privateer-agent 0.14.0 → 0.14.2

package/src/providers/account.ts

@@ -100,6 +100,27 @@ function validContextWindow(value: unknown): number | undefined {
     : undefined;
 }
 
+// What to ask for per turn when the server publishes no output cap for a model — the
+// flat value the whole catalog used to be registered with, so "unpublished" behaves
+// exactly as it always has.
+const DEFAULT_MAX_OUTPUT_TOKENS = 16384;
+
+// The server's own ceiling on a proxied turn (treeview inferenceService
+// PROXY_MAX_COMPLETION_TOKENS). Asking past it buys nothing — the proxy sizes its
+// balance gate to at most this — so a published cap above it is clamped here.
+const ACCOUNT_MAX_OUTPUT_TOKENS = 32000;
+
+// Below this a turn cannot fit a complete tool call; same floor pi-ai uses for an
+// answer (contextBudget.ts MIN_ANSWER_TOKENS). A smaller published cap is treated as
+// garbled rather than strangling every turn.
+const MIN_PUBLISHED_MAX_OUTPUT = 1024;
+
+function validMaxOutputTokens(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value) && value >= MIN_PUBLISHED_MAX_OUTPUT
+    ? Math.min(Math.floor(value), ACCOUNT_MAX_OUTPUT_TOKENS)
+    : undefined;
+}
+
 function seedModel(id: string) {
   return {
     id,
@@ -119,7 +140,13 @@ function seedModel(id: string) {
     // that under-states the model's real one therefore throttles the answer — and
     // used to collapse it to a single token — while the model still has room.
     contextWindow: accountContextWindow(id) ?? DEFAULT_CONTEXT_WINDOW,
-    maxTokens: 16384,
+    // The model's real output cap when published. Not cosmetic either: reasoning and
+    // the answer share this one budget, and pi only compact-and-retries a length stop
+    // that ended BELOW it — a thinking model that spends all of a too-small budget
+    // reasoning ends the run with "Response was truncated before completion."
+    // (measured: glm-5.3-flash spending all 16384 on 50k+ chars of reasoning, whose
+    // real cap is far higher). See also ext/truncationRecovery.ts.
+    maxTokens: accountMaxOutputTokens(id) ?? DEFAULT_MAX_OUTPUT_TOKENS,
   };
 }
 
@@ -296,14 +323,19 @@ function saveCachedCatalog(infos: AccountModelInfo[]): void {
     mkdirSync(globalDir(), { recursive: true });
     const kept = infos.slice(0, CATALOG_CACHE_MAX);
     const windows: Record<string, number> = {};
+    const maxOutputs: Record<string, number> = {};
     for (const info of kept) {
       if (info.contextWindow !== undefined) windows[info.id] = info.contextWindow;
+      if (info.maxOutputTokens !== undefined) maxOutputs[info.id] = info.maxOutputTokens;
     }
     const payload = {
       v: 2,
       fetchedAt: new Date().toISOString(),
       ids: kept.map((info) => info.id),
       windows,
+      // Same reasoning as `windows`: a capability needed at launch. Absent in older
+      // files, which then fall back per model.
+      maxOutputs,
     };
     writeFileSync(catalogCachePath(), JSON.stringify(payload) + "\n", "utf8");
     forgetCachedContextWindows();
@@ -316,33 +348,42 @@ function saveCachedCatalog(infos: AccountModelInfo[]): void {
 // the catalog on every registration, and the catalog re-registers whenever the shim
 // state changes — re-reading and re-parsing a 284-entry file each time would turn a
 // cheap lookup into hundreds of syscalls on the launch path.
-let cachedWindows: Map<string, number> | null = null;
+let cachedCapabilities: { windows: Map<string, number>; maxOutputs: Map<string, number> } | null = null;
 
