agentplugged 1.0.0 → 1.0.2

package/dist/agent-commands.js

@@ -19775,9 +19775,9 @@ const syncCommand = defineCommand({
 			flavor: claudeFlavor(loaded.config.permissions?.mode),
 			current: claudeSettings
 		}, has("claude-code") ? {
-			deny: unique([...denyRules(permissionInputs), ...claudeRules.deny]),
-			allow: claudeRules.allow,
-			ask: claudeRules.ask
+			deny: claudeWritable(unique([...denyRules(permissionInputs), ...claudeRules.deny])),
+			allow: claudeWritable(claudeRules.allow),
+			ask: claudeWritable(claudeRules.ask)
 		} : {}, {
 			deny: manifest.permissions,
 			...previousLists[CLAUDE_SETTINGS_PATH]
@@ -19878,6 +19878,14 @@ const CODEX_HOME_DENY = [
 function unique(rules) {
 	return [...new Set(rules)];
 }
+/**
+* The rules Claude Code's settings can hold: a backslash before the closing parenthesis escapes it
+* there, so such a rule would be malformed (the `C:/` spelling of the same root stays). The
+* engine's own guards keep them: they read the rules themselves.
+*/
+function claudeWritable(rules) {
+	return rules.filter((rule) => !rule.endsWith("\\)"));
+}
 /** The tool a generated path belongs to, for the summary. */
 function groupOf(path) {
 	if (path.startsWith(".claude/") || path === "CLAUDE.md") return "claude-code";

package/dist/main.js

@@ -510,6 +510,48 @@ function withoutPart(files, part) {
 	};
 }
 //#endregion
+//#region ../../packages/adapters-git/dist/atomic-rename.js
+/** The pauses, in milliseconds, before each new try: about a second and a half in all. */
+const RETRY_DELAYS_MS = [
+	25,
+	50,
+	100,
+	200,
+	400,
+	700
+];
+/** The errors Windows gives when another program (an AI tool, an editor, an antivirus) holds a file. */
+const HELD_CODES = /* @__PURE__ */ new Set([
+	"EPERM",
+	"EBUSY",
+	"EACCES"
+]);
+/**
+* Renames `from` over `to`, as the last step of an atomic write. On Windows a file another program
+* holds open cannot be replaced, and that is most often brief: the rename is tried again a few times
+* with growing pauses (about a second and a half in all). When the file stays held, the error names
+* the file and says that another program holds it. Elsewhere, and for any other error, the first
+* error is the answer.
+*/
+async function renameWithRetry(from, to, options = {}) {
+	const move = options.rename ?? rename;
+	const windows = (options.platform ?? process.platform) === "win32";
+	const wait = options.wait ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+	for (let attempt = 0;; attempt++) try {
+		await move(from, to);
+		return;
+	} catch (error) {
+		const code = error?.code;
+		if (!windows || code === void 0 || !HELD_CODES.has(code)) throw error;
+		const pause = RETRY_DELAYS_MS[attempt];
+		if (pause === void 0) throw new AgentPluggedError(ErrorCode.UNEXPECTED, "error.file_in_use", {
+			path: to,
+			code
+		});
+		await wait(pause);
+	}
+}
+//#endregion
 //#region ../../packages/adapters-git/dist/git-process.js
 /** Variables that would point `git` at another repository, index or object store. */
 const REPOSITORY_VARIABLES = [
@@ -3943,7 +3985,7 @@ var GitStateStore = class {
 		this.#memoryWrites += 1;
 		const temporary = `${target}.${process.pid}.${this.#memoryWrites}.tmp`;
 		await writeFile(temporary, `${text}\n`, "utf8");
-		await rename(temporary, target);
+		await renameWithRetry(temporary, target);
 	}
 	async backupRemote(options) {
 		await this.#repository();
@@ -6095,7 +6137,7 @@ var NodeCodexUserConfig = class {
 				encoding: "utf8",
 				mode: 384
 			});
-			await rename(temporary, target);
+			await renameWithRetry(temporary, target);
 		} finally {
 			await rm(temporary, { force: true }).catch(() => void 0);
 		}
@@ -6163,7 +6205,7 @@ var NodeCommonMemory = class {
 				mode: 384,
 				flag: "wx"
 			});
-			await rename(temporary, target);
+			await renameWithRetry(temporary, target);
 		} catch (error) {
 			await rm(temporary, { force: true });
 			throw error;
@@ -6278,7 +6320,7 @@ var NodeWorkspaceFiles = class {
 				encoding: "utf8",
 				flag: "wx"
 			} : { flag: "wx" });
-			await rename(temp, target);
+			await renameWithRetry(temp, target);
 		} catch (error) {
 			await rm(temp, { force: true });
 			throw error;
@@ -6405,6 +6447,415 @@ var NodeFolderReader = class {
 		return new NodeWorkspaceFiles(path);
 	}
 };
+/**
+* The helper's script: compiles the C#, says it is ready (or why it cannot be), then answers one
+* JSON line per request line until its input closes. Constrained language mode forbids `Add-Type`,
+* which is said before trying.
+*/
+const HELPER_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$out = [Console]::Out
+try {
+  $mode = [string]$ExecutionContext.SessionState.LanguageMode
+  if ($mode -ne 'FullLanguage') { throw ('PowerShell is in ' + $mode + ' mode, which forbids compiling code') }
+  Add-Type -ReferencedAssemblies 'System.Web.Extensions' -TypeDefinition @'
+${String.raw`
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Collections.Generic;
+using System.Web.Script.Serialization;
+
+public static class ApCredentials {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  struct CREDENTIAL {
+    public uint Flags;
+    public uint Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public uint CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public uint Persist;
+    public uint AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+
+  [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredRead(string target, uint type, uint flags, out IntPtr credential);
+  [DllImport("advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredWrite(ref CREDENTIAL credential, uint flags);
+  [DllImport("advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredDelete(string target, uint type, uint flags);
+  [DllImport("advapi32.dll", EntryPoint = "CredEnumerateW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredEnumerate(string filter, uint flags, out uint count, out IntPtr credentials);
+  [DllImport("advapi32.dll", EntryPoint = "CredFree")]
+  static extern void CredFree(IntPtr buffer);
+
+  const uint Generic = 1;
+  const uint PersistEnterprise = 3;
+  const int NotFound = 1168;
+
+  static string Text(string b64) {
+    return b64 == null ? null : Encoding.UTF8.GetString(Convert.FromBase64String(b64));
+  }
+  static string B64(string text) {
+    return Convert.ToBase64String(Encoding.UTF8.GetBytes(text == null ? "" : text));
+  }
+  public static string Failure(int code, string message) {
+    return "{\"ok\":false,\"code\":" + code + ",\"message\":\"" + B64(message) + "\"}";
+  }
+  static string Win32Failure(int code) {
+    string message;
+    try { message = new System.ComponentModel.Win32Exception(code).Message; } catch (Exception) { message = ""; }
+    return Failure(code, message);
+  }
+
+  // One request line in, one answer line out. The line is parsed here, not by a cmdlet, so that
+  // PowerShell module logging (when a policy turns it on) never records a secret.
+  public static string HandleLine(string line) {
+    int id = 0;
+    try {
+      Dictionary<string, object> request =
+        (Dictionary<string, object>)new JavaScriptSerializer().DeserializeObject(line);
+      id = Convert.ToInt32(request["id"]);
+      string answer = Handle(Field(request, "op"), Field(request, "target"), Field(request, "user"), Field(request, "secret"));
+      return "{\"id\":" + id + "," + answer.Substring(1);
+    } catch (Exception) {
+      return "{\"id\":" + id + "," + Failure(0, "the credential helper could not read a request").Substring(1);
+    }
+  }
+  static string Field(Dictionary<string, object> request, string name) {
+    object value;
+    return request.TryGetValue(name, out value) && value != null ? value.ToString() : "";
+  }
+
+  public static string Handle(string op, string targetB64, string userB64, string secretB64) {
+    try {
+      string target = Text(targetB64);
+      if (op == "read") return Read(target);
+      if (op == "write") return Write(target, Text(userB64), Convert.FromBase64String(secretB64));
+      if (op == "delete") return Delete(target);
+      if (op == "list") return List(target);
+      return Failure(0, "unknown operation");
+    } catch (Exception) {
+      return Failure(0, "the credential helper failed");
+    }
+  }
+
+  static string Read(string target) {
+    IntPtr pointer;
+    if (!CredRead(target, Generic, 0, out pointer)) {
+      int error = Marshal.GetLastWin32Error();
+      return error == NotFound ? "{\"ok\":true,\"found\":false}" : Win32Failure(error);
+    }
+    try {
+      CREDENTIAL credential = (CREDENTIAL)Marshal.PtrToStructure(pointer, typeof(CREDENTIAL));
+      byte[] blob = new byte[credential.CredentialBlobSize];
+      if (blob.Length > 0) Marshal.Copy(credential.CredentialBlob, blob, 0, blob.Length);
+      string answer = "{\"ok\":true,\"found\":true,\"secret\":\"" + Convert.ToBase64String(blob) + "\"}";
+      Array.Clear(blob, 0, blob.Length);
+      return answer;
+    } finally {
+      CredFree(pointer);
+    }
+  }
+
+  static string Write(string target, string user, byte[] blob) {
+    IntPtr memory = Marshal.AllocHGlobal(blob.Length == 0 ? 1 : blob.Length);
+    try {
+      if (blob.Length > 0) Marshal.Copy(blob, 0, memory, blob.Length);
+      CREDENTIAL credential = new CREDENTIAL();
+      credential.Type = Generic;
+      credential.TargetName = target;
+      credential.CredentialBlobSize = (uint)blob.Length;
+      credential.CredentialBlob = memory;
+      credential.Persist = PersistEnterprise;
+      credential.UserName = user;
+      if (!CredWrite(ref credential, 0)) return Win32Failure(Marshal.GetLastWin32Error());
+      return "{\"ok\":true}";
+    } finally {
+      byte[] zeros = new byte[blob.Length];
+      if (zeros.Length > 0) Marshal.Copy(zeros, 0, memory, zeros.Length);
+      Marshal.FreeHGlobal(memory);
+      Array.Clear(blob, 0, blob.Length);
+    }
+  }
+
+  static string Delete(string target) {
+    if (CredDelete(target, Generic, 0)) return "{\"ok\":true,\"found\":true}";
+    int error = Marshal.GetLastWin32Error();
+    return error == NotFound ? "{\"ok\":true,\"found\":false}" : Win32Failure(error);
+  }
+
+  // The accounts of a service: every generic credential whose target is "<user>.<service>".
+  static string List(string service) {
+    uint count;
+    IntPtr array;
+    if (!CredEnumerate(null, 0, out count, out array)) {
+      int error = Marshal.GetLastWin32Error();
+      return error == NotFound ? "{\"ok\":true,\"users\":[]}" : Win32Failure(error);
+    }
+    try {
+      List<string> users = new List<string>();
+      for (int index = 0; index < count; index++) {
+        IntPtr pointer = Marshal.ReadIntPtr(array, index * IntPtr.Size);
+        CREDENTIAL credential = (CREDENTIAL)Marshal.PtrToStructure(pointer, typeof(CREDENTIAL));
+        if (credential.Type == Generic && credential.UserName != null
+            && credential.TargetName == credential.UserName + "." + service) {
+          users.Add("\"" + B64(credential.UserName) + "\"");
+        }
+      }
+      return "{\"ok\":true,\"users\":[" + string.Join(",", users.ToArray()) + "]}";
+    } finally {
+      CredFree(array);
+    }
+  }
+}
+`}
+'@
+  $out.WriteLine('{"ready":true}')
+} catch {
+  # Constrained language mode forbids method calls: the reason goes out as plain ASCII text,
+  # through a cmdlet.
+  $reason = ([string]$_) -replace '[^ -~]', ' ' -replace '["\\\\]', ' '
+  Write-Output ('{"ready":false,"message":"' + $reason + '"}')
+  exit 0
+}
+while ($null -ne ($line = [Console]::In.ReadLine())) {
+  if ($line.Trim().Length -eq 0) { continue }
+  $out.WriteLine([ApCredentials]::HandleLine($line))
+}
+`;
+/** Windows PowerShell 5.1 by its full path: never a `powershell` found on the PATH. */
+function windowsPowerShellPath() {
+	const root = process.env.SystemRoot ?? process.env.windir;
+	if (root === void 0) return void 0;
+	const path = join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+	return existsSync(path) ? path : void 0;
+}
+/** The helper cannot be used on this machine (no PowerShell, constrained language, a crash...). */
+var PowerShellUnavailableError = class extends Error {
+	name = "PowerShellUnavailableError";
+};
+const decode = (text) => Buffer.from(text ?? "", "base64").toString("utf8");
+/** One running helper process. */
+var Session = class Session {
+	#child;
+	#pending = /* @__PURE__ */ new Map();
+	#nextId = 1;
+	#buffer = "";
+	#alive = true;
+	#onReady;
+	constructor(child) {
+		this.#child = child;
+		child.stdout?.setEncoding("utf8");
+		child.stdout?.on("data", (chunk) => this.#receive(chunk));
+		child.stdin?.on("error", () => {});
+		child.on("error", () => this.#end("PowerShell could not be started"));
+		child.on("close", () => this.#end("the PowerShell credential helper stopped"));
+	}
+	/** Starts a helper and waits until it is ready, or says why it cannot be. */
+	static start(powershell, startupTimeoutMs) {
+		const script = Buffer.from(HELPER_SCRIPT, "utf16le").toString("base64");
+		const child = spawn(powershell, [
+			"-NoLogo",
+			"-NoProfile",
+			"-NonInteractive",
+			"-EncodedCommand",
+			script
+		], {
+			stdio: [
+				"pipe",
+				"pipe",
+				"ignore"
+			],
+			windowsHide: true
+		});
+		const session = new Session(child);
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				session.close();
+				reject(new PowerShellUnavailableError("PowerShell did not answer in time"));
+			}, startupTimeoutMs);
+			session.#onReady = (answer) => {
+				clearTimeout(timer);
+				if (answer.ready === true) {
+					session.#idle();
+					resolve(session);
+				} else {
+					session.close();
+					reject(new PowerShellUnavailableError(answer.message || "PowerShell refused"));
+				}
+			};
+			child.once("error", (error) => {
+				clearTimeout(timer);
+				reject(new PowerShellUnavailableError(error.message));
+			});
+			child.once("close", () => {
+				clearTimeout(timer);
+				reject(new PowerShellUnavailableError("PowerShell stopped before it was ready"));
+			});
+		});
+	}
+	get alive() {
+		return this.#alive;
+	}
+	/** Stops the helper; its input closing also ends it if the kill fails. */
+	close() {
+		this.#alive = false;
+		this.#child.stdin?.end();
+		this.#child.kill();
+	}
+	/** Sends one request and waits for its answer (a failure of the Credential Manager is thrown). */
+	request(fields, timeoutMs) {
+		if (!this.#alive) return Promise.reject(/* @__PURE__ */ new Error("the PowerShell credential helper is not running"));
+		const id = this.#nextId;
+		this.#nextId += 1;
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.#pending.delete(id);
+				this.close();
+				reject(/* @__PURE__ */ new Error("the PowerShell credential helper did not answer in time"));
+			}, timeoutMs);
+			this.#pending.set(id, {
+				resolve,
+				reject,
+				timer
+			});
+			this.#busy();
+			const line = JSON.stringify({
+				id,
+				op: fields.op,
+				target: Buffer.from(fields.target, "utf8").toString("base64"),
+				user: Buffer.from(fields.user ?? "", "utf8").toString("base64"),
+				secret: fields.secret
+			});
+			this.#child.stdin?.write(`${line}\n`);
+		});
+	}
+	#receive(chunk) {
+		this.#buffer += chunk;
+		for (let end = this.#buffer.indexOf("\n"); end >= 0; end = this.#buffer.indexOf("\n")) {
+			const line = this.#buffer.slice(0, end).trim();
+			this.#buffer = this.#buffer.slice(end + 1);
+			if (line === "") continue;
+			let answer;
+			try {
+				answer = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			if (answer.ready !== void 0) this.#onReady?.(answer);
+			else if (answer.id !== void 0) {
+				const pending = this.#pending.get(answer.id);
+				if (pending === void 0) continue;
+				this.#pending.delete(answer.id);
+				clearTimeout(pending.timer);
+				pending.resolve(answer);
+				if (this.#pending.size === 0) this.#idle();
+			}
+		}
+	}
+	#end(reason) {
+		this.#alive = false;
+		for (const pending of this.#pending.values()) {
+			clearTimeout(pending.timer);
+			pending.reject(new Error(reason));
+		}
+		this.#pending.clear();
+	}
+	/** While a request is in flight, Node must wait for the answer. */
+	#busy() {
+		for (const handle of this.#handles()) handle.ref?.();
+	}
+	/** With nothing in flight, the helper never keeps Node from exiting. */
+	#idle() {
+		for (const handle of this.#handles()) handle.unref?.();
+	}
+	#handles() {
+		return [
+			this.#child,
+			this.#child.stdin,
+			this.#child.stdout
+		];
+	}
+};
+const STARTUP_TIMEOUT_MS = 3e4;
+const REQUEST_TIMEOUT_MS = 3e4;
+/** `CredentialBackend` through a PowerShell helper, started on the first request. */
+var PowerShellCredentials = class PowerShellCredentials {
+	#powershell;
+	#session;
+	constructor(powershell) {
+		this.#powershell = powershell;
+	}
+	/**
+	* Starts the helper now. Rejects with `PowerShellUnavailableError` when PowerShell is absent, in
+	* constrained language mode, or otherwise unable to compile the helper.
+	*/
+	static async open(options = {}) {
+		const powershell = options.powershell ?? windowsPowerShellPath();
+		if (powershell === void 0) throw new PowerShellUnavailableError("Windows PowerShell was not found");
+		const backend = new PowerShellCredentials(powershell);
+		await backend.#ensure();
+		return backend;
+	}
+	/** The running helper; a new one when the last stopped. */
+	async #ensure() {
+		for (let attempt = 0; attempt < 2; attempt += 1) {
+			this.#session ??= Session.start(this.#powershell, STARTUP_TIMEOUT_MS).catch((error) => {
+				this.#session = void 0;
+				throw error;
+			});
+			const pending = this.#session;
+			const session = await pending;
+			if (session.alive) return session;
+			if (this.#session === pending) this.#session = void 0;
+		}
+		throw new Error("the PowerShell credential helper keeps stopping");
+	}
+	async #ask(fields) {
+		const answer = await (await this.#ensure()).request(fields, REQUEST_TIMEOUT_MS);
+		if (answer.ok !== true) {
+			const message = decode(answer.message) || "the Credential Manager refused";
+			throw new Error(`Windows Credential Manager failed: ${message} (Windows error code ${answer.code ?? 0})`);
+		}
+		return answer;
+	}
+	async read(service, account) {
+		const answer = await this.#ask({
+			op: "read",
+			target: `${account}.${service}`,
+			user: account
+		});
+		if (answer.found !== true) return void 0;
+		return Buffer.from(answer.secret ?? "", "base64").toString("utf16le");
+	}
+	async write(service, account, secret) {
+		await this.#ask({
+			op: "write",
+			target: `${account}.${service}`,
+			user: account,
+			secret: Buffer.from(secret, "utf16le").toString("base64")
+		});
+	}
+	async remove(service, account) {
+		return (await this.#ask({
+			op: "delete",
+			target: `${account}.${service}`,
+			user: account
+		})).found === true;
+	}
+	async accounts(service) {
+		return ((await this.#ask({
+			op: "list",
+			target: service
+		})).users ?? []).map(decode);
+	}
+};
 //#endregion
 //#region ../../packages/adapters-git/dist/node-key-store.js
 /**
@@ -6467,6 +6918,78 @@ function explainKeychainError(error, platform = process.platform) {
 	if (platform !== "linux" || !/secret.?service|d-?bus|platform secure storage/i.test(message)) return error;
 	return new Error(`the Secret Service of this Linux session could not be used: start one and unlock its default keyring (GNOME Keyring, KWallet or KeePassXC; on a machine without a desktop, gnome-keyring-daemon --unlock in a dbus-run-session), then run the command again. The system said: ${message}`, { cause: error });
 }
+/** What Windows says when it refuses a file under Smart App Control or an application control policy. */
+const BLOCKED_BY_POLICY = /application control|blocked this file|smart app control|signing level|code integrity|contr.le d.application|bloqu. ce fichier|error 4551|0x800711c7/i;
+/** The message of `error` and of the errors under its `cause`, outermost first. */
+function messageChain(error) {
+	const messages = [];
+	let current = error;
+	for (let depth = 0; depth < 20 && current !== void 0 && current !== null; depth += 1) {
+		messages.push(current instanceof Error ? current.message : String(current));
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return messages;
+}
+/**
+* The error for a keychain that cannot be reached at all: `native` is why `@napi-rs/keyring` did
+* not load and, on Windows, `powershell` why the PowerShell helper could not be used. Says what
+* blocks, in plain words: the generic "npm has a bug" of the module's loader never stands alone,
+* and a Windows policy blocking the module is named, with the file.
+*/
+function unavailableKeychainError(native, powershell) {
+	const real = messageChain(native).filter((message) => !/cannot find native binding|npm has a bug/i.test(message));
+	const blocked = real.find((message) => BLOCKED_BY_POLICY.test(message));
+	const file = blocked === void 0 ? void 0 : /[A-Za-z]:\\[^\r\n"']*?\.node/.exec(blocked)?.[0];
+	const viaPowerShell = powershell === void 0 ? "" : ` The keys could not be reached through Windows PowerShell either (${messageChain(powershell)[0]}).`;
+	if (blocked !== void 0) {
+		const said = blocked.split(/\r?\n/).find((line) => line.trim() !== "") ?? blocked;
+		return new Error(`Windows blocked the system keychain module${file === void 0 ? "" : ` (${file})`}: Smart App Control or an application control policy refuses this unsigned file ("${said.trim()}").${viaPowerShell} Turn off Smart App Control (Windows Security, App & browser control) or allow this file in your application control policy, make sure Windows PowerShell can run in full language mode, then run the command again.`, { cause: native });
+	}
+	const why = real.length > 0 ? real.join("; ") : "Node gave no further reason";
+	return new Error(`the system keychain module could not be loaded: ${why}.${viaPowerShell}`, { cause: native });
+}
+/** The keychain through `@napi-rs/keyring`. */
+async function nativeBackend() {
+	const { AsyncEntry, findCredentialsAsync } = await load().catch((error) => {
+		throw unavailableKeychainError(error);
+	});
+	const entry = (service, account) => new AsyncEntry(service, account, KEYCHAIN_ENTRY_OPTIONS);
+	return {
+		read: async (service, account) => await entry(service, account).getPassword() ?? void 0,
+		write: (service, account, secret) => entry(service, account).setPassword(secret),
+		remove: (service, account) => entry(service, account).deleteCredential(),
+		accounts: async (service) => (await findCredentialsAsync(service)).map((found) => found.account)
+	};
+}
+let system;
+/**
+* The system keychain of this machine. On Windows, the PowerShell helper first (no native module
+* to load, which Smart App Control may refuse), then `@napi-rs/keyring` when PowerShell cannot be
+* used; elsewhere `@napi-rs/keyring`. Chosen once per process, kept once it works.
+*/
+function systemCredentials() {
+	system ??= (async () => {
+		let powershell;
+		if (process.platform === "win32") try {
+			return await PowerShellCredentials.open();
+		} catch (error) {
+			powershell = error;
+		}
+		try {
+			return await nativeBackend();
+		} catch (error) {
+			throw powershell === void 0 ? error : unavailableKeychainError(nativeCause(error), powershell);
+		}
+	})().catch((error) => {
+		system = void 0;
+		throw error;
+	});
+	return system;
+}
+/** The error `@napi-rs/keyring` failed with, under the explained one `nativeBackend` throws. */
+function nativeCause(error) {
+	return error instanceof Error && error.cause !== void 0 ? error.cause : error;
+}
 /** `operation`, its failure explained by `explainKeychainError`. */
 async function explained(operation) {
 	try {
@@ -6477,8 +7000,9 @@ async function explained(operation) {
 }
 /**
 * `KeyStore` in the system keychain (Windows Credential Manager, macOS Keychain, the Secret
-* Service on Linux), through `@napi-rs/keyring`. Tests pass their own service name
-* and delete their entries afterwards: the machine's real entries are never touched.
+* Service on Linux): through a PowerShell helper on Windows (`systemCredentials`) and
+* `@napi-rs/keyring` elsewhere, or when PowerShell cannot be used. Tests pass their own service
+* name and delete their entries afterwards: the machine's real entries are never touched.
 */
 var NodeKeyStore = class {
 	service;
@@ -6491,11 +7015,13 @@ var NodeKeyStore = class {
 	* answering empty under concurrent access: elsewhere, none (no wait added to a first `init`).
 	*/
 	settleDelays;
+	#engine;
 	constructor(options = {}) {
 		this.service = options.service ?? "agentplugged";
 		this.account = options.account ?? "machine";
 		this.humanAccount = options.humanAccount ?? "human";
 		this.presenceAccount = options.presenceAccount ?? "human-presence";
+		this.#engine = options.engine ?? "system";
 		this.settleDelays = options.settleDelays ?? (process.platform === "win32" ? KEYCHAIN_SETTLE_DELAYS_MS : []);
 	}
 	/** Waits `settleDelays[attempt]`; false once they are all spent. */
@@ -6505,21 +7031,17 @@ var NodeKeyStore = class {
 		await setTimeout$1(delay);
 		return true;
 	}
-	/** The entry of `account`; on Linux, in the Secret Service only (`KEYCHAIN_ENTRY_OPTIONS`). */
-	async #entry(account) {
-		const { AsyncEntry } = await load();
-		return new AsyncEntry(this.service, account, KEYCHAIN_ENTRY_OPTIONS);
+	#backend() {
+		return this.#engine === "native" ? nativeBackend() : systemCredentials();
 	}
 	#read(account) {
-		return explained(async () => {
-			return await (await this.#entry(account)).getPassword() ?? void 0;
-		});
+		return explained(async () => (await this.#backend()).read(this.service, account));
 	}
 	/** A full keychain gives `KEYCHAIN_FULL`; any other failure is thrown, explained. */
 	async #write(account, value) {
-		const entry = await explained(() => this.#entry(account));
+		const backend = await explained(() => this.#backend());
 		try {
-			await entry.setPassword(value);
+			await backend.write(this.service, account, value);
 		} catch (error) {
 			if (isKeychainFullError(error)) throw keychainFull(error instanceof Error ? error.message : String(error));
 			throw explainKeychainError(error);
@@ -6554,7 +7076,7 @@ var NodeKeyStore = class {
 	}
 	/** Deletes the machine key's entry; true when there was one. */
 	deleteMachineSecret() {
-		return explained(async () => (await this.#entry(this.account)).deleteCredential());
+		return explained(async () => (await this.#backend()).remove(this.service, this.account));
 	}
 	/**
 	* Deletes the entries of this service, product keys included (tests: a service of their own).
@@ -6564,13 +7086,14 @@ var NodeKeyStore = class {
 	async deleteAll() {
 		if (this.service === "agentplugged") throw new Error(`deleteAll refuses the real keychain service ${KEYCHAIN_SERVICE}`);
 		let deleted = false;
-		const products = await load().then(({ findCredentialsAsync }) => findCredentialsAsync(this.service)).then((found) => found.map((entry) => entry.account).filter((name) => name.startsWith(PRODUCT_ACCOUNT))).catch(() => []);
+		const backend = await explained(() => this.#backend());
+		const products = await backend.accounts(this.service).then((found) => found.filter((name) => name.startsWith(PRODUCT_ACCOUNT))).catch(() => []);
 		for (const account of [
 			this.account,
 			this.humanAccount,
 			this.presenceAccount,
 			...products
-		]) deleted = await (await this.#entry(account)).deleteCredential() || deleted;
+		]) deleted = await backend.remove(this.service, account) || deleted;
 		return deleted;
 	}
 };
@@ -6936,7 +7459,7 @@ var NodeRootPinStore = class {
 			} finally {
 				await handle.close();
 			}
-			await rename(temporary, target);
+			await renameWithRetry(temporary, target);
 			await syncFolder(folder);
 			this.#onFlush?.("folder");
 		} catch (error) {
@@ -7208,6 +7731,7 @@ const en = {
 	"error.unknown_command": "Unknown command \"{command}\".",
 	"error.invalid_arguments": "Invalid arguments: {reason}",
 	"error.unexpected": "Unexpected error: {reason}",
+	"error.file_in_use": "{path} is held open by another program (your AI tool, your editor or your antivirus): nothing was changed. Close it or wait a moment, then run the command again.",
 	"error.engine_version_mismatch": "{path} pins engine {pinned}, and this engine is {engine_version}: nothing was written. Run `npx agentplugged@{pinned} {command}`, or `npx agentplugged init --upgrade-engine` to pin {engine_version}, or add `--engine-any` to run anyway.",
 	"error.upgrade_required": "{path} uses format {format_version}, newer than this engine knows (format {supported}, engine {engine_version}): nothing was written. Run `npx agentplugged@{version} {command}`.",
 	"cli.warning.engine_any": "Warning: {path} pins engine {pinned}, but engine {engine_version} runs anyway (--engine-any). Run `npx agentplugged init --upgrade-engine` to pin it.",
@@ -9127,6 +9651,7 @@ const fr = {
 	"error.unknown_command": "Commande inconnue « {command} ».",
 	"error.invalid_arguments": "Arguments invalides : {reason}",
 	"error.unexpected": "Erreur inattendue : {reason}",
+	"error.file_in_use": "{path} est tenu ouvert par un autre programme (ton outil d'IA, ton éditeur ou ton antivirus) : rien n'a été modifié. Ferme-le ou attends un instant, puis relance la commande.",
 	"error.engine_version_mismatch": "{path} épingle le moteur {pinned}, et ce moteur est en {engine_version} : rien n'a été écrit. Lance `npx agentplugged@{pinned} {command}`, ou `npx agentplugged init --upgrade-engine` pour épingler {engine_version}, ou ajoute `--engine-any` pour passer outre.",
 	"error.upgrade_required": "{path} utilise le format {format_version}, plus récent que celui que connaît ce moteur (format {supported}, moteur {engine_version}) : rien n'a été écrit. Lance `npx agentplugged@{version} {command}`.",
 	"cli.warning.engine_any": "Attention : {path} épingle le moteur {pinned}, mais le moteur {engine_version} s'exécute quand même (--engine-any). Lance `npx agentplugged init --upgrade-engine` pour l'épingler.",

package/dist/method/doctor.yaml

@@ -454,10 +454,12 @@ checks:
       - steps:
           en:
             - "On Linux, install and unlock a secret service (GNOME Keyring or KWallet), then run: npx agentplugged doctor"
-            - "On Windows or macOS, the system keychain is part of the system: restart the session and try again."
+            - "On Windows, if the message says Smart App Control or an application control policy blocked a file: turn off Smart App Control (Windows Security, App & browser control) or allow that file in your policy, check that Windows PowerShell is not in constrained language mode, then run: npx agentplugged doctor"
+            - "On Windows or macOS otherwise, the system keychain is part of the system: restart the session and try again."
           fr:
             - "Sous Linux, installe et déverrouille un service de secrets (GNOME Keyring ou KWallet), puis lance : npx agentplugged doctor"
-            - "Sous Windows ou macOS, le trousseau fait partie du système : redémarre la session et réessaie."
+            - "Sous Windows, si le message dit que Smart App Control ou une stratégie de contrôle des applications a bloqué un fichier : désactive Smart App Control (Sécurité Windows, Contrôle des applications et du navigateur) ou autorise ce fichier, vérifie que Windows PowerShell n'est pas en mode de langage restreint, puis lance : npx agentplugged doctor"
+            - "Sous Windows ou macOS sinon, le trousseau fait partie du système : redémarre la session et réessaie."
 
   - id: presence
     group: keys
@@ -1027,3 +1029,17 @@ signatures:
       en: "A write failed for lack of room"
       fr: "Une écriture a échoué faute de place"
     read: [disk.space]
+  - id: keychain-blocked
+    when:
+      output:
+        - "smart app control"
+        - "application control policy"
+        - "blocked the system keychain module"
+        - "stratégie de contrôle d'application"
+    say:
+      en: "Windows refused to load the keychain's module (Smart App Control or an application control policy)"
+      fr: "Windows a refusé de charger le module du trousseau (Smart App Control ou une stratégie de contrôle des applications)"
+    read: [keychain]
+    assumed:
+      en: "The message names the blocked file; whether turning off Smart App Control or adding an allow rule is right for this machine is your call, I only checked that the keychain does not answer"
+      fr: "Le message nomme le fichier bloqué ; désactiver Smart App Control ou ajouter une règle d'autorisation, c'est à toi de décider pour cette machine, je n'ai vérifié que le fait que le trousseau ne répond pas"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentplugged",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Install the AgentPlugged method in a repository and make its agents callable from Claude Code, Codex, Antigravity/Gemini CLI and Cursor.",
   "releaseSummary": "The engine updates itself: your session moves to a newer version between two calls, with nothing to reconnect.",
   "license": "FSL-1.1-MIT",
@@ -47,14 +47,14 @@
     "koffi": "~3.3.2"
   },
   "devDependencies": {
-    "@agentplugged/adapters-git": "1.0.0",
-    "@agentplugged/adapters-tools": "1.0.0",
-    "@agentplugged/core": "1.0.0",
-    "@agentplugged/crypto": "1.0.0",
-    "@agentplugged/i18n": "1.0.0",
-    "@agentplugged/mcp": "1.0.0",
+    "@agentplugged/adapters-git": "1.0.2",
+    "@agentplugged/adapters-tools": "1.0.2",
+    "@agentplugged/core": "1.0.2",
+    "@agentplugged/crypto": "1.0.2",
+    "@agentplugged/i18n": "1.0.2",
+    "@agentplugged/mcp": "1.0.2",
     "@agentplugged/method": "0.0.0",
-    "@agentplugged/protocol": "1.0.0",
+    "@agentplugged/protocol": "1.0.2",
     "@biomejs/biome": "~2.5.15",
     "@modelcontextprotocol/client": "~2.3.0",
     "@types/node": "^24.19.1",