aegis-desktop 1.0.0 → 1.0.2

package/bin/aegis.js

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/auto.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/companion.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/cosmetics.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/events.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/holder-turn.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/holders.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/identity.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/level.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/mirror.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/persona.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/profile.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/register.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/store.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/tiers.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/transfer.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/turn.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/voice.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/avatar/xp.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/deep-link.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/fingerprint.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/aegis-seal.mjs

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 /**
  * aegis-seal.mjs — codec for ÆL/1 (AEGIS Encoded Language)
  *

package/lib/local/agents.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/autonomous.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/context.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/covenant.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/engine.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**
@@ -335,6 +340,33 @@ function requireSharedUserModels() {
   throw last;
 }
 
+/**
+ * The vendor-list helper (`client/model-discovery.js`) — the module that asks a
+ * provider's OWN API which model ids exist, so a desktop user is not asked to
+ * recall an id the vendor publishes at a URL. Same resolution rule as the two
+ * catalog modules above, for the same reason: the CLI's `/model-discover` reads
+ * this one module too, so the terminal and the window cannot answer "what does
+ * this key reach" differently.
+ *
+ * It does no I/O at load time (no key store, no network), so requiring it here
+ * costs the window nothing until a user asks for a list.
+ */
+function requireSharedModelDiscovery() {
+  const candidates = [
+    () => require('../../../client/model-discovery.js'),
+    () => require('../../vendor/model-discovery.js'),
+  ];
+  let last = null;
+  for (const load of candidates) {
+    try {
+      return load();
+    } catch (err) {
+      last = err;
+    }
+  }
+  throw last;
+}
+
 /**
  * How long a turn waits for the working-tree lock before running anyway.
  *
@@ -614,6 +646,12 @@ const {
   addUserModel,
   removeUserModel,
 } = requireSharedUserModels();
+const {
+  discoverModels: discoverVendorModels,
+  canDiscover: canDiscoverVendorModels,
+  endpointFor: vendorEndpointFor,
+  discoverableProviders,
+} = requireSharedModelDiscovery();
 
 // ── Agent-loop helpers ──────────────────────────────────────────────────────
 
@@ -941,6 +979,12 @@ function createLocalEngine({
   // caller (desktop/main.js, the CLI's deps.js) wires the local class by
   // simply existing.
   localTransport: localT = localTransport,
+  // Injectable for tests (and for a host that fronts the network itself): the
+  // fetch used ONLY by `discoverModels`, which asks a vendor's list API. Every
+  // other request in this file goes through `localT`, so this is deliberately
+  // not the transport — discovery is an outbound call to api.<vendor>, not to
+  // the AEGIS relay. Undefined in production, which means the global fetch.
+  fetchImpl,
 }) {
   const controllers = new Map(); // sessionId -> AbortController
   const T = tools || toolsModule;
@@ -2556,6 +2600,28 @@ function createLocalEngine({
     return localT.unloadAll();
   }
 
+  /**
+   * The vendor key for a provider, resolved in the order the NEXT TURN will
+   * resolve it: the saved `byok:<provider>` row first, then `~/.aegiscode/.env`
+   * (loaded into the environment at host start-up by `client/env-file.js`) and
+   * the shell. Discovery must ask with the key the call will run on — a list
+   * fetched with a different one describes a catalog this machine cannot reach.
+   *
+   * Read-only by construction: it never writes a key, never hands the value to
+   * a renderer and never logs it.
+   */
+  function byokKeyForProviderLookup(providerId) {
+    const id = String(providerId == null ? '' : providerId).trim().toLowerCase();
+    if (!id) return '';
+    try {
+      if (settings && typeof settings.rawKey === 'function') {
+        const stored = settings.rawKey(byokNamespace(id));
+        if (typeof stored === 'string' && stored.trim()) return stored.trim();
+      }
+    } catch { /* a store that throws has no key, and that is a reportable state */ }
+    return providerKeyFromEnv(id);
+  }
+
   return {
     CLASSES,
     listClasses,
@@ -2582,6 +2648,69 @@ function createLocalEngine({
     userModels: () => loadUserModels(),
     addUserModel: (provider, model) => addUserModel(provider, model),
     removeUserModel: (provider, model) => removeUserModel(provider, model),
+    // ── asking the vendor, so the user does not have to remember ids ───────
+    //
+    // `discoverModels(provider)` resolves and returns the ids the provider's own
+    // list API serves RIGHT NOW, which is the fix for the chore that produced
+    // `client/byok-catalog.js`'s hand-copied Anthropic table. It never throws:
+    // the shape is the discovery module's own
+    // `{ ok, provider, ids, others, count }` / `{ ok:false, error }`, and the
+    // renderer prints `error` verbatim. A window that guessed at an id and
+    // silently pinned a 404 is the outcome this exists to prevent.
+    //
+    // The key comes from the SAME chain the next turn will use (the saved
+    // `byok:<provider>` row, then `~/.aegiscode/.env`, then the shell), because
+    // a list fetched with a different key than the call runs on would describe
+    // somebody else's catalog.
+    discoverModels: async (provider) => {
+      const id = String(provider == null ? '' : provider).trim().toLowerCase();
+      const key = byokKeyForProviderLookup(id);
+      const res = await discoverVendorModels(id, { key, fetchImpl });
+      // Say what the caller needs to offer the next step: which of these the
+      // relay itself already lists, and which this machine has declared, so the
+      // UI can mark a row instead of the user diffing two lists by eye.
+      if (!res || !res.ok) return res;
+      const declared = [];
+      try {
+        const map = loadUserModels().map;
+        for (const m of Array.isArray(map[id]) ? map[id] : []) declared.push(m);
+      } catch { /* a store that cannot be read marks nothing */ }
+      return { ...res, declared, endpoint: (vendorEndpointFor(id) || {}).url || '' };
+    },
+    // The bulk write (`/model-add <provider> '*'` and the desktop's "Add all"
+    // button): declare every id in one pass, skipping what is already there and
+    // NAMING what was refused rather than aborting the whole batch on one bad
+    // row. Returns counts, never a bare boolean, so both faces can report
+    // "3 added, 2 already declared" instead of claiming work they did not do.
+    addUserModels: (provider, ids) => {
+      const list = Array.isArray(ids) ? ids : [];
+      const out = { provider, added: 0, already: [], failed: [], capped: 0, file: '' };
+      for (const raw of list) {
+        try {
+          const res = addUserModel(provider, raw);
+          out.file = res.file || out.file;
+          if (res.added) out.added += 1;
+          else out.already.push(res.model);
+        } catch (err) {
+          const message = (err && err.message) || String(err);
+          // The store's per-provider ceiling ends the batch as a CEILING. A
+          // vendor serves a hundred ids and the store holds 32, so reporting
+          // that as sixty-eight refused models would describe one deliberate
+          // limit as sixty-eight broken ids.
+          if (/the cap/.test(message)) {
+            out.capped = list.length - out.added - out.already.length - out.failed.length;
+            break;
+          }
+          out.failed.push({ id: String(raw), reason: message });
+        }
+      }
+      return out;
+    },
+    // What the Settings row uses to decide whether to OFFER a list at all: a
+    // provider this client cannot ask (or has no key for) falls back to the
+    // free-form input, which is the path that always works.
+    canDiscoverModels: (provider) => canDiscoverVendorModels(provider),
+    discoverableProviders: () => discoverableProviders(),
   };
 }
 

package/lib/local/entitlement.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/git-scope.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/local.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/prompt.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/queue.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/session-rounds.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**

package/lib/local/shell.js

@@ -1,3 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
 'use strict';
 
 /**
@@ -280,10 +285,34 @@ const SHELL_CACHE = new Map();
 function resolveSessionShell(options = {}) {
   const o = shellSeams(options);
   if (o.platform === 'win32') {
-    const spec = platform.shellSpec({ platform: 'win32', env: o.env });
+    const cmdSpec = platform.shellSpec({ platform: 'win32', env: o.env });
     const powershell =
       platform.resolveExecutable('powershell', { platform: 'win32', env: o.env, exists: o.exists }) ||
       'powershell.exe';
+    // ONE-SHOT NOW SPEAKS THE SESSION'S DIALECT TOO (2026-02-14 report, item 1).
+    //
+    // This used to be `oneShot: cmdSpec` — PowerShell for the session, cmd.exe
+    // for every one-shot — and that mismatch is what made `exec` silently wrong
+    // mid-turn. When the live session died (sentinel timeout, killed child, a
+    // rejected stdin write) the degrade paths below run one-shot, so from that
+    // moment on every remaining command in the turn was parsed by cmd.exe while
+    // the model kept emitting PowerShell quoting. cmd.exe answers
+    // `'"Write-Output \"' is not recognized as an internal or external command`
+    // — localized, so on sv-SE it reads `Felaktig syntax för filnamn, katalognamn
+    // eller volymetikett`, which looks like a filesystem fault and not a shell
+    // change — and nothing in the tool result said the shell had switched.
+    //
+    // `-Command` accepts exactly the quoting the session accepts, so a
+    // degradation is now a transport change and not a language change. cmd.exe
+    // is no longer reachable from this path at all: if PowerShell cannot be
+    // resolved the spawn fails loudly (oneShotShell reports `error: …`) instead
+    // of quietly running the command in a shell that cannot read it.
+    const oneShot = {
+      cmd: powershell,
+      arg: '-Command',
+      kind: 'powershell',
+      source: 'powershell.exe',
+    };
     return {
       ok: true,
       cmd: powershell,
@@ -294,11 +323,16 @@ function resolveSessionShell(options = {}) {
       unsupported: null,
       caveat: null,
       error: null,
-      // One-shot commands on Windows stay cmd.exe: that is what the pre-session
-      // `exec` always used, and PowerShell is only the session's dialect.
-      oneShot: spec,
+      oneShot,
       executed: [],
-      tried: [{ candidate: powershell, ok: true, reason: 'the Windows default (PowerShell session, cmd.exe one-shot)' }],
+      tried: [
+        { candidate: powershell, ok: true, reason: 'the Windows default (PowerShell session AND one-shot)' },
+        {
+          candidate: cmdSpec.cmd,
+          ok: false,
+          reason: 'cmd.exe is never used for one-shot: it cannot parse the PowerShell quoting the session teaches',
+        },
+      ],
     };
   }
 
@@ -363,8 +397,11 @@ function oneShotShellSpec(options = {}) {
     return { ok: false, cmd: null, arg: null, kind: null, error: spec.error, spec };
   }
   if (spec.kind === 'powershell') {
-    const cmdSpec = platform.shellSpec({ platform: 'win32', env: shellSeams(options).env });
-    return { ok: true, cmd: cmdSpec.cmd, arg: cmdSpec.arg, kind: 'cmd', error: null, spec };
+    // The session's own one-shot spec (PowerShell `-Command`), so the `exec`
+    // tool's no-session path and this module's fallback cannot disagree about
+    // the dialect — which is exactly how cmd.exe used to sneak back in.
+    const shot = spec.oneShot || platform.shellSpec({ platform: 'win32', env: shellSeams(options).env });
+    return { ok: true, cmd: shot.cmd, arg: shot.arg, kind: shot.kind || 'powershell', error: null, spec };
   }
   return { ok: true, cmd: spec.cmd, arg: spec.arg, kind: 'posix-sh', error: null, spec };
 }
@@ -412,6 +449,10 @@ class ShellSession {
     this.buf = '';
     this.alive = false;
     this._pending = null; // resolver-scan for the in-flight command
+    this.cwd = cwd || process.cwd();
+    this.disposed = false; // an explicit dispose() must NOT be self-healed
+    this._respawns = 0; // one self-heal attempt per session, never a loop
+    this._degradedNoted = false; // the degrade marker is emitted once per session
     this.shellOptions = shellOptions || {};
     // Resolved BEFORE anything is spawned or written: `shell.kind` is what the
     // command framing below branches on, so an unverified `$SHELL` can never
@@ -485,7 +526,21 @@ class ShellSession {
       if (!this.alive && this.shellError) {
         return Promise.resolve({ content: this.shellError, isError: true });
       }
-      return oneShotShell({ command, timeout, working_directory, shellOptions: this.shellOptions });
+      // SELF-HEAL BEFORE DEGRADING. The old path latched: once the live session
+      // died (a timeout kill, a child exit, a spawn error) every remaining
+      // command in the turn ran one-shot, and on Windows that one-shot used to
+      // be cmd.exe — so the agent stayed silently wrong for the rest of the
+      // turn. Re-probe and re-spawn ONCE instead, and only then fall through.
+      if (!this.alive && !this.disposed && this._respawns < 1) {
+        this._respawns += 1;
+        this.buf = '';
+        this.shell = resolveSessionShell(this.shellOptions);
+        this.shellError = this.shell.ok ? null : this.shell.error;
+        this._start(this.cwd);
+        if (this.alive) return this.run(command, { timeout, working_directory });
+      }
+      return oneShotShell({ command, timeout, working_directory, shellOptions: this.shellOptions })
+        .then((result) => this._noteDegraded(result, !this.alive ? 'the persistent session is not running' : 'no usable session dialect'));
     }
     let cmd = String(command || '');
 
@@ -557,7 +612,8 @@ class ShellSession {
         this.child.stdin.write(script);
       } catch {
         this.alive = false;
-        oneShotShell({ command, timeout, working_directory, shellOptions: this.shellOptions }).then(finish);
+        oneShotShell({ command, timeout, working_directory, shellOptions: this.shellOptions })
+          .then((r) => finish(this._noteDegraded(r, 'the session stdin rejected the command')));
         return;
       }
       // Data may already be buffered (fast commands) — scan once now.
@@ -565,7 +621,30 @@ class ShellSession {
     });
   }
 
+  /**
+   * Mark a result that came from the one-shot fallback rather than the live
+   * session, so the model is TOLD the shell changed and can stop trusting its
+   * quoting contract.
+   *
+   * The 2026-02-14 report's worst finding was precisely that this happened
+   * silently: "nothing in the result tells the agent the shell changed" while
+   * the agent "degrades to a one-shot cmd.exe — and stays there for the
+   * remainder of the turn", so it kept emitting PowerShell quoting, got
+   * localized cmd.exe syntax errors, and finally blamed the user's machine.
+   * Emitted ONCE per session so a degraded turn stays readable.
+   */
+  _noteDegraded(result, reason) {
+    const r = result && typeof result === 'object' ? result : { content: String(result == null ? '' : result), isError: true };
+    if (this._degradedNoted) return r;
+    this._degradedNoted = true;
+    const via = this.shell && this.shell.cmd ? this.shell.cmd : 'unknown shell';
+    const was = this.shell && this.shell.kind ? this.shell.kind : 'none';
+    const marker = `[shell_degraded] ran one-shot via ${via} (${reason}); session dialect was ${was} — quoting contracts may differ`;
+    return { ...r, content: `${marker}\n${r.content || ''}` };
+  }
+
   dispose() {
+    this.disposed = true;
     this.alive = false;
     if (this.child) {
       try { this.child.stdin.end(); } catch { /* already gone */ }