aiterm-mcp 0.28.2 → 0.28.4

package/README.ja.md

@@ -459,7 +459,7 @@ handoff contextを前置きできる。この任意経路は`throughline >= 0.9.
 - **Node.js >= 18**
 - **tmux または psmux**（実行時の前提）
   - **macOS / Linux / WSL2** は tmux を直接使う。macOS は同梱されないので `brew install tmux` で導入する。MCP クライアントがターミナルでなく **GUI から起動**された場合、Homebrew の bin（Apple Silicon: `/opt/homebrew/bin`、Intel: `/usr/local/bin`）が `PATH` に入らないことがある。その場合 aiterm が自動で探索するか、**`AITERM_TMUX=/path/to/tmux`** で明示指定する。
-  - **Windows ネイティブ**は WSL を使わず、tmux CLI互換の [psmux](https://github.com/psmux/psmux) **3.3.8以上**を直接使う（`winget install marlocarlo.psmux`）。pane shell用に Git for Windows も必要。解決先は **`AITERM_PSMUX`**／**`AITERM_BASH`** で上書きできる。Windows toolはSSHと同じく入れ子で握れ、`pty_send "powershell.exe"`でPowerShellへ入れる。
+  - **Windows ネイティブ**は WSL を使わず、tmux CLI互換の [psmux](https://github.com/psmux/psmux) **3.3.8以上**をAitermのterminal/session multiplexer backendとして使う（`winget install marlocarlo.psmux`）。**psmuxはshellではない。** `pty_open`の既定shellはPowerShell 7（`pwsh.exe`）で、Windows PowerShell 5.1・PowerShell 6・`cmd.exe`へfallbackしない。5.1しかなければMicrosoft公式installer／package managerで7を導入してから使う。Git for Windowsはharness launcherが内部で明示するBash shell用に引き続き必要。解決先は **`AITERM_PSMUX`**／**`AITERM_BASH`** で上書きできる。他製品はpsmuxへ直接依存せず、永続端末をAiterm公開APIから利用する。
 - **agent harness**を使う場合: 対応CLIを製品所有者の公式経路で導入・認証する。CursorはmacOS／Linux／WSLで`curl https://cursor.com/install -fsS | bash`、Windows nativeで`irm 'https://cursor.com/install?win32=true' | iex`を使い、`agent login`で認証、`agent update`で更新する。Aitermは`cursor-agent`を起動する。portable forkだけは追加で`throughline >= 0.9.0`が必要。
 - 任意: [`rtk`](https://github.com/rtk-ai/rtk) バイナリ（`pty_send` の `rtk: true` 委譲で使う。無くても動く）
 

package/README.md

@@ -501,7 +501,7 @@ Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on na
 - **Node.js >= 18**
 - **tmux or psmux** (platform runtime prerequisite)
   - **macOS / Linux / WSL2** run tmux directly. On macOS install it with `brew install tmux` (stock macOS ships none). If your MCP client is launched from the **GUI** rather than a terminal, Homebrew's bin (`/opt/homebrew/bin` on Apple Silicon, `/usr/local/bin` on Intel) may be off its `PATH`; aiterm auto-searches those locations, or set **`AITERM_TMUX=/path/to/tmux`** to point at it explicitly.
-  - **Native Windows** has no tmux, so aiterm drives [psmux](https://github.com/psmux/psmux) — a tmux-CLI-compatible native multiplexer — with a per-install `-L` namespace. **No WSL is required.** Install psmux **3.3.8 or newer** (`winget install marlocarlo.psmux`; 3.3.8 is the first release whose `pipe-pane` file sink, byte-exact `paste-buffer` wire, and foreground `#{pane_current_command}` behave the way aiterm's capture/dispatch paths rely on), plus [Git for Windows](https://gitforwindows.org/) whose `bash.exe` becomes the pane shell (System32's `bash.exe` is the WSL launcher and is deliberately not used). Override resolution with **`AITERM_PSMUX`** / **`AITERM_BASH`** when the binaries live elsewhere. You reach Windows tools the same way you reach SSH: `pty_send "powershell.exe …"` nests into PowerShell. The `grok-cli` harness and its deprecated aliases launch the **Windows-native** Grok CLI (`%USERPROFILE%\.grok\bin\grok.exe`, or `GROK_BIN` pointing at a `.exe`) as a Windows process, and a WSL-side grok is rejected before a session is created so product auth and session records never split across an OS boundary.
+  - **Native Windows** has no tmux, so aiterm drives [psmux](https://github.com/psmux/psmux) — a tmux-CLI-compatible native terminal/session multiplexer — with a per-install `-L` namespace. **psmux is not a shell.** `pty_open` defaults to PowerShell 7 (`pwsh.exe`) and never falls back to Windows PowerShell 5.1, PowerShell 6, or `cmd.exe`; if only 5.1 is installed, use Microsoft's official installer or package manager first. Install psmux **3.3.8 or newer** (`winget install marlocarlo.psmux`; 3.3.8 is the first release whose `pipe-pane` file sink, byte-exact `paste-buffer` wire, and foreground `#{pane_current_command}` behave the way aiterm's capture/dispatch paths rely on). [Git for Windows](https://gitforwindows.org/) remains required for the explicit Bash shell used internally by harness launchers; System32's `bash.exe` is the WSL launcher and is deliberately not used. Override multiplexer/Bash resolution with **`AITERM_PSMUX`** / **`AITERM_BASH`**. Other products consume persistent terminals through Aiterm's public API instead of depending on psmux directly.
 - For **agent harnesses**: the selected CLI, installed and authenticated through its product owner's official path — `claude`, `codex`, `grok`, or Cursor's `cursor-agent`. Portable fork additionally needs `throughline >= 0.9.0`; ordinary clean launch does not. (Not needed if you only use the PTY tools.)
 - Optional: the [`rtk`](https://github.com/rtk-ai/rtk) binary (used by `pty_send`'s `rtk: true` delegation; works fine without it)
 

package/dist/agent-resolver.js

@@ -5,6 +5,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 import { AitermError } from "./errors.js";
+import { resolveWindowsPowerShell7 } from "./windows-powershell.js";
 import { isWin } from "./tmux-runtime.js";
 export function isUsableExecutableFile(candidate) {
     try {
@@ -84,7 +85,12 @@ export function spawnAgentControlCommand(bin, args, _cwd, options) {
     return spawnSync(bin, args, options);
 }
 export function resolveWinPaneShell(shell) {
-    if (!isWin || shell !== "bash")
+    if (!isWin)
+        return shell;
+    if (["powershell", "powershell.exe", "pwsh", "pwsh.exe"].includes(path.basename(shell).toLowerCase())) {
+        return resolveWindowsPowerShell7();
+    }
+    if (shell !== "bash")
         return shell;
     const fromEnv = process.env.AITERM_BASH;
     if (fromEnv) {
@@ -166,7 +172,7 @@ export function runThroughlineHandoffContext(bin, sessionId) {
     if (isWin && /\.(?:cmd|bat)$/i.test(bin)) {
         const ps1 = path.join(path.dirname(bin), `${path.basename(bin, path.extname(bin))}.ps1`);
         if (fs.existsSync(ps1)) {
-            return spawnSync("powershell.exe", [
+            return spawnSync(resolveWindowsPowerShell7(), [
                 "-NoLogo",
                 "-NoProfile",
                 "-NonInteractive",

package/dist/agent-shared.js

@@ -1,35 +1,12 @@
 // harness中立の共有プリミティブ。core と harnesses/ の両方が依存する最下層で、
 // tmux-runtime / errors 以外の内部moduleへ依存しない（依存方向: core → harnesses → agent-shared）。
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import { randomBytes } from "node:crypto";
 import { AitermError } from "./errors.js";
 export const sleep = (ms) => new Promise((res) => setTimeout(res, ms));
-export function currentUid() {
-    // Windows(native)は process.getuid を持たない。以前はここで throw していたが、
-    // agent metadata の存在確認経由で素の pty_send まで巻き込んで全 send を殺していた。
-    // Windows の fs.Stats.uid は常に 0 なので、ここも 0 を返せば owner 比較
-    // (st.uid !== currentUid()) は自然に通過する。Windows は POSIX owner 検証を
-    // 持たない（NTFS ACL は別体系）という既知の制約の明示的受容であり、POSIX 側は
-    // getuid をそのまま返すため挙動不変。
-    if (typeof process.getuid !== "function")
-        return 0;
-    return process.getuid();
-}
-export function runtimeStateBase() {
-    const xdg = process.env.XDG_RUNTIME_DIR;
-    if (xdg) {
-        try {
-            if (fs.statSync(xdg).isDirectory())
-                return xdg;
-        }
-        catch {
-            /* XDG_RUNTIME_DIR が壊れている CI/非 login 環境では os.tmpdir() に戻す */
-        }
-    }
-    return os.tmpdir();
-}
+import { currentUid, runtimeStateBase } from "./state-root.js";
+export { currentUid, runtimeStateBase };
 export function safeStatSize(p) {
     try {
         return fs.statSync(p).size;

package/dist/claude-stop-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
+import { currentUid as uid, runtimeStateBase } from "./state-root.js";
 import { createHash, randomBytes } from "node:crypto";
 const LAUNCH_ID_RE = /^[0-9a-f]{32}$/;
 const SESSION_RE = /^[A-Za-z0-9_-]{1,64}$/;
@@ -21,26 +21,6 @@ function hasAitermEnv() {
         process.env.AITERM_AGENT_SESSION_ID ||
         process.env.AITERM_AGENT_LAUNCH_ID);
 }
-function uid() {
-    // state root のパス構成要素 `aiterm-mcp-<uid>` にだけ使う。Windows(native) は
-    // process.getuid を持たないため core の currentUid() と同じ受容で 0 を返す。
-    if (typeof process.getuid !== "function")
-        return 0;
-    return process.getuid();
-}
-function runtimeStateBase() {
-    const xdg = process.env.XDG_RUNTIME_DIR;
-    if (xdg) {
-        try {
-            if (fs.statSync(xdg).isDirectory())
-                return xdg;
-        }
-        catch {
-            /* 壊れたXDG_RUNTIME_DIRはTMPDIRへ戻す */
-        }
-    }
-    return os.tmpdir();
-}
 function agentsDir() {
     // state root は OS が与える per-user runtime dir（XDG_RUNTIME_DIR / os.tmpdir()）の下にある。
     // 以前はここで symlink・owner・mode を検査していたが、共有 /tmp に敵対的な同居主体がいる

package/dist/grok-stop-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
+import { currentUid as uid, runtimeStateBase } from "./state-root.js";
 const LAUNCH_ID_RE = /^[0-9a-f]{32}$/;
 const SESSION_RE = /^[A-Za-z0-9_-]{1,64}$/;
 const MAX_STDIN_BYTES = 1024 * 1024;
@@ -18,29 +18,6 @@ function hasAitermEnv() {
         process.env.AITERM_AGENT_SESSION_ID ||
         process.env.AITERM_AGENT_LAUNCH_ID);
 }
-function uid() {
-    // Windows(native) は process.getuid を持たない。core の currentUid()・claude-stop-hook と
-    // 同じ受容として 0 を返す（Windows の fs.Stats.uid は常に 0 のため owner 比較は自然に
-    // 通過する。NTFS ACL は別体系）。POSIX は getuid のまま＝挙動不変。
-    // 以前はここで fail していたため、Windows では Grok/Composer の完了 event が
-    // 一度も書かれず aiterm-wait が timeout まで返らなかった。
-    if (typeof process.getuid !== "function")
-        return 0;
-    return process.getuid();
-}
-function runtimeStateBase() {
-    const xdg = process.env.XDG_RUNTIME_DIR;
-    if (xdg) {
-        try {
-            if (fs.statSync(xdg).isDirectory())
-                return xdg;
-        }
-        catch {
-            /* XDG_RUNTIME_DIR が壊れている CI/非 login 環境では os.tmpdir() に戻す */
-        }
-    }
-    return os.tmpdir();
-}
 function agentsDir() {
     const root = path.join(runtimeStateBase(), `aiterm-mcp-${uid()}`);
     const agents = path.join(root, "agents");

package/dist/index.js

@@ -84,13 +84,14 @@ server.registerTool("diagnostics", {
     description: "Factory 向け read-only 診断。安全な状態語彙だけを機械可読 JSON で返す（PTY 内容・認証情報・path・環境値は返さない）。",
     inputSchema: {},
 }, async () => ok(await factoryDiagnostics()));
+const DEFAULT_PTY_SHELL = process.platform === "win32" ? "pwsh" : "bash";
 server.registerTool("pty_open", {
     description: "ローカル永続端末(tmux セッション)を1個開き、session_id を返す。tmux サーバ常駐ゆえ本サーバや " +
         "クライアントが再起動してもセッションは生存する。リモート操作は専用ツールにせず、開いた端末の中で " +
         'pty_send(session_id, "ssh host") と打って入る。',
     inputSchema: {
         name: z.string().nullish().describe("セッション名（省略時は t1, t2... を自動採番）"),
-        shell: z.string().default("bash").describe("起動シェル（既定 bash）"),
+        shell: z.string().default(DEFAULT_PTY_SHELL).describe(`起動シェル（既定 ${DEFAULT_PTY_SHELL}）`),
     },
 }, async ({ name, shell }) => {
     try {

package/dist/runtime-error-os.js

@@ -5,6 +5,7 @@ import { spawn, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { resolveWindowsPowerShell7, windowsPowerShell7Command } from "./windows-powershell.js";
 export function defaultRuntimeErrorPaths(options = {}) {
     const platform = options.platform ?? process.platform;
     const home = options.home ?? os.homedir();
@@ -26,7 +27,9 @@ const WINDOWS_DACL_VERIFY_SCRIPT = String.raw `
 $ErrorActionPreference='Stop'
 $target=$env:AITERMMCP_ACL_PATH; $kind=$env:AITERMMCP_ACL_KIND
 $sid=[Security.Principal.WindowsIdentity]::GetCurrent().User
-$check=if($kind -eq 'directory'){[IO.Directory]::GetAccessControl($target)}else{[IO.File]::GetAccessControl($target)}
+$item=Get-Item -LiteralPath $target
+$sections=[Security.AccessControl.AccessControlSections]::Access -bor [Security.AccessControl.AccessControlSections]::Owner
+$check=[IO.FileSystemAclExtensions]::GetAccessControl($item,$sections)
 $ownerSid=$check.GetOwner([Security.Principal.SecurityIdentifier]).Value
 $rules=@($check.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]))
 if($ownerSid -ne $sid.Value -or $rules.Count -ne 1 -or $rules[0].IdentityReference.Value -ne $sid.Value -or $rules[0].AccessControlType -ne 'Allow' -or $rules[0].IsInherited -or (($rules[0].FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -ne [Security.AccessControl.FileSystemRights]::FullControl)){exit 9}
@@ -38,18 +41,18 @@ $sid=[Security.Principal.WindowsIdentity]::GetCurrent().User
 if($kind -eq 'directory'){$acl=New-Object Security.AccessControl.DirectorySecurity;$inherit=[Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'}else{$acl=New-Object Security.AccessControl.FileSecurity;$inherit=[Security.AccessControl.InheritanceFlags]::None}
 $acl.SetOwner($sid); $acl.SetAccessRuleProtection($true,$false)
 $rule=New-Object Security.AccessControl.FileSystemAccessRule($sid,[Security.AccessControl.FileSystemRights]::FullControl,$inherit,[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow)
-$acl.AddAccessRule($rule); if($kind -eq 'directory'){[IO.Directory]::SetAccessControl($target,$acl)}else{[IO.File]::SetAccessControl($target,$acl)}
+$acl.AddAccessRule($rule); $item=Get-Item -LiteralPath $target; [IO.FileSystemAclExtensions]::SetAccessControl($item,$acl)
 ` + WINDOWS_DACL_VERIFY_SCRIPT;
 export function windowsPrivateDaclCommand(target, kind = "directory") {
     return {
-        command: "powershell.exe",
+        command: windowsPowerShell7Command(),
         args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", WINDOWS_DACL_SCRIPT],
         env: { ...process.env, AITERMMCP_ACL_PATH: target, AITERMMCP_ACL_KIND: kind },
     };
 }
 export function windowsPrivateDaclVerifyCommand(target, kind = "file") {
     return {
-        command: "powershell.exe",
+        command: windowsPowerShell7Command(),
         args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", WINDOWS_DACL_VERIFY_SCRIPT],
         env: { ...process.env, AITERMMCP_ACL_PATH: target, AITERMMCP_ACL_KIND: kind },
     };
@@ -128,7 +131,7 @@ export function processStartIdentity(pid, platform, timeoutMs = 1000) {
     }
     if (platform === "win32") {
         const script = "$p=Get-Process -Id $env:AITERMMCP_PROCESS_ID -ErrorAction Stop; $p.StartTime.ToUniversalTime().Ticks";
-        const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+        const result = spawnSync(resolveWindowsPowerShell7(), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
             encoding: "utf8", timeout: timeoutMs, maxBuffer: 4096, windowsHide: true,
             env: { ...process.env, AITERMMCP_PROCESS_ID: String(pid) },
         });

package/dist/state-root.js

@@ -0,0 +1,30 @@
+// state root（`aiterm-mcp-<uid>`）の位置決めの唯一の置き場。node builtin 以外へ依存しない最下層で、
+// 単体実行される stop hook 2本と agent-shared がここだけを共有する（campaign 32 の maintenance queue
+// に積んだ uid()/runtimeStateBase() の三重実装を解消。stop hook の「内部 module へ依存しない」設計は、
+// 本 module が builtin 依存だけであることで保たれる）。
+import * as fs from "node:fs";
+import * as os from "node:os";
+export function currentUid() {
+    // Windows(native)は process.getuid を持たない。以前はここで throw していたが、
+    // agent metadata の存在確認経由で素の pty_send まで巻き込んで全 send を殺していた。
+    // Windows の fs.Stats.uid は常に 0 なので、ここも 0 を返せば owner 比較
+    // (st.uid !== currentUid()) は自然に通過する。Windows は POSIX owner 検証を
+    // 持たない（NTFS ACL は別体系）という既知の制約の明示的受容であり、POSIX 側は
+    // getuid をそのまま返すため挙動不変。
+    if (typeof process.getuid !== "function")
+        return 0;
+    return process.getuid();
+}
+export function runtimeStateBase() {
+    const xdg = process.env.XDG_RUNTIME_DIR;
+    if (xdg) {
+        try {
+            if (fs.statSync(xdg).isDirectory())
+                return xdg;
+        }
+        catch {
+            /* XDG_RUNTIME_DIR が壊れている CI/非 login 環境では os.tmpdir() に戻す */
+        }
+    }
+    return os.tmpdir();
+}

package/dist/windows-powershell.js

@@ -0,0 +1,42 @@
+// Windows PowerShell実体の唯一の解決境界。5.1／cmd fallbackを持たず、検出したpwsh自身の
+// edition／majorを実行時に検証してから絶対pathを返す。
+import { spawnSync } from "node:child_process";
+import * as path from "node:path";
+import { AitermError } from "./errors.js";
+export const WINDOWS_POWERSHELL_7_COMMAND = "pwsh.exe";
+export const WINDOWS_POWERSHELL_7_INSTALL = "winget install --id Microsoft.PowerShell --source winget";
+export const WINDOWS_POWERSHELL_7_FIXTURE = "C:\\Program Files\\PowerShell\\7\\pwsh.exe";
+const defaultProbe = (command, args) => spawnSync(command, [...args], {
+    encoding: "utf8", timeout: 5000, maxBuffer: 16 * 1024, windowsHide: true,
+});
+let resolvedDefault = null;
+export function resolveWindowsPowerShell7(probe = defaultProbe) {
+    if (probe === defaultProbe && resolvedDefault !== null)
+        return resolvedDefault;
+    const located = probe("where.exe", [WINDOWS_POWERSHELL_7_COMMAND]);
+    const resolved = located.stdout?.split(/\r?\n/u)
+        .find(candidate => path.win32.isAbsolute(candidate)
+        && path.win32.basename(candidate).toLowerCase() === WINDOWS_POWERSHELL_7_COMMAND);
+    const fail = () => {
+        throw new AitermError(`PowerShell 7が必要です。Microsoft公式経路で導入してください: ${WINDOWS_POWERSHELL_7_INSTALL}`, 2);
+    };
+    if (located.status !== 0 || typeof resolved !== "string")
+        fail();
+    const executable = resolved;
+    const version = probe(executable, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command",
+        '[ordered]@{ edition = $PSVersionTable.PSEdition; major = $PSVersionTable.PSVersion.Major } | ConvertTo-Json -Compress']);
+    let identity = null;
+    try {
+        identity = JSON.parse(version.stdout?.trim() ?? "");
+    }
+    catch { /* typed failure below */ }
+    if (version.status !== 0 || identity?.edition !== "Core"
+        || !Number.isInteger(identity.major) || Number(identity.major) < 7)
+        fail();
+    if (probe === defaultProbe)
+        resolvedDefault = executable;
+    return executable;
+}
+export function windowsPowerShell7Command(platform = process.platform) {
+    return platform === "win32" ? resolveWindowsPowerShell7() : WINDOWS_POWERSHELL_7_FIXTURE;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.28.2",
+  "version": "0.28.4",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [