scream-code 0.16.8 → 0.16.9

package/dist/{dispatch-CNitkOqX.mjs → dispatch-CIOuINvn.mjs}

@@ -4,9 +4,9 @@ import { dirname as __cjsShimDirname } from 'node:path';
 const __filename = __cjsShimFileURLToPath(import.meta.url);
 const __dirname = __cjsShimDirname(__filename);
 import { i as __require, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-D90kvbyJ.mjs";
-import { A as classifyEmbeddingFailure, B as rankMemos, C as applyConsolidation, D as parseMemoryMemos, E as buildExitExtractionPrompt, F as createMemoryMemo, G as normalize$1, H as dirname$2, I as toSummary, J as resolve$2, K as parse$7, L as generateTags, M as createFastEmbedEngine, N as hasEmbeddingModelCache$1, O as stripMemoryTags, P as probeLocalEmbeddingSupport, R as normalizeTags, S as DreamTracker, T as EXIT_EXTRACTION_SYSTEM_PROMPT, U as isAbsolute$1, V as basename$1, W as join$1, a as isSupportedFile, b as sharedKnowledgeStoreReady, i as ingestFile, j as clearEmbeddingModelCache, k as MemoryMemoStore, q as relative$1, r as ingestDirectory, t as multiSearch, w as buildConsolidationPlan, y as sharedKnowledgeStore, z as buildProjectTagCloud } from "./src-CXmZg1VT.mjs";
+import { A as classifyEmbeddingFailure, B as rankMemos, C as applyConsolidation, D as parseMemoryMemos, E as buildExitExtractionPrompt, F as createMemoryMemo, G as normalize, H as dirname$2, I as toSummary, J as resolve$2, K as parse$7, L as generateTags, M as createFastEmbedEngine, N as hasEmbeddingModelCache$1, O as stripMemoryTags, P as probeLocalEmbeddingSupport, R as normalizeTags, S as DreamTracker, T as EXIT_EXTRACTION_SYSTEM_PROMPT, U as isAbsolute$1, V as basename$1, W as join$1, a as isSupportedFile, b as sharedKnowledgeStoreReady, i as ingestFile, j as clearEmbeddingModelCache, k as MemoryMemoStore, q as relative$1, r as ingestDirectory, t as multiSearch, w as buildConsolidationPlan, y as sharedKnowledgeStore, z as buildProjectTagCloud } from "./src-BhZujafw.mjs";
 import { t as require_base64_js } from "./base64-js-DzVmk6Nb.mjs";
-import { a as setLocale, i as getLocale, n as assertScreamHostIdentity, o as t, r as createScreamDefaultHeaders, t as TextInputDialogComponent } from "./text-input-dialog-6v2667rm.mjs";
+import { a as setLocale, i as getLocale, n as assertScreamHostIdentity, o as t, r as createScreamDefaultHeaders, t as TextInputDialogComponent } from "./text-input-dialog-XT3cOEjD.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import * as fs$1 from "node:fs/promises";
@@ -24,12 +24,12 @@ import * as NodeWs from "ws";
 import * as fs$10 from "node:fs";
 import Vt, { appendFileSync, chmodSync, closeSync, constants, createReadStream, createWriteStream as createWriteStream$1, existsSync, fchmodSync, fsyncSync, mkdirSync, openSync, promises, readFileSync, readSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import * as path$8 from "node:path";
-import path, { basename, dirname as dirname$1, extname, isAbsolute, join, normalize, posix, relative, resolve, sep, win32 } from "node:path";
+import path, { basename, dirname as dirname$1, extname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
+import * as nodeOs from "node:os";
+import { homedir, release, tmpdir } from "node:os";
 import { z } from "zod";
 import { exec, execFile, execSync, spawn, spawnSync } from "node:child_process";
 import { promisify } from "node:util";
-import * as nodeOs from "node:os";
-import { homedir, release, tmpdir } from "node:os";
 import * as vs from "zlib";
 import Qr from "zlib";
 import { diffLines, diffWords } from "diff";
@@ -38,6 +38,7 @@ import { StringDecoder } from "node:string_decoder";
 import Pi from "assert";
 import ro from "node:assert";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as posixPath from "node:path/posix";
 import * as win32Path from "node:path/win32";
 import { createServer } from "node:http";
@@ -48,7 +49,6 @@ import * as z4mini from "zod/v4-mini";
 import process$1 from "node:process";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
-import { AsyncLocalStorage } from "node:async_hooks";
 import chalk from "chalk";
 import { Box, Container, Image, Input, Key, Markdown, Marked, Spacer, Text, decodeKittyPrintable, fuzzyFilter, getCapabilities, getImageDimensions, matchesKey, sliceByColumn, truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@liutod-scream/pi-tui";
 import { highlight, supportsLanguage } from "cli-highlight";
@@ -47417,6 +47417,20 @@ function resolveGlobalLogPath(homeDir) {
 	return join$1(homeDir, "logs", "scream-code.log");
 }
 //#endregion
+//#region ../../packages/agent-core/src/config/path.ts
+function resolveScreamHome(homeDir) {
+	return homeDir ?? process.env["SCREAM_CODE_HOME"] ?? join$1(homedir(), ".scream-code");
+}
+function resolveConfigPath(input) {
+	return input.configPath ?? join$1(resolveScreamHome(input.homeDir), "config.toml");
+}
+function ensureScreamHome(homeDir) {
+	mkdirSync(homeDir, {
+		recursive: true,
+		mode: 448
+	});
+}
+//#endregion
 //#region ../../node_modules/.pnpm/@antfu+utils@9.3.0/node_modules/@antfu/utils/dist/index.mjs
 function uniq(array) {
 	return Array.from(new Set(array));
@@ -50853,15 +50867,15 @@ function canonicalizePath(path, cwd, pathClass = DEFAULT_PATH_CLASS) {
 	const normalizedPath = normalizeUserPath(path, pathClass);
 	if (pathClass === "win32" && isWin32DriveRelative(normalizedPath)) throw new PathSecurityError("PATH_INVALID", path, normalizedPath, `"${path}" is a drive-relative Windows path. Use an absolute path like C:\\path or a path relative to the working directory.`);
 	if (!isAbsolute$1(normalizedPath) && !isAbsolute$1(cwd)) throw new PathSecurityError("PATH_INVALID", path, normalizedPath, `Cannot resolve "${path}" against non-absolute cwd "${cwd}".`);
-	return normalize$1(isAbsolute$1(normalizedPath) ? normalizedPath : resolve$2(cwd, normalizedPath));
+	return normalize(isAbsolute$1(normalizedPath) ? normalizedPath : resolve$2(cwd, normalizedPath));
 }
 /**
 * True iff `candidate` is `base` itself or a descendant of it, compared
 * on path-component boundaries. Both arguments must already be canonical.
 */
 function isWithinDirectory$1(candidate, base, pathClass = DEFAULT_PATH_CLASS) {
-	const nc = normalize$1(candidate);
-	const nb = normalize$1(base);
+	const nc = normalize(candidate);
+	const nb = normalize(base);
 	const comparableCandidate = pathClass === "win32" ? nc.toLowerCase() : nc;
 	const comparableBase = pathClass === "win32" ? nb.toLowerCase() : nb;
 	if (comparableCandidate === comparableBase) return true;
@@ -53888,7 +53902,7 @@ var KnowledgeLookupTool = class {
 				const llm = { generate: async (systemPrompt, userPrompt) => {
 					return this.agent.generateText(systemPrompt, userPrompt);
 				} };
-				const { multiSearchWithTrace } = await import("./src-DIAKpkXO.mjs");
+				const { multiSearchWithTrace } = await import("./src-CUURS-i6.mjs");
 				const { results, trace } = await multiSearchWithTrace(store, llm, query, {
 					topK,
 					skipLlm: args.deep !== true
@@ -59089,7 +59103,7 @@ const MANAGED_SKILL_ROOT_NAMES = new Set([".scream-code", ".agents"]);
 * `<...>/.agents/skills`.
 */
 function resolveSkillInstallUnit(skillPath) {
-	let current = normalize$1(skillPath).replaceAll("\\", "/");
+	let current = normalize(skillPath).replaceAll("\\", "/");
 	while (true) {
 		const parent = dirname$2(current).replaceAll("\\", "/");
 		if (parent === current || parent === ".") throw new Error(`Skill path "${skillPath}" is not under a managed skill root`);
@@ -64334,6 +64348,89 @@ function escapeXml(input) {
 	return input.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
 }
 //#endregion
+//#region ../../packages/agent-core/src/utils/path-safety.ts
+/**
+* Cross-platform path classification for call sites that must decide whether
+* a path is absolute and whether it sits inside a directory.
+*
+* The paths reaching these helpers need not match the host OS: a
+* Windows-shaped path can arrive at a macOS/Linux process (a config value, a
+* remote workspace, a session recorded on another machine). `node:path`
+* derives absoluteness from `process.platform`, so `C:\x` and
+* `\\server\share` silently read as ordinary relative names there and get
+* appended under a directory the caller never intended. These helpers instead
+* classify every supported flavour explicitly — POSIX (`/x`, `\x`), Windows
+* drive (`C:\x`, `C:/x`, drive-relative `C:x`) and UNC
+* (`\\server\share`) — on top of `pathe`, the path library the rest of this
+* package uses.
+*/
+/** `C:`, `C:\x`, `C:/x`, and the drive-relative `C:x`. */
+const WINDOWS_DRIVE = /^[A-Za-z]:/;
+/** `\\server\share` and `//server/share`. */
+const WINDOWS_UNC = /^[/\\]{2}[^/\\]/;
+/** True when `path` is written in Windows syntax (drive-qualified or UNC). */
+function usesWindowsSyntax(path) {
+	return WINDOWS_DRIVE.test(path) || WINDOWS_UNC.test(path);
+}
+/**
+* Normalize a candidate that declares its own root.
+*
+* `//x` is UNC syntax only next to a Windows `base`: a POSIX caller passing
+* `//work/file.ts` means the POSIX path `/work/file.ts`, and comparing the
+* doubled slash as written would place a file inside the working directory
+* outside it. The Windows `\\server\share` spelling is left alone — it is UNC
+* in every context, and folding it into the POSIX namespace would widen the
+* check instead of narrowing it.
+*/
+function normalizeRootedCandidate(candidate, baseIsWindows) {
+	if (!baseIsWindows && candidate.startsWith("//")) return normalize(candidate.replace(/^\/+/, "/"));
+	return normalize(candidate);
+}
+/**
+* True when `path` names its own root instead of one relative to a base:
+* POSIX-absolute (`/x`, `\x`), UNC-rooted, or drive-qualified. `isAbsolute`
+* covers the first three; the drive test adds `C:x`, which is relative to
+* *the drive's* current directory and therefore equally unappendable under a
+* base.
+*/
+function declaresOwnRoot(path) {
+	return isAbsolute$1(path) || WINDOWS_DRIVE.test(path);
+}
+/**
+* True when `candidate` is `base` itself or a descendant of it.
+*
+* A relative `candidate` is resolved against `base`; one that declares its
+* own root is compared as written, so `C:\outside\f.txt` is outside a POSIX
+* `base` on every host. Comparison is made on path components (`/work-evil`
+* is not inside `/work`) and case-insensitively when both sides use Windows
+* syntax, because Windows filenames are case-insensitive.
+*/
+function isPathInside(base, candidate) {
+	const basePath = normalize(base);
+	const baseIsWindows = usesWindowsSyntax(basePath);
+	const candidatePath = declaresOwnRoot(candidate) ? normalizeRootedCandidate(candidate, baseIsWindows) : join$1(basePath, candidate);
+	const foldCase = baseIsWindows && usesWindowsSyntax(candidatePath);
+	const lhs = foldCase ? basePath.toLowerCase() : basePath;
+	const rhs = foldCase ? candidatePath.toLowerCase() : candidatePath;
+	if (lhs === rhs) return true;
+	return rhs.startsWith(lhs.endsWith("/") ? lhs : `${lhs}/`);
+}
+/**
+* True when `candidate` may be appended under a directory: it declares no
+* root of its own and does not climb out of the directory it is appended to.
+*
+* The check is lexical and runs on the normalized form, so `a/../b.txt` is
+* accepted while `../b.txt`, `a/../../x` and `sub/..` are rejected. Only
+* `..` path *components* are unsafe — `..foo.txt` is an ordinary file name.
+*/
+function isSafeRelativePath(candidate) {
+	if (candidate.trim().length === 0) return false;
+	if (declaresOwnRoot(candidate)) return false;
+	const normalized = normalize(candidate);
+	if (normalized === "." || normalized === "..") return false;
+	return !normalized.startsWith("../");
+}
+//#endregion
 //#region ../../packages/agent-core/src/tools/builtin/skill/skill-package-writer.ts
 const SKILL_TYPE_SCHEMA = z.enum([
 	"workflow",
@@ -67610,12 +67707,6 @@ function isScreamNativeBinary() {
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/skill/plugin-skill-package-writer.ts
 const MANIFEST_FILE = "scream.plugin.json";
-function isSafeRelativePath(filePath) {
-	const normalized = normalize$1(filePath);
-	if (normalized.startsWith("..")) return false;
-	if (normalize$1("/" + normalized).startsWith("..")) return false;
-	return !normalized.startsWith("/");
-}
 async function writePluginSkillPackage(options) {
 	const { jian, screamHomeDir, manager, package: pkg } = options;
 	const name = sanitizeSkillName(pkg.name);
@@ -67642,7 +67733,7 @@ async function writePluginSkillPackage(options) {
 		const files = pkg.files ?? [];
 		for (const file of files) {
 			if (!isSafeRelativePath(file.path)) throw new ScreamError(ErrorCodes.REQUEST_INVALID, `Unsafe supporting file path "${file.path}". Paths must be relative and cannot escape the skill directory.`);
-			const filePath = join$1(targetDir, normalize$1(file.path));
+			const filePath = join$1(targetDir, normalize(file.path));
 			const fileDir = dirname$2(filePath);
 			if (fileDir !== targetDir) await jian.mkdir(fileDir, {
 				parents: true,
@@ -69043,8 +69134,8 @@ var GlobTool = class {
 * should be canonical absolute paths.
 */
 function relativizeIfUnder$1(candidate, base, pathClass) {
-	const normCandidate = normalize$1(candidate);
-	const normBase = normalize$1(base);
+	const normCandidate = normalize(candidate);
+	const normBase = normalize(base);
 	const comparableCandidate = pathClass === "win32" ? normCandidate.toLowerCase() : normCandidate;
 	const comparableBase = pathClass === "win32" ? normBase.toLowerCase() : normBase;
 	if (comparableCandidate === comparableBase) return ".";
@@ -72086,7 +72177,7 @@ const RG_ARCHIVE_SHA256 = {
 */
 async function ensureRgPath(options = {}) {
 	options.signal?.throwIfAborted();
-	const resolution = resolveRgPath(options.shareDir ?? getShareDir(), options.signal);
+	const resolution = resolveRgPath(options.shareDir ?? resolveScreamHome(), options.signal);
 	return options.signal === void 0 ? resolution : abortable(resolution, options.signal);
 }
 async function resolveRgPath(shareDir, signal) {
@@ -72107,7 +72198,7 @@ async function findExistingRg(shareDir) {
 		source: "system-path"
 	};
 	const cachePath = join$1(shareDir, "bin", binName);
-	if (await isExecutableFile(cachePath)) return {
+	if (await fileExists$1(cachePath)) return {
 		path: cachePath,
 		source: "share-bin-cached"
 	};
@@ -72132,11 +72223,6 @@ async function downloadRgWithLock(shareDir) {
 function rgBinaryName() {
 	return process.platform === "win32" ? "rg.exe" : "rg";
 }
-function getShareDir() {
-	const override = process.env["SCREAM_CODE_HOME"];
-	if (override !== void 0 && override !== "") return override;
-	return join$1(homedir(), ".scream-code");
-}
 async function whichRg() {
 	const pathEnv = process.env["PATH"] ?? "";
 	const sep = process.platform === "win32" ? ";" : ":";
@@ -72149,29 +72235,143 @@ async function whichRg() {
 		} catch {}
 	}
 }
-async function isExecutableFile(p) {
+async function fileExists$1(p) {
 	try {
 		return (await stat(p)).isFile();
 	} catch {
 		return false;
 	}
 }
-/** @internal for tests — rust-style `<arch>-<vendor>-<os>` target triple. */
-function detectTarget() {
-	const arch = process.arch === "x64" ? "x86_64" : process.arch === "arm64" ? "aarch64" : void 0;
-	if (arch === void 0) return void 0;
-	if (process.platform === "darwin") return `${arch}-apple-darwin`;
-	if (process.platform === "linux") return arch === "x86_64" ? "x86_64-unknown-linux-musl" : "aarch64-unknown-linux-gnu";
-	if (process.platform === "win32") return `${arch}-pc-windows-msvc`;
+/** Rust target-triple arch component, for the Node arches ripgrep ships binaries for. */
+const TARGET_ARCH = {
+	x64: "x86_64",
+	arm64: "aarch64"
+};
+/** Node arch → the arch component musl uses in its dynamic loader file name. */
+const LINUX_LOADER_ARCH = {
+	x64: "x86_64",
+	arm64: "aarch64"
+};
+/**
+* Decide whether the Linux host is musl- or glibc-based.
