aiterm-mcp 0.25.2 → 0.26.0

package/README.md

@@ -165,7 +165,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · the newcomer here, betting on a different shape (see [vs. the alternatives](#vs-the-alternatives)) · runs on Linux · WSL2 · macOS · native Windows for the core PTY tools (correlated agent completion is POSIX/WSL/macOS only for now) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · the newcomer here, betting on a different shape (see [vs. the alternatives](#vs-the-alternatives)) · runs on Linux · WSL2 · macOS · native Windows for the core PTY tools and Grok/Composer launches (Claude/Codex correlated completion is POSIX/WSL/macOS only for now) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ## Why now
 
@@ -221,7 +221,7 @@ One call per model, so the tool name itself tells you which model you get:
 | --- | --- | --- |
 | `claude_agent` | Claude Code CLI (Anthropic) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (`low`/`medium`/`high`/`xhigh`/`max`), `env_vars?`, `cwd?`, `session_name?`, `launch_operation_id?` |
 | `codex_agent` | Codex CLI (OpenAI; terminal config/CLI default unless overridden) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (`low`/`medium`/`high`/`xhigh`/`max`/`ultra`; ultra enables proactive automatic delegation), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
-| `grok_agent` | Grok Build, model `grok-4.5` by default (`model?` overrides) (xAI) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (vendor-supported value), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
+| `grok_agent` | Grok Build, model `grok-4.6` by default (`model?` overrides) (xAI) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (vendor-supported value), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
 | `composer_agent` | Grok Build, model `grok-composer-2.5-fast` by default (`model?` overrides); every model is live-catalog checked (xAI) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (vendor-supported value), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
 
 `env_vars` is an allowlist of environment-variable **names**, not a name/value map. At launch,
@@ -242,7 +242,7 @@ places its returned context before a fixed separator and the mission. This route
 `throughline >= 0.9.0`; it reads the source memory without changing that database's session
 ownership. No Throughline dependency is needed when the field is omitted.
 
-All four launchers forward `model` and `reasoning_effort` through public CLI flags. Explicit Grok/Composer models and Composer's default model are checked against the current `grok models` catalog before a PTY exists; missing models are errors, with no cache, retry, or fallback to another model. Pass an absolute path for `cwd` — `~` is not expanded. Durable callers can make a promptless Claude launch exactly replayable by passing an explicit `session_name` and `launch_operation_id`. Claude adds a launch-local settings file only for the correlated Stop hook and loads it together with normal `user,project,local` setting sources; it does not replace normal hooks, MCPs, plugins, permissions, or trust state. The hook event contains no answer body, and the bounded owner-only result is returned by `pty_read({ agent_transcript:true })` without reading Claude's private transcript. While a correlated Claude turn is active, raw sends and non-interrupt keys are rejected. Exact `/login` and `/logout` dispatches are rejected so shared authentication is repaired once in a normal terminal. Codex reads its normal rollout store; Grok/Composer read their normal session event/history files. Before dispatch, Codex waits for an idle TUI, while Grok/Composer additionally require the vendor's structured `mcp_init_completed` event so a visible input box cannot accept a prompt too early. Correlated completion requires POSIX filesystem semantics (Linux, WSL2, macOS).
+All four launchers forward `model` and `reasoning_effort` through public CLI flags. Explicit Grok/Composer models and Composer's default model are checked against the current `grok models` catalog before a PTY exists; missing models are errors, with no cache, retry, or fallback to another model. Pass an absolute path for `cwd` — `~` is not expanded. Durable callers can make a promptless Claude launch exactly replayable by passing an explicit `session_name` and `launch_operation_id`. Claude adds a launch-local settings file only for the correlated Stop hook and loads it together with normal `user,project,local` setting sources; it does not replace normal hooks, MCPs, plugins, permissions, or trust state. The hook event contains no answer body, and the bounded owner-only result is returned by `pty_read({ agent_transcript:true })` without reading Claude's private transcript. While a correlated Claude turn is active, raw sends and non-interrupt keys are rejected. Exact `/login` and `/logout` dispatches are rejected so shared authentication is repaired once in a normal terminal. Codex reads its normal rollout store; Grok/Composer read their normal session event/history files. Before dispatch, Codex waits for an idle TUI, while Grok/Composer additionally require the vendor's structured `mcp_init_completed` event so a visible input box cannot accept a prompt too early. Claude/Codex correlated completion requires POSIX filesystem semantics (Linux, WSL2, macOS); Grok/Composer correlated completion also works on native Windows, where the launcher starts the Windows-native `grok.exe` and reads its Windows-side session records.