-function cachedContextWindows(): Map<string, number> {
-  if (cachedWindows) return cachedWindows;
-  cachedWindows = new Map();
+function cachedCapabilityMaps(): { windows: Map<string, number>; maxOutputs: Map<string, number> } {
+  if (cachedCapabilities) return cachedCapabilities;
+  cachedCapabilities = { windows: new Map(), maxOutputs: new Map() };
   try {
     const path = catalogCachePath();
     if (existsSync(path)) {
-      const parsed = JSON.parse(readFileSync(path, "utf8")) as { windows?: unknown };
-      // A v1 file has no `windows` at all; every id then falls back, exactly as before.
-      if (parsed.windows && typeof parsed.windows === "object") {
-        for (const [id, value] of Object.entries(parsed.windows as Record<string, unknown>)) {
-          const window = validContextWindow(value);
-          if (window !== undefined && cachedWindows.size < CATALOG_CACHE_MAX) cachedWindows.set(id, window);
-        }
-      }
+      const parsed = JSON.parse(readFileSync(path, "utf8")) as { windows?: unknown; maxOutputs?: unknown };
+      // A v1 file has no `windows` (and an older v2 no `maxOutputs`); every id then
+      // falls back, exactly as before. Re-validated on read: the file is input too.
+      readCapability(parsed.windows, validContextWindow, cachedCapabilities.windows);
+      readCapability(parsed.maxOutputs, validMaxOutputTokens, cachedCapabilities.maxOutputs);
     }
   } catch {
-    /* absent, unreadable, or garbage — every model just uses the fallback window */
+    /* absent, unreadable, or garbage — every model just uses the fallbacks */
+  }
+  return cachedCapabilities;
+}
+
+function readCapability(raw: unknown, valid: (value: unknown) => number | undefined, into: Map<string, number>): void {
+  if (!raw || typeof raw !== "object") return;
+  for (const [id, value] of Object.entries(raw as Record<string, unknown>)) {
+    const n = valid(value);
+    if (n !== undefined && into.size < CATALOG_CACHE_MAX) into.set(id, n);
   }
-  return cachedWindows;
+}
+
+function cachedContextWindows(): Map<string, number> {
+  return cachedCapabilityMaps().windows;
 }
 
 // Drop the memo so the next read sees what was just written (and so a test can rewrite
 // the cache between assertions).
 function forgetCachedContextWindows(): void {
-  cachedWindows = null;
+  cachedCapabilities = null;
 }
 
 export function loadCachedCatalogIds(): string[] {
@@ -408,6 +449,9 @@ export interface AccountModelInfo {
   // Absent means "unknown" — seedModel falls back to DEFAULT_CONTEXT_WINDOW rather
   // than to a guess, so an older server behaves exactly as before.
   contextWindow?: number;
+  // The server's published per-turn output cap, already clamped to the proxy's
+  // ceiling. Absent means unknown — seedModel falls back to DEFAULT_MAX_OUTPUT_TOKENS.
+  maxOutputTokens?: number;
 }
 
 // The set of tier strings pi-privacy defines (posture/tiers.ts). We only trust a
@@ -454,6 +498,13 @@ export function accountContextWindow(id: string): number | undefined {
   return accountWindowMap.get(id) ?? cachedContextWindows().get(id);
 }
 
+// Published output caps, keyed by modelId — live catalog first, then the disk cache.
+const accountMaxOutputMap = new Map<string, number>();
+
+export function accountMaxOutputTokens(id: string): number | undefined {
+  return accountMaxOutputMap.get(id) ?? cachedCapabilityMaps().maxOutputs.get(id);
+}
+
 // The server-asserted baseline tier for an account model, or undefined if we haven't
 // seen it in a catalog fetch. Used by the /models picker (privateer-models.ts).
 export function accountBaselineTier(modelId: string): PrivacyTier | undefined {
@@ -483,7 +534,7 @@ export async function fetchAccountCatalog(): Promise<AccountModelInfo[]> {
       infos = fallback();
     } else {
       const data = (await res.json()) as {
-        models?: { modelId?: string; privacy?: { tier?: string }; contextLength?: unknown }[];
+        models?: { modelId?: string; privacy?: { tier?: string }; contextLength?: unknown; maxCompletionTokens?: unknown }[];
       };
       const parsed = (data.models ?? [])
         .map((m): AccountModelInfo | null =>
@@ -495,6 +546,7 @@ export async function fetchAccountCatalog(): Promise<AccountModelInfo[]> {
                 // absent entirely on a server older than the field — both mean
                 // "unknown", and validContextWindow collapses them to undefined.
                 contextWindow: validContextWindow(m.contextLength),
+                maxOutputTokens: validMaxOutputTokens(m.maxCompletionTokens),
               }
             : null,
         )
@@ -511,9 +563,11 @@ export async function fetchAccountCatalog(): Promise<AccountModelInfo[]> {
   }
   accountTierMap.clear();
   accountWindowMap.clear();
+  accountMaxOutputMap.clear();
   for (const info of infos) {
     accountTierMap.set(info.id, info.tier);
     if (info.contextWindow !== undefined) accountWindowMap.set(info.id, info.contextWindow);
+    if (info.maxOutputTokens !== undefined) accountMaxOutputMap.set(info.id, info.maxOutputTokens);
   }
   return infos;
 }

package/src/remote/channelsControl.ts

@@ -21,13 +21,14 @@
  * Framework-agnostic: nothing here imports React or the relay. The caller owns the
  * frame plumbing and the running-presence read.
  */
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { configPath } from "../config/paths.ts";
 // The platform roster, per-platform secret field names, and the "is this block
 // startable" predicate all live in ONE place, shared with the channels runtime —
 // see channels/platforms.ts. Re-exported here so existing importers of
 // CHANNEL_PLATFORMS/ChannelPlatform from this module keep working unchanged.
 import { CHANNEL_PLATFORMS, SECRET_FIELDS, isChannelPlatform, type ChannelPlatform } from "../channels/platforms.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 export { CHANNEL_PLATFORMS };
 export type { ChannelPlatform };
@@ -161,7 +162,7 @@ export function makeChannelsControl(opts: {
 
       cfg.channels[draft.platform] = block;
       try {
-        writeFileSync(configPath(), JSON.stringify(cfg, null, 2));
+        writeFileAtomic(configPath(), JSON.stringify(cfg, null, 2) + "\n");
       } catch (e) {
         return { ok: false, message: `Couldn't write config: ${e instanceof Error ? e.message : String(e)}` };
       }
@@ -174,7 +175,7 @@ export function makeChannelsControl(opts: {
       if (!cfg.channels?.[platform]) return { ok: false, message: "Not configured." };
       delete cfg.channels[platform];
       try {
-        writeFileSync(configPath(), JSON.stringify(cfg, null, 2));
+        writeFileAtomic(configPath(), JSON.stringify(cfg, null, 2) + "\n");
       } catch (e) {
         return { ok: false, message: `Couldn't write config: ${e instanceof Error ? e.message : String(e)}` };
       }

package/src/remote/mcpControl.ts

@@ -35,9 +35,10 @@
  * Framework-agnostic: nothing here imports React or the relay. The caller owns the
  * frame plumbing and the sealed-secret open.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { agentDir } from "../config/paths.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 export type McpTransport = "stdio" | "http";
 
@@ -200,7 +201,7 @@ export function makeMcpControl(opts?: {
 
   function writeSource(src: SourceFile): void {
     mkdirSync(dirname(sourcePath()), { recursive: true });
-    writeFileSync(sourcePath(), JSON.stringify(src, null, 2) + "\n");
+    writeFileAtomic(sourcePath(), JSON.stringify(src, null, 2) + "\n");
     project(src);
   }
 
@@ -220,7 +221,7 @@ export function makeMcpControl(opts?: {
       mcpServers[name] = toStandard(e);
     }
     mkdirSync(dirname(projectionPath()), { recursive: true });
-    writeFileSync(
+    writeFileAtomic(
       projectionPath(),
       JSON.stringify({ mcpServers, settings: { toolPrefix: "server" } }, null, 2) + "\n",
     );

package/src/routines/store.ts

@@ -1,4 +1,5 @@
-import { mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync, readdirSync, unlinkSync } from "node:fs";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { globalDir } from "../config/paths.ts";
@@ -64,11 +65,9 @@ export function saveRoutines(routines: Routine[]): void {
   mkdirSync(dir, { recursive: true });
   tryChmod(dir, 0o700);
   const payload: RoutineFile = { routines };
-  writeFileSync(routinesFilePath(), JSON.stringify(payload, null, 2) + "\n", {
-    encoding: "utf8",
-    mode: 0o600,
-  });
-  tryChmod(routinesFilePath(), 0o600);
+  // Atomic: a half-written routines.json reads as "no routines" (loadRoutines), and the
+  // next save would then persist only the one routine it was given.
+  writeFileAtomic(routinesFilePath(), JSON.stringify(payload, null, 2) + "\n", { mode: 0o600 });
 }
 
 // Look up by id first, then by (case-insensitive) name for CLI convenience.
@@ -99,18 +98,48 @@ export function removeRoutine(idOrName: string): Routine | null {
   return target;
 }
 
-// Write a run's result to the routine's output dir: a dated file plus latest.md.
+// Dated result files kept per routine. An hourly routine on an always-on box wrote one
+// every hour, forever; latest.md is what anything reads, and this many is history enough.
+export const ROUTINE_OUTPUT_KEEP = Number(process.env.PRIVATEER_ROUTINE_OUTPUT_KEEP) || 30;
+
+// Write a run's result to the routine's output dir: a dated file plus latest.md, then
+// prune the dated files to the newest ROUTINE_OUTPUT_KEEP. Owner-only, like the rest of
+// the global dir: a result can quote whatever the routine read.
 // Returns the absolute path of latest.md.
 export function writeRoutineOutput(name: string, content: string): string {
   const dir = routineOutputDir(name);
   mkdirSync(dir, { recursive: true });
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-  writeFileSync(join(dir, `${stamp}.md`), content, "utf8");
+  writeFileSync(join(dir, `${stamp}.md`), content, { encoding: "utf8", mode: 0o600 });
   const latest = join(dir, "latest.md");
-  writeFileSync(latest, content, "utf8");
+  writeFileAtomic(latest, content, { mode: 0o600 });
+  pruneRoutineOutput(dir, ROUTINE_OUTPUT_KEEP);
   return latest;
 }
 
+// Our dated names (ISO with ':' and '.' → '-') sort chronologically as strings, so the
+// oldest are first. Only files of that shape are touched — anything else a user put in
+// the folder is theirs. Best-effort: a prune failure never fails a delivery.
+const DATED_OUTPUT = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z\.md$/;
+
+export function pruneRoutineOutput(dir: string, keep: number): number {
+  let removed = 0;
+  try {
+    const dated = readdirSync(dir).filter((f) => DATED_OUTPUT.test(f)).sort();
+    for (const f of dated.slice(0, Math.max(0, dated.length - keep))) {
+      try {
+        unlinkSync(join(dir, f));
+        removed++;
+      } catch {
+        /* already gone */
+      }
+    }
+  } catch {
+    /* unreadable dir */
+  }
+  return removed;
+}
+
 // A pending routine result queued for the next interactive session ("notice"
 // delivery). The TUI drains these on startup so results surface even when no
 // terminal was attached at fire time.
@@ -144,7 +173,7 @@ export function addNotice(notice: RoutineNotice): void {
   notices.push(notice);
   // Keep the queue bounded so an offline stretch can't grow it without limit.
   const trimmed = notices.slice(-50);
-  writeFileSync(noticesPath(), JSON.stringify(trimmed, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  writeFileAtomic(noticesPath(), JSON.stringify(trimmed, null, 2) + "\n", { mode: 0o600 });
   tryChmod(noticesPath(), 0o600);
 }
 
@@ -189,7 +218,7 @@ export function addPendingRelay(entry: PendingRelay): void {
   const queue = loadPendingRelay();
   queue.push(entry);
   const trimmed = queue.slice(-50); // bound the backlog
-  writeFileSync(pendingRelayPath(), JSON.stringify(trimmed, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  writeFileAtomic(pendingRelayPath(), JSON.stringify(trimmed, null, 2) + "\n", { mode: 0o600 });
   tryChmod(pendingRelayPath(), 0o600);
 }
 
@@ -271,6 +300,6 @@ export function addPendingCloud(entry: PendingCloud): void {
 export function savePendingCloud(entries: PendingCloud[]): void {
   const dir = join(globalDir(), "routines");
   mkdirSync(dir, { recursive: true });
-  writeFileSync(pendingCloudPath(), JSON.stringify(entries, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  writeFileAtomic(pendingCloudPath(), JSON.stringify(entries, null, 2) + "\n", { mode: 0o600 });
   tryChmod(pendingCloudPath(), 0o600);
 }

package/src/terminals/backends.ts

@@ -14,20 +14,28 @@
 // easier to match and are worthless as identity: the shell rewrites them on every
 // prompt.
 //
-// THREE BACKENDS, ONE ON PURPOSE PER PLACE. tmux wins whenever we are inside it,
-// because there the "window" the user sees is tmux's, whatever app draws it. Outside
-// tmux: macOS Terminal and iTerm2 through AppleScript. Everything else (Ghostty,
-// kitty, WezTerm, Linux and Windows terminals with no tmux) gets a clear "not here"
-// rather than a guess: focusing a window by name on X11/Wayland/Windows needs a
-// window manager contract we can't count on, and tmux runs everywhere.
+// ONE BACKEND ON PURPOSE PER PLACE. tmux wins whenever we are inside it, because there
+// the "window" the user sees is tmux's, whatever app draws it. Outside tmux: macOS
+// Terminal and iTerm2 through AppleScript, and Git Bash's own window (mintty) on Windows
+// through PowerShell. Everything else (Ghostty, kitty, WezTerm, Windows Terminal, Linux
+// terminals with no tmux) gets a clear "not here" rather than a guess: focusing a window
+// by name there needs a window manager contract we can't count on, and tmux runs
+// everywhere.
+//
+// On Windows there is no tty to go by, so a mintty window's id is its Windows process
+// id: each window is one mintty.exe, and a Privateer inside finds it by walking up its
+// parent processes.
 //
 // AppleScript runs as the terminal app controlling ITSELF (Privateer is a child of the
 // window it draws in). Terminal does this without an Automation prompt (verified);
 // iTerm2 is untested here and may ask once.
 
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 
-export type TerminalApp = "tmux" | "Apple_Terminal" | "iTerm.app";
+export type TerminalApp = "tmux" | "Apple_Terminal" | "iTerm.app" | "mintty";
 
 export interface OpenRequest {
   name: string;
@@ -54,6 +62,12 @@ export interface TerminalBackend {
   selfId(): Promise<string | undefined>;
   /** Is this window the one in front, app and all? undefined when it can't tell. */
   isFront(id: string): Promise<boolean | undefined>;
+  /**
+   * Call `onChange` each time the window with this id comes to the front or goes
+   * behind. Only where the terminal can't say so itself (mintty: see watchFront below).
+   * Returns what stops watching.
+   */
+  watchFront?(id: string, onChange: (front: boolean) => void): () => void;
 }
 
 /** Run a program and hand back stdout; injectable so tests can see the exact calls. */
@@ -355,6 +369,168 @@ export function tmux(exec: Exec = execProgram, env: NodeJS.ProcessEnv = process.
   };
 }
 
+// ── mintty (Git Bash on Windows) ────────────────────────────────────────────
+
+/** Start a program in its own window and hand back its process id. Injectable for tests. */
+export type Launch = (file: string, args: string[], opts: { cwd: string; env: NodeJS.ProcessEnv }) => Promise<number>;
+
+export const launchDetached: Launch = (file, args, opts) =>
+  new Promise((resolve, reject) => {
+    const child = spawn(file, args, { ...opts, detached: true, stdio: "ignore" });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      if (child.pid) resolve(child.pid);
+      else reject(new Error(`${file} started without a process id`));
+    });
+  });
+
+/**
+ * PowerShell, handed its script base64-encoded: the one way to get quotes, braces and
+ * newlines through Windows' command line untouched.
+ */
+export function powershellArgs(script: string): string[] {
+  return ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")];
+}
+
+// The few user32 calls PowerShell can't make on its own.
+const USER32 = `
+Add-Type -Namespace PV -Name U -MemberDefinition @'
+[DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();
+[DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);
+[DllImport("user32.dll")] public static extern bool SetForegroundWindow(IntPtr h);
+[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr h, int cmd);
+[DllImport("user32.dll")] public static extern bool IsIconic(IntPtr h);
+[DllImport("user32.dll")] public static extern void keybd_event(byte key, byte scan, uint flags, UIntPtr extra);
+'@
+function FrontPid { $p = [uint32]0; [PV.U]::GetWindowThreadProcessId([PV.U]::GetForegroundWindow(), [ref]$p) | Out-Null; $p }
+`;
+
+/** Walk up from `pid` to the first mintty.exe; prints "<pid>|<exe path>" or nothing. */
+export const minttyAncestorScript = (pid: number): string => `
+$all = @{}
+foreach ($p in Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,Name,ExecutablePath) { $all[[int]$p.ProcessId] = $p }
+$id = ${Math.trunc(pid)}
+for ($i = 0; $i -lt 32 -and $all.ContainsKey($id); $i++) {
+  $p = $all[$id]
+  if ($p.Name -ieq 'mintty.exe') { Write-Output "$($p.ProcessId)|$($p.ExecutablePath)"; exit }
+  $id = [int]$p.ParentProcessId
+}`;
+
+/**
+ * Bring a window forward. Windows only lets the program in front hand the foreground
+ * over; a tap of Alt is the long-standing way for a helper to be allowed to.
+ */
+export const minttyFocusScript = (pid: number): string => `${USER32}
+$p = Get-Process -Id ${Math.trunc(pid)} -ErrorAction SilentlyContinue
+if (-not $p -or $p.MainWindowHandle -eq 0) { Write-Output 'missing'; exit }
+$h = $p.MainWindowHandle
+if ([PV.U]::IsIconic($h)) { [PV.U]::ShowWindow($h, 9) | Out-Null }
+[PV.U]::keybd_event(0x12, 0, 0, [UIntPtr]::Zero); [PV.U]::keybd_event(0x12, 0, 2, [UIntPtr]::Zero)
+[PV.U]::SetForegroundWindow($h) | Out-Null
+Write-Output 'ok'`;
+
+export const frontPidScript = `${USER32}
+Write-Output (FrontPid)`;
+
+/**
+ * Print the foreground window's process id whenever it changes, until `owner` exits —
+ * a process left behind on Windows isn't ended with its parent. 0 is skipped: there is
+ * no foreground window for a moment during alt-tab, and reporting it would pause the
+ * mic mid-word.
+ */
+export const frontWatchScript = (owner: number): string => `${USER32}
+$last = -1; $n = 0
+while ($true) {
+  $p = FrontPid
+  if ($p -ne 0 -and $p -ne $last) { $last = $p; [Console]::Out.WriteLine($p); [Console]::Out.Flush() }
+  if ((++$n % 10) -eq 0 -and -not (Get-Process -Id ${Math.trunc(owner)} -ErrorAction SilentlyContinue)) { exit }
+  Start-Sleep -Milliseconds 200
+}`;
+
+/** mintty's CSV process list → the ids of every mintty window. */
+export function parseTasklist(out: string): Set<string> {
+  const ids = new Set<string>();
+  for (const line of out.split(/\r?\n/)) {
+    const m = /^"mintty\.exe","(\d+)"/i.exec(line.trim());
+    if (m) ids.add(m[1]!);
+  }
+  return ids;
+}
+
+/** A Windows path as Git Bash reads it: forward slashes. */
+const msysPath = (p: string): string => p.replace(/\\/g, "/");
+
+export function mintty(
+  exec: Exec = execProgram,
+  launch: Launch = launchDetached,
