aiterm-mcp 0.61.10 → 0.61.12

package/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.12] - 2026-10-24
+
+### Validation scope
+
+- Linux full validation passed (1579 passed, 46 skipped, 0 failed). The affected native execution path passed its focused macOS gate (110 passed, 0 failed). The same focused gate on hosted Windows passed 23 tests and skipped 87 POSIX-only cases; this patch does not enable POSIX execution checkpoints on Windows or replace the Windows full acceptance recorded for 0.61.11. All fixtures use isolated metadata and CLI substitutes, without production seats or delivery replay.
+
+### Fixed
+
+- A newly connected participant in the opt-in POSIX native execution entry waits within the existing bounded metadata admission before committing its declared roles for its first asynchronous request. Previously, deferred enrollment tried a synchronous lock first and could return `EXECUTION_BUSY` while a concurrent metadata writer was about to finish. Scope and actor checks, synchronous refusal, removed-registration refusal and immediate-stop snapshots are preserved; no input or failed request is replayed.
+
+### Tests
+
+- Isolated cold-participant fixtures cover dispatch under a held writer, read-only registration, concurrent first requests, scope or actor changes while waiting, and refusal after registration removal. These reproduce and repair the product defect without assigning a cause to historical deliveries whose original native receipt was not retained.
+
+## [0.61.11] - 2026-10-24
+
+### Validation scope
+
+- Windows native full validation passed (908 passed, 709 skipped, 0 failed) on GitHub-hosted Windows 2022, Node 22 and psmux 3.3.8. Linux full validation passed (1574 passed, 46 skipped, 0 failed); macOS acceptance combines its previously passing full suite with the subsequent launch and shell-runtime focused gates. Validation uses isolated CLI fixtures; commercial image and real CLI acceptance remain separate.
+
+### Fixed
+
+- Shell dialect selection, current prompt reconciliation and encoding share one runtime entry for ordinary and marked sends. A stale psmux PowerShell report no longer sends PowerShell syntax into a current Git Bash prompt; raw input and TUI pastes remain literal.
+
+- Windows agent launches use the existing native PowerShell 7 launch adaptation for all harnesses. One shared argv construction feeds POSIX quoting and Windows native invocation; accepted shebang wrappers run through noninteractive Git Bash in the same pane. Startup commands no longer depend on the interactive MSYS bash console input loop. The original text limit is checked before the existing ASCII Base64 adaptation; TUI bodies remain literal.
+- Native Windows panes retain runtime additions to the caller PATH instead of replacing them with registry PATH. Explicit PATH entries keep precedence.
+- Non-raw PowerShell shell submissions establish UTF-8 input, output and native pipeline encoding in the submitted script, including single-line commands. Profiles, psmux interactive initialization, deferred Enter and raw PTY input retain their existing behavior.
+- Agent composer pastes retain their sanitized literal text even when the native foreground query still reports a startup shell. Shell encoding is limited to shell submissions.
+- Agent launch commands for Aiterm-owned bash panes are submitted as one physical line through the existing POSIX multiline adaptation, instead of one interactive line per embedded newline joined by continuation prompts. Argument bytes, lineage, metadata, native admission and receipts are unchanged, and the agent composer body remains literal.
+
+### Tests
+
+- Real Windows Bash panes retain literal multiline file bytes and correct completion for ordinary and marked sends even when the backend foreground report is deliberately replaced with `pwsh`. Native argv fixtures also verify the received read-only sandbox pair without relying on the startup command echo.
+
+- POSIX-only native test teardown also stays skipped on Windows. A file-level hook previously reached the psmux `tmux.exe` alias and stopped other fixture namespaces even when every test case was skipped. A native canary regression covers this boundary.
+- Argument fixtures wait for their final output marker within the existing deadline. Nested lineage assertions inspect child output instead of shell echo.
+- The portable-context fake TUI counts a bracketed multiline paste and its submit Enter as one input.
+- A bash round-trip check and a native launch regression compare the argv bytes a fake CLI received, through the CLI's own file, for quotes, backslashes, history characters, percent signs, Japanese text and newlines.
+
 ## [0.61.10] - 2026-10-23
 
 ### Validation scope
@@ -2782,7 +2821,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.10...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.12...HEAD
+[0.61.12]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.11...v0.61.12
+[0.61.11]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.10...v0.61.11
 [0.61.10]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.9...v0.61.10
 [0.61.9]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.8...v0.61.9
 [0.61.8]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.7...v0.61.8

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.10** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.12** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 
@@ -434,6 +434,9 @@ MCP クライアントが aiterm を stdio 越しにプログラムから駆動
 
 ## 仕組み
 
+Windows nativeのPowerShell shellへの非raw送信は、Console入出力とnative pipelineをUTF-8へ揃えます。実行時に追加した呼出元PATHは新しいpaneへ渡します。raw PTY入力は従来どおりです。
+agentの起動はPowerShell 7のpaneでargvを渡して実行し、受入済みshebang wrapperだけは同じpane内でGit Bashを非対話実行します。Aitermが作る起動scriptはASCIIの1行にし、agent TUIへ渡す本文は文字どおりに保ちます。
+
 ```mermaid
 flowchart LR
     AI["AI / MCP client<br/>(the orchestrator)"] -->|"pty_send · pty_observe · agent_launch · agent_models · agent_configure · agent_auth · agent_approval · claude_turn · claude_approval<br/>旧launcher alias · diagnostics"| S["aiterm-mcp<br/>stdio MCP · 18 tools"]
@@ -750,7 +753,7 @@ CLIが終了した結果不明の空起動には、BellTeam native入口の `age
 
 ## 人が覗く
 
-POSIXの明示native実行構成では、検証済みcallerへ通常メッセージが届く間も、そのcallerから別席への送信を継続できる。callerの世代や各requestのslotは書き換えない。agentの貼付け・Enterはmetadata mutexの競合を入力前に待ち、不明な操作・世代交代・停止では入力を止める。BellTeamは閉じた席をpromptなしの明示管理`agent_launch`で再作成できる。promptを送る呼出しには元の実行参照が必要である。
+POSIXの明示native実行構成では、検証済みcallerへ通常メッセージが届く間も、そのcallerから別席への送信を継続できる。callerの世代や各requestのslotは書き換えない。新しく接続した参加者も、初回の非同期要求で宣言済みの役割を保存する際は、既存の上限付きmetadata受付で競合を待つ。この待機は入力を再送しない。agentの貼付け・Enterはmetadata mutexの競合を入力前に待ち、不明な操作・世代交代・停止では入力を止める。BellTeamは閉じた席をpromptなしの明示管理`agent_launch`で再作成できる。promptを送る呼出しには元の実行参照が必要である。
 
 セッションは共有tmux socket（Windows nativeはpsmux namespace）上にある。`pty_open`／`agent_launch`の戻り値に表示されるattachコマンドで、人間がClaude／Codex／Grok／Cursor harnessの同じ端末へ入り、途中でキーボードを引き取れる。
 POSIXでは、tmuxのソケットがまだ無くても最初の`agent_launch`でserverを起動できる。Aitermは作成したsessionとserverを実際のreceiptから照合して受付を確定し、不明な結果を入力の再送で補わない。

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.10** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.12** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 
@@ -795,7 +795,7 @@ Each `pty_send` accepts at most 64 KiB of UTF-8 text. Sends to the same session
 
 ## A human can watch
 
-In the opt-in POSIX native execution entry, an ordinary message arriving at a verified caller can overlap that caller's outgoing send. It does not replace the caller's generation or clear either request's slot. Agent paste/submit segments wait for metadata mutex contention before input; uncertain operations, generation changes and stops still prevent input. BellTeam may explicitly recreate a closed session with a promptless management `agent_launch`; sending a prompt still requires its original execution reference.