 
 There is no hidden protocol between agents: a launched Claude, Codex, Grok, or Composer is another user-visible persistent terminal session. The MCP client drives that TUI with ordinary PTY operations, and a human can attach to watch or take over.
 
@@ -446,7 +446,7 @@ Each launcher starts a specific vendor's interactive coding-agent TUI inside a f
 | --- | --- | --- |
 | `claude_agent` | Claude Code CLI (Anthropic) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (`low`/`medium`/`high`/`xhigh`/`max`), `env_vars?`, `cwd?`, `session_name?`, `launch_operation_id?` |
 | `codex_agent` | Codex CLI (OpenAI; terminal config/CLI default unless overridden) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (`low`/`medium`/`high`/`xhigh`/`max`/`ultra`; ultra enables proactive automatic delegation), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
-| `grok_agent` | Grok Build, model `grok-4.5` by default (`model?` overrides) (xAI) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (vendor-supported value), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
+| `grok_agent` | Grok Build, model `grok-4.6` by default (`model?` overrides) (xAI) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (vendor-supported value), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
 | `composer_agent` | Grok Build, model `grok-composer-2.5-fast` by default (`model?` overrides); every model is live-catalog checked (xAI) | `prompt?`, `throughline_source_session?`, `model?`, `reasoning_effort?` (vendor-supported value), `env_vars?`, `cwd?`, `session_name?`, `write_scope?` |
 
 The vendor CLI must be installed and authenticated (`claude` for `claude_agent`; `codex` for `codex_agent`; `grok` for both Grok tools). Binary resolution uses `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN`, then each documented default location, then `PATH`. Missing binaries, invalid model/effort values, unavailable Grok/Composer catalog models, and nonexistent `cwd` fail before a session is created. Claude additionally requires a structured healthy authentication status before any PTY exists, and correlated Claude sessions reject `/login` and `/logout`; repair authentication once in a normal terminal. All four launchers share the normal project/user environment and the same non-blocking dispatch contract. Claude, Codex, Grok, and Composer depth-1 live smokes and a Claude depth-2 nested-delegation smoke are green; fixture coverage remains a separate claim. Native Windows can launch agents but correlated completion is not supported yet.
@@ -497,7 +497,7 @@ Sessions live on a shared tmux socket. The `tmux -S … attach -t <id>` line pri
 - **Node.js >= 18**
 - **tmux** (runtime prerequisite; check with `tmux -V`. Install with `apt install tmux` / `brew install tmux`)
   - **macOS / Linux / WSL2** run tmux directly. On macOS install it with `brew install tmux` (stock macOS ships none). If your MCP client is launched from the **GUI** rather than a terminal, Homebrew's bin (`/opt/homebrew/bin` on Apple Silicon, `/usr/local/bin` on Intel) may be off its `PATH`; aiterm auto-searches those locations, or set **`AITERM_TMUX=/path/to/tmux`** to point at it explicitly.
-  - **Native Windows** has no tmux, so aiterm transparently runs tmux **inside WSL**. It needs [WSL](https://learn.microsoft.com/windows/wsl/) installed and initialized, with **tmux installed inside your WSL distro** (`sudo apt install tmux`); verify with `wsl tmux -V`. Sessions, the socket, and human `attach` all live on the WSL side — the AI just drives them from the Windows-side command. (You reach Windows tools the same way you reach SSH: `pty_send "powershell.exe …"` nests into PowerShell.)
+  - **Native Windows** has no tmux, so aiterm transparently runs tmux **inside WSL**. It needs [WSL](https://learn.microsoft.com/windows/wsl/) installed and initialized, with **tmux installed inside your WSL distro** (`sudo apt install tmux`); verify with `wsl tmux -V`. Sessions, the socket, and human `attach` all live on the WSL side — the AI just drives them from the Windows-side command. (You reach Windows tools the same way you reach SSH: `pty_send "powershell.exe …"` nests into PowerShell.) WSL stays a pure terminal transport: `grok_agent`/`composer_agent` launch the **Windows-native** Grok CLI (`%USERPROFILE%\.grok\bin\grok.exe`, or `GROK_BIN` pointing at a `.exe`) as a Windows process, and a WSL-side grok is rejected before a session is created so vendor auth and session records never split across the WSL boundary. aiterm keeps one long-lived WSL interop anchor process alive so Windows executables can start inside the WSL tmux pane.
 - For the **agent launchers**: the corresponding vendor CLI, installed and authenticated — `claude` for `claude_agent`, `codex` for `codex_agent`, `grok` for `grok_agent` / `composer_agent`. Portable fork additionally needs `throughline >= 0.9.0`; ordinary clean launch does not. (Not needed if you only use the PTY tools.)
 - Optional: the [`rtk`](https://github.com/rtk-ai/rtk) binary (used by `pty_send`'s `rtk: true` delegation; works fine without it)
 

package/dist/core.js

@@ -7,7 +7,7 @@
  *
  * 設計: docs/01_design-plan.md / docs/02_mcp-plan.md。出力削減は rag/ の RTK を移植。
  */
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
@@ -185,6 +185,82 @@ function ensureWinBridge(observe = true) {
         ptyDependencyError("WSL 経由で tmux を起動できませんでした。WSL のディストリ未導入、または distro 内に tmux が無い可能性があります。`wsl tmux -V` が通るか確認してください（tmux 導入例: sudo apt install tmux）。", observe);
     winBridgeOk = true;
 }
+// Windows の tmux bridge では各 wsl.exe 呼び出しが短命で、tmux server と pane が継承する
+// WSL_INTEROP は起動元 WSL session の終了とともに死ぬ。死んだ socket のまま pane 内から
+// Windows .exe を起動すると binfmt interop が UtilAcceptVsock accept4=110(ETIMEDOUT) で失敗する。
+// 生きた session leader の socket を WSL_INTEROP へ指せば同じ pane で成功する（どちらも実測
+// 2026-08-15・WSL 2.6.1）。そのため aiterm が長寿命 anchor（sleep する wsl.exe process）を
+// 1本所有し、native .exe 起動の env へその socket を供給する。anchor は起動時に自身の
+// WSL_INTEROP と pid を state file へ書き、以後は生存確認だけで再利用する。
+const WIN_INTEROP_ANCHOR_SPAWN_TIMEOUT_MS = 10_000;
+const WIN_INTEROP_ANCHOR_POLL_MS = 100;
+function winInteropAnchorStatePath() {
+    return path.join(ensureSecureStateRoot(), "interop-anchor.json");
+}
+function readWinInteropAnchorState() {
+    let raw;
+    try {
+        raw = fs.readFileSync(winInteropAnchorStatePath(), "utf8");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const value = JSON.parse(raw);
+        if (typeof value.socket === "string" &&
+            value.socket.startsWith("/run/WSL/") &&
+            Number.isSafeInteger(value.pid) &&
+            value.pid > 0) {
+            return { socket: value.socket, pid: value.pid };
+        }
+    }
+    catch {
+        /* 不完全・破損 state は下の再生成経路で作り直す */
+    }
+    return null;
+}
+function isWinInteropAnchorAlive(state) {
+    const r = spawnSync("wsl.exe", ["-e", "sh", "-c", `test -S ${shq(state.socket)} && kill -0 ${state.pid}`], {
+        encoding: "utf8",
