devlyn-cli 3.1.0 → 3.1.1

package/README.md

@@ -305,9 +305,14 @@ Selected during install. Run `npx devlyn-cli` again to add more.
 
 ## Requirements
 
-- **Node.js 18+**
+- **Node.js 18+** and npm
+- **Python 3.11+** available as `python3`, and Git for the resolve harness
 - **[Claude Code](https://docs.anthropic.com/en/docs/claude-code)** installed and configured
 
+On native Windows, use native Node/npm and Python plus Git for Windows Bash for the shipped shell wrapper. Run `npx devlyn-cli -y` in the project; add Codex with `npx devlyn-cli agents codex`. npm extraction and installed directories use the legal U+F03A colon alias (for example `devlyn\uf03aresolve`); logical skill names remain `devlyn:resolve`. Do not rename them by hand. Harness text is UTF-8 without requiring `PYTHONUTF8`.
+
+Windows completion preserves the workspace, owned refs and recovery receipt when writer cessation cannot be proved, even after merge; resume guidance and delivery status remain separate from product verification. The portability workflow tests a POSIX-packed npm artifact on native Windows without checking out colon paths. A POSIX pass alone does not establish Windows support: acceptance requires the passing Windows job for the exact source SHA/artifact hashes.
+
 ## Contributing
 
 - **Add a skill** — directory in `config/skills/` with `SKILL.md`

package/bin/devlyn.js

@@ -18,6 +18,33 @@ const DEVLYN_CORE_SKILLS = ['devlyn:resolve', 'devlyn:ideate', 'devlyn:design-ui
 const DEVLYN_SKILL_DIR_STAMP = '__DEVLYN_SKILL_DIR__';
 const DEVLYN_INSTALL_MARKER = '.devlyn-install.json';
 
+function logicalSkillName(name) {
+  return name.replace(/\uF03A/g, ':');
+}
+
+function physicalSkillName(name) {
+  return process.platform === 'win32' ? name.replace(/:/g, '\uF03A') : name;
+}
+
+function skillPath(root, name) {
+  name = logicalSkillName(name);
+  const aliases = [...new Set([name, name.replace(/:/g, '\uF03A')])];
+  const entries = fs.existsSync(root) ? fs.readdirSync(root) : [];
+  const found = aliases.filter((alias) => entries.includes(alias));
+  if (found.length > 1) throw new Error(`Ambiguous skill aliases in ${root}: ${found.join(', ')}`);
+  return path.join(root, found[0] || physicalSkillName(name));
+}
+
+function preflightSkillDirs(source, target, names) {
+  for (const name of names) {
+    skillPath(source, name);
+    skillPath(target, name);
+  }
+  for (const relative of DEPRECATED_DIRS) {
+    skillPath(target, path.basename(relative));
+  }
+}
+
 // Cross-agent shared skills directory read by BOTH oh-my-pi and Pi. Verified
 // from the omp binary's skill-provider strings ("skills from .agents/skills —
 // project walk-up + user home") and Pi's docs ("~/.agents/skills/"). Installing
@@ -313,6 +340,8 @@ function listContents() {
 
 function cleanupDeprecated(targetDir) {
   let removed = 0;
+  const deprecated = DEPRECATED_DIRS.map((relPath) =>
+    [relPath, skillPath(path.join(targetDir, 'skills'), path.basename(relPath))]);
   for (const relPath of DEPRECATED_FILES) {
     const fullPath = path.join(targetDir, relPath);
     if (fs.existsSync(fullPath)) {
@@ -321,8 +350,7 @@ function cleanupDeprecated(targetDir) {
       removed++;
     }
   }
-  for (const relPath of DEPRECATED_DIRS) {
-    const fullPath = path.join(targetDir, relPath);
+  for (const [relPath, fullPath] of deprecated) {
     if (fs.existsSync(fullPath)) {
       fs.rmSync(fullPath, { recursive: true });
       log(`  ✕ ${relPath}/ (removed)`, 'dim');
@@ -337,13 +365,14 @@ function copyRecursive(src, dest, baseDir) {
 
