fauxnix-cli 0.11.0 → 0.12.0

package/README.md

@@ -85,6 +85,20 @@ npm install -g .
 
 Requires: Windows with PowerShell 5.1+ (built-in) and Node.js ≥ 18.
 
+PowerShell 7 is an opt-in, CI-tested tier:
+
+```powershell
+$env:FAUXNIX_PS = 'pwsh'
+fauxnix check                 # edition: Core
+```
+
+Set the variable before starting `fauxnix` or its MCP harness; restart the
+harness after changing it. Windows PowerShell 5.1 remains the default. Invalid
+values and a missing selected executable fail loudly rather than falling back.
+The default is pinned below `SystemRoot`; `pwsh.exe` is resolved once from
+absolute `PATH` directories, excluding the current working directory.
+See [PowerShell 7 support](docs/powershell-7.md).
+
 ## Quick start
 
 ```bash
@@ -107,8 +121,14 @@ fauxnix install --claude
 fauxnix mcp
 ```
 
+`translate` only renders a script and does not read command operands. Because
+`sed -f` needs a script file, translate-only mode asks you to use `-e` with
+inline script text; normal command execution continues to support `sed -f`.
+
 Unknown commands (git, node, npm, python, cargo, gh, docker, ...) are **passed through natively**
-with argv-style quoting — no string re-parsing, no quoting bugs.
+with argv-style quoting. Windows `.cmd`/`.bat` shims necessarily pass through `cmd.exe`; fauxnix
+preserves its supported punctuation and fails loudly for `%`, embedded double quotes, NUL, and
+line breaks rather than passing a different argument.
 
 ## Use with your agent harness
 
@@ -154,13 +174,13 @@ TOML config: `~/.kimi-code/mcp.json`
 ```
 
 **Qwen Code** (`~/.qwen/settings.json`)
-```json
-{
-  "mcpServers": {
-    "fauxnix": { "command": "fauxnix", "args": ["mcp"] }
-  }
-}
+```bash
+fauxnix install --qwen
 ```
+The installer preserves the rest of `settings.json` and writes an absolute
+Node + package-entry launcher so Qwen startup does not depend on its working
+directory or `PATH` order. See [the Qwen example](docs/examples/qwen.md) for
+the generated JSON shape.
 
 **Any MCP client** — stdio server: `fauxnix mcp`. The tool name is `bash` (override with
 `FAUXNIX_TOOL_NAME`). Tool description already teaches the model the supported subset, so no
@@ -177,19 +197,19 @@ Windows path.
 development:
 
 - **files**: `ls cp mv rm mkdir rmdir touch mktemp ln readlink realpath basename dirname stat file du df find chmod chown diff`
-- **text filters**: `grep egrep sed awk sort uniq cut tr` — sed/awk scripts are parsed at
-  translate time (unsupported constructs throw named errors, never silently misbehave)
+- **text filters**: `grep egrep sed awk sort uniq cut tr` — sed/awk scripts are parsed while
+  preparing an executable plan (unsupported constructs throw named errors, never silently
+  misbehave); inspect-only `translate` keeps `sed -f` file reads out of that path
 - **text I/O**: `echo printf cat head tail wc tee nl tac md5sum sha1sum sha256sum base64 seq yes xargs`
 
-`cp` / `mv` / `rm` / `touch` / `du` / `ls` / `ll` / `mkdir` / `rmdir` / `mktemp` / `ln` /
-`readlink` / `realpath` / `basename` / `dirname` / `stat` / `file` / `df` / `chmod` / `chown` /
-`diff` / `tee` / `grep` / `head` / `echo` / `printf` / `cat` / `tail` / `wc` / `sort` / `uniq` /
-`cut` / `tr` / `gzip` / `gunzip` / `zcat` / `zip` / `unzip` carry a `CommandSpec`: unknown options fail with a GNU-style
-usage error instead of being ignored (`find` stays unspec'd so predicates like `-name` still
-compile; `sed`/`awk`/`egrep` stay unspec'd; `tar` stays unspec'd because it is fx-native to
-`tar.exe` and unknown GNU flags must reach bsdtar). Implemented GNU holes: `cp -n` / `mv -n` / `touch -c` / `tee --append` / `grep -m` /
-`head --lines` / `du --max-depth`. `fauxnix list --json` and `docs/command-specs.md` dump the
-same metadata.
+The curated **agent-daily 60** carry a `CommandSpec`: unknown options fail with a GNU-style
+usage error instead of being ignored. The generated [`docs/command-specs.md`](docs/command-specs.md)
+is the exact list, coverage count, option table, and exclusion rationale; `fauxnix list --json`
+exposes the same per-command metadata. `find` stays unspec'd so predicates like `-name` still
+compile; `sed`/`awk`/`egrep` keep their command-specific parsers; `tar` remains native to
+`tar.exe` so supported bsdtar options reach the executable. Implemented GNU holes include
+`cp -n` / `mv -n` / `touch -c` / `tee --append` / `grep -m` / `head --lines` /
+`du --max-depth` / `env -u` / `ps -f` / `command -V` / `date --date=@SECONDS`.
 - **shell/system**: `cd pwd export unset env printenv ps kill pkill pgrep sleep which type whoami
   id groups date uname hostname uptime free nproc clear true false test [ [[ : pushd popd dirs sudo
   timeout man history less more source . eval exit alias set shift`
@@ -208,9 +228,9 @@ Exit codes follow bash conventions: 0 ok, 1 fail, 2 usage/serious, 127 command n
 ## How it works
 
 ```
-bash command ──parser──▶ AST ──translator──▶ PowerShell script ──executor──▶ powershell.exe
+bash command ──parser──▶ AST ──translator──▶ PowerShell script ──executor──▶ selected PowerShell
                                                                               │
-agent ◀── GNU-style output, bash-style errors ◀── decoder (UTF-8 → GBK fallback) ◀┘
+agent ◀── GNU-style output, bash-style errors ◀── UTF-8 framed host protocol ◀┘
 ```
 
 - **Deterministic translation, zero LLM calls** at runtime.
@@ -218,9 +238,10 @@ agent ◀── GNU-style output, bash-style errors ◀── decoder (UTF-8 →
   "Fauxnix contract": string-per-line stdout, `[Console]::Error.WriteLine` for bash-style
   stderr, `$script:fx_exit` for exit codes, `$input` for stdin.
 - The executor wraps every script with UTF-8 enforcement (`[Console]::OutputEncoding`,
-  `$OutputEncoding`, `chcp 65001`), decodes output as strict-UTF-8 with a GBK(936) fallback for
-  legacy native tools, strips CLIXML serialization and PowerShell noise from stderr, and rewrites
-  common PowerShell errors (including zh-CN locale messages) into bash phrasing.
+  `$OutputEncoding`, `chcp 65001`), decodes native output at the process boundary (UTF-8 by
+  default or GBK(936) in `ansi` mode), keeps host frames UTF-8, strips CLIXML serialization and
+  PowerShell noise from stderr, and rewrites common PowerShell errors (including zh-CN locale
+  messages) into bash phrasing.
 - Scripts run via `-EncodedCommand` (UTF-16LE) and transparently fall back to a temp `.ps1` file
   when the 32 KB command-line limit would be exceeded.
 
@@ -236,9 +257,11 @@ fauxnix optimizes for the commands agents actually run. Documented deviations:
   an unbounded `yes | head` would hang.
 - `tail -f`, `eval`, `alias`, heredocs,
   `env -i`/`--ignore-environment`,
-  background `&`, and stdout redirects (`>` `>>` `&>` `&>>`) on a non-last
-  pipeline stage (`echo hi >f | cat`) are rejected with actionable error
-  messages instead of misbehaving.
+  background `&`, and output/fd redirects (`>` `>>` `2>` `2>>` `&>` `&>>`
+  `2>&1` `1>&2`) on a non-last pipeline stage (`echo hi >f | cat`) are
+  rejected with operation-specific, actionable error messages instead of
+  misbehaving. Per-stage `<` remains supported; fully routed per-stage output
+  fds are still tracked by #157.
   (`if/then/elif/else/fi`, `for x in ...`, `while`/`until`, `case ... esac` (`;;` only; `;&`/`;;&` fail loud),
   backtick substitution, `command -v`, pipeline `read`,
   dotenv-style `source`, word-level `$((...))` arithmetic expansion, `A=(x y z)` arrays, and
@@ -265,14 +288,15 @@ fauxnix optimizes for the commands agents actually run. Documented deviations:
 
 ## Development
 
-```bash
+```powershell
 npm install
 npm test          # unit + real-PowerShell integration suite (Windows only, auto-skipped elsewhere)
+$env:FAUXNIX_PS = 'pwsh'; npm test   # same suite through PowerShell 7
 npm run build
 npx tsx scratch/run.mjs "any bash command"   # quick live check
 ```
 
-Differential vs Git Bash is opt-in (`FAUXNIX_DIFF_ORACLE=1`; skips if unset or `bash.exe` is missing — Git Bash is not required). See [`test/differential/README.md`](test/differential/README.md). This is grown from the 40-case RFC C-7 scaffold, not the 200-case 1.0 gate. The weekly oracle is opt-in via the scheduled workflow (`.github/workflows/differential.yml`) when Git Bash is on the runner.
+Differential vs Git Bash is opt-in (`FAUXNIX_DIFF_ORACLE=1`; skips if unset or `bash.exe` is missing — Git Bash is not required). See [`test/differential/README.md`](test/differential/README.md). The 253-case corpus enforces the RFC C-7 minimum of 200 cases and a 95% identity gate. The weekly oracle runs from `.github/workflows/differential.yml`; two consecutive green **scheduled** runs are still required release evidence after this gate lands.
 
 Architecture map: `src/parser.ts` (bash subset → AST) · `src/translator.ts` (AST → PowerShell +
 executor wrapper) · `src/executor.ts` (spawn, redirects, session persistence) ·

package/dist/cli.d.ts

@@ -1,3 +1,4 @@
 import './commands/install-all.js';
-export declare const USAGE = "fauxnix \u2014 run Linux-style commands on Windows via PowerShell translation\n\nUsage:\n  fauxnix \"ls -la | head -5\"        translate + execute a bash-style command\n  fauxnix -c \"cmd\"                   same as above\n  fauxnix translate \"cmd\"            show the PowerShell translation only\n  fauxnix mcp                        start the MCP stdio server (for agent harnesses)\n  fauxnix list                       list translated commands\n  fauxnix list --json                same list as machine-readable capability metadata\n  fauxnix list --markdown            CommandSpec tables (same text as docs/command-specs.md)\n  fauxnix check                      verify the local PowerShell environment\n  fauxnix doctor                     check + encoding, harness config, MCP readiness\n  fauxnix install --claude|--codex|--opencode|--kimi|--qwen\n  fauxnix --version\n\nNotes:\n  Unknown commands (git, node, npm, python, cargo, ...) pass through and run natively.";
+export declare const USAGE = "fauxnix \u2014 run Linux-style commands on Windows via PowerShell translation\n\nUsage:\n  fauxnix \"ls -la | head -5\"        translate + execute a bash-style command\n  fauxnix -c \"cmd\"                   same as above\n  fauxnix translate \"cmd\"            show the PowerShell translation only\n  fauxnix mcp                        start the MCP stdio server (for agent harnesses)\n  fauxnix list                       list translated commands\n  fauxnix list --json                same list as machine-readable capability metadata\n  fauxnix list --markdown            CommandSpec tables (same text as docs/command-specs.md)\n  fauxnix check                      verify the local PowerShell environment\n  fauxnix doctor                     check + encoding, harness config, MCP readiness\n  fauxnix install --claude|--codex|--opencode|--kimi|--qwen\n  fauxnix --version\n\nNotes:\n  FAUXNIX_PS=pwsh selects the opt-in PowerShell 7 host (5.1 is the default).\n  Unknown commands (git, node, npm, python, cargo, ...) pass through and run natively.";
 export declare function runCli(argv: string[]): Promise<void>;
+export declare function runCheck(): Promise<boolean>;

package/dist/cli.js

@@ -1,13 +1,14 @@
 import { spawn } from 'node:child_process';
 import { FauxnixSession } from './executor.js';
 import { parseCommand } from './parser.js';
-import { translateCommandList } from './translator.js';
+import { EXECUTE_TRANSLATION, PURE_TRANSLATION, translateCommandList, } from './translator.js';
 import { listCommandsJson, registeredNames, specsMarkdown } from './registry.js';
 import { encodeCommand } from './encoding.js';
 import { startMcpServer } from './mcp.js';
 import { collectDoctorReport } from './doctor.js';
 import { runInstall } from './install.js';
 import { packageVersion } from './version.js';
+import { POWERSHELL_ARGS, powerShellDisplay, powerShellMissingMessage, resolvePowerShell, } from './powershell.js';
 import './commands/install-all.js';
 export const USAGE = `fauxnix — run Linux-style commands on Windows via PowerShell translation
 
@@ -25,6 +26,7 @@ Usage:
   fauxnix --version
 
 Notes:
+  FAUXNIX_PS=pwsh selects the opt-in PowerShell 7 host (5.1 is the default).
   Unknown commands (git, node, npm, python, cargo, ...) pass through and run natively.`;
 export async function runCli(argv) {
     if (argv.length === 0) {
@@ -75,7 +77,7 @@ export async function runCli(argv) {
     if (verb === 'translate') {
         const cmd = rest.join(' ');
         const list = parseCommand(cmd);
-        const plans = translateCommandList(list);
+        const plans = translateCommandList(list, PURE_TRANSLATION);
         console.log(plans.map((p) => p.script).join('\n# ---- next segment ----\n'));
         return;
     }
@@ -85,7 +87,7 @@ export async function runCli(argv) {
         return;
     }
     const list = parseCommand(cmd);
-    const plans = translateCommandList(list);
+    const plans = translateCommandList(list, EXECUTE_TRANSLATION);
     const session = new FauxnixSession();
     const result = await session.run(plans);
     if (result.stdout)
@@ -95,36 +97,74 @@ export async function runCli(argv) {
     await session.dispose();
     process.exit(result.exitCode);
 }
-const PS_ARGS = ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass'];
 async function runDoctor() {
-    await runCheck();
+    const checkOk = await runCheck();
     const report = await collectDoctorReport();
     for (const line of report.lines)
         console.log(line);
-    if (!report.ok)
+    if (!checkOk || !report.ok)
         process.exitCode = 1;
 }
-async function runCheck() {
-    console.log('powershell : powershell.exe (Windows built-in)');
-    const probeCmd = '$PSVersionTable.PSVersion.ToString()';
-    const probe = spawn('powershell.exe', [...PS_ARGS, '-EncodedCommand', encodeCommand(probeCmd)], {
+export async function runCheck() {
+    const selection = resolvePowerShell();
+    console.log('powershell : ' + powerShellDisplay(selection));
+    if (selection.error) {
+        console.error('status     : FAILED');
+        console.error(selection.error);
+        process.exitCode = 1;
+        return false;
+    }
+    const probeCmd = '[Console]::Out.WriteLine($PSVersionTable.PSVersion.ToString()); ' +
+        '[Console]::Out.WriteLine([string]$PSVersionTable.PSEdition)';
+    const probe = spawn(selection.executable, [...POWERSHELL_ARGS, '-EncodedCommand', encodeCommand(probeCmd)], {
         stdio: ['ignore', 'pipe', 'pipe'],
         windowsHide: true,
     });
-    probe.on('error', (e) => {
-        console.error('status     : FAILED to run powershell.exe: ' + e.message);
-        process.exit(1);
-    });
     let out = '';
+    let err = '';
     probe.stdout.on('data', (d) => (out += d.toString('utf8')));
-    const code = await new Promise((resolve) => probe.on('close', (c) => resolve(c ?? 1)));
-    if (code === 0) {
-        console.log('version    : ' + out.trim());
-        console.log('commands   : ' + registeredNames().length + ' translated, others pass through');
-        console.log('status     : OK');
+    probe.stderr.on('data', (d) => (err += d.toString('utf8')));
+    const outcome = await new Promise((resolve) => {
+        let settled = false;
+        const done = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(value);
+        };
+        probe.once('error', (error) => done({ code: 127, error }));
+        probe.once('close', (code) => done({ code: code ?? 1 }));
+    });
+    if (outcome.error) {
+        console.error('status     : FAILED');
+        if (outcome.error.code === 'ENOENT') {
+            console.error(powerShellMissingMessage(selection).trimEnd());
+        }
+        else {
+            console.error(`fauxnix: failed to start ${selection.executable}: ${outcome.error.message}`);
+        }
+        process.exitCode = 1;
+        return false;
+    }
+    if (outcome.code !== 0) {
+        console.error(`status     : FAILED to run ${selection.executable}`);
+        if (err.trim())
+            console.error(err.trim());
+        process.exitCode = 1;
+        return false;
     }
-    else {
-        console.error('status     : FAILED to run powershell.exe');
+    const lines = out.trim().split(/\r?\n/);
+    const version = lines[0] ?? '';
+    const edition = lines[1] ?? '';
+    console.log('version    : ' + version);
+    console.log('edition    : ' + edition);
+    if (edition !== selection.expectedEdition) {
+        console.error(`status     : FAILED: ${selection.executable} reported ${edition || 'no edition'}; ` +
+            `expected ${selection.expectedEdition}`);
         process.exitCode = 1;
+        return false;
     }
+    console.log('commands   : ' + registeredNames().length + ' translated, others pass through');
+    console.log('status     : OK');
+    return true;
 }

package/dist/commands/archive.js

@@ -28,19 +28,89 @@ const PS_GZ_FNS = [
     '  $fx_gz.Close()',
     '  return ,$fx_ms.ToArray()',
     '}',
-    'function fx-gz-dbytes($src) {',
-    '  $fx_fs = [IO.File]::OpenRead($src)',
-    '  $fx_gz = New-Object System.IO.Compression.GZipStream($fx_fs, [System.IO.Compression.CompressionMode]::Decompress)',
-    '  $fx_ms = New-Object System.IO.MemoryStream',
+    'function fx-gz-open($src, $isBytes) {',
+    '  if ($isBytes) { $fx_raw = New-Object System.IO.MemoryStream(,$src) }',
+    '  else { $fx_raw = [IO.File]::OpenRead($src) }',
+    '  try {',
+    '    return (New-Object System.IO.Compression.GZipStream($fx_raw, [System.IO.Compression.CompressionMode]::Decompress))',
+    '  } catch {',
+    '    $fx_raw.Dispose()',
+    '    throw',
+    '  }',
+    '}',
+    // Drain the complete stream before producing stdout. Besides keeping -t
+    // bounded, this preserves the old all-or-nothing behavior for malformed
+    // inputs while remembering which text decoder the second pass should use.
+    'function fx-gz-validate($src, $isBytes) {',
+    '  $fx_gz = fx-gz-open $src $isBytes',
     '  $fx_buf = New-Object byte[] 65536',
-    '  while ($true) {',
-    '    $fx_n = $fx_gz.Read($fx_buf, 0, $fx_buf.Length)',
-    '    if ($fx_n -le 0) { break }',
-    '    $fx_ms.Write($fx_buf, 0, $fx_n)',
+    '  $fx_dec = (New-Object System.Text.UTF8Encoding($false, $true)).GetDecoder()',
+    '  $fx_utf8 = $true',
+    '  try {',
+    '    while ($true) {',
+    '      $fx_n = $fx_gz.Read($fx_buf, 0, $fx_buf.Length)',
+    '      if ($fx_n -le 0) { break }',
+    '      if ($fx_utf8) {',
+    '        try { [void]$fx_dec.GetCharCount($fx_buf, 0, $fx_n, $false) }',
+    '        catch [System.Text.DecoderFallbackException] { $fx_utf8 = $false }',
+    '      }',
+    '    }',
+    '    if ($fx_utf8) {',
+    '      try { [void]$fx_dec.GetCharCount($fx_buf, 0, 0, $true) }',
+    '      catch [System.Text.DecoderFallbackException] { $fx_utf8 = $false }',
+    '    }',
+    '    return $fx_utf8',
+    '  } finally {',
+    '    $fx_gz.Dispose()',
+    '  }',
+    '}',
+    'function fx-gz-stream-text($src, $isBytes) {',
+    '  $fx_utf8 = fx-gz-validate $src $isBytes',
+    '  if ($fx_utf8) { $fx_enc = New-Object System.Text.UTF8Encoding($false, $true) }',
+    '  else { try { $fx_enc = [System.Text.Encoding]::GetEncoding(936) } catch { $fx_enc = [System.Text.Encoding]::ASCII } }',
+    '  $fx_gz = fx-gz-open $src $isBytes',
+    '  $fx_sr = New-Object System.IO.StreamReader($fx_gz, $fx_enc, $false, 65536)',
+    '  try {',
+    '    while ($true) {',
+    '      $fx_line = $fx_sr.ReadLine()',
+    '      if ($null -eq $fx_line) { break }',
+    '      Write-Output -NoEnumerate $fx_line',
+    '    }',
+    '  } finally {',
+    '    $fx_sr.Dispose()',
+    '  }',
+    '}',
+    // File output is streamed into a sibling temporary file. The destination
+    // changes only after a complete decompression, and the temporary is removed
+    // on every failed path.
+    'function fx-gz-stream-file($src, $dst) {',
+    '  $fx_full = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($dst)',
+    '  $fx_parent = [IO.Path]::GetDirectoryName($fx_full)',
+    "  $fx_tmp = [IO.Path]::Combine($fx_parent, '.fauxnix-gzip-' + [Guid]::NewGuid().ToString('N') + '.tmp')",
+    '  $fx_gz = $null',
+    '  $fx_os = $null',
+    '  try {',
+    '    $fx_gz = fx-gz-open $src $false',
+    "    $fx_os = New-Object System.IO.FileStream($fx_tmp, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)",
+    '    $fx_buf = New-Object byte[] 65536',
+    '    while ($true) {',
+    '      $fx_n = $fx_gz.Read($fx_buf, 0, $fx_buf.Length)',
+    '      if ($fx_n -le 0) { break }',
+    '      $fx_os.Write($fx_buf, 0, $fx_n)',
+    '    }',
+    '    $fx_os.Dispose(); $fx_os = $null',
+    '    $fx_gz.Dispose(); $fx_gz = $null',
+    '    if ([IO.File]::Exists($fx_full)) {',
+    '      $fx_null = [System.Management.Automation.Language.NullString]::Value',
+    '      [IO.File]::Replace($fx_tmp, $fx_full, $fx_null)',
+    '    }',
+    '    else { [IO.File]::Move($fx_tmp, $fx_full) }',
+    '  } catch {',
+    '    if ($null -ne $fx_os) { $fx_os.Dispose() }',
+    '    if ($null -ne $fx_gz) { $fx_gz.Dispose() }',
+    '    if ([IO.File]::Exists($fx_tmp)) { [IO.File]::Delete($fx_tmp) }',
+    '    throw',
     '  }',
-    '  $fx_gz.Close()',
-    '  $fx_fs.Close()',
-    '  return ,$fx_ms.ToArray()',
     '}',
 ].join('\n');
 /** Parse GNU gzip-style argv (works for gzip/gunzip/zcat). */
@@ -121,7 +191,7 @@ function gzBlock(args, ctx, forced) {
                 : "  [Console]::Error.WriteLine('gzip: compressed data not written to a terminal. Use -f to force compression.')",
             '  $script:fx_exit = 1',
         ].join('\n')
-        : p.decompress
+        : p.decompress || p.test
             ? [
                 // NOTE stdin fidelity limitation: pipeline stdin arrives as decoded
                 // text lines, so only gzip streams that survived the text pipeline
@@ -130,13 +200,7 @@ function gzBlock(args, ctx, forced) {
                 "  if ($fx_txt -ne '') { $fx_txt = $fx_txt + \"`n\" }",
                 '  $fx_in = [System.Text.Encoding]::UTF8.GetBytes($fx_txt)',
                 '  try {',
-                '    $fx_ms = New-Object System.IO.MemoryStream(,$fx_in)',
-                '    $fx_gz = New-Object System.IO.Compression.GZipStream($fx_ms, [System.IO.Compression.CompressionMode]::Decompress)',
-                '    $fx_mo = New-Object System.IO.MemoryStream',
-                '    $fx_buf = New-Object byte[] 65536',
-                '    while ($true) { $fx_n = $fx_gz.Read($fx_buf, 0, $fx_buf.Length); if ($fx_n -le 0) { break }; $fx_mo.Write($fx_buf, 0, $fx_n) }',
-                '    $fx_gz.Close()',
-                '    fx-lines (fx-dec $fx_mo.ToArray())',
+                p.test ? '    [void](fx-gz-validate $fx_in $true)' : '    fx-gz-stream-text $fx_in $true',
                 '  } catch {',
                 "    [Console]::Error.WriteLine('gzip: stdin: not in gzip format')",
                 '    $script:fx_exit = 1',
@@ -163,14 +227,13 @@ function gzBlock(args, ctx, forced) {
         '    }',
     ];
     if (p.test) {
-        fileLoop.push('    try { $fx_tb = fx-gz-dbytes $fx_f }', "    catch { [Console]::Error.WriteLine('gzip: ' + $fx_f + ': not in gzip format'); $script:fx_exit = 1 }", '    continue');
+        fileLoop.push('    try { [void](fx-gz-validate $fx_f $false) }', "    catch { [Console]::Error.WriteLine('gzip: ' + $fx_f + ': not in gzip format'); $script:fx_exit = 1 }", '    continue');
     }
     else if (p.decompress) {
         fileLoop.push('    $fx_low = $fx_f.ToLower()', "    if (-not ($fx_low.EndsWith('.gz') -or $fx_low.EndsWith('.tgz'))) {", "      [Console]::Error.WriteLine('gzip: ' + $fx_f + ': unknown suffix -- ignored')", '      $script:fx_exit = 2', '      continue', '    }', '    $fx_out = $fx_f.Substring(0, $fx_f.Length - 3)', "    if ($fx_low.EndsWith('.tgz')) { $fx_out = $fx_f.Substring(0, $fx_f.Length - 4) + '.tar' }", '    try {', p.stdout
-            ? '      fx-lines (fx-dec (fx-gz-dbytes $fx_f))'
+            ? '      fx-gz-stream-text $fx_f $false'
             : [
-                '      $fx_o = fx-gz-dbytes $fx_f',
-                '      [IO.File]::WriteAllBytes($fx_out, $fx_o)',
+                '      fx-gz-stream-file $fx_f $fx_out',
                 '      try { (Get-Item -LiteralPath $fx_out).LastWriteTime = (Get-Item -LiteralPath $fx_f).LastWriteTime } catch {}',
                 '      if (-not ' + b(p.keep) + ') { Remove-Item -LiteralPath $fx_f -Force }',
             ].join('\n'), "    } catch { [Console]::Error.WriteLine('gzip: ' + $fx_f + ': not in gzip format'); $script:fx_exit = 1 }");
@@ -278,7 +341,7 @@ const zip = (args) => {
         "    $fx_dst = $fx_arc",
         '    $fx_rename = $false',
         "    if (-not $fx_arc.ToLower().EndsWith('.zip')) { $fx_dst = $fx_arc + '.zip'; $fx_rename = $true }",
-        '    Compress-Archive -Path $fx_valid -DestinationPath $fx_dst -Force -ErrorAction Stop',
+        '    Compress-Archive -LiteralPath $fx_valid -DestinationPath $fx_dst -Force -ErrorAction Stop',
         // PS 5.1 Compress-Archive writes `\` entry separators; rewrite them to `/`
         // so GNU unzip/bsdtar see proper directory entries.
         '    Add-Type -AssemblyName System.IO.Compression.FileSystem',

package/dist/commands/install-all.js

@@ -2,7 +2,7 @@ import { registerAll, registerSpecs } from '../registry.js';
 import { handlers as files, specs as fileSpecs } from './files.js';
 import { handlers as textFilters, specs as textFilterSpecs } from './text-filters.js';
 import { handlers as textIo, specs as textIoSpecs } from './text-io.js';
-import { handlers as sysinfo } from './sysinfo.js';
+import { handlers as sysinfo, specs as sysinfoSpecs } from './sysinfo.js';
 import { handlers as net } from './net.js';
 import { handlers as archive, specs as archiveSpecs } from './archive.js';
 /** Register every built-in Linux command translator. Side-effectful import. */
@@ -17,5 +17,6 @@ export function installAll() {
     registerSpecs(textIoSpecs);
     registerSpecs(textFilterSpecs);
     registerSpecs(archiveSpecs);
+    registerSpecs(sysinfoSpecs);
 }
 installAll();

package/dist/commands/net.d.ts

@@ -1,2 +1,11 @@
 import { Handler } from '../registry.js';
+/**
+ * GNU wget-style default output basename for the curl fallback.
+ *
+ * A valid UTF-8 percent sequence is decoded exactly once. Malformed sequences
+ * remain literal, while characters Windows cannot put in a filename are
+ * percent-encoded again. This keeps encoded separators inside one basename
+ * instead of accidentally turning them into local path components.
+ */
+export declare function urlFileName(u: string): string;
 export declare const handlers: Record<string, Handler>;

package/dist/commands/net.js

@@ -105,21 +105,57 @@ const curl = (args) => {
 /* ------------------------------------------------------------------ */
 /* wget                                                                */
 /* ------------------------------------------------------------------ */
-/** GNU wget default output filename derived from a literal URL (index.html when bare). */
-function urlFileName(u) {
-    // keep only the path component (drop scheme, host, query, fragment)
-    let p = u.split('#')[0].split('?')[0];
-    const sm = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.exec(p);
-    if (sm)
-        p = p.slice(sm[0].length);
-    const slash = p.indexOf('/');
-    if (slash >= 0)
-        p = p.slice(slash + 1);
-    else
-        p = '';
-    if (p === '')
-        return 'index.html'; // no path (or trailing /) → GNU default
-    return p;
+const WINDOWS_DEVICE_NAME = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
+function percentEncodeChar(char) {
+    return Array.from(Buffer.from(char, 'utf8'), (byte) => '%' + byte.toString(16).toUpperCase()).join('');
+}
+/**
+ * GNU wget-style default output basename for the curl fallback.
+ *
+ * A valid UTF-8 percent sequence is decoded exactly once. Malformed sequences
+ * remain literal, while characters Windows cannot put in a filename are
+ * percent-encoded again. This keeps encoded separators inside one basename
+ * instead of accidentally turning them into local path components.
+ */
+export function urlFileName(u) {
+    let pathname;
+    try {
+        pathname = new URL(u).pathname;
+    }
+    catch {
+        return 'index.html';
+    }
+    // URL normalisation handles dot segments. A bare path or trailing slash uses
+    // wget's conventional index filename.
+    if (pathname === '' || pathname.endsWith('/'))
+        return 'index.html';
+    const rawName = pathname.slice(pathname.lastIndexOf('/') + 1);
+    let decoded = rawName;
+    try {
+        decoded = decodeURIComponent(rawName);
+    }
+    catch {
+        // Keep malformed percent escapes literal so naming remains deterministic.
+    }
+    let safe = '';
+    for (const char of decoded) {
+        const code = char.codePointAt(0) ?? 0;
+        if (code <= 0x1f || code === 0x7f || /[<>:"/\\|?*]/.test(char)) {
+            safe += percentEncodeChar(char);
+        }
+        else {
+            safe += char;
+        }
+    }
+    // Windows strips trailing dots/spaces and treats DOS device basenames as
+    // special even when an extension is present. Preserve the intended text in
+    // a stable, ordinary filename instead.
+    safe = safe.replace(/[. ]+$/, (suffix) => Array.from(suffix, (char) => percentEncodeChar(char)).join(''));
+    if (safe === '' || safe === '.' || safe === '..')
+        return 'index.html';
+    if (WINDOWS_DEVICE_NAME.test(safe))
+        safe = '_' + safe;
+    return safe;
 }
 /** Map GNU wget argv → curl.exe argv (only literal words are rewritten). */
 function mapWgetArgs(args) {

package/dist/commands/sysinfo.d.ts

@@ -1,2 +1,3 @@
-import { Handler } from '../registry.js';
+import { CommandSpec, Handler } from '../registry.js';
+export declare const specs: CommandSpec[];
 export declare const handlers: Record<string, Handler>;