+        timeout: 10000,
+        windowsHide: true,
+    });
+    return !r.error && r.status === 0;
+}
+// openAgent は同期経路のため、anchor の起動待ちだけ Atomics.wait で有界に同期 sleep する。
+function sleepSyncMs(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function ensureWinInteropAnchor() {
+    const existing = readWinInteropAnchorState();
+    if (existing && isWinInteropAnchorAlive(existing))
+        return existing.socket;
+    const statePath = winInteropAnchorStatePath();
+    fs.rmSync(statePath, { force: true });
+    // 並行launchが同時にここへ来ると anchor が余分に1本立つが、state は後着が上書きし
+    // どちらの socket も有効なので実害はない（余剰 process は wsl shutdown まで sleep のみ）。
+    const child = spawn("wsl.exe", [
+        "-e",
+        "sh",
+        "-c",
+        `printf '{"socket":"%s","pid":%s}' "$WSL_INTEROP" "$$" > ${shq(toWslPath(statePath))} && exec sleep infinity`,
+    ], { detached: true, stdio: "ignore", windowsHide: true });
+    child.unref();
+    const deadline = Date.now() + WIN_INTEROP_ANCHOR_SPAWN_TIMEOUT_MS;
+    for (;;) {
+        const state = readWinInteropAnchorState();
+        if (state) {
+            if (!isWinInteropAnchorAlive(state)) {
+                throw new AitermError("WSL interop anchor が起動直後に停止しました。`wsl` が動作するか確認してください。", 2);
+            }
+            return state.socket;
+        }
+        if (Date.now() >= deadline) {
+            throw new AitermError("WSL interop anchor を起動できません。`wsl` が動作するか確認してください。", 2);
+        }
+        sleepSyncMs(WIN_INTEROP_ANCHOR_POLL_MS);
+    }
+}
 // tmux が見つからないときの説明。macOS は tmux を同梱せず、Homebrew の bin は GUI 起動時の PATH に
 // 入らないため、原因と対処（導入・自動探索・AITERM_TMUX 上書き）を正直に提示する。
 function tmuxMissingMessage() {
@@ -450,20 +526,22 @@ function agentClaudeDispatchReceiptPath(name, launchId, operationId) {
     return path.join(agentsDir(), `${name}.${launchId}.${validated.slice("sha256:".length)}.claude-dispatch`);
 }
 function existingAgentsDir() {
-    if (typeof process.getuid !== "function")
-        return null;
-    const root = path.join(runtimeStateBase(), `aiterm-mcp-${process.getuid()}`);
+    // Windows は getuid を持たないが、currentUid() が 0 を返し fs.Stats.uid も常に 0 のため
+    // owner 比較は自然に通過する（currentUid の既知制約受容と同じ）。以前はここで null を返して
+    // いたため、Windows では close/killAll の agent state 掃除が常に no-op になり、同名 session の
+    // 再起動が「agent metadata が複数あります」で失敗していた（実被弾 2026-08-15）。
+    const root = path.join(runtimeStateBase(), `aiterm-mcp-${currentUid()}`);
     const dir = path.join(root, "agents");
     try {
         const rst = fs.lstatSync(root);
-        if (!rst.isDirectory() || rst.isSymbolicLink() || rst.uid !== process.getuid())
+        if (!rst.isDirectory() || rst.isSymbolicLink() || rst.uid !== currentUid())
             return null;
-        if ((rst.mode & 0o077) !== 0)
+        if (!isWin && (rst.mode & 0o077) !== 0)
             fs.chmodSync(root, 0o700);
         const st = fs.lstatSync(dir);
-        if (!st.isDirectory() || st.isSymbolicLink() || st.uid !== process.getuid())
+        if (!st.isDirectory() || st.isSymbolicLink() || st.uid !== currentUid())
             return null;
-        if ((st.mode & 0o077) !== 0)
+        if (!isWin && (st.mode & 0o077) !== 0)
             fs.chmodSync(dir, 0o700);
         return dir;
     }
@@ -1625,7 +1703,11 @@ function resolveAndValidateGrokAuth(srcHome) {
