aegis-desktop 0.8.20 → 0.8.21

package/lib/local/engine.js

@@ -80,6 +80,107 @@ try {
   }
 }
 
+// The ONE platform module (client/platform.js), resolved the same two ways, for
+// `desktopDir()` — the environment preamble names the user's REAL Desktop so a
+// model asked to put a file there stops guessing `~/Desktop`, which is wrong
+// under OneDrive redirection on Windows and on any localised Linux session.
+let platformLib = null;
+try {
+  platformLib = require('../../../client/platform.js');
+} catch {
+  try {
+    platformLib = require('../../vendor/platform.js');
+  } catch {
+    platformLib = null;
+  }
+}
+
+/**
+ * The environment facts the model needs to stop asking which OS it is on.
+ *
+ * Module scope, not a closure inside `createLocalEngine`, because there are now
+ * TWO hosts that must state these facts the same way: the desktop engine (whose
+ * `envFor` below is this function with the host's own `env` bag) and the CLI
+ * (`cli/src/app.js`), which had no environment block at all. A second copy over
+ * there is precisely how the two hosts would drift — the Windows report that
+ * started this ("it still writes to /home/you/... on my PC") was the CLI path,
+ * where a Linux-shaped persona was built from `process.platform` and nothing
+ * else.
+ *
+ * Everything is best-effort: a missing field is simply omitted, never guessed.
+ *
+ *   base      the host's own env bag   ({ platform, homedir, cwd, … } or {})
+ *   supplied  a per-turn override bag  (payload.env; wins key by key)
+ *   payload   the turn payload, for `model`
+ */
+/**
+ * Resolve a tool call's path arguments, tolerating an injected tools module that
+ * does not implement it.
+ *
+ * `createLocalEngine({ tools })` accepts a PARTIAL tool layer — the engine tests
+ * inject `{ MUTATING_TOOLS, executeTool, toolsFor }` and nothing else — so
+ * calling `T.normalizeArgs` unconditionally turns every such caller into a
+ * TypeError. The injected module's own implementation wins when it has one; the
+ * real tools.js is the fallback, because path resolution is a property of the
+ * MACHINE (client/platform.js) and not of which executors a caller supplied.
+ */
+function normalizeToolArgs(T, name, args, ctx) {
+  const fn =
+    (T && typeof T.normalizeArgs === 'function' && T.normalizeArgs) ||
+    (typeof toolsModule.normalizeArgs === 'function' && toolsModule.normalizeArgs) ||
+    null;
+  if (!fn) return { ok: true, args: args && typeof args === 'object' ? args : {}, error: null };
+  return fn(name, args, ctx);
+}
+
+function hostEnv(base = {}, supplied = {}, payload = null) {
+  const b = base || {};
+  const s = supplied || {};
+  const pick = (key, value) => (s[key] != null ? s[key] : value);
+  let homedir = b.homedir;
+  let cwd = b.cwd;
+  try {
+    if (!homedir) homedir = os.homedir();
+    if (!cwd) cwd = process.cwd();
+  } catch {
+    /* keep whatever we have */
+  }
+  // The shell the `exec` tool really runs in, from the module that decides it
+  // (shell.js resolveSessionShell) rather than a second guess here: on win32
+  // that is PowerShell, and a model told nothing reaches for `ls`/`cat`/`grep`
+  // — commands that do not exist there. Best-effort; a failed probe simply
+  // omits the line.
+  let shellName = b.shell;
+  let shellKind = b.shellKind;
+  try {
+    if (!shellName || !shellKind) {
+      const spec = require('./shell.js').resolveSessionShell();
+      shellName = shellName || spec.cmd;
+      shellKind = shellKind || spec.kind;
+    }
+  } catch {
+    /* no shell line */
+  }
+  let desktopdir = b.desktopdir;
+  try {
+    if (!desktopdir && platformLib) desktopdir = platformLib.desktopDir();
+  } catch {
+    /* no desktop line */
+  }
+  return {
+    platform: pick('platform', b.platform || process.platform),
+    arch: pick('arch', b.arch || process.arch),
+    homedir: pick('homedir', homedir),
+    desktopdir: pick('desktopdir', desktopdir),
+    cwd: pick('cwd', cwd),
+    shell: pick('shell', shellName),
+    shellKind: pick('shellKind', shellKind),
+    roots: pick('roots', b.roots),
+    appVersion: pick('appVersion', b.appVersion),
+    model: pick('model', payload && payload.model),
+  };
+}
+
 /**
  * The shared pooled-brain selection rule (`client/brain-catalog.js`), resolved
  * the same two ways as every other shared module: repo-relative from a source
@@ -773,6 +874,13 @@ function createLocalEngine({
    * channel — the same reason it works identically in the GUI and the CLI.
    */
   async function guardedExecute(name, args, toolCtx) {
+    // Resolve `~/…` and refuse a foreign-OS path BEFORE anything below reads it
+    // (tools.js normalizeArgs; idempotent, so executeTool normalising again is a
+    // no-op). The covenant assert and recordWrite both inspect `args.file_path`,
+    // and a path they rule on must be the path that actually gets written.
+    const norm = normalizeToolArgs(T, name, args, toolCtx || {});
+    if (!norm.ok) return { ok: false, error: norm.error };
+    args = norm.args;
     const guard = toolCtx && toolCtx.guard;
     if (guard && name === 'exec') {
       const verdict = blocksDestructive(guard, args && args.command);
@@ -816,7 +924,13 @@ function createLocalEngine({
   }
 
   async function gatedExecuteTool(call, { toolCtx, rootSessionId, rootOnDelta, signal }) {
-    const { name, args } = call;
+    const { name } = call;
+    // Same normalisation as guardedExecute, and for the same reason one layer
+    // up: the diff the user approves is rendered from this path, the hash guard
+    // re-reads it, and recordWrite claims it. All three must mean one file.
+    const normalized = normalizeToolArgs(T, name, call.args, toolCtx || {});
+    if (!normalized.ok) return { ok: false, error: normalized.error };
+    const args = normalized.args;
     if (!T.MUTATING_TOOLS.has(name)) return guardedExecute(name, args, toolCtx);
     if (!confirmModeEnabled()) return guardedExecute(name, args, toolCtx);
     if (sessionAllows(rootSessionId, name)) return guardedExecute(name, args, toolCtx);
@@ -830,7 +944,7 @@ function createLocalEngine({
 
     let preview = null;
     if (name === 'writeFile' || name === 'editFile') {
-      preview = T.previewMutation(name, args);
+      preview = T.previewMutation(name, args, toolCtx || {});
       if (!preview.ok) return { ok: false, error: preview.error };
     }
 
@@ -853,7 +967,7 @@ function createLocalEngine({
     if (decision === 'session') allowForSession(rootSessionId, name);
 
     if (preview) {
-      const res = T.applyChecked(name, args, preview);
+      const res = T.applyChecked(name, args, preview, toolCtx || {});
       // Recorded on the same condition as guardedExecute's path: only a write
       // that landed is this session's. (The previous form returned here
       // unconditionally, making every line below it unreachable — the
@@ -1039,26 +1153,7 @@ function createLocalEngine({
    * Everything is best-effort: a missing field is simply omitted.
    */
   function envFor(payload) {
-    const supplied = (payload && payload.env) || {};
-    const base = env || {};
-    const pick = (key, value) => (supplied[key] != null ? supplied[key] : value);
-    let homedir = base.homedir;
-    let cwd = base.cwd;
-    try {
-      if (!homedir) homedir = os.homedir();
-      if (!cwd) cwd = process.cwd();
-    } catch {
-      /* keep whatever we have */
-    }
-    return {
-      platform: pick('platform', base.platform || process.platform),
-      arch: pick('arch', base.arch || process.arch),
-      homedir: pick('homedir', homedir),
-      cwd: pick('cwd', cwd),
-      roots: pick('roots', base.roots),
-      appVersion: pick('appVersion', base.appVersion),
-      model: pick('model', payload && payload.model),
-    };
+    return hostEnv(env || {}, (payload && payload.env) || {}, payload);
   }
 
   /** One transport round for the chosen class. */
@@ -1938,4 +2033,4 @@ function createLocalEngine({
   };
 }
 
-module.exports = { CLASSES, createLocalEngine, extractToolCalls, parseArgs, reasoningBudget, nativeEffort };
+module.exports = { CLASSES, createLocalEngine, extractToolCalls, parseArgs, reasoningBudget, nativeEffort, hostEnv };

package/lib/local/local.js

@@ -59,41 +59,290 @@ function baseOf(baseURL) {
 }
 
 /**
- * DeepSeek's chat template (also the one a locally-pulled `deepseek-*` Ollama
- * model uses) wraps tool calls and turn boundaries in special tokens —
- * fullwidth pipe (U+FF5C) delimiting an identifier that uses ▁ (U+2581) as its
- * word separator, e.g. ｜tool▁calls▁begin｜, ｜tool▁call▁end｜, ｜Assistant｜,
- * ｜begin▁of▁sentence｜. These are chat-template internals, never user-facing
- * text; when the local daemon's tool-call path leaks them into `delta.content`
- * they used to reach the screen verbatim — reported as the pasted
- * "｜｜DSML｜｜" envelope. Returns a per-turn stripper closure with a short
- * lookback buffer so a token split across two SSE chunks isn't half-rendered
- * before its closing pipe arrives.
+ * DeepSeek (also the chat template a locally-pulled `deepseek-*` Ollama model
+ * uses) emits its tool calls as DSML — an XML-ish dialect that the
+ * OpenAI-compatible wire format does NOT structure for us:
+ *
+ *     <｜DSML｜tool_calls>
+ *     <｜DSML｜invoke name="write">
+ *     <｜DSML｜parameter name="path" string="true">src/app.js</｜DSML｜parameter>
+ *     <｜DSML｜parameter name="content" string="true">…the file body…</｜DSML｜parameter>
+ *     </｜DSML｜invoke>
+ *     </｜DSML｜tool_calls>
+ *
+ * It arrives as plain `delta.content` text, and that produces two failures:
+ * the markup rendering verbatim (reported as the pasted "｜｜DSML｜｜" envelope),
+ * and the call itself never running because text is not a tool call. Ported
+ * from aegiscodex-dev's src/backend.js (also client/aegis.js, the other
+ * transport this engine shares), which carries the full history of this
+ * grammar's quirks (provider/template/model revision disagree about the exact
+ * identifier, angle brackets sometimes absent, tag names drift under
+ * sampling) — every part of the pattern below is deliberately optional and
+ * spacing-insensitive for that reason. `string="false"` marks a JSON
+ * parameter; `string="true"` (or an absent attribute) is the literal value,
+ * kept verbatim so a multi-line `content` is never mangled by a JSON
+ * round-trip.
+ */
+// `\b` after each tag-name alternative matters: without it, "call" matches as
+// a bare PREFIX of a drifted wrapper tag like "calls" (observed verbatim —
+// `<｜｜ calls>`, no "tool_"/"function_" prefix at all), swallowing everything
+// up to the next real `</invoke>` as that spurious match's unnamed body and
+// silently discarding a whole tool call with it. "call" and "calls" are both
+// word characters, so plain alternation order cannot tell them apart.
+const DSML_RE_INVOKE = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call)\b\s*([^>]*?)\s*>([\s\S]*?)<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call)\b\s*>/g;
+const DSML_RE_PARAM = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*([^>]*?)\s*>([\s\S]*?)<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*>/g;
+const DSML_RE_LEADER = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*(?:(?:tool|function)[_▁ ]*calls?|reasoning)[_▁ ]*(?:begin|end)?\s*>/gi;
+const DSML_RE_ANY_TAG = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*[A-Za-z_][A-Za-z0-9_]*[^>]{0,120}>/g;
+const DSML_RE_SKELETON = /<\s*\/?\s*(?:tool_calls|function_calls|invoke|parameter|param|reasoning)\b[^>]{0,120}>/gi;
+const DSML_RE_JSON_CALLS = /｜[ \t]*(?:tool|function)[_▁ ]*calls?[_▁ ]*begin[ \t]*｜([\s\S]*?)｜[ \t]*(?:tool|function)[_▁ ]*calls?[_▁ ]*end[ \t]*｜/gi;
+const DSML_RE_ENVELOPE_TOKEN = /｜[ \t]?[A-Za-z0-9_▁]*[ \t]?｜/g;
+const DSML_RE_DRIFT_INVOKE = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call)\b\s*([^>]*?)\s*>/gi;
+const DSML_RE_DRIFT_PARAM = /<\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*([^>]*?)\s*>/gi;
+const DSML_RE_PARAM_CLOSE = /<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:parameter|param|arg)\b\s*>/gi;
+const DSML_RE_ATTR = /([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+const DSML_RE_STRUCT_TAG = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call|parameter|param|arg|reasoning|(?:tool|function)[_▁ ]*calls?)\b/gi;
+const DSML_RE_STRUCT_CLOSER = /<\s*\/\s*｜\s*(?:DSML\s*)?｜\s*(?:invoke|call|tool_call|parameter|param|arg|reasoning|(?:tool|function)[_▁ ]*calls?)\b/gi;
+/**
+ * A COMPLETE (its own '>' has arrived) wrapper/leader tag that carries no
+ * call of its own — observed verbatim: a bare `<｜｜calls>`, with neither a
+ * "tool_"/"function_" prefix (so DSML_RE_LEADER above misses it) nor a JSON
+ * envelope pair. Safe to drop the moment it closes, UNLIKE invoke/parameter —
+ * excluded here via negative lookahead so a *partial* invoke/parameter head is
+ * never erased before its own close has a chance to pair it up with
+ * DSML_RE_INVOKE/DSML_RE_PARAM on a later call once more of it has arrived.
+ */
+const DSML_RE_WRAPPER_TAG = /<\s*\/?\s*｜\s*(?:DSML\s*)?｜\s*(?!(?:invoke|call|tool_call|parameter|param|arg)\b)[A-Za-z_][A-Za-z0-9_]*[^>]{0,120}>/g;
+/** A '<' (or '</') at the tail: the head of a tag whose pipe is still in flight. */
+const DSML_RE_TRAILING_LT = /<\s*\/?\s*$/;
+/** An in-flight identifier token: a pipe whose partner has not arrived yet. */
+const DSML_RE_OPEN_TOKEN = /^｜[ \t]?[A-Za-z0-9_▁]*[ \t]?$/;
+/** Past this much buffered markup, a held tail is released as-is. */
+const DSML_HOLD_MAX = 4 * 1024 * 1024;
+
+/** The attributes of one tag head, lower-cased: name="write" → { name: 'write' }. */
+function dsmlAttrs(text) {
+  const out = {};
+  if (!text) return out;
+  DSML_RE_ATTR.lastIndex = 0;
+  let m;
+  while ((m = DSML_RE_ATTR.exec(text))) out[m[1].toLowerCase()] = m[2] != null ? m[2] : m[3];
+  return out;
+}
+
+/** A JSON parameter — or, when it is not JSON after all, the text it came as. */
+function dsmlJson(raw) {
+  const s = String(raw == null ? '' : raw).trim();
+  try {
+    const v = JSON.parse(s);
+    return v === undefined ? s : v;
+  } catch {
+    return s;
+  }
+}
+
+/** The `parameter` tags of one `invoke` body, as a tool call's args object. */
+function dsmlArgs(body) {
+  const args = {};
+  DSML_RE_PARAM.lastIndex = 0;
+  let p;
+  while ((p = DSML_RE_PARAM.exec(body))) {
+    const a = dsmlAttrs(p[1]);
+    const key = a.name || a.key || `arg${Object.keys(args).length}`;
+    const isJson = String(a.string || '').toLowerCase() === 'false' || String(a.json || '').toLowerCase() === 'true';
+    args[key] = isJson ? dsmlJson(p[2]) : p[2];
+  }
+  return args;
+}
+
+/**
+ * Decode every DSML tool call in `text` and return the two things a caller
+ * needs: what may be shown, and what must be executed — `{ text, calls }`.
+ * The generic `｜…｜` tokens are deliberately left in place here: an `invoke`
+ * block still arriving is identified by its delimiters on the next pass, and
+ * eating them early would lose the call's name and arguments. They are
+ * removed from the *released* text instead (see dsmlResidue).
+ */
+function decodeDeepSeekDSML(input) {
+  if (typeof input !== 'string' || !input || input.indexOf('｜') === -1) {
+    return { text: input || '', calls: [] };
+  }
+  const calls = [];
+  let text = input;
+
+  // 1. One `invoke` block per call, the well-formed spelling.
+  DSML_RE_INVOKE.lastIndex = 0;
+  const spans = [];
+  let m;
+  while ((m = DSML_RE_INVOKE.exec(text))) {
+    const a = dsmlAttrs(m[1]);
+    const name = a.name || a.function || a.tool || '';
+    if (name) calls.push({ name, args: dsmlArgs(m[2]) });
+    spans.push([m.index, m.index + m[0].length]);
+  }
+  for (let i = spans.length - 1; i >= 0; i--) {
+    text = text.slice(0, spans[i][0]) + text.slice(spans[i][1]);
+  }
+
+  // 2. The older spelling: a JSON array wrapped in envelope tokens.
+  text = text.replace(DSML_RE_JSON_CALLS, (full, body) => {
+    const parsed = dsmlJson(body);
+    const list = Array.isArray(parsed) ? parsed : (parsed && Array.isArray(parsed.tool_calls) ? parsed.tool_calls : []);
+    for (const c of list) {
+      const fn = (c && c.function) || c || {};
+      const name = fn.name || (c && c.name) || '';
+      if (!name) continue;
+      let args = fn.arguments != null ? fn.arguments : (c && c.arguments);
+      if (typeof args === 'string') args = dsmlJson(args);
+      calls.push({ name, args: args && typeof args === 'object' ? args : {} });
+    }
+    return '';
+  });
+
+  // 3. The wrapper tags carry no call of their own.
+  text = text.replace(DSML_RE_LEADER, '');
+  return { text, calls };
+}
+
+/**
+ * Last-resort decode for markup that drifted out of well-formedness: a missing
+ * closing tag, or a stream cut mid-call. The call still names a tool and its
+ * parameters are still readable, so it is decoded rather than deleted — a call
+ * that reached the wire must not vanish because its closing tag did.
+ */
+function decodeDeepSeekDSMLDrift(input) {
+  if (typeof input !== 'string' || !input || input.indexOf('｜') === -1) return { text: input || '', calls: [] };
+  const opens = [];
+  DSML_RE_DRIFT_INVOKE.lastIndex = 0;
+  let m;
+  while ((m = DSML_RE_DRIFT_INVOKE.exec(input))) {
+    opens.push({ at: m.index, attrs: m[1], body: DSML_RE_DRIFT_INVOKE.lastIndex });
+  }
+  if (!opens.length) return { text: input, calls: [] };
+  const calls = [];
+  let text = '';
+  let cursor = 0;
+  for (let i = 0; i < opens.length; i++) {
+    // One call runs to the next `invoke` head, or to the end of the text.
+    const end = i + 1 < opens.length ? opens[i + 1].at : input.length;
+    const body = input.slice(opens[i].body, end);
+    const a = dsmlAttrs(opens[i].attrs);
+    const name = a.name || a.function || a.tool || '';
+    const args = {};
+    const params = [];
+    DSML_RE_DRIFT_PARAM.lastIndex = 0;
+    let pm;
+    while ((pm = DSML_RE_DRIFT_PARAM.exec(body))) {
+      params.push({ at: pm.index, attrs: pm[1], from: DSML_RE_DRIFT_PARAM.lastIndex });
+    }
+    for (let k = 0; k < params.length; k++) {
+      // A value runs to the next parameter tag — its closing tag may be the
+      // thing that never arrived.
+      const stop = k + 1 < params.length ? params[k + 1].at : body.length;
+      const raw = body.slice(params[k].from, stop).replace(DSML_RE_PARAM_CLOSE, '');
+      const pa = dsmlAttrs(params[k].attrs);
+      const key = pa.name || pa.key || `arg${Object.keys(args).length}`;
+      const isJson = String(pa.string || '').toLowerCase() === 'false';
+      args[key] = isJson ? dsmlJson(raw) : raw;
+    }
+    text += input.slice(cursor, opens[i].at);
+    cursor = end;
+    if (name) calls.push({ name, args });
+  }
+  text += input.slice(cursor);
+  return { text, calls };
+}
+
+/**
+ * Residue removal for text that is about to be shown. Two spellings have to go:
+ * a leftover envelope token (`｜DSML｜`, `｜tool▁calls▁begin｜`, `｜Assistant｜`),
+ * and the skeleton an earlier release left behind by stripping the delimiters
+ * out of a DSML block — `<tool_calls> <invoke name="write"> <parameter …>`,
+ * which is exactly what a user pasted back at us.
+ */
+function dsmlResidue(text) {
+  if (!text) return text;
+  if (text.indexOf('｜') === -1) return text.replace(DSML_RE_SKELETON, '');
+  return text.replace(DSML_RE_ANY_TAG, '').replace(DSML_RE_SKELETON, '').replace(DSML_RE_ENVELOPE_TOKEN, '');
+}
+
+/**
+ * Is the buffer, read from the first `｜` in it, a construct that is still
+ * arriving? Only two shapes may be held back: a pipe whose partner has not
+ * arrived, and a DSML opener whose matching close has not landed. Everything
+ * else is prose — a `｜` in an answer is a character, not a promise of markup,
+ * and holding the rest of the answer behind it would swallow the reply.
+ */
+function dsmlUnterminated(s) {
+  if (DSML_RE_OPEN_TOKEN.test(s)) return true;
+  const openers = (s.match(DSML_RE_STRUCT_TAG) || []).length;
+  const closers = (s.match(DSML_RE_STRUCT_CLOSER) || []).length;
+  return openers > closers;
+}
+
+/**
+ * Where, if anywhere, an in-flight DSML construct still needs the rest of the
+ * buffer held back from view. By the time this runs, decodeDeepSeekDSML() has
+ * already removed every COMPLETE invoke/parameter span and the caller has
+ * already removed every complete non-invoke wrapper tag (DSML_RE_WRAPPER_TAG),
+ * so whatever is left can only be: clean prose, or the start of exactly ONE
+ * incomplete construct running to the end of the buffer — an opener whose own
+ * '｜' has arrived but not its '>' (`<\s*\/?\s*｜`, found wherever it starts,
+ * not just at the tail: a Write's `content` can be arbitrarily long, so the
+ * unresolved opener is usually far behind the cursor, not at it), a '<' that
+ * arrived with no '｜' yet (the chunk boundary landed first), or a bare pipe
+ * token still accumulating its identifier (the plain envelope-leak case, e.g.
+ * '｜tool▁cal'). Returns -1 when none apply — safe to release in full.
+ */
+function dsmlHoldFrom(buf) {
+  const tagStart = buf.search(/<\s*\/?\s*｜/);
+  if (tagStart !== -1) return tagStart;
+  const lt = DSML_RE_TRAILING_LT.exec(buf);
+  if (lt) return lt.index;
+  const openIdx = buf.indexOf('｜');
+  if (openIdx !== -1 && dsmlUnterminated(buf.slice(openIdx))) return openIdx;
+  return -1;
+}
+
+/**
+ * The per-turn stripper this transport uses. Feed it each `delta.content`
+ * chunk: it returns the text that is safe to show, holds back whatever is
+ * still arriving (a Write's `content` parameter is a whole file — it belongs
+ * to the call, not to the screen), and collects the tool calls the model made
+ * in text form. `flush()` releases the tail once the stream is drained, and
+ * `calls()` returns everything decoded so far, which the caller merges into
+ * the turn's tool calls so a Write that arrived as DSML is executed like any
+ * other.
  */
-const DEEPSEEK_ENVELOPE_RE = /｜[A-Za-z][A-Za-z0-9]*(?:▁[A-Za-z0-9]+)*｜/g;
 function makeDeepSeekEnvelopeStripper() {
   let buf = '';
+  const calls = [];
   const strip = (chunk) => {
-    buf += chunk;
-    buf = buf.replace(DEEPSEEK_ENVELOPE_RE, '');
-    const openIdx = buf.lastIndexOf('｜');
-    if (openIdx !== -1) {
-      const tail = buf.slice(openIdx);
-      if (tail.length <= 60 && /^｜[A-Za-z0-9▁]*$/.test(tail)) {
-        const out = buf.slice(0, openIdx);
-        buf = tail;
-        return out;
-      }
+    buf += typeof chunk === 'string' ? chunk : '';
+    const dec = decodeDeepSeekDSML(buf);
+    buf = dec.text;
+    for (const c of dec.calls) calls.push(c);
+    buf = buf.replace(DSML_RE_WRAPPER_TAG, '');
+    const hold = dsmlHoldFrom(buf);
+    let out;
+    if (hold !== -1 && buf.length - hold <= DSML_HOLD_MAX) {
+      out = buf.slice(0, hold);
+      buf = buf.slice(hold);
+    } else {
+      out = buf;
+      buf = '';
     }
-    const out = buf;
-    buf = '';
-    return out;
+    return dsmlResidue(out);
   };
   strip.flush = () => {
-    const out = buf;
+    const dec = decodeDeepSeekDSML(buf);
     buf = '';
-    return out;
+    for (const c of dec.calls) calls.push(c);
+    const drift = decodeDeepSeekDSMLDrift(dec.text);
+    for (const c of drift.calls) calls.push(c);
+    return dsmlResidue(drift.text);
   };
+  /** Every tool call decoded from text so far, as `{ name, args }`. */
+  strip.calls = () => calls.slice();
   return strip;
 }
 
@@ -463,12 +712,29 @@ async function chat({
   const message = { role: 'assistant', content };
   if (toolCalls.length) message.tool_calls = toolCalls;
 
-  return {
+  // DSML calls arrive as plain text, decoded by stripEnvelope rather than
+  // accumulated by index like structured delta.tool_calls — merged into one
+  // normalised `{ id, name, args }` list so a call that arrived as DSML (a
+  // locally-pulled deepseek-* model with no provider-native delta.tool_calls
+  // at all) is executed like any other. engine.js's extractToolCalls() reads
+  // this field first, ahead of message.tool_calls.
+  const dsmlCalls = stripEnvelope.calls();
+  const result = {
     id: 'local',
     model: String(model),
     choices: [{ index: 0, message, finish_reason: toolCalls.length ? 'tool_calls' : 'stop' }],
     ...(usage ? { usage } : {}),
   };
+  if (toolCalls.length || dsmlCalls.length) {
+    result.toolCalls = [
+      ...toolCalls.map((c) => ({ id: c.id, name: c.function.name, args: c.function.arguments })),
+      ...dsmlCalls.map((c) => ({ id: '', name: c.name, args: c.args || {} })),
+    ];
+    if (dsmlCalls.length && result.choices[0].finish_reason !== 'tool_calls') {
+      result.choices[0].finish_reason = 'tool_calls';
+    }
+  }
+  return result;
 }
 
 module.exports = {

package/lib/local/prompt.js

@@ -61,7 +61,11 @@ const MAIN_CHAT_PROMPT =
 
 /** The tools the desktop actually advertises (kept in step with tools.js). */
 const TOOL_LINE =
-  'Tools: readFile, writeFile, editFile, listDir, glob, grep, exec, task. Paths are absolute; ' +
+  'Tools: readFile, writeFile, editFile, listDir, glob, grep, exec, task. Paths are absolute and ' +
+  'must be written in the form THIS machine uses — read the platform and home directory in the ' +
+  'Environment block below and use them: on win32 that means C:\\Users\\you\\Desktop\\file.txt, ' +
+  'not /home/you/Desktop/file.txt or /tmp/file.txt. "~" and "~/…" mean the home directory and are ' +
+  'expanded for you; a relative path resolves against the working directory. ' +
   'exec runs in a persistent shell session on this machine — cd and exported env vars carry ' +
   'across calls within the turn, like a real terminal. task spawns a specialist subagent ' +
   '(its own tool loop, same model) for a focused, self-contained piece of work.';
@@ -72,11 +76,25 @@ const TOOL_LINE =
  * the identity block.
  */
 function environmentPreamble(env = {}) {
-  const { platform, arch, homedir, cwd, roots, appVersion, model } = env || {};
+  const { platform, arch, homedir, desktopdir, cwd, shell, shellKind, roots, appVersion, model } =
+    env || {};
   const bits = [];
   if (platform) bits.push(`platform: ${platform}${arch ? ` (${arch})` : ''}`);
   if (homedir) bits.push(`home directory: ${homedir}`);
+  // Named explicitly because `~/Desktop` is a GUESS that is wrong on two of the
+  // three platforms this app ships to: OneDrive folder redirection moves it on
+  // Windows, and a localised Linux session translates the directory itself
+  // (a Swedish desktop has ~/Skrivbord and no ~/Desktop). "Put this on my
+  // desktop" is a real request, and this is the line that makes it land.
+  if (desktopdir) {
+    bits.push(
+      `desktop directory: ${desktopdir} — use this exact path when the user says "my desktop"; ` +
+        'do NOT build it yourself from the home directory, because it is not always a folder ' +
+        'called "Desktop" there',
+    );
+  }
   if (cwd) bits.push(`working directory: ${cwd}`);
+  if (shell) bits.push(`exec shell: ${shell}${shellKind ? ` (${shellKind})` : ''}`);
   if (model) bits.push(`model: ${model}`);
   if (appVersion) bits.push(`AEGIS Desktop ${appVersion}`);
 
@@ -86,10 +104,40 @@ function environmentPreamble(env = {}) {
   if (rootList.length) {
     lines.push(`repo roots:\n${rootList.map((r) => `  - ${r}`).join('\n')}`);
   }
+  // The command dialect, stated as an instruction rather than left for the model
+  // to infer from `platform: win32`. Inference is what failed: a model handed a
+  // Windows machine still reached for `ls`, `cat`, `grep` and `mkdir -p`, none
+  // of which exist in PowerShell, so every exec call failed until it guessed.
+  const dialect = commandDialectLine(platform, shellKind);
+  if (dialect) lines.push(dialect);
   if (!lines.length) return '';
   return `# Environment\n${lines.join('\n')}`;
 }
 
+/**
+ * How `exec` commands must be written on this host. Empty when the platform is
+ * unknown — a guess here would be worse than silence.
+ */
+function commandDialectLine(platform, shellKind) {
+  if (!platform) return '';
+  if (platform === 'win32') {
+    return (
+      `This is Windows: exec runs ${shellKind === 'powershell' ? 'PowerShell' : 'a Windows shell'}, ` +
+      'so use Windows-native commands — Get-ChildItem/dir, Get-Content/type, Select-String/findstr, ' +
+      'where, New-Item -ItemType Directory — NOT ls, cat, grep, mkdir -p, touch or rm -rf, which do ' +
+      'not exist here. Separate paths with \\, and never assume /tmp, /usr or /home exist.'
+    );
+  }
+  if (platform === 'darwin') {
+    return (
+      'This is macOS: exec runs a POSIX shell and the standard Unix commands are available, but the ' +
+      'userland is BSD, not GNU — sed -i needs an argument (sed -i \'\'), and readlink -f, ' +
+      'date -d and sed -r are absent. Prefer portable forms, or python3.'
+    );
+  }
+  return 'This is a POSIX host: the standard Unix commands are available in exec.';
+}
+
 /**
  * The full system prompt for a desktop chat turn: identity + work rules +
  * the tool line + the environment block. Never empty.
@@ -105,5 +153,6 @@ module.exports = {
   MAIN_CHAT_PROMPT,
   TOOL_LINE,
   environmentPreamble,
+  commandDialectLine,
   buildSystemPrompt,
 };