+  env: NodeJS.ProcessEnv = process.env,
+  scripts: { dir: string; write: (path: string, body: string) => void } = { dir: tmpdir(), write: (p, b) => writeFileSync(p, b, { mode: 0o600 }) },
+): TerminalBackend {
+  const ps = (script: string) => exec("powershell.exe", powershellArgs(script));
+  let self: Promise<{ pid: string; exe: string } | undefined> | undefined;
+  const findSelf = () =>
+    (self ??= ps(minttyAncestorScript(process.pid))
+      .then((out) => {
+        const [pid, exe] = out.trim().split("|");
+        return pid && /^\d+$/.test(pid) ? { pid, exe: exe?.trim() || "mintty.exe" } : undefined;
+      })
+      .catch(() => undefined));
+  const live = async () => parseTasklist(await exec("tasklist", ["/FI", "IMAGENAME eq mintty.exe", "/FO", "CSV", "/NH"]));
+  return {
+    app: "mintty",
+    label: "Git Bash",
+    async open(req) {
+      const exe = (await findSelf())?.exe ?? "mintty.exe";
+      const shell = env.SHELL || "/usr/bin/bash";
+      // The command goes in a script file rather than on mintty's command line, where
+      // Windows and Cygwin each have their own idea of quoting. It deletes itself, runs,
+      // and leaves a login shell behind, so the window outlives the command.
+      const file = join(scripts.dir, `privateer-term-${process.pid}-${Date.now()}.sh`);
+      scripts.write(file, `rm -f "$0"\n${shellLine(req.cwd, req.command)}\nexec ${shQuote(shell)} -l\n`);
+      // CHERE_INVOKING keeps Git Bash's login profile from moving the shell to $HOME.
+      const pid = await launch(exe, ["-t", req.name, "-e", shell, "-l", msysPath(file)], {
+        cwd: req.cwd,
+        env: { ...env, CHERE_INVOKING: "1" },
+      });
+      return String(pid);
+    },
+    async focus(id) {
+      return (await ps(minttyFocusScript(Number(id)))).trim() === "ok";
+    },
+    async close(id) {
+      if (!(await live()).has(id)) return false;
+      // /T takes the shell and whatever it runs along with the window.
+      await exec("taskkill", ["/PID", id, "/T", "/F"]);
+      return true;
+    },
+    live,
+    selfId: async () => (await findSelf())?.pid,
+    async isFront(id) {
+      const out = (await ps(frontPidScript)).trim();
+      return /^\d+$/.test(out) ? out === id : undefined;
+    },
+    watchFront(id, onChange) {
+      const child = spawn("powershell.exe", powershellArgs(frontWatchScript(process.pid)), { stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+      let last: boolean | undefined;
+      let buf = "";
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk: string) => {
+        buf += chunk;
+        const lines = buf.split(/\r?\n/);
+        buf = lines.pop() ?? "";
+        for (const line of lines) {
+          if (!/^\d+$/.test(line.trim())) continue;
+          const front = line.trim() === id;
+          if (front !== last) onChange((last = front));
+        }
+      });
+      child.on("error", () => undefined); // no PowerShell: focus just isn't tracked
+      return () => void child.kill();
+    },
+  };
+}
+
 /**
  * The backend for the window this process is in, or why there isn't one. tmux first:
  * inside it, TERM_PROGRAM names the app that draws tmux, not the thing we can drive.
@@ -367,10 +543,11 @@ export function detectBackend(
   if (env.TMUX) return tmux(exec, env);
   if (platform === "darwin" && env.TERM_PROGRAM === "Apple_Terminal") return appleTerminal(exec);
   if (platform === "darwin" && env.TERM_PROGRAM === "iTerm.app") return iTerm(exec);
+  if (platform === "win32" && env.TERM_PROGRAM === "mintty") return mintty(exec);
   const where = env.TERM_PROGRAM ? `${env.TERM_PROGRAM}` : platform === "win32" ? "this Windows terminal" : "this terminal";
   return {
     unsupported:
-      `Named terminals work inside tmux, macOS Terminal and iTerm2 — not in ${where}. ` +
-      `Run privateer inside tmux to use them here.`,
+      `Named terminals work inside tmux, macOS Terminal, iTerm2 and Git Bash's own window (mintty) — not in ${where}. ` +
+      (platform === "win32" ? `Run privateer from the Git Bash window to use them here.` : `Run privateer inside tmux to use them here.`),
   };
 }

package/src/terminals/index.ts

@@ -169,6 +169,29 @@ export async function thisTerminalIsFront(): Promise<boolean | undefined> {
   }
 }
 
+/**
+ * Report whether this window is in front each time that changes, for terminals that
+ * can't tell the program inside themselves (mintty on Windows — see backends.ts). For
+ * privateer-speak's watchFocus; elsewhere the terminal's own focus reports do this, and
+ * it watches nothing.
+ */
+export function watchThisTerminalFocus(report: (front: boolean) => void): () => void {
+  const b = backend();
+  if ("unsupported" in b || !b.watchFront) return () => undefined;
+  let stop: (() => void) | undefined;
+  let stopped = false;
+  void b
+    .selfId()
+    .then((id) => {
+      if (id && !stopped) stop = b.watchFront!(id, report);
+    })
+    .catch(() => undefined);
+  return () => {
+    stopped = true;
+    stop?.();
+  };
+}
+
 export interface TerminalListing {
   records: TerminalRecord[];
   selfId?: string;

package/src/tools/terminal.ts

@@ -33,7 +33,8 @@ export const terminalToolDefinition = {
     "`list` shows every named terminal and marks this one. `close` closes a window and ends what runs in it. " +
     "You can NOT read a terminal's output: for commands whose output you need, use bash or a background task. " +
     "Use this when the user wants to watch or use something themselves, or asks to switch terminals. " +
-    "Works in macOS Terminal, iTerm2, and inside tmux.",
+    "Works in macOS Terminal, iTerm2, Git Bash's own window (mintty) on Windows, and inside tmux. " +
+    "Don't improvise with bash (`start`, `mintty`, `open -a`) when this says it can't: tell the user instead.",
   parameters: Type.Object({
     action: Type.Union(ACTIONS.map((a) => Type.Literal(a)), { description: "What to do." }),
     name: Type.Optional(

package/src/util/atomicWrite.ts

@@ -0,0 +1,46 @@
+// Replace a file all at once: write a sibling temp file, then rename it over the target.
+//
+// A plain writeFileSync truncates first and writes second, so a crash, a full disk or a
+// kill in between leaves a short or empty file. For the files this is used on that is
+// worse than losing the write: loadRoutines() reads a half-written routines.json as "no
+// routines", and the next save from the app then writes just the one routine it holds —
+// every other routine gone. rename() is atomic on one filesystem, so a reader sees the
+// old file or the new one and never anything between.
+//
+// Permissions carry over from the file being replaced (a config.json someone chmod'ed
+// 0600 stays 0600). A new file gets `mode`, default 0600: everything written through
+// here is config that can hold tokens.
+//
+// IMPORT-SAFETY: node builtins only.
+import { chmodSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+
+export function writeFileAtomic(path: string, data: string, opts: { mode?: number } = {}): void {
+  // Follow a symlinked config to the file it names, so we replace the file rather than
+  // the link (which would quietly detach a dotfiles-managed config).
+  let target = path;
+  let mode = opts.mode ?? 0o600;
+  try {
+    target = realpathSync(path);
+    if (opts.mode === undefined) mode = statSync(target).mode & 0o777;
+  } catch {
+    /* new file */
+  }
+  const tmp = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tmp, data, { encoding: "utf8", mode });
+    try {
+      chmodSync(tmp, mode); // writeFileSync's mode is filtered by the umask
+    } catch {
+      /* non-POSIX filesystem */
+    }
+    renameSync(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      /* never created */
+    }
+    throw e;
+  }
+}