external-subagent 0.5.2 → 0.5.3

package/cli/paths.mjs

@@ -30,7 +30,7 @@ function darwinProductPaths(home) {
   };
 }
 
-// XDG Base Directory resolution (D-S02).  A variable selects its directory only
+// XDG Base Directory resolution.  A variable selects its directory only
 // when it is a non-empty absolute path; relative or empty values are ignored and
 // the spec fallback under $HOME applies.  Only the three XDG variables the
 // product owns are read — no other user XDG directory is probed.
@@ -46,7 +46,7 @@ function xdgDirectory(env, variable, home, fallback) {
 // state, database, socket, hook provenance, plugin staging, profiles all live
 // inside the product data directory) so the two platforms stay structurally
 // parallel.  Data and logs follow XDG; the systemd user unit directory is
-// provided for the S03 service backend.
+// provided for the service backend.
 function linuxProductPaths(home, env) {
   const data = path.join(xdgDirectory(env, 'XDG_DATA_HOME', home, ['.local', 'share']), PRODUCT_NAME);
   const logs = path.join(xdgDirectory(env, 'XDG_STATE_HOME', home, ['.local', 'state']), PRODUCT_NAME);
@@ -67,13 +67,55 @@ function linuxProductPaths(home, env) {
   };
 }
 
+// Windows base directory resolution: %LOCALAPPDATA% is used only when it is a
+// non-empty absolute path; relative or empty values are ignored and the fallback
+// under %USERPROFILE%\AppData\Local applies. APPDATA (Roaming) is deliberately
+// not consulted as the frozen field set has no roaming consumers.
+function localAppDataDirectory(env, home) {
+  const configured = env.LOCALAPPDATA;
+  if (typeof configured === 'string' && configured !== '' && path.isAbsolute(configured)) {
+    return configured;
+  }
+  return path.join(home, 'AppData', 'Local');
+}
+
+// Windows product layout: structurally parallel to darwin/linux.
+// Data, database, config, state, hook provenance, plugin staging, and profiles
+// live under %LOCALAPPDATA%\<product>.
+// Socket uses the Windows named pipe namespace (\\.\pipe\<product>-daemon).
+// launchAgent is null as Windows uses SCM rather than a file-based unit definition.
+function windowsProductPaths(home, env) {
+  const localAppData = localAppDataDirectory(env, home);
+  const data = path.join(localAppData, PRODUCT_NAME);
+  return {
+    home,
+    data,
+    config: path.join(data, 'config.json'),
+    state: path.join(data, 'install-state.json'),
+    hookProvenance: path.join(data, 'zcode-agent-hook-provenance.json'),
+    database: path.join(data, `${PRODUCT_NAME}.sqlite3`),
+    // Named pipe namespace placeholder (pending phase 1 real-machine implementation,
+    // not a filesystem path; prefix matches the windows.rs \\.\pipe\ literal).
+    socket: `\\\\.\\pipe\\${PRODUCT_NAME}-daemon`,
+    logs: path.join(localAppData, PRODUCT_NAME, 'logs'),
+    // Windows has no file-based service definition; pending phase 3 SCM integration decision.
+    launchAgent: null,
+    zcodeConfig: path.join(home, '.zcode', 'cli', 'config.json'),
+    zcodePlugin: path.join(data, 'zcode-plugin', PLUGIN_NAME),
+    profiles: path.join(data, 'profiles'),
+  };
+}
+
 // State paths derive from PRODUCT_NAME, so the debug variant gets a fully
 // parallel tree (its own data directory, database, socket, and logs) and
 // never touches the released product's state.  The layout is selected by the
-// process platform: macOS `~/Library`, every other supported host the XDG
-// baseline.  `zcodeConfig` is `~/.zcode/cli/config.json` on both platforms.
+// process platform: macOS `~/Library`, Windows `%LOCALAPPDATA%`, every other
+// supported host the XDG baseline.  `zcodeConfig` is `~/.zcode/cli/config.json`.
 export function productPaths(home = os.homedir(), env = process.env) {
-  return platform(env) === 'darwin' ? darwinProductPaths(home) : linuxProductPaths(home, env);
+  const currentPlatform = platform(env);
+  if (currentPlatform === 'darwin') return darwinProductPaths(home);
+  if (currentPlatform === 'win32') return windowsProductPaths(home, env);
+  return linuxProductPaths(home, env);
 }
 
 // Mirror the daemon's `profiles_directory()` exactly (rpc/profiles.rs):
@@ -92,7 +134,7 @@ export function productPaths(home = os.homedir(), env = process.env) {
 // separators and any `.` component that is not the first, so a trailing `.` is
 // not a component of its own: `a/.` has parent `Some("")`, `a/b/.` has parent
 // `Some("a")`, and `/.` is the root with no parent (`None`). `..` is retained.
-function rustPathParent(value) {
+function rustPathParentUnix(value) {
   if (value === '') return null;
   let end = value.length;
   for (;;) {
@@ -121,6 +163,107 @@ function joinProfiles(parent) {
   return `${parent}/profiles`;
 }
 
+// ---------------------------------------------------------------------------
+// Windows twin of the two helpers above.
+//
+// Rust compiles `std::path` against the TARGET platform's grammar, so the
+// daemon running on Windows reads config paths as Win32 paths: both `\` and
+// `/` are separators, a Disk/UNC/Verbatim prefix is part of the path, and
+// `Path::parent()` never returns a parent for a root.  The functions below are
+// derived case-by-case from real `Path::parent()` / `Path::join("profiles")`
+// output on Windows (see tests/platform/windows-paths.test.mjs); they preserve
+// the original bytes (mixed separators included) and never lexically fold
+// `..`, exactly like the Unix implementation above.
+//
+// The Unix helpers stay untouched: `profilesDir` selects the pair by the same
+// process-platform seam that selects the product layout.
+function isWindowsSeparator(char) {
+  return char === '\\' || char === '/';
+}
+
+// Prefix grammar (the subset the product can encounter):
+//   VerbatimDisk   \\?\C:
+//   VerbatimUNC    \\?\UNC\server\share
+//   Verbatim       \\?\...
+//   UNC            \\server\share        (requires both components)
+//   Disk           C:
+// A path with fewer UNC components (`\\server`, `//foo`) is NOT a prefix in
+// Rust: the leading separator is the root instead.
+function windowsPrefixEnd(value) {
+  if (value.startsWith('\\\\?\\') || value.startsWith('//?/')) {
+    let index = 4;
+    if (value.slice(index, index + 3).toUpperCase() === 'UNC'
+      && index + 3 < value.length && isWindowsSeparator(value[index + 3])) {
+      index += 4;
+      // server
+      while (index < value.length && !isWindowsSeparator(value[index])) index += 1;
+      while (index < value.length && isWindowsSeparator(value[index])) index += 1;
+      // share
+      while (index < value.length && !isWindowsSeparator(value[index])) index += 1;
+      return index;
+    }
+    if (index + 1 < value.length && /[A-Za-z]/u.test(value[index]) && value[index + 1] === ':') {
+      return index + 2;
+    }
+    return 4;
+  }
+  if (value.length >= 2 && isWindowsSeparator(value[0]) && isWindowsSeparator(value[1])) {
+    let index = 2;
+    const serverStart = index;
+    while (index < value.length && !isWindowsSeparator(value[index])) index += 1;
+    if (index === serverStart) return 0; // repeated separator: root-relative
+    while (index < value.length && isWindowsSeparator(value[index])) index += 1;
+    const shareStart = index;
+    while (index < value.length && !isWindowsSeparator(value[index])) index += 1;
+    if (index === shareStart) return 0; // no share: not a UNC prefix
+    return index;
+  }
+  if (value.length >= 2 && /[A-Za-z]/u.test(value[0]) && value[1] === ':') return 2;
+  return 0;
+}
+
+function windowsComponents(value, start) {
+  const components = [];
+  let index = start;
+  while (index < value.length) {
+    while (index < value.length && isWindowsSeparator(value[index])) index += 1;
+    if (index >= value.length) break;
+    const componentStart = index;
+    while (index < value.length && !isWindowsSeparator(value[index])) index += 1;
+    // Rust's Path::components drops a non-leading "." (a leading "." with no
+    // prefix/root is CurDir and stays a component).
+    if (value.slice(componentStart, index) === '.' && componentStart !== 0) continue;
+    components.push({ start: componentStart, end: index });
+  }
+  return components;
+}
+
+function rustPathParentWindows(value) {
+  if (value === '') return null;
+  const prefixEnd = windowsPrefixEnd(value);
+  let rootEnd = prefixEnd;
+  if (rootEnd < value.length && isWindowsSeparator(value[rootEnd])) rootEnd += 1;
+  const components = windowsComponents(value, rootEnd);
+  if (components.length === 0) return null; // root, prefix-only, and empty paths
+  if (components.length === 1) return rootEnd === 0 ? '' : value.slice(0, rootEnd);
+  return value.slice(0, components[components.length - 2].end);
+}
+
+// Platform-selected Rust `Path::parent()` (the target platform's grammar, not
+// the host JS module's).  Exported so the path contract is directly testable
+// without going through the product layout.
+export function rustPathParent(value, currentPlatform = process.platform) {
+  return currentPlatform === 'win32' ? rustPathParentWindows(value) : rustPathParentUnix(value);
+}
+
+// Rust `Path::join` on Windows appends with `\`; a trailing separator (roots)
+// and a drive-relative `C:` prefix append directly.
+function joinProfilesWindows(parent) {
+  if (parent === '') return 'profiles';
+  if (/[\\/]$/u.test(parent) || /^[A-Za-z]:$/u.test(parent)) return `${parent}profiles`;
+  return `${parent}\\profiles`;
+}
+
 export function profilesDir(env = {}, home = os.homedir()) {
   const names = ['EXTERNAL_SUBAGENT_CONFIG', 'ZCODE_AGENT_CONFIG'];
   let envPath;
@@ -133,7 +276,8 @@ export function profilesDir(env = {}, home = os.homedir()) {
     }
   }
   if (!exported) return path.join(productPaths(home, env).data, 'profiles');
-  const parent = rustPathParent(envPath);
+  const windows = platform(env) === 'win32';
+  const parent = rustPathParent(envPath, platform(env));
   if (parent === null) return null;
-  return joinProfiles(parent);
+  return windows ? joinProfilesWindows(parent) : joinProfiles(parent);
 }

package/npm/native/README.md

@@ -14,6 +14,6 @@ node scripts/release/build-native-payload.mjs --if-stale
 
 Supported platforms install without compiling Rust; the installer verifies
 the payload manifest, digest, permissions (755), and Mach-O arm64 image
-before any `init` step runs.  There is no payload for other platforms in
-S05; unsupported platforms keep `help`/`version` working and reject business
+before any `init` step runs.  There is no payload for other platforms yet;
+unsupported platforms keep `help`/`version` working and reject business
 commands without writing HOME.

package/npm/native/darwin-arm64/payload.json

@@ -1,20 +1,20 @@
 {
   "schema_version": 1,
   "product": "external-subagent",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "platform": "darwin-arm64",
   "files": [
     {
       "name": "external-subagentd",
-      "bytes": 10118624,
+      "bytes": 10169696,
       "mode": "755",
-      "sha256": "d0effa783502353dc474ab4c961b35bbe82ba8cb2f1ccbdadae3aac7e68dec7a"
+      "sha256": "2a253cc82755453ce7e56a625871f7fc2144d853f37dda1498daa18d0800dfc0"
     },
     {
       "name": "external-subagent-mcp",
-      "bytes": 935760,
+      "bytes": 935776,
       "mode": "755",
-      "sha256": "76e52e11bf1d30553c26278f34f363005714f30012a7fca14df54cd025666461"
+      "sha256": "f941106af0c3135087a1122d3e6075223996ab09831768a1a495facb91ca6ad7"
     }
   ]
 }

package/npm/native/linux-x64/payload.json

@@ -1,20 +1,20 @@
 {
   "schema_version": 1,
   "product": "external-subagent",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "platform": "linux-x64",
   "files": [
     {
       "name": "external-subagentd",
-      "bytes": 11434656,
+      "bytes": 11488752,
       "mode": "755",
-      "sha256": "28b3bf99d7ea6e24747044620d6a6976849d434637e18372327848fcab3d202f"
+      "sha256": "d960dc25d6f4ac77027f81575b91428bb521c8f75b5b39f30e148b15707f1ebb"
     },
     {
       "name": "external-subagent-mcp",
-      "bytes": 1025400,
+      "bytes": 1025512,
       "mode": "755",
-      "sha256": "115d466e4480db0d0ebd45b2930e87b1510560e9cd4a2896bd8442318a967c19"
+      "sha256": "44717d7bada5ed71066f93348fa26f74391475fa147c816c3574a91b3ad65f22"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "external-subagent",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Manage bounded ZCode, DeepSeek Harness (DSH), Codex, and Google Antigravity (agy) subagent tasks through a local MCP service for any local host (Codex, ZCode, or a custom MCP client)",
   "type": "module",
   "license": "MIT",
@@ -22,7 +22,8 @@
   ],
   "os": [
     "darwin",
-    "linux"
+    "linux",
+    "win32"
   ],
   "cpu": [
     "arm64",

package/plugins/codex/external-subagent/skills/external-subagent/SKILL.md

@@ -31,7 +31,7 @@ existing wire default; zcode and dsh send no effort field or call at all).
 pass it through to the runtime, because the supported set is only known at
 runtime. A malformed or unsupported token is rejected before dispatch, so no
 task is created. Example: spawn with
-`{"subagent": "zcode", "repository": "/absolute/path", "prompt": "...", "effort": "high"}`.
+`{"subagent": "zcode", "model": "provider/model", "repository": "/absolute/path", "prompt": "...", "effort": "high"}`.
 
 The caller is a `host`. Any unregistered local MCP client can act as `custom` and
 call status or spawn without a host record or Codex home. Built-in `host.codex`
@@ -47,8 +47,10 @@ the configuration only on success (a daemon restart is required for `dsh`/`codex
 Actual per-subagent limitations (from the accepted code):
 
 - `zcode` — disabled until explicitly enabled; all four permission modes
-  (build/edit/plan/yolo); an explicit spawn `model` is rejected
-  (`model_selection_unsupported`).
+  (build/edit/plan/yolo); spawn requires an explicit `{provider}/{model}`
+  token from the spawn request or a named profile. A bare token and an
+  omitted model are rejected at admission, and `agents.zcode.default_model`
+  is rejected with `model_selection_unsupported`.
 - `dsh` — disabled until explicitly enabled and configured
   (`runtime_path`/`home`/`profile`/`version`); admits only `build` and strict
   `plan`.

package/schema/external-subagent-public-api.json

@@ -68,7 +68,7 @@
         "repository": { "type": "string", "minLength": 1 },
         "permission_mode": { "$ref": "#/properties/permission_mode", "description": "codex supports build/edit (workspace-write), plan (read-only), and yolo (danger-full-access), always with approvalPolicy=never; agy supports only build (--mode accept-edits) and yolo (--dangerously-skip-permissions)." },
         "prompt": { "type": "string", "minLength": 1 },
-        "model": { "type": "string", "minLength": 1, "description": "Task model. dsh requires provider:model, split at the first colon (the model side may contain further colons; a missing colon or an empty side is rejected before any task). codex uses its own model id; zcode uses provider/model (a bare token keeps its backward-compatible zai/<token> reading). agy uses a bare model slug with no ':' or '/' separator or whitespace; admission validates only that shape and the daemon does not verify catalog membership, so an unknown slug fails loudly at session start when the agy CLI rejects it. Omission falls back to the configured default_model for dsh, zcode and agy, then to the provider-native model; codex requires an explicit model or agents.codex.default_model and never falls back to a provider default." },
+        "model": { "type": "string", "minLength": 1, "description": "Task model. dsh requires provider:model, split at the first colon (the model side may contain further colons; a missing colon or an empty side is rejected before any task). codex uses its own model id; zcode requires an explicit provider/model token from the spawn request or a named profile, and rejects a bare token, an omitted model, and agents.zcode.default_model at admission. agy uses a bare model slug with no ':' or '/' separator or whitespace; admission validates only that shape and the daemon does not verify catalog membership, so an unknown slug fails loudly at session start when the agy CLI rejects it. Omission falls back to the configured default_model for dsh and agy, then to the provider-native model; codex requires an explicit model or agents.codex.default_model; zcode and codex never fall back to a provider default." },
         "effort": { "type": "string", "minLength": 1, "maxLength": 24, "pattern": "^[a-z0-9_]+$", "description": "Reasoning-effort token: 1..24 bytes of [a-z0-9_]. codex admits only low, medium, high or xhigh; agy admits only low, medium, high or max; zcode and dsh pass the bounded token through. Omission keeps the runtime default." },
         "write_manifest": { "type": "array", "items": { "type": "string", "minLength": 1 }, "description": "codex requires an empty or omitted write_manifest; non-empty input returns codex_write_manifest_unsupported before task creation. agy likewise requires an empty or omitted write_manifest; non-empty input returns agy_write_manifest_unsupported before task creation. dsh admits a non-empty manifest in build through the guarded manifest-build composition (workspace-write sandbox, only tool-fs writable, out-of-manifest paths rejected as FS_WRITE_MANIFEST_DENIED), at most 256 entries; an explicit [\".\"] keeps the existing build composition. plan requires an empty manifest for every subagent." }
       },
@@ -104,7 +104,7 @@
     },
     "wait": {
       "type": "object",
-      "description": "Wait up to 290 seconds by default. Returns early only when an actionable pending request exists (permission requests need allow/deny; user-input requests carry the full embedded question and need answer with non-empty content) or the terminal result is available; ordinary progress, message receipts, already-responded and unsupported requests never wake it, and its timeout still returns timed_out=true. When the final result is embedded with complete=true no further result call is needed; a partial page directs you to external_subagent_result with next_offset. A failed terminal result also carries failure_message: usually the daemon's bounded single-line JSON failure detail, but an early fail_claim row may be plain text, so treat it as an opaque bounded string and attempt JSON parsing defensively (null when the task has no persisted detail or the outcome is not a failure). Read failure_message before falling back to daemon logs or sqlite. The pending_requests projection stays capped at 100 records while the wake decision scans the full pending set, and the request that woke the wait is always part of the returned projection so its request_id can be answered directly. activity carries the text tail incrementally: each wait returns only the text appended since the previous wait (an empty tail means nothing new), every byte is delivered by wait at most once, and latest_text_truncated flags the case where undelivered bytes rolled out of the bounded window so this response degraded to the whole window (on the terminal response, bytes repeating the embedded result page verbatim are stripped so they are not shipped twice), a 200-char verified reasoning tail, tool calls started in the last 60 seconds, and telemetry status; activity also exposes last_tool_calls as up to three [tool, arg] string pairs in chronological order across turns (tool up to 64 characters, arg up to 512 UTF-8 bytes), last_activity_age_ms (null before any activity), and model_request_active; additionally in_flight_tool_count counts tracked in-flight tool calls (scheduled or started without a matching result, error or permission resolution; 0 when there is no snapshot or the adapter has no per-call lifecycle tracking, such as codex) and oldest_in_flight_tool_age_ms is the age since the oldest tracked in-flight call first appeared (null when none is tracked); use observe only when these suggest a meaningless loop.",
+      "description": "Wait up to 290 seconds by default. Returns early only when an actionable pending request exists (permission requests need allow/deny; user-input requests carry the full embedded question and need answer with non-empty content) or the terminal result is available; ordinary progress, message receipts, already-responded and unsupported requests never wake it, and its timeout still returns timed_out=true. When the final result is embedded with complete=true no further result call is needed; a partial page directs you to external_subagent_result with next_offset. A failed terminal result also carries failure_message: usually the daemon's bounded single-line JSON failure detail, but an early fail_claim row may be plain text, so treat it as an opaque bounded string and attempt JSON parsing defensively (null when the task has no persisted detail or the outcome is not a failure). Read failure_message before falling back to daemon logs or sqlite. The pending_requests projection stays capped at 100 records while the wake decision scans the full pending set, and the request that woke the wait is always part of the returned projection so its request_id can be answered directly. activity carries the text tail incrementally: each wait returns only the text appended since the previous wait (an empty tail means nothing new), every byte is delivered by wait at most once, and latest_text_truncated flags the case where undelivered bytes rolled out of the bounded window so this response degraded to the whole window (on the terminal response, bytes repeating the embedded result page verbatim are stripped so they are not shipped twice), tool calls started in the last 60 seconds, and telemetry status; activity also exposes last_activity_age_ms (null before any activity) and model_request_active; additionally in_flight_tool_count counts tracked in-flight tool calls (scheduled or started without a matching result, error or permission resolution; 0 when there is no snapshot or the adapter has no per-call lifecycle tracking, such as codex) and oldest_in_flight_tool_age_ms is the age since the oldest tracked in-flight call first appeared (null when none is tracked); use external_subagent_observe only when these liveness signals suggest a meaningless loop or a stuck command, to inspect recent tool-call detail.",
       "required": ["agent_id"],
       "properties": {
         "agent_id": { "type": "integer", "minimum": 10000000, "maximum": 99999999 },
@@ -184,7 +184,7 @@
       "additionalProperties": false,
       "properties": {
         "external_subagent_status": { "input": [], "output": ["mcp_version", "components", "capabilities", "subagents"] },
-        "external_subagent_spawn": { "input": ["profile", "subagent", "repository", "permission_mode", "prompt", "model", "effort", "write_manifest"], "output": ["agent_id", "status", "session_id"], "idempotent": false },
+        "external_subagent_spawn": { "input": ["profile", "subagent", "repository", "permission_mode", "prompt", "model", "effort", "write_manifest"], "output": ["agent_id", "status", "session_id", "instruction"], "idempotent": false },
         "external_subagent_wait": { "input": ["agent_id", "wait_time", "message_id"], "output": ["task", "pending_requests", "result_available", "activity", "result", "instruction", "timed_out", "message_receipt"] },
         "external_subagent_observe": { "input": ["agent_id"], "output": ["tools", "reasoning", "coverage"], "idempotent": true },
         "external_subagent_list": { "input": ["subagent", "repository", "phase", "outcome", "cursor", "limit"], "output": ["tasks", "next_cursor"] },

package/scripts/release/build-native-payload.mjs

@@ -29,11 +29,19 @@ const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '
 // correct tuple everywhere (release: darwin-arm64, linux-x64) and an
 // unsupported host fails before touching the tree.  The debug variant reuses
 // the same tuple under its parallel native-debug directory.
-const platform = nativePlatform();
+//
+// win32-x64 is staged as a controlled test artifact before NATIVE_PLATFORMS
+// is opened for Windows distribution: the tuple is explicit here, never resolved by
+// nativePlatform(), so `npm pack` can build and inspect the Windows payload
+// on a real Windows host without activating distribution.  Windows cargo
+// output carries the `.exe` suffix, and the manifest records the same names.
+const platform = nativePlatform()
+  ?? ((process.platform === 'win32' && process.arch === 'x64') ? 'win32-x64' : null);
 if (platform === null) {
   process.stderr.write(`no native payload for ${process.platform}-${process.arch}\n`);
   process.exit(2);
 }
+const executableSuffix = platform === 'win32-x64' ? '.exe' : '';
 const variantIndex = process.argv.indexOf('--variant');
 const variant = variantIndex === -1 ? '' : (process.argv[variantIndex + 1] ?? '');
 if (variant !== '' && variant !== 'debug') {
@@ -51,9 +59,10 @@ if (cargoProfile !== 'release' && cargoProfile !== 'debug') {
 }
 const nativeDirName = isDebug ? 'native-debug' : 'native';
 const productName = isDebug ? 'external-subagent-debug' : 'external-subagent';
-const binaries = isDebug
+const binaries = (isDebug
   ? [['external-subagentd', 'external-subagent-debugd'], ['external-subagent-mcp', 'external-subagent-debug-mcp']]
-  : [['external-subagentd', 'external-subagentd'], ['external-subagent-mcp', 'external-subagent-mcp']];
+  : [['external-subagentd', 'external-subagentd'], ['external-subagent-mcp', 'external-subagent-mcp']])
+  .map(([source, name]) => [source, `${name}${executableSuffix}`]);
 const platformDir = path.join(packageRoot, 'npm', nativeDirName, platform);
 const manifestPath = path.join(platformDir, 'payload.json');
 const sourceRoots = ['crates', 'profiles'].map((dir) => path.join(packageRoot, dir))
@@ -121,7 +130,7 @@ if (build.status !== 0) {
 fs.mkdirSync(platformDir, { recursive: true });
 const files = [];
 for (const [source, name] of binaries) {
-  const sourcePath = path.join(packageRoot, 'target', cargoProfile, source);
+  const sourcePath = path.join(packageRoot, 'target', cargoProfile, `${source}${executableSuffix}`);
   if (!fs.existsSync(sourcePath)) {
     process.stderr.write(`${cargoProfile} binary missing: ${sourcePath}\n`);
     process.exit(1);
@@ -130,7 +139,15 @@ for (const [source, name] of binaries) {
   fs.copyFileSync(sourcePath, target);
   fs.chmodSync(target, 0o755);
   const bytes = fs.readFileSync(target);
-  files.push({ name, bytes: bytes.length, mode: '755', sha256: sha256(bytes) });
+  // The POSIX mode is part of the darwin/linux manifest contract (and the
+  // install verifier enforces it there).  Windows has no POSIX mode; omit the
+  // field instead of recording a meaningless "755".
+  files.push({
+    name,
+    bytes: bytes.length,
+    ...(executableSuffix === '' ? { mode: '755' } : {}),
+    sha256: sha256(bytes),
+  });
 }
 
 const manifest = { schema_version: 1, product: productName, version, platform };

package/scripts/release/check-native-tarball.mjs

@@ -26,23 +26,32 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { elfArch, machoArch } from '../../cli/install/payload.mjs';
+import { elfArch, machoArch, peArch } from '../../cli/install/payload.mjs';
 import { nativePlatform } from '../../cli/install/layout.mjs';
 
 const stagedOnly = process.argv.includes('--staged');
 const explicit = process.argv[2] && !process.argv[2].startsWith('--') ? process.argv[2] : null;
 const dryRun = process.env.npm_config_dry_run === 'true';
 
-// Every platform the single release tarball ships, and the image identity each
+// A Windows host packs a CONTROLLED win32-x64 artifact, not the
+// multi-platform release bundle: only the Windows payload is required and
+// checked. Windows npm publishing is intentionally not activated yet, so
+// macOS/Linux hosts keep the existing dual-platform publish gate; the merged
+// release tarball is assembled there from the platform artifacts.
+const win32Controlled = process.platform === 'win32' && process.arch === 'x64';
+const hostPlatform = nativePlatform() ?? (win32Controlled ? 'win32-x64' : null);
+// Every platform the packed artifact carries, and the image identity each
 // payload must carry.  Keeping both lists here (rather than a fixed
-// darwin-arm64 path) is what makes the gate dual-platform.
-const RELEASE_PLATFORMS = Object.freeze(['darwin-arm64', 'linux-x64']);
-const BINARIES = Object.freeze(['external-subagentd', 'external-subagent-mcp']);
+// darwin-arm64 path) is what makes the gate multi-platform.
+const RELEASE_PLATFORMS = Object.freeze(win32Controlled ? ['win32-x64'] : ['darwin-arm64', 'linux-x64']);
+const binariesFor = (platform) => (platform === 'win32-x64'
+  ? Object.freeze(['external-subagentd.exe', 'external-subagent-mcp.exe'])
+  : Object.freeze(['external-subagentd', 'external-subagent-mcp']));
 const IMAGE_CHECKS = Object.freeze({
   'darwin-arm64': { describe: 'Mach-O arm64 executable', probe: machoArch, arch: 'arm64' },
   'linux-x64': { describe: 'ELF x86-64 executable', probe: elfArch, arch: 'x64' },
+  'win32-x64': { describe: 'PE32+ x86-64 executable', probe: peArch, arch: 'x64' },
 });
-const hostPlatform = nativePlatform();
 
 function findTarball() {
   if (explicit) return explicit;
@@ -87,15 +96,22 @@ if (!stagedOnly) {
     // rejected here (and by the --staged publish gate) before it can be
     // published.
     for (const platform of RELEASE_PLATFORMS) {
-      for (const name of [...BINARIES, 'payload.json']) required.push(`package/npm/native/${platform}/${name}`);
+      for (const name of [...binariesFor(platform), 'payload.json']) required.push(`package/npm/native/${platform}/${name}`);
     }
 
-    const listing = spawnSync('tar', ['-tzf', tgz], { encoding: 'utf8' });
+    // GNU tar (git-bash on Windows) reads a drive-letter path such as
+    // `C:\...` as a remote host.  A cwd-relative path is unambiguous on every
+    // platform and names the same file the pack just produced.
+    const tarArgument = path.relative(process.cwd(), path.resolve(tgz)) || tgz;
+    const listing = spawnSync('tar', ['-tzf', tarArgument], { encoding: 'utf8' });
     if (listing.status !== 0) {
       process.stderr.write(`cannot list tarball: ${listing.stderr}\n`);
       process.exit(1);
     }
-    const entries = listing.stdout.split('\n').filter(Boolean);
+    // Windows' bundled System32 tar (libarchive bsdtar) lists entries with CRLF
+    // line endings while GNU tar writes LF; accept both so entry matching does
+    // not depend on which tar the host resolves.
+    const entries = listing.stdout.split(/\r?\n/).filter(Boolean);
 
     for (const entry of required) {
       if (!entries.includes(entry)) { process.stderr.write(`missing release entry: ${entry}\n`); failed = true; }
@@ -108,9 +124,9 @@ if (!stagedOnly) {
       if (forbidden.test(entry)) { process.stderr.write(`forbidden release material: ${entry}\n`); failed = true; }
     }
 
-    const packedPackage = JSON.parse(spawnSync('tar', ['-xzf', tgz, '-O', 'package/package.json'], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).stdout);
+    const packedPackage = JSON.parse(spawnSync('tar', ['-xzf', tarArgument, '-O', 'package/package.json'], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).stdout);
     for (const platform of RELEASE_PLATFORMS) {
-      const manifestText = spawnSync('tar', ['-xzf', tgz, '-O', `package/npm/native/${platform}/payload.json`], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).stdout;
+      const manifestText = spawnSync('tar', ['-xzf', tarArgument, '-O', `package/npm/native/${platform}/payload.json`], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }).stdout;
       let manifest;
       try {
         manifest = JSON.parse(manifestText);
@@ -162,7 +178,7 @@ function checkStagedPlatform(platform) {
     failed = true;
   }
   const image = IMAGE_CHECKS[platform];
-  for (const name of BINARIES) {
+  for (const name of binariesFor(platform)) {
     const local = path.join(dir, name);
     let bytes;
     try {
@@ -176,8 +192,12 @@ function checkStagedPlatform(platform) {
       process.stderr.write(`${platform}/${name} is not a ${image.describe}\n`);
       failed = true;
     }
-    const mode = (fs.statSync(local).mode & 0o777).toString(8);
-    if (mode !== '755') { process.stderr.write(`${platform}/${name} has release mode ${mode}, expected 755\n`); failed = true; }
+    // Windows has no POSIX execute bit; the PE image check above is the
+    // executable identity there, exactly as verifyPayload reasons.
+    if (platform !== 'win32-x64') {
+      const mode = (fs.statSync(local).mode & 0o777).toString(8);
+      if (mode !== '755') { process.stderr.write(`${platform}/${name} has release mode ${mode}, expected 755\n`); failed = true; }
+    }
   }
 }
 

package/scripts/release/stage-debug-plugin.mjs

@@ -3,12 +3,13 @@
 // from the release source at plugins/codex/external-subagent: a byte-level copy
 // with the plugin identity renamed (plugin.json name/displayName, the skill
 // directory and its frontmatter name).  The .mcp.json placeholder and the
-// hooks/scripts/lib payloads stay identical — the host bindings rewrite the
+// scripts payload stay identical — the host bindings rewrite the
 // placeholder at staging time, and tool names are the daemon's, not the
 // plugin's.  The generated tree is a build artifact (gitignored) owned by
 // build-native-payload.mjs --variant debug.
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 const DEBUG_PLUGIN_NAME = 'external-subagent-debug';
 const SOURCE_PLUGIN_NAME = 'external-subagent';
@@ -43,13 +44,18 @@ export function stageDebugPlugin(packageRoot) {
   fs.renameSync(path.join(target, 'skills', SOURCE_PLUGIN_NAME), path.join(target, 'skills', DEBUG_PLUGIN_NAME));
   const skillPath = path.join(target, 'skills', DEBUG_PLUGIN_NAME, 'SKILL.md');
   const skill = fs.readFileSync(skillPath, 'utf8');
-  const rewritten = skill.replace(`name: ${SOURCE_PLUGIN_NAME}\n`, `name: ${DEBUG_PLUGIN_NAME}\n`, 1);
+  // Preserve the source file's line endings: a Windows checkout has CRLF and
+  // the debug rename must not normalize the whole document.
+  const rewritten = skill.replace(
+    new RegExp(`name: ${SOURCE_PLUGIN_NAME}(\\r?\\n)`, 'u'),
+    (_, newline) => `name: ${DEBUG_PLUGIN_NAME}${newline}`,
+  );
   fs.writeFileSync(skillPath, rewritten);
   return target;
 }
 
 if (import.meta.url === `file://${process.argv[1]}`) {
-  const packageRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..');
+  const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
   try {
     const target = stageDebugPlugin(packageRoot);
     process.stdout.write(`debug plugin source staged: ${target}\n`);

package/scripts/release/test-installed-tarball.mjs

@@ -39,7 +39,7 @@ try {
   run('npm', ['install', '--global', `--prefix=${prefix}`, '--no-audit', '--no-fund', tgz], { cwd: work, env });
   const cli = path.join(prefix, 'bin', 'external-subagent');
   const packageRoot = path.join(prefix, 'lib', 'node_modules', 'external-subagent');
-  // The packed payload directory is the running host's tuple (S01), so the
+  // The packed payload directory is the running host's tuple, so the
   // smoke checks the platform it is actually installing rather than a fixed
   // darwin-arm64 path.
   const payloadPlatform = nativePlatform() ?? `${process.platform}-${process.arch}`;

package/plugins/codex/external-subagent/hooks/audit-bash-result.mjs

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-
-let raw = '';
-process.stdin.setEncoding('utf8');
-for await (const chunk of process.stdin) raw += chunk;
-
-function boundedText(value, maxBytes = 1_048_576) {
-  if (typeof value !== 'string') return '';
-  const bytes = Buffer.from(value, 'utf8');
-  return bytes.length <= maxBytes ? value : bytes.subarray(0, maxBytes).toString('utf8');
-}
-
-try {
-  const input = JSON.parse(raw);
-  const tool = input?.tool_name ?? input?.toolName ?? '';
-  if (tool !== 'Bash') process.exit(0);
-
-  const toolInput = input?.tool_input ?? input?.input ?? {};
-  const command = String(toolInput?.command ?? '');
-  const cwd = String(input?.cwd ?? '');
-  const response = input?.tool_response ?? input?.toolResponse ?? {};
-  const stdout = boundedText(response?.stdout ?? response?.output ?? '');
-  const stderr = boundedText(response?.stderr ?? input?.error ?? '');
-  const record = {
-    schema: 'zcode-agent-bash-fact/v2',
-    at: new Date().toISOString(),
-    session_id: input?.session_id ?? input?.sessionId ?? null,
-    tool_use_id: input?.tool_use_id ?? input?.toolUseId ?? null,
-    hook_event_name: input?.hook_event_name ?? input?.hookEventName ?? null,
-    cwd_sha256: crypto.createHash('sha256').update(cwd).digest('hex'),
-    command_sha256: crypto.createHash('sha256').update(command).digest('hex'),
-    status_code: Number.isInteger(response?.status_code) ? response.status_code : (Number.isInteger(response?.exitCode) ? response.exitCode : null),
-    duration_ms: Number.isFinite(input?.duration_ms) ? Math.max(0, Math.floor(input.duration_ms))
-      : (Number.isFinite(response?.duration_ms) ? Math.max(0, Math.floor(response.duration_ms)) : null),
-    stdout_sha256: crypto.createHash('sha256').update(stdout).digest('hex'),
-    stderr_sha256: crypto.createHash('sha256').update(stderr).digest('hex'),
-    stdout_bytes_observed: Buffer.byteLength(stdout),
-    stderr_bytes_observed: Buffer.byteLength(stderr),
-    failed: Boolean(input?.error) || input?.hook_event_name === 'PostToolUseFailure' || input?.hookEventName === 'PostToolUseFailure',
-    permission_mode: ['build', 'edit', 'plan', 'yolo'].includes(process.env.ZCODE_PERMISSION_MODE || process.env.ZCODE_AGENT_PERMISSION_MODE)
-      ? (process.env.ZCODE_PERMISSION_MODE || process.env.ZCODE_AGENT_PERMISSION_MODE)
-      : null,
-  };
-
-  const dataRoot = process.env.ZCODE_PLUGIN_DATA;
-  if (!dataRoot) process.exit(0);
-  fs.mkdirSync(dataRoot, { recursive: true, mode: 0o700 });
-  const logPath = path.join(dataRoot, 'readonly-bash-audit.jsonl');
-  fs.appendFileSync(logPath, `${JSON.stringify(record)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'a' });
-} catch (error) {
-  process.stderr.write(`[zcode-agent-bash-audit] ${error instanceof Error ? error.message : String(error)}\n`);
-}