orion-super-agent-dev 0.1.11 → 0.1.12

package/out/main.js

@@ -28185,6 +28185,10 @@ var require_protocol = __commonJS({
       "bash_background",
       "bash_check",
       "bash_stop",
+      // Client-executed like the bash family. Whether it is OFFERED is a separate
+      // question the backend answers from the client's advertised capabilities —
+      // this set only says who runs it.
+      "powershell",
       "lsp_symbols",
       "lsp_goto_definition",
       "lsp_references",
@@ -29360,6 +29364,107 @@ var require_scratchpad = __commonJS({
   }
 });
 
+// ../packages/orion-client-core/dist/wellFormed.js
+var require_wellFormed = __commonJS({
+  "../packages/orion-client-core/dist/wellFormed.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.splitsSurrogatePair = splitsSurrogatePair;
+    exports2.toWellFormedString = toWellFormedString;
+    exports2.toWellFormedJsonDeep = toWellFormedJsonDeep;
+    var HIGH_SURROGATE_START = 55296;
+    var HIGH_SURROGATE_END = 56319;
+    var LOW_SURROGATE_START = 56320;
+    var LOW_SURROGATE_END = 57343;
+    var REPLACEMENT_CHAR = "\uFFFD";
+    var HAS_NATIVE = typeof String.prototype.isWellFormed === "function" && typeof String.prototype.toWellFormed === "function";
+    function isHighSurrogate(unit) {
+      return unit >= HIGH_SURROGATE_START && unit <= HIGH_SURROGATE_END;
+    }
+    function isLowSurrogate(unit) {
+      return unit >= LOW_SURROGATE_START && unit <= LOW_SURROGATE_END;
+    }
+    function splitsSurrogatePair(s, index) {
+      if (index <= 0 || index >= s.length)
+        return false;
+      return isHighSurrogate(s.charCodeAt(index - 1)) && isLowSurrogate(s.charCodeAt(index));
+    }
+    function manualToWellFormed(s) {
+      let dirty = false;
+      for (let i2 = 0; i2 < s.length; i2++) {
+        const unit = s.charCodeAt(i2);
+        if (isHighSurrogate(unit)) {
+          if (isLowSurrogate(s.charCodeAt(i2 + 1))) {
+            i2++;
+          } else {
+            dirty = true;
+            break;
+          }
+        } else if (isLowSurrogate(unit)) {
+          dirty = true;
+          break;
+        }
+      }
+      if (!dirty)
+        return s;
+      let out2 = "";
+      for (let i2 = 0; i2 < s.length; i2++) {
+        const unit = s.charCodeAt(i2);
+        if (isHighSurrogate(unit) && isLowSurrogate(s.charCodeAt(i2 + 1))) {
+          out2 += s[i2] + s[i2 + 1];
+          i2++;
+        } else if (isHighSurrogate(unit) || isLowSurrogate(unit)) {
+          out2 += REPLACEMENT_CHAR;
+        } else {
+          out2 += s[i2];
+        }
+      }
+      return out2;
+    }
+    function toWellFormedString(s) {
+      if (HAS_NATIVE) {
+        const api = s;
+        return api.isWellFormed() ? s : api.toWellFormed();
+      }
+      return manualToWellFormed(s);
+    }
+    function toWellFormedJsonDeep(value) {
+      if (typeof value === "string") {
+        return toWellFormedString(value);
+      }
+      if (Array.isArray(value)) {
+        let copy;
+        for (let i2 = 0; i2 < value.length; i2++) {
+          const repaired = toWellFormedJsonDeep(value[i2]);
+          if (repaired !== value[i2] && copy === void 0)
+            copy = value.slice();
+          if (copy !== void 0)
+            copy[i2] = repaired;
+        }
+        return copy ?? value;
+      }
+      if (typeof value === "object" && value !== null) {
+        const record = value;
+        let copy;
+        for (const key of Object.keys(record)) {
+          const cleanKey = toWellFormedString(key);
+          const repaired = toWellFormedJsonDeep(record[key]);
+          if ((cleanKey !== key || repaired !== record[key]) && copy === void 0) {
+            copy = { ...record };
+          }
+          if (copy !== void 0) {
+            if (cleanKey !== key)
+              delete copy[key];
+            copy[cleanKey] = repaired;
+          }
+        }
+        return copy ?? value;
+      }
+      return value;
+    }
+  }
+});
+
 // ../packages/orion-client-core/dist/wikiBundle.js
 var require_wikiBundle = __commonJS({
   "../packages/orion-client-core/dist/wikiBundle.js"(exports2) {
@@ -30008,6 +30113,7 @@ var require_segmentDriver = __commonJS({
     var memoryIndex_js_1 = require_memoryIndex();
     var pathResolution_js_1 = require_pathResolution();
     var scratchpad_js_1 = require_scratchpad();
+    var wellFormed_js_1 = require_wellFormed();
     var orionSnapshot_js_1 = require_orionSnapshot();
     var toolConcurrency_js_1 = require_toolConcurrency();
     function turnAbortController() {
@@ -30299,7 +30405,7 @@ var require_segmentDriver = __commonJS({
       const queued = start2.drainQueuedInput?.();
       if (queued && queued.length > 0)
         body2.queued_input = queued;
-      return body2;
+      return (0, wellFormed_js_1.toWellFormedJsonDeep)(body2);
     }
     function applyRouting(body2, routing) {
       if (!routing)
@@ -32383,6 +32489,7 @@ var require_agentNarration = __commonJS({
           return `Editing ${base(input.path)}`;
         case "bash":
         case "bash_background":
+        case "powershell":
           return `Running ${clip(input.command, 48)}`;
         case "grep":
           return `Grepping "${clip(input.pattern, 40)}"`;
@@ -36861,7 +36968,7 @@ var require_searchCommands = __commonJS({
   "../packages/orion-client-core/dist/searchCommands.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ALWAYS_EXCLUDE_GLOBS = void 0;
+    exports2.GREP_DEFAULT_MAX_RESULTS = exports2.GREP_MAX_COLUMNS = exports2.ALWAYS_EXCLUDE_GLOBS = exports2.ALWAYS_EXCLUDE_GLOB_VALUES = void 0;
     exports2.shq = shq;
     exports2.normalizeContextLines = normalizeContextLines;
     exports2.normalizeOutputMode = normalizeOutputMode;
@@ -36872,14 +36979,15 @@ var require_searchCommands = __commonJS({
     exports2.buildGrepRg = buildGrepRg;
     exports2.buildGrepPosix = buildGrepPosix;
     exports2.truncateSearchOutput = truncateSearchOutput;
-    exports2.ALWAYS_EXCLUDE_GLOBS = ["'!**/node_modules/**'", "'!**/.git/**'"];
+    exports2.ALWAYS_EXCLUDE_GLOB_VALUES = ["!**/node_modules/**", "!**/.git/**"];
+    exports2.ALWAYS_EXCLUDE_GLOBS = exports2.ALWAYS_EXCLUDE_GLOB_VALUES.map((g2) => `'${g2}'`);
     function shq(s) {
       return JSON.stringify(s);
     }
     var CTX_MIN = 0;
     var CTX_MAX = 50;
-    var GREP_MAX_COLUMNS = 400;
-    var GREP_DEFAULT_MAX_RESULTS = 200;
+    exports2.GREP_MAX_COLUMNS = 400;
+    exports2.GREP_DEFAULT_MAX_RESULTS = 200;
     function withEarlyExit(command, cap, offset = 0) {
       const skip = Math.max(0, Math.trunc(offset));
       const pipe = skip > 0 ? ` | tail -n +${skip + 1} | head -n ${cap}` : ` | head -n ${cap}`;
@@ -36967,7 +37075,7 @@ var require_searchCommands = __commonJS({
       const searchPath = p.path ?? ".";
       const mode = normalizeOutputMode(p.outputMode);
       const ctx = normalizeContextLines(p.contextLines);
-      const cap = (p.maxResults ?? GREP_DEFAULT_MAX_RESULTS) + 1;
+      const cap = (p.maxResults ?? exports2.GREP_DEFAULT_MAX_RESULTS) + 1;
       const parts2 = [
         shq(rgPath),
         "--no-heading",
@@ -36985,7 +37093,7 @@ var require_searchCommands = __commonJS({
       if (mode === "content" && ctx > 0)
         parts2.push(`-C ${ctx}`);
       if (mode === "content")
-        parts2.push(`--max-columns=${GREP_MAX_COLUMNS}`, "--max-columns-preview");
+        parts2.push(`--max-columns=${exports2.GREP_MAX_COLUMNS}`, "--max-columns-preview");
       if (p.includeIgnored)
         parts2.push("--no-ignore", "--hidden");
       for (const g2 of exports2.ALWAYS_EXCLUDE_GLOBS)
@@ -37003,7 +37111,7 @@ var require_searchCommands = __commonJS({
       const searchPath = p.path ?? ".";
       const mode = normalizeOutputMode(p.outputMode);
       const ctx = normalizeContextLines(p.contextLines);
-      const cap = (p.maxResults ?? GREP_DEFAULT_MAX_RESULTS) + 1;
+      const cap = (p.maxResults ?? exports2.GREP_DEFAULT_MAX_RESULTS) + 1;
       const parts2 = ["grep", "-rn"];
       if (p.caseInsensitive)
         parts2.push("-i");
@@ -37567,6 +37675,7 @@ var require_toolText = __commonJS({
     exports2.resolveOldString = resolveOldString;
     exports2.isStaleAgainst = isStaleAgainst;
     exports2.headTailTruncate = headTailTruncate;
+    var wellFormed_js_1 = require_wellFormed();
     function numberLines(lines, firstLineNo) {
       return lines.map((l3, i2) => `${firstLineNo + i2}	${l3}`).join("\n");
     }
@@ -37619,8 +37728,10 @@ var require_toolText = __commonJS({
     function headTailTruncate(s, head, tail) {
       if (s.length <= head + tail)
         return s;
-      const headPart = s.slice(0, head);
-      const tailPart = s.slice(s.length - tail);
+      const headEnd = (0, wellFormed_js_1.splitsSurrogatePair)(s, head) ? head - 1 : head;
+      const tailStart = (0, wellFormed_js_1.splitsSurrogatePair)(s, s.length - tail) ? s.length - tail + 1 : s.length - tail;
+      const headPart = s.slice(0, headEnd);
+      const tailPart = s.slice(tailStart);
       const headCut = headPart.lastIndexOf("\n");
       const tailCut = tailPart.indexOf("\n");
       const headClean = headCut > 0 ? headPart.slice(0, headCut) : headPart;
@@ -49474,6 +49585,7 @@ var require_bashResolver = __commonJS({
     exports2.resetBashResolverCacheForTests = resetBashResolverCacheForTests;
     exports2.resolveBashFile = resolveBashFile;
     exports2.bashInvocation = bashInvocation2;
+    exports2.isBashAvailable = isBashAvailable;
     var fs_1 = __require("fs");
     var path13 = __importStar(__require("path"));
     var BashUnavailableError = class extends Error {
@@ -49500,7 +49612,7 @@ var require_bashResolver = __commonJS({
       return ["System32", "Sysnative", "SysWOW64"].some((sys) => normalized.startsWith(w2.resolve(systemRoot, sys).toLowerCase()));
     }
     function windowsPathDirs(env3) {
-      return (env3.PATH ?? env3.Path ?? "").split(";").filter(Boolean);
+      return (env3.PATH ?? env3.Path ?? "").split(";").filter(Boolean).filter((dir) => w2.isAbsolute(dir));
     }
     function gitBashCandidates(env3) {
       const roots = [];
@@ -49553,6 +49665,134 @@ var require_bashResolver = __commonJS({
     function bashInvocation2(command, opts) {
       return { file: resolveBashFile(opts), args: ["-lc", command] };
     }
+    function isBashAvailable(opts = {}) {
+      try {
+        resolveBashFile(opts);
+        return true;
+      } catch (error) {
+        if (error instanceof BashUnavailableError)
+          return false;
+        throw error;
+      }
+    }
+  }
+});
+
+// ../packages/orion-client-core/dist/powershellResolver.js
+var require_powershellResolver = __commonJS({
+  "../packages/orion-client-core/dist/powershellResolver.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m2[k];
+    });
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? function(o, v2) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v2 });
+    } : function(o, v2) {
+      o["default"] = v2;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++) if (k[i2] !== "default") __createBinding(result, mod, k[i2]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.PowerShellUnavailableError = void 0;
+    exports2.resetPowerShellResolverCacheForTests = resetPowerShellResolverCacheForTests;
+    exports2.resolvePowerShellFile = resolvePowerShellFile;
+    exports2.powershellInvocation = powershellInvocation;
+    exports2.isPowerShellFallbackActive = isPowerShellFallbackActive;
+    exports2.platformCapabilities = platformCapabilities2;
+    var fs_1 = __require("fs");
+    var path13 = __importStar(__require("path"));
+    var bashResolver_1 = require_bashResolver();
+    var PowerShellUnavailableError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "PowerShellUnavailableError";
+      }
+    };
+    exports2.PowerShellUnavailableError = PowerShellUnavailableError;
+    var w2 = path13.win32;
+    var BASE_ARGS = ["-NoProfile", "-NonInteractive", "-Command"];
+    function candidates(env3) {
+      const systemRoot = env3.SystemRoot ?? env3.windir ?? "C:\\Windows";
+      const programFiles = env3.ProgramFiles ?? "C:\\Program Files";
+      const found = [];
+      for (const major of ["7", "8"]) {
+        found.push(w2.join(programFiles, "PowerShell", major, "pwsh.exe"));
+      }
+      for (const dir of (env3.PATH ?? env3.Path ?? "").split(";").filter(Boolean)) {
+        if (w2.isAbsolute(dir))
+          found.push(w2.join(dir, "pwsh.exe"));
+      }
+      found.push(w2.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"));
+      return [...new Set(found)];
+    }
+    var cachedFile;
+    function resetPowerShellResolverCacheForTests() {
+      cachedFile = void 0;
+    }
+    function resolvePowerShellFile(opts = {}) {
+      if (cachedFile !== void 0 && opts.platform === void 0)
+        return cachedFile;
+      const platform2 = opts.platform ?? process.platform;
+      const exists = opts.existsSync ?? fs_1.existsSync;
+      const env3 = opts.env ?? process.env;
+      if (platform2 !== "win32") {
+        throw new PowerShellUnavailableError("The powershell tool is Windows-only; other platforms run commands through bash.");
+      }
+      for (const candidate of candidates(env3)) {
+        if (exists(candidate)) {
+          if (opts.platform === void 0)
+            cachedFile = candidate;
+          return candidate;
+        }
+      }
+      throw new PowerShellUnavailableError("No PowerShell interpreter was found on this Windows machine (looked for pwsh.exe and the system powershell.exe). Install Git for Windows (https://git-scm.com/download/win) to run commands through bash instead.");
+    }
+    function powershellInvocation(command, opts) {
+      return { file: resolvePowerShellFile(opts), args: [...BASE_ARGS, command] };
+    }
+    function isPowerShellFallbackActive(opts = {}) {
+      const platform2 = opts.platform ?? process.platform;
+      if (platform2 !== "win32")
+        return false;
+      if ((0, bashResolver_1.isBashAvailable)(opts))
+        return false;
+      try {
+        resolvePowerShellFile(opts);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    function platformCapabilities2(opts = {}) {
+      return isPowerShellFallbackActive(opts) ? ["powershell"] : [];
+    }
   }
 });
 
@@ -50355,6 +50595,187 @@ var require_permissions = __commonJS({
   }
 });
 
+// ../packages/orion-client-core/dist/bashCommandRewrite.js
+var require_bashCommandRewrite = __commonJS({
+  "../packages/orion-client-core/dist/bashCommandRewrite.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.rewriteWindowsNullRedirect = rewriteWindowsNullRedirect;
+    exports2.normalizeShellCommand = normalizeShellCommand;
+    var NUL_REDIRECT_RE = /(\d?&?>+\s*)[Nn][Uu][Ll](?=\s|$|[|&;)\n])/g;
+    function rewriteWindowsNullRedirect(command) {
+      return command.replace(NUL_REDIRECT_RE, "$1/dev/null");
+    }
+    function normalizeShellCommand(command, platform2 = process.platform) {
+      if (platform2 !== "win32")
+        return command;
+      return rewriteWindowsNullRedirect(command);
+    }
+  }
+});
+
+// ../packages/orion-client-core/dist/searchArgv.js
+var require_searchArgv = __commonJS({
+  "../packages/orion-client-core/dist/searchArgv.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.globArgv = globArgv;
+    exports2.grepArgv = grepArgv;
+    exports2.grepLineBudget = grepLineBudget;
+    var searchCommands_1 = require_searchCommands();
+    function globArgv(p) {
+      const args2 = ["--files", "--hidden", "--follow", "-g", p.pattern];
+      for (const glob of searchCommands_1.ALWAYS_EXCLUDE_GLOB_VALUES)
+        args2.push("-g", glob);
+      args2.push("--", p.path ?? ".");
+      return args2;
+    }
+    function grepArgv(p) {
+      const mode = (0, searchCommands_1.normalizeOutputMode)(p.outputMode);
+      const ctx = (0, searchCommands_1.normalizeContextLines)(p.contextLines);
+      const args2 = ["--no-heading", "--color=never", "-n", "--sort=path"];
+      if (p.caseInsensitive)
+        args2.push("-i");
+      if (p.multiline)
+        args2.push("-U", "--multiline");
+      if (mode === "content" && ctx > 0)
+        args2.push("-C", String(ctx));
+      if (mode === "content")
+        args2.push(`--max-columns=${searchCommands_1.GREP_MAX_COLUMNS}`, "--max-columns-preview");
+      if (p.includeIgnored)
+        args2.push("--no-ignore", "--hidden");
+      for (const glob of searchCommands_1.ALWAYS_EXCLUDE_GLOB_VALUES)
+        args2.push("-g", glob);
+      if (p.glob)
+        args2.push("-g", p.glob);
+      if (mode === "files_with_matches")
+        args2.push("-l");
+      else if (mode === "count")
+        args2.push("-c");
+      args2.push("-e", p.pattern, "--", p.path ?? ".");
+      return args2;
+    }
+    function grepLineBudget(p) {
+      return (p.maxResults ?? searchCommands_1.GREP_DEFAULT_MAX_RESULTS) + 1;
+    }
+  }
+});
+
+// ../packages/orion-client-core/dist/processHardening.js
+var require_processHardening = __commonJS({
+  "../packages/orion-client-core/dist/processHardening.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.HIDDEN_WINDOW_SPAWN_OPTIONS = void 0;
+    exports2.killChild = killChild;
+    exports2.hardenExecutableSearchPath = hardenExecutableSearchPath;
+    exports2.HIDDEN_WINDOW_SPAWN_OPTIONS = { windowsHide: true };
+    function killChild(child, signal = "SIGTERM", platform2 = process.platform) {
+      try {
+        if (platform2 === "win32")
+          child.kill();
+        else
+          child.kill(signal);
+      } catch {
+      }
+    }
+    function hardenExecutableSearchPath(env3 = process.env, platform2 = process.platform) {
+      if (platform2 !== "win32")
+        return;
+      env3.NoDefaultCurrentDirectoryInExePath = "1";
+    }
+  }
+});
+
+// ../packages/orion-client-core/dist/searchRg.js
+var require_searchRg = __commonJS({
+  "../packages/orion-client-core/dist/searchRg.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.spawnRg = void 0;
+    var child_process_1 = __require("child_process");
+    var processHardening_1 = require_processHardening();
+    function isSuccessExit(code) {
+      return code === 0 || code === 1;
+    }
+    function keepLines(text, max) {
+      const lines = text.split("\n");
+      if (lines.length <= max)
+        return text;
+      return lines.slice(0, max).join("\n") + "\n";
+    }
+    var spawnRg = (opts) => new Promise((resolve5, reject) => {
+      const child = (0, child_process_1.spawn)(opts.rgPath, opts.args, {
+        ...processHardening_1.HIDDEN_WINDOW_SPAWN_OPTIONS,
+        cwd: opts.cwd,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      let lines = 0;
+      let cappedEarly = false;
+      let timedOut = false;
+      let settled = false;
+      const finish = (result) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        resolve5(result);
+      };
+      const bounded = () => opts.maxLines === void 0 ? stdout : keepLines(stdout, opts.maxLines);
+      const timer = setTimeout(() => {
+        if (settled)
+          return;
+        timedOut = true;
+        (0, processHardening_1.killChild)(child);
+        finish({ stdout: bounded(), cappedEarly, timedOut });
+      }, opts.timeoutMs);
+      timer.unref?.();
+      child.stdout.on("data", (chunk) => {
+        if (settled)
+          return;
+        const text = chunk.toString();
+        stdout += text;
+        if (opts.maxLines === void 0 || cappedEarly)
+          return;
+        for (let i2 = 0; i2 < text.length; i2 += 1) {
+          if (text.charCodeAt(i2) === 10)
+            lines += 1;
+        }
+        if (lines >= opts.maxLines) {
+          cappedEarly = true;
+          stdout = keepLines(stdout, opts.maxLines);
+          (0, processHardening_1.killChild)(child);
+          finish({ stdout, cappedEarly, timedOut });
+        }
+      });
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      child.on("error", (error) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        reject(error);
+      });
+      child.on("close", (code) => {
+        if (settled)
+          return;
+        if (isSuccessExit(code)) {
+          finish({ stdout, cappedEarly, timedOut });
+          return;
+        }
+        settled = true;
+        clearTimeout(timer);
+        reject(new Error(`ripgrep exited ${code}${stderr.trim() ? `: ${stderr.trim()}` : ""}`));
+      });
+    });
+    exports2.spawnRg = spawnRg;
+  }
+});
+
 // ../packages/orion-client-core/dist/o-vault/experienceStore.js
 var require_experienceStore = __commonJS({
   "../packages/orion-client-core/dist/o-vault/experienceStore.js"(exports2) {
@@ -51246,7 +51667,12 @@ var require_toolExecutor = __commonJS({
     var os7 = __importStar(__require("os"));
     var path13 = __importStar(__require("path"));
     var bashFileChanges_1 = require_bashFileChanges();
+    var bashCommandRewrite_1 = require_bashCommandRewrite();
     var bashResolver_1 = require_bashResolver();
+    var powershellResolver_1 = require_powershellResolver();
+    var searchArgv_1 = require_searchArgv();
+    var searchRg_1 = require_searchRg();
+    var processHardening_1 = require_processHardening();
     var fileCodec_1 = require_fileCodec();
     var fileHistory_1 = require_fileHistory();
     var multimodalRead_1 = require_multimodalRead();
@@ -51272,6 +51698,7 @@ var require_toolExecutor = __commonJS({
     var BASH_HEAD_CHARS = 6e4;
     var BASH_TAIL_CHARS = 2e4;
     var GREP_MAX_RESULTS = 2e3;
+    var SEARCH_TIMEOUT_S = 30;
     var LIST_DIR_MAX_ENTRIES = 1e3;
     var LIST_DIR_DEPTH_DEFAULT = 3;
     var LIST_DIR_DEPTH_MAX = 16;
@@ -51608,6 +52035,7 @@ var require_toolExecutor = __commonJS({
         this.getAdditionalDirectories = getAdditionalDirectories;
         this.getPermissionRules = getPermissionRules;
         this.rgPath = ripgrep.locate();
+        (0, processHardening_1.hardenExecutableSearchPath)();
       }
       /** Attach the machine-local presence layer (post-construction, mirroring
        *  registerTools — the 12-arg constructor does not grow). Hosts that never
@@ -52218,6 +52646,7 @@ ${notes.join("\n\n")}`;
         ["glob", (req, params, sessionId, context) => this.toolGlob(req, params, sessionId, context)],
         ["grep", (req, params, sessionId, context) => this.toolGrep(req, params, sessionId, context)],
         ["bash", (req, params, sessionId, context) => this.toolBash(req, params, sessionId, context)],
+        ["powershell", (req, params, sessionId, context) => this.toolPowershell(req, params, sessionId, context)],
         ["bash_background", (req, params, sessionId, context) => this.toolBashBackground(req, params, sessionId, context)],
         ["bash_check", (req, params, sessionId, context) => this.toolBashCheck(req, params, sessionId, context)],
         ["bash_stop", (req, params, sessionId, context) => this.toolBashStop(req, params, sessionId, context)],
@@ -52516,8 +52945,11 @@ ${notes.join("\n\n")}`;
           path: params.path != null ? String(params.path) : "."
         };
         const cwd = this.requireRoot(params);
-        const cmd = this.rgPath ? (0, searchCommands_1.buildGlobRg)(this.rgPath, p) : (0, searchCommands_1.buildGlobFind)(p);
-        const raw = await this.runBash(cmd, 30, cwd, void 0, true);
+        const raw = await this.runSearch({
+          shellCommand: () => this.rgPath ? (0, searchCommands_1.buildGlobRg)(this.rgPath, p) : (0, searchCommands_1.buildGlobFind)(p),
+          argv: () => (0, searchArgv_1.globArgv)(p),
+          cwd
+        });
         const sorted = (0, searchCommands_1.sortPathsByMtimeDesc)(raw, (rel) => {
           try {
             return (0, fs_1.statSync)(path13.resolve(cwd, rel)).mtimeMs;
@@ -52544,15 +52976,24 @@ ${notes.join("\n\n")}`;
           offset: (0, searchCommands_1.normalizeOffset)(params.offset)
         };
         const root2 = this.requireRoot(params);
-        const cmd = this.rgPath ? (0, searchCommands_1.buildGrepRg)(this.rgPath, p) : (0, searchCommands_1.buildGrepPosix)(p);
-        const raw = await this.runBash(cmd, 30, root2, void 0, true);
+        const raw = await this.runSearch({
+          shellCommand: () => this.rgPath ? (0, searchCommands_1.buildGrepRg)(this.rgPath, p) : (0, searchCommands_1.buildGrepPosix)(p),
+          argv: () => (0, searchArgv_1.grepArgv)(p),
+          cwd: root2,
+          // The argv transport has no pipe, so it takes the budget the shell
+          // pipeline expresses as `| head -n cap`; both then hand
+          // `truncateSearchOutput` the same shape (exactTotal:false — a capped run
+          // knows only that MORE than maxLines exist, never the true total).
+          maxLines: (0, searchArgv_1.grepLineBudget)(p),
+          offset: p.offset
+        });
         return (0, searchCommands_1.truncateSearchOutput)(raw, maxLines, { exactTotal: false }).text;
       }
       /** `bash` */
       async toolBash(req, params, sessionId, context) {
         if (this.getPermissionMode() === "read_only")
           throw new Error("read-only mode");
-        const command = String(params.command);
+        const command = (0, bashCommandRewrite_1.normalizeShellCommand)(String(params.command));
         const reqId = req.request_id;
         const sink = params._agent_id ? null : this.termSink;
         let effectiveCwd;
@@ -52617,11 +53058,83 @@ exit $__orion_rc`;
           }
         }
       }
+      /** `powershell` — the shell tool a Windows machine with no bash gets instead.
+       *
+       *  Deliberately mirrors `toolBash`'s CONTRACT (permission mode, cwd
+       *  resolution, sticky cwd across calls, live terminal streaming, output
+       *  compression) while speaking PowerShell, because the difference between the
+       *  two tools is the language, not the semantics. What it does NOT mirror is
+       *  the sandbox: OS write-containment exists on darwin/linux only, so there is
+       *  nothing to wrap here and no `disable_sandbox` param to honor. */
+      async toolPowershell(req, params, sessionId, context) {
+        if (this.getPermissionMode() === "read_only")
+          throw new Error("read-only mode");
+        const command = String(params.command);
+        const reqId = req.request_id;
+        const sink = params._agent_id ? null : this.termSink;
+        let effectiveCwd;
+        if (typeof params.cwd === "string" && params.cwd.length > 0) {
+          effectiveCwd = this.resolveWithinWorkspace(params.cwd, sessionId, params._root, "write");
+        } else if (!params._agent_id) {
+          effectiveCwd = this.shellCwd.get(sessionId);
+        }
+        effectiveCwd = effectiveCwd || params._root || this.getWorkspaceRoot() || void 0;
+        if (effectiveCwd && !(0, fs_1.existsSync)(effectiveCwd)) {
+          effectiveCwd = this.getWorkspaceRoot() ?? void 0;
+        }
+        effectiveCwd = (0, pathResolution_1.effectiveWorkspaceRoot)(effectiveCwd ?? null);
+        (0, pathResolution_1.assertNoWorkspacePathPrefixInCommand)(command, params._root || this.getWorkspaceRoot() || effectiveCwd);
+        let wrapped = command;
+        let cwdFile;
+        if (!params._agent_id) {
+          cwdFile = path13.join(os7.tmpdir(), `orion-pscwd-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+          const psPath = cwdFile.replace(/'/g, "''");
+          wrapped = `${command}
+$__orion_rc = if ($null -ne $LASTEXITCODE) { $LASTEXITCODE } elseif ($?) { 0 } else { 1 }
+(Get-Location).Path | Out-File -FilePath '${psPath}' -Encoding utf8 -NoNewline
+exit $__orion_rc`;
+        }
+        const detectRoot = params._root || this.getWorkspaceRoot();
+        const inScratch = this.isOwnScratchWrite(effectiveCwd, sessionId);
+        const baseline = detectRoot && effectiveCwd && !inScratch ? await (0, bashFileChanges_1.captureBaseline)(effectiveCwd, detectRoot) : null;
+        sink?.(sessionId, reqId, command, "start");
+        try {
+          const out2 = await this.runPowershell(wrapped, Math.min(300, Number(params.timeout_s ?? 60)), effectiveCwd, sink ? (chunk) => sink(sessionId, reqId, command, "chunk", chunk) : void 0);
+          if (baseline) {
+            const changes = await (0, bashFileChanges_1.diffAgainstBaseline)(baseline);
+            if (changes.length > 0)
+              this.pendingBashChanges.set(reqId, changes);
+          }
+          const compressed = (0, terminalOutputCompression_1.compressTerminalOutputWithMetrics)({
+            toolName: req.name,
+            command,
+            output: out2,
+            tokenSaving: context.tokenSaving
+          });
+          if (compressed.savings)
+            this.pendingTerminalSavings.set(reqId, compressed.savings);
+          return compressed.output;
+        } finally {
+          sink?.(sessionId, reqId, command, "end");
+          if (cwdFile) {
+            try {
+              const newCwd = (await fs14.readFile(cwdFile, "utf8")).replace(/^/, "").trim();
+              if (newCwd && (0, fs_1.existsSync)(newCwd) && this.getWorkspaceRoot()) {
+                this.shellCwd.set(sessionId, newCwd);
+              }
+            } catch {
+            } finally {
+              await fs14.unlink(cwdFile).catch(() => {
+              });
+            }
+          }
+        }
+      }
       /** `bash_background` */
       async toolBashBackground(req, params, sessionId, context) {
         if (this.getPermissionMode() === "read_only")
           throw new Error("read-only mode");
-        const command = String(params.command);
+        const command = (0, bashCommandRewrite_1.normalizeShellCommand)(String(params.command));
         const root2 = this.requireRoot(params);
         (0, pathResolution_1.assertNoWorkspacePathPrefixInCommand)(command, root2);
         const bgSandbox = this.sandboxForParams(params);
@@ -52629,7 +53142,7 @@ exit $__orion_rc`;
           capability: bgSandbox.capability,
           writableRoots: bgSandbox.writableRoots
         }) : (0, bashResolver_1.bashInvocation)(command);
-        const proc = (0, child_process_1.spawn)(bgInv.file, bgInv.args, { cwd: root2 });
+        const proc = (0, child_process_1.spawn)(bgInv.file, bgInv.args, { ...processHardening_1.HIDDEN_WINDOW_SPAWN_OPTIONS, cwd: root2 });
         const handle2 = `bg-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
         const rec = { proc, command, output: "" };
         this.background.set(handle2, rec);
@@ -52835,6 +53348,7 @@ exit $__orion_rc`;
         const envOverride = params.env ?? {};
         return await new Promise((resolve5, reject) => {
           const proc = (0, child_process_1.spawn)(argv[0], argv.slice(1), {
+            ...processHardening_1.HIDDEN_WINDOW_SPAWN_OPTIONS,
             cwd: cwd || void 0,
             env: { ...process.env, ...envOverride }
           });
@@ -52968,6 +53482,98 @@ exit $__orion_rc`;
         ];
         return { capability, writableRoots };
       }
+      /**
+       * Run one search on whichever transport this machine has, and return the raw
+       * output the caller then sorts/truncates.
+       *
+       * THE decision point, in one place for both search tools: a shell pipeline
+       * wherever a POSIX shell exists — every mac, every linux, every Windows
+       * carrying Git for Windows — and an argument vector only where none does. The
+       * two builders are passed as thunks so the unused one is never constructed,
+       * and the transport is never a caller's concern.
+       */
+      async runSearch(opts) {
+        if ((0, bashResolver_1.isBashAvailable)()) {
+          return await this.runBash(opts.shellCommand(), SEARCH_TIMEOUT_S, opts.cwd, void 0, true);
+        }
+        return await this.runRgDirect({
+          args: opts.argv(),
+          cwd: opts.cwd,
+          maxLines: opts.maxLines,
+          offset: opts.offset
+        });
+      }
+      /** Run ripgrep with an argument vector, for the machine that has no shell to
+       *  run the pipeline in. Applies the caller's line budget and `offset` exactly
+       *  as the pipeline's `| tail -n +N | head -n cap` does, so both transports
+       *  hand `truncateSearchOutput` the same shape. */
+      async runRgDirect(opts) {
+        if (!this.rgPath) {
+          throw new Error("Search is unavailable: this machine has neither a POSIX shell nor a bundled ripgrep. Install Git for Windows (https://git-scm.com/download/win) to restore search.");
+        }
+        const skip = Math.max(0, Math.trunc(opts.offset ?? 0));
+        const budget = opts.maxLines === void 0 ? void 0 : opts.maxLines + skip;
+        const result = await (0, searchRg_1.spawnRg)({
+          rgPath: this.rgPath,
+          args: opts.args,
+          cwd: opts.cwd,
+          timeoutMs: SEARCH_TIMEOUT_S * 1e3,
+          maxLines: budget
+        });
+        if (skip === 0)
+          return result.stdout;
+        const lines = result.stdout.split("\n");
+        const trailingNewline = lines.length > 0 && lines[lines.length - 1] === "";
+        const body2 = trailingNewline ? lines.slice(0, -1) : lines;
+        const kept = body2.slice(skip);
+        return kept.length === 0 ? "" : kept.join("\n") + (trailingNewline ? "\n" : "");
+      }
+      /** Spawn one PowerShell command. Shares `runBash`'s streaming, truncation and
+       *  exit-marker conventions so the model reads the same shape of result from
+       *  either shell; the interpreter and its flags are the only difference. */
+      async runPowershell(command, timeoutS, cwd, onChunk) {
+        const inv = (0, powershellResolver_1.powershellInvocation)(command);
+        return await new Promise((resolve5, reject) => {
+          const proc = (0, child_process_1.spawn)(inv.file, inv.args, {
+            ...processHardening_1.HIDDEN_WINDOW_SPAWN_OPTIONS,
+            cwd: cwd || this.getWorkspaceRoot() || void 0,
+            env: { ...process.env, PAGER: "cat", GIT_PAGER: "cat" }
+          });
+          let out2 = "";
+          const take = (chunk) => {
+            const text = chunk.toString();
+            out2 += text;
+            onChunk?.(text);
+          };
+          proc.stdout?.on("data", take);
+          proc.stderr?.on("data", take);
+          let timedOut = false;
+          const timer = setTimeout(() => {
+            timedOut = true;
+            (0, processHardening_1.killChild)(proc);
+            reject(new Error(`command timed out after ${timeoutS}s`));
+          }, timeoutS * 1e3);
+          proc.on("close", (code) => {
+            clearTimeout(timer);
+            if (timedOut)
+              return;
+            const modelOut = (0, toolText_1.headTailTruncate)((0, toolText_1.stripAnsiCodes)(out2), BASH_HEAD_CHARS, BASH_TAIL_CHARS);
+            if (code === 0) {
+              resolve5(modelOut);
+            } else {
+              const suffix = `
+(exit ${code})`;
+              onChunk?.(suffix);
+              resolve5(modelOut + suffix);
+            }
+          });
+          proc.on("error", (e) => {
+            clearTimeout(timer);
+            if (!timedOut)
+              reject(e);
+          });
+        });
+      }
       async runBash(command, timeoutS, cwd, onChunk, partialOnTimeout = false, sandbox) {
         const inv = sandbox && sandbox.capability ? (0, bashSandbox_1.buildSandboxedInvocation)(command, {
           capability: sandbox.capability,
@@ -52975,6 +53581,7 @@ exit $__orion_rc`;
         }) : (0, bashResolver_1.bashInvocation)(command);
         return await new Promise((resolve5, reject) => {
           const proc = (0, child_process_1.spawn)(inv.file, inv.args, {
+            ...processHardening_1.HIDDEN_WINDOW_SPAWN_OPTIONS,
             cwd: cwd || this.getWorkspaceRoot() || void 0,
             // We run without a PTY, so CLIs (vite, npm, eslint, jest, …) see a
             // pipe and disable colors by default. Force color on so the live
@@ -53005,7 +53612,7 @@ exit $__orion_rc`;
           let timedOut = false;
           const timer = setTimeout(() => {
             timedOut = true;
-            proc.kill("SIGTERM");
+            (0, processHardening_1.killChild)(proc);
             if (partialOnTimeout) {
               const note = `
 [timed out after ${timeoutS}s \u2014 partial results above; narrow the pattern, or use search_codebase for ranked results]`;
@@ -59903,13 +60510,15 @@ var require_connection = __commonJS({
     var BrainConnection = class _BrainConnection {
       io;
       brainVersion;
+      log;
       pending = /* @__PURE__ */ new Map();
       nextId = 0;
       closed = false;
       closeError;
-      constructor(io, brainVersion) {
+      constructor(io, brainVersion, log) {
         this.io = io;
         this.brainVersion = brainVersion;
+        this.log = log;
       }
       /** True while the underlying channel is usable. */
       get alive() {
@@ -59960,7 +60569,7 @@ var require_connection = __commonJS({
             settled = true;
             clearTimeout(timer);
             io.readable.removeListener("data", onData);
-            const connection = new _BrainConnection(io, frame.brain_version);
+            const connection = new _BrainConnection(io, frame.brain_version, options.log);
             connection.attach();
             resolve5(connection);
           });
@@ -60037,6 +60646,9 @@ var require_connection = __commonJS({
         this.closeError = error;
         const inFlight2 = [...this.pending.values()];
         this.pending.clear();
+        if (inFlight2.length > 0) {
+          this.log?.(`brain connection failed \u2014 rejecting ${inFlight2.length} in-flight segment(s)`, error);
+        }
         const rejection = error instanceof segmentDriver_1.TransportError ? error : new segmentDriver_1.TransportError(`brain connection failed: ${String(error)}`, { cause: error });
         for (const pending of inFlight2)
           pending.reject(rejection);
@@ -60506,7 +61118,8 @@ var require_supervisor = __commonJS({
           }
         }, {
           helloTimeoutMs: this.options.helloTimeoutMs,
-          clientVersion: this.options.clientVersion
+          clientVersion: this.options.clientVersion,
+          log: this.options.log
         });
         this.connection = connection;
         return connection;
@@ -60685,7 +61298,8 @@ var require_socketClient = __commonJS({
               }
             }, {
               helloTimeoutMs: this.options.helloTimeoutMs,
-              clientVersion: this.options.clientVersion
+              clientVersion: this.options.clientVersion,
+              log: this.options.log
             }).then(resolve5, reject);
           });
         });
@@ -60974,6 +61588,7 @@ var require_dist = __commonJS({
     __exportStar(require_workerPool(), exports2);
     __exportStar(require_pathResolution(), exports2);
     __exportStar(require_bashResolver(), exports2);
+    __exportStar(require_powershellResolver(), exports2);
     __exportStar(require_bashSandbox(), exports2);
     __exportStar(require_workingDirectories(), exports2);
     __exportStar(require_permissions(), exports2);
@@ -61173,7 +61788,7 @@ var require_permissionCard = __commonJS({
       { source: "user", label: "All projects" },
       { source: "session", label: "This session" }
     ];
-    var BASH_FAMILY = /* @__PURE__ */ new Set(["bash", "bash_background"]);
+    var COMMAND_TOOLS = /* @__PURE__ */ new Set(["bash", "bash_background", "powershell"]);
     function firstLine(text) {
       return text.split("\n", 1)[0] ?? text;
     }
@@ -61203,7 +61818,7 @@ var require_permissionCard = __commonJS({
       const tool = req.tool_name;
       let header;
       let body2;
-      if (BASH_FAMILY.has(tool)) {
+      if (COMMAND_TOOLS.has(tool)) {
         const command = String(input.command ?? "");
         header = { verb: "Run", subject: firstLine(command) };
         body2 = { kind: "command", command };
@@ -98416,7 +99031,7 @@ function OrionRing() {
 
 // src/services/version.ts
 function tuiVersion() {
-  return "0.1.11".length > 0 ? "0.1.11" : null;
+  return "0.1.12".length > 0 ? "0.1.12" : null;
 }
 
 // src/components/layout/WelcomeCard.tsx
@@ -103982,7 +104597,10 @@ async function main() {
   const attachAgentParent = (sid) => {
     agentManager.attachParent(sid, {
       routing: () => currentRouting(),
-      clientCapabilities: () => appStore.getState().subagentsEnabled ? ["subagents"] : [],
+      clientCapabilities: () => [
+        ...(0, import_client_core34.platformCapabilities)(),
+        ...appStore.getState().subagentsEnabled ? ["subagents"] : []
+      ],
       transcript: () => transcriptStore.getState().messages,
       queueParentInput: (text) => heldAgentReports.push(text),
       wakeParent: () => {
@@ -104147,7 +104765,10 @@ async function main() {
           // the def catalog is sent and the backend hides the whole family.
           // `workgraph` rides the same switch as the fan-out family: a work graph IS a
           // fan-out (its phases are sub-agents), so turning sub-agents off must hide both.
-          clientCapabilities: appStore.getState().subagentsEnabled ? ["scheduling", "subagents", "workgraph"] : ["scheduling"],
+          clientCapabilities: [
+            ...(0, import_client_core34.platformCapabilities)(),
+            ...appStore.getState().subagentsEnabled ? ["scheduling", "subagents", "workgraph"] : ["scheduling"]
+          ],
           extraBody: {
             ...appStore.getState().subagentsEnabled ? agentManager.parentExtraBody() : {},
             ...peerAgents.length > 0 ? { peer_agents: peerAgents } : {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orion-super-agent-dev",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "[dev] Orion \u2014 a terminal AI super-agent, strongest at coding. Local brain, local disk: the agent loop runs on your machine; only the metered model call leaves it.",
   "license": "MIT",
   "type": "module",