pum-agent 0.2.36-beta.1 → 0.2.38-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pum-agent",
-  "version": "0.2.36-beta.1",
+  "version": "0.2.38-beta.1",
   "description": "A compact terminal coding agent powered by pi and OpenTUI.",
   "license": "MIT",
   "type": "module",
@@ -50,8 +50,8 @@
     "pack:check": "bun run scripts/validate-pack.ts"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "^0.87.1",
-    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-ai": "1.1.0",
+    "@earendil-works/pi-coding-agent": "1.1.0",
     "@opentui/core": "^0.5.1",
     "@opentui/react": "^0.5.1",
     "react": "^19.2.8",

package/src/app.tsx

@@ -10,7 +10,7 @@ import { randomUUID } from "node:crypto";
 import { diagnosticsCommandText } from "./request-diagnostics-access";
 import { checkpointControllerForSession, checkpointRecoveryFailureText } from "./file-checkpoints";
 import { VALIDATION_CUSTOM_TYPE, validationForSession } from "./project-validation";
-import type { McpController } from "./mcp";
+import { mcpCommandErrorMessage, type McpController } from "./mcp";
 import type { LspController } from "./lsp";
 import { useKeyboard, usePaste, useRenderer, useTerminalDimensions } from "@opentui/react";
 import { getSupportedThinkingLevels, type Model } from "@earendil-works/pi-ai";
@@ -62,7 +62,6 @@ import {
   rawToolText,
   resolveGoalReview,
   resolvePendingDelivery,
-  settleTranscriptMessage,
   streamedDelta,
   StreamLine,
   TextLine,
@@ -74,6 +73,7 @@ import {
 } from "./transcript";
 import { bashOutput, bashResultDisplay, editCounts, toolArgs, type ToolCall } from "./tool-line";
 import { interruptedToolCall, settledToolCall, startedToolCall } from "./tool-row";
+import { settleAssistantTranscript } from "./provider-error";
 import { toolPreviewFromResult, toolPreviewFromStart } from "./tool-preview";
 import { readBranch, watchBranch } from "./git-branch";
 import { HelpPopup, maxHelpScrollOffset } from "./help-popup";
@@ -2222,7 +2222,7 @@ export function App({
         }
         case "message_end":
           if (event.message.role === "assistant") {
-            setTx((value) => settleTranscriptMessage(value));
+            setTx((value) => settleAssistantTranscript(value, event.message));
           } else if (event.message.role === "custom" && event.message.customType === VALIDATION_CUSTOM_TYPE) {
             append({
               kind: "text",
@@ -4877,9 +4877,9 @@ export function App({
       }
       void controller.command(promptText).then((text) => {
         if (sessionRef.current === session && mcpForSession?.(session) === controller) report(text);
-      }).catch(() => {
+      }).catch((error: unknown) => {
         if (sessionRef.current === session && mcpForSession?.(session) === controller) {
-          report("MCP request failed. Preview /mcp and check the current proposal and digests.", true);
+          report(mcpCommandErrorMessage(error), true);
         }
       });
       return;

package/src/bash-output.ts

@@ -580,7 +580,12 @@ export type BashToolLike = {
     signal?: AbortSignal,
     onUpdate?: (update: { content: unknown[]; details?: unknown }) => void,
     ctx?: unknown,
-  ) => Promise<{ content: Array<{ type: string; text: string }>; details?: { fullOutputPath?: string } }>;
+  ) => Promise<{
+    content: Array<{ type: string; text: string }>;
+    details?: { fullOutputPath?: string };
+    isError?: boolean;
+    structuredContent?: unknown;
+  }>;
 };
 
 export const bashOutputParameters = Type.Object({
@@ -666,16 +671,27 @@ export function withBashOutput(
           await capture.remove();
           return result; // Fail open to pi's bounded native result; never lose output.
         }
-        const source = captured ?? textOf(result.content);
-        const summary = summarizeBashOutput(source, perCall, {
-          exitCode: 0,
+        const nativeText = textOf(result.content);
+        // pi 1.1.0 returns nonzero exits as error results, not thrown Errors.
+        // Keep native status/error identity while summarizing our trusted stream.
+        const exit = result.isError ? EXIT_RE.exec(nativeText) : null;
+        const status = exit ? `Command exited with code ${exit[2]}` : undefined;
+        if (result.isError && !exit) {
+          await capture?.remove();
+          return result; // Unknown error shape: preserve native evidence intact.
+        }
+        const source = captured ?? (exit ? exit[1] : nativeText);
+        const summary = summarizeBashOutput(source, status
+          ? { ...perCall, maxBytes: Math.max(64, perCall.maxBytes - byteLen(status) - 2) }
+          : perCall, {
+          exitCode: exit ? Number(exit[2]) : 0,
           path: capture?.path,
           patterns,
         });
         if (capture && !summary.lossy) await capture.remove();
         return {
           ...result,
-          content: [{ type: "text", text: summary.content }],
+          content: [{ type: "text", text: status ? `${summary.content}\n\n${status}` : summary.content }],
           details: capture && summary.lossy ? { fullOutputPath: capture.path } : result.details,
         };
       } catch (error) {

package/src/file-mutation-guard.ts

@@ -1,4 +1,4 @@
-import { createReadToolDefinition, type ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { createReadToolDefinition, type ExtensionToolContext } from "@earendil-works/pi-coding-agent";
 import { createHash } from "node:crypto";
 import { constants, type Stats } from "node:fs";
 import { lstat, open } from "node:fs/promises";
@@ -138,11 +138,11 @@ export class FileMutationGuard {
   }
 
