context-mode 0.9.16 → 0.9.18

package/.claude-plugin/hooks/hooks.json

@@ -46,6 +46,44 @@
             "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/pretooluse.mjs"
           }
         ]
+      },
+      {
+        "matcher": "mcp__plugin_context-mode_context-mode__execute",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/pretooluse.mjs"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__plugin_context-mode_context-mode__execute_file",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/pretooluse.mjs"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__plugin_context-mode_context-mode__batch_execute",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/pretooluse.mjs"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node ${CLAUDE_PLUGIN_ROOT}/hooks/sessionstart.mjs"
+          }
+        ]
       }
     ]
   }

package/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "0.9.16",
+      "version": "0.9.18",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "0.9.16",
+  "version": "0.9.18",
   "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",
@@ -8,7 +8,7 @@
   },
   "homepage": "https://github.com/mksglu/claude-context-mode#readme",
   "repository": "https://github.com/mksglu/claude-context-mode",
-  "license": "MIT",
+  "license": "Elastic-2.0",
   "keywords": [
     "mcp",
     "context-window",

package/LICENSE

@@ -1,21 +1,94 @@
-MIT License
-
-Copyright (c) 2026 Mert Koseoğlu
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Elastic License 2.0 (ELv2)
+
+Copyright 2026 Mert Koseoglu
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set
+of the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key
+functionality in the software, and you may not remove or obscure any
+functionality in the software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If your company
+makes such a claim, your patent license ends immediately for work on behalf
+of your company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not
+licensed, and your licenses will automatically terminate. If the licensor
+provides you with a notice of your violation, and you cease all violation of
+this license no later than 30 days after you receive that notice, your
+licenses will be reinstated retroactively. However, if you violate these
+terms after such reinstatement, any additional violation of these terms will
+cause your licenses to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is
+the software the licensor makes available under these terms, including any
+portion of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+**control** means ownership of substantially all the assets of an entity, or
+the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your
+licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

package/README.md

@@ -2,7 +2,7 @@
 
 **The other half of the context problem.**
 
-[![users](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcdn.jsdelivr.net%2Fgh%2Fmksglu%2Fclaude-context-mode%40main%2Fstats.json&query=%24.message&label=users&color=brightgreen)](https://www.npmjs.com/package/context-mode) [![npm](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcdn.jsdelivr.net%2Fgh%2Fmksglu%2Fclaude-context-mode%40main%2Fstats.json&query=%24.npm&label=npm&color=blue)](https://www.npmjs.com/package/context-mode) [![marketplace](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcdn.jsdelivr.net%2Fgh%2Fmksglu%2Fclaude-context-mode%40main%2Fstats.json&query=%24.marketplace&label=marketplace&color=blue)](https://github.com/mksglu/claude-context-mode) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![users](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcdn.jsdelivr.net%2Fgh%2Fmksglu%2Fclaude-context-mode%40main%2Fstats.json&query=%24.message&label=users&color=brightgreen)](https://www.npmjs.com/package/context-mode) [![npm](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcdn.jsdelivr.net%2Fgh%2Fmksglu%2Fclaude-context-mode%40main%2Fstats.json&query=%24.npm&label=npm&color=blue)](https://www.npmjs.com/package/context-mode) [![marketplace](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcdn.jsdelivr.net%2Fgh%2Fmksglu%2Fclaude-context-mode%40main%2Fstats.json&query=%24.marketplace&label=marketplace&color=blue)](https://github.com/mksglu/claude-context-mode) [![GitHub stars](https://img.shields.io/github/stars/mksglu/claude-context-mode?style=flat&color=yellow)](https://github.com/mksglu/claude-context-mode/stargazers) [![GitHub forks](https://img.shields.io/github/forks/mksglu/claude-context-mode?style=flat&color=blue)](https://github.com/mksglu/claude-context-mode/network/members) [![Last commit](https://img.shields.io/github/last-commit/mksglu/claude-context-mode?color=green)](https://github.com/mksglu/claude-context-mode/commits) [![License: ELv2](https://img.shields.io/badge/License-ELv2-blue.svg)](LICENSE)
 
 Every MCP tool call in Claude Code dumps raw data into your 200K context window. A Playwright snapshot costs 56 KB. Twenty GitHub issues cost 59 KB. One access log — 45 KB. After 30 minutes, 40% of your context is gone.
 
@@ -62,7 +62,7 @@ Code Mode showed that tool definitions can be compressed by 99.9%. Context Mode
 | `execute_file` | Process files in sandbox. Raw content never leaves. | 45 KB → 155 B |
 | `index` | Chunk markdown into FTS5 with BM25 ranking. | 60 KB → 40 B |
 | `search` | Query indexed content with multiple queries in one call. | On-demand retrieval |
-| `fetch_and_index` | Fetch URL, convert to markdown, index. | 60 KB → 40 B |
+| `fetch_and_index` | Fetch URL, detect content type (HTML/JSON/text), chunk and index. | 60 KB → 40 B |
 
 ## How the Sandbox Works
 
@@ -184,13 +184,139 @@ Fetch the React useEffect docs, index them, and find the cleanup pattern
 with code examples. Then run /context-mode:stats.
 ```
 
+## Security
+
+Context Mode enforces the same permission rules you already use in Claude Code — but extends them to the MCP sandbox. If you block `sudo` in Claude Code, it's also blocked inside `execute`, `execute_file`, and `batch_execute`.
+
+**Zero setup required.** If you haven't configured any permissions, nothing changes. This only activates when you add rules.
+
+### Getting started
+
+Find your settings file:
+
+```bash
+# macOS / Linux
+cat ~/.claude/settings.json
+
+# Windows
+type %USERPROFILE%\.claude\settings.json
+```
+
+Add a `permissions` section (keep your existing settings, just add this block). Then restart Claude Code.
+
+```json
+{
+  "permissions": {
+    "deny": [
+      "Bash(sudo *)",
+      "Bash(rm -rf /*)",
+      "Read(.env)",
+      "Read(**/.env*)"
+    ],
+    "allow": [
+      "Bash(git:*)",
+      "Bash(npm:*)"
+    ]
+  }
+}
+```
+
+The pattern is `Tool(what to match)` where `*` means "anything".
+
+<details>
+<summary><strong>Common deny patterns</strong> (click to expand)</summary>
+
+**Dangerous commands:**
+```
+"Bash(sudo *)"              — block all sudo commands
+"Bash(rm -rf /*)"           — block recursive delete from root
+"Bash(chmod 777 *)"         — block open permissions
+"Bash(shutdown *)"          — block shutdown/reboot
+"Bash(kill -9 *)"           — block force kill
+"Bash(mkfs *)"              — block filesystem format
+"Bash(dd *)"                — block disk write
+```
+
+**Network access:**
+```
+"Bash(curl *)"              — block curl
+"Bash(wget *)"              — block wget
+"Bash(ssh *)"               — block ssh connections
+"Bash(scp *)"               — block secure copy
+"Bash(nc *)"                — block netcat
+```
+
+**Package managers and deploys:**
+```
+"Bash(npm publish *)"       — block npm publish
+"Bash(docker push *)"       — block docker push
+"Bash(pip install *)"       — block pip install
+"Bash(brew install *)"      — block brew install
+"Bash(apt install *)"       — block apt install
+"Bash(wrangler deploy *)"   — block Cloudflare deploys
+"Bash(terraform apply *)"   — block terraform apply
+"Bash(kubectl delete *)"    — block k8s delete
+```
+
+**Sensitive files:**
+```
+"Read(.env)"                — block .env in project root
+"Read(**/.env*)"            — block .env files everywhere
+"Read(**/*secret*)"         — block files with "secret" in the name
+"Read(**/*credential*)"     — block credential files
+"Read(**/*.pem)"            — block private keys
+"Read(**/*id_rsa*)"         — block SSH keys
+```
+
+</details>
+
+<details>
+<summary><strong>Common allow patterns</strong> (click to expand)</summary>
+
+```
+"Bash(git:*)"               — allow git (with or without args)
+"Bash(npm:*)"               — allow npm
+"Bash(npx:*)"               — allow npx
+"Bash(node:*)"              — allow node
+"Bash(python:*)"            — allow python
+"Bash(ls:*)"                — allow ls
+"Bash(cat:*)"               — allow cat
+"Bash(echo:*)"              — allow echo
+"Bash(grep:*)"              — allow grep
+"Bash(make:*)"              — allow make
+```
+
+</details>
+
+### Chained commands
+
+Commands chained with `&&`, `;`, or `|` are split — each part is checked separately:
+
+```
+echo hello && sudo rm -rf /tmp
+```
+
+Blocked. Even though it starts with `echo`, the `sudo` part matches the deny rule.
+
+### Where to put rules
+
+Rules can go in three places (checked in this order):
+
+1. `.claude/settings.local.json` — this project only (gitignored)
+2. `.claude/settings.json` — this project, shared with team
+3. `~/.claude/settings.json` — all projects
+
+**deny** always wins over **allow**. More specific (project-level) rules override global ones.
+
 ## Requirements
 
 - **Node.js 18+**
 - **Claude Code** with MCP support
 - Optional: Bun (auto-detected, 3-5x faster JS/TS)
 
-## Development
+## Contributing
+
+We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for the full local development workflow, TDD guidelines, and how to test your changes in a live Claude Code session.
 
 ```bash
 git clone https://github.com/mksglu/claude-context-mode.git
@@ -211,4 +337,4 @@ npm run test:all      # full suite
 
 ## License
 
-MIT
+[Elastic License 2.0 (ELv2)](LICENSE) — free to use, modify, and share. You may not rebrand and redistribute this software as a competing plugin, product, or managed service.

package/build/cli.js

@@ -231,6 +231,24 @@ async function doctor() {
                 " — No PreToolUse hooks found" +
                 color.dim("\n  Run: npx context-mode upgrade"));
         }
+        // Check SessionStart hook
+        const sessionStart = hooks?.SessionStart;
+        if (sessionStart && sessionStart.length > 0) {
+            const hasSessionHook = sessionStart.some((entry) => entry.hooks?.some((h) => h.command?.includes("sessionstart.mjs")));
+            if (hasSessionHook) {
+                p.log.success(color.green("SessionStart hook: PASS") + " — SessionStart hook configured");
+            }
+            else {
+                p.log.error(color.red("SessionStart hook: FAIL") +
+                    " — SessionStart exists but does not point to sessionstart.mjs" +
+                    color.dim("\n  Run: npx context-mode upgrade"));
+            }
+        }
+        else {
+            p.log.error(color.red("SessionStart hook: FAIL") +
+                " — No SessionStart hooks found" +
+                color.dim("\n  Run: npx context-mode upgrade"));
+        }
     }
     else {
         p.log.error(color.red("Hooks installed: FAIL") +
@@ -500,7 +518,7 @@ async function upgrade() {
     const hookScriptPath = resolve(pluginRoot, "hooks", "pretooluse.mjs");
     const settings = readSettings() ?? {};
     const desiredHookEntry = {
-        matcher: "Bash|Read|Grep|Glob|WebFetch|WebSearch|Task",
+        matcher: "Bash|Read|Grep|WebFetch|Task|mcp__plugin_context-mode_context-mode__execute|mcp__plugin_context-mode_context-mode__execute_file|mcp__plugin_context-mode_context-mode__batch_execute",
         hooks: [
             {
                 type: "command",
@@ -532,6 +550,41 @@ async function upgrade() {
         p.log.info(color.dim("Created PreToolUse hooks section"));
         changes.push("Created PreToolUse hooks section");
     }
+    // --- SessionStart hook ---
+    p.log.step("Configuring SessionStart hook...");
+    const sessionHookScriptPath = resolve(pluginRoot, "hooks", "sessionstart.mjs");
+    const desiredSessionHookEntry = {
+        matcher: "",
+        hooks: [
+            {
+                type: "command",
+                command: "node " + sessionHookScriptPath,
+            },
+        ],
+    };
+    const existingSessionStart = hooks.SessionStart;
+    if (existingSessionStart && Array.isArray(existingSessionStart)) {
+        const existingSessionIdx = existingSessionStart.findIndex((entry) => {
+            const entryHooks = entry.hooks;
+            return entryHooks?.some((h) => h.command?.includes("sessionstart.mjs"));
+        });
+        if (existingSessionIdx >= 0) {
+            existingSessionStart[existingSessionIdx] = desiredSessionHookEntry;
+            p.log.info(color.dim("Updated existing SessionStart hook entry"));
+            changes.push("Updated existing SessionStart hook entry");
+        }
+        else {
+            existingSessionStart.push(desiredSessionHookEntry);
+            p.log.info(color.dim("Added SessionStart hook entry"));
+            changes.push("Added SessionStart hook entry to existing hooks");
+        }
+        hooks.SessionStart = existingSessionStart;
+    }
+    else {
+        hooks.SessionStart = [desiredSessionHookEntry];
+        p.log.info(color.dim("Created SessionStart hooks section"));
+        changes.push("Created SessionStart hooks section");
+    }
     settings.hooks = hooks;
     // Write updated settings
     try {

package/build/executor.js

@@ -41,10 +41,20 @@ export class PolyglotExecutor {
             if (cmd[0] === "__rust_compile_run__") {
                 return await this.#compileAndRun(filePath, tmpDir, timeout);
             }
-            return await this.#spawn(cmd, tmpDir, timeout);
+            // Shell commands run in the project directory so git, relative paths,
+            // and other project-aware tools work naturally. Non-shell languages
+            // run in the temp directory where their script file is written.
+            const cwd = language === "shell" ? this.#projectRoot : tmpDir;
+            return await this.#spawn(cmd, cwd, timeout);
         }
         finally {
-            rmSync(tmpDir, { recursive: true, force: true });
+            try {
+                rmSync(tmpDir, { recursive: true, force: true });
+            }
+            catch {
+                // On Windows, bash may still hold file handles when rmSync runs.
+                // Ignore EPERM/EBUSY — the OS will clean up %TEMP% eventually.
+            }
         }
     }
     async executeFile(opts) {
@@ -155,7 +165,21 @@ export class PolyglotExecutor {
             // Only .cmd/.bat shims need shell on Windows; real executables don't.
             // Using shell: true globally causes process-tree kill issues with MSYS2/Git Bash.
             const needsShell = isWin && ["tsx", "ts-node", "elixir"].includes(cmd[0]);
-            const proc = spawn(cmd[0], cmd.slice(1), {
+            // On Windows with Git Bash, pass the script as `bash -c "source /posix/path"`
+            // rather than `bash /path/to/script.sh`. This avoids MSYS2 path mangling
+            // while still allowing MSYS_NO_PATHCONV to protect non-ASCII paths in commands.
+            let spawnCmd = cmd[0];
+            let spawnArgs;
+            if (isWin && cmd.length === 2 && cmd[1]) {
+                const posixPath = cmd[1].replace(/\\/g, "/");
+                spawnArgs = [posixPath];
+            }
+            else {
+                spawnArgs = isWin
+                    ? cmd.slice(1).map(a => a.replace(/\\/g, "/"))
+                    : cmd.slice(1);
+            }
+            const proc = spawn(spawnCmd, spawnArgs, {
                 cwd,
                 stdio: ["ignore", "pipe", "pipe"],
                 env: this.#buildSafeEnv(cwd),
@@ -256,6 +280,12 @@ export class PolyglotExecutor {
             // XDG (config paths for gh, gcloud, etc.)
             "XDG_CONFIG_HOME",
             "XDG_DATA_HOME",
+            // SSH agent socket — required for git/jj operations that use SSH remotes.
+            // Without this, subprocesses cannot reach the agent and fall back to
+            // prompting for the key passphrase directly on the TTY, which corrupts
+            // Claude Code's PTY ownership.
+            "SSH_AUTH_SOCK",
+            "SSH_AGENT_PID",
         ];
         const env = {
             PATH: process.env.PATH ?? (isWin ? "" : "/usr/local/bin:/usr/bin:/bin"),
@@ -264,6 +294,7 @@ export class PolyglotExecutor {
             LANG: "en_US.UTF-8",
             PYTHONDONTWRITEBYTECODE: "1",
             PYTHONUNBUFFERED: "1",
+            PYTHONUTF8: "1",
             NO_COLOR: "1",
         };
         // Windows-critical env vars
@@ -277,6 +308,18 @@ export class PolyglotExecutor {
                 if (process.env[key])
                     env[key] = process.env[key];
             }
+            // Prevent MSYS2/Git Bash from converting non-ASCII Windows paths
+            // (e.g. Chinese characters in project paths) to POSIX paths.
+            env["MSYS_NO_PATHCONV"] = "1";
+            env["MSYS2_ARG_CONV_EXCL"] = "*";
+            // Ensure Git Bash unix tools (cat, ls, head, etc.) are on PATH.
+            // The MCP server process may not inherit the full user PATH that
+            // includes Git's usr/bin directory.
+            const gitUsrBin = "C:\\Program Files\\Git\\usr\\bin";
+            const gitBin = "C:\\Program Files\\Git\\bin";
+            if (!env["PATH"].includes(gitUsrBin)) {
+                env["PATH"] = `${gitUsrBin};${gitBin};${env["PATH"]}`;
+            }
         }
         for (const key of passthrough) {
             if (process.env[key]) {
@@ -292,14 +335,14 @@ export class PolyglotExecutor {
             case "typescript":
                 return `const FILE_CONTENT_PATH = ${escaped};\nconst FILE_CONTENT = require("fs").readFileSync(FILE_CONTENT_PATH, "utf-8");\n${code}`;
             case "python":
-                return `FILE_CONTENT_PATH = ${escaped}\nwith open(FILE_CONTENT_PATH, "r") as _f:\n    FILE_CONTENT = _f.read()\n${code}`;
+                return `FILE_CONTENT_PATH = ${escaped}\nwith open(FILE_CONTENT_PATH, "r", encoding="utf-8") as _f:\n    FILE_CONTENT = _f.read()\n${code}`;
             case "shell": {
                 // Single-quote the path to prevent $, backtick, and ! expansion
                 const sq = "'" + absolutePath.replace(/'/g, "'\\''") + "'";
                 return `FILE_CONTENT_PATH=${sq}\nFILE_CONTENT=$(cat ${sq})\n${code}`;
             }
             case "ruby":
-                return `FILE_CONTENT_PATH = ${escaped}\nFILE_CONTENT = File.read(FILE_CONTENT_PATH)\n${code}`;
+                return `FILE_CONTENT_PATH = ${escaped}\nFILE_CONTENT = File.read(FILE_CONTENT_PATH, encoding: "utf-8")\n${code}`;
             case "go":
                 return `package main\n\nimport (\n\t"fmt"\n\t"os"\n)\n\nvar FILE_CONTENT_PATH = ${escaped}\n\nfunc main() {\n\tb, _ := os.ReadFile(FILE_CONTENT_PATH)\n\tFILE_CONTENT := string(b)\n\t_ = FILE_CONTENT\n\t_ = fmt.Sprint()\n${code}\n}\n`;
             case "rust":
@@ -307,9 +350,9 @@ export class PolyglotExecutor {
             case "php":
                 return `<?php\n$FILE_CONTENT_PATH = ${escaped};\n$FILE_CONTENT = file_get_contents($FILE_CONTENT_PATH);\n${code}`;
             case "perl":
-                return `my $FILE_CONTENT_PATH = ${escaped};\nopen(my $fh, '<', $FILE_CONTENT_PATH) or die "Cannot open: $!";\nmy $FILE_CONTENT = do { local $/; <$fh> };\nclose($fh);\n${code}`;
+                return `my $FILE_CONTENT_PATH = ${escaped};\nopen(my $fh, '<:encoding(UTF-8)', $FILE_CONTENT_PATH) or die "Cannot open: $!";\nmy $FILE_CONTENT = do { local $/; <$fh> };\nclose($fh);\n${code}`;
             case "r":
-                return `FILE_CONTENT_PATH <- ${escaped}\nFILE_CONTENT <- readLines(FILE_CONTENT_PATH, warn=FALSE)\nFILE_CONTENT <- paste(FILE_CONTENT, collapse="\\n")\n${code}`;
+                return `FILE_CONTENT_PATH <- ${escaped}\nFILE_CONTENT <- readLines(FILE_CONTENT_PATH, warn=FALSE, encoding="UTF-8")\nFILE_CONTENT <- paste(FILE_CONTENT, collapse="\\n")\n${code}`;
             case "elixir":
                 return `file_content_path = ${escaped}\nfile_content = File.read!(file_content_path)\n${code}`;
         }

package/build/runtime.js

@@ -1,4 +1,5 @@
 import { execSync } from "node:child_process";
+import { existsSync } from "node:fs";
 const isWindows = process.platform === "win32";
 function commandExists(cmd) {
     try {
@@ -10,6 +11,39 @@ function commandExists(cmd) {
         return false;
     }
 }
+/**
+ * On Windows, resolve the first non-WSL bash in PATH.
+ * WSL bash (C:\Windows\System32\bash.exe) cannot handle Windows paths,
+ * so we skip it and prefer Git Bash or MSYS2 bash instead.
+ */
+function resolveWindowsBash() {
+    // First, try well-known Git Bash locations directly (works even when
+    // Git\usr\bin is not on PATH, which is common in MCP server environments
+    // that only inherit Git\cmd from the system PATH).
+    const knownPaths = [
+        "C:\\Program Files\\Git\\usr\\bin\\bash.exe",
+        "C:\\Program Files (x86)\\Git\\usr\\bin\\bash.exe",
+    ];
+    for (const p of knownPaths) {
+        if (existsSync(p))
+            return p;
+    }
+    // Fallback: scan PATH via `where bash`, skipping WSL and WindowsApps entries.
+    try {
+        const result = execSync("where bash", { encoding: "utf-8", stdio: "pipe" });
+        const candidates = result.trim().split(/\r?\n/).map(p => p.trim()).filter(Boolean);
+        for (const p of candidates) {
+            const lower = p.toLowerCase();
+            if (lower.includes("system32") || lower.includes("windowsapps"))
+                continue;
+            return p;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 function getVersion(cmd) {
     try {
         return execSync(`${cmd} --version`, {
@@ -40,7 +74,9 @@ export function detectRuntimes() {
             : commandExists("python")
                 ? "python"
                 : null,
-        shell: commandExists("bash") ? "bash" : "sh",
+        shell: isWindows
+            ? (resolveWindowsBash() ?? (commandExists("sh") ? "sh" : commandExists("powershell") ? "powershell" : "cmd.exe"))
+            : commandExists("bash") ? "bash" : "sh",
         ruby: commandExists("ruby") ? "ruby" : null,
         go: commandExists("go") ? "go" : null,
         rust: commandExists("rustc") ? "rustc" : null,