   if (stats.isDirectory()) {
     // Never install dev workspaces, even when running from source repo.
-    if (UNSHIPPED_SKILL_DIRS.has(path.basename(src))) return;
+    if (UNSHIPPED_SKILL_DIRS.has(logicalSkillName(path.basename(src)))) return;
     if (!fs.existsSync(dest)) {
       fs.mkdirSync(dest, { recursive: true });
     }
 
     for (const item of fs.readdirSync(src)) {
-      copyRecursive(path.join(src, item), path.join(dest, item), baseDir);
+      const name = src === path.join(CONFIG_SOURCE, 'skills') ? physicalSkillName(logicalSkillName(item)) : item;
+      copyRecursive(path.join(src, item), path.join(dest, name), baseDir);
     }
   } else {
     const destDir = path.dirname(dest);
@@ -360,9 +389,19 @@ function clearInstallMarker(skillsDir) {
 }
 
 function assertCompleteSkillInstall(sourceSkillsDir, skillsDir, skillNames) {
-  const missing = skillNames.filter((skillName) =>
-    !fs.existsSync(path.join(sourceSkillsDir, skillName))
-      || !fs.existsSync(path.join(skillsDir, skillName)));
+  function complete(src, dest) {
+    if (!fs.existsSync(src) || !fs.existsSync(dest)) return false;
+    if (fs.statSync(src).isDirectory()) {
+      return fs.statSync(dest).isDirectory() && fs.readdirSync(src).every((name) =>
+        complete(path.join(src, name), path.join(dest, name)));
+    }
+    return fs.statSync(dest).isFile();
+  }
+  const missing = skillNames.filter((name) => {
+    const src = skillPath(sourceSkillsDir, name);
+    const dest = skillPath(skillsDir, name);
+    return !complete(src, dest) || (name !== '_shared' && !fs.existsSync(path.join(src, 'SKILL.md')));
+  });
   if (missing.length > 0) {
     throw new Error(`Incomplete devlyn skill install; missing: ${missing.join(', ')}`);
   }
@@ -440,11 +479,12 @@ const UNSHIPPED_SKILL_DIRS = new Set([
 // no counterpart in source. Dev workspaces are skipped entirely.
 function cleanManagedSkillDirs(sourceSkillsDir, targetSkillsDir) {
   if (!fs.existsSync(sourceSkillsDir) || !fs.existsSync(targetSkillsDir)) return 0;
+  preflightSkillDirs(sourceSkillsDir, targetSkillsDir, fs.readdirSync(sourceSkillsDir));
   let cleaned = 0;
   for (const entry of fs.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    if (UNSHIPPED_SKILL_DIRS.has(entry.name)) continue;
-    const targetPath = path.join(targetSkillsDir, entry.name);
+    if (UNSHIPPED_SKILL_DIRS.has(logicalSkillName(entry.name))) continue;
+    const targetPath = skillPath(targetSkillsDir, entry.name);
     if (fs.existsSync(targetPath)) {
       fs.rmSync(targetPath, { recursive: true, force: true });
       cleaned++;
@@ -547,9 +587,11 @@ function multiSelect(items, preselectedIndices = []) {
 }
 
 function installLocalSkill(skillName) {
-  const src = path.join(OPTIONAL_SKILLS_SOURCE, skillName);
+  const src = skillPath(OPTIONAL_SKILLS_SOURCE, skillName);
   const targetDir = getTargetDir();
-  const dest = path.join(targetDir, 'skills', skillName);
+  const targets = new Set([path.join(targetDir, 'skills'), ...Object.values(CLI_TARGETS)
+    .map((cli) => cli.skillsDir).filter((dir) => dir && fs.existsSync(dir))]);
+  for (const target of targets) skillPath(target, skillName);
 
   if (!fs.existsSync(src)) {
     log(`   ⚠️  Skill "${skillName}" not found`, 'yellow');
@@ -557,7 +599,6 @@ function installLocalSkill(skillName) {
   }
 
   log(`\n🛠️  Installing ${skillName}...`, 'cyan');
-  copyRecursive(src, dest, targetDir);
 
   // Mirror to every CLI skill-loader directory that already exists so optional
   // skills are picked up by Codex/omp/Pi (and any future CLI with a skillsDir)
@@ -565,13 +606,12 @@ function installLocalSkill(skillName) {
   // create an agent install just because someone opted into a Claude-side skill.
   // De-dup by directory: omp and Pi share ~/.agents/skills, so the mirror runs
   // once per unique destination.
-  const mirrored = new Set();
-  for (const cli of Object.values(CLI_TARGETS)) {
-    if (!cli.skillsDir || mirrored.has(cli.skillsDir) || !fs.existsSync(cli.skillsDir)) continue;
-    mirrored.add(cli.skillsDir);
-    const cliDest = path.join(cli.skillsDir, skillName);
-    if (fs.existsSync(cliDest)) fs.rmSync(cliDest, { recursive: true, force: true });
-    copyRecursive(src, cliDest, cli.skillsDir);
+  for (const target of targets) {
+    fs.rmSync(skillPath(target, skillName), { recursive: true, force: true });
+    const dest = path.join(target, physicalSkillName(skillName));
+    copyRecursive(src, dest, target);
+    stampInstalledSkillDir(dest, dest);
+    assertCompleteSkillInstall(OPTIONAL_SKILLS_SOURCE, target, [skillName]);
   }
   return true;
 }
@@ -632,6 +672,7 @@ function installSkillsForCLI(cliKey) {
     fs.mkdirSync(cli.skillsDir, { recursive: true });
   }
   clearInstallMarker(cli.skillsDir);
+  preflightSkillDirs(sourceSkillsDir, cli.skillsDir, cli.skillsToInstall);
 
   const removed = cleanupDeprecated(path.dirname(cli.skillsDir));
   if (removed > 0) {
@@ -640,13 +681,14 @@ function installSkillsForCLI(cliKey) {
 
   let copied = 0;
   for (const skillName of cli.skillsToInstall) {
-    const src = path.join(sourceSkillsDir, skillName);
-    const dest = path.join(cli.skillsDir, skillName);
+    const src = skillPath(sourceSkillsDir, skillName);
+    const previous = skillPath(cli.skillsDir, skillName);
+    const dest = path.join(cli.skillsDir, physicalSkillName(skillName));
     if (!fs.existsSync(src)) continue;
     // Full replace per cleanManagedSkillDirs semantics: stale files in the
     // installed mirror would otherwise persist forever.
-    if (fs.existsSync(dest)) {
-      fs.rmSync(dest, { recursive: true, force: true });
+    if (fs.existsSync(previous)) {
+      fs.rmSync(previous, { recursive: true, force: true });
     }
     copyRecursive(src, dest, cli.skillsDir);
     stampInstalledSkillDir(dest, dest);
@@ -777,6 +819,10 @@ function installClaudeCore() {
   }
   copyRecursive(CONFIG_SOURCE, targetDir, targetDir);
   assertCompleteSkillInstall(path.join(CONFIG_SOURCE, 'skills'), skillsDir, DEVLYN_CORE_SKILLS);
+  for (const name of DEVLYN_CORE_SKILLS) {
+    const dest = skillPath(skillsDir, name);
+    stampInstalledSkillDir(dest, dest);
+  }
   writeInstallMarker(skillsDir);
 
   // Remove deprecated files from previous versions

package/config/skills/_shared/adapters/claude.md

@@ -22,7 +22,7 @@ two targeted probes; the invoking phase sets `--effort`, pair-JUDGE uses
 `medium`):
 
 ```bash
-python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- claude -p "<judge prompt>" \
+python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 --stdin-file "<judge-prompt-file>" --record-transport -- claude -p \
   --permission-mode dontAsk \
   --tools "Read,Grep,Glob" --allowedTools "Read,Grep,Glob" \
   --setting-sources project --strict-mcp-config --mcp-config '{"mcpServers":{}}' \
@@ -30,6 +30,7 @@ python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- claude -p "<judge prompt>" \
   > .devlyn/claude-judge.stdout 2> .devlyn/claude-judge.stderr
 ```
 
+- Write the complete prompt as exact UTF-8 file bytes; no positional prompt or shell substitution. With `--record-transport`, the runner snapshots stdin and exclusively creates `<judge-prompt-file>.transport.json` to bind actual native argv and delivered bytes; an existing carrier rejects dispatch. Preserve it for explicit judge-role authentication. Ordinary `--stdin-file` reads require no output or writable input directory; without it, stdin remains DEVNULL.
 - Omit `--model` — the CLI's configured default is used (zero-touch, same
   rule as codex-config.md's "omit `-m`").
 - `dontAsk` denies anything not allowlisted (official guide: "denies
@@ -46,7 +47,7 @@ python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- claude -p "<judge prompt>" \
   `.devlyn/verify.pair.findings.jsonl`. Raw stdout stays diagnostic at
   `.devlyn/claude-judge.stdout`; `verify-merge-findings.py` blocks the run
   if stdout contains findings the canonical file lacks.
-- Exit 124 is a wall-budget abort (kills the process group) → the orchestrator
+- Exit 124 is a wall-budget abort (terminates the native child process tree; POSIX process group) → the orchestrator
   writes `.devlyn/verify.pair.timeout.json`; budget abort ≠ availability failure
   and the fail-closed availability rules above are unchanged.
 - Do not pipe stdout (`| tail`, `| grep`); capture to file. Non-zero exit other

package/config/skills/_shared/adapters/codex.md

@@ -14,7 +14,7 @@ Your default is efficient, direct, task-oriented. The canonical body specifies t
 
 Resolve the request in the fewest useful tool loops without sacrificing correctness. For retrieval tasks: start with one broad search using short discriminative keywords; make another retrieval call only when the top results don't answer the core question or a required fact / parameter / source is missing. For tool-heavy tasks, start with a brief preamble: a one-line acknowledgment of the request and the first step you'll take.
 
-For VERIFY JUDGE retrieval, batch related reads. After sealed parity proves a
+For a constrained-read VERIFY packet, judge the supplied material without tools; missing or unbound inputs require a verdict-binding BLOCKED finding. Keep the read-only sandbox and bounded review. Otherwise, for VERIFY JUDGE retrieval, batch related reads. After sealed parity proves a
 canonical file and its `.agents` mirror are byte-identical, inspect the
 canonical file only. Open self-test bodies or MECHANICAL raw streams only for a
 named clause that remains unresolved after the broad pass.

package/config/skills/_shared/archive_run.py

@@ -535,7 +535,7 @@ def completion_self_test() -> None:
         for i, final in enumerate(invalid):
             path = runs / f"indeterminate-{i:02d}" / "pipeline.state.json"
             path.parent.mkdir()
-            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": final}}))
+            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": final}}), encoding="utf-8")
             preserved.append(path)
         for i, raw in enumerate((b"{", b"\xff", b"null", b'{"phases":{}}', b'{"run_id":[]}')):
             path = runs / f"malformed-{i}" / "pipeline.state.json"
@@ -545,14 +545,14 @@ def completion_self_test() -> None:
         for i, pattern in enumerate(BOOTSTRAP_TEMP_PATTERNS):
             path = runs / f"residue-{i}" / "pipeline.state.json"
             path.parent.mkdir()
-            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[0]}}))
+            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[0]}}), encoding="utf-8")
             residue = path.with_name(pattern.replace("*", "interrupted"))
             residue.write_bytes(b"interrupted initialization")
             preserved.extend((path, residue))
         for i in range(12):
             path = runs / f"complete-{i:02d}" / "pipeline.state.json"
             path.parent.mkdir()
-            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[i % 8]}}))
+            path.write_text(json.dumps({"run_id": path.parent.name, "phases": {"final_report": valid[i % 8]}}), encoding="utf-8")
         before = {p: p.read_bytes() for p in preserved}
         assert prune(runs) == 2
         assert {p: p.read_bytes() for p in preserved} == before
@@ -901,6 +901,7 @@ def self_test() -> int:
             [sys.executable, str(pathlib.Path(__file__).resolve()), "--devlyn-dir", str(bad)],
             capture_output=True,
             text=True,
+            encoding="utf-8",
         )
         assert blocked_cli.returncode == 1
         assert "error: archive blocked:" in blocked_cli.stderr
@@ -948,4 +949,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    runpy.run_path(str(pathlib.Path(__file__).with_name("platform-support.py")))["configure_utf8"]()
     raise SystemExit(main())

package/config/skills/_shared/codex-config.md

@@ -4,7 +4,7 @@ Single source of truth for how every skill calls Codex. **MCP is not used.** Ski
 
 ## Canonical invocations
 
-All long-running Codex calls go through `codex-monitored.sh` — a thin wrapper that closes stdin (codex 0.124.0 hangs when both stdin is open and a prompt arg is given), streams Codex stdout fully (no `tail -n` truncation), and prints a `[codex-monitored] heartbeat` line every 30s so the outer `claude -p` byte-watchdog stays fed during long reasoning gaps. The wrapper passes its arguments through verbatim to the underlying CLI, so the canonical flag set is unchanged from a raw call — only the launcher differs.
+All long-running Codex calls go through `codex-monitored.sh`. It streams full stdout and emits a `[codex-monitored] heartbeat` every 30s on stderr. Write multiline prompts as exact UTF-8 bytes to a task-local file; set `DEVLYN_CODEX_PROMPT_FILE` and pass the sole prompt argument `-`. The wrapper snapshots those bytes before dispatch and seals actual argv, prompt digest and completion in `<prompt-file>.transport.json`. Missing/unreadable files, competing prompt arguments and receipt/prompt mismatches fail before launch. Without file transport, stdin remains DEVNULL (avoiding the open-stdin plus argument-prompt hang).
 
 Before the first Codex call, resolve the wrapper from the invoked skill directory:
 
@@ -25,22 +25,22 @@ fi
 **Read-only critique / adversarial review / debate** (`/devlyn:resolve` VERIFY pair-mode, plus any future ideate read-only critique). Security review stays native to Claude Code BUILD_GATE. Codex returns findings on stdout; the orchestrator writes files.
 
 ```bash
-CODEX_MONITORED_ISOLATED=1 bash "$CODEX_MONITORED_PATH" \
+DEVLYN_CODEX_PROMPT_FILE="<prompt-file>" CODEX_MONITORED_ISOLATED=1 CODEX_MONITORED_TIMEOUT_SEC=600 bash "$CODEX_MONITORED_PATH" \
   -C <project-root> \
   -s read-only \
   -c model_reasoning_effort=xhigh \
-  "<inlined-prompt>"
+  -
 ```
 
 **Workspace-write implementation** (`/devlyn:resolve` IMPLEMENT phase when `--engine codex` or `--engine auto` routes to Codex, plus codex-routed `/devlyn:ideate` phases):
 
 ```bash
-bash "$CODEX_MONITORED_PATH" \
+DEVLYN_CODEX_PROMPT_FILE="<prompt-file>" bash "$CODEX_MONITORED_PATH" \
   -C <project-root> \
   -s workspace-write \
   -c sandbox_workspace_write.network_access=false \
   -c model_reasoning_effort=xhigh \
-  "<inlined-prompt>"
+  -
 ```
 
 **CI-equivalent BUILD_GATE** keeps the same write sandbox and enables general
@@ -48,15 +48,16 @@ outbound network access inside that sandbox, including the loopback servers and
 network-backed test gates that CI may exercise:
 
 ```bash
-bash "$CODEX_MONITORED_PATH" \
+DEVLYN_CODEX_PROMPT_FILE="<prompt-file>" bash "$CODEX_MONITORED_PATH" \
   -C <project-root> \
   -s workspace-write \
   -c sandbox_workspace_write.network_access=true \
   -c model_reasoning_effort=xhigh \
-  "<inlined-prompt>"
+  -
 ```
 
 Notes:
+- `DEVLYN_CODEX_PROMPT_FILE` — use the same file as `DEVLYN_INVOCATION_PROMPT_FILE` for receipt-bound calls. Retain the generated transport carrier with the prompt/session/argv evidence; a path or claimed environment value alone does not prove delivery. Do not use shell command substitution for prompt bytes.
 - `-C` — project root so Codex's working directory matches.
 - `-s read-only` / `-s workspace-write` — sandbox policy. Use workspace-write for implementation/probe phases that write tracked files or `.devlyn` artifacts.
 - `-c sandbox_workspace_write.network_access=<true|false>` — required and receipt-bound for mutation phases: `true` only for BUILD_GATE and, per call, PROBE-DERIVE when the probe's visible Verification command requires a localhost service; `false` for PLAN, IMPLEMENT, CLEANUP, and PROBE-DERIVE by default. This allows CI-equivalent loopback/network tests without widening to `danger-full-access` and prevents user configuration from silently changing other phases.
@@ -66,6 +67,10 @@ Notes:
 - Wrapper calls are **foreground-blocking**. Never launch them via a backgrounded shell (`run_in_background`, `&`, `nohup`) and never end the orchestrator message while one runs: a headless print-mode session kills backgrounded children at wind-down (observed 2026-07-07: an FS1 A-arm IMPLEMENT codex call was killed at turn end → 0-byte delivery). The heartbeat stream is the observability channel; block on the call. Interactive Claude Code caps a foreground Bash call at `BASH_MAX_TIMEOUT_MS` (the installer sets at least 3600000 ms, IMPLEMENT's effective outer ceiling), so every foreground Codex wrapper call must pass the Bash `timeout` explicitly at that ceiling or the phase's own budget (for example, 600s judges) — never rely on the 120 s default.
 - Raw `codex exec ...` invocations are **forbidden** in skill prompts. The benchmark variant arm runs a PATH shim (`scripts/codex-shim/codex`) that transparently re-routes any raw `codex exec` to the wrapper as a safety net, but skills should always emit the wrapper form directly so the orchestrator's first-attempt has the right shape. Two prior iterations (iter-0006 universal foreground ban, iter-0008 prompt-level kill-shape contract) failed because the orchestrator picked starvation-prone shapes (`codex exec ... 2>&1 | tail -200`) from its own pattern prior — the wrapper plus the shim is the runtime binding layer those iters lacked. See `autoresearch/iterations/0009-wrapper-and-hook.md`.
 
+## Constrained Windows judge reads
+
+Codex supports [native Windows sandboxing](https://learn.chatgpt.com/docs/windows/windows-sandbox). A policy-denied read selects a constrained-read route for that judge; it does not establish that Windows lacks sandbox support or denies every read. The orchestrator supplies the complete spec, sibling expected contract, accepted source SHA and cumulative diff, relevant source/tests with file:line locators, and validated sealed MECHANICAL results, manifests and required raw streams inline in the prompt file. Tell the fresh judge: "Judge only the supplied evidence; run no tools. Missing, truncated or unbound inputs require a verdict-binding BLOCKED finding." Keep `-s read-only`, isolation, freshness, selected model/effort, the 600s budget and normal findings/timeout handling. Never widen sandbox permissions or invent evidence to complete the packet.
+
 ## Availability check
 
 Before the first Codex call in a run, verify the CLI is on PATH:
@@ -84,4 +89,4 @@ The local Codex CLI, fronted by `codex-monitored.sh`, is the integration boundar
 
 Skills write the invocation as a Bash command the runtime executes. Example shape from `/devlyn:resolve` PHASE 2 IMPLEMENT when routed to Codex:
 
-> Run `bash "$CODEX_MONITORED_PATH" --json -C <state.base_ref.repo_root> -s workspace-write -m <model_requested> -c sandbox_workspace_write.network_access=false -c model_reasoning_effort=xhigh "<IMPLEMENT prompt>"`. Capture stdout as the IMPLEMENT reply; non-zero exit → treat as subagent failure. The wrapper emits `[codex-monitored]` heartbeat and lifecycle lines on **stderr** — stdout stays clean for Codex output, so the orchestrator can parse the reply without filtering. Heartbeat-on-stderr keeps the orchestrator's combined-output stream non-silent (defeats the iter-0008 byte-watchdog kill) without polluting the codex-reply view of stdout. Do not pipe the wrapper; direct capture or file redirection preserves streaming and avoids the pipe-refusal exit.
+> Run `DEVLYN_CODEX_PROMPT_FILE="<IMPLEMENT-prompt-file>" bash "$CODEX_MONITORED_PATH" --json -C <state.base_ref.repo_root> -s workspace-write -m <model_requested> -c sandbox_workspace_write.network_access=false -c model_reasoning_effort=xhigh -`. Capture stdout as the IMPLEMENT reply; non-zero exit → treat as subagent failure. The wrapper emits `[codex-monitored]` heartbeat and lifecycle lines on **stderr** — stdout stays clean for Codex output, so the orchestrator can parse the reply without filtering. Heartbeat-on-stderr keeps the orchestrator's combined-output stream non-silent (defeats the iter-0008 byte-watchdog kill) without polluting the codex-reply view of stdout. Do not pipe the wrapper; direct capture or file redirection preserves streaming and avoids the pipe-refusal exit.

package/config/skills/_shared/codex-monitored.sh

@@ -21,7 +21,7 @@
 #      clear message so the orchestrator can self-correct on retry.
 #      (Round 2 finding #1 fix: shim alone does not defeat `| tail`; the
 #      wrapper must reject the pipe shape directly.)
-#   2. Closes stdin (`< /dev/null`) — kills the codex 0.124.0 stdin hang.
+#   2. Closes stdin unless DEVLYN_CODEX_PROMPT_FILE supplies the sole prompt.
 #   3. Streams codex stdout to OUR stdout line-by-line — the orchestrator reads
 #      stdout as the subagent reply (per `_shared/codex-config.md`) so we MUST
 #      NOT swallow it (e.g. `tail -n 200`). codex stderr forwards to OUR stderr.
@@ -54,6 +54,7 @@
 #   CODEX_MONITORED_ALLOW_PIPED    — set non-empty to skip the pipe-stdout
 #                                     refusal. Reserved for tests; don't use
 #                                     in skill prompts.
+#   DEVLYN_CODEX_PROMPT_FILE      — exact binary stdin prompt; requires sole `-`.
 #   DEVLYN_INVOCATION_*             — run/phase/round/workdir/prompt/session/
 #                                     receipt identity. When any is set, all
 #                                     are required and the wrapper seals a
@@ -269,22 +270,17 @@ if [ -n "${CODEX_MONITORED_ISOLATED:-}" ]; then
   printf '[codex-monitored] isolated=1\n' >&2
 fi
 
-if [ -n "$RECEIPT_ENABLED" ]; then
-  RECEIPT_HELPER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/invocation-receipt.py"
-  python3 "$RECEIPT_HELPER" start \
-    --workdir "$DEVLYN_INVOCATION_WORKDIR" \
-    --receipt "$DEVLYN_INVOCATION_RECEIPT" \
-    --run-id "$DEVLYN_INVOCATION_RUN_ID" \
-    --phase "$DEVLYN_INVOCATION_PHASE" \
-    --round "$DEVLYN_INVOCATION_ROUND" \
-    --prompt-file "$DEVLYN_INVOCATION_PROMPT_FILE" \
-    --session-file "$DEVLYN_INVOCATION_SESSION_FILE" \
-    -- "${CODEX_ARGS[@]}" || exit 64
+RECEIPT_HELPER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/invocation-receipt.py"
+# Native Python owns Windows PIDs and the timeout tree; MSYS PIDs are different.
+if [ "${OS:-}" = Windows_NT ]; then
+  exec python3 "$RECEIPT_HELPER" dispatch --binary "$CODEX_BIN" \
+    --timeout "$TIMEOUT_SEC" --heartbeat "$HEARTBEAT_SEC" -- "${CODEX_ARGS[@]}" < /dev/null
 fi
 
-# Launch codex with stdin closed; output streams directly to OUR stdout/stderr.
+# The dispatcher snapshots file input, seals actual argv, then execs in this group.
 set -m
-"$CODEX_BIN" exec "${CODEX_ARGS[@]}" < /dev/null &
+python3 "$RECEIPT_HELPER" dispatch --binary "$CODEX_BIN" \
+  --timeout "$TIMEOUT_SEC" --heartbeat "$HEARTBEAT_SEC" -- "${CODEX_ARGS[@]}" < /dev/null &
 CODEX_PID=$!
 printf '[codex-monitored] codex pid=%d\n' "$CODEX_PID" >&2
 
@@ -308,11 +304,8 @@ if [ -n "$TIMEOUT_FLAG" ] && [ -f "$TIMEOUT_FLAG" ]; then
   EXIT=124
 fi
 
-if [ -n "$RECEIPT_ENABLED" ]; then
-  python3 "$RECEIPT_HELPER" finish \
-    --workdir "$DEVLYN_INVOCATION_WORKDIR" \
-    --receipt "$DEVLYN_INVOCATION_RECEIPT" \
-    --exit-code "$EXIT" || exit 64
+if [ -n "$RECEIPT_ENABLED" ] || [ -n "${DEVLYN_CODEX_PROMPT_FILE:-}" ]; then
+  python3 "$RECEIPT_HELPER" complete-dispatch --exit-code "$EXIT" || exit 64
 fi
 
 printf '[codex-monitored] codex exited: code=%d elapsed=%ds\n' \

package/config/skills/_shared/collect-codex-findings.py

@@ -501,4 +501,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    runpy.run_path(str(pathlib.Path(__file__).with_name("platform-support.py")))["configure_utf8"]()
     raise SystemExit(main())

package/config/skills/_shared/engine-preflight.md

@@ -49,6 +49,8 @@ Do not report a downgraded successful run when a required engine is missing.
 
 ## Canonical cross-engine invocations
 
+For native Windows, use native Node/npm and Python (`python3` on PATH), with Git for Windows Bash for the shipped shell wrapper. Supported npm engine shims resolve to native argv; unsupported/malformed shims fail visibly. Deliver multiline prompts from files: Codex uses `DEVLYN_CODEX_PROMPT_FILE` with explicit `-`; Claude uses `run-bounded.py 600 --stdin-file <prompt-file> --record-transport -- claude -p`. Retain generated transport evidence. A policy-denied Codex judge read uses the complete inline no-tools packet in `_shared/codex-config.md#constrained-windows-judge-reads`, keeping read-only isolation and the selected role.
+
 After the availability check passes, Codex keeps the monitored `codex-monitored.sh`
 path; every other resolved OTHER engine follows `_shared/adapters/<name>.md`
 `## Invocation`. Capture `.devlyn/<name>-judge.stdout`, then normalize it with

package/config/skills/_shared/finish-gate.py

@@ -2,6 +2,7 @@
 """Deterministic PHASE 6 final-diff gate for /devlyn:resolve."""
 from __future__ import annotations
 
+import runpy
 import argparse
 import importlib.util
 import json
@@ -43,6 +44,7 @@ def git(work: pathlib.Path, *args: str) -> subprocess.CompletedProcess[str]:
         cwd=str(work),
         capture_output=True,
         text=True,
+        encoding="utf-8",
     )
 
 
@@ -329,7 +331,7 @@ def write_state(devlyn: pathlib.Path, state: dict) -> None:
 
 def read_findings(devlyn: pathlib.Path) -> list[dict]:
     path = devlyn / FINDINGS_NAME
-    return [SPEC_VERIFY.loads_strict_json(line) for line in path.read_text().splitlines() if line.strip()]
+    return [SPEC_VERIFY.loads_strict_json(line) for line in path.read_text(encoding="utf-8").splitlines() if line.strip()]
 
 
 def read_summary(devlyn: pathlib.Path) -> dict:
@@ -515,4 +517,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    runpy.run_path(str(pathlib.Path(__file__).with_name("platform-support.py")))["configure_utf8"]()
     raise SystemExit(main())