+*
+* The libc is probed, never inferred from the arch: a glibc-linked binary
+* cannot exec on a musl host, so guessing wrong hands the user a broken `rg`.
+* Three positive signals, each cheap, then a documented default:
+*
+*   1. `/etc/alpine-release` — Alpine states its own libc here, and the marker
+*      wins over the probes below because Alpine also ships a glibc-compat
+*      shim that would otherwise make the next signal claim "glibc".
+*   2. Node's diagnostic report `header.glibcVersionRuntime` — populated only
+*      when the *running* binary bound to glibc, so it is strong evidence for
+*      distros that carry no marker file.
+*   3. The musl dynamic loader `/lib/ld-musl-<arch>.so.1` — covers non-Alpine
+*      musl distros and musl container images.
+*   4. Default `glibc`: the Linux baseline. A wrong guess here only changes the
+*      outcome on aarch64 Linux, where it selects the glibc build.
+*/
+async function detectLinuxLibc(probe = {}) {
+	const isFile = probe.isFile ?? fileExists$1;
+	if (await isFile("/etc/alpine-release")) return "musl";
+	const glibcVersion = (probe.glibcVersionRuntime ?? nodeGlibcVersionRuntime)();
+	if (glibcVersion !== void 0 && glibcVersion.length > 0) return "glibc";
+	const loaderArch = LINUX_LOADER_ARCH[probe.arch ?? process.arch];
+	if (loaderArch !== void 0 && await isFile(`/lib/ld-musl-${loaderArch}.so.1`)) return "musl";
+	return "glibc";
+}
+function nodeGlibcVersionRuntime() {
+	try {
+		const version = process.report.getReport().header?.glibcVersionRuntime;
+		return typeof version === "string" ? version : void 0;
+	} catch {
+		return;
+	}
 }
-async function downloadAndInstallRg(shareDir) {
-	const target = detectTarget();
-	if (target === void 0) throw new Error(`Unsupported platform/arch for ripgrep download: ${process.platform}/${process.arch}`);
+/**
+* The single decision tree behind {@link detectTarget} and
+* {@link resolveRgArchive}: one place that knows which host maps to which
+* upstream release, so the "which target" and "why is there none" answers
+* cannot drift apart.
+*
+* Linux is the only platform whose libc matters, and upstream publishes exactly
+* one Linux build per arch:
+*   - x86_64: the static musl build only. Static musl runs unchanged on glibc
+*     hosts, so both libcs resolve to the same archive and no probe is needed.
+*   - aarch64: the glibc build only, so musl (e.g. Alpine) has no build at all.
+*/
+async function decideTarget(probe) {
+	const nodeArch = probe.arch ?? process.arch;
+	const arch = TARGET_ARCH[nodeArch];
+	if (arch === void 0) return {
+		kind: "unavailable",
+		reason: `unsupported architecture '${nodeArch}'`
+	};
+	const platform = probe.platform ?? process.platform;
+	if (platform === "darwin") return {
+		kind: "target",
+		target: `${arch}-apple-darwin`
+	};
+	if (platform === "win32") return {
+		kind: "target",
+		target: `${arch}-pc-windows-msvc`
+	};
+	if (platform !== "linux") return {
+		kind: "unavailable",
+		reason: `unsupported platform '${platform}'`
+	};
+	if (arch === "x86_64") return {
+		kind: "target",
+		target: "x86_64-unknown-linux-musl"
+	};
+	if (await (probe.detectLinuxLibc !== void 0 ? probe.detectLinuxLibc() : detectLinuxLibc({ arch: nodeArch })) === "glibc") return {
+		kind: "target",
+		target: "aarch64-unknown-linux-gnu"
+	};
+	return {
+		kind: "unavailable",
+		reason: `no upstream ripgrep ${RG_VERSION} release exists for aarch64 Linux with musl (Alpine ARM64); upstream publishes glibc only for aarch64`
+	};
+}
+/**
+* Build the download plan for one target triple, or throw when that archive is
+* not pinned in {@link RG_ARCHIVE_SHA256}. Kept separate from
+* {@link resolveRgArchive} so the pin gate is directly testable without
+* inventing a reachable-but-unpinned host.
+*
+* @internal for tests
+*/
+function pinnedRgArchive(target) {
 	const isWindows = target.includes("windows");
-	const archiveName = `ripgrep-${RG_VERSION}-${target}.${isWindows ? "zip" : "tar.gz"}`;
-	const expectedSha256 = RG_ARCHIVE_SHA256[archiveName];
-	if (expectedSha256 === void 0) throw new Error(`No pinned SHA-256 is configured for ripgrep archive ${archiveName}`);
-	const url = `${RG_BASE_URL}/${archiveName}`;
+	const name = `ripgrep-${RG_VERSION}-${target}.${isWindows ? "zip" : "tar.gz"}`;
+	const sha256 = RG_ARCHIVE_SHA256[name];
+	if (sha256 === void 0) throw new Error(`No pinned SHA-256 is configured for ripgrep archive ${name}, so it will not be downloaded. Install ripgrep with your package manager and re-run.`);
+	return {
+		target,
+		name,
+		url: `${RG_BASE_URL}/${name}`,
+		sha256,
+		isWindows
+	};
+}
+/**
+* Resolve the release archive to bootstrap — the only download gate.
+*
+* Throws (never falls back to a different target) when the host has no
+* supported build or when the resulting archive is not in
+* {@link RG_ARCHIVE_SHA256}: downloading bytes we cannot verify against a
+* pinned digest is worse than telling the user to install ripgrep themselves.
+* Callers turn the thrown message into user-facing text with
+* {@link rgUnavailableMessage}.
+*
+* @internal for tests
+*/
+async function resolveRgArchive(probe = {}) {
+	const decision = await decideTarget(probe);
+	if (decision.kind === "unavailable") throw new Error(`No automatic ripgrep bootstrap is available on this host: ${decision.reason}. Install ripgrep with your package manager and re-run.`);
+	return pinnedRgArchive(decision.target);
+}
+async function downloadAndInstallRg(shareDir) {
+	const { name: archiveName, target, url, sha256: expectedSha256, isWindows } = await resolveRgArchive();
 	const binDir = join$1(shareDir, "bin");
 	await mkdir(binDir, { recursive: true });
 	const destination = join$1(binDir, rgBinaryName());
@@ -72291,7 +72491,7 @@ async function extractRgFromZip(archivePath, destination) {
 function rgUnavailableMessage(cause) {
 	return `ripgrep (rg) is not available and the automatic bootstrap failed.
 
-Error: ${cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "unknown error"}\n\nFix options:\n  macOS:   brew install ripgrep\n  Ubuntu:  sudo apt-get install ripgrep\n  Other:   https://github.com/BurntSushi/ripgrep#installation\n\nAlternatively, drop a static rg binary at ${join$1(getShareDir(), "bin", rgBinaryName())}`;
+Error: ${cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "unknown error"}\n\nFix options:\n  macOS:   brew install ripgrep\n  Ubuntu:  sudo apt-get install ripgrep\n  Other:   https://github.com/BurntSushi/ripgrep#installation\n\nAlternatively, drop a static rg binary at ${join$1(resolveScreamHome(), "bin", rgBinaryName())}`;
 }
 //#endregion
 //#region ../../packages/agent-core/src/tools/support/rg-pattern-sanitize.ts
@@ -73034,8 +73234,8 @@ function formatDisplayLine(line, mode, workspaceDir, pathClass, contentIncludesL
 * canonical absolute paths in the active backend path class.
 */
 function relativizeIfUnder(candidate, base, pathClass) {
-	const normCandidate = normalize$1(candidate);
-	const normBase = normalize$1(base);
+	const normCandidate = normalize(candidate);
+	const normBase = normalize(base);
 	const comparableCandidate = pathClass === "win32" ? normCandidate.toLowerCase() : normCandidate;
 	const comparableBase = pathClass === "win32" ? normBase.toLowerCase() : normBase;
 	if (comparableCandidate === comparableBase) return ".";
@@ -73122,21 +73322,21 @@ function normalizeContextSeparators(lines) {
 	return normalized;
 }
 function parsedFilePath(line, mode, pathClass) {
-	if (line.kind === "record") return normalize$1(line.filePath);
+	if (line.kind === "record") return normalize(line.filePath);
 	if (line.kind === "separator") return void 0;
 	const text = line.text;
-	if (mode === "files_with_matches") return normalize$1(text);
+	if (mode === "files_with_matches") return normalize(text);
 	if (mode === "count_matches") {
 		const idx = text.lastIndexOf(":");
-		return idx > 0 ? normalize$1(text.slice(0, idx)) : normalize$1(text);
+		return idx > 0 ? normalize(text.slice(0, idx)) : normalize(text);
 	}
 	return extractContentFilePath(text, pathClass);
 }
 function extractContentFilePath(line, pathClass) {
 	const m = CONTENT_LINE_RE.exec(line);
-	if (m?.[1] !== void 0) return normalize$1(m[1]);
+	if (m?.[1] !== void 0) return normalize(m[1]);
 	const separatorIndex = noLineNumberContentSeparatorIndex(line, pathClass);
-	return separatorIndex > 0 ? normalize$1(line.slice(0, separatorIndex)) : void 0;
+	return separatorIndex > 0 ? normalize(line.slice(0, separatorIndex)) : void 0;
 }
 function noLineNumberContentSeparatorIndex(line, pathClass) {
 	const searchFrom = pathClass === "win32" && /^[A-Za-z]:/.test(line) ? 2 : 0;
@@ -75170,7 +75370,7 @@ function resolveEntrySource$1(source, location) {
 }
 function resolveLocalPath$1(input, workDir) {
 	if (input === "~") return homedir();
-	if (input.startsWith("~/")) return join(homedir(), input.slice(2));
+	if (input.startsWith("~/") || input.startsWith("~\\")) return join(homedir(), input.slice(2));
 	return isAbsolute(input) ? input : resolve(workDir ?? process.cwd(), input);
 }
 function stringField$1(value, field) {
@@ -76404,7 +76604,7 @@ function splitSegments(value) {
 }
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/shell/bash.md
-var bash_default = "Execute a `{{ SHELL_NAME }}` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\n\n**Translate these to a dedicated tool instead:**\n- `cat` / `head` / `tail` (known path) → `Read`\n- `sed` / `awk` (in-place edit) → `Edit`\n- `echo > file` / `cat <<EOF` → `Write`\n- `find` / recursive `ls` to locate files by name pattern → `Glob` (plain `ls <known-directory>` is fine for listing a directory)\n- `grep` / `rg` (search file contents) → `Grep`\n- `echo` / `printf` (talk to the user) → just output text directly\n\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\n\n**Output:**\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command failed, the output will end with a `Command failed with exit code: N` line stating the non-zero exit code.\n\nIf `run_in_background=true`, the command will be started as a background task and this tool will return a task ID instead of waiting for command completion. When doing that, you must provide a short `description`. Background commands default to a {{ DEFAULT_BACKGROUND_TIMEOUT_S }}s timeout and `timeout` is capped at {{ MAX_BACKGROUND_TIMEOUT_S }}s; set `disable_timeout=true` only when the task should run without a timeout. You will be automatically notified when the task completes. Use `TaskOutput` for a non-blocking status/output snapshot, and only set `block=true` when you explicitly want to wait for completion. Use `TaskStop` only if the task must be cancelled. If a human user wants to inspect background tasks themselves, point them to the `/tasks` command, which opens an interactive panel; it has no subcommands.\n\n**Guidelines for safety and security:**\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls.\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running foreground commands, set the `timeout` argument in seconds. Foreground commands default to {{ DEFAULT_TIMEOUT_S }}s and allow up to {{ MAX_TIMEOUT_S }}s.\n- Avoid using `..` to access files or directories outside of the working directory.\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\n\n**Guidelines for efficiency:**\n- For multiple related commands, use `&&` to chain them in a single call, e.g. `cd /path && ls -la`\n- Use `;` to run commands sequentially regardless of success/failure\n- Use `||` for conditional execution (run second command only if first fails)\n- Use pipe operations (`|`) and redirections (`>`, `>>`) to chain input and output between commands\n- Always quote file paths containing spaces with double quotes (e.g., cd \"/path with spaces/\")\n- Compose multi-step logic in a single call with `if` / `case` / `for` / `while` control flows.\n- Prefer `run_in_background=true` for long-running builds, tests, watchers, or servers when you need the conversation to continue before the command finishes.\n\n**Commands available:**\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt run `which <command>` first to confirm a command exists before relying on it.\n- Navigation and inspection: `ls`, `pwd`, `cd`, `stat`, `file`, `du`, `df`, `tree`\n- File and directory management: `cp`, `mv`, `rm`, `mkdir`, `touch`, `ln`, `chmod`, `chown`\n- Text and data processing: `wc`, `sort`, `uniq`, `cut`, `tr`, `diff`, `xargs`\n- Archives and compression: `tar`, `gzip`, `gunzip`, `zip`, `unzip`\n- Networking and transfer: `curl`, `wget`, `ping`, `ssh`, `scp`\n- Version control: `git`\n- Process and system: `ps`, `kill`, `top`, `env`, `date`, `uname`, `whoami`\n- Language and package toolchains: `node`, `npm`, `pnpm`, `yarn`, `python`, `pip` (use whichever the project actually relies on)\n";
+var bash_default = "Execute a `{{ SHELL_NAME }}` command. Use this for shell semantics — pipes, env, processes, git, package managers, build/test runners, anything genuinely interactive or multi-step.\n\n**Translate these to a dedicated tool instead:**\n- `cat` / `head` / `tail` (known path) → `Read`\n- `sed` / `awk` (in-place edit) → `Edit`\n- `echo > file` / `cat <<EOF` → `Write`\n- `find` / recursive `ls` to locate files by name pattern → `Glob` (plain `ls <known-directory>` is fine for listing a directory)\n- `grep` / `rg` (search file contents) → `Grep`\n- `echo` / `printf` (talk to the user) → just output text directly\n\nThe dedicated tools render in the per-tool permission UI and keep raw stdout out of the conversation; that is why they are worth reaching for whenever one fits.\n\n**Output:**\nThe stdout and stderr will be combined and returned as a string. The output may be truncated if it is too long. If the command failed, the output will end with a `Command failed with exit code: N` line stating the non-zero exit code.\n\nIf `run_in_background=true`, the command will be started as a background task and this tool will return a task ID instead of waiting for command completion. When doing that, you must provide a short `description`. Background commands default to a {{ DEFAULT_BACKGROUND_TIMEOUT_S }}s timeout and `timeout` is capped at {{ MAX_BACKGROUND_TIMEOUT_S }}s; set `disable_timeout=true` only when the task should run without a timeout. You will be automatically notified when the task completes. Use `TaskOutput` for a non-blocking status/output snapshot, and only set `block=true` when you explicitly want to wait for completion. Use `TaskStop` only if the task must be cancelled. If a human user wants to inspect background tasks themselves, point them to the `/tasks` command, which opens an interactive panel; it has no subcommands.\n\n**Guidelines for safety and security:**\n- Each shell tool call will be executed in a fresh shell environment. The shell variables, current working directory changes, and the shell history is not preserved between calls.\n- The tool call will return after the command is finished. You shall not use this tool to execute an interactive command or a command that may run forever. For possibly long-running foreground commands, set the `timeout` argument in seconds. Foreground commands default to {{ DEFAULT_TIMEOUT_S }}s and allow up to {{ MAX_TIMEOUT_S }}s.\n- Avoid using `..` to access files or directories outside of the working directory.\n- Avoid modifying files outside of the working directory unless explicitly instructed to do so.\n- Never run commands that require superuser privileges unless explicitly instructed to do so.\n\n**Guidelines for efficiency:**\n{%- if SHELL_IS_POWERSHELL %}\n- Chain with `;` to run commands sequentially. `&&` / `||` only exist from PowerShell 7 and are a parse error on Windows PowerShell 5.1, so do not use them; write `; if ($?) { … }` when the next step must run only if the previous one succeeded.\n- Filter and transform with pipelines (`Get-ChildItem | Where-Object …`); redirect with `>` / `>>`.\n- Quote paths containing spaces with single quotes, e.g. `Set-Location 'C:\\Program Files'`.\n- Read environment variables as `$env:NAME` (`$env:NAME = 'value'`), never `$NAME`.\n- Compose multi-step logic in a single call with `if` / `foreach` / `while` and `try` / `catch`.\n{%- else %}\n- For multiple related commands, use `&&` to chain them in a single call, e.g. `cd /path && ls -la`\n- Use `;` to run commands sequentially regardless of success/failure\n- Use `||` for conditional execution (run second command only if first fails)\n- Use pipe operations (`|`) and redirections (`>`, `>>`) to chain input and output between commands\n- Always quote file paths containing spaces with double quotes (e.g., cd \"/path with spaces/\")\n- Compose multi-step logic in a single call with `if` / `case` / `for` / `while` control flows.\n{%- endif %}\n- Prefer `run_in_background=true` for long-running builds, tests, watchers, or servers when you need the conversation to continue before the command finishes.\n\n**Commands available:**\nThe following common command categories are usually available. Availability still depends on the host, so when in doubt {% if SHELL_IS_POWERSHELL %}confirm a command exists with `Get-Command <name> -ErrorAction SilentlyContinue` before relying on it — several names below are cmdlet aliases (`ls` → `Get-ChildItem`, `rm` → `Remove-Item`), and POSIX-only entries such as `uname`, `chmod` and `kill` may be absent.{% else %}run `which <command>` first to confirm a command exists before relying on it.{% endif %}\n- Navigation and inspection: `ls`, `pwd`, `cd`, `stat`, `file`, `du`, `df`, `tree`\n- File and directory management: `cp`, `mv`, `rm`, `mkdir`, `touch`, `ln`, `chmod`, `chown`\n- Text and data processing: `wc`, `sort`, `uniq`, `cut`, `tr`, `diff`, `xargs`\n- Archives and compression: `tar`, `gzip`, `gunzip`, `zip`, `unzip`\n- Networking and transfer: `curl`, `wget`, `ping`, `ssh`, `scp`\n- Version control: `git`\n- Process and system: `ps`, `kill`, `top`, `env`, `date`, `uname`, `whoami`\n- Language and package toolchains: `node`, `npm`, `pnpm`, `yarn`, `python`, `pip` (use whichever the project actually relies on)\n";
 //#endregion
 //#region ../../packages/agent-core/src/tools/builtin/shell/background-tasks.ts
 /**
@@ -76466,13 +76666,27 @@ function drainCompletedBackgroundTasks() {
 /**
 * BashTool — execute shell commands.
 *
-* Invokes bash (POSIX) according to an injected `Environment`. On Windows
-* the shell is Git Bash; the path is resolved by `detectEnvironment`.
+* Invokes whichever shell an injected `Environment` selected, in that shell's
+* own dialect:
+*
+*   - POSIX (`bash` / `sh`, including Git Bash on Windows) — `-c` with a
+*     POSIX-quoted `cd … && …` script. Windows Git Bash additionally gets its
+*     cwd converted to a `/c/…` path and its `>nul` redirects rewritten.
+*   - PowerShell (`pwsh` / `powershell`, the Windows fallback when no Git Bash
+*     is installed) — the interpreter's own `-NoProfile -NonInteractive
+*     -Command` switches, the working directory set with `Set-Location
+*     -LiteralPath`, the path left in its native `C:\…` form, its own
+*     self-protection preamble (the bash shims are a parse error here), and no
+*     bash syntax anywhere.
+*
+* The switches come from `Environment.shellArgs`; the dialect from
+* `Environment.shellName`. Neither is re-derived here, so a host whose probe
+* picked a fallback shell is actually driven with that shell.
 *
 * Dependencies injected via constructor:
 *   - `Jian`        — shell execution abstraction (exec / execWithEnv)
 *   - `cwd`         — default working directory for commands
-*   - `Environment` — cross-platform probe (shellName / shellPath)
+*   - `Environment` — cross-platform probe (shellName / shellPath / shellArgs)
 *   - `BackgroundProcessManager?` — optional: required iff run_in_background=true
 *
 * Execution goes through Jian, never directly via node:child_process.
@@ -76496,6 +76710,28 @@ const SIGTERM_GRACE_MS = 5e3;
 /** After the process exits, how long to keep draining stdout/stderr before
 * declaring completion (grandchildren may hold the pipe open). */
 const STREAM_GRACE_MS = 500;
+/**
+* Which dialect `env` selected. `shellName` is the probe's answer to "which
+* interpreter is this", so it decides the dialect; `osKind` does not, because
+* Windows carries either dialect depending on whether Git Bash was found.
+*/
+function shellKindOf(env) {
+	return env.shellName === "pwsh" || env.shellName === "powershell" ? "powershell" : "posix";
+}
+/**
+* Non-interactive script switches, used only when the `Environment` pins a
+* shell path without args. Mirrors what `detectEnvironment` puts in
+* `Environment.shellArgs`, so a hand-built environment behaves like a probed
+* one: `-c` for bash/sh, and no profile / no prompt for PowerShell.
+*/
+const DEFAULT_SHELL_ARGS = {
+	posix: ["-c"],
+	powershell: [
+		"-NoProfile",
+		"-NonInteractive",
+		"-Command"
+	]
+};
 const BashInputSchema = z.object({
 	command: z.string().min(1, "Command cannot be empty.").describe("The command to execute."),
 	cwd: z.string().optional().describe("The working directory in which to run the command. When omitted, the command runs in the session's working directory."),
@@ -76535,14 +76771,25 @@ function isValidTimeoutValue(timeout, isBackground) {
 function normalizeTimeoutMs(timeout, isBackground) {
 	return Math.min(timeout ?? (isBackground ? DEFAULT_BACKGROUND_TIMEOUT_S : DEFAULT_TIMEOUT_S), timeoutCapS(isBackground)) * MS_PER_SECOND;
 }
-function renderBashDescription(shellName) {
+function renderBashDescription(shellName, isPowerShell) {
 	return renderPrompt(bash_default, {
 		...SHELL_TIMEOUT_VARS,
-		SHELL_NAME: shellName
+		SHELL_NAME: shellName,
+		SHELL_IS_POWERSHELL: isPowerShell
 	});
 }
+/**
+* The description with its background-mode paragraph replaced by a refusal.
+*
+* The replacements below match literal template text, and the first one anchors
+* on a blank line (`\n\n`). A checkout whose line endings are CRLF — which is
+* what Windows runners get from Git by default — renders that blank line as
+* `\r\n\r\n`, so the anchor never matches and the background paragraph survives
+* into a tool that cannot run background commands. Normalise the line endings
+* first: the result must not depend on how the template file was checked out.
+*/
 function withoutBackgroundDescription(description) {
-	return description.replace(/\n\nIf `run_in_background=true`,[\s\S]*?point them to the `\/tasks` command, which opens an interactive panel; it has no subcommands\./, "\n\nBackground execution is disabled for this agent. Do not set `run_in_background=true`.").replace(` For possibly long-running foreground commands, set the \`timeout\` argument in seconds. Foreground commands default to ${String(DEFAULT_TIMEOUT_S)}s and allow up to ${String(MAX_TIMEOUT_S)}s.`, ` For possibly long-running commands, set the \`timeout\` argument in seconds. The default is ${String(DEFAULT_TIMEOUT_S)}s; foreground commands allow up to ${String(MAX_TIMEOUT_S)}s.`).replace(/\n- Prefer `run_in_background=true`[\s\S]*?conversation to continue before the command finishes\./, "\n- Do not set `run_in_background=true`; background task management tools are not available.");
+	return description.replaceAll("\r\n", "\n").replace(/\n\nIf `run_in_background=true`,[\s\S]*?point them to the `\/tasks` command, which opens an interactive panel; it has no subcommands\./, "\n\nBackground execution is disabled for this agent. Do not set `run_in_background=true`.").replace(` For possibly long-running foreground commands, set the \`timeout\` argument in seconds. Foreground commands default to ${String(DEFAULT_TIMEOUT_S)}s and allow up to ${String(MAX_TIMEOUT_S)}s.`, ` For possibly long-running commands, set the \`timeout\` argument in seconds. The default is ${String(DEFAULT_TIMEOUT_S)}s; foreground commands allow up to ${String(MAX_TIMEOUT_S)}s.`).replace(/\n- Prefer `run_in_background=true`[\s\S]*?conversation to continue before the command finishes\./, "\n- Do not set `run_in_background=true`; background task management tools are not available.");
 }
 function rejectDangerousCommand(pattern, hint) {
 	return {
@@ -76605,19 +76852,74 @@ function validateCommand(command, isWindows) {
 	if (/\b(killall|pkill)\b.*\b(node|scream)/i.test(cmd)) return rejectDangerousCommand("killall/pkill node", "Use 'kill <pid>' with a specific PID, or use the server's own stop command.");
 	if (isWindows) {
 		if (/\btasklist\b/.test(cmd) && /\bgrep\b.*\b(node|scream)/i.test(cmd) && /\b(taskkill|tskill)\b/.test(cmd)) return rejectDangerousCommand("tasklist | grep node | taskkill pipeline", "Use 'taskkill /PID <pid>' with the specific preview server PID. First run 'tasklist | grep -i node' to find the exact PID, then kill only that one.");
-		if (/\btaskkill\b.*\/IM\s+node/i.test(cmd)) return rejectDangerousCommand("taskkill /IM node.exe", "Use 'taskkill /PID <pid>' with a specific PID instead of killing by image name.");
 		if (/\bwmic\s+process\s+.*where\s+.*name.*=.*node/i.test(cmd) && /\bdelete\b/i.test(cmd)) return rejectDangerousCommand("wmic process delete", "Use 'taskkill /PID <pid>' with a specific PID instead.");
-		if (/\bstop-process\b.*-Name\s+node/i.test(cmd)) return rejectDangerousCommand("Stop-Process -Name node", "Use 'Stop-Process -Id <pid>' with a specific PID instead.");
+		const segments = cmd.split(/[;&|\n]/);
+		for (const segment of segments) {
+			if (/\bstop-process\b/i.test(segment) && /-(?:N|Na|Nam|Name)(?::|\s|$)/i.test(segment)) return rejectDangerousCommand("Stop-Process by name", "Use 'Stop-Process -Id <pid>' with a specific PID instead of killing by process name.");
+			if (/\bstop-process\b/i.test(segment) && /-(?:I|In|Inp|Inpu|Input|InputO|InputOb|InputObj|InputObje|InputObjec|InputObject)(?::|\s|$)/i.test(segment)) return rejectDangerousCommand("Stop-Process -InputObject", "Use 'Stop-Process -Id <pid>' with a specific PID instead of passing a process object.");
+			if (/\b(taskkill|tskill)\b/i.test(segment) && /[/-]IM(?::|\s|$)/i.test(segment)) return rejectDangerousCommand("taskkill by image name", "Use 'taskkill /PID <pid>' with a specific PID instead of killing by image name.");
+		}
+		for (let index = 0; index < segments.length; index += 1) {
+			const segment = segments[index];
+			if (/\bget-process\b/i.test(segment) && /-(?:N|Na|Nam|Name)(?::|\s|$)/i.test(segment) && segments.slice(index + 1).some((later) => /\bstop-process\b/i.test(later))) return rejectDangerousCommand("Get-Process by name piped into Stop-Process", "Use 'Stop-Process -Id <pid>' with a specific PID instead of killing by process name.");
+		}
+		const bypassesShadow = /taskkill\.exe|Microsoft\.PowerShell\.Management\\Stop-Process|\[(?:System\.)?Diagnostics\.Process\]/i;
+		const selfPidOperand = /%SCREAM_PID%|\$env:SCREAM_PID|\$\{PID\}|\$PID\b/i;
+		for (const segment of segments) if (bypassesShadow.test(segment) && selfPidOperand.test(segment)) return rejectDangerousCommand("kill targeting this run through a shadow-bypassing command", "Use a specific pid that is not this run's own — never $PID or $env:SCREAM_PID (%SCREAM_PID%).");
 	} else {
 		if (/\bps\b/.test(cmd) && /\bgrep\b.*\b(node|scream)/i.test(cmd) && /\bxargs\s+kill\b/.test(cmd)) return rejectDangerousCommand("ps | grep node | xargs kill pipeline", "Use 'kill <pid>' with a specific PID instead.");
 		if (/\bpgrep\b.*\b(node|scream)/i.test(cmd) && /\bxargs\s+kill\b/.test(cmd)) return rejectDangerousCommand("pgrep node | xargs kill", "Use 'kill <pid>' with a specific PID instead.");
 	}
 	return null;
 }
-function buildSelfProtectionPreamble(isWindows) {
-	if (isWindows) return "_SCREAM_CHECK(){ for _a in \"$@\";do [ \"$_a\" = \"$SCREAM_PID\" ]&&{ echo \"Scream Code self-protection: refusing to kill itself (pid $SCREAM_PID). Use a specific non-Scream PID.\">&2;return 1;};done;return 0;};kill(){ _SCREAM_CHECK \"$@\"||return 1;command kill \"$@\";};pkill(){ echo \"Scream Code self-protection: pkill blocked. Use kill <pid>.\">&2;return 1;};taskkill(){ _SCREAM_CHECK \"$@\"||return 1;command taskkill \"$@\";};tskill(){ _SCREAM_CHECK \"$@\"||return 1;command tskill \"$@\";};";
+function buildSelfProtectionPreamble(isWindowsBash) {
+	if (isWindowsBash) return "_SCREAM_CHECK(){ for _a in \"$@\";do [ \"$_a\" = \"$SCREAM_PID\" ]&&{ echo \"Scream Code self-protection: refusing to kill itself (pid $SCREAM_PID). Use a specific non-Scream PID.\">&2;return 1;};done;return 0;};kill(){ _SCREAM_CHECK \"$@\"||return 1;command kill \"$@\";};pkill(){ echo \"Scream Code self-protection: pkill blocked. Use kill <pid>.\">&2;return 1;};taskkill(){ _SCREAM_CHECK \"$@\"||return 1;command taskkill \"$@\";};tskill(){ _SCREAM_CHECK \"$@\"||return 1;command tskill \"$@\";};";
 	return "_SCREAM_CHECK(){ for _a in \"$@\";do [ \"$_a\" = \"$SCREAM_PID\" ]||[ \"$_a\" = \"-$SCREAM_PID\" ]&&{ echo \"Scream Code self-protection: refusing to kill itself (pid $SCREAM_PID). Use a specific non-Scream PID.\">&2;return 1;};done;return 0;};kill(){ _SCREAM_CHECK \"$@\"||return 1;command kill \"$@\";};pkill(){ echo \"Scream Code self-protection: pkill blocked. Use kill <pid>.\">&2;return 1;};killall(){ echo \"Scream Code self-protection: killall blocked. Use kill <pid>.\">&2;return 1;};";
 }
+/**
+* The PowerShell self-protection preamble — the dialect's counterpart of
+* {@link buildSelfProtectionPreamble}, which PowerShell cannot run (a bash
+* function definition is a parse error there).
+*
+* `SCREAM_PID` names the process that started this shell and is inherited
+* through the Jian environment allowlist; `$PID` is the shell itself. Killing
+* either — by pid, by process name (`Stop-Process -Name nod*` reaches the host
+* through a wildcard no pid comparison can catch), or by handing the cmdlet the
+* process object itself — detaches the tool from the command it is running, so
+* the three commands that can do it are shadowed:
+*
+*   - `Stop-Process`, the cmdlet;
+*   - `kill` — its built-in alias. An alias outranks a function in PowerShell's
+*     resolution order, so the alias is repointed instead of redefined;
+*   - `taskkill`, an executable, which a function of the same name does shadow
+*     (a function outranks an application).
+*
+* The real commands stay reachable by their module-qualified and `.exe` names,
+* which no shadow can capture.
+*
+* Each shadow is a *simple* function on purpose: only then does PowerShell
+* collect an unbound `-Id 1234` into `$args`, and `@args` splats those
+* parameters back onto the real command, so every case except the guarded pid
+* and the refused by-name, `-InputObject` and process-object forms — including
+* `-WhatIf`, `-Force` and pipeline input — behaves as before. A refusal
+* `throw`s rather than `exit`s: it is an ordinary terminating error, so the
+* message lands on stderr and the shell exits non-zero, exactly as the bash
+* shims behave.
+*
+* Written for Windows PowerShell 5.1 and PowerShell 7 alike: one line of
+* `;`-separated statements, no `&&`, no ternary, no null-coalescing, no class
+* syntax — 5.1 parses none of those.
+*/
+function buildPowerShellSelfProtectionPreamble() {
+	return [
+		"function _ScreamGuardPid([object[]] $Ids) { $guarded = @([string] $PID, [string] $env:SCREAM_PID); foreach ($id in $Ids) { foreach ($one in @($id)) { if ($null -eq $one) { continue }; if ($guarded -contains ([string] $one)) { throw \"Scream Code self-protection: refusing to kill itself (pid $one). Use a specific non-Scream PID.\" } } } }",
+		"function _ScreamGuardByName([object[]] $Arguments) { foreach ($one in $Arguments) { $text = [string] $one; if ($text -match '^-(N|Na|Nam|Name)(:|$)') { throw \"Scream Code self-protection: refusing to kill by process name ($text). Use a specific non-Scream PID.\" } if ($text -match '^[/-]IM(:|$)' -or $text -match 'IMAGENAME') { throw \"Scream Code self-protection: refusing to kill by image name ($text). Use a specific non-Scream PID.\" } } }",
+		"function _ScreamGuardInputObject([object[]] $Arguments) { foreach ($one in $Arguments) { $text = [string] $one; if ($text -match '^-(I|In|Inp|Inpu|Input|InputO|InputOb|InputObj|InputObje|InputObjec|InputObject)(:|$)') { throw \"Scream Code self-protection: refusing to kill via -InputObject, whose operand cannot be inspected. Use a specific non-Scream PID.\" } if ($one -is [System.Diagnostics.Process]) { throw \"Scream Code self-protection: refusing to kill a process object, whose target cannot be inspected. Use a specific non-Scream PID.\" } } }",
+		"function Stop-Process { _ScreamGuardPid $args; _ScreamGuardByName $args; _ScreamGuardInputObject $args; $incoming = @($input | Where-Object { $null -ne $_ }); if ($incoming.Count -gt 0) { _ScreamGuardPid ($incoming | ForEach-Object { $_.Id }); Microsoft.PowerShell.Management\\Stop-Process -InputObject $incoming @args } else { Microsoft.PowerShell.Management\\Stop-Process @args } }",
+		"function taskkill { _ScreamGuardPid $args; _ScreamGuardByName $args; taskkill.exe @args }",
+		"Set-Alias -Name kill -Value Stop-Process -Force"
+	].join("; ");
+}
 var BashTool = class {
 	jian;
 	cwd;
@@ -76625,17 +76927,24 @@ var BashTool = class {
 	name = "Bash";
 	description;
 	parameters = toInputJsonSchema(BashInputSchema);
+	/** Windows Git Bash — a POSIX shell running on Windows. */
 	isWindowsBash;
+	/** This host is Windows. Independent of which dialect its shell speaks. */
+	isWindows;
+	/** The dialect the probed shell speaks. */
+	shellKind;
 	allowBackground;
 	availableTools;
 	constructor(jian, cwd, backgroundManager, options) {
 		this.jian = jian;
 		this.cwd = cwd;
 		this.backgroundManager = backgroundManager;
-		this.isWindowsBash = this.jian.osEnv.osKind === "Windows";
+		this.isWindows = this.jian.osEnv.osKind === "Windows";
+		this.shellKind = shellKindOf(this.jian.osEnv);
+		this.isWindowsBash = this.isWindows && this.shellKind === "posix";
 		this.allowBackground = options?.allowBackground ?? this.backgroundManager !== void 0;
 		this.availableTools = options?.availableTools ?? /* @__PURE__ */ new Set();
-		const rendered = renderBashDescription(this.jian.osEnv.shellName);
+		const rendered = renderBashDescription(this.jian.osEnv.shellName, this.shellKind === "powershell");
 		this.description = this.allowBackground ? rendered : withoutBackgroundDescription(rendered);
 	}
 	resolveExecution(args) {
@@ -76655,12 +76964,10 @@ var BashTool = class {
 		};
 	}
 	spawn(effectiveCwd, command) {
-		const shellCwd = this.isWindowsBash ? windowsPathToPosixPath(effectiveCwd) : effectiveCwd;
-		const preamble = buildSelfProtectionPreamble(this.isWindowsBash);
 		const shellArgs = [
 			this.jian.osEnv.shellPath,
-			"-c",
-			`cd ${shellQuote(shellCwd)} && ${preamble}\n${command}`
+			...this.jian.osEnv.shellArgs ?? DEFAULT_SHELL_ARGS[this.shellKind],
+			this.scriptFor(effectiveCwd, command)
 		];
 		const mergedEnv = {
 			NO_COLOR: "1",
@@ -76671,6 +76978,11 @@ var BashTool = class {
 		};
 		return this.jian.execWithEnv(shellArgs, mergedEnv);
 	}
+	/** The script body handed to the selected interpreter — one dialect each. */
+	scriptFor(effectiveCwd, command) {
+		if (this.shellKind === "powershell") return buildPowerShellScript(effectiveCwd, command);
+		return buildPosixScript(this.isWindowsBash ? windowsPathToPosixPath(effectiveCwd) : effectiveCwd, buildSelfProtectionPreamble(this.isWindowsBash), command);
+	}
 	async execution(args, ctx) {
 		const { signal, onUpdate } = ctx;
 		const completedBg = drainCompletedBackgroundTasks();
@@ -76683,7 +76995,7 @@ var BashTool = class {
 			isError: true,
 			output: bgPrefix + "Command cannot be empty."
 		};
-		const validationError = validateCommand(args.command, this.isWindowsBash);
+		const validationError = validateCommand(args.command, this.isWindows);
 		if (validationError !== null) return validationError;
 		const interception = checkBashInterception(args.command, this.availableTools);
 		if (interception !== null) return interception;
@@ -76815,7 +77127,7 @@ var BashTool = class {
 			const isError = exitCode !== 0;
 			if (isError && builder.nChars === 0) builder.write(`Process exited with code ${String(exitCode)}`);
 			if (!isError) return builder.ok("Command executed successfully.");
-			const hint = looksLikeCommandNotFound(command, builder.toString()) ? `\\n${commandNotFoundHint()}` : "";
+			const hint = looksLikeCommandNotFound(command, builder.toString()) ? `\n${commandNotFoundHint()}` : "";
 			return builder.error(`Command failed with exit code: ${String(exitCode)}.${hint}`, { brief: `Failed with exit code: ${String(exitCode)}` });
 		} catch (error) {
 			return {
@@ -76932,6 +77244,42 @@ async function readStreamIntoBuilder(stream, builder, onChunk) {
 function shellQuote(s) {
 	return `'${s.replaceAll("'", "'\\''")}'`;
 }
+/**
+* PowerShell's literal string — single quotes, with an embedded quote doubled.
+* `$`, backticks and `\` are literal inside it, so a Windows path needs no
+* further escaping.
+*/
+function powershellQuote(s) {
+	return `'${s.replaceAll("'", "''")}'`;
+}
+/**
+* The POSIX script body: set the working directory, install the
+* self-protection shims, then run the command. `cd … && …` keeps a missing
+* directory from running the command somewhere else.
+*/
+function buildPosixScript(shellCwd, preamble, command) {
+	return `cd ${shellQuote(shellCwd)} && ${preamble}\n${command}`;
+}
+/**
+* The PowerShell script body.
+*
+* No POSIX cwd conversion and no bash syntax at all: the cwd is passed in its
+* native `C:\…` form, and the working directory is set with the cmdlet
+* (`Set-Location -LiteralPath`) instead of bash's `cd` builtin — the
+* `-LiteralPath` switch keeps `[` and `]` in a path from being read as
+* wildcards. `-ErrorAction Stop` turns a missing directory into a terminating
+* error, so the command never runs from the process default directory; that is
+* the fail-fast behaviour the POSIX branch gets from `cd … && …`. A `;`
+* separates the statements rather than `&&`, which only exists from PowerShell
+* 7 and would be a parse error on the Windows PowerShell 5.1 the fallback must
+* also serve.
+*
+* The self-protection preamble sits between the two, so the command always runs
+* with the guards in place.
+*/
+function buildPowerShellScript(effectiveCwd, command) {
+	return `Set-Location -LiteralPath ${powershellQuote(effectiveCwd)} -ErrorAction Stop; ${buildPowerShellSelfProtectionPreamble()}; ${command}`;
+}
 function windowsPathToPosixPath(path) {
 	if (path.startsWith("\\\\")) return path.replaceAll("\\", "/");
 	const driveMatch = /^([A-Za-z]):(?:[\\/]|$)/.exec(path);
@@ -76947,20 +77295,6 @@ function rewriteWindowsNullRedirect(command) {
 	return command.replace(WINDOWS_NUL_REDIRECT, "$1/dev/null");
 }
 //#endregion
-//#region ../../packages/agent-core/src/config/path.ts
-function resolveScreamHome(homeDir) {
-	return homeDir ?? process.env["SCREAM_CODE_HOME"] ?? join$1(homedir(), ".scream-code");
-}
-function resolveConfigPath(input) {
-	return input.configPath ?? join$1(resolveScreamHome(input.homeDir), "config.toml");
-}
-function ensureScreamHome(homeDir) {
-	mkdirSync(homeDir, {
-		recursive: true,
-		mode: 448
-	});
-}
-//#endregion
 //#region ../../packages/agent-core/src/mcp/config-loader.ts
 const McpJsonFileSchema = z.object({ mcpServers: z.record(z.string(), McpServerConfigSchema).default({}) });
 /** Maximum number of parent directories to walk when discovering mcp.json. */
@@ -78034,6 +78368,52 @@ var EventSubscriptionBus = class {
 /** Rejection sink for async subscribers: their failures are deliberately dropped. */
 function noop$1() {}
 //#endregion
+//#region ../../packages/agent-core/src/agent/context/identity.ts
+/**
+* Determines whether a context message counts as a "user prompt" for undo
+* anchoring. Regular user messages and user-triggered skill activations both
+* count; injections, system reminders, scheduled notifications, hook results
+* and model-triggered skills don't.
+*
+* The bar is deliberately lower than {@link isUserAuthoredMessage}: this asks
+* whether the *user acted*, not whether the user wrote the text. A slash
+* command the user typed starts a turn the user expects `/undo` to reverse,
+* even though the message body is a rendered skill prompt.
+*/
+function isRealUserPrompt(message) {
+	if (message.role !== "user") return false;
+	const origin = message.origin;
+	if (origin === void 0 || origin.kind === "user") return true;
+	if (origin.kind === "skill_activation") return origin.trigger === "user-slash";
+	return false;
+}
+/**
+* Determines whether a context message was authored by the user as
+* conversation content — a direct user prompt, carrying
+* `origin.kind === 'user'`.
+*
+* Strictly narrower than {@link isRealUserPrompt} on both axes that matter:
+*
+*   - a user-triggered skill activation carries `origin.kind ===
+*     'skill_activation'`. The user acted, but the body is the rendered skill
+*     prompt, not the user's own words: concatenating it into an adjacent user
+*     message, or quoting it back as "the user's request", would misattribute
+*     generated text to the user;
+*   - a message with no `origin` is not user-authored. Every message appended
+*     through `ContextMemory.appendUserMessage` carries one, so a missing
+*     origin means an internal producer wrote the message and its authorship
+*     cannot be claimed for the user.
+*
+* Use this where the question is "are these the user's own words?" — merging
+* adjacent user messages for the provider, recovering the most recent user
+* request, resetting a cadence on genuine user input. Use
+* {@link isRealUserPrompt} where the question is "does this message start a
+* user turn the user could undo?".
+*/
+function isUserAuthoredMessage(message) {
+	return message.role === "user" && message.origin?.kind === "user";
+}
+//#endregion
 //#region ../../packages/agent-core/src/agent/context/projector.ts
 /** Synthetic error text used when a tool result is missing and must be
 * filled in so the provider accepts the message sequence. */
@@ -78106,17 +78486,16 @@ function makeSyntheticToolResult(toolCallId) {
 	};
 }
 /**
-* Drops a trailing open tool exchange from a projected message list: when the
-* last assistant message carries tool calls whose results never arrived and
-* nothing follows, truncate from that batch so the compacted history does not
-* carry an unterminated exchange (which would be rejected or, if synthesized,
-* pollute the compaction prompt).
+* Merges runs of adjacent user-authored messages into one, so the provider
+* never receives consecutive user-role messages. Only the user's own words
+* merge: an injection, a rendered skill prompt or a scheduled notification
+* keeps its own boundary even when it sits next to a real prompt.
 */
 function mergeAdjacentUserMessages(history, _onAnomaly) {
 	const out = [];
 	for (const message of history) {
 		const previous = out.at(-1);
-		if (canMergeUserMessage(message) && previous !== void 0 && canMergeUserMessage(previous)) {
+		if (isUserAuthoredMessage(message) && previous !== void 0 && isUserAuthoredMessage(previous)) {
 			out[out.length - 1] = mergeTwoUserMessages(previous, message);
 			continue;
 		}
@@ -78124,9 +78503,6 @@ function mergeAdjacentUserMessages(history, _onAnomaly) {
 	}
 	return out.map(stripContextMetadata);
 }
-function canMergeUserMessage(message) {
-	return message.role === "user" && message.origin?.kind === "user";
-}
 function mergeTwoUserMessages(a, b) {
 	const aText = extractTextOnly(a);
 	const bText = extractTextOnly(b);
@@ -78942,13 +79318,13 @@ var FullCompaction = class {
 			sessionId
 		});
 	}
-	/** Build a low-confidence fallback memo from the most recent real user
-	*  message in the compacted history (origin.kind === 'user'), so an ongoing
+	/** Build a low-confidence fallback memo from the most recent user-authored
+	*  message in the compacted history (`isUserAuthoredMessage`), so an ongoing
 	*  task is not lost when the summary omits the memory-memo section. */
 	buildFallbackMemo(messages) {
 		for (let i = messages.length - 1; i >= 0; i--) {
 			const msg = messages[i];
-			if (msg === void 0 || msg.role !== "user" || msg.origin?.kind !== "user") continue;
+			if (msg === void 0 || !isUserAuthoredMessage(msg)) continue;
 			const text = msg.content.filter((p) => p.type === "text").map((p) => p.text).join("").trim();
 			if (text.length === 0) continue;
 			return createMemoryMemo({
@@ -81076,18 +81452,6 @@ function truncateContentParts(parts) {
 function isEmptyOutputText(output) {
 	return output.length === 0 || output.trim() === TOOL_OUTPUT_EMPTY_TEXT;
 }
-/**
-* Determines whether a context message counts as a "user prompt" for undo
-* anchoring.  Regular user messages and user-triggered skill activations
-* both count; injections, system reminders, and model-triggered skills don't.
-*/
-function isRealUserPrompt(message) {
-	if (message.role !== "user") return false;
-	const origin = message.origin;
-	if (origin === void 0 || origin.kind === "user") return true;
-	if (origin.kind === "skill_activation") return origin.trigger === "user-slash";
-	return false;
-}
 //#endregion
 //#region ../../packages/agent-core/src/agent/goal/index.ts
 /**
@@ -81502,6 +81866,1183 @@ function normalizeCompletionCriterion(value) {
 	return trimmed?.length ? trimmed : void 0;
 }
 //#endregion
+//#region ../../packages/jian/src/errors.ts
+/**
+* Base error class for the jian package.
+*/
+var JianError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "JianError";
+	}
+};
+/**
+* Equivalent to Python's FileExistsError — indicates a file or directory already exists.
+*/
+var JianFileExistsError = class extends JianError {
+	constructor(message) {
+		super(message);
+		this.name = "JianFileExistsError";
+	}
+};
+/**
+* Thrown by `detectEnvironment` on Windows when neither Git Bash nor
+* PowerShell can be located. Carries the list of paths that were probed so
+* callers can include them in install hints.
+*/
+var JianShellNotFoundError = class extends JianError {
+	constructor(message) {
+		super(message);
+		this.name = "JianShellNotFoundError";
+	}
+};
+/**
+* Thrown by `LocalJian` when a file operation would resolve outside the
+* instance's configured root directory. This is a last-line-of-defense guard;
+* higher-level path policies should still validate user-supplied paths first.
+*/
+var JianPathOutsideRootError = class extends JianError {
+	path;
+	rootDir;
+	constructor(message, path, rootDir) {
+		super(message);
+		this.path = path;
+		this.rootDir = rootDir;
+		this.name = "JianPathOutsideRootError";
+	}
+};
+/** Thrown when process execution fails (spawn error, ENOENT, EACCES). */
+var JianExecError = class extends JianError {
+	command;
+	code;
+	constructor(message, command, code) {
+		super(message);
+		this.command = command;
+		this.code = code;
+		this.name = "JianExecError";
+	}
+};
+//#endregion
+//#region ../../packages/jian/src/environment.ts
+/**
+* Environment — cross-platform probe of OS / shell.
+*
+* Detection is a pure function of injected probes (`platform` / `arch` /
+* `release` / `env` / `isFile` / `findExecutable`) so the same suite runs
+* identically on any host OS. `detectEnvironmentFromNode()` bundles the
+* Node defaults for production callers.
+*
+* On Windows the probe prefers Git Bash (the canonical POSIX shell that ships
+* with Git for Windows) and falls back to PowerShell when Git Bash is absent,
+* so a Windows host without Git Bash still has a working execution channel.
+* `JianShellNotFoundError` is raised only when neither can be located; the SDK
+* layer can wrap that into a user-facing install hint. Set `SCREAM_SHELL_PATH`
+* to override the Git Bash lookup.
+*/
+function resolveOsKind(platform) {
+	switch (platform) {
+		case "darwin": return "macOS";
+		case "linux": return "Linux";
+		case "win32": return "Windows";
+		default: return platform;
+	}
+}
+async function detectEnvironment(deps) {
+	const osKind = resolveOsKind(deps.platform);
+	const osArch = deps.arch;
+	const osVersion = deps.release;
+	if (deps.platform === "win32") return detectWindowsShell(deps, {
+		osKind,
+		osArch,
+		osVersion
+	});
+	const candidates = [
+		"/bin/bash",
+		"/usr/bin/bash",
+		"/usr/local/bin/bash"
+	];
+	let found;
+	for (const p of candidates) if (await deps.isFile(p)) {
+		found = p;
+		break;
+	}
+	if (found !== void 0) return {
+		osKind,
+		osArch,
+		osVersion,
+		shellName: "bash",
+		shellPath: found,
+		shellArgs: ["-c"]
+	};
+	return {
+		osKind,
+		osArch,
+		osVersion,
+		shellName: "sh",
+		shellPath: "/bin/sh",
+		shellArgs: ["-c"]
+	};
+}
+/**
+* Windows shell selection: Git Bash first, PowerShell second, error last.
+*
+* Git Bash is preferred because the agent's command layer is POSIX-shaped
+* (single-quoted `-c` scripts, POSIX cwd conversion), so a Windows host with
+* Git for Windows behaves exactly like macOS / Linux. A host without it used to
+* have no execution channel at all; falling back to PowerShell at least keeps
+* the process-execution path available. `pwsh` (PowerShell 7+) wins over
+* `powershell.exe` (Windows PowerShell 5.1): it is the supported line and the
+* one accepting `-NoProfile -NonInteractive` unchanged.
+*
+* `checked` is shared with the Git Bash lookup so the "nothing found" error can
+* list every location that was probed.