     try {
         fd = fs.openSync(authPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
         const st = fs.fstatSync(fd);
-        if (!st.isFile() || st.nlink !== 1 || st.uid !== currentUid() || (st.mode & 0o077) !== 0 || st.size > GROK_AUTH_MAX_BYTES) {
+        // Windows の fs.Stats.mode は POSIX permission bit を持たず、常に 666/777 相当を報告する
+        // （NTFS ACL は別体系）。currentUid と同じ既知制約の明示的受容として、Windows では
+        // group/other bit 検証を行わない。isFile・nlink・owner・size・O_NOFOLLOW・realpath 検証は共通に維持する。
+        const worldAccessible = !isWin && (st.mode & 0o077) !== 0;
+        if (!st.isFile() || st.nlink !== 1 || st.uid !== currentUid() || worldAccessible || st.size > GROK_AUTH_MAX_BYTES) {
             throw new AitermError("Grok 認証正本の安全検証に失敗しました", 2);
         }
         const value = JSON.parse(fs.readFileSync(fd, "utf8"));
@@ -1643,7 +1725,8 @@ function resolveAndValidateGrokAuth(srcHome) {
             // /tmp のような root 所有 + sticky の共有 directory は、本人所有の private な
             // 直下 directory を他 UID が rename/unlink できないため許可する。sticky 無しの
             // group/other writable 祖先は path swap が可能なので従来どおり拒否する。
-            const writableByOthers = (dirSt.mode & 0o022) !== 0;
+            // Windows は directory も mode bit を持たない（常に 777 相当）ため、同じ受容で除外する。
+            const writableByOthers = !isWin && (dirSt.mode & 0o022) !== 0;
             const protectedSharedRoot = dirSt.uid === 0 && (dirSt.mode & 0o1000) !== 0;
             if (!dirSt.isDirectory()
                 || dirSt.isSymbolicLink()
@@ -3376,8 +3459,9 @@ function isAgentTuiReady(kind, screen) {
     }
     // Grok Build 0.2.117 は起動完了後に製品名を消し、model footerだけを残す。
     // Composerも同じfrontendでmodel名だけが異なるため、両方をvendor UIの根拠にする。
+    // Windows native grok.exe（1.0.4 実測）は入力欄markerを `❯` でなく `>` で描画するため両方を受ける。
     const grokFrontend = screen.includes("Grok Build") || /\b(?:Grok|Composer)\s+[\w.()-]+/.test(screen);
-    return grokFrontend && /(^|\n|\s)❯/.test(screen);
+    return grokFrontend && /(^|\n|\s)[❯>]/.test(screen);
 }
 // Codex/Claude は実行中に「(esc to interrupt)」を表示する（実機採取）。startup 側の処理
 // （MCP initialize 等）が走ったまま composer だけ描画されている画面は入力受付とみなさない。
@@ -3441,7 +3525,8 @@ function agentSubmitResidueOnScreen(kind, screen, tail) {
     const lines = screen.split("\n");
     // 入力欄マーカーは ready 判定と同じ記号を行頭基準で探す。submit 済みの transcript echo は
     // マーカー行より上に出るため、最後のマーカー行以降だけを composer 領域として見る。
-    const markerRe = kind === "codex" ? /^\s*[›>]/ : kind === "claude" ? /^\s*❯/ : /(^|\s)❯/;
+    // grok/composer は Windows native 描画（`>`・実測 1.0.4）も ready 判定と同様に受ける。
+    const markerRe = kind === "codex" ? /^\s*[›>]/ : kind === "claude" ? /^\s*❯/ : /(^|\s)[❯>]/;
     let markerIdx = -1;
     for (let i = lines.length - 1; i >= 0; i--) {
         if (markerRe.test(lines[i])) {
@@ -3937,7 +4022,7 @@ function resolveAgentBin(kind) {
         ? ["CLAUDE_BIN", [".local", "bin", "claude"], "claude"]
         : kind === "codex"
             ? ["CODEX_BIN", [".local", "bin", "codex"], "codex"]
-            : ["GROK_BIN", [".grok", "bin", "grok"], "grok"];
+            : ["GROK_BIN", [".grok", "bin", isWin ? "grok.exe" : "grok"], "grok"];
     const fromEnv = process.env[envVar];
     if (fromEnv) {
         // 明示指定 env は実在を検証する。存在しないパスを黙って返すと、session を作って
@@ -4158,8 +4243,9 @@ function shq(s) {
 }
 // grok CLI はモデル未指定だと端末側 default に従うため、ツール契約として既定 slug を固定する。
 // codex は既定 slug を持たず端末 config／CLI 既定に委ねる（起動応答で実効値を報告する）。
+// grok 既定は dotagents 規範（docs/02_models.md: xAI 旗艦 = grok-4.6）に従う。
 const GROK_MODEL_DEFAULTS = {
-    grok: "grok-4.5",
+    grok: "grok-4.6",
     composer: "grok-composer-2.5-fast",
 };
 const CLAUDE_EFFORTS = new Set(["low", "medium", "high", "xhigh", "max"]);
@@ -4197,7 +4283,10 @@ function buildAgentCmd(kind, bin, model, effort, prompt, meta = null) {
         if (effort)
             parts.push("--reasoning-effort", shq(effort));
         if ((meta?.kind === "grok" || meta?.kind === "composer") && meta.write_scope === "read-only") {
-            parts.push("--sandbox", "read-only");
+            // read-only は sandbox が実効書込み禁止を作るため、MCP ツール許可ダイアログの自動承認を
+            // 付けても能力は増えない。無人 subagent が初回 MCP 使用の許可待ちで停止する実障害への対処。
+            // read-only 以外の launch には付けない＝権限拡大しない。
+            parts.push("--sandbox", "read-only", "--always-approve");
         }
         if ((meta?.kind === "grok" || meta?.kind === "composer") && meta.hook_route === "shared_grok_home") {
             parts.push("--session-id", shq(meta.vendor_session_id ?? ""), "--rules", shq(subagentInstruction(meta)));
@@ -4209,36 +4298,51 @@ function buildAgentCmd(kind, bin, model, effort, prompt, meta = null) {
         parts.push(shq(prompt)); // 初手プロンプト（任意）
     return parts.join(" ");
 }
-function agentEnvPrefix(meta, sid, envVars = []) {
+// Windows native .exe を WSL pane から interop 起動する時だけ、生きた anchor socket と、
+// 注入 env を Win32 process まで運ぶ WSLENV(/w) を先頭へ加える（WSL 側の env は interop 先の
+// Windows process へ既定では渡らない・実測 2026-08-15）。POSIX と非 native bin では不変。
+export function winInteropEnvTokens(tokens, interopSocket) {
+    if (!interopSocket)
+        return tokens;
+    const names = tokens.map((token) => token.slice(0, token.indexOf("=")));
+    return [
+        `WSL_INTEROP=${shq(interopSocket)}`,
+        ...(names.length ? [`WSLENV=${names.map((name) => `${name}/w`).join(":")}`] : []),
+        ...tokens,
+    ];
+}
+function agentEnvPrefix(meta, sid, envVars = [], interopSocket = null) {
     const inherited = envVars.flatMap((name) => {
         const value = process.env[name];
         return value === undefined ? [] : [`${name}=${shq(value)}`];
     });
-    if (!meta)
-        return inherited.length ? inherited.join(" ") + " " : "";
-    const common = [
-        ...inherited,
-        `AITERM_AGENT_KIND=${shq(meta.kind)}`,
-        `AITERM_SESSION_ID=${shq(sid)}`,
-        `AITERM_AGENT_SESSION_ID=${shq(sid)}`,
-        `AITERM_AGENT_LAUNCH_ID=${shq(meta.launch_id)}`,
-        `AITERM_AGENT_ROLE=${shq(meta.agent_role ?? "subagent")}`,
-        `AITERM_AGENT_PARENT_SESSION_ID=${shq(meta.parent_session_id ?? "host-root")}`,
-        `AITERM_AGENT_DEPTH=${shq(String(meta.delegation_depth ?? 1))}`,
-        `AITERM_AGENT_LINEAGE=${shq(meta.lineage ?? `host-root>${meta.kind}:${sid}`)}`,
-        `AITERM_AGENT_DELEGATION_ALLOWED=${shq(meta.delegation_allowed === true ? "true" : "false")}`,
-    ];
-    if (meta.kind === "claude") {
-        return common.join(" ") + " ";
-    }
-    if (meta.kind === "codex") {
-        return common.join(" ") + " ";
-    }
-    return [
-        ...(meta.grok_auth_path ? [`GROK_AUTH_PATH=${shq(meta.grok_auth_path)}`] : []),
-        "GROK_DISABLE_AUTOUPDATER=1",
-        ...common,
-    ].join(" ") + " ";
+    const tokens = (() => {
+        if (!meta)
+            return inherited;
+        const common = [
+            ...inherited,
+            `AITERM_AGENT_KIND=${shq(meta.kind)}`,
+            `AITERM_SESSION_ID=${shq(sid)}`,
+            `AITERM_AGENT_SESSION_ID=${shq(sid)}`,
+            `AITERM_AGENT_LAUNCH_ID=${shq(meta.launch_id)}`,
+            `AITERM_AGENT_ROLE=${shq(meta.agent_role ?? "subagent")}`,
+            `AITERM_AGENT_PARENT_SESSION_ID=${shq(meta.parent_session_id ?? "host-root")}`,
+            `AITERM_AGENT_DEPTH=${shq(String(meta.delegation_depth ?? 1))}`,
+            `AITERM_AGENT_LINEAGE=${shq(meta.lineage ?? `host-root>${meta.kind}:${sid}`)}`,
+            `AITERM_AGENT_DELEGATION_ALLOWED=${shq(meta.delegation_allowed === true ? "true" : "false")}`,
+        ];
+        if (meta.kind === "claude" || meta.kind === "codex")
+            return common;
+        // grok/composer: 検証済み auth 正本をそのままの path 形で渡す。Windows では native 強制により
+        // vendor は Windows process なので、Windows ドライブパスが正しい形（WSL 形への変換はしない）。
+        return [
+            ...(meta.grok_auth_path ? [`GROK_AUTH_PATH=${shq(meta.grok_auth_path)}`] : []),
+            "GROK_DISABLE_AUTOUPDATER=1",
+            ...common,
+        ];
+    })();
+    const finalTokens = winInteropEnvTokens(tokens, interopSocket);
+    return finalTokens.length ? finalTokens.join(" ") + " " : "";
 }
 function agentLabel(kind) {
     return kind === "claude"
@@ -4256,7 +4360,8 @@ function buildAgentLaunchNote(kind, model, effort, meta) {
     const writeScopeNote = meta?.write_scope === undefined
         ? ""
         : (kind === "codex" || kind === "grok" || kind === "composer") && meta.write_scope === "read-only"
-            ? `\n能力宣言: write_scope=${JSON.stringify(meta.write_scope)}。${agentLabel(kind)} CLIへ --sandbox read-only を付与し、書込みを実効禁止。`
+            ? `\n能力宣言: write_scope=${JSON.stringify(meta.write_scope)}。${agentLabel(kind)} CLIへ --sandbox read-only を付与し、書込みを実効禁止。` +
+                (kind === "codex" ? "" : "MCPツール許可は --always-approve で自動承認（sandbox内のため能力拡大なし）。")
             : `\n能力宣言: write_scope=${JSON.stringify(meta.write_scope)}。パス単位のsandbox allowlistに対応するCLI引数がないため宣言の記録のみ（構造的unsupported）。`;
     if (kind === "claude") {
         return `起動設定: model=${model ?? "CLI既定"} effort=${effort ?? "CLI既定"}。${writeScopeNote}`;
@@ -4406,10 +4511,22 @@ export function openAgent(kind, opts = {}) {
     // Windows は起動コマンドが WSL 内 bash で走る（tmux ブリッジ）。bin/cwd を /mnt/c/... 形へ変換して
     // 渡す（ログの toWslPath と対称・A1）。前提: Windows 側に CLI を導入（resolveAgentBin が Windows
     // パスで解決）。toWslPath は session を作る前に呼ぶ＝変換失敗（非ドライブパス）で残骸 session を残さない。
-    // 未検証リスク: npm グローバル導入の codex.cmd/.bat シムや WSL interop 上の対話 TUI 描画は実 Windows
-    // でしか確認できない（CI 非対象。docs/03_audit-sweep-2026-07.md 参照）。
+    // 未検証リスク: npm グローバル導入の codex.cmd/.bat シムの対話 TUI 描画は実 Windows でしか確認
+    // できない（CI 非対象。docs/03_audit-sweep-2026-07.md 参照）。native .exe の interop 起動と
+    // TUI 描画は grok.exe で実測済み（2026-08-15）。
+    // Windows の grok/composer は Windows native の grok.exe だけを起動する（オーナー裁定 2026-08-15:
+    // WindowsネイティブはWindowsネイティブで完結させ、WSL2へ持ち込まない）。WSL 側 grok を起動すると
+    // vendor 実体が WSL process になり、auth・session 記録（events/chat_history）が WSL home 側へ分裂して
+    // transcript／completion を回収できない（実被弾: 2026-08-15 olc-plan-review-grok2）。
+    if (isWin && (kind === "grok" || kind === "composer") && !isWindowsNativeExecutable(bin)) {
+        ownTelemetryFailure("AITERM.VENDOR_LAUNCHER_FAILED", new AitermError(`Windows の ${label} launcher は Windows native の grok.exe だけを起動できます（現在の解決先: ${bin}）。` +
+            "Windows 版 Grok CLI を導入するか、GROK_BIN に grok.exe の絶対パスを指定してください。", 2), 2);
+    }
     const binForCmd = agentBinForWslShell(bin);
     const cwdForCmd = cwd && isWin ? toWslPath(cwd) : cwd;
+    // native .exe を pane 内で interop 起動するには生きた WSL_INTEROP が必須（anchor 解説参照）。
+    // session 作成前に確保し、失敗時は残骸 session を残さない。
+    const interopSocket = isWin && isWindowsNativeExecutable(bin) ? ensureWinInteropAnchor() : null;
     const grokAuthPath = agentDone && (kind === "grok" || kind === "composer") ? resolveAndValidateGrokAuth(realGrokHome()) : null;
     if (kind === "grok" || kind === "composer") {
         const requestedModel = model ?? (kind === "composer" ? GROK_MODEL_DEFAULTS.composer : null);
@@ -4442,7 +4559,7 @@ export function openAgent(kind, opts = {}) {
             agentMetadataNegativeCache.delete(sid);
         launchNote = buildAgentLaunchNote(kind, model, effort, meta);
         const cmd = buildAgentCmd(kind, binForCmd, model, effort, opts.prompt ?? null, meta);
-        const envPrefix = agentEnvPrefix(meta, sid, envVars);
+        const envPrefix = agentEnvPrefix(meta, sid, envVars, interopSocket);
         const full = cwdForCmd ? `cd ${shq(cwdForCmd)} && ${envPrefix}${cmd}` : `${envPrefix}${cmd}`;
         // force:true で送る。起動骨格は `bin '...'` の固定形で、prompt/cwd/effort は shq でクオート済みの
         // 引数＝シェルは決して破壊コマンドとして実行しない。破壊ゲート（生シェルコマンド想定）を prompt に

package/dist/index.js

@@ -430,7 +430,7 @@ const agentModelDesc = (kind) => kind === "claude"
     : kind === "codex"
         ? "起動モデル（例: gpt-5.6-sol / gpt-5.6-terra / gpt-5.6-luna）。省略時は端末 config／CLI 既定を継承" +
             "（端末側のピンがそのまま効く。実効値は起動応答に明示される）"
-        : `起動モデル。省略時は ${kind === "grok" ? "grok-4.5" : "grok-composer-2.5-fast"}。` +
+        : `起動モデル。省略時は ${kind === "grok" ? "grok-4.6" : "grok-composer-2.5-fast"}。` +
             (kind === "composer"
                 ? "既定／explicit modelを起動前にlive catalogへ照合し、不在ならfallbackせずエラー"
                 : "explicit modelを起動前にlive catalogへ照合し、不在ならfallbackせずエラー");
@@ -560,7 +560,7 @@ registerAgentTool("codex_agent", "codex", "【Codex (OpenAI)】の対話エー
     agentCompletionDesc +
     "model / reasoning_effort を引数で指定可" +
     "（省略時は端末 config／CLI 既定を継承。実効値は起動応答に明示）。");
-registerAgentTool("grok_agent", "grok", "【Grok Build の Grok モデル (既定 grok-4.5)】の対話エージェント TUI を永続端末に起動する。" +
+registerAgentTool("grok_agent", "grok", "【Grok Build の Grok モデル (既定 grok-4.6)】の対話エージェント TUI を永続端末に起動する。" +
     agentEnvironmentDesc +
     "turn は pty_send で送る（自動で非ブロック dispatch になる）。" +
     agentCompletionDesc +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.25.2",
+  "version": "0.26.0",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent tmux terminal MCP for launching and driving Claude, Codex, Grok, or Composer from any MCP client, cross-vendor or same-vendor. Also runs durable PTY sessions for SSH, containers, and REPLs.",
   "keywords": [