   /** Preserve native image handling and filename retries; observe only a stable successful read. */
-  async read(id: string, input: any, signal?: AbortSignal, onUpdate?: any, ctx?: ExtensionContext, autoResizeImages?: boolean): Promise<any> {
+  async read(id: string, input: any, signal?: AbortSignal, onUpdate?: any, ctx?: ExtensionToolContext, autoResizeImages?: boolean): Promise<any> {
     const target = await this.target(input.path, "read");
     const before = await this.snapshot(target.path, "read");
     const result = await createReadToolDefinition(this.cwd, { autoResizeImages }).execute(
-      id, input, signal, onUpdate, ctx ?? { cwd: this.cwd } as ExtensionContext,
+      id, input, signal, onUpdate, ctx ?? { cwd: this.cwd } as ExtensionToolContext,
     );
     const after = await this.snapshot(target.path, "read");
     if (!signal?.aborted && !this.disposed && before.fingerprint === after.fingerprint) this.remember(target.key, before);

package/src/main.tsx

@@ -329,6 +329,8 @@ export async function start(
       let mcpSession: AgentSession | undefined;
       let mcpDisposed = false;
       const mcpProcess = createMcpProcessAdapter({ configDir: AGENT_DIR });
+      // LSP keeps the reviewed Linux-only boundary; only the MCP controller uses MXC on Windows.
+      const lspProcess = createMcpProcessAdapter({ configDir: AGENT_DIR, allowWindows: false });
       const mcp: McpController = new McpController({
         cwd,
         spawn: (request) => mcpProcess.spawn(request),
@@ -337,7 +339,7 @@ export async function start(
       });
       const lsp: LspController = new LspController({
         cwd,
-        spawn: (request) => mcpProcess.spawn(request),
+        spawn: (request) => lspProcess.spawn(request),
         isIdle: () => isRuntimeIdle(mcpSession),
         isCurrent: (): boolean => !mcpDisposed && !!mcpSession && lspControllers.get(mcpSession) === lsp,
       });

package/src/mcp-config.ts

@@ -21,8 +21,18 @@ function string(value: unknown, maximum: number): value is string {
 }
 function invalid(): never { throw new Error("Invalid MCP proposal: use the documented bounded version 1 stdio configuration."); }
 
+/** One platform-native absolute executable path. Drive-qualified only on Windows:
+ * drive roots, UNC/device paths, `.`/`..` segments and trailing separators are rejected. */
+export function isAbsoluteMcpExecutable(value: string, platform: NodeJS.Platform): boolean {
+  if (platform === "win32") {
+    return /^[A-Za-z]:[\\/][^\\/]/.test(value)
+      && !value.split(/[\\/]/).slice(1).some((part) => part === "" || part === "." || part === "..");
+  }
+  return posix.isAbsolute(value) && value !== "/";
+}
+
 /** Parsing is not authorization. Unknown transport/auth/environment fields fail closed. */
-export function parseMcpConfig(text: string): McpConfig {
+export function parseMcpConfig(text: string, platform: NodeJS.Platform = process.platform): McpConfig {
   if (Buffer.byteLength(text) > MCP_MAX_CONFIG_BYTES) invalid();
   let value: unknown;
   try { value = JSON.parse(text); } catch { invalid(); }
@@ -32,8 +42,8 @@ export function parseMcpConfig(text: string): McpConfig {
   const servers = value.servers.map((entry): McpServerConfig => {
     if (!object(entry) || !keys(entry, ["name", "executable", "args"])
       || typeof entry.name !== "string" || !namePattern.test(entry.name) || names.has(entry.name)
-      || !string(entry.executable, 4096) || !posix.isAbsolute(entry.executable)
-      || entry.executable === "/" || !Array.isArray(entry.args) || entry.args.length > 16
+      || !string(entry.executable, 4096) || !isAbsoluteMcpExecutable(entry.executable, platform)
+      || !Array.isArray(entry.args) || entry.args.length > 16
       || !entry.args.every((argument) => string(argument, 1024))) invalid();
     names.add(entry.name);
     return { name: entry.name, executable: entry.executable, args: [...entry.args] as string[] };

package/src/mcp-process.ts

@@ -1,11 +1,12 @@
-import { lstat, opendir, realpath } from "node:fs/promises";
+import { lstat, mkdtemp, opendir, realpath, rm } from "node:fs/promises";
 import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { posix } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { posix, win32, join } from "node:path";
 import { AGENT_DIR } from "./config";
 import { isCredentialSensitivePath } from "./credential-path";
 import { createBubblewrapBackend } from "./sandbox/linux";
-import type { SandboxPolicy, SandboxProcessHandle } from "./sandbox/types";
+import { createWindowsSandboxBackend } from "./sandbox/windows";
+import type { SandboxBackend, SandboxPolicy, SandboxProcessHandle } from "./sandbox/types";
 
 export interface McpProcessRequest {
   executable: string;
@@ -28,13 +29,17 @@ export const MCP_MAX_PENDING_WRITES = 64;
 export const MCP_WRITE_TIMEOUT_MS = 5_000;
 export const MCP_CLOSE_GRACE_MS = 1_000;
 const failure = () => new Error("MCP process unavailable or blocked by native policy");
+/** Only the adapter may identify an unavailable mandatory native boundary. */
+export class McpNativeUnavailableError extends Error {
+  constructor() { super("MCP native enforcement unavailable (Linux Bubblewrap or Windows MXC BaseContainer)"); }
+}
 
 export const MCP_SCAN_MAX_ENTRIES = 50_000;
 export const MCP_SCAN_MAX_DEPTH = 32;
 export const MCP_SCAN_MAX_MASKS = 2_048;
 export const MCP_SCAN_MAX_PATH_BYTES = 256 * 1024;
 export const MCP_SCAN_TIMEOUT_MS = 5_000;
-export interface McpProcessAdapterOptions { configDir?: string }
+export interface McpProcessAdapterOptions { configDir?: string; platform?: NodeJS.Platform; allowWindows?: boolean; windowsBackend?: SandboxBackend }
 
 const within = (root: string, path: string) => path === root || path.startsWith(root === "/" ? "/" : `${root}/`);
 /** Pure comparison after caller validation/canonicalization; no authority grant. */
@@ -157,24 +162,184 @@ export async function buildMcpProcessPolicy(
   } catch { throw failure(); }
 }
 
+async function spawnLinuxMcp(request: McpProcessRequest, options: McpProcessAdapterOptions): Promise<McpProcessHandle> {
+  const bubblewrap = ["/usr/bin/bwrap", "/bin/bwrap"].find(existsSync);
+  if (!bubblewrap) throw new McpNativeUnavailableError();
+  const backend = createBubblewrapBackend({ executable: bubblewrap, systemMounts: MCP_SYSTEM_MOUNTS });
+  if ((await backend.probe()).state !== "enforced") throw new McpNativeUnavailableError();
+  if (request.signal?.aborted) throw failure();
+  const policy = await buildMcpProcessPolicy(request, options);
+  if (request.signal?.aborted) throw failure();
+  return manageMcpProcessHandle(backend.spawn(policy, {
+    persistentStdin: true, signal: request.signal,
+    onStdout: request.onStdout, onStderr: request.onStderr,
+  }), request.signal ?? new AbortController().signal);
+}
+
+const WINDOWS_DRIVE = /^[A-Za-z]:[\\/]/;
+const pathControls = /[\x00-\x1f\x7f\u202a-\u202e\u2066-\u2069]/;
+/** Drive-qualified absolute only: drive roots, UNC/device, `.`/`..` and separators fail. */
+function windowsSafe(value: string): boolean {
+  return typeof value === "string" && WINDOWS_DRIVE.test(value) && !pathControls.test(value)
+    && !value.split(/[\\/]/).slice(1).some((part) => part === "" || part === "." || part === "..");
+}
+function windowsSame(a: string, b: string): boolean {
+  return win32.normalize(a).toLowerCase() === win32.normalize(b).toLowerCase();
+}
+function windowsWithin(root: string, path: string): boolean {
+  const r = win32.normalize(root).toLowerCase();
+  const p = win32.normalize(path).toLowerCase();
+  const base = r.endsWith("\\") ? r : `${r}\\`;
+  return p === r || p.startsWith(base);
+}
+/** Canonical path without link/junction components; checks compare lowercased spellings. */
+async function windowsExactPath(value: string, directory: boolean): Promise<string> {
+  if (!windowsSafe(value)) throw failure();
+  const normalized = win32.normalize(value);
+  const parts = normalized.split(/[\\/]+/).slice(1);
+  let prefix = /^[A-Za-z]:/.exec(normalized)![0];
+  for (let index = 0; index < parts.length; index++) {
+    const part = parts[index]!;
+    if (!part) continue;
+    prefix = `${prefix}\\${part}`;
+    const stat = await lstat(prefix);
+    // Only ancestors must be directories; the final component may be the file.
+    if (stat.isSymbolicLink() || (index < parts.length - 1 && !stat.isDirectory())) throw failure();
+  }
+  const final = await lstat(normalized);
+  if (final.isSymbolicLink() || (directory ? !final.isDirectory() : !final.isFile())) throw failure();
+  const canonical = (await realpath(normalized)).replace(/^\\\\\?\\/u, "");
+  if (!windowsSame(canonical, normalized)) throw failure();
+  return win32.normalize(canonical);
+}
+/** Bind the config directory and every ancestor for this policy build; never guessed. */
+async function windowsConfigBoundary(path: string): Promise<{ path: string; identity: string }> {
+  const canonical = await windowsExactPath(path, true);
+  const identities: string[] = [];
+  let prefix = /^[A-Za-z]:/.exec(canonical)![0];
+  for (const part of canonical.split(/[\\/]+/).slice(1)) {
+    if (!part) continue;
+    prefix = `${prefix}\\${part}`;
+    const stat = await lstat(prefix);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw failure();
+    identities.push(`${prefix.toLowerCase()}:${stat.dev}:${stat.ino}`);
+  }
+  if (!windowsSame(await windowsExactPath(path, true), canonical)) throw failure();
+  return { path: canonical, identity: identities.join("\n") };
+}
+
+/** Windows MCP policy: exact cwd and executable file readonly, config denied, no network.
+ * The adapter owns the real private temp; this builder only validates and records it. */
+export async function buildWindowsMcpProcessPolicy(
+  request: Pick<McpProcessRequest, "cwd" | "executable" | "args" | "signal">,
+  options: McpProcessAdapterOptions & { privateTemp?: string } = {},
+): Promise<SandboxPolicy> {
+  try {
+    const start = Date.now();
+    const check = () => { if (request.signal?.aborted || Date.now() - start > MCP_SCAN_TIMEOUT_MS) throw failure(); };
+    check();
+    const cwd = await windowsExactPath(request.cwd, true);
+    const executable = await windowsExactPath(request.executable, false);
+    const configInput = options.configDir ?? AGENT_DIR;
+    const boundary = await windowsConfigBoundary(configInput);
+    const forbidden = [...new Set([win32.normalize(configInput), boundary.path])];
+    const home = await realpath(homedir());
+    const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? "C:\\Windows";
+    const privateTemp = options.privateTemp ?? "";
+    if (!windowsSafe(privateTemp) || home === cwd || windowsWithin(cwd, home)
+      || isCredentialSensitivePath(cwd) || isCredentialSensitivePath(executable)
+      || forbidden.some((path) => windowsWithin(path, cwd) || windowsWithin(path, executable))
+      || windowsWithin(systemRoot, cwd) || windowsWithin(systemRoot, configInput) || windowsWithin(configInput, systemRoot)
+      || windowsWithin(privateTemp, cwd) || windowsWithin(privateTemp, executable)
+      || windowsWithin(cwd, privateTemp) || windowsWithin(executable, privateTemp)) throw failure();
+    const tempStat = await lstat(privateTemp);
+    if (!tempStat.isDirectory() || tempStat.isSymbolicLink()) throw failure();
+    if (!Array.isArray(request.args) || request.args.length > 16 || request.args.some((arg) =>
+      typeof arg !== "string" || Buffer.byteLength(arg) > 1024
+      || /[\x00-\x1f\x7f\u202a-\u202e\u2066-\u2069]/.test(arg))) throw failure();
+    let entries = 0;
+    let maskBytes = 0;
+    const deniedPaths: string[] = [];
+    const mask = (path: string) => {
+      deniedPaths.push(path);
+      maskBytes += Buffer.byteLength(path);
+      if (deniedPaths.length > MCP_SCAN_MAX_MASKS || maskBytes > MCP_SCAN_MAX_PATH_BYTES) throw failure();
+    };
+    const scan = async (directory: string, depth: number): Promise<void> => {
+      check();
+      if (depth > MCP_SCAN_MAX_DEPTH || (await lstat(directory)).isSymbolicLink()
+        || !windowsSame(await realpath(directory), directory)) throw failure();
+      for await (const entry of await opendir(directory)) {
+        check();
+        if (++entries > MCP_SCAN_MAX_ENTRIES) throw failure();
+        const path = win32.join(directory, entry.name);
+        const sensitive = isCredentialSensitivePath(`${path}\\`) || isCredentialSensitivePath(path)
+          || forbidden.some((root) => windowsWithin(root, path));
+        const stat = await lstat(path);
+        if (sensitive) {
+          if (stat.isSymbolicLink()) throw failure();
+          mask(path);
+        } else if (stat.isDirectory()) await scan(path, depth + 1);
+        else if (!stat.isFile() && !stat.isSymbolicLink()) throw failure();
+      }
+    };
+    await scan(cwd, 0);
+    const currentBoundary = await windowsConfigBoundary(configInput);
+    if (currentBoundary.path !== boundary.path || currentBoundary.identity !== boundary.identity) throw failure();
+    check();
+    if (deniedPaths.some((path) => windowsWithin(path, executable))) throw failure();
+    return {
+      version: 1, exactCommand: "MCP approved stdio process", executable, args: [...request.args], cwd,
+      readOnlyPaths: [cwd, executable], readWritePaths: [], deniedPaths,
+      privateTemp,
+      environment: {
+        PATH: `${win32.join(systemRoot, "System32")};${systemRoot}`,
+        SystemRoot: systemRoot, HOME: privateTemp, USERPROFILE: privateTemp,
+      },
+      network: "deny",
+      rationale: "Explicitly approved readonly live-project Windows MCP (MXC BaseContainer); masks are check-time defense in depth",
+      accesses: [],
+    };
+  } catch { throw failure(); }
+}
+
+async function spawnWindowsMcp(request: McpProcessRequest, options: McpProcessAdapterOptions): Promise<McpProcessHandle> {
+  const backend = options.windowsBackend ?? createWindowsSandboxBackend();
+  const capability = await backend.probe();
+  if (capability.state !== "enforced") throw new McpNativeUnavailableError();
+  if (request.signal?.aborted) throw failure();
+  const privateTemp = await mkdtemp(join(tmpdir(), "pum-mcp-private-"));
+  let child: SandboxProcessHandle;
+  try {
+    const policy = await buildWindowsMcpProcessPolicy(request, { ...options, privateTemp });
+    if (request.signal?.aborted) throw failure();
+    child = backend.spawn(policy, {
+      persistentStdin: true, signal: request.signal, onStdout: request.onStdout, onStderr: request.onStderr,
+    });
+  } catch (error) {
+    await rm(privateTemp, { recursive: true, force: true }).catch(() => {});
+    throw error;
+  }
+  const completed = child.completed.finally(() => rm(privateTemp, { recursive: true, force: true }).catch(() => {}));
+  return manageMcpProcessHandle({ ...child, completed }, request.signal ?? new AbortController().signal);
+}
+
 /** No startup work until spawn. The controller, not this adapter, owns consent.
- * Mandatory Linux Bubblewrap regardless of Check mode; never a direct fallback. */
+ * Mandatory platform-native enforcement regardless of Check mode; never a direct fallback.
+ * Linux requires Bubblewrap; Windows requires MXC BaseContainer (never AppContainer+DACL). */
 export function createMcpProcessAdapter(options: McpProcessAdapterOptions = {}): McpProcessAdapter {
+  const platform = options.platform ?? process.platform;
   return {
     async spawn(request) {
       try {
-        if (process.platform !== "linux" || request.signal?.aborted) throw failure();
-        const bubblewrap = ["/usr/bin/bwrap", "/bin/bwrap"].find(existsSync);
-        if (!bubblewrap) throw failure();
-        const backend = createBubblewrapBackend({ executable: bubblewrap, systemMounts: MCP_SYSTEM_MOUNTS });
-        if ((await backend.probe()).state !== "enforced" || request.signal?.aborted) throw failure();
-        const policy = await buildMcpProcessPolicy(request, options);
         if (request.signal?.aborted) throw failure();
-        return manageMcpProcessHandle(backend.spawn(policy, {
-          persistentStdin: true, signal: request.signal,
-          onStdout: request.onStdout, onStderr: request.onStderr,
-        }), request.signal ?? new AbortController().signal);
-      } catch { throw failure(); }
+        if (platform === "linux") return spawnLinuxMcp(request, options);
+        if (platform === "win32" && options.allowWindows !== false) return spawnWindowsMcp(request, options);
+        throw new McpNativeUnavailableError();
+      } catch (error) {
+        if (error instanceof McpNativeUnavailableError && !request.signal?.aborted) throw error;
+        throw failure();
+      }
     },
   };
 }

package/src/mcp-protocol.ts

@@ -3,6 +3,8 @@
  * basic/lifecycle,basic/utilities/cancellation,server/tools}.
  * This deliberately rejects unsupported JSON Schema keywords rather than claiming full coverage.
  */
+import { McpNativeUnavailableError } from "./mcp-process";
+
 export const MCP_PROTOCOL_VERSION = "2025-11-25";
 export const MCP_LIMITS = Object.freeze({ frameBytes: 256 * 1024, stdoutBytes: 16 * 1024 * 1024,
   discoveryBytes: 256 * 1024, tools: 32, pages: 4, schemaBytes: 16 * 1024,
@@ -228,7 +230,12 @@ export class McpProtocolClient {
       return client;
     };
     try { return await Promise.race([start(), stopped]); }
-    catch { client.closeWith("MCP connection failed."); throw new Error("MCP connection failed."); }
+    catch (error) {
+      const nativeUnavailable = !signal?.aborted && error instanceof McpNativeUnavailableError;
+      client.closeWith("MCP connection failed.");
+      if (nativeUnavailable) throw new McpNativeUnavailableError();
+      throw new Error("MCP connection failed.");
+    }
     finally { clearTimeout(timer); }
   }
   private assertOpen(): void { if (this.closed || !this.handle) throw new Error("MCP connection closed."); }

package/src/mcp.ts

@@ -4,6 +4,7 @@ import { dirname, join, resolve } from "node:path";
 import { Type } from "typebox";
 import { defineTool, type AgentSession, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { readMcpProposal, type McpProposal } from "./mcp-config";
+import { McpNativeUnavailableError } from "./mcp-process";
 import { McpProtocolClient, type McpSpawn, type McpTool } from "./mcp-protocol";
 
 type Connection = { digest: string; abort: AbortController; client?: McpProtocolClient; tools?: McpTool[]; toolset?: string; approved: boolean };
@@ -12,7 +13,18 @@ const digestPattern = /^[a-f0-9]{64}$/;
 const serverPattern = /^[a-z][a-z0-9_-]{0,31}$/;
 const textResult = (text: string) => ({ content: [{ type: "text" as const, text }], details: {} });
 const unavailable = () => new Error("MCP access unavailable: direct main-TUI connection and exact toolset approval are required.");
-const scope = "Linux native Bubblewrap required, even with Check Off; no fallback or network. Live project read-only, private scratch writable; filtered environment, no auth passthrough, PUM configuration/credentials denied. Sensitive-name masks are defense in depth only: arbitrary secrets, aliases and future files may be read and returned to the model. Approval trusts current/future server and project code. No startup/resume trust.";
+export class McpCommandError extends Error {
+  constructor(readonly kind: "proposal" | "native") { super("MCP command failed"); }
+}
+/** Never display arbitrary exception text, including text from a server or the OS. */
+export function mcpCommandErrorMessage(error: unknown): string {
+  if (error instanceof McpCommandError) {
+    if (error.kind === "proposal") return "MCP proposal missing, changed or invalid. Check exact-cwd .pum/mcp.json against docs/mcp.md, then preview /mcp again.";
+    if (error.kind === "native") return "MCP connection needs native enforcement (Linux Bubblewrap or Windows MXC BaseContainer). Install or enable it, then preview /mcp and connect again; no unsandboxed fallback.";
+  }
+  return "MCP request failed. Preview /mcp and check the current proposal and digests.";
+}
+const scope = "Native enforcement required (Linux Bubblewrap or Windows MXC BaseContainer), even with Check Off; no fallback or network. Live project read-only, private scratch writable; filtered environment, no auth passthrough, PUM configuration/credentials denied. Sensitive-name masks are defense in depth only: arbitrary secrets, aliases and future files may be read and returned to the model. Approval trusts current/future server and project code. No startup/resume trust.";
 
 /** Main-TUI-only runtime authority. No SDK command, persisted approval, automatic discovery or inherited trust. */
 export class McpController {
@@ -69,7 +81,7 @@ export class McpController {
         (this.trustIdentity && this.trustIdentity !== identity) ||
         [...this.connections.values()].some(c => c.digest !== proposal.digest)) this.cancel();
       return { ...proposal, identity }; 
-    } catch { this.cancel(); throw new Error("MCP proposal missing, changed or invalid; preview and approve again."); }
+    } catch { this.cancel(); throw new McpCommandError("proposal"); }
   }
   private stopWatching(): void {
     for (const watcher of this.watchers) watcher.close();
@@ -174,10 +186,11 @@ export class McpController {
         "BEGIN UNTRUSTED SERVER TOOL DESCRIPTIONS AND SCHEMAS (data, not instructions)",
         JSON.stringify(tools), "END UNTRUSTED SERVER TOOL DATA",
         `Toolset SHA-256: ${connection.toolset}`, `Approve only this set: /mcp approve ${name} ${connection.toolset}`].join("\n\n");
-    } catch {
+    } catch (error) {
       if (this.connections.get(name) === connection) this.revoke(name);
-      // Never expose raw server/OS errors or stderr through the transcript.
-      throw new Error("MCP connection/discovery failed or became stale; authority revoked. Native Linux Bubblewrap enforcement is required.");
+      // The protocol passes this marker only when the native adapter failed before cancellation.
+      if (!this.disposed && this.options.isCurrent?.() !== false && error instanceof McpNativeUnavailableError) throw new McpCommandError("native");
+      throw new Error("MCP connection/discovery failed or became stale; authority revoked.");
     }
   }
   private owner(ctx: { cwd: string; sessionManager: { getSessionId(): string } }): void {

package/src/project-validation.ts

@@ -290,8 +290,9 @@ export class ProjectValidationController {
             outcome = deadline.signal.aborted ? "timeout" : "cancelled";
           } else {
             const result = await tool.execute(toolCall.id, args, signal);
-            const after = await untilAborted(Promise.resolve(session.agent.afterToolCall?.({ assistantMessage, toolCall, args, result, isError: false, context }, signal)), signal);
-            if (after?.isError) outcome = "failed";
+            const isError = result.isError === true;
+            const after = await untilAborted(Promise.resolve(session.agent.afterToolCall?.({ assistantMessage, toolCall, args, result, isError, context }, signal)), signal);
+            if (after?.isError ?? isError) outcome = "failed";
             output = (after?.content ?? result.content).filter((item) => item.type === "text").map((item) => item.text).join("\n");
           }
         } catch (error) {

package/src/provider-error.ts

@@ -0,0 +1,66 @@
+import { flushStream, settleTranscriptMessage, type Line, type PendingTranscriptState } from "./transcript";
+
+/** Redact entire header values, not just the scheme or first credential token. */
+function redactAuthorization(text: string): string {
+  const header = /(["']?\b(?:proxy-)?authorization["']?\s*[:=]\s*)/gi;
+  let safe = "";
+  let copied = 0;
+  for (let match = header.exec(text); match; match = header.exec(text)) {
+    const start = header.lastIndex;
+    let end = start;
+    let quote = "";
+    for (; end < text.length; end++) {
+      const char = text[end]!;
+      if (quote) {
+        // JSON-escaped Digest quotes are part of the value, not its boundary.
+        if (char === "\\") { end++; continue; }
+        if (char === quote) quote = "";
+        continue;
+      }
+      if (char === '"' || char === "'") { quote = char; continue; }
+      // Digest commas and arbitrary scheme whitespace/semicolons can contain
+      // credentials. Only a structured next field or explicit schema diagnostic
+      // is a safe boundary; ambiguous/unclosed values consume the remaining text.
+      if (char === "," && /^,\s*["'][^"'\n]+["']\s*:/.test(text.slice(end))) break;
+      if (char === ";" && /^;\s*(?:[45]\d\d\s+)?tools\.\d+\.custom\b/.test(text.slice(end))) break;
+    }
+    safe += text.slice(copied, start) + "[redacted]";
+    copied = end;
+    header.lastIndex = end;
+  }
+  return safe + text.slice(copied);
+}
+
+/** Provider text is untrusted display data, never a diagnostic or durable rewrite. */
+export function providerErrorLine(message: unknown): Line | null {
+  const assistant = message as { role?: unknown; stopReason?: unknown; errorMessage?: unknown } | null;
+  // An aborted response can also carry errorMessage; cancellation is not failure.
+  if (assistant?.role !== "assistant" || assistant.stopReason !== "error") return null;
+  const raw = typeof assistant.errorMessage === "string" ? assistant.errorMessage : "";
+  // As in login-flow.safeError, redact credential-shaped keys. Provider failures
+  // can also echo headers/JSON or an OAuth URL, so remove those before bounding.
+  const normalized = raw
+    // Normalize control sequences first so they cannot split a credential marker.
+    .replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "")
+    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "")
+    .replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f\u202a-\u202e\u2066-\u2069]/g, "");
+  const safe = redactAuthorization(normalized)
+    .replace(/https?:\/\/[^\s<>"']+/gi, "[redacted URL]")
+    .replace(/\bBearer\s+[^\s,"'}]+/gi, "Bearer [redacted]")
+    // Quoted JSON/header values may contain escaped quotes or span whitespace.
+    // An unterminated quoted secret is redacted through the end, never partially.
+    .replace(/(["']?\b(?:api[_ -]?key|x-api-key|access[_ -]?token|refresh[_ -]?token|password|secret|client[_ -]?secret)["']?\s*[:=]\s*)(?:"(?:\\[\s\S]|[^"\\])*(?:"|\\?$)|'(?:\\[\s\S]|[^'\\])*(?:'|\\?$)|[^\s,}\n]+)/gi, "$1[redacted]")
+    .replace(/\b(?:sk|key|token)-[A-Za-z0-9_.-]{8,}\b/gi, "[redacted]")
+    .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+|AKIA[A-Z0-9]{16}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)\b/g, "[redacted]")
+    .trim();
+  const detail = safe ? safe.slice(0, 4000) + (safe.length > 4000 ? "…" : "") : "The request failed without an error description.";
+  return { kind: "text", role: "error", text: `Provider error: ${detail}` };
+}
+
+/** Finish partial output before its failure, then deliver queued messages. */
+export function settleAssistantTranscript<T extends PendingTranscriptState>(value: T, message: unknown): T {
+  const error = providerErrorLine(message);
+  if (!error) return settleTranscriptMessage(value);
+  const flushed = flushStream(value);
+  return settleTranscriptMessage({ ...flushed, lines: [...flushed.lines, error] });
+}

package/src/replay.ts

@@ -1,4 +1,5 @@
 import type { AgentMessageKind, Line } from "./transcript";
+import { providerErrorLine } from "./provider-error";
 import { toolArgs, type ToolCall } from "./tool-line";
 import { interruptedToolCall, settledToolCall, startedToolCall } from "./tool-row";
 import {
@@ -303,8 +304,8 @@ export function replayEntries(
       continue;
     }
 
-    if (message?.role === "assistant" && Array.isArray(message.content)) {
-      for (const block of message.content) {
+    if (message?.role === "assistant") {
+      for (const block of Array.isArray(message.content) ? message.content : []) {
         if (block?.type === "text" && block.text?.trim()) {
           lines.push({ kind: "text", role: "assistant", text: block.text.trim() });
         } else if (showThinking && block?.type === "thinking" && block.thinking?.trim()) {
@@ -322,6 +323,8 @@ export function replayEntries(
           lines.push({ kind: "tool", call });
         }
       }
+      const error = providerErrorLine(message);
+      if (error) lines.push(error);
       continue;
     }
 

package/src/sandbox/windows.ts

@@ -154,11 +154,14 @@ function sandboxEnvironment(policy: SandboxPolicy): string[] {
   return entries.map(([name, value]) => `${name}=${value}`);
 }
 
-/** Build the exact stable MXC 0.7 ProcessContainer configuration used for a run. */
+/** Build the exact stable MXC 0.7 ProcessContainer configuration used for a run.
+ * `runtimePaths` follows the writable-mutable Bash convention: grant the executable's
+ * runtime directory. MCP is stricter and passes false: only the exact executable file. */
 export function buildWindowsMxcConfig(
   sdk: Pick<MxcSdk, "createConfigFromPolicy">,
   policy: SandboxPolicy,
   timeoutSeconds?: number,
+  options: { runtimePaths?: boolean } = {},
 ): ContainerConfig {
   const timeoutMs = timeoutSeconds === undefined ? 0 : Math.ceil(timeoutSeconds * 1000);
   if (timeoutSeconds !== undefined && (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0)) {
@@ -168,10 +171,11 @@ export function buildWindowsMxcConfig(
     throw new Error("Invalid timeout: maximum is 2147483.647 seconds");
   }
 
+  const runtimePaths = options.runtimePaths === false ? [] : windowsRuntimePaths(policy.executable);
   const mxcPolicy: MxcPolicy = {
     version: "0.7.0-alpha",
     filesystem: {
-      readonlyPaths: uniqueWindowsPaths([...policy.readOnlyPaths, ...windowsRuntimePaths(policy.executable)]),
+      readonlyPaths: uniqueWindowsPaths([...policy.readOnlyPaths, ...runtimePaths]),
       readwritePaths: uniqueWindowsPaths([...policy.readWritePaths, policy.privateTemp]),
       deniedPaths: uniqueWindowsPaths(policy.deniedPaths),
       clearPolicyOnExit: true,
@@ -295,7 +299,10 @@ function startSandboxProcess(
     });
 
     child.stdin?.on("error", () => {});
-    child.stdin?.end(options.stdin ? Buffer.from(options.stdin) : undefined);
+    // A persistent protocol owns the stdin pipe after spawn; one-shot stdin closes now.
+    if (!options.persistentStdin) {
+      child.stdin?.end(options.stdin ? Buffer.from(options.stdin) : undefined);
+    }
   });
 }
 
@@ -316,6 +323,23 @@ export class MxcSandboxBackend implements SandboxBackend {
   spawn(policy: SandboxPolicy, options: SandboxProcessOptions): SandboxProcessHandle {
     let child: ChildProcess | undefined;
     let killRequested = false;
+    let stdinClosed = false;
+    const pendingWrites: { data: string; resolve(): void; reject(error: Error): void }[] = [];
+    const rejectWrites = (error: Error) => {
+      for (const write of pendingWrites.splice(0)) write.reject(error);
+    };
+    const dispatch = (entry: { data: string; resolve(): void; reject(error: Error): void }) => {
+      const stdin = child?.stdin;
+      if (!stdin || stdin.destroyed || stdin.writableEnded || stdinClosed) {
+        entry.reject(new Error("Persistent process input is closed"));
+        return;
+      }
+      try {
+        stdin.write(entry.data, "utf8", (error) => error ? entry.reject(error) : entry.resolve());
+      } catch (error) {
+        entry.reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    };
     const completed = (async () => {
       if (this.#platform !== "win32") throw new Error("MXC ProcessContainer requires Windows");
       if (options.signal?.aborted) throw new Error("aborted");
@@ -325,14 +349,30 @@ export class MxcSandboxBackend implements SandboxBackend {
       return startSandboxProcess(sdk, policy, options, (spawned) => {
         child = spawned;
         if (killRequested) child.kill();
+        for (const entry of pendingWrites.splice(0)) dispatch(entry);
+        if (stdinClosed) child.stdin?.end();
       });
     })();
+    void completed.catch(() => rejectWrites(new Error("Persistent process input is closed")));
     return {
       completed,
       kill: () => {
         killRequested = true;
         child?.kill();
       },
+      ...(options.persistentStdin ? {
+        write(data: string): Promise<void> {
+          return new Promise<void>((resolve, reject) => {
+            const entry = { data, resolve, reject };
+            if (child?.stdin) dispatch(entry);
+            else pendingWrites.push(entry);
+          });
+        },
+        closeInput(): void {
+          stdinClosed = true;
+          child?.stdin?.end();
+        },
+      } : {}),
     };
   }
 }

package/src/subagents/manager.ts

@@ -20,6 +20,7 @@ import {
   usageFromEntries,
 } from "../agent-usage";
 import { replayEntries } from "../replay";
+import { settleAssistantTranscript } from "../provider-error";
 import { registerOperationalNotice } from "../operational-context";
 import { bindFileCheckpointSession } from "../file-checkpoints";
 import { ProjectValidationController, VALIDATION_CUSTOM_TYPE } from "../project-validation";
@@ -76,7 +77,6 @@ import { GOAL_VERDICT_TOOL_NAME, goalVerdictParameters } from "../goal-judge";
 import {
   flushStream,
   resolvePendingDelivery,
-  settleTranscriptMessage,
   streamedDelta,
   type Line,
   type PendingLine,
@@ -1041,7 +1041,7 @@ export class SubagentManager {
           this.appendLine(record, { kind: "text", role: event.message.details?.outcome === "passed" ? "system" : "error", text: String(event.message.content) });
         }
         if (event.message?.role === "assistant") {
-          this.updateTranscript(record, (value) => settleTranscriptMessage(value));
+          this.updateTranscript(record, (value) => settleAssistantTranscript(value, event.message));
         }
         break;
       case "message_update": {