+*/
+async function detectWindowsShell(deps, base) {
+	const checked = [];
+	const gitBash = await locateWindowsGitBash(deps, checked);
+	if (gitBash !== void 0) return {
+		...base,
+		shellName: "bash",
+		shellPath: gitBash,
+		shellArgs: ["-c"]
+	};
+	const powerShell = await locateWindowsPowerShell(deps, checked);
+	if (powerShell !== void 0) return {
+		...base,
+		shellName: powerShell.name,
+		shellPath: powerShell.path,
+		shellArgs: [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command"
+		]
+	};
+	throw new JianShellNotFoundError(`Neither Git Bash nor PowerShell was found on this Windows host. Install Git for Windows from https://gitforwindows.org/ (or set SCREAM_SHELL_PATH to a bash.exe), or install PowerShell. Checked: ${checked.join(", ")}.`);
+}
+async function locateWindowsGitBash(deps, checked) {
+	const override = deps.env["SCREAM_SHELL_PATH"]?.trim();
+	if (override !== void 0 && override.length > 0) {
+		checked.push(override);
+		if (await deps.isFile(override)) return override;
+	}
+	const gitExe = await deps.findExecutable("git.exe");
+	if (gitExe !== void 0) {
+		const inferred = inferGitBashFromGitExe(gitExe);
+		if (inferred !== void 0) {
+			checked.push(inferred);
+			if (await deps.isFile(inferred)) return inferred;
+		}
+		const fellback = inferBashByWalkingUp(gitExe);
+		if (fellback !== void 0) {
+			checked.push(fellback);
+			if (await deps.isFile(fellback)) return fellback;
+		}
+	}
+	const bashExe = await deps.findExecutable("bash.exe");
+	if (bashExe !== void 0) {
+		checked.push(bashExe);
+		return bashExe;
+	}
+	const candidates = [
+		"C:\\Program Files\\Git\\bin\\bash.exe",
+		"C:\\Program Files (x86)\\Git\\bin\\bash.exe",
+		"C:\\msys64\\usr\\bin\\bash.exe",
+		"C:\\cygwin64\\bin\\bash.exe"
+	];
+	const localAppData = deps.env["LOCALAPPDATA"]?.trim();
+	if (localAppData !== void 0 && localAppData.length > 0) candidates.push(`${localAppData}\\Programs\\Git\\bin\\bash.exe`);
+	const userProfile = deps.env["USERPROFILE"]?.trim();
+	if (userProfile !== void 0 && userProfile.length > 0) candidates.push(`${userProfile}\\scoop\\apps\\git\\current\\bin\\bash.exe`);
+	for (const candidate of candidates) {
+		checked.push(candidate);
+		if (await deps.isFile(candidate)) return candidate;
+	}
+}
+/** Locate a PowerShell to run scripts with when Git Bash is unavailable. */
+async function locateWindowsPowerShell(deps, checked) {
+	for (const candidate of [{
+		name: "pwsh",
+		exe: "pwsh.exe"
+	}, {
+		name: "powershell",
+		exe: "powershell.exe"
+	}]) {
+		const found = await deps.findExecutable(candidate.exe);
+		if (found !== void 0) {
+			checked.push(found);
+			return {
+				name: candidate.name,
+				path: found
+			};
+		}
+	}
+	const installs = [];
+	const programFiles = deps.env["ProgramFiles"]?.trim();
+	if (programFiles !== void 0 && programFiles.length > 0) installs.push({
+		name: "pwsh",
+		path: `${programFiles}\\PowerShell\\7\\pwsh.exe`
+	});
+	const systemRoot = deps.env["SystemRoot"]?.trim() ?? deps.env["windir"]?.trim();
+	if (systemRoot !== void 0 && systemRoot.length > 0) installs.push({
+		name: "powershell",
+		path: `${systemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`
+	});
+	for (const candidate of installs) {
+		checked.push(candidate.path);
+		if (await deps.isFile(candidate.path)) return candidate;
+	}
+}
+function inferGitBashFromGitExe(gitExe) {
+	const sep = gitExe.includes("\\") ? "\\" : "/";
+	const parts = gitExe.split(sep);
+	for (let i = parts.length - 2; i >= 0; i -= 1) {
+		const segment = parts[i];
+		if (segment === "cmd" || segment === "bin") {
+			const root = parts.slice(0, i).join(sep);
+			return root.length === 0 ? `bin${sep}bash.exe` : `${root}${sep}bin${sep}bash.exe`;
+		}
+	}
+}
+function inferBashByWalkingUp(gitExe) {
+	const sep = gitExe.includes("\\") ? "\\" : "/";
+	const parts = gitExe.split(sep);
+	for (let i = parts.length - 1; i >= 1 && parts.length - i <= 6; i -= 1) {
+		const root = parts.slice(0, i).join(sep) || sep;
+		const candidate = `${root}${sep}bin${sep}bash.exe`;
+		const gitDir = parts.slice(0, -1).join(sep);
+		if (`${root}${sep}bin` !== gitDir) return candidate;
+	}
+}
+/**
+* Production convenience — derive the deps bag from Node's ambient surface.
+*
+* The result is memoised: subsequent calls return the original promise.
+* `Environment` is immutable for the lifetime of the process (it derives
+* from `process.platform`, `process.arch`, `os.release()`, and one-time
+* shell-path discovery), so caching is sound. Tests that need to probe
+* with different inputs should call {@link detectEnvironment} directly
+* with an injected deps bag.
+*/
+let detectedEnvironment;
+function detectEnvironmentFromNode() {
+	if (detectedEnvironment !== void 0) return detectedEnvironment;
+	const platform = process.platform;
+	const env = process.env;
+	const isFile = async (path) => {
+		try {
+			await access(path, constants.F_OK);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+	detectedEnvironment = detectEnvironment({
+		platform,
+		arch: process.arch,
+		release: nodeOs.release(),
+		env,
+		isFile,
+		findExecutable: (name) => findExecutableOnPath(name, env["PATH"], platform, isFile)
+	});
+	return detectedEnvironment;
+}
+async function findExecutableOnPath(name, pathEnv, platform, isFile) {
+	if (pathEnv === void 0 || pathEnv.length === 0) return void 0;
+	const listSep = platform === "win32" ? ";" : ":";
+	const dirSep = platform === "win32" ? "\\" : "/";
+	for (const rawDir of pathEnv.split(listSep)) {
+		const dir = rawDir.trim();
+		if (dir.length === 0) continue;
+		const candidate = dir.endsWith(dirSep) ? `${dir}${name}` : `${dir}${dirSep}${name}`;
+		if (await isFile(candidate)) return candidate;
+	}
+}
+//#endregion
+//#region ../../packages/jian/src/internal.ts
+function isUtf8Continuation(byte) {
+	return byte >= 128 && byte <= 191;
+}
+function decodeUtf8Ignore(data) {
+	let output = "";
+	let i = 0;
+	while (i < data.length) {
+		const b0 = data[i];
+		if (b0 === void 0) break;
+		if (b0 <= 127) {
+			output += String.fromCodePoint(b0);
+			i += 1;
+			continue;
+		}
+		if (b0 >= 194 && b0 <= 223) {
+			const b1 = data[i + 1];
+			if (b1 !== void 0 && isUtf8Continuation(b1)) {
+				output += String.fromCodePoint((b0 & 31) << 6 | b1 & 63);
+				i += 2;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		if (b0 >= 224 && b0 <= 239) {
+			const b1 = data[i + 1];
+			const b2 = data[i + 2];
+			if (b1 !== void 0 && (b0 === 224 && b1 >= 160 && b1 <= 191 || b0 >= 225 && b0 <= 236 && isUtf8Continuation(b1) || b0 === 237 && b1 >= 128 && b1 <= 159 || b0 >= 238 && b0 <= 239 && isUtf8Continuation(b1)) && b2 !== void 0 && isUtf8Continuation(b2)) {
+				output += String.fromCodePoint((b0 & 15) << 12 | (b1 & 63) << 6 | b2 & 63);
+				i += 3;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		if (b0 >= 240 && b0 <= 244) {
+			const b1 = data[i + 1];
+			const b2 = data[i + 2];
+			const b3 = data[i + 3];
+			if (b1 !== void 0 && (b0 === 240 && b1 >= 144 && b1 <= 191 || b0 >= 241 && b0 <= 243 && isUtf8Continuation(b1) || b0 === 244 && b1 >= 128 && b1 <= 143) && b2 !== void 0 && b3 !== void 0 && isUtf8Continuation(b2) && isUtf8Continuation(b3)) {
+				output += String.fromCodePoint((b0 & 7) << 18 | (b1 & 63) << 12 | (b2 & 63) << 6 | b3 & 63);
+				i += 4;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		i += 1;
+	}
+	return output;
+}
+function decodeUtf16LeIgnore(data) {
+	let output = "";
+	let i = 0;
+	while (i + 1 < data.length) {
+		const first = data[i];
+		const second = data[i + 1];
+		if (first === void 0 || second === void 0) break;
+		const codeUnit = first | second << 8;
+		if (codeUnit >= 55296 && codeUnit <= 56319) {
+			const lowFirst = data[i + 2];
+			const lowSecond = data[i + 3];
+			if (lowFirst !== void 0 && lowSecond !== void 0) {
+				const low = lowFirst | lowSecond << 8;
+				if (low >= 56320 && low <= 57343) {
+					const codePoint = 65536 + (codeUnit - 55296 << 10) + (low - 56320);
+					output += String.fromCodePoint(codePoint);
+					i += 4;
+					continue;
+				}
+			}
+			i += 2;
+			continue;
+		}
+		if (codeUnit >= 56320 && codeUnit <= 57343) {
+			i += 2;
+			continue;
+		}
+		output += String.fromCodePoint(codeUnit);
+		i += 2;
+	}
+	return output;
+}
+/**
+* Decode a Buffer into a string with Python-compatible `errors` handling.
+*
+* - `'strict'` (default): throw on invalid sequences (via TextDecoder `fatal: true`)
+* - `'replace'`: substitute each invalid sequence with U+FFFD (TextDecoder default)
+* - `'ignore'`: drop invalid input sequences while preserving valid U+FFFD characters
+*
+* Falls back to `Buffer.toString(encoding)` for encodings TextDecoder does not
+* support (e.g. `hex`, `base64`, `binary`, `latin1`) — those are lossless
+* byte-to-character mappings so `errors` has no effect.
+* @internal
+*/
+function decodeTextWithErrors(data, encoding, errors = "strict") {
+	let webLabel;
+	switch (encoding) {
+		case "utf-8":
+		case "utf8":
+			webLabel = "utf-8";
+			break;
+		case "utf16le":
+		case "ucs2":
+		case "ucs-2":
+			webLabel = "utf-16le";
+			break;
+		default: webLabel = void 0;
+	}
+	if (webLabel === void 0) return data.toString(encoding);
+	if (errors === "strict") return new TextDecoder(webLabel, { fatal: true }).decode(data);
+	if (errors === "ignore") return webLabel === "utf-8" ? decodeUtf8Ignore(data) : decodeUtf16LeIgnore(data);
+	return new TextDecoder(webLabel, { fatal: false }).decode(data);
+}
+/**
+* Convert a glob pattern segment (e.g. "*.txt", "file?.log") into a RegExp.
+* Mirrors Python pathlib behavior: includes dotfiles, case-sensitive by default.
+* @internal
+*/
+function globPatternToRegex(pattern, caseSensitive) {
+	let regex = "^";
+	for (let i = 0; i < pattern.length; i++) {
+		const ch = pattern[i];
+		if (ch === void 0) break;
+		switch (ch) {
+			case "*":
+				regex += "[^/]*";
+				break;
+			case "?":
+				regex += "[^/]";
+				break;
+			case "[": {
+				const end = pattern.indexOf("]", i + 1);
+				if (end === -1) regex += "\\[";
+				else {
+					let charClass = pattern.slice(i + 1, end);
+					if (charClass.startsWith("!")) charClass = "^" + charClass.slice(1);
+					else if (charClass.startsWith("^")) charClass = "\\" + charClass;
+					regex += "[" + charClass + "]";
+					i = end;
+				}
+				break;
+			}
+			default: regex += ch.replaceAll(/[{}()+.\\^$|]/g, "\\$&");
+		}
+	}
+	regex += "$";
+	return new RegExp(regex, caseSensitive ? "" : "i");
+}
+/**
+* A Readable wrapper that preserves source backpressure while still allowing
+* consumers to read buffered output after the source has ended.
+* @internal
+*/
+var BufferedReadable = class extends Readable {
+	_source;
+	_ended = false;
+	constructor(source) {
+		super({ highWaterMark: 128 * 1024 });
+		this._source = source;
+		this._source.on("data", this._onData);
+		this._source.on("end", this._onEnd);
+		this._source.on("close", this._onClose);
+		this._source.on("error", this._onError);
+	}
+	_read() {
+		if (!this._ended && !this.destroyed) this._source.resume();
+	}
+	_destroy(error, callback) {
+		this._source.off("data", this._onData);
+		this._source.off("end", this._onEnd);
+		this._source.off("close", this._onClose);
+		this._source.off("error", this._onError);
+		callback(error);
+	}
+	_onData = (chunk) => {
+		if (!this.push(chunk)) this._source.pause();
+	};
+	_onEnd = () => {
+		this._ended = true;
+		this.push(null);
+	};
+	_onClose = () => {
+		if (!this._ended) {
+			this._ended = true;
+			this.push(null);
+		}
+	};
+	_onError = (error) => {
+		this.destroy(error);
+	};
+};
+//#endregion
+//#region ../../packages/jian/src/platform.ts
+/**
+* Platform dialect — the spawn / kill rules that differ between Windows and
+* POSIX, written once and shared by every spawn site in this repo.
+*
+* Two questions come up at each site, and they must be answered the same way
+* everywhere or a caller ends up with a half-killed process tree:
+*
+*   1. `detached` — on POSIX, `detached: true` makes the child a process-group
+*      leader, which is what lets a single `kill(-pid)` reach the grandchildren
+*      a shell command spawns. Windows has no process groups, so it stays
+*      `false` and relies on `taskkill /T`.
+*   2. Killing — {@link killProcessTree}, which pairs with (1).
+*
+* The platform is always a parameter (never a module-level constant) so tests
+* can drive both dialects from any host.
+*/
+/**
+* True on Windows — the platform with no POSIX process groups, no POSIX
+* signals, and case-insensitive path comparison.
+*/
+function isWindowsPlatform(platform) {
+	return platform === "win32";
+}
+/**
+* The `detached` flag for a spawn whose process tree will later be reaped by
+* {@link killProcessTree}: true exactly when the platform has process groups.
+*/
+function detachedForProcessTree(platform) {
+	return !isWindowsPlatform(platform);
+}
+/**
+* Kill `pid` and every descendant, resolving once the request has been made.
+*
+* Windows: `taskkill /F /T /PID <pid>`. `/T` walks the tree; `/F` is
+* unconditional because without it `taskkill` only posts `WM_CLOSE`, which
+* console processes — i.e. everything an agent runs — ignore, so a "graceful"
+* Windows kill would report success while leaving the tree running. Exit code
+* 128 ("process not found") resolves, mirroring the POSIX `ESRCH` branch below:
+* an already-dead tree is the state the caller asked for.
+*
+* POSIX: signal the process group, which requires the child to have been
+* spawned with `detached: true` (see {@link detachedForProcessTree}).
+* `ESRCH` resolves for the same reason. Anything else rejects so the caller can
+* decide whether to surface it.
+*/
+async function killProcessTree(pid, options) {
+	if (pid <= 0) return;
+	if (isWindowsPlatform(options.platform ?? process.platform)) {
+		await runTaskkill(pid);
+		return;
+	}
+	try {
+		process.kill(-pid, options.signal);
+	} catch (error) {
+		if (error.code === "ESRCH") return;
+		throw error;
+	}
+}
+const TASKKILL_PROCESS_NOT_FOUND = 128;
+function runTaskkill(pid) {
+	return new Promise((resolve, reject) => {
+		const killer = spawn("taskkill", [
+			"/F",
+			"/T",
+			"/PID",
+			String(pid)
+		], {
+			stdio: "ignore",
+			windowsHide: true
+		});
+		killer.once("error", (error) => {
+			reject(/* @__PURE__ */ new Error(`taskkill failed to start: ${error.message}`));
+		});
+		killer.once("close", (code) => {
+			if (code === 0 || code === TASKKILL_PROCESS_NOT_FOUND) resolve();
+			else reject(/* @__PURE__ */ new Error(`taskkill exited with code ${String(code)}`));
+		});
+		killer.unref();
+	});
+}
+//#endregion
+//#region ../../packages/jian/src/local.ts
+/**
+* Environment variables that spawned processes are allowed to inherit from the
+* parent process. All other variables are stripped to prevent accidental secret
+* leakage (e.g. cloud tokens, API keys, SSH agent sockets) into agent-executed
+* commands. Explicit env values passed by callers can still add or override keys.
+*/
+const ALLOWED_INHERITED_ENV_KEYS = [
+	"PATH",
+	"PATHEXT",
+	"SHELL",
+	"ComSpec",
+	"HOME",
+	"USER",
+	"USERNAME",
+	"LOGNAME",
+	"USERPROFILE",
+	"HOMEDRIVE",
+	"HOMEPATH",
+	"LANG",
+	"LC_ALL",
+	"LC_CTYPE",
+	"LC_MESSAGES",
+	"TERM",
+	"TERM_PROGRAM",
+	"TERM_PROGRAM_VERSION",
+	"COLORTERM",
+	"NO_COLOR",
+	"FORCE_COLOR",
+	"TMPDIR",
+	"TEMP",
+	"TMP",
+	"APPDATA",
+	"LOCALAPPDATA",
+	"XDG_CONFIG_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_DATA_HOME",
+	"XDG_RUNTIME_DIR",
+	"GIT_TERMINAL_PROMPT",
+	"GIT_ASKPASS",
+	"SSH_ASKPASS",
+	"SCREAM_PID"
+];
+/**
+* True if `candidate` is `base` itself or a descendant of `base`, compared on
+* path-component boundaries. Both paths must already be normalized. This is a
+* lexical check only; it does not resolve symlinks.
+*
+* `platform` decides whether the comparison folds case: Windows paths are
+* case-insensitive, POSIX paths are not.
+*/
+function isWithinDirectory(candidate, base, platform) {
+	const normalizedCandidate = normalize(candidate);
+	const normalizedBase = normalize(base);
+	const windows = isWindowsPlatform(platform);
+	const comparableCandidate = windows ? normalizedCandidate.toLowerCase() : normalizedCandidate;
+	const comparableBase = windows ? normalizedBase.toLowerCase() : normalizedBase;
+	if (comparableCandidate === comparableBase) return true;
+	const prefix = comparableBase.endsWith("/") ? comparableBase : `${comparableBase}/`;
+	return comparableCandidate.startsWith(prefix);
+}
+/**
+* Build a sanitized environment for child processes. Inherits only an explicit
+* allowlist of ambient variables, then applies caller-supplied overrides.
+*/
+function buildSafeEnv(explicit) {
+	const env = {};
+	for (const key of ALLOWED_INHERITED_ENV_KEYS) {
+		const value = process.env[key];
+		if (value !== void 0) env[key] = value;
+	}
+	if (explicit !== void 0) for (const [key, value] of Object.entries(explicit)) env[key] = value;
+	return env;
+}
+/**
+* Build the `(dev, ino)` cycle-detection key used by `_globWalk`'s
+* visited set. Returns `null` when `ino` is 0, which Node returns on
+* filesystems that don't carry inodes (Windows FAT/exFAT, some SMB/NFS
+* mounts). A null key signals "no reliable identity for this dir" so
+* the caller skips visited tracking for that descent — cycle safety
+* is weakened on those filesystems, but normal walking works instead
+* of every directory colliding on the shared key `"<dev>:0"`.
+*/
+function cycleKey(s) {
+	if (s.ino === 0) return null;
+	return `${String(s.dev)}:${String(s.ino)}`;
+}
+const DEFAULT_PATHEXT = [
+	".COM",
+	".EXE",
+	".BAT",
+	".CMD"
+];
+/** Extensions Windows can only run through `cmd.exe`, never by direct exec. */
+const CMD_SCRIPT_EXTENSIONS = [".bat", ".cmd"];
+/**
+* Windows spawn plan for `command`.
+*
+* Windows does not resolve a bare name to a runnable file the way POSIX does: a
+* shell walks `PATH` + `PATHEXT` and lands on `npm.cmd`, while Node's `spawn`
+* does not, which is why `spawn('npm')` fails on a host where `npm.cmd` works
+* in every terminal. This reproduces that resolution and then launches the
+* result the way the OS requires:
+*
+*   - anything runnable as-is (`.exe` / `.com` / extensionless) → spawned directly.
+*   - `.cmd` / `.bat` → through `cmd.exe /d /s /c`. A batch file is a script for
+*     `cmd`, so there is no direct-exec route — Node refuses to spawn one
+*     anyway (it rejects `.bat`/`.cmd` without `shell: true`). Handing a fully
+*     quoted command line to `cmd.exe` keeps argument parsing under our
+*     control, which is exactly why `shell: true` is not used: that would let
+*     Node re-tokenize the whole line for us, including the parts we build.
+*
+* The command line is built by {@link quoteCmdToken}, so a command or argument
+* that cannot be quoted for a batch file (an embedded `"` or line break)
+* rejects the call instead of being passed through — see there for why no
+* escaping exists.
+*
+* @internal for tests
+*/
+async function windowsSpawnPlan(command, args, env) {
+	const resolved = await resolveWindowsExecutable(command, env["PATH"], pathextExtensions(env["PATHEXT"]));
+	if (!isCmdScript(resolved)) return {
+		command: resolved,
+		args,
+		windowsVerbatimArguments: false
+	};
+	return {
+		command: env["ComSpec"] ?? env["COMSPEC"] ?? "cmd.exe",
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			buildCmdCommandLine(resolved, args)
+		],
+		windowsVerbatimArguments: true
+	};
+}
+/** `PATHEXT` entries verbatim (Windows compares extensions case-insensitively); its own default when unset/empty. */
+function pathextExtensions(pathext) {
+	const entries = (pathext ?? "").split(";").map((extension) => extension.trim()).filter((extension) => extension.length > 0);
+	return entries.length > 0 ? entries : DEFAULT_PATHEXT;
+}
+function isCmdScript(path) {
+	const lower = path.toLowerCase();
+	return CMD_SCRIPT_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+/**
+* Find the runnable file `command` names, trying the literal name first and then
+* every `PATHEXT` suffix in order (the order a shell uses). A name containing a
+* separator is a path rather than a `PATH` lookup, but Windows still appends
+* `PATHEXT` candidates to it, so the candidate list is the same.
+*
+* Throws a readable `JianExecError` naming the command and every name that was
+* tried, because the bare `ENOENT` a raw `spawn` produces names neither the
+* suffixes nor the search roots.
+*/
+async function resolveWindowsExecutable(command, pathEnv, extensions) {
+	const isPath = /[\\/]/.test(command);
+	const searchDirs = isPath ? [""] : pathDirectories(pathEnv);
+	const names = [command, ...extensions.map((extension) => `${command}${extension}`)];
+	for (const dir of searchDirs) for (const name of names) {
+		const candidate = join(dir, name);
+		if (await fileExists(candidate)) return candidate;
+	}
+	throw new JianExecError(`Command not found: ${command}. Searched ${isPath ? "the path given in the command" : `PATH (${pathEnv ?? ""})`} for ${names.join(", ")}.`, command, "ENOENT");
+}
+function pathDirectories(pathEnv) {
+	return (pathEnv ?? "").split(";").map((dir) => dir.trim()).filter((dir) => dir.length > 0);
+}
+async function fileExists(path) {
+	try {
+		return (await stat(path)).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* Quote one token for a `cmd.exe /s /c` command line.
+*
+* Batch files are interpreted by `cmd`, so anything reaching a `.cmd` shim is
+* subject to cmd metacharacters. Wrapping a token that carries whitespace or a
+* metacharacter in double quotes keeps `&` / `|` / `<` / `>` from starting a
+* second command — which is the entire job of this helper, because `shell: true`
+* is deliberately not used and nothing else would quote these tokens.
+*
+* A token containing `"` is refused, not escaped. `\` is not an escape
+* character in `cmd`; `"` *toggles* the quoting state, so a `\"` closes the
+* quoted region early and leaves the rest of the token outside it — an `&` that
+* follows then reaches `cmd` as a real command separator and the remainder runs
+* as a second command at the caller's privilege. There is no quoted form of a
+* `"` that survives a batch shim, so the only safe answer is to fail closed.
+* CR/LF are refused for the same reason: they end the line `cmd.exe /c` parses,
+* turning the rest into further commands.
+*
+* `%VAR%` is expanded by `cmd` *inside* the quotes. That is inherent to invoking
+* a batch file and cannot be escaped away; not masking it is the honest form,
+* and the alternative would be refusing to run `npm`, `pnpm` and every other
+* shim shipped as a `.cmd`.
+*
+* An empty token is quoted too: it is still one argument slot, and collapsing it
+* to nothing would shift every argument that follows (`install -g ''` would
+* become `install -g`).
+*/
+function quoteCmdToken(token) {
+	if (/["\r\n]/.test(token)) throw new JianExecError(`Cannot quote ${JSON.stringify(token)} for a batch file: cmd.exe has no escape character — a double quote toggles its quoting state instead of being escaped, so the rest of the token would fall outside the quotes and split into further commands. A double quote or a line break cannot be passed through a .cmd/.bat argument list.`, token);
+	if (token === "") return "\"\"";
+	return /[\s&|<>^()]/.test(token) ? `"${token}"` : token;
+}
+/**
+* The `cmd.exe /s /c` command line for a batch shim: `cmd.exe /s` strips exactly
+* one outer quote pair, then takes the rest verbatim, so the whole line is
+* wrapped and every token inside it is quoted by {@link quoteCmdToken}.
+*
+* Exported because a caller outside this package has to build the same line for
+* the same reason — the CLI's `npm` launch plan spawns `npm.cmd` through
+* `cmd.exe` on Windows, and a second copy of the quoting rules is exactly the
+* kind of drift that lets one call site become injectable while the other is
+* fixed. It throws a `JianExecError` for a token no batch file can carry.
+*/
+function buildCmdCommandLine(command, args) {
+	return `"${[command, ...args].map(quoteCmdToken).join(" ")}"`;
+}
+var LocalProcess = class {
+	stdin;
+	stdout;
+	stderr;
+	pid;
+	_child;
+	_platform;
+	_exitCode = null;
+	_exitPromise;
+	constructor(child, platform) {
+		if (child.stdin === null || child.stdout === null || child.stderr === null) throw new Error("Process must be created with stdin/stdout/stderr pipes.");
+		this._child = child;
+		this._platform = platform;
+		this.stdin = child.stdin;
+		this.stdout = new BufferedReadable(child.stdout);
+		this.stderr = new BufferedReadable(child.stderr);
+		this.pid = child.pid ?? -1;
+		this._exitPromise = new Promise((resolve, reject) => {
+			child.on("exit", (code) => {
+				this._exitCode = code ?? -1;
+				resolve(this._exitCode);
+			});
+			child.on("error", (error) => {
+				reject(error);
+			});
+		});
+	}
+	get exitCode() {
+		return this._exitCode;
+	}
+	async wait() {
+		return this._exitPromise;
+	}
+	async kill(signal) {
+		const deliver = signal ?? "SIGTERM";
+		try {
+			await killProcessTree(this.pid, {
+				signal: deliver,
+				platform: this._platform
+			});
+		} catch (error) {
+			if (error.code !== "EPERM") throw error;
+			try {
+				this._child.kill(deliver);
+			} catch {}
+		}
+	}
+};
+let atomicWriteCounter = 0;
+/**
+* A JIAN implementation that directly interacts with the local filesystem.
+*
+* Note: LocalJian maintains its own per-instance working directory (`_cwd`)
+* rather than mutating `process.cwd()`. This lets multiple LocalJian instances
+* coexist with independent cwds (e.g. when switching contexts via
+* `runWithJian`) without cross-polluting each other's relative-path resolution.
+*/
+var LocalJian = class LocalJian {
+	name = "local";
+	osEnv;
+	_cwd;
+	_rootDir;
+	/**
+	* Spawn / kill / path-case dialect for this instance, derived from the probed
+	* environment: `osKind` is `'Windows'` exactly when the probe saw win32.
+	* Injected rather than read from `process.platform` so tests can drive the
+	* Windows dialect from any host — same shape as `environment.ts`, which takes
+	* an injected platform probe.
+	*/
+	_platform;
+	constructor(osEnv, cwd, rootDir) {
+		this._cwd = normalize(cwd ?? process.cwd());
+		this._rootDir = rootDir === void 0 ? void 0 : normalize(rootDir);
+		this._platform = osEnv.osKind === "Windows" ? "win32" : "posix";
+		this.osEnv = osEnv;
+	}
+	/**
+	* Construct a fresh `LocalJian` after probing the host environment.
+	*
+	* Each call returns a new instance with its own `_cwd`; concurrent
+	* callers can therefore operate on independent working directories
+	* without polluting one another.
+	*/
+	static async create(cwd, rootDir, env) {
+		return new LocalJian(env ?? await detectEnvironmentFromNode(), cwd, rootDir);
+	}
+	withCwd(cwd) {
+		return new LocalJian(this.osEnv, cwd, this._rootDir);
+	}
+	_resolvePath(path) {
+		const resolved = isAbsolute$1(path) ? normalize(path) : join$1(this._cwd, path);
+		this._assertWithinRoot(resolved);
+		return resolved;
+	}
+	_assertWithinRoot(resolvedPath) {
+		if (this._rootDir === void 0) return;
+		if (isWithinDirectory(resolvedPath, this._rootDir, this._platform)) return;
+		throw new JianPathOutsideRootError(`Path outside allowed root directory: ${resolvedPath}`, resolvedPath, this._rootDir);
+	}
+	/** Resolve path for sandboxed operations — lexical check + realpath. */
+	async _resolveSandboxedPath(path) {
+		const lexical = isAbsolute$1(path) ? normalize(path) : join$1(this._cwd, path);
+		if (!isWithinDirectory(lexical, this._rootDir, this._platform)) throw new JianPathOutsideRootError(`Path outside allowed root directory: ${lexical}`, lexical, this._rootDir);
+		const realPath = await realpath(lexical);
+		if (!isWithinDirectory(realPath, await realpath(this._rootDir), this._platform)) throw new JianPathOutsideRootError(`Path outside allowed root directory (via symlink): ${lexical}`, lexical, this._rootDir);
+		return realPath;
+	}
+	pathClass() {
+		return this._platform;
+	}
+	normpath(path) {
+		return normalize(path);
+	}
+	gethome() {
+		return normalize(homedir());
+	}
+	getcwd() {
+		return this._cwd;
+	}
+	/**
+	* Change the working directory of this LocalJian instance.
+	*
+	* Unlike Python's `os.chdir`, this is instance-scoped and never touches
+	* `process.cwd()`. Child processes spawned via {@link exec} inherit this
+	* instance's `_cwd`; concurrent LocalJian instances each carry their own
+	* independent cwd. If you need Python-compatible process-global cwd,
+	* call `process.chdir(x)` directly.
+	*/
+	async chdir(path) {
+		const resolved = this._rootDir !== void 0 ? await this._resolveSandboxedPath(path) : this._resolvePath(path);
+		if (!(await stat(resolved)).isDirectory()) throw new Error(`Not a directory: ${resolved}`);
+		this._cwd = resolved;
+	}
+	async realpath(path, options) {
+		const lexical = this._resolvePath(path);
+		try {
+			return normalize(await realpath(lexical));
+		} catch (error) {
+			const code = error.code;
+			if (!options?.allowMissing || code !== "ENOENT" && code !== "ENOTDIR") throw error;
+		}
+		const missingSegments = [];
+		let ancestor = lexical;
+		while (true) {
+			try {
+				await lstat(ancestor);
+			} catch (error) {
+				const code = error.code;
+				if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
+				const parent = dirname$2(ancestor);
+				if (parent === ancestor) throw error;
+				missingSegments.push(basename$1(ancestor));
+				ancestor = parent;
+				continue;
+			}
+			return normalize(join$1(normalize(await realpath(ancestor)), ...missingSegments.toReversed()));
+		}
+	}
+	async stat(path, options) {
+		const followSymlinks = options?.followSymlinks ?? true;
+		const resolved = this._rootDir !== void 0 && followSymlinks ? await this._resolveSandboxedPath(path) : this._resolvePath(path);
+		const s = followSymlinks ? await stat(resolved) : await lstat(resolved);
+		return {
+			stMode: s.mode,
+			stIno: s.ino,
+			stDev: s.dev,
+			stNlink: s.nlink,
+			stUid: s.uid,
+			stGid: s.gid,
+			stSize: s.size,
+			stAtime: s.atimeMs / 1e3,
+			stMtime: s.mtimeMs / 1e3,
+			stCtime: isWindowsPlatform(this._platform) ? s.birthtimeMs / 1e3 : s.ctimeMs / 1e3
+		};
+	}
+	async *iterdir(path) {
+		const resolved = this._resolvePath(path);
+		const entries = await readdir(resolved);
+		for (const entry of entries) yield join$1(resolved, entry);
+	}
+	async *glob(path, pattern, options) {
+		const resolved = this._resolvePath(path);
+		const caseSensitive = options?.caseSensitive ?? true;
+		const physicalAllowedRoots = options?.allowedRoots === void 0 ? void 0 : await Promise.all(options.allowedRoots.map((root) => this.realpath(root, { allowMissing: true })));
+		if (!await this._isWithinPhysicalRoots(resolved, physicalAllowedRoots)) return;
+		const patternParts = pattern.split("/");
+		const initVisited = /* @__PURE__ */ new Set();
+		try {
+			const rootKey = cycleKey(await stat(resolved));
+			if (rootKey !== null) initVisited.add(rootKey);
+		} catch {}
+		yield* this._globWalk(resolved, patternParts, caseSensitive, initVisited, physicalAllowedRoots);
+	}
+	async *_globWalk(basePath, patternParts, caseSensitive, visited, physicalAllowedRoots) {
+		if (!await this._isWithinPhysicalRoots(basePath, physicalAllowedRoots)) return;
+		if (patternParts.length === 0) return;
+		const [currentPattern, ...remainingParts] = patternParts;
+		if (currentPattern === "**") {
+			if (remainingParts.length > 0) yield* this._globWalk(basePath, remainingParts, caseSensitive, visited, physicalAllowedRoots);
+			else yield basePath;
+			let entries;
+			try {
+				entries = await readdir(basePath);
+			} catch {
+				return;
+			}
+			for (const entry of entries) {
+				const fullPath = join$1(basePath, entry);
+				if (this._rootDir && !isWithinDirectory(fullPath, this._rootDir, this._platform)) continue;
+				let entryStat;
+				try {
+					entryStat = await stat(fullPath);
+				} catch {
+					continue;
+				}
+				if (entryStat.isDirectory()) {
+					const key = cycleKey(entryStat);
+					if (key !== null && visited.has(key)) continue;
+					yield* this._globWalk(fullPath, patternParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots);
+				} else if (remainingParts.length === 0 && await this._isWithinPhysicalRoots(fullPath, physicalAllowedRoots)) yield fullPath;
+			}
+		} else {
+			const regex = globPatternToRegex(currentPattern ?? "", caseSensitive);
+			let entries;
+			try {
+				entries = await readdir(basePath);
+			} catch {
+				return;
+			}
+			for (const entry of entries) {
+				if (!regex.test(entry)) continue;
+				const fullPath = join$1(basePath, entry);
+				if (this._rootDir && !isWithinDirectory(fullPath, this._rootDir, this._platform)) continue;
+				if (remainingParts.length === 0) {
+					if (await this._isWithinPhysicalRoots(fullPath, physicalAllowedRoots)) yield fullPath;
+				} else {
+					let entryStat;
+					try {
+						entryStat = await stat(fullPath);
+					} catch {
+						continue;
+					}
+					if (entryStat.isDirectory()) {
+						const key = cycleKey(entryStat);
+						if (key !== null && visited.has(key)) continue;
+						yield* this._globWalk(fullPath, remainingParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots);
+					}
+				}
+			}
+		}
+	}
+	async _isWithinPhysicalRoots(path, physicalAllowedRoots) {
+		if (physicalAllowedRoots === void 0) return true;
+		try {
+			const physicalPath = normalize(await realpath(path));
+			return physicalAllowedRoots.some((root) => isWithinDirectory(physicalPath, root, this._platform));
+		} catch {
+			return false;
+		}
+	}
+	async readBytes(path, n) {
+		const resolved = this._resolvePath(path);
+		if (n === void 0) return Buffer.from(await readFile(resolved));
+		const fh = await open(resolved, "r");
+		try {
+			const buf = Buffer.alloc(n);
+			const { bytesRead } = await fh.read(buf, 0, n, 0);
+			return buf.subarray(0, bytesRead);
+		} finally {
+			await fh.close();
+		}
+	}
+	async readText(path, options) {
+		const resolved = this._resolvePath(path);
+		const encoding = options?.encoding ?? "utf-8";
+		const errors = options?.errors ?? "strict";
+		return decodeTextWithErrors(await readFile(resolved), encoding, errors);
+	}
+	async *readLines(path, options) {
+		const stream = createReadStream(this._resolvePath(path), {
+			encoding: options?.encoding ?? "utf-8",
+			highWaterMark: 64 * 1024
+		});
+		let remainder = "";
+		try {
+			for await (const chunk of stream) {
+				const lines = (remainder + chunk).split("\n");
+				remainder = lines.pop() ?? "";
+				for (const line of lines) yield line + "\n";
+			}
+		} finally {
+			stream.destroy();
+		}
+		if (remainder !== "") yield remainder;
+	}
+	async writeBytes(path, data) {
+		await writeFile(this._resolvePath(path), data);
+		return data.length;
+	}
+	async writeText(path, data, options) {
+		const resolved = this._resolvePath(path);
+		const encoding = options?.encoding ?? "utf-8";
+		if ((options?.mode ?? "w") === "a") await appendFile(resolved, data, encoding);
+		else await writeFile(resolved, data, encoding);
+		return data.length;
+	}
+	async writeTextAtomic(path, data, options) {
+		const resolved = this._resolvePath(path);
+		const encoding = options?.encoding ?? "utf-8";
+		const tmpPath = `${resolved}.${process.pid}.${Date.now().toString(36)}.${(atomicWriteCounter++).toString(36)}.tmp`;
+		await writeFile(tmpPath, data, encoding);
+		await rename(tmpPath, resolved);
+		return data.length;
+	}
+	async mkdir(path, options) {
+		const resolved = this._resolvePath(path);
+		const parents = options?.parents ?? false;
+		const existOk = options?.existOk ?? false;
+		if (parents) {
+			if (!existOk) try {
+				if ((await stat(resolved)).isDirectory()) throw new JianFileExistsError(`${resolved} already exists`);
+			} catch (error) {
+				if (error instanceof JianFileExistsError) throw error;
+				if (error.code !== "ENOENT") throw error;
+			}
+			await mkdir(resolved, { recursive: true });
+			return;
+		}
+		try {
+			await mkdir(resolved);
+		} catch (error) {
+			if (existOk && error instanceof Error && "code" in error && error.code === "EEXIST") {
+				if (!(await stat(resolved)).isDirectory()) throw new JianFileExistsError(`${resolved} already exists but is not a directory`);
+				return;
+			}
+			throw error;
+		}
+	}
+	async exec(...args) {
+		return this.execWithEnv(args, void 0);
+	}
+	async execWithEnv(args, env) {
+		const command = args[0];
+		if (command === void 0) throw new Error("LocalJian.execWithEnv(): at least one argument (the command to run) is required.");
+		const childEnv = buildSafeEnv(env);
+		const plan = isWindowsPlatform(this._platform) ? await windowsSpawnPlan(command, args.slice(1), childEnv) : {
+			command,
+			args: args.slice(1),
+			windowsVerbatimArguments: false
+		};
+		const child = spawn(plan.command, plan.args, {
+			cwd: this._cwd,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			detached: detachedForProcessTree(this._platform),
+			env: childEnv,
+			windowsVerbatimArguments: plan.windowsVerbatimArguments,
+			windowsHide: true
+		});
+		try {
+			await waitForSpawn(child);
+		} catch (error) {
+			if (error instanceof Error) throw new JianExecError(`Failed to spawn ${plan.command}: ${error.message}`, plan.command, error.code);
+			throw error;
+		}
+		return new LocalProcess(child, this._platform);
+	}
+};
+function waitForSpawn(child) {
+	return new Promise((resolve, reject) => {
+		const onSpawn = () => {
+			child.off("error", onError);
+			resolve();
+		};
+		const onError = (err) => {
+			child.off("spawn", onSpawn);
+			reject(err);
+		};
+		child.once("spawn", onSpawn);
+		child.once("error", onError);
+	});
+}
+new AsyncLocalStorage();
+//#endregion
 //#region ../../packages/agent-core/src/session/hooks/runner.ts
 const DEFAULT_TIMEOUT_SECONDS = 30;
 const KILL_GRACE_MS = 100;
@@ -81526,7 +83067,7 @@ async function runHook(command, input, options) {
 			shell: true,
 			cwd: options.cwd,
 			stdio: "pipe",
-			detached: process.platform !== "win32"
+			detached: detachedForProcessTree(process.platform)
 		});
 	} catch (error) {
 		return allowResult({ stderr: errorMessage$2(error) });
@@ -81654,21 +83195,41 @@ function allowResult(input) {
 		structuredOutput: input.structuredOutput
 	};
 }
+/**
+* Tear down the hook's whole process tree, not just the shell it was spawned as.
+* A hook command that starts children of its own (`sh -c 'foo & bar'`) would
+* otherwise keep running past the timeout — and past the session that started
+* it.
+*
+* POSIX keeps the two-phase signal (SIGTERM, then SIGKILL after a short grace)
+* because the shell leads its own process group. Windows has no POSIX signals:
+* `killProcessTree` force-kills the tree in one step, since a "graceful" phase
+* there would only post `WM_CLOSE`, which console processes ignore — it would
+* report success while the tree kept running.
+*/
 function killProcess(child) {
-	tryKillProcess(child, "SIGTERM");
-	setTimeout(() => {
-		tryKillProcess(child, "SIGKILL");
-	}, KILL_GRACE_MS).unref();
-}
-function tryKillProcess(child, signal) {
-	try {
-		if (process.platform !== "win32" && child.pid !== void 0) process.kill(-child.pid, signal);
-		else child.kill(signal);
-	} catch {
+	const pid = child.pid;
+	if (pid === void 0) {
 		try {
-			child.kill(signal);
+			child.kill();
 		} catch {}
+		return;
 	}
+	const killTree = (signal) => {
+		killProcessTree(pid, { signal }).catch(() => {
+			try {
+				child.kill(signal);
+			} catch {}
+		});
+	};
+	if (isWindowsPlatform(process.platform)) {
+		killTree("SIGKILL");
+		return;
+	}
+	killTree("SIGTERM");
+	setTimeout(() => {
+		killTree("SIGKILL");
+	}, KILL_GRACE_MS).unref();
 }
 function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -82185,6 +83746,16 @@ var PlanModeInjector = class extends DynamicInjector {
 		if (strategy === "fusion") return variant === "full" ? fusionFullReminder(planFilePath) : variant === "sparse" ? fusionSparseReminder(planFilePath) : fusionReentryReminder(planFilePath);
 		return variant === "full" ? fullReminder(planFilePath) : variant === "sparse" ? sparseReminder(planFilePath) : reentryReminder(planFilePath);
 	}
+	/**
+	* Picks the reminder variant for the current injection point.
+	*
+	* A user-authored message resets the cadence to the full reminder. The test
+	* is `isUserAuthoredMessage`, never the role: system reminders, injected
+	* context, scheduled notifications and hook results all land in history as
+	* user-role messages (`ContextMemory.appendSystemReminder`), so matching on
+	* the role alone would let any injection on any step re-trigger the full
+	* reminder and make `PLAN_MODE_FULL_REFRESH_TURNS` unreachable.
+	*/
 	getVariant() {
 		if (this.injectedAt === null) return "full";
 		const history = this.agent.context.history;
@@ -82196,7 +83767,7 @@ var PlanModeInjector = class extends DynamicInjector {
 				assistantTurnsSince += 1;
 				continue;
 			}
-			if (msg.role === "user") return "full";
+			if (isUserAuthoredMessage(msg)) return "full";
 		}
 		if (assistantTurnsSince >= PLAN_MODE_FULL_REFRESH_TURNS) return "full";
 		if (assistantTurnsSince >= PLAN_MODE_DEDUP_MIN_TURNS) return "sparse";
@@ -82325,24 +83896,28 @@ Do NOT write the plan manually. Use the FusionPlan tool to generate it, or Edit
 const TODO_LIST_TOOL_NAME = "TodoList";
 const TODO_STORE_KEY = "todo";
 const TODO_LIST_REMINDER_VARIANT = "todo_list_reminder";
-const TODO_LIST_REMINDER_TURNS_SINCE_WRITE = 10;
-const TODO_LIST_REMINDER_TURNS_BETWEEN_REMINDERS = 10;
+const TODO_LIST_REMINDER_TURNS_SINCE_WRITE = 20;
+const TODO_LIST_REMINDER_TURNS_BETWEEN_REMINDERS = 20;
 /**
 * Periodically reminds the model to update its todo list when it hasn't
 * been touched for many turns. Prevents stale, forgotten task lists.
 *
 * Fires when:
 *   - TodoList tool is active
-*   - >= 10 turns since the last todo write
-*   - >= 10 turns since the last reminder
+*   - the list is non-empty and still has at least one unfinished item
+*     (nothing to maintain means nothing to say)
+*   - >= 20 turns since the last todo write
+*   - >= 20 turns since the last reminder
 */
 var TodoListReminderInjector = class extends DynamicInjector {
 	injectionVariant = TODO_LIST_REMINDER_VARIANT;
 	getInjection() {
 		if (!this.isTodoListActive()) return void 0;
+		const todos = this.currentTodos();
+		if (todos.every((todo) => todo.status === "done")) return void 0;
 		const counts = getTodoListReminderTurnCounts(this.agent.context.history);
 		if (counts.turnsSinceLastWrite < TODO_LIST_REMINDER_TURNS_SINCE_WRITE || counts.turnsSinceLastReminder < TODO_LIST_REMINDER_TURNS_BETWEEN_REMINDERS) return;
-		return renderTodoListReminder(this.currentTodos());
+		return renderTodoListReminder(todos);
 	}
 	isTodoListActive() {
 		return this.agent.tools.data().some((tool) => {
@@ -82410,7 +83985,7 @@ function isTodoItem(value) {
 	return typeof record["title"] === "string" && isTodoStatus(record["status"]);
 }
 function isTodoStatus(value) {
-	return value === "pending" || value === "in_progress" || value === "done";
+	return value === "pending" || value === "in_progress" || value === "done" || value === "blocked";
 }
 //#endregion
 //#region ../../packages/agent-core/src/profile/context.ts
@@ -82872,11 +84447,8 @@ var BotModePermissionPolicy = class BotModePermissionPolicy {
 	isAllowedWritePath(rawPath) {
 		if (rawPath.trim().length === 0) return false;
 		if (rawPath.startsWith("~")) return false;
-		const cwd = this.agent.config?.cwd ?? ".";
-		const norm = normalize(rawPath.startsWith("/") ? rawPath : join(cwd, rawPath));
-		const normCwd = normalize(cwd);
-		if (norm !== normCwd && !norm.startsWith(normCwd.endsWith(sep) ? normCwd : normCwd + sep)) return false;
-		if (BotModePermissionPolicy.SENSITIVE_WRITE.test(basename(norm))) return false;
+		if (!isPathInside(this.agent.config?.cwd ?? ".", rawPath)) return false;
+		if (BotModePermissionPolicy.SENSITIVE_WRITE.test(basename$1(normalize(rawPath)))) return false;
 		return true;
 	}
 	evaluate(context) {
@@ -83060,7 +84632,7 @@ const S_IFDIR = 16384;
 const S_IFREG = 32768;
 async function findGitWorkTreeMarker(jian, cwd) {
 	if (cwd.length === 0 || !isAbsolute$1(cwd)) return null;
-	let current = normalize$1(cwd);
+	let current = normalize(cwd);
 	for (let depth = 0; depth < 256; depth += 1) {
 		const hit = await probeGitMarker(jian, join$1(current, ".git"), current);
 		if (hit !== null) return hit;
@@ -83108,7 +84680,7 @@ function parseGitDir(content, markerParent) {
 	if (line === void 0 || !line.startsWith("gitdir:")) return void 0;
 	const rawPath = line.slice(7).trim();
 	if (rawPath.length === 0) return void 0;
-	return normalize$1(isAbsolute$1(rawPath) ? rawPath : join$1(markerParent, rawPath));
+	return normalize(isAbsolute$1(rawPath) ? rawPath : join$1(markerParent, rawPath));
 }
 //#endregion
 //#region ../../packages/agent-core/src/agent/permission/policies/file-access-ask.ts
@@ -85899,20 +87471,6 @@ var AgentRecords = class {
 		await this.persistence?.flush();
 	}
 };
-/** Mirrors the TUI's isReplayUserTurnRecord predicate (message-replay.ts):
-* a replay record starts a user turn when it is a user-role message from the
-* user (or a user-slash skill activation). */
-function isUserTurnStartRecord(record) {
-	if (record.type !== "message") return false;
-	const { message } = record;
-	if (message.role !== "user") return false;
-	switch (message.origin?.kind) {
-		case void 0:
-		case "user": return true;
-		case "skill_activation": return message.origin.trigger === "user-slash";
-		default: return false;
-	}
-}
 var ReplayBuilder = class {
 	agent;
 	records = [];
@@ -85926,7 +87484,7 @@ var ReplayBuilder = class {
 	push(record) {
 		if (!this.agent.records.restoring) return;
 		this.records.push(record);
-		if (!isUserTurnStartRecord(record)) return;
+		if (record.type !== "message" || !isRealUserPrompt(record.message)) return;
 		this.userTurnStarts.push(this.records.length - 1);
 		if (this.userTurnStarts.length <= 10) return;
 		const dropBefore = this.userTurnStarts[this.userTurnStarts.length - 10];
@@ -94837,8 +96395,14 @@ async function startCallbackServer() {
 function mcpCredentialsDir(screamHomeDir) {
 	return join$1(screamHomeDir, "credentials", "mcp");
 }
+/**
+* Fallback location for the credential store, used when the caller did not
+* pass a `screamHomeDir`. Resolved through the same home resolver as every
+* other caller, so `SCREAM_CODE_HOME` moves this store too instead of leaving
+* it under the built-in `~/.scream-code` default.
+*/
 function defaultMcpCredentialsDir() {
-	return mcpCredentialsDir(join$1(homedir(), ".scream-code"));
+	return mcpCredentialsDir(resolveScreamHome());
 }
 function sanitizeStoreKey(name) {
 	const safe = basename$1(name).replaceAll(/[^a-zA-Z0-9_-]/g, "_").replaceAll(/_+/g, "_");
@@ -98810,7 +100374,7 @@ function readRequiredSource(sources, path) {
 	return content;
 }
 function normalizeSourcePath(path) {
-	return normalize$1(path.replaceAll("\\", "/")).replace(/^\.\//, "");
+	return normalize(path.replaceAll("\\", "/")).replace(/^\.\//, "");
 }
 //#endregion
 //#region ../../packages/agent-core/src/profile/default/agent.yaml
@@ -100461,9 +102025,14 @@ var ToolCallDeduplicator = class {
 const TURN_DEFAULTS = {
 	/**
 	* Convergence gate: max times the turn injects a `<system-reminder>` to
-	* force continuation (empty step, missing TodoList for an active goal,
-	* non-exploratory tool failure, failed verification). Bounded so a model
-	* that can't converge ends the turn instead of looping forever.
+	* force continuation (empty step, non-exploratory tool failure, failed
+	* verification) — all `correction`-category reasons in the stop gate's
+	* three-category scheme (`correction` / `external-input` / `quality-floor`;
+	* see 「续轮输出纪律」 in `docs/turn-pipeline.md`). Bounded so a model that
+	* can't converge ends the turn instead of looping forever. Internal state
+	* upkeep (checklist bookkeeping, goal progress, summary polish) is never a
+	* reason: those reminders run before the answer, never as a post-answer
+	* continuation.
 	*/
 	maxConvergenceInjections: 3,
 	/**
@@ -100915,10 +102484,19 @@ var TurnFlow = class {
 								kind: "system_trigger",
 								name: "todo_required"
 							});
-							if (stepNumber === 2 && !this.todoSeenThisTurn) this.agent.context.appendSystemReminder("This task spans multiple steps. Use TodoList to track the remaining work and current phase.", {
+							if (stepNumber === 3 && !this.todoSeenThisTurn) this.agent.context.appendSystemReminder("This task spans multiple steps. Use TodoList to track the remaining work and current phase.", {
 								kind: "system_trigger",
 								name: "todo_suggested"
 							});
+							if (!this.todoReconcileInjected && this.todoSeenThisTurn) {
+								if (this.agent.tools.getTodos().some((todo) => todo.status !== "done")) {
+									this.todoReconcileInjected = true;
+									this.agent.context.appendSystemReminder("Before you write your final answer this turn, reconcile the TodoList with reality: mark only work that is actually finished as done, leave unfinished items pending or in_progress, and keep blockers accurate. Do not mark incomplete work as done. Fold this into the work you are already doing rather than spending a separate round on it.", {
+										kind: "system_trigger",
+										name: "todo_reconcile"
+									});
+								}
+							}
 							if (stepNumber === 1 || this.agent.fullCompaction.shouldInjectSessionSummary()) {
 								const sessionSummary = this.agent.sessionMemory.getSessionSummary();
 								if (sessionSummary.length > 0) this.agent.context.appendSystemReminder(sessionSummary, {
@@ -100955,7 +102533,6 @@ var TurnFlow = class {
 							if (this.convergenceInjections < TURN_DEFAULTS.maxConvergenceInjections) {
 								const reasons = [];
 								if (!this.currentStepHadContent) reasons.push("The last assistant step produced no content or tool calls. Continue the task.");
-								if (this.agent.goal.getGoal().goal?.status === "active" && !this.todoSeenThisTurn) reasons.push("An active goal exists but no TodoList update was made this turn. Update TodoList and continue.");
 								if (this.lastToolFailure?.isExploratory === false && !hasPassedVerificationThisTurn) reasons.push(`A required tool (${this.lastToolFailure.toolName}) failed this turn. Analyze the error and fix it before reporting completion.`);
 								if (latestVerification && !latestVerification.passed && !this.verificationFailureInjected) {
 									this.verificationFailureInjected = true;
@@ -100997,17 +102574,6 @@ var TurnFlow = class {
 								}
 							}
 							if (this.flushSteerBuffer()) return { continue: true };
-							if (!this.todoReconcileInjected && stopReason !== "max_tokens" && this.agent.background.list().length === 0) {
-								const todos = this.agent.tools.getTodos();
-								if (todos.some((todo) => todo.status !== "done") && todos.length > 0) {
-									this.todoReconcileInjected = true;
-									this.agent.context.appendSystemReminder("Before ending the turn, reconcile the TodoList with reality: mark only work that is actually finished as done, leave unfinished items pending or in_progress, and keep blockers accurate. Do not mark incomplete work as done. Prefer updating TodoList only on this continuation.", {
-										kind: "system_trigger",
-										name: "todo_reconcile"
-									});
-									return { continue: true };
-								}
-							}
 							return { continue: false };
 						},
 						prepareToolExecution: async (ctx) => {
@@ -101055,7 +102621,7 @@ var TurnFlow = class {
 									}
 								}
 							}
-							if (ctx.toolCall.name === "TodoList") this.todoSeenThisTurn = true;
+							if (ctx.toolCall.name === "TodoList" && isError !== true) this.todoSeenThisTurn = true;
 							if (isError === true && [
 								"Edit",
 								"Write",
@@ -101653,7 +103219,7 @@ var Agent = class {
 		}) : Promise.resolve();
 		this.sessionMemory = new SessionMemory(this);
 		this.workingSet = new WorkingSet();
-		this.dreamTracker = new DreamTracker(screamHomeDir ?? "");
+		this.dreamTracker = new DreamTracker(resolveScreamHome(screamHomeDir));
 		this.replayBuilder = new ReplayBuilder(this);
 		this.services = {
 			records: this.records,
@@ -123141,7 +124707,7 @@ async function readSessionIndex(homeDir, sessionsDir) {
 		const sessionDir = resolve$2(entry.sessionDir);
 		if (!isAbsolute$1(entry.sessionDir)) continue;
 		if (!isAbsolute$1(entry.workDir)) continue;
-		if (!isPathInside(sessionsDir, sessionDir)) continue;
+		if (sessionDir === sessionsDir || !isPathInside(sessionsDir, sessionDir)) continue;
 		if (basename$1(sessionDir) !== entry.sessionId) continue;
 		result.set(entry.sessionId, {
 			sessionId: entry.sessionId,
@@ -123193,10 +124759,6 @@ function parseIndexLine(line) {
 		return;
 	}
 }
-function isPathInside(parent, child) {
-	const rel = relative$1(resolve$2(parent), resolve$2(child));
-	return rel !== "" && !rel.startsWith("..") && !isAbsolute$1(rel);
-}
 //#endregion
 //#region ../../packages/agent-core/src/utils/workdir-slug.ts
 const MAX_WORKDIR_SLUG_LENGTH = 40;
@@ -123565,903 +125127,6 @@ function compareSessionSummary(a, b) {
 	return 0;
 }
 //#endregion
-//#region ../../packages/jian/src/errors.ts
-/**
-* Base error class for the jian package.
-*/
-var JianError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "JianError";
-	}
-};
-/**
-* Equivalent to Python's FileExistsError — indicates a file or directory already exists.
-*/
-var JianFileExistsError = class extends JianError {
-	constructor(message) {
-		super(message);
-		this.name = "JianFileExistsError";
-	}
-};
-/**
-* Thrown by `detectEnvironment` on Windows when no Git Bash install can be
-* located. Carries the list of paths that were probed so callers can include
-* them in install hints.
-*/
-var JianShellNotFoundError = class extends JianError {
-	constructor(message) {
-		super(message);
-		this.name = "JianShellNotFoundError";
-	}
-};
-/**
-* Thrown by `LocalJian` when a file operation would resolve outside the
-* instance's configured root directory. This is a last-line-of-defense guard;
-* higher-level path policies should still validate user-supplied paths first.
-*/
-var JianPathOutsideRootError = class extends JianError {
-	path;
-	rootDir;
-	constructor(message, path, rootDir) {
-		super(message);
-		this.path = path;
-		this.rootDir = rootDir;
-		this.name = "JianPathOutsideRootError";
-	}
-};
-/** Thrown when process execution fails (spawn error, ENOENT, EACCES). */
-var JianExecError = class extends JianError {
-	command;
-	code;
-	constructor(message, command, code) {
-		super(message);
-		this.command = command;
-		this.code = code;
-		this.name = "JianExecError";
-	}
-};
-//#endregion
-//#region ../../packages/jian/src/environment.ts
-/**
-* Environment — cross-platform probe of OS / shell.
-*
-* Detection is a pure function of injected probes (`platform` / `arch` /
-* `release` / `env` / `isFile` / `findExecutable`) so the same suite runs
-* identically on any host OS. `detectEnvironmentFromNode()` bundles the
-* Node defaults for production callers.
-*
-* On Windows the probe expects Git Bash (the canonical POSIX shell that
-* ships with Git for Windows). If it cannot be located the function
-* throws `JianShellNotFoundError`; the SDK layer can wrap that into a
-* user-facing install hint. Set `SCREAM_SHELL_PATH` to override.
-*/
-function resolveOsKind(platform) {
-	switch (platform) {
-		case "darwin": return "macOS";
-		case "linux": return "Linux";
-		case "win32": return "Windows";
-		default: return platform;
-	}
-}
-async function detectEnvironment(deps) {
-	const osKind = resolveOsKind(deps.platform);
-	const osArch = deps.arch;
-	const osVersion = deps.release;
-	if (deps.platform === "win32") return {
-		osKind,
-		osArch,
-		osVersion,
-		shellName: "bash",
-		shellPath: await locateWindowsGitBash(deps)
-	};
-	const candidates = [
-		"/bin/bash",
-		"/usr/bin/bash",
-		"/usr/local/bin/bash"
-	];
-	let found;
-	for (const p of candidates) if (await deps.isFile(p)) {
-		found = p;
-		break;
-	}
-	if (found !== void 0) return {
-		osKind,
-		osArch,
-		osVersion,
-		shellName: "bash",
-		shellPath: found
-	};
-	return {
-		osKind,
-		osArch,
-		osVersion,
-		shellName: "sh",
-		shellPath: "/bin/sh"
-	};
-}
-async function locateWindowsGitBash(deps) {
-	const checked = [];
-	const override = deps.env["SCREAM_SHELL_PATH"]?.trim();
-	if (override !== void 0 && override.length > 0) {
-		checked.push(override);
-		if (await deps.isFile(override)) return override;
-	}
-	const gitExe = await deps.findExecutable("git.exe");
-	if (gitExe !== void 0) {
-		const inferred = inferGitBashFromGitExe(gitExe);
-		if (inferred !== void 0) {
-			checked.push(inferred);
-			if (await deps.isFile(inferred)) return inferred;
-		}
-		const fellback = inferBashByWalkingUp(gitExe);
-		if (fellback !== void 0) {
-			checked.push(fellback);
-			if (await deps.isFile(fellback)) return fellback;
-		}
-	}
-	const bashExe = await deps.findExecutable("bash.exe");
-	if (bashExe !== void 0) {
-		checked.push(bashExe);
-		return bashExe;
-	}
-	const candidates = [
-		"C:\\Program Files\\Git\\bin\\bash.exe",
-		"C:\\Program Files (x86)\\Git\\bin\\bash.exe",
-		"C:\\msys64\\usr\\bin\\bash.exe",
-		"C:\\cygwin64\\bin\\bash.exe"
-	];
-	const localAppData = deps.env["LOCALAPPDATA"]?.trim();
-	if (localAppData !== void 0 && localAppData.length > 0) candidates.push(`${localAppData}\\Programs\\Git\\bin\\bash.exe`);
-	const userProfile = deps.env["USERPROFILE"]?.trim();
-	if (userProfile !== void 0 && userProfile.length > 0) candidates.push(`${userProfile}\\scoop\\apps\\git\\current\\bin\\bash.exe`);
-	for (const candidate of candidates) {
-		checked.push(candidate);
-		if (await deps.isFile(candidate)) return candidate;
-	}
-	throw new JianShellNotFoundError(`Git Bash was not found on this Windows host. Install Git for Windows from https://gitforwindows.org/ or set SCREAM_SHELL_PATH to a bash.exe. Checked: ${checked.join(", ")}.`);
-}
-function inferGitBashFromGitExe(gitExe) {
-	const sep = gitExe.includes("\\") ? "\\" : "/";
-	const parts = gitExe.split(sep);
-	for (let i = parts.length - 2; i >= 0; i -= 1) {
-		const segment = parts[i];
-		if (segment === "cmd" || segment === "bin") {
-			const root = parts.slice(0, i).join(sep);
-			return root.length === 0 ? `bin${sep}bash.exe` : `${root}${sep}bin${sep}bash.exe`;
-		}
-	}
-}
-function inferBashByWalkingUp(gitExe) {
-	const sep = gitExe.includes("\\") ? "\\" : "/";
-	const parts = gitExe.split(sep);
-	for (let i = parts.length - 1; i >= 1 && parts.length - i <= 6; i -= 1) {
-		const root = parts.slice(0, i).join(sep) || sep;
-		const candidate = `${root}${sep}bin${sep}bash.exe`;
-		const gitDir = parts.slice(0, -1).join(sep);
-		if (`${root}${sep}bin` !== gitDir) return candidate;
-	}
-}
-/**
-* Production convenience — derive the deps bag from Node's ambient surface.
-*
-* The result is memoised: subsequent calls return the original promise.
-* `Environment` is immutable for the lifetime of the process (it derives
-* from `process.platform`, `process.arch`, `os.release()`, and one-time
-* shell-path discovery), so caching is sound. Tests that need to probe
-* with different inputs should call {@link detectEnvironment} directly
-* with an injected deps bag.
-*/
-let detectedEnvironment;
-function detectEnvironmentFromNode() {
-	if (detectedEnvironment !== void 0) return detectedEnvironment;
-	const platform = process.platform;
-	const env = process.env;
-	const isFile = async (path) => {
-		try {
-			await access(path, constants.F_OK);
-			return true;
-		} catch {
-			return false;
-		}
-	};
-	detectedEnvironment = detectEnvironment({
-		platform,
-		arch: process.arch,
-		release: nodeOs.release(),
-		env,
-		isFile,
-		findExecutable: (name) => findExecutableOnPath(name, env["PATH"], platform, isFile)
-	});
-	return detectedEnvironment;
-}
-async function findExecutableOnPath(name, pathEnv, platform, isFile) {
-	if (pathEnv === void 0 || pathEnv.length === 0) return void 0;
-	const listSep = platform === "win32" ? ";" : ":";
-	const dirSep = platform === "win32" ? "\\" : "/";
-	for (const rawDir of pathEnv.split(listSep)) {
-		const dir = rawDir.trim();
-		if (dir.length === 0) continue;
-		const candidate = dir.endsWith(dirSep) ? `${dir}${name}` : `${dir}${dirSep}${name}`;
-		if (await isFile(candidate)) return candidate;
-	}
-}
-//#endregion
-//#region ../../packages/jian/src/internal.ts
-function isUtf8Continuation(byte) {
-	return byte >= 128 && byte <= 191;
-}
-function decodeUtf8Ignore(data) {
-	let output = "";
-	let i = 0;
-	while (i < data.length) {
-		const b0 = data[i];
-		if (b0 === void 0) break;
-		if (b0 <= 127) {
-			output += String.fromCodePoint(b0);
-			i += 1;
-			continue;
-		}
-		if (b0 >= 194 && b0 <= 223) {
-			const b1 = data[i + 1];
-			if (b1 !== void 0 && isUtf8Continuation(b1)) {
-				output += String.fromCodePoint((b0 & 31) << 6 | b1 & 63);
-				i += 2;
-				continue;
-			}
-			i += 1;
-			continue;
-		}
-		if (b0 >= 224 && b0 <= 239) {
-			const b1 = data[i + 1];
-			const b2 = data[i + 2];
-			if (b1 !== void 0 && (b0 === 224 && b1 >= 160 && b1 <= 191 || b0 >= 225 && b0 <= 236 && isUtf8Continuation(b1) || b0 === 237 && b1 >= 128 && b1 <= 159 || b0 >= 238 && b0 <= 239 && isUtf8Continuation(b1)) && b2 !== void 0 && isUtf8Continuation(b2)) {
-				output += String.fromCodePoint((b0 & 15) << 12 | (b1 & 63) << 6 | b2 & 63);
-				i += 3;
-				continue;
-			}
-			i += 1;
-			continue;
-		}
-		if (b0 >= 240 && b0 <= 244) {
-			const b1 = data[i + 1];
-			const b2 = data[i + 2];
-			const b3 = data[i + 3];
-			if (b1 !== void 0 && (b0 === 240 && b1 >= 144 && b1 <= 191 || b0 >= 241 && b0 <= 243 && isUtf8Continuation(b1) || b0 === 244 && b1 >= 128 && b1 <= 143) && b2 !== void 0 && b3 !== void 0 && isUtf8Continuation(b2) && isUtf8Continuation(b3)) {
-				output += String.fromCodePoint((b0 & 7) << 18 | (b1 & 63) << 12 | (b2 & 63) << 6 | b3 & 63);
-				i += 4;
-				continue;
-			}
-			i += 1;
-			continue;
-		}
-		i += 1;
-	}
-	return output;
-}
-function decodeUtf16LeIgnore(data) {
-	let output = "";
-	let i = 0;
-	while (i + 1 < data.length) {
-		const first = data[i];
-		const second = data[i + 1];
-		if (first === void 0 || second === void 0) break;
-		const codeUnit = first | second << 8;
-		if (codeUnit >= 55296 && codeUnit <= 56319) {
-			const lowFirst = data[i + 2];
-			const lowSecond = data[i + 3];
-			if (lowFirst !== void 0 && lowSecond !== void 0) {
-				const low = lowFirst | lowSecond << 8;
-				if (low >= