muonroi-cli 1.3.4 → 1.4.1

package/dist/src/tools/bash-output-cache.test.js

@@ -0,0 +1,89 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { clearBashOutputCache, getBashRun, listBashRunIds, nextBashRunId, recordBashRun, sliceBashOutput, stripAnsi, } from "./bash-output-cache.js";
+beforeEach(() => clearBashOutputCache());
+describe("stripAnsi", () => {
+    it("removes CSI color sequences", () => {
+        expect(stripAnsi("red text")).toBe("red text");
+    });
+    it("removes vitest's clear-line + cursor-move sequences", () => {
+        expect(stripAnsi(" PASS test.ts")).toBe(" PASS test.ts");
+    });
+    it("returns input unchanged when no ANSI codes present", () => {
+        expect(stripAnsi("plain text")).toBe("plain text");
+    });
+});
+describe("recordBashRun / getBashRun", () => {
+    it("round-trips a record", () => {
+        const id = nextBashRunId();
+        recordBashRun({ id, command: "ls", stdout: "a\nb", stderr: "", exitCode: 0, durationMs: 12 });
+        const r = getBashRun(id);
+        expect(r?.command).toBe("ls");
+        expect(r?.stdout).toBe("a\nb");
+    });
+    it("returns null for unknown id", () => {
+        expect(getBashRun("bash-9999")).toBeNull();
+    });
+    it("LRU evicts oldest entry past 50", () => {
+        for (let i = 0; i < 60; i++) {
+            recordBashRun({ id: `bash-${i}`, command: "c", stdout: "x", stderr: "", exitCode: 0, durationMs: 1 });
+        }
+        expect(listBashRunIds().length).toBe(50);
+        expect(getBashRun("bash-0")).toBeNull();
+        expect(getBashRun("bash-59")).not.toBeNull();
+    });
+    it("getBashRun touches LRU (most recently used)", () => {
+        for (let i = 0; i < 50; i++) {
+            recordBashRun({ id: `bash-${i}`, command: "c", stdout: "x", stderr: "", exitCode: 0, durationMs: 1 });
+        }
+        // Touch bash-0 to make it freshest.
+        getBashRun("bash-0");
+        recordBashRun({ id: "bash-50", command: "c", stdout: "x", stderr: "", exitCode: 0, durationMs: 1 });
+        // bash-1 (the next-oldest after bash-0 was touched) should be evicted.
+        expect(getBashRun("bash-0")).not.toBeNull();
+        expect(getBashRun("bash-1")).toBeNull();
+    });
+});
+describe("sliceBashOutput", () => {
+    const record = {
+        id: "bash-x",
+        command: "vitest",
+        stdout: ["FAIL test/a.spec.ts", "PASS test/b.spec.ts", "ERROR something", "PASS test/c.spec.ts", "Done"].join("\n"),
+        stderr: "",
+        exitCode: 1,
+        durationMs: 100,
+        completedAt: new Date().toISOString(),
+    };
+    it("head returns first N lines", () => {
+        expect(sliceBashOutput(record, { mode: "head", lines: 2 }).text).toBe("FAIL test/a.spec.ts\nPASS test/b.spec.ts");
+    });
+    it("tail returns last N lines", () => {
+        expect(sliceBashOutput(record, { mode: "tail", lines: 2 }).text).toBe("PASS test/c.spec.ts\nDone");
+    });
+    it("grep filters by regex", () => {
+        const r = sliceBashOutput(record, { mode: "grep", pattern: "FAIL|ERROR" });
+        expect(r.text).toBe("FAIL test/a.spec.ts\nERROR something");
+        expect(r.matchedLines).toBe(2);
+    });
+    it("grep respects caseInsensitive", () => {
+        const r = sliceBashOutput(record, { mode: "grep", pattern: "fail", caseInsensitive: true });
+        expect(r.matchedLines).toBe(1);
+    });
+    it("lines extracts a range", () => {
+        expect(sliceBashOutput(record, { mode: "lines", range: "2-4" }).text).toBe("PASS test/b.spec.ts\nERROR something\nPASS test/c.spec.ts");
+    });
+    it("rejects malformed range", () => {
+        const r = sliceBashOutput(record, { mode: "lines", range: "garbage" });
+        expect(r.ok).toBe(false);
+    });
+    it("rejects invalid regex without throwing", () => {
+        const r = sliceBashOutput(record, { mode: "grep", pattern: "[" });
+        expect(r.ok).toBe(false);
+        expect(r.text).toMatch(/Invalid regex/);
+    });
+    it("merges stderr into output for slicing", () => {
+        const withErr = { ...record, stderr: "stderr line" };
+        const r = sliceBashOutput(withErr, { mode: "full" });
+        expect(r.text).toContain("[stderr]\nstderr line");
+    });
+});
+//# sourceMappingURL=bash-output-cache.test.js.map

package/dist/src/tools/bash-output-integration.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Integration test for Fix #2 — BashTool.execute() must populate
+ * bashRunId/bashTotalChars and the bash-output-cache so bash_output_get can
+ * read the captured output back.
+ *
+ * Kept deliberately minimal: ANSI stripping, slicing, and exit-code handling
+ * are covered by unit tests in bash-output-cache.test.ts. Here we only verify
+ * the wireup between BashTool.execute() and the cache module.
+ */
+export {};

package/dist/src/tools/bash-output-integration.test.js

@@ -0,0 +1,30 @@
+/**
+ * Integration test for Fix #2 — BashTool.execute() must populate
+ * bashRunId/bashTotalChars and the bash-output-cache so bash_output_get can
+ * read the captured output back.
+ *
+ * Kept deliberately minimal: ANSI stripping, slicing, and exit-code handling
+ * are covered by unit tests in bash-output-cache.test.ts. Here we only verify
+ * the wireup between BashTool.execute() and the cache module.
+ */
+import os from "node:os";
+import { beforeEach, describe, expect, it } from "vitest";
+import { BashTool } from "./bash.js";
+import { clearBashOutputCache, getBashRun } from "./bash-output-cache.js";
+describe("BashTool + bash-output-cache integration", () => {
+    beforeEach(() => clearBashOutputCache());
+    it("populates bashRunId / bashTotalChars and caches stdout for a successful echo", async () => {
+        const bash = new BashTool(os.tmpdir());
+        const marker = "muonroi-fix2-marker";
+        // `echo MARKER` is portable across cmd.exe, bash, pwsh, and wsl bash.
+        const result = await bash.execute(`echo ${marker}`, 15_000);
+        expect(result.success).toBe(true);
+        expect(result.bashRunId).toMatch(/^bash-\d+$/);
+        expect(result.bashTotalChars ?? 0).toBeGreaterThan(0);
+        const cached = getBashRun(result.bashRunId);
+        expect(cached?.command).toBe(`echo ${marker}`);
+        expect(cached?.stdout).toContain(marker);
+        expect(cached?.exitCode).toBe(0);
+    }, 20_000);
+});
+//# sourceMappingURL=bash-output-integration.test.js.map

package/dist/src/tools/bash.d.ts

@@ -26,6 +26,7 @@ export declare class BashTool {
     private sandboxSettings;
     private shellSettings;
     private resolvedShell;
+    private sandboxUnsupportedWarned;
     constructor(initialCwd?: string, options?: BashToolOptions);
     private ensureTmpDir;
     execute(command: string, timeout?: number, abortSignal?: AbortSignal): Promise<ToolResult>;
@@ -38,6 +39,17 @@ export declare class BashTool {
     setCwd(next: string): void;
     getSandboxMode(): SandboxMode;
     setSandboxMode(mode: SandboxMode): void;
+    /**
+     * The sandbox mode that actually takes effect. When "shuru" is configured but
+     * the current platform cannot run Shuru (non-macOS/arm64), the sandbox is
+     * inert: every wrapped command would fail with the macOS-only error, and the
+     * tool description would still advertise a `/workspace` mount that does not
+     * exist — so the model `cd`s into a phantom dir and abandons verification.
+     * Degrade to "off" (host execution) with a one-time warning so bash keeps
+     * working and the description reflects reality. A stale checked-in project
+     * `sandboxMode: "shuru"` therefore no longer bricks the shell off-platform.
+     */
+    private effectiveSandboxMode;
     getSandboxSettings(): SandboxSettings;
     setSandboxSettings(settings: SandboxSettings): void;
     getToolDescription(): string;

package/dist/src/tools/bash.js

@@ -4,7 +4,9 @@ import { mkdtemp, rm, stat, unlink } from "fs/promises";
 import os from "os";
 import path from "path";
 import { executeEventHooks } from "../hooks/index.js";
+import { appendAudit } from "../utils/permission-mode.js";
 import { posixToNative, resolveShell } from "../utils/shell.js";
+import { nextBashRunId, recordBashRun, stripAnsi } from "./bash-output-cache.js";
 const MAX_TAIL_BYTES = 8_192;
 const MAX_BACKGROUND_PROCESSES = 8;
 let nextBgId = 1;
@@ -16,6 +18,7 @@ export class BashTool {
     sandboxSettings;
     shellSettings;
     resolvedShell;
+    sandboxUnsupportedWarned = false;
     constructor(initialCwd = process.cwd(), options = {}) {
         this.cwd = initialCwd;
         this.sandboxMode = options.sandboxMode ?? "off";
@@ -32,14 +35,36 @@ export class BashTool {
     async execute(command, timeout = 30_000, abortSignal) {
         try {
             if (command.startsWith("cd ")) {
-                const dir = command
+                // Parse "cd <dir>" with optional "&&|||;" chained remainder.
+                // Without this split, `cd D:\foo && gh run list` was passed wholesale
+                // to stat() → ENOENT → agents retried with different shell syntaxes
+                // and burned hundreds of tool calls (session 127140a47b56: 248 bash
+                // calls all hit this bug).
+                // Path token = quoted string or bare word stopping at first unquoted
+                // shell separator. The regex deliberately excludes `&|;<>` from the
+                // bare-word class so chained commands split correctly.
+                // Strip cmd.exe-style DOS flags (e.g. `cd /d D:\path` — `/d` enables
+                // drive-change, irrelevant in our cwd tracker). Without this, agents
+                // using `cd /d <path>` (session 7dcf8fd7d6a4 caller still does this
+                // habitually) parse as dir="/d" → resolve fails. Drop the flag and
+                // continue parsing.
+                const afterCd = command
                     .substring(3)
                     .trim()
+                    .replace(/^\/[a-zA-Z](?=\s)/, "")
+                    .trim();
+                const parsed = afterCd.match(/^("[^"]+"|'[^']+'|[^\s&|;<>]+)(?:\s*(&&|\|\||;)\s*([\s\S]+))?$/);
+                const rawDir = parsed?.[1] ?? afterCd;
+                const chainOp = parsed?.[2];
+                const remainder = parsed?.[3]?.trim() || null;
+                const dir = rawDir
                     .replace(/^["']|["']$/g, "")
                     // Strip a trailing backslash that was an escaped quote in the shell
                     // parse (e.g. cd "C:\foo\" && cmd → C:\foo). Only strip on Windows
                     // because on POSIX a trailing backslash is a valid path continuation.
                     .replace(process.platform === "win32" ? /\\$/ : /(?!x)x/, "");
+                let cdSucceeded = false;
+                let cdError = null;
                 try {
                     // Translate POSIX-style absolute paths (e.g. /d/sources/x, ~/foo)
                     // when the active shell understands them, so cwd tracking matches
@@ -48,23 +73,38 @@ export class BashTool {
                     const nextCwd = path.resolve(this.cwd, translated);
                     const info = await stat(nextCwd);
                     if (!info.isDirectory()) {
-                        return { success: false, error: `Cannot change directory: ${nextCwd} is not a directory` };
+                        cdError = { success: false, error: `Cannot change directory: ${nextCwd} is not a directory` };
+                    }
+                    else {
+                        const oldCwd = this.cwd;
+                        this.cwd = nextCwd;
+                        cdSucceeded = true;
+                        const cwdInput = {
+                            hook_event_name: "CwdChanged",
+                            old_cwd: oldCwd,
+                            new_cwd: nextCwd,
+                            cwd: nextCwd,
+                        };
+                        executeEventHooks(cwdInput, nextCwd).catch(() => { });
                     }
-                    const oldCwd = this.cwd;
-                    this.cwd = nextCwd;
-                    const cwdInput = {
-                        hook_event_name: "CwdChanged",
-                        old_cwd: oldCwd,
-                        new_cwd: nextCwd,
-                        cwd: nextCwd,
-                    };
-                    executeEventHooks(cwdInput, nextCwd).catch(() => { });
-                    return { success: true, output: `Changed directory to: ${this.cwd}` };
                 }
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
-                    return { success: false, error: `Cannot change directory: ${msg}` };
+                    cdError = { success: false, error: `Cannot change directory: ${msg}` };
+                }
+                // No chained command — return the cd outcome as before.
+                if (!remainder) {
+                    return cdSucceeded ? { success: true, output: `Changed directory to: ${this.cwd}` } : cdError;
+                }
+                // Chained command — respect shell semantics:
+                //   `&&` runs remainder only if cd succeeded
+                //   `||` runs remainder only if cd failed
+                //   `;`  runs remainder unconditionally
+                const shouldRunRemainder = chainOp === ";" || (chainOp === "&&" && cdSucceeded) || (chainOp === "||" && !cdSucceeded);
+                if (!shouldRunRemainder) {
+                    return cdSucceeded ? { success: true, output: `Changed directory to: ${this.cwd}` } : cdError;
                 }
+                return await this.execute(remainder, timeout, abortSignal);
             }
             if (abortSignal?.aborted) {
                 return { success: false, error: "[Cancelled]" };
@@ -73,6 +113,8 @@ export class BashTool {
             if (!prepared.ok) {
                 return { success: false, error: prepared.error };
             }
+            const runId = nextBashRunId();
+            const startedAt = Date.now();
             return await new Promise((resolve) => {
                 let settled = false;
                 let aborted = false;
@@ -95,28 +137,50 @@ export class BashTool {
                     // (`2>&1 &`, `$()`, single-quotes, `&&` as logical AND, …)
                     // works on Windows instead of falling back to cmd.exe.
                     ...(this.resolvedShell.binary ? { shell: this.resolvedShell.binary } : {}),
-                }, (err, stdout, stderr) => {
+                }, (err, stdoutRaw, stderrRaw) => {
                     if (aborted || abortSignal?.aborted) {
                         finish({ success: false, error: "[Cancelled]" });
                         return;
                     }
+                    // ANSI strip — FORCE_COLOR=0 covers cooperating children, but
+                    // vitest / bun emit cursor-control sequences regardless, so we
+                    // strip post-process before the output ever leaves this module.
+                    const stdout = stripAnsi(stdoutRaw);
+                    const stderr = stripAnsi(stderrRaw);
+                    const exitCode = err && typeof err.code === "number" ? err.code : err ? 1 : 0;
+                    recordBashRun({
+                        id: runId,
+                        command,
+                        stdout,
+                        stderr,
+                        exitCode,
+                        durationMs: Date.now() - startedAt,
+                    });
+                    const totalChars = stdout.length + stderr.length;
                     const output = stdout + (stderr ? `\nSTDERR: ${stderr}` : "");
                     if (err) {
                         const sandboxError = this.formatSandboxRuntimeError(output, err.message);
                         if (sandboxError) {
-                            finish({ success: false, error: sandboxError });
+                            finish({ success: false, error: sandboxError, bashRunId: runId, bashTotalChars: totalChars });
                             return;
                         }
                         if (output.trim()) {
-                            finish({ success: false, error: output.trim() });
+                            finish({ success: false, error: output.trim(), bashRunId: runId, bashTotalChars: totalChars });
                             return;
                         }
-                        finish({ success: false, error: `Command failed: ${err.message}` });
+                        finish({
+                            success: false,
+                            error: `Command failed: ${err.message}`,
+                            bashRunId: runId,
+                            bashTotalChars: totalChars,
+                        });
                         return;
                     }
                     finish({
                         success: true,
                         output: output.trim() || "Command executed successfully (no output)",
+                        bashRunId: runId,
+                        bashTotalChars: totalChars,
                     });
                 });
                 const onAbort = () => {
@@ -350,6 +414,27 @@ export class BashTool {
     setSandboxMode(mode) {
         this.sandboxMode = mode;
     }
+    /**
+     * The sandbox mode that actually takes effect. When "shuru" is configured but
+     * the current platform cannot run Shuru (non-macOS/arm64), the sandbox is
+     * inert: every wrapped command would fail with the macOS-only error, and the
+     * tool description would still advertise a `/workspace` mount that does not
+     * exist — so the model `cd`s into a phantom dir and abandons verification.
+     * Degrade to "off" (host execution) with a one-time warning so bash keeps
+     * working and the description reflects reality. A stale checked-in project
+     * `sandboxMode: "shuru"` therefore no longer bricks the shell off-platform.
+     */
+    effectiveSandboxMode() {
+        if (this.sandboxMode === "shuru" && getSandboxUnsupportedReason() !== null) {
+            if (!this.sandboxUnsupportedWarned) {
+                this.sandboxUnsupportedWarned = true;
+                console.error(`[bash] sandboxMode "shuru" is configured but ${getSandboxUnsupportedReason()} ` +
+                    'Falling back to host execution for this platform. Set sandboxMode to "off" to silence this.');
+            }
+            return "off";
+        }
+        return this.sandboxMode;
+    }
     getSandboxSettings() {
         return this.sandboxSettings;
     }
@@ -357,7 +442,7 @@ export class BashTool {
         this.sandboxSettings = settings;
     }
     getToolDescription() {
-        if (this.sandboxMode === "shuru") {
+        if (this.effectiveSandboxMode() === "shuru") {
             const s = this.sandboxSettings;
             const netStatus = s.allowNet
                 ? s.allowedHosts?.length
@@ -396,7 +481,7 @@ export class BashTool {
         return { binary: "/bin/sh", args: ["-c", command] };
     }
     prepareCommand(command) {
-        if (this.sandboxMode !== "shuru") {
+        if (this.effectiveSandboxMode() !== "shuru") {
             return { ok: true, command };
         }
         if (shouldRunOnHostInSandboxMode(command, this.sandboxSettings)) {
@@ -410,10 +495,18 @@ export class BashTool {
         if (blockedReason) {
             return { ok: false, error: blockedReason };
         }
-        return { ok: true, command: wrapCommandForShuru(this.cwd, command, this.sandboxSettings) };
+        const wrapped = wrapCommandForShuru(this.cwd, command, this.sandboxSettings);
+        appendAudit({
+            kind: "permission-override",
+            tool: "bash",
+            mode: "safe",
+            context: { command, shuru: true, settings: this.sandboxSettings },
+            ts: Date.now(),
+        });
+        return { ok: true, command: wrapped };
     }
     formatSandboxRuntimeError(output, fallbackMessage) {
-        if (this.sandboxMode !== "shuru") {
+        if (this.effectiveSandboxMode() !== "shuru") {
             return null;
         }
         if (output.includes("shuru: command not found") || output.includes("sh: shuru: not found")) {

package/dist/src/tools/bash.test.js

@@ -11,7 +11,7 @@ function makeTempDir(prefix) {
 }
 afterEach(() => {
     for (const dir of tempDirs.splice(0)) {
-        fs.rmSync(dir, { recursive: true, force: true });
+        fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
     }
 });
 describe("wrapCommandForShuru", () => {
@@ -203,8 +203,32 @@ describe("BashTool sandbox state", () => {
         const off = new BashTool("/repo", { sandboxMode: "off" });
         const on = new BashTool("/repo", { sandboxMode: "shuru" });
         expect(off.getToolDescription()).not.toContain("Shuru");
-        expect(on.getToolDescription()).toContain("Shuru sandbox");
-        expect(on.getToolDescription()).toContain("do not persist back to the host");
+        // Shuru only actually engages on macOS/arm64. Elsewhere the tool degrades
+        // to host execution, so the description must NOT advertise the phantom
+        // /workspace mount that a non-mac platform cannot provide.
+        const shuruSupported = process.platform === "darwin" && process.arch === "arm64";
+        if (shuruSupported) {
+            expect(on.getToolDescription()).toContain("Shuru sandbox");
+            expect(on.getToolDescription()).toContain("do not persist back to the host");
+        }
+        else {
+            expect(on.getToolDescription()).not.toContain("Shuru");
+            expect(on.getToolDescription()).not.toContain("/workspace");
+        }
+    });
+    it("degrades shuru to host execution when the platform cannot run Shuru", async () => {
+        const shuruSupported = process.platform === "darwin" && process.arch === "arm64";
+        if (shuruSupported)
+            return; // on a real Shuru host this path doesn't apply
+        const root = makeTempDir("muonroi-bash-shuru-degrade-");
+        const bash = new BashTool(root, { sandboxMode: "shuru" });
+        // getSandboxMode() still reports the CONFIGURED mode (intent preserved)...
+        expect(bash.getSandboxMode()).toBe("shuru");
+        // ...but a real command runs on the host instead of failing with the
+        // "requires macOS on Apple Silicon" error that previously bricked the shell.
+        const result = await bash.execute("echo sandbox-degrade-ok", 15_000);
+        expect(result.output).toContain("sandbox-degrade-ok");
+        expect(result.output).not.toContain("Apple Silicon");
     });
     it("stores and returns sandbox settings", () => {
         const bash = new BashTool("/repo", {
@@ -247,7 +271,60 @@ describe("BashTool sandbox state", () => {
         expect(result.success).toBe(true);
         expect(bash.getCwd()).toBe(root);
     });
+    it("splits `cd <dir> && <cmd>` and runs <cmd> in the new cwd (session 127140a47b56 regression)", async () => {
+        // Pre-fix: the cd handler consumed the entire substring after `cd ` as a
+        // directory, so `cd D:\foo && gh run list` was stat()-ed as the literal
+        // string `D:\foo && gh run list`. Agents retried with every shell syntax
+        // imaginable (cmd.exe, powershell, /d/sources, escaped backslashes…) and
+        // burned 248 bash calls before being killed. After the fix the chain is
+        // parsed so the cd succeeds and the remainder executes in the new cwd.
+        const root = makeTempDir("muonroi-bash-cdchain-");
+        const bash = new BashTool(os.tmpdir());
+        const echoCmd = process.platform === "win32" ? "echo split-ok" : "echo split-ok";
+        const quoted = process.platform === "win32" ? `"${root}"` : root;
+        const result = await bash.execute(`cd ${quoted} && ${echoCmd}`);
+        expect(result.success).toBe(true);
+        expect(result.output ?? "").toContain("split-ok");
+        expect(bash.getCwd()).toBe(root);
+    });
+    it("respects `&&` short-circuit: failed cd does NOT run the chained command", async () => {
+        const bash = new BashTool(os.tmpdir());
+        const result = await bash.execute(`cd /this/path/does/not/exist && echo should-not-run`);
+        expect(result.success).toBe(false);
+        expect(result.error ?? "").toMatch(/Cannot change directory/);
+        expect(result.output ?? "").not.toContain("should-not-run");
+    });
+    it("respects `||` short-circuit: failed cd DOES run the chained command", async () => {
+        const start = os.tmpdir();
+        const bash = new BashTool(start);
+        const result = await bash.execute(`cd /this/path/does/not/exist || echo fallback-ran`);
+        expect(result.success).toBe(true);
+        expect(result.output ?? "").toContain("fallback-ran");
+        expect(bash.getCwd()).toBe(start); // cwd unchanged after failed cd
+    });
+    it("strips cmd.exe DOS flag `/d` from `cd /d <path> && <cmd>` (session 7dcf8fd7d6a4 regression)", async () => {
+        const root = makeTempDir("muonroi-bash-cddosflag-");
+        const bash = new BashTool(os.tmpdir());
+        const quoted = process.platform === "win32" ? `"${root}"` : root;
+        const result = await bash.execute(`cd /d ${quoted} && echo dos-flag-ok`);
+        expect(result.success).toBe(true);
+        expect(result.output ?? "").toContain("dos-flag-ok");
+        expect(bash.getCwd()).toBe(root);
+    });
+    it("respects `;` separator: runs remainder regardless of cd outcome", async () => {
+        const root = makeTempDir("muonroi-bash-cdsemicolon-");
+        const bash = new BashTool(os.tmpdir());
+        const quoted = process.platform === "win32" ? `"${root}"` : root;
+        const result = await bash.execute(`cd ${quoted} ; echo always-runs`);
+        expect(result.success).toBe(true);
+        expect(result.output ?? "").toContain("always-runs");
+        expect(bash.getCwd()).toBe(root);
+    });
     it("includes network status in tool description when allowNet is set", () => {
+        // Network status only appears in the Shuru description, which engages on
+        // macOS/arm64. Off-platform the tool degrades to host execution.
+        if (process.platform !== "darwin" || process.arch !== "arm64")
+            return;
         const netOn = new BashTool("/repo", {
             sandboxMode: "shuru",
             sandboxSettings: { allowNet: true },

package/dist/src/tools/computer.test.js

@@ -7,7 +7,7 @@ describe("computer tools", () => {
     const tempDirs = [];
     afterEach(() => {
         for (const dir of tempDirs.splice(0)) {
-            fs.rmSync(dir, { recursive: true, force: true });
+            fs.rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
         }
     });
     it("stores screenshots under .muonroi-cli/computer by default", () => {

package/dist/src/tools/file-tracker.test.js

@@ -10,7 +10,7 @@ vi.mock("../lsp/runtime", () => ({
 }));
 const tempDirs = [];
 afterEach(async () => {
-    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 })));
 });
 async function createTempDir() {
     const dir = await mkdtemp(path.join(os.tmpdir(), "muonroi-tracker-"));

package/dist/src/tools/file.js

@@ -100,7 +100,28 @@ export async function editFile(filePath, oldString, newString, cwd, tracker) {
                 return { success: false, output: violation };
             }
         }
-        const count = before.split(oldString).length - 1;
+        // Line-ending tolerant matching. LLMs emit old_string with `\n` line
+        // breaks, but Windows-authored files (common in Angular/.NET repos) are
+        // stored with `\r\n`. An exact substring search then never finds any
+        // multi-line old_string, so every edit beyond a single line fails (live:
+        // storyflow_ui A/B — both models failed 8-9/10 edits on CRLF templates).
+        // First try the verbatim match; if that misses, re-match with both sides
+        // EOL-normalized and rebuild old/new with the FILE's dominant EOL so the
+        // replace lands on `before` and the file's line endings are preserved.
+        let searchString = oldString;
+        let replaceString = newString;
+        let count = before.split(searchString).length - 1;
+        if (count === 0 && (before.includes("\r\n") || /\r\n/.test(oldString))) {
+            const fileEol = before.includes("\r\n") ? "\r\n" : "\n";
+            const toFileEol = (s) => s.replace(/\r\n/g, "\n").replace(/\n/g, fileEol);
+            const normalizedOld = toFileEol(oldString);
+            const normalizedCount = before.split(normalizedOld).length - 1;
+            if (normalizedCount >= 1) {
+                searchString = normalizedOld;
+                replaceString = toFileEol(newString);
+                count = normalizedCount;
+            }
+        }
         if (count === 0) {
             return {
                 success: false,
@@ -113,7 +134,7 @@ export async function editFile(filePath, oldString, newString, cwd, tracker) {
                 output: `old_string is not unique in ${filePath} (${count} occurrences). Include more surrounding context to make it unique.`,
             };
         }
-        const after = before.replace(oldString, newString);
+        const after = before.replace(searchString, replaceString);
         writeFileSync(full, after, "utf-8");
         // Refresh tracker so back-to-back edits keep working.
         tracker?.markRead(full, after, mtimeMsOf(full));

package/dist/src/tools/file.test.js

@@ -28,7 +28,7 @@ const tempDirs = [];
 afterEach(async () => {
     summarizeDiagnosticsMock.mockClear();
     syncFileWithLspMock.mockClear();
-    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+    await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 })));
 });
 describe("file tool LSP integration", () => {
     it("includes diagnostics metadata when writing a file", async () => {
@@ -50,6 +50,54 @@ describe("file tool LSP integration", () => {
         expect(syncFileWithLspMock).toHaveBeenCalledWith(cwd, filePath, "const answer = 42;\n", true, true);
     });
 });
+describe("editFile line-ending normalization", () => {
+    it("matches a multi-line old_string (LF) against a CRLF file and preserves CRLF", async () => {
+        // Live finding (storyflow_ui A/B 2026-06-06): both DeepSeek and Grok failed
+        // 8-9/10 edit_file calls on CRLF-terminated Angular templates. The model
+        // emits old_string with \n line breaks; the on-disk file uses \r\n, so an
+        // exact substring match never finds a multi-line old_string. Only a
+        // single-line edit (no newline) succeeded. The tool must normalize EOLs.
+        const cwd = await createTempDir();
+        const filePath = path.join(cwd, "tpl.html");
+        const crlf = '<div class="a">\r\n  <span></span>\r\n</div>\r\n';
+        await writeFsFile(filePath, crlf, "utf8");
+        // old_string + new_string use \n (what an LLM emits).
+        const oldStr = '<div class="a">\n  <span></span>\n</div>';
+        const newStr = '<div class="a">\n  <span>X</span>\n</div>';
+        const result = await editFile("tpl.html", oldStr, newStr, cwd);
+        const content = await readFile(filePath, "utf8");
+        expect(result.success).toBe(true);
+        expect(content).toContain("<span>X</span>");
+        // CRLF must be preserved on the written lines (no silent LF conversion).
+        expect(content).toContain('<div class="a">\r\n  <span>X</span>\r\n</div>\r\n');
+        expect(content).not.toMatch(/[^\r]\n/); // no bare LF remains
+    });
+    it("still edits a plain LF file with an LF old_string (no regression)", async () => {
+        const cwd = await createTempDir();
+        const filePath = path.join(cwd, "tpl.ts");
+        await writeFsFile(filePath, "const a = 1;\nconst b = 2;\n", "utf8");
+        const result = await editFile("tpl.ts", "const a = 1;\nconst b = 2;", "const a = 1;\nconst b = 3;", cwd);
+        const content = await readFile(filePath, "utf8");
+        expect(result.success).toBe(true);
+        expect(content).toBe("const a = 1;\nconst b = 3;\n");
+    });
+    it("still reports old_string not found when it is genuinely absent (CRLF file)", async () => {
+        const cwd = await createTempDir();
+        const filePath = path.join(cwd, "tpl.html");
+        await writeFsFile(filePath, '<div class="a">\r\n  <span></span>\r\n</div>\r\n', "utf8");
+        const result = await editFile("tpl.html", "<p>\n  nope\n</p>", "<p>yes</p>", cwd);
+        expect(result.success).toBe(false);
+        expect(result.output).toContain("old_string not found");
+    });
+    it("reports non-unique when the EOL-normalized old_string matches multiple times (CRLF file)", async () => {
+        const cwd = await createTempDir();
+        const filePath = path.join(cwd, "tpl.html");
+        await writeFsFile(filePath, "<li>x</li>\r\n<li>x</li>\r\n", "utf8");
+        const result = await editFile("tpl.html", "<li>x</li>", "<li>y</li>", cwd);
+        expect(result.success).toBe(false);
+        expect(result.output).toContain("not unique");
+    });
+});
 async function createTempDir() {
     const dir = await mkdtemp(path.join(os.tmpdir(), "muonroi-file-tools-"));
     tempDirs.push(dir);

package/dist/src/tools/registry-bash-empty-command.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Corrective guard for malformed bash tool calls (missing / empty `command`).
+ *
+ * Live obs (2026-06-04, deepseek long session 734e65cffdf6): on an open-ended
+ * "find a bug" task the cheap model emitted `bash` calls with EMPTY arguments
+ * (`{}`, no `command`) three times in a row until the loop-guard askcard fired.
+ * Root cause: the registry passed `input.command` (undefined) straight to
+ * `bash.execute()`, where `command.startsWith(...)` threw an opaque TypeError.
+ * An opaque error doesn't steer a cheap model to self-correct — it just repeats
+ * the malformed call. The guard returns a crisp, actionable instruction instead
+ * so the next step supplies a real command.
+ */
+export {};