this.pos += 2;
 			return "&&";
@@ -943,7 +959,7 @@ var PowerShellParser = class PowerShellParser {
 		}
 		if (level !== 0) throw new PowerShellRefusal("unbalanced-quotes", "A `$(` subexpression is never closed.");
 		const inner = this.src.slice(open + 1, index);
-		new PowerShellParser(inner, this.commands, this.depth + 1).parseProgram([]);
+		new PowerShellParser(inner, this.commands, this.depth + 1, this.chaining).parseProgram([]);
 		this.pos = index + 1;
 	}
 	/** Read `$name`, `${name}` or `$env:NAME` at the cursor; a `$(` is refused. */
@@ -965,9 +981,9 @@ var PowerShellParser = class PowerShellParser {
 	}
 };
 /** Parse a PowerShell command line for the shell policy. Never throws. */
-function parsePowerShellLine(line) {
+function parsePowerShellLine(line, options) {
 	const segments = [];
-	const parser = new PowerShellParser(line);
+	const parser = new PowerShellParser(line, [], 0, options?.chaining !== false);
 	try {
 		parser.parseProgram(segments);
 		return {
@@ -1753,7 +1769,7 @@ var CmdParser = class {
 */
 function parseShellLine(line, dialect) {
 	const segments = [];
-	if (dialect === "powershell") return parsePowerShellLine(line);
+	if (dialect === "powershell" || dialect === "powershell5") return parsePowerShellLine(line, { chaining: dialect === "powershell" });
 	try {
 		if (dialect === "cmd") {
 			const commands = [];
@@ -2089,7 +2105,7 @@ function shellDialect() {
 * stripped). The cmd dialect splits Windows paths too.
 */
 function executableBasename(firstToken, dialect = "posix") {
-	return (dialect === "cmd" || dialect === "powershell" ? node_path.default.win32.basename(firstToken) : node_path.default.basename(firstToken)).replace(dialect === "powershell" ? /\.(exe|cmd|bat|com|ps1)$/i : /\.(exe|cmd|bat|com)$/i, "");
+	return (dialect === "cmd" || dialect === "powershell" || dialect === "powershell5" ? node_path.default.win32.basename(firstToken) : node_path.default.basename(firstToken)).replace(dialect === "powershell" || dialect === "powershell5" ? /\.(exe|cmd|bat|com|ps1)$/i : /\.(exe|cmd|bat|com)$/i, "");
 }
 /** Show a command in a refusal, abbreviated at a word boundary when long. */
 function show(source) {
@@ -2254,7 +2270,7 @@ var LineChecker = class {
 		this.commands.push([...argv]);
 		const remembered = this.isRemembered(argv);
 		const approved = rule?.effect === "allow" || remembered || this.explicitlyAllowed(executable);
-		if (OPAQUE_RUNNERS.has(key) || this.shellMode && this.dialect === "posix" && SHELL_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "cmd" && CMD_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "powershell" && POWERSHELL_OPAQUE.has(key)) {
+		if (OPAQUE_RUNNERS.has(key) || this.shellMode && this.dialect === "posix" && SHELL_OPAQUE_BUILTINS.has(key) || this.shellMode && this.dialect === "cmd" && CMD_OPAQUE_BUILTINS.has(key) || this.shellMode && (this.dialect === "powershell" || this.dialect === "powershell5") && POWERSHELL_OPAQUE.has(key)) {
 			if (approved) return;
 			if (this.askMode || rule?.effect === "ask") {
 				this.addAsk(argv, "nested", rule);
@@ -2342,7 +2358,7 @@ var LineChecker = class {
 	}
 	/** Check a redirection target from every possible cwd. */
 	checkRedirectTarget(word, access, cwds) {
-		if (this.dialect === "powershell" && !word.quoted && word.value.toLowerCase() === "$null") return;
+		if ((this.dialect === "powershell" || this.dialect === "powershell5") && !word.quoted && word.value.toLowerCase() === "$null") return;
 		if (word.dynamic) throw new Refusal("unsupported-syntax", `The redirection target \`${word.raw}\` must be a literal path (no variables, globs or \`~\`).`);
 		const value = word.value;
 		if (this.dialect === "posix" && DEVICE_TARGETS.has(value) || this.dialect === "cmd" && CMD_DEVICE_TARGETS.has(value.toLowerCase())) return;
@@ -2560,7 +2576,7 @@ function checkSimpleCommand(checker, simple, cwds, dialect) {
 	const first = simple.words[0];
 	if (first === void 0) return cwds;
 	const executable = first.dynamic ? "" : executableBasename(first.value, dialect).toLowerCase();
-	const powershell = dialect === "powershell";
+	const powershell = dialect === "powershell" || dialect === "powershell5";
 	if (executable === "cd" || powershell && POWERSHELL_CD_NAMES.has(executable)) {
 		checker.assertExecutableNotDenied(executable, simple.words.map((word) => word.value));
 		if (powershell) {
@@ -3812,7 +3828,10 @@ var OutputSpiller = class {
 		const where = file === void 0 ? "the rest was dropped" : `full output saved to ${file}`;
 		const marker = `[showing ${tail.length === 0 ? `lines 1-${head.length}` : head.length === 0 ? `lines ${total - tail.length + 1}-${total}` : `lines 1-${head.length} and ${total - tail.length + 1}-${total}`} of ${total}; ${where}]`;
 		const parts = [...head.length > 0 ? [head.join("\n")] : [], marker];
-		if (tail.length > 0) parts.push(tail.join("\n"));
+		if (tail.length > 0) {
+			parts.push(tail.join("\n"));
+			if (file !== void 0) parts.push(`[full output saved to ${file}]`);
+		}
 		return {
 			value: parts.join("\n"),
 			truncation: {
@@ -3866,6 +3885,26 @@ var OutputSpiller = class {
 	}
 };
 
+//#endregion
+//#region ../../packages/ai-workspace/src/policy/approval-helpers.ts
+/** The longest refusal reason passed on to the model, in characters. */
+const MAX_REFUSAL_REASON = 500;
+/** Whether two command patterns are the same (strings by value, RegExps by source and flags). */
+function samePattern(a, b) {
+	if (typeof a === "string" || typeof b === "string") return a === b;
+	return a.source === b.source && a.flags === b.flags;
+}
+/**
+* The tail of a refusal message for an owner's reason: `"."` without one,
+* otherwise `" — <reason>"` cut at {@link MAX_REFUSAL_REASON} characters with
+* a visible marker.
+*/
+function refusalReason(reason) {
+	const text = typeof reason === "string" ? reason.trim() : "";
+	if (text.length === 0) return ".";
+	return ` — ${text.length > 500 ? `${text.slice(0, 500)}… [truncated]` : text}`;
+}
+
 //#endregion
 //#region ../../packages/ai-workspace/src/shell-jobs.ts
 /** Finished commands kept for a last `shell_output` read before the oldest are pruned. */
@@ -4338,6 +4377,7 @@ var Ops = class {
 		return {
 			content: spilled?.content ?? content,
 			...spilled !== void 0 ? { truncation: spilled.truncation } : {},
+			...spilled?.truncation.path !== void 0 ? { spilledTo: [spilled.truncation.path] } : {},
 			startLine: offset,
 			endLine,
 			totalLines,
@@ -4504,12 +4544,18 @@ var Ops = class {
 		} catch {
 			decision = void 0;
 		}
-		if (decision?.allow !== true) throw new WorkspacePolicyError(`Running ${asks.map((ask) => `\`${ask.argv.join(" ")}\``).join(", ")} was not approved.`, {
-			type: "denied-command",
-			reason: "approval-denied",
-			command
-		});
-		if (decision.remember !== void 0 && !this.approvals.includes(decision.remember)) this.approvals.push(decision.remember);
+		if (decision?.allow !== true) {
+			const reason = refusalReason(decision?.reason);
+			throw new WorkspacePolicyError(`Running ${asks.map((ask) => `\`${ask.argv.join(" ")}\``).join(", ")} was not approved${reason}`, {
+				type: "denied-command",
+				reason: "approval-denied",
+				command
+			});
+		}
+		if (decision.remember !== void 0) {
+			const patterns = Array.isArray(decision.remember) ? decision.remember : [decision.remember];
+			for (const pattern of patterns) if (!this.approvals.some((entry) => samePattern(entry, pattern))) this.approvals.push(pattern);
+		}
 	}
 	async exec(command, opts) {
 		await this.assertCommandAllowed(command, opts?.signal);
@@ -4545,7 +4591,8 @@ var Ops = class {
 			truncated: stdout.truncated || stderr.truncated,
 			timedOut: result.timedOut && !cancelled,
 			cancelled,
-			...truncation !== void 0 ? { truncation } : {}
+			...truncation !== void 0 ? { truncation } : {},
+			...spilledField(truncation)
 		};
 	}
 	async startShell(command, opts) {
@@ -4592,7 +4639,8 @@ var Ops = class {
 			stdout: stdout.value,
 			stderr: stderr.value,
 			truncated: true,
-			truncation
+			truncation,
+			...spilledField(truncation)
 		};
 	}
 	/**
@@ -4750,7 +4798,8 @@ var Ops = class {
 			matches: fitted.items,
 			total: matches.length,
 			truncated: true,
-			truncation: fitted.truncation
+			truncation: fitted.truncation,
+			...spilledField({ stdout: fitted.truncation })
 		};
 	}
 	async globResult(pattern) {
@@ -4759,7 +4808,8 @@ var Ops = class {
 		return fitted.truncation === void 0 ? { paths: all } : {
 			paths: fitted.items,
 			truncated: true,
-			truncation: fitted.truncation
+			truncation: fitted.truncation,
+			...spilledField({ stdout: fitted.truncation })
 		};
 	}
 	async glob(pattern) {
@@ -4792,6 +4842,11 @@ var Ops = class {
 		return denyPaths !== void 0 && denyPaths.length > 0 && matchesAnyGlob(relativePath, denyPaths);
 	}
 };
+/** `{ spilledTo }` for every spill file named in the truncation metadata, or nothing. */
+function spilledField(truncation) {
+	const paths = [truncation?.stdout?.path, truncation?.stderr?.path].filter((file) => file !== void 0);
+	return paths.length > 0 ? { spilledTo: paths } : {};
+}
 /** Combine per-stream truncation metadata; `undefined` when neither stream was clipped. */
 function streamTruncation(stdout, stderr) {
 	if (stdout === void 0 && stderr === void 0) return;
@@ -6218,7 +6273,8 @@ function runShellInputSchema(background) {
 const DIALECT_RULES = {
 	posix: "Use POSIX shell syntax: `;`, `&&`, `||`, pipes, quotes, `$( )` and redirections are supported, and every command in the line is checked. Compound statements (`if`, `for`), brace expansion, arithmetic and `&` are not.",
 	cmd: "Use cmd.exe syntax: `&&`, `||`, `&`, `|` and simple redirections are supported, and every command in the line is checked. `%` and `!` expansion, `^`, parentheses and `if` / `for` are not.",
-	powershell: "Use PowerShell syntax: `;`, `&&`, `||`, pipes, `$( )`, the call operator `&` and the redirections `>`, `>>`, `2>` and `2>&1` are supported, and every command in the line is checked (aliases such as `rm` and `Remove-Item` are treated alike). Script blocks, `Invoke-Expression`, here-strings, splatting and `if` / `foreach` are not."
+	powershell: "Use PowerShell syntax: `;`, `&&`, `||`, pipes, `$( )`, the call operator `&` and the redirections `>`, `>>`, `2>` and `2>&1` are supported, and every command in the line is checked (aliases such as `rm` and `Remove-Item` are treated alike). Script blocks, `Invoke-Expression`, here-strings, splatting and `if` / `foreach` are not.",
+	powershell5: "Use Windows PowerShell 5.1 syntax: `;`, pipes, `$( )`, the call operator `&` and the redirections `>`, `>>`, `2>` and `2>&1` are supported, and every command in the line is checked (aliases such as `rm` and `Remove-Item` are treated alike). This version cannot chain with `&&` or `||`: put one command per call, or join with `;` (which runs the next command whatever the exit code). Script blocks, `Invoke-Expression`, here-strings, splatting and `if` / `foreach` are not supported."
 };
 const PLATFORM_NAMES = {
 	win32: "Windows",
@@ -6302,7 +6358,7 @@ const runTestsInputSchema = withJsonSchema({ "~standard": {
 } }, RUN_TESTS_JSON_SCHEMA);
 /** Quote the test pattern as one literal argument for the line's interpreter. */
 function quotePattern(pattern, interpreter, dialect, platform = process.platform) {
-	if (dialect === "powershell" || interpreter === "powershell") return `'${pattern.replace(/['\u2018\u2019\u201A\u201B]/g, "$&$&")}'`;
+	if (dialect === "powershell" || dialect === "powershell5" || interpreter === "powershell") return `'${pattern.replace(/['\u2018\u2019\u201A\u201B]/g, "$&$&")}'`;
 	if (interpreter === "bash" || interpreter === "sh" && platform !== "win32") return `'${pattern.replace(/'/g, "'\\''")}'`;
 	return `"${pattern}"`;
 }
@@ -6727,7 +6783,17 @@ var WorkspaceImpl = class WorkspaceImpl {
 			approvals: []
 		};
 		this.resolvedShell = resolveShell(policy.shell);
-		this.shell = { classify: (line) => classifyShellCommand(line, policy) };
+		const approvals = this.state.approvals;
+		this.shell = {
+			classify: (line) => classifyShellCommand(line, policy),
+			remembered: () => [...approvals],
+			forget: (pattern) => {
+				const index = approvals.findIndex((entry) => samePattern(entry, pattern));
+				if (index === -1) return false;
+				approvals.splice(index, 1);
+				return true;
+			}
+		};
 		const backend = selectBackend(policy);
 		this.ops = createOps(backend, policy, {
 			jobs: this.state.jobs,