+In the opt-in POSIX native execution entry, an ordinary message arriving at a verified caller can overlap that caller's outgoing send. It does not replace the caller's generation or clear either request's slot. A newly connected participant also waits within the existing bounded metadata admission to commit its declared roles before its first asynchronous request; that wait never replays input. Agent paste/submit segments wait for metadata mutex contention before input; uncertain operations, generation changes and stops still prevent input. BellTeam may explicitly recreate a closed session with a promptless management `agent_launch`; sending a prompt still requires its original execution reference.
 
 An explicit `agent_execution` action `reconcile_launch` can bind an existing empty launch after a lost launch result in this opt-in entry. Supply the original `request` and exact `target: {session_id, launch_id}`. The server checks the original native/server identity, current managed generation, raw no-prompt state and a live ready harness under metadata admission, then releases only that unknown launch slot. Repeating an accepted empty launch before its send also rechecks the current generation, readiness and absence of competing session operations; a saved acceptance alone cannot confirm a later generation. It never launches, types, closes or resends. `issued` RPCs, unknown input and changed or unverified generations remain blocked. Any subsequent body uses the original reference through normal send admission once; a successful reconciliation does not prove the lost RPC receipt.
 
@@ -806,6 +806,9 @@ Success retains the original unknown record and returns the serving SDK's distin
 For a returned unknown launch whose harness has exited, the same native entry admits explicit `pty_close` only after synchronous proof of the original native/server and managed generation, raw no-initial-prompt state, an unissued body send and an exited harness. It releases the failed launch slot after successful close and confirmed absence, preserving the original unknown record. Issued RPCs, live harnesses and missing input or generation evidence remain blocked. The old request is never replayed; a later ordinary request may create a fresh generation.
 
 
+On native Windows, non-raw commands sent to a PowerShell shell use UTF-8 for Console input/output and native pipelines. Runtime additions to the caller PATH are passed to new panes; raw PTY input is unchanged.
+Agent launches use a PowerShell 7 pane and pass the harness argv directly; accepted shebang wrappers use noninteractive Git Bash in that same pane. The owned startup script is sent as one ASCII line, while agent TUI bodies retain their literal text.
+
 Sessions live on a shared tmux socket on POSIX or a shared psmux namespace on native Windows. The attach line printed by `pty_open` and `agent_launch` lets a human attach to the same terminal and intervene, including a Claude/Codex/Grok/Cursor harness session: `tmux -S … attach -t <id>` on POSIX, or `psmux -L <namespace> attach -t <id>` on native Windows.
 On POSIX, the first `agent_launch` can create the tmux server when its socket does not yet exist. Aiterm verifies the exact created session and server before accepting that launch; an uncertain result is reported without retrying the input.
 

package/dist/agent-resolver.js

@@ -1,4 +1,4 @@
-// エージェント CLI（claude / codex / grok / cursor-agent）・Throughline・pane shell（Windows は Git Bash）の
+// エージェント CLI（claude / codex / grok / cursor-agent）・Throughline・pane shell（Windows は PowerShell / Git Bash）の
 // 実行ファイルをどう見つけ、どう起動するかの所有者（OS 分岐の所有者。tmux とは独立）。
 import { spawn, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
@@ -257,3 +257,27 @@ export function runThroughlineHandoffContext(bin, sessionId, supplementFile = nu
         encoding: "utf8",
     });
 }
+/** Owned Windows agent launch: PowerShell uses argv, without interactive MSYS input. */
+export function windowsAgentLaunchLine(cwd, env, argv) {
+    const psq = (value) => `'${value.replace(/'/g, "''")}'`;
+    const parts = [];
+    if (cwd)
+        parts.push(`Set-Location -LiteralPath ${psq(cwd)}`);
+    for (const [name, value] of env) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            throw new AitermError("環境変数名が不正です", 2);
+        parts.push(`$env:${name}=${psq(value)}`);
+    }
+    parts.push(`& ${argv.map(psq).join(" ")}`);
+    return parts.join("; ");
+}
+/**
+ * Keep accepted shebang wrappers in the same pane, as for control commands.
+ * Invoking .sh directly in PowerShell uses its file association and can open a
+ * separate Git Bash window whose process outlives the pane (fox, 2026-10-14).
+ */
+export function windowsAgentArgv(argv, scriptShell) {
+    if (/\.(?:exe|com|cmd|bat|ps1)$/i.test(argv[0]))
+        return argv;
+    return [scriptShell(), argv[0].replace(/\\/g, "/"), ...argv.slice(1)];
+}

package/dist/core.js

@@ -27,19 +27,19 @@ import { unfinishedDeliveriesOwnedBy } from "./parent-delivery-owners.js";
 import { readRuntimeProcesses, readProcessIdentities, processSubtree, parentProcess, processIdentity, backgroundProcesses, lazyRelayProcess, aitermProcessProbe, windowsConsoleHost, processElapsedSeconds } from "./process-runtime.js";
 import { liveNodeExecutable } from "./live-node.js";
 import { AitermError, telemetryOwnedFailure, ownTelemetryFailure } from "./errors.js";
-import { isWin, SOCKDIR, SOCK, tmuxCommand, sendPsmuxPayload, loadPtyBufferChunk, pasteBufferBaseArgs, tmuxNewSession, openPsmuxServerToDesktop, registeredSessionEnvironment, attachCommand, normalizePaneCommand, atomicShellMultiline, appendMarkSentinel, markShellCommand, settlePaneLog, paneCwdArgument, sessionEnvironmentLaunch, } from "./tmux-runtime.js";
+import { isWin, SOCKDIR, SOCK, tmuxCommand, sendPsmuxPayload, loadPtyBufferChunk, pasteBufferBaseArgs, tmuxNewSession, openPsmuxServerToDesktop, registeredSessionEnvironment, attachCommand, normalizePaneCommand, atomicShellMultiline, appendMarkSentinel, paneShellForSubmission, adaptShellSubmission, settlePaneLog, paneCwdArgument, sessionEnvironmentLaunch, } from "./tmux-runtime.js";
 import { AGENT_DEFAULT_PREFACE, sleep, currentUid, runtimeStateBase, safeStatSize, readFileRange, writeJson0600, createEmpty0600, shq, LAUNCH_ID_RE, AGENT_DONE_POLL_MS, AGENT_RATE_LIMIT_POLL_MS, pollGate, AGENT_EVENT_MAX_BYTES, assertSessionName, agentsDir, agentEventPath, agentMetadataPath, writeAgentMetadata, AGENT_EVENT_TAIL_BYTES, agentLabel, agentHarness, subagentInstruction, agentLineageFields, } from "./agent-shared.js";
 import { catalogUnavailable } from "./model-catalog.js";
 import { FastModeError, fastModeFailure } from "./fast-mode.js";
 import { readFileOrNull, restoreJsonSetting, withUserConfigLock } from "./user-config.js";
 import { isDeepStrictEqual } from "node:util";
-import { grokAuthPlan, grokAuthStatus, grokAuthPane, GROK_MODEL_DEFAULTS, realGrokHome, resolveAndValidateGrokAuth, assertGrokModelAvailable, grokModelChoices, grokModelFromFooter, grokFooterModelName, grokModelDefaultsFromBody, restoreGrokModelDefaults, grokEventsTranscript, latestGrokCompletion, grokTurnSettled, observeGrokDone, buildGrokAgentCmd, grokLaunchNote, grokEnvTokens, grokTuiReady, grokPaneObservation, GROK_INTERRUPT_KEY, grokRateLimitDialog, grokPromptAwaitingAccept, grokUnacceptedPromptRestored, grokStartupAction, grokFooterHasConfiguration, grokTranscriptText, createGrokAgentMetadata, } from "./harnesses/grok.js";
-import { codexAuthPlan, codexAuthStatus, codexAuthPane, realCodexHome, readCodexConfigPins, bindCodexTranscriptSession, latestCodexCompletion, codexTurnSettled, codexRunningTurn, codexInterruptionRecord, observeCodexDone, buildCodexAgentCmd, codexLaunchNote, codexPaneObservation, CODEX_INTERRUPT_KEY, codexHelperProcess, codexRateLimitModelSwitchDialog, codexApprovalDialog, codexStartupAction, codexModelChoice, codexEffortChoice, codexMoreReasoningChoice, codexTranscriptText, createCodexAgentMetadata, codexModelChoices, codexFastCommandOffered, codexFooterShowsFast, codexServiceTierNotices, restoreCodexDefaults, restoreCodexDefaultInFile, } from "./harnesses/codex.js";
-import { claudeAuthPlan, claudeAuthStatus, claudeAuthPane, OPERATION_ID_RE, CLAUDE_RESULT_MAX_BYTES, CLAUDE_EFFORTS, agentManagedClaudeSettingsPath, agentClaudeResultPath, agentClaudeOperationPath, agentClaudeApprovalReceiptPath, agentClaudeDispatchReceiptPath, validateOperationId, readClaudeResultText, assertClaudeAuthenticationReady, claudeModelChoices, claudeConfigDir, claudeFastIndicatorShown, claudeFastResult, buildClaudeAgentCmd, claudeLaunchNote, claudePaneObservation, CLAUDE_INTERRUPT_KEY, claudeUsageLimit, claudeLiveSelectMenu, claudeModelPicker, claudeModelPickerRow, claudeModelSwitchConfirm, claudeModelSwitchResult, claudeStartupAction, createClaudeAgentMetadata, claudeSessionTranscriptPath, claudeApiErrorFromLine, claudeApiErrorAfter, } from "./harnesses/claude.js";
-import { cursorAuthPlan, cursorAuthStatus, cursorAuthPane, bindCursorTranscriptSession, cursorTurnBoundary, latestCursorCompletion, observeCursorDone, cursorTranscriptText, assertCursorAuthenticationReady, assertCursorModelAvailable, cursorModelChoices, cursorModelIsFastVariant, cursorFastParameter, cursorHeaderShowsFast, cursorPickerView, cursorEffortSelected, cursorParameterRows, cursorUserConfigPath, CURSOR_DEFAULT_MODEL_KEYS, realCursorHome, buildCursorAgentCmd, cursorAgentArgv, cursorPwshArgv, cursorPwshLaunchLine, cursorPromptWithLineage, createCursorAgentMetadata, cursorLaunchNote, cursorEffortNavigation, cursorTuiReady, cursorPaneObservation, CURSOR_INTERRUPT_KEY, cursorPromptHooksRunning, cursorUsageLimit, CURSOR_SUBMIT_SEQUENCE, validateCursorModelEffort, } from "./harnesses/cursor.js";
+import { grokAuthPlan, grokAuthStatus, grokAuthPane, GROK_MODEL_DEFAULTS, realGrokHome, resolveAndValidateGrokAuth, assertGrokModelAvailable, grokModelChoices, grokModelFromFooter, grokFooterModelName, grokModelDefaultsFromBody, restoreGrokModelDefaults, grokEventsTranscript, latestGrokCompletion, grokTurnSettled, observeGrokDone, buildGrokAgentCmd, grokAgentArgv, grokLaunchNote, grokEnvTokens, grokEnvEntries, grokTuiReady, grokPaneObservation, GROK_INTERRUPT_KEY, grokRateLimitDialog, grokPromptAwaitingAccept, grokUnacceptedPromptRestored, grokStartupAction, grokFooterHasConfiguration, grokTranscriptText, createGrokAgentMetadata, } from "./harnesses/grok.js";
+import { codexAuthPlan, codexAuthStatus, codexAuthPane, realCodexHome, readCodexConfigPins, bindCodexTranscriptSession, latestCodexCompletion, codexTurnSettled, codexRunningTurn, codexInterruptionRecord, observeCodexDone, buildCodexAgentCmd, codexAgentArgv, codexLaunchNote, codexPaneObservation, CODEX_INTERRUPT_KEY, codexHelperProcess, codexRateLimitModelSwitchDialog, codexApprovalDialog, codexStartupAction, codexModelChoice, codexEffortChoice, codexMoreReasoningChoice, codexTranscriptText, createCodexAgentMetadata, codexModelChoices, codexFastCommandOffered, codexFooterShowsFast, codexServiceTierNotices, restoreCodexDefaults, restoreCodexDefaultInFile, } from "./harnesses/codex.js";
+import { claudeAuthPlan, claudeAuthStatus, claudeAuthPane, OPERATION_ID_RE, CLAUDE_RESULT_MAX_BYTES, CLAUDE_EFFORTS, agentManagedClaudeSettingsPath, agentClaudeResultPath, agentClaudeOperationPath, agentClaudeApprovalReceiptPath, agentClaudeDispatchReceiptPath, validateOperationId, readClaudeResultText, assertClaudeAuthenticationReady, claudeModelChoices, claudeConfigDir, claudeFastIndicatorShown, claudeFastResult, buildClaudeAgentCmd, claudeAgentArgv, claudeLaunchNote, claudePaneObservation, CLAUDE_INTERRUPT_KEY, claudeUsageLimit, claudeLiveSelectMenu, claudeModelPicker, claudeModelPickerRow, claudeModelSwitchConfirm, claudeModelSwitchResult, claudeStartupAction, createClaudeAgentMetadata, claudeSessionTranscriptPath, claudeApiErrorFromLine, claudeApiErrorAfter, } from "./harnesses/claude.js";
+import { cursorAuthPlan, cursorAuthStatus, cursorAuthPane, bindCursorTranscriptSession, cursorTurnBoundary, latestCursorCompletion, observeCursorDone, cursorTranscriptText, assertCursorAuthenticationReady, assertCursorModelAvailable, cursorModelChoices, cursorModelIsFastVariant, cursorFastParameter, cursorHeaderShowsFast, cursorPickerView, cursorEffortSelected, cursorParameterRows, cursorUserConfigPath, CURSOR_DEFAULT_MODEL_KEYS, realCursorHome, buildCursorAgentCmd, cursorAgentArgv, cursorPromptWithLineage, createCursorAgentMetadata, cursorLaunchNote, cursorEffortNavigation, cursorTuiReady, cursorPaneObservation, CURSOR_INTERRUPT_KEY, cursorPromptHooksRunning, cursorUsageLimit, CURSOR_SUBMIT_SEQUENCE, validateCursorModelEffort, } from "./harnesses/cursor.js";
 import { interimFromNow, readInterimWords, recordInterimBoundary } from "./interim-words.js";
 import { codexSeatTurn, observeSteerDone, readSteerEntry, recordSteer } from "./steer-follow.js";
-import { resolveAgentBin, resolveThroughlineBin, runThroughlineHandoffContext, isWindowsNativeExecutable, agentBinForPaneShell, resolveWinPaneShell } from "./agent-resolver.js";
+import { resolveAgentBin, resolveThroughlineBin, runThroughlineHandoffContext, isWindowsNativeExecutable, agentBinForPaneShell, resolveWinPaneShell, windowsAgentArgv, windowsAgentLaunchLine } from "./agent-resolver.js";
 export { AitermError } from "./errors.js";
 export { tmuxSpawnEnv } from "./tmux-runtime.js";
 export { agentHarness } from "./agent-shared.js";
@@ -251,10 +251,7 @@ export async function ensureAgentOwnsPaneInput(name, kind) {
     return recovery;
 }
 function paneCurrentCommandForMark(name) {
-    const foreground = paneCurrentCommand(name);
-    if ((!isWin && foreground !== "ssh") || foreground === "powershell" || foreground === "pwsh")
-        return foreground;
-    return markShellCommand(foreground, captureScreen(name, 4));
+    return paneShellForSubmission(name);
 }
 function pasteBufferSupportsNoSanitizeFlag() {
     const listed = tmux("list-commands");
@@ -850,16 +847,21 @@ export function send(name, text, o = {}) {
             throw new AitermError("aiterm相関付きClaude agent sessionへの通常送信はturn境界を失うため拒否します。" +
                 "pty_send（forceなし＝自動dispatch）を使うか、通常対話へ切り替えるならsessionをcloseしてpty_openから手動起動し直してください。", 2);
         }
-        writeLastcmd(name, text); // read rtk の reducer 分類用（書換/mark 前の素のコマンド）
+        writeLastcmd(name, o.launchShell ? atomicShellMultiline(text, o.launchShell) : text);
         if (o.rtk)
             text = rtkRewrite(text);
         if (o.mark)
             text = appendMarkSentinel(text, fg);
         assertSendTextSize(text, o.rtk || o.mark ? "変換後の送信文字列" : "送信文字列");
         const reportedText = text;
-        if (!o.raw && text.includes("\n")) {
-            text = atomicShellMultiline(text, fg || paneCurrentCommand(name));
-        }
+        // Agent composer paste is literal text even if native foreground metadata
+        // still reports the startup shell. Keep sanitization, but never encode TUI
+        // text as an executable shell command.
+        // Original text is validated above. OS queries, stale foreground handling
+        // and shell encoding belong to the runtime; common send supplies intent.
+        text = adaptShellSubmission(name, text, {
+            raw: o.raw, literalPaste: o.bracketedPaste, launchShell: o.launchShell, shell: fg,
+        });
         if (o.mark) {
             try {
                 fs.writeFileSync(markpath(name), "1"); // waitCompletion に sentinel 完了検出を有効化させる
@@ -5985,7 +5987,7 @@ function agentVendorSessionEnv(meta) {
 }
 /**
  * 席へ渡すAitermの環境変数（名前と値）の唯一の一覧。呼び手が指定した継承分を先に置き、席の控えが無い時は継承分だけ。
- * shell別の引用はここでは付けず、POSIXの前置き（agentEnvPrefix）とWindowsのPowerShell行（cursorPwshLaunchLine）が同じ一覧から作る。
+ * shell別の引用はここでは付けず、POSIXの前置き（agentEnvPrefix）とWindowsのPowerShell行（windowsAgentLaunchLine）が同じ一覧から作る。
  */
 function agentEnvEntries(meta, sid, envVars = []) {
     const inherited = envVars.flatMap((name) => {
@@ -6163,8 +6165,8 @@ function prepareAgentLaunch(kind, opts = {}) {
         assertClaudeAuthenticationReady(bin);
     if (kind === "cursor")
         assertCursorAuthenticationReady(bin);
-    // Windows の起動コマンドは native psmux pane の Git Bash で走る（WSL 橋・/mnt/c 変換は
-    // e3f5fc8 で全廃。bin/cwd は Windows パスの forward slash 形のまま渡す）。
+    // Windows agent launches run in a native PowerShell pane. Accepted shebang
+    // wrappers use noninteractive Git Bash in that pane; there is no WSL bridge.
     // 未検証リスク: npm グローバル導入の codex.cmd/.bat シムの対話 TUI 描画は実 Windows でしか確認
     // できない（CI 非対象。docs/03_audit-sweep-2026-07.md 参照）。native .exe の TUI 描画は
     // grok.exe で実測済み（2026-08-15）。
@@ -6190,8 +6192,9 @@ function prepareAgentLaunch(kind, opts = {}) {
     return () => {
         let sid;
         let hint;
-        // WindowsのCursorだけはPowerShell 7 paneから起動する（理由はcursorPwshLaunchLine）。
-        const paneShell = isWin && kind === "cursor" && agentDone ? "pwsh" : "bash";
+        // Windows launches use native PowerShell input; never type an owned CLI
+        // command through MSYS interactive select/console-master input handling.
+        const paneShell = isWin ? "pwsh" : "bash";
         try {
             [sid, hint] = openSession(opts.session_name ?? null, paneShell, envVars);
         }
@@ -6238,23 +6241,37 @@ function prepareAgentLaunch(kind, opts = {}) {
                 bindExecutionCreatedLaunch({ session_id: sid, launch_id: meta.launch_id });
             launchNote = buildAgentLaunchNote(kind, model, effort, meta);
             let full;
-            if (paneShell === "pwsh" && meta) {
-                full = cursorPwshLaunchLine(cwd, agentEnvEntries(meta, sid, envVars), cursorPwshArgv(cursorAgentArgv(bin, model, effort, opts.prompt ?? null, meta, cursorFast), () => resolveWinPaneShell("bash")));
+            if (paneShell === "pwsh") {
+                const prompt = opts.prompt ?? null;
+                const argv = kind === "claude" ? claudeAgentArgv(bin, model, effort, prompt, meta)
+                    : kind === "codex" ? codexAgentArgv(bin, model, effort, prompt, meta)
+                        : kind === "cursor" ? cursorAgentArgv(bin, model, effort, prompt, meta, cursorFast)
+                            : grokAgentArgv(kind, bin, model, effort, prompt, meta);
+                full = windowsAgentLaunchLine(cwd, [
+                    ...(meta?.kind === "grok" ? grokEnvEntries(meta) : []), ...agentEnvEntries(meta, sid, envVars),
+                ], windowsAgentArgv(argv, () => resolveWinPaneShell("bash")));
             }
             else {
                 const cmd = buildAgentCmd(kind, binForCmd, model, effort, opts.prompt ?? null, meta, cursorFast);
                 const envPrefix = agentEnvPrefix(meta, sid, envVars);
-                full = cwdForCmd ? `cd ${shq(cwdForCmd)} && ${envPrefix}${cmd}` : `${envPrefix}${cmd}`;
+                const command = cwdForCmd ? `cd ${shq(cwdForCmd)} && ${envPrefix}${cmd}` : `${envPrefix}${cmd}`;
+                // このpaneのbashはAitermが自分で選んだ。sub-agent instructionのLFを含む起動commandは、
+                // 利用者のshell送信と同じknown-shell適合で1物理行にしてから打つ（sanitizeはしない）。
+                // 対話shellの行編集が、埋め込みLFごとに1行ずつ受け付けて継続promptで繋ぐ形に依存しない。
+                // agent TUIへの本文（bracketedPaste）は文字どおりのまま。argv・lineage・metadata・native
+                // admission・receiptの契約は変えない。
+                full = command;
             }
             if (meta)
-                agentLaunchLines.set(sid, full);
-            // force:true はagent sessionへの手動介入を表す。起動コマンド自体はAitermが組み立てて素送信する。
+                agentLaunchLines.set(sid, atomicShellMultiline(full, paneShell));
+            // force:true はagent sessionへの手動介入を表す。起動コマンド自体はAitermが組み立てて、sanitizeせずに送る。
             send(sid, full, {
                 enter: true,
                 mark: false,
                 force: true,
                 rtk: false,
                 raw: true,
+                launchShell: paneShell,
                 preserveAgentOperation: meta?.kind === "claude",
             });
         }

package/dist/execution-participant-store.js

@@ -70,8 +70,14 @@ export class ParticipantExecutionStore extends FileExecutionStore {
             return value;
         }, options);
     }
-    transaction(body, options = {}) {
-        this.ensureEnrolled();
+    async transaction(body, options = {}) {
+        if (this.deferEnrollment && !this.registered) {
+            this.assertScope();
+            // The first async request must not take a fail-fast synchronous lock
+            // before its bounded metadata wait. Commit the explicit declaration in
+            // the existing short admission; never hold it across an async callback.
+            await super.admitNative(() => this.ensureEnrolled());
+        }
         return super.transaction(async (state) => {
             if (!options.readOnly)
                 this.assertScope();

package/dist/harnesses/claude.js

@@ -306,18 +306,24 @@ const CLAUDE_DELIVERY_NOTES = Object.freeze([
     `「${AGENT_DEFAULT_PREFACE}」`,
     "この1行が包みの外にある文は、呼び手がこの席へ宛てて送った文です。同じ文が包みの中にあっても、この印にはなりません。",
 ]);
-export function buildClaudeAgentCmd(bin, model, effort, prompt, meta) {
-    const parts = [shq(bin)];
+export function claudeAgentArgv(bin, model, effort, prompt, meta) {
+    const parts = [bin];
     if (meta?.kind === "claude") {
-        parts.push("--dangerously-skip-permissions", "--setting-sources", shq("user,project,local"), "--settings", shq(meta.claude_settings ?? ""), "--session-id", shq(meta.vendor_session_id ?? ""), "--append-system-prompt", shq(subagentInstruction(meta, CLAUDE_DELIVERY_NOTES)));
+        parts.push("--dangerously-skip-permissions", "--setting-sources", "user,project,local", "--settings", meta.claude_settings ?? "", "--session-id", meta.vendor_session_id ?? "", "--append-system-prompt", subagentInstruction(meta, CLAUDE_DELIVERY_NOTES));
     }
     if (model)
-        parts.push("--model", shq(model));
+        parts.push("--model", model);
     if (effort)
-        parts.push("--effort", shq(effort));
+        parts.push("--effort", effort);
     if (prompt)
-        parts.push(shq(prompt)); // 初手プロンプト（任意）
-    return parts.join(" ");
+        parts.push(prompt); // 初手プロンプト（任意）
+    return parts;
+}
+export function buildClaudeAgentCmd(bin, model, effort, prompt, meta) {
+    const argv = claudeAgentArgv(bin, model, effort, prompt, meta);
+    const values = new Set(["--setting-sources", "--settings", "--session-id", "--append-system-prompt", "--model", "--effort"]);
+    return argv.map((arg, index) => index === 0 || values.has(argv[index - 1]) || (prompt && index === argv.length - 1)
+        ? shq(arg) : arg).join(" ");
 }
 export function claudeLaunchNote(model, effort, meta) {
     const writeScopeNote = writeScopeLaunchNote("claude", meta?.write_scope);

package/dist/harnesses/codex.js

@@ -745,8 +745,8 @@ export async function observeCodexDone(meta, timeout, requestedCursor, signal) {
         await sleep(AGENT_DONE_POLL_MS);
     }
 }
-export function buildCodexAgentCmd(bin, model, effort, prompt, meta) {
-    const parts = [shq(bin)];
+export function codexAgentArgv(bin, model, effort, prompt, meta) {
+    const parts = [bin];
     // `codex --help` で確認した実在フラグ。read-only 宣言だけはCLI sandboxへ落とし、
     // launcher自身が実効能力壁を作る。パス説明はCodex CLIに同等のallowlist引数がないため宣言のまま残す。
     if (meta?.kind === "codex" && meta.write_scope === "read-only")
@@ -759,15 +759,29 @@ export function buildCodexAgentCmd(bin, model, effort, prompt, meta) {
         parts.push("-c", "service_tier=default");
     // model/effort は共有configを書き換えず、CLI引数で明示して起動単位に優先する。
     if (model)
-        parts.push("-m", shq(model));
+        parts.push("-m", model);
     if (effort)
-        parts.push("-c", `model_reasoning_effort=${shq(effort)}`);
+        parts.push("-c", `model_reasoning_effort=${effort}`);
     if (meta?.kind === "codex" && meta.hook_route === "shared_codex_home") {
-        parts.push("-c", `developer_instructions=${shq(subagentInstruction(meta))}`);
+        parts.push("-c", `developer_instructions=${subagentInstruction(meta)}`);
     }
     if (prompt)
-        parts.push(shq(prompt)); // 初手プロンプト（任意）
-    return parts.join(" ");
+        parts.push(prompt); // 初手プロンプト（任意）
+    return parts;
+}
+export function buildCodexAgentCmd(bin, model, effort, prompt, meta) {
+    const argv = codexAgentArgv(bin, model, effort, prompt, meta);
+    return argv.map((arg, index) => {
+        if (index === 0 || argv[index - 1] === "-m" || (prompt && index === argv.length - 1))
+            return shq(arg);
+        if (argv[index - 1] === "-c") {
+            for (const key of ["model_reasoning_effort=", "developer_instructions="]) {
+                if (arg.startsWith(key))
+                    return key + shq(arg.slice(key.length));
+            }
+        }
+        return arg;
+    }).join(" ");
 }
 // 起動応答にモデル/effort の実効値と出所を明示する。codex は端末 config のピン（model /
 // model_reasoning_effort）が対話子へ波及する構造のため、引数・端末config継承・CLI既定の

package/dist/harnesses/cursor.js

@@ -537,30 +537,7 @@ export function buildCursorAgentCmd(bin, model, effort, prompt, meta, fast = fal
  * hookへ渡すJSONの先頭にUTF-8 BOMを付け、BOMを読めない利用者hookが送信を止める（fox実測 2026-09-26:
  * Git Bash配下は全てprompt_historyだけ残りstore.dbが作られず、PowerShell 7 paneからは同じhookで通る）。
  */
-export function cursorPwshLaunchLine(cwd, env, argv) {
-    const psq = (value) => `'${value.replace(/'/g, "''")}'`;
-    const parts = [];
-    if (cwd)
-        parts.push(`Set-Location -LiteralPath ${psq(cwd)}`);
-    for (const [name, value] of env) {
-        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
-            throw new AitermError("環境変数名が不正です", 2);
-        parts.push(`$env:${name}=${psq(value)}`);
-    }
-    parts.push(`& ${argv.map(psq).join(" ")}`);
-    return parts.join("; ");
-}
-/**
- * PowerShell 7のpaneで走らせるargv。PowerShellが自分のconsoleで走らせるのは .exe・.com・.cmd・.bat・.ps1 だけで、
- * それ以外（受入が許すshebangのscript。拡張子なしも含む）を `&` で呼ぶと、拡張子の関連付けでpaneの外の別の窓に開く
- * （fox実測 2026-10-14: `.sh` は `git-bash.exe` の窓で起き、席を閉じてもprocessが残った）。
- * scriptは、control commandと同じGit Bashをpaneの中で挟んで走らせる。
- */
-export function cursorPwshArgv(argv, scriptShell) {
-    if (/\.(?:exe|com|cmd|bat|ps1)$/i.test(argv[0]))
-        return argv;
-    return [scriptShell(), argv[0].replace(/\\/g, "/"), ...argv.slice(1)];
-}
+export { windowsAgentLaunchLine as cursorPwshLaunchLine, windowsAgentArgv as cursorPwshArgv } from "../agent-resolver.js";
 export function cursorPromptWithLineage(meta, prompt) {
     return `${subagentInstruction(meta)}\n\n${prompt}`;
 }

package/dist/harnesses/grok.js

@@ -371,15 +371,15 @@ export async function observeGrokDone(meta, timeout, requestedCursor, detectRate
         await sleep(AGENT_DONE_POLL_MS);
     }
 }
-export function buildGrokAgentCmd(kind, bin, model, effort, prompt, meta) {
-    const parts = [shq(bin)];
+export function grokAgentArgv(kind, bin, model, effort, prompt, meta) {
+    const parts = [bin];
     parts.push("--no-auto-update");
     // 無人起動の対象cwdはCLIの公式folder trust指定で登録し、確認画面にpromptを消費させない。
     if (meta?.kind === "grok")
         parts.push("--no-alt-screen", "--trust");
-    parts.push("--model", shq(model ?? GROK_MODEL_DEFAULTS[kind]));
+    parts.push("--model", model ?? GROK_MODEL_DEFAULTS[kind]);
     if (effort)
-        parts.push("--reasoning-effort", shq(effort));
+        parts.push("--reasoning-effort", effort);
     if (meta?.kind === "grok" && meta.write_scope === "read-only") {
         // read-only は sandbox が実効書込み禁止を作るため、MCP ツール許可ダイアログの自動承認を
         // 付けても能力は増えない。無人 subagent が初回 MCP 使用の許可待ちで停止する実障害への対処。
@@ -387,13 +387,19 @@ export function buildGrokAgentCmd(kind, bin, model, effort, prompt, meta) {
         parts.push("--sandbox", "read-only", "--always-approve");
     }
     if (meta?.kind === "grok" && meta.hook_route === "shared_grok_home") {
-        parts.push("--session-id", shq(meta.vendor_session_id ?? ""), "--rules", shq(subagentInstruction(meta)));
+        parts.push("--session-id", meta.vendor_session_id ?? "", "--rules", subagentInstruction(meta));
     }
     if (meta?.kind === "grok" && prompt)
         parts.push("--verbatim");
     if (prompt)
-        parts.push(shq(prompt)); // 初手プロンプト（任意）
-    return parts.join(" ");
+        parts.push(prompt); // 初手プロンプト（任意）
+    return parts;
+}
+export function buildGrokAgentCmd(kind, bin, model, effort, prompt, meta) {
+    const argv = grokAgentArgv(kind, bin, model, effort, prompt, meta);
+    const values = new Set(["--model", "--reasoning-effort", "--session-id", "--rules"]);
+    return argv.map((arg, index) => index === 0 || values.has(argv[index - 1]) || (prompt && index === argv.length - 1)
+        ? shq(arg) : arg).join(" ");
 }
 export function grokLaunchNote(kind, model, effort, meta) {
     const writeScopeNote = writeScopeLaunchNote(kind, meta?.write_scope);
@@ -403,10 +409,13 @@ export function grokLaunchNote(kind, model, effort, meta) {
 // grok: 検証済み auth 正本をそのままの path 形で渡す。Windows では native 強制により
 // harness は Windows process なので、Windows ドライブパスが正しい形（WSL 形への変換はしない）。
 export function grokEnvTokens(meta) {
+    return grokEnvEntries(meta).map(([name, value]) => `${name}=${name === "GROK_AUTH_PATH" ? shq(value) : value}`);
+}
+export function grokEnvEntries(meta) {
     return [
-        ...(meta.grok_auth_path ? [`GROK_AUTH_PATH=${shq(meta.grok_auth_path)}`] : []),
-        "GROK_DISABLE_AUTOUPDATER=1",
-        "GROK_PRIVACY_NOTICE_ROLLOUT=0",
+        ...(meta.grok_auth_path ? [["GROK_AUTH_PATH", meta.grok_auth_path]] : []),
+        ["GROK_DISABLE_AUTOUPDATER", "1"],
+        ["GROK_PRIVACY_NOTICE_ROLLOUT", "0"],
     ];
 }
 export function assertGrokSandboxNotRejected(screen) {

package/dist/psmux-send-worker.js

@@ -2,8 +2,9 @@ import * as fs from "node:fs";
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
-// 公開本文64KiBをPowerShellの一括入力へBase64化した長さと構文・paste markerを含む。
-const MAX_PAYLOAD_BYTES = Math.ceil(64 * 1024 / 3) * 4 + 128;
+// 公開本文64KiBのBase64に加え、UTF-8初期化文・scriptblock構文・paste markerを含む。
+// 最大本文の変換増分は336byte以内。本文の公開上限は変えず、内部の包みを512byte確保する。
+const MAX_PAYLOAD_BYTES = Math.ceil(64 * 1024 / 3) * 4 + 512;
 const PTY_CHUNK_BYTES = 256;
 const MAX_FINAL_DRAIN_MS = 3_000;
 const SESSION_BASE_RE = /^[A-Za-z0-9_-]{1,160}$/;

package/dist/tmux-runtime.js

@@ -443,6 +443,14 @@ function tmuxHasSessionEnvironmentFlags(version) {
     return Number(match[1]) > 3 || (Number(match[1]) === 3 && Number(match[2]) >= 2);
 }
 export function sessionEnvironmentLaunch(shell, environment, version) {
+    // psmux 3.3.8 rebuilds PATH from the registry when creating a pane. Preserve
+    // the caller's runtime additions (tool installs, activated environments),
+    // without copying other environment values into command arguments.
+    if (isWin && !environment.some(entry => /^path=/i.test(entry))) {
+        const callerPath = process.env.PATH;
+        if (callerPath !== undefined)
+            environment = [...environment, `PATH=${callerPath}`];
+    }
     const modern = isWin || tmuxHasSessionEnvironmentFlags(version);
     if (modern)
         return { shell, args: environment.flatMap(entry => ["-e", entry]), register_after_start: false };
@@ -579,9 +587,17 @@ const POSIX_ATOMIC_SHELLS = new Set(["bash", "sh", "zsh", "dash"]);
 // OSで仕組みを変えず、同じ一括入力を各shellの構文へ適合させる。
 export function atomicShellMultiline(text, foreground) {
     if (POWERSHELL_COMMANDS.has(foreground)) {
-        const encoded = Buffer.from(text, "utf8").toString("base64");
+        // A ConPTY PowerShell can start at CP437 even when its parent uses UTF-8.
+        // Send ASCII until the submitted script establishes UTF-8; keep psmux's
+        // interactive/profile/CWD initialization and execute in the current scope.
+        const encoding = isWin
+            ? "[Console]::InputEncoding = [Text.UTF8Encoding]::new($false); [Console]::OutputEncoding = [Text.UTF8Encoding]::new($false); $OutputEncoding = [Text.UTF8Encoding]::new($false); "
+            : "";
+        const encoded = Buffer.from(encoding + text, "utf8").toString("base64");
         return `. ([scriptblock]::Create([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}'))))`;
     }
+    if (!text.includes("\n"))
+        return text;
     if (!POSIX_ATOMIC_SHELLS.has(foreground))
         return text;
     const quoted = text.replace(/\\/g, "\\\\").replace(/\n/g, "\\n")
@@ -589,14 +605,34 @@ export function atomicShellMultiline(text, foreground) {
     // printf %bで本文を復元する。末尾LFの除去はpty_sendのsubmit Enterと同値。
     return `eval "$(command printf '%b' '${quoted}')"`;
 }
-export function markShellCommand(foreground, screen) {
-    if (POWERSHELL_COMMANDS.has(foreground))
+export function markShellCommand(foreground, screen, platform = process.platform) {
+    if (platform !== "win32" && foreground !== "ssh")
         return foreground;
+    // psmuxの前面名はprocess snapshotやOSCの古い値を返しうる。
+    // 現在のpromptだけを使い、PowerShell→Git Bashと逆向きの両方を補正する。
+    const current = screen.replace(/\x1b\[[0-9;?]*[a-zA-Z]/g, "").trimEnd();
+    if (/(?:^|\n)PS [^\r\n]*>$/.test(current))
+        return "pwsh";
+    if (platform === "win32" && /(?:^|\n)[^\r\n]*\b(?:MINGW(?:32|64)|UCRT64|MSYS)\b[^\r\n]*\r?\n\$\s*$/.test(current))
+        return "bash";
+    return foreground;
+}
+/** The runtime owns platform foreground queries and shell-dialect reconciliation. */
+export function paneShellForSubmission(name) {
+    const r = tmuxCommand(true, "display-message", "-p", "-t", name, "#{pane_current_command}");
+    const foreground = r.code === 0 ? normalizePaneCommand(r.stdout.trim()) : "";
     if (!isWin && foreground !== "ssh")
         return foreground;
-    // psmux起動直後の古いprocess名も、SSH先も、現在の末尾promptだけを実効shellの証拠にする。
-    const current = screen.replace(/\x1b\[[0-9;?]*[a-zA-Z]/g, "").trimEnd();
-    return /(?:^|\n)PS [^\r\n]*>$/.test(current) ? "pwsh" : foreground;
+    const screen = tmuxCommand(true, "capture-pane", "-p", "-J", "-t", name, "-S", "-4");
+    return markShellCommand(foreground, screen.code === 0 ? screen.stdout : "");
+}
+/** Common send code supplies intent; the runtime decides whether/how to encode it. */
+export function adaptShellSubmission(name, text, options = {}) {
+    if (options.launchShell)
+        return atomicShellMultiline(text, options.launchShell);
+    if (options.raw || options.literalPaste || (!isWin && !text.includes("\n")))
+        return text;
+    return atomicShellMultiline(text, options.shell || paneShellForSubmission(name));
 }
 export function appendMarkSentinel(text, foreground) {
     // 複数行入力の末尾はheredoc／here-string終端になり得るため、独立した次行へ置く。

package/docs/DESIGN.md

@@ -69,6 +69,9 @@ core入口の再確認と、managed metadata/hook生成・設定model保存は
 native作用やawaitをcallbackへ入れず、停止・世代/actor/scope交代・RPC終了後の遅着を拒否する。
 これらの明示接続以外の設定復元や親配送metadata経路はまだ未了であり、既定mainへの有効化条件を満たさない。
 private factoryは同scopeの共有stateへ既存PID/開始identityと役割を宣言し、各受付の同じlock内で欠測を拒否する。
+遅延登録する参加者の最初の非同期要求は、既存の上限付きmetadata受付内で宣言を保存してから進む。
+待機後にもscope/actorを照合し、read-only要求でも宣言だけは独立して保存する。
+同期入口の即時拒否、登録削除後の拒否、停止snapshotの登録不要条件は変えず、入力や要求を再送しない。
 MCP/parent-effectの既存参照とnative identityを読むinventoryはread-onlyで、役割やenvから世代・終了を補完しない。
 開始identity交代や未登録actorを示しても旧slotを消さず、parent受付だけで参照を退役させない。
 全行のidentity一致でも参加者の全発見/native終了fence/全経路の接続を証明せず、coverage incompleteを維持する。
@@ -103,7 +106,22 @@ sanitize済みの複数行は、POSIX shellでもPowerShellでもscript全体を
 `src/tmux-runtime.ts`が改行を持たない1回の入力へ適合させ、POSIXは`eval`、PowerShellは
 UTF-8のBase64を復元したscriptblockのdot-sourceを使う。変数と作業場所は現在のshellに残す。
 生LFをPowerShellへキー入力として流さないため、Windowsの`Ctrl+Enter`による行順の反転を防ぐ。
+WindowsのPowerShell shell向け非raw送信は単行もASCIIのBase64 wrapperを使い、本文の前に
+Console入力・出力とnative pipelineのencodingをUTF-8へ揃える。CP437で起動したConPTYでも
+文字を失わず、psmuxのprofile/PSReadLine/CWD初期化を置換しない。追加の送信やEnterは行わない。
 単一行、`raw:true`、非shell前面は直接PTYへ送る。`enter:false`では後続のEnterまで実行しない。
+Aitermが所有するagent起動は、POSIXではbash、WindowsではPowerShell 7のpaneを使う。
+harnessは未引用のargvを一度組み立て、POSIXの従来の引用とWindowsのPowerShell単引用へ適合する。
+Windowsは既存のUTF-8 Base64 scriptblockへ包み、対話MSYS bashのselect/input-mutexへ起動行を打たない。
+受入済みshebang scriptだけは、既存のcontrol commandと同じGit Bashで非対話実行する。
+POSIXの複数行起動commandは既存のPOSIX適合で1物理行にする。いずれもsanitizeはしない。
+`.lastcmd`と`agentLaunchLines`は実際に打つ1物理行を持ち、公開64KiBは符号化前に検査する。
+argv・lineage・metadata・native admission・receipt・TUI本文は変えず、新queueや再送は作らない。
+
+通常送信もmark送信も、shellの取得・現在promptとの補正・構文への適合はtmux-runtimeの
+同じ入口へ渡す。共通sendはraw/TUI/startupという送信意図と符号化前の上限検査を所有し、
+Windowsの前面名だけから方言を決めない。psmuxのprocess snapshot/OSCが古い時は、
+現在のPowerShell又はGit Bash promptで双方向に補正する。過去のpromptは使わない。
 
 TUIの準備判定、送信文の入力欄への残存、完了後の画面安定待ちは`agent-screen-observation.ts`が所有する。
 このmoduleはcoreをimportせず、既存harness adapterと渡されたsample・sleep・時計だけで判断する。
@@ -122,6 +140,8 @@ coreの観測（`pty_observe`）・起動準備・送信口・停止は`kind`を
 席へ渡すAitermの環境変数は`agentEnvEntries`の1つの一覧から、POSIXの前置き（`agentEnvPrefix`）とWindowsのPowerShell行
 （`cursorPwshLaunchLine`）の両方を作る。名前と値の一覧とshell別の引用を分け、同じ値を2度定義しない。
 
+agent入力欄への`bracketedPaste`は、制御文字の除去後も本文のまま渡す。nativeの前面process名が起動shellを報告していてもshell実行文へ変換しない。shell用のUTF-8初期化・複数行適合はshell送信（利用者のshell送信と、Aiterm自身のbash起動command）だけに適用する。
+
 `pty_read`は制御文字除去、反復圧縮、head＋tail、command別reducerでcontext量を減らす。
 完了はprocess exit、shell sentinel、literal／regex `until`、shell復帰を伴うquiescence、timeoutを区別する。
 要求されたsentinel／untilを静止判定より優先し、nested shellで証拠がない状態を完了へ丸めない。
@@ -137,7 +157,9 @@ psmuxが出力した余分な環境値を返さない。通常PTYとagentへ`AIT
 全sessionへ配るので、`new-session`の間だけ`update-environment`を差し替えてclientの環境をsessionへ写し、
 共通環境にしか無い変数はsessionで消す。`AITERM_SESSION_ID`・`AITERM_AGENT_*`・`TMUX`・`TMUX_PANE`は継がない。
 sessionの表には環境が丸ごと入るので、名指しで登録した名前をsessionのoption `@aiterm_env_keys`に控え、
-`env_keys`はその名前だけを返す。psmuxは元から端末ごとに呼び出し元の環境を継ぐ。
+`env_keys`はその名前だけを返す。psmuxは端末ごとに呼び出し元の環境を継ぐが、3.3.8はPATHをregistry値で上書きする。
+Windowsでは呼出元PATHだけをnew-sessionの`-e`で明示し、実行時に追加したtoolの場所を保つ。
+明示済みPATHは大文字小文字を問わず優先し、他の環境値を引数へ追加しない。
 
 内部の`killAll`は終了するsocketのsession一覧と、そのsocketのログ等に残るsession名だけを対象にする。
 別socketが同じ`AITERM_STATE_BASE`を使っていても、他のsessionの登録・完了記録・待機lockを削除しない。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.10",
+  "version": "0.61.12",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [