aegis-desktop 0.8.19 → 0.8.21

package/vendor/aegis.js

@@ -66,46 +66,292 @@ function envIdleMs(name) {
 }
 
 /**
- * DeepSeek's chat template wraps tool calls and turn boundaries in special
- * tokens — fullwidth pipe (U+FF5C) delimiting an identifier that uses ▁
- * (U+2581) as its word separator, e.g. ｜tool▁calls▁begin｜, ｜tool▁call▁end｜,
- * ｜Assistant｜, ｜begin▁of▁sentence｜. These are chat-template internals, never
- * user-facing text; when the provider's streaming tool-call path leaks them
- * into `delta.content` they used to reach the screen verbatim — reported as
- * the pasted "｜｜DSML｜｜" envelope on Windows/macOS. Returns a per-stream
- * stripper closure with a short lookback buffer so a token split across two
- * SSE chunks isn't half-rendered before its closing pipe arrives.
+ * DeepSeek emits its tool calls as DSML — an XML-ish dialect of its chat
+ * template that the OpenAI-compatible wire format does NOT structure for us:
+ *
+ *     <｜DSML｜tool_calls>
+ *     <｜DSML｜invoke name="write">
+ *     <｜DSML｜parameter name="path" string="true">src/app.js</｜DSML｜parameter>
+ *     <｜DSML｜parameter name="content" string="true">…the file body…</｜DSML｜parameter>
+ *     </｜DSML｜invoke>
+ *     </｜DSML｜tool_calls>
+ *
+ * It arrives as plain `delta.content` text, and that produces two failures:
+ * the markup rendering verbatim (reported as the pasted "｜｜DSML｜｜" envelope),
+ * and the call itself never running because text is not a tool call. Ported
+ * from aegiscodex-dev's src/backend.js, which carries the full history of this
+ * grammar's quirks (provider/template/model revision disagree about the exact
+ * identifier, angle brackets sometimes absent, tag names drift under
+ * sampling) — every part of the pattern below is deliberately optional and
+ * spacing-insensitive for that reason. `string="false"` marks a JSON
+ * parameter; `string="true"` (or an absent attribute) is the literal value,
+ * kept verbatim so a multi-line `content` is never mangled by a JSON
+ * round-trip.
+ */
+// `\b` after each tag-name alternative matters: without it, "call" matches as
+// a bare PREFIX of a drifted wrapper tag like "calls" (observed verbatim —
+// `<｜｜ calls>`, no "tool_"/"function_" prefix at all), swallowing everything
+// up to the next real `</invoke>` as that spurious match's unnamed body and
+// silently discarding a whole tool call with it. "call" and "calls" are both
+// word characters, so plain alternation order cannot tell them apart.
+const DSML_RE_INVOKE = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call)\b\s*([^>]*?)\s*>([\s\S]*?)<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call)\b\s*>/g;
+const DSML_RE_PARAM = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*([^>]*?)\s*>([\s\S]*?)<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*>/g;
+const DSML_RE_LEADER = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*(?:(?:tool|function)[_▁ ]*calls?|reasoning)[_▁ ]*(?:begin|end)?\s*>/gi;
+const DSML_RE_ANY_TAG = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*[A-Za-z_][A-Za-z0-9_]*[^>]{0,120}>/g;
+const DSML_RE_SKELETON = /<\s*\/?\s*(?:tool_calls|function_calls|invoke|parameter|param|reasoning)\b[^>]{0,120}>/gi;
+const DSML_RE_JSON_CALLS = /｜[ \t]*(?:tool|function)[_▁ ]*calls?[_▁ ]*begin[ \t]*｜([\s\S]*?)｜[ \t]*(?:tool|function)[_▁ ]*calls?[_▁ ]*end[ \t]*｜/gi;
+const DSML_RE_ENVELOPE_TOKEN = /｜[ \t]?[A-Za-z0-9_▁]*[ \t]?｜/g;
+const DSML_RE_DRIFT_INVOKE = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call)\b\s*([^>]*?)\s*>/gi;
+const DSML_RE_DRIFT_PARAM = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*([^>]*?)\s*>/gi;
+const DSML_RE_PARAM_CLOSE = /<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*>/gi;
+const DSML_RE_ATTR = /([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+const DSML_RE_STRUCT_TAG = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call|parameter|param|arg|reasoning|(?:tool|function)[_▁ ]*calls?)\b/gi;
+const DSML_RE_STRUCT_CLOSER = /<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call|parameter|param|arg|reasoning|(?:tool|function)[_▁ ]*calls?)\b/gi;
+/**
+ * A COMPLETE (its own '>' has arrived) wrapper/leader tag that carries no
+ * call of its own — observed verbatim: a bare `<｜｜calls>`, with neither a
+ * "tool_"/"function_" prefix (so DSML_RE_LEADER above misses it) nor a JSON
+ * envelope pair. Safe to drop the moment it closes, UNLIKE invoke/parameter —
+ * excluded here via negative lookahead so a *partial* invoke/parameter head is
+ * never erased before its own close has a chance to pair it up with
+ * DSML_RE_INVOKE/DSML_RE_PARAM on a later call once more of it has arrived.
+ */
+const DSML_RE_WRAPPER_TAG = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*(?!(?:invoke|call|tool_call|parameter|param|arg)\b)[A-Za-z_][A-Za-z0-9_]*[^>]{0,120}>/g;
+/** A '<' (or '</') at the tail: the head of a tag whose pipe is still in flight. */
+const DSML_RE_TRAILING_LT = /<\s*\/?\s*$/;
+/** An in-flight identifier token: a pipe whose partner has not arrived yet. */
+const DSML_RE_OPEN_TOKEN = /^｜[ \t]?[A-Za-z0-9_▁]*[ \t]?$/;
+/** Past this much buffered markup, a held tail is released as-is. */
+const DSML_HOLD_MAX = 4 * 1024 * 1024;
+
+/** The attributes of one tag head, lower-cased: name="write" → { name: 'write' }. */
+function dsmlAttrs(text) {
+  const out = {};
+  if (!text) return out;
+  DSML_RE_ATTR.lastIndex = 0;
+  let m;
+  while ((m = DSML_RE_ATTR.exec(text))) out[m[1].toLowerCase()] = m[2] != null ? m[2] : m[3];
+  return out;
+}
+
+/** A JSON parameter — or, when it is not JSON after all, the text it came as. */
+function dsmlJson(raw) {
+  const s = String(raw == null ? '' : raw).trim();
+  try {
+    const v = JSON.parse(s);
+    return v === undefined ? s : v;
+  } catch {
+    return s;
+  }
+}
+
+/** The `parameter` tags of one `invoke` body, as a tool call's args object. */
+function dsmlArgs(body) {
+  const args = {};
+  DSML_RE_PARAM.lastIndex = 0;
+  let p;
+  while ((p = DSML_RE_PARAM.exec(body))) {
+    const a = dsmlAttrs(p[1]);
+    const key = a.name || a.key || `arg${Object.keys(args).length}`;
+    const isJson = String(a.string || '').toLowerCase() === 'false' || String(a.json || '').toLowerCase() === 'true';
+    args[key] = isJson ? dsmlJson(p[2]) : p[2];
+  }
+  return args;
+}
+
+/**
+ * Decode every DSML tool call in `text` and return the two things a caller
+ * needs: what may be shown, and what must be executed — `{ text, calls }`.
+ * The generic `｜…｜` tokens are deliberately left in place here: an `invoke`
+ * block still arriving is identified by its delimiters on the next pass, and
+ * eating them early would lose the call's name and arguments. They are
+ * removed from the *released* text instead (see dsmlResidue).
+ */
+function decodeDeepSeekDSML(input) {
+  if (typeof input !== 'string' || !input || input.indexOf('｜') === -1) {
+    return { text: input || '', calls: [] };
+  }
+  const calls = [];
+  let text = input;
+
+  // 1. One `invoke` block per call, the well-formed spelling.
+  DSML_RE_INVOKE.lastIndex = 0;
+  const spans = [];
+  let m;
+  while ((m = DSML_RE_INVOKE.exec(text))) {
+    const a = dsmlAttrs(m[1]);
+    const name = a.name || a.function || a.tool || '';
+    if (name) calls.push({ name, args: dsmlArgs(m[2]) });
+    spans.push([m.index, m.index + m[0].length]);
+  }
+  for (let i = spans.length - 1; i >= 0; i--) {
+    text = text.slice(0, spans[i][0]) + text.slice(spans[i][1]);
+  }
+
+  // 2. The older spelling: a JSON array wrapped in envelope tokens.
+  text = text.replace(DSML_RE_JSON_CALLS, (full, body) => {
+    const parsed = dsmlJson(body);
+    const list = Array.isArray(parsed) ? parsed : (parsed && Array.isArray(parsed.tool_calls) ? parsed.tool_calls : []);
+    for (const c of list) {
+      const fn = (c && c.function) || c || {};
+      const name = fn.name || (c && c.name) || '';
+      if (!name) continue;
+      let args = fn.arguments != null ? fn.arguments : (c && c.arguments);
+      if (typeof args === 'string') args = dsmlJson(args);
+      calls.push({ name, args: args && typeof args === 'object' ? args : {} });
+    }
+    return '';
+  });
+
+  // 3. The wrapper tags carry no call of their own.
+  text = text.replace(DSML_RE_LEADER, '');
+  return { text, calls };
+}
+
+/**
+ * Last-resort decode for markup that drifted out of well-formedness: a missing
+ * closing tag, or a stream cut mid-call. The call still names a tool and its
+ * parameters are still readable, so it is decoded rather than deleted — a call
+ * that reached the wire must not vanish because its closing tag did.
+ */
+function decodeDeepSeekDSMLDrift(input) {
+  if (typeof input !== 'string' || !input || input.indexOf('｜') === -1) return { text: input || '', calls: [] };
+  const opens = [];
+  DSML_RE_DRIFT_INVOKE.lastIndex = 0;
+  let m;
+  while ((m = DSML_RE_DRIFT_INVOKE.exec(input))) {
+    opens.push({ at: m.index, attrs: m[1], body: DSML_RE_DRIFT_INVOKE.lastIndex });
+  }
+  if (!opens.length) return { text: input, calls: [] };
+  const calls = [];
+  let text = '';
+  let cursor = 0;
+  for (let i = 0; i < opens.length; i++) {
+    // One call runs to the next `invoke` head, or to the end of the text.
+    const end = i + 1 < opens.length ? opens[i + 1].at : input.length;
+    const body = input.slice(opens[i].body, end);
+    const a = dsmlAttrs(opens[i].attrs);
+    const name = a.name || a.function || a.tool || '';
+    const args = {};
+    const params = [];
+    DSML_RE_DRIFT_PARAM.lastIndex = 0;
+    let pm;
+    while ((pm = DSML_RE_DRIFT_PARAM.exec(body))) {
+      params.push({ at: pm.index, attrs: pm[1], from: DSML_RE_DRIFT_PARAM.lastIndex });
+    }
+    for (let k = 0; k < params.length; k++) {
+      // A value runs to the next parameter tag — its closing tag may be the
+      // thing that never arrived.
+      const stop = k + 1 < params.length ? params[k + 1].at : body.length;
+      const raw = body.slice(params[k].from, stop).replace(DSML_RE_PARAM_CLOSE, '');
+      const pa = dsmlAttrs(params[k].attrs);
+      const key = pa.name || pa.key || `arg${Object.keys(args).length}`;
+      const isJson = String(pa.string || '').toLowerCase() === 'false';
+      args[key] = isJson ? dsmlJson(raw) : raw;
+    }
+    text += input.slice(cursor, opens[i].at);
+    cursor = end;
+    if (name) calls.push({ name, args });
+  }
+  text += input.slice(cursor);
+  return { text, calls };
+}
+
+/**
+ * Residue removal for text that is about to be shown. Two spellings have to go:
+ * a leftover envelope token (`｜DSML｜`, `｜tool▁calls▁begin｜`, `｜Assistant｜`),
+ * and the skeleton an earlier release left behind by stripping the delimiters
+ * out of a DSML block — `<tool_calls> <invoke name="write"> <parameter …>`,
+ * which is exactly what a user pasted back at us.
+ */
+function dsmlResidue(text) {
+  if (!text) return text;
+  if (text.indexOf('｜') === -1) return text.replace(DSML_RE_SKELETON, '');
+  return text.replace(DSML_RE_ANY_TAG, '').replace(DSML_RE_SKELETON, '').replace(DSML_RE_ENVELOPE_TOKEN, '');
+}
+
+/**
+ * Is the buffer, read from the first `｜` in it, a construct that is still
+ * arriving? Only two shapes may be held back: a pipe whose partner has not
+ * arrived, and a DSML opener whose matching close has not landed. Everything
+ * else is prose — a `｜` in an answer is a character, not a promise of markup,
+ * and holding the rest of the answer behind it would swallow the reply.
+ */
+function dsmlUnterminated(s) {
+  if (DSML_RE_OPEN_TOKEN.test(s)) return true;
+  const openers = (s.match(DSML_RE_STRUCT_TAG) || []).length;
+  const closers = (s.match(DSML_RE_STRUCT_CLOSER) || []).length;
+  return openers > closers;
+}
+
+/**
+ * Where, if anywhere, an in-flight DSML construct still needs the rest of the
+ * buffer held back from view. By the time this runs, decodeDeepSeekDSML() has
+ * already removed every COMPLETE invoke/parameter span and the caller has
+ * already removed every complete non-invoke wrapper tag (DSML_RE_WRAPPER_TAG),
+ * so whatever is left can only be: clean prose, or the start of exactly ONE
+ * incomplete construct running to the end of the buffer — an opener whose own
+ * '｜' has arrived but not its '>' (`<\s*\/?\s*｜`, found wherever it starts,
+ * not just at the tail: a Write's `content` can be arbitrarily long, so the
+ * unresolved opener is usually far behind the cursor, not at it), a '<' that
+ * arrived with no '｜' yet (the chunk boundary landed first), or a bare pipe
+ * token still accumulating its identifier (the plain envelope-leak case, e.g.
+ * '｜tool▁cal'). Returns -1 when none apply — safe to release in full.
+ */
+function dsmlHoldFrom(buf) {
+  const tagStart = buf.search(/<\s*\/?\s*｜/);
+  if (tagStart !== -1) return tagStart;
+  const lt = DSML_RE_TRAILING_LT.exec(buf);
+  if (lt) return lt.index;
+  const openIdx = buf.indexOf('｜');
+  if (openIdx !== -1 && dsmlUnterminated(buf.slice(openIdx))) return openIdx;
+  return -1;
+}
+
+/**
+ * The per-stream stripper the transports share. Feed it each `delta.content`
+ * chunk: it returns the text that is safe to show, holds back whatever is
+ * still arriving (a Write's `content` parameter is a whole file — it belongs
+ * to the call, not to the screen), and collects the tool calls the model made
+ * in text form. `flush()` releases the tail once the stream is drained, and
+ * `calls()` returns everything decoded so far, which the caller merges into
+ * the turn's tool calls so a Write that arrived as DSML is executed like any
+ * other.
  */
-const DEEPSEEK_ENVELOPE_RE = /｜[A-Za-z][A-Za-z0-9]*(?:▁[A-Za-z0-9]+)*｜/g;
 function makeDeepSeekEnvelopeStripper() {
   let buf = '';
+  const calls = [];
   const strip = (chunk) => {
-    buf += chunk;
-    buf = buf.replace(DEEPSEEK_ENVELOPE_RE, '');
-    const openIdx = buf.lastIndexOf('｜');
-    if (openIdx !== -1) {
-      const tail = buf.slice(openIdx);
-      // Held back only while the tail still looks like an in-progress token
-      // (no closing pipe yet); a bare '｜' or genuine prose flushes normally.
-      if (tail.length <= 60 && /^｜[A-Za-z0-9▁]*$/.test(tail)) {
-        const out = buf.slice(0, openIdx);
-        buf = tail;
-        return out;
-      }
+    buf += typeof chunk === 'string' ? chunk : '';
+    const dec = decodeDeepSeekDSML(buf);
+    buf = dec.text;
+    for (const c of dec.calls) calls.push(c);
+    buf = buf.replace(DSML_RE_WRAPPER_TAG, '');
+    const hold = dsmlHoldFrom(buf);
+    let out;
+    if (hold !== -1 && buf.length - hold <= DSML_HOLD_MAX) {
+      out = buf.slice(0, hold);
+      buf = buf.slice(hold);
+    } else {
+      out = buf;
+      buf = '';
     }
-    const out = buf;
-    buf = '';
-    return out;
+    return dsmlResidue(out);
   };
   // Unconditional release of whatever is left buffered — called once the
-  // stream is fully drained, when a held-back '｜…' is known to never close
-  // (dropped connection, or it was real prose all along) rather than an
+  // stream is fully drained, when a held-back construct is known to never
+  // close (dropped connection, or it was real prose all along) rather than an
   // in-progress token.
   strip.flush = () => {
-    const out = buf;
+    const dec = decodeDeepSeekDSML(buf);
     buf = '';
-    return out;
+    for (const c of dec.calls) calls.push(c);
+    const drift = decodeDeepSeekDSMLDrift(dec.text);
+    for (const c of drift.calls) calls.push(c);
+    return dsmlResidue(drift.text);
   };
+  /** Every tool call decoded from text so far, as `{ name, args }`. */
+  strip.calls = () => calls.slice();
   return strip;
 }
 
@@ -678,7 +924,7 @@ function createClient(opts = {}) {
     else if (mode) body.mode = mode;
     const headers = authHeaders(agentKey ? { 'X-AEGIS-Agent-Key': agentKey } : undefined);
     if (!stream || typeof onStream !== 'function') {
-      return apiPost('/api/v1/chat/completions', { ...body, stream: false }, headers);
+      return decodeDsmlInResult(await apiPost('/api/v1/chat/completions', { ...body, stream: false }, headers));
     }
     // An OpenAI-compatible SSE response carries no `usage` unless the caller
     // asks for it (`stream_options.include_usage`). Without this the streamed
@@ -784,7 +1030,7 @@ function createClient(opts = {}) {
     // billable traffic instead of a free ride.
     if (apiKey) headers['X-AEGIS-Key'] = apiKey;
     if (!stream || typeof onStream !== 'function') {
-      return apiPost('/api/v1/byok/chat/completions', { ...body, stream: false }, headers);
+      return decodeDsmlInResult(await apiPost('/api/v1/byok/chat/completions', { ...body, stream: false }, headers));
     }
     return postStream('/api/v1/byok/chat/completions', body, headers, onStream, signal);
   }
@@ -796,6 +1042,31 @@ function createClient(opts = {}) {
     return typeof content === 'string' ? content : '';
   }
 
+  /**
+   * One-shot DSML decode for a non-streamed completion: the whole answer
+   * already arrived in one JSON payload, so there is no partial-token hold-
+   * back to do — just decode, drift-decode what the well-formed pass missed,
+   * and strip whatever residue would otherwise render as garble. Mutates and
+   * returns `data` so every non-stream return site in this module can wrap
+   * its result the same way the streaming path's `message.content` is clean.
+   */
+  function decodeDsmlInResult(data) {
+    const choice = data && data.choices && data.choices[0];
+    const content = choice && choice.message && choice.message.content;
+    if (typeof content !== 'string' || content.indexOf('｜') === -1) return data;
+    const once = decodeDeepSeekDSML(content);
+    const drift = decodeDeepSeekDSMLDrift(once.text);
+    choice.message.content = dsmlResidue(drift.text);
+    const calls = [...once.calls, ...drift.calls];
+    if (calls.length) {
+      data.toolCalls = [
+        ...(Array.isArray(data.toolCalls) ? data.toolCalls : []),
+        ...calls.map((c) => ({ id: '', name: c.name, args: c.args || {} })),
+      ];
+    }
+    return data;
+  }
+
   /**
    * POST body with `stream: true` and forward SSE deltas to onStream.
    * Shared by the AEGIS pool and the BYOK relay so every host parses exactly
@@ -881,7 +1152,7 @@ function createClient(opts = {}) {
       // request with plain JSON. Dropping the signal here meant an aborted turn
       // kept waiting on a request nobody was listening for any more — the
       // caller had already moved on, and the host held the socket.
-      const data = await apiPost(path, { ...cleanBody, stream: false }, headers, { signal });
+      const data = decodeDsmlInResult(await apiPost(path, { ...cleanBody, stream: false }, headers, { signal }));
       const fullText = textOf(data);
       if (fullText) onStream({ delta: fullText });
       return data;
@@ -890,7 +1161,7 @@ function createClient(opts = {}) {
     const contentType = res.headers.get('content-type') || '';
     if (!contentType.includes('text/event-stream')) {
       // Server ignored the stream flag and answered with plain JSON.
-      const data = await parseResponse(res);
+      const data = decodeDsmlInResult(await parseResponse(res));
       const fullText = textOf(data);
       if (fullText) {
         onStream({ delta: fullText });
@@ -1146,6 +1417,19 @@ function createClient(opts = {}) {
       ],
     };
     if (usage) result.usage = usage;
+    // DSML calls arrive as plain text, decoded by stripEnvelope rather than
+    // accumulated by index like structured delta.tool_calls — merged into one
+    // normalised `{ id, name, args }` list so a tool call that arrived as DSML
+    // (no provider-native delta.tool_calls at all) is executed like any other.
+    // engine.js's extractToolCalls() reads this field first, ahead of
+    // message.tool_calls.
+    const dsmlCalls = stripEnvelope.calls();
+    if (toolCalls.length || dsmlCalls.length) {
+      result.toolCalls = [
+        ...toolCalls.map((c) => ({ id: c.id, name: c.function.name, args: c.function.arguments })),
+        ...dsmlCalls.map((c) => ({ id: '', name: c.name, args: c.args || {} })),
+      ];
+    }
     return result;
   }
 

package/vendor/agent-gate.mjs

@@ -121,6 +121,32 @@ const KEY_FILE_MODE = 0o600;
 const DIR_MODE = 0o700;
 const GROUP_OTHER_BITS = 0o077;
 
+/**
+ * Do `fs.stat().mode` permission bits mean anything on this host?
+ *
+ * Windows: no. libuv has no NTFS ACL to report, so it synthesises the mode from
+ * the single read-only attribute and returns `0o666` for every writable file —
+ * the agent key included. `(mode & GROUP_OTHER_BITS) !== 0` is therefore ALWAYS
+ * true there, so the check below refused the agent key unconditionally: on
+ * Windows a correctly locked-down key at 0600 was reported as "readable by other
+ * users, refusing to treat it as a secret", and no chmod could ever clear it.
+ * `writeAgentKey` then threw on its own post-write assert for the same reason,
+ * so the gate could not even be initialised there.
+ *
+ * Where this returns false the boundary is the DIRECTORY's ACL — a per-user
+ * profile directory is already inaccessible to other non-admin accounts — which
+ * is what client/authorship-key.js has always done for the key file. The right
+ * behaviour is to skip the judgement, never to assume the worst.
+ *
+ * Duplicated from client/platform.js `hasPosixModes()` rather than imported: this
+ * file is deliberately standalone so it still runs from a copied hook, a staged
+ * tarball, or a vendored tools/ directory that has no sibling `client/`. Same
+ * reason cli/src/securefs.js carries its own copy.
+ */
+function hasPosixModes(platform) {
+  return (platform || process.platform) !== 'win32';
+}
+
 // ── derivations ─────────────────────────────────────────────────────────────
 
 /** @param {string} key @returns {string} hex sha256 under the gate domain */
@@ -259,10 +285,27 @@ const WRITEISH_BASH = [
   /(^|[^<])>>?\s*\S/,                   // > file, >> file
   /\btee\b/, /\bsed\s+-i/, /\btruncate\b/, /\bdd\b/,
   /\b(rm|mv|cp|install|touch|mkdir|rmdir|chmod|chown|ln)\b/,
-  /\b(patch|applypatch)\b/, /\bpython[0-9.]*\s+-c\b.*\bopen\s*\(/, /\bperl\s+-i\b/,
+  /\b(patch|applypatch)\b/, /\bperl\s+-i\b/,
   /\bgit\s+(checkout|restore|reset|clean|stash|apply|revert|cherry-pick|merge|rebase)\b/,
   /\bnpm\s+(install|ci|uninstall|update)\b/, /\byarn\s+(add|remove)\b/, /\bpip[0-9.]*\s+install\b/,
   /\bAEGIS_GATE_SKIP\b/,
+
+  // `find` is a writer the moment it mutates: -delete, -exec/-execdir, and the
+  // -fprint/-fls family all write without ever containing `rm` or a redirect.
+  // Found by probing this gate keylessly on 2026-10-02 (`find <gated-tree>
+  // -name guard.json -delete` was reported as a read). Kept in step with
+  // aegiscodex-dev/src/repoguard.js, which carries the same list.
+  /\bfind\b[^|;]*\s-(delete|exec|execdir|fprint|fprint0|fls)\b/,
+  /\bxargs\b/,
+
+  // An inline-eval interpreter is an opaque program: `node -e`, `python -c`,
+  // `perl -e`, `sh -c` can write anywhere without naming a path in the command
+  // text. The old python rule looked for a literal `open(` and so missed
+  // `open(String.fromCharCode(...))`; the interpreter itself is the honest
+  // marker, and path-less write-ish commands fall back to cwd (fail-closed).
+  // `node --test` is deliberately NOT a hit.
+  /\b(python[0-9.]*|perl)\s+-c\b/, /\b(python[0-9.]*|perl)\s+-e\b/,
+  /\bnode\b[^|;]*\s(?:-e|--eval)\b/, /\b(sh|bash|zsh|dash)\s+-c\b/,
 ];
 
 /** Path-shaped tokens in a command line. Deliberately over-eager: see bashTargets. */
@@ -333,7 +376,7 @@ function protectedUnder(manifest, absPaths) {
  *
  * @returns {{ key: string, source: string, error: string|null }}
  */
-export function resolveAgentKey({ env = process.env, manifestRoot = null, key = null } = {}) {
+export function resolveAgentKey({ env = process.env, manifestRoot = null, key = null, platform = null } = {}) {
   if (key) return { key: String(key).trim(), source: 'argument', error: null };
 
   const fromEnv = env.AEGIS_AGENT_KEY;
@@ -350,7 +393,9 @@ export function resolveAgentKey({ env = process.env, manifestRoot = null, key =
   }
   let mode = null;
   try { mode = st.mode & 0o777; } catch { /* non-POSIX */ }
-  if (mode !== null && (mode & GROUP_OTHER_BITS)) {
+  // Skipped where the mode is synthesised (see hasPosixModes): the test is true
+  // for every file on Windows, so it refused the key on every read there.
+  if (hasPosixModes(platform) && mode !== null && (mode & GROUP_OTHER_BITS)) {
     return {
       key: '',
       source: file,
@@ -368,13 +413,17 @@ export function resolveAgentKey({ env = process.env, manifestRoot = null, key =
   return { key: value, source: file, error: null };
 }
 
-export function writeAgentKey(key, env = process.env) {
+export function writeAgentKey(key, env = process.env, platform = null) {
   const file = path.join(aegisHome(env), KEY_FILE_REL);
   fs.mkdirSync(path.dirname(file), { recursive: true, mode: DIR_MODE });
   fs.writeFileSync(file, `${key}\n`, { mode: KEY_FILE_MODE });
   fs.chmodSync(file, KEY_FILE_MODE); // writeFileSync's mode is masked by umask
-  const after = fs.statSync(file).mode & 0o777;
-  if (after !== KEY_FILE_MODE) throw new Error(`key file landed at mode 0${after.toString(8)}, expected 0600`);
+  // The re-read assert only means something where stat reports what chmod wrote;
+  // on Windows it reports 0666 for this 0600 file, so this threw on every init.
+  if (hasPosixModes(platform)) {
+    const after = fs.statSync(file).mode & 0o777;
+    if (after !== KEY_FILE_MODE) throw new Error(`key file landed at mode 0${after.toString(8)}, expected 0600`);
+  }
   return file;
 }
 

package/vendor/env-file.js

@@ -87,6 +87,11 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const credentials = require('./credentials.js');
+// `hasPosixModes()` — on Windows fs.stat's mode is synthesised from the read-only
+// attribute, so 0o666 comes back for every file and the group/other test below is
+// always true. Reporting a Windows user's .env as world-readable on every single
+// load is a false alarm they cannot act on.
+const platform = require('./platform.js');
 
 const ENV_FILE = '.env';
 
@@ -339,8 +344,9 @@ function loadEnvFile(o = {}) {
     const st = fs.statSync(file);
     result.mode = st.mode & 0o777;
     // Group- or world-readable: worth one line to the user, never a rewrite of
-    // a file we did not create.
-    result.loose = (st.mode & 0o077) !== 0;
+    // a file we did not create. Only asked where the answer can be true or false
+    // (see the platform require above).
+    result.loose = platform.hasPosixModes() && (st.mode & 0o077) !== 0;
   } catch { /* stat is advisory only */ }
 
   const parsed = parseEnvText(text);
@@ -406,7 +412,7 @@ function loadForeignSecrets(o = {}) {
   try {
     const st = fs.statSync(file);
     result.mode = st.mode & 0o777;
-    result.loose = (st.mode & 0o077) !== 0;
+    result.loose = platform.hasPosixModes() && (st.mode & 0o077) !== 0;
   } catch { /* advisory */ }
 
   const parsed = parseEnvText(text);
@@ -708,7 +714,8 @@ function setEnvValue(name, value, o = {}) {
   out.changed = true;
   out.replaced = replaced;
   out.mode = SECRET_FILE_MODE;
-  out.tightened = !out.created && previousMode !== 0 && (previousMode & 0o077) !== 0;
+  out.tightened =
+    platform.hasPosixModes() && !out.created && previousMode !== 0 && (previousMode & 0o077) !== 0;
   if (o.apply !== false) {
     env[name] = secret;
     // Just written to the file and applied here: file-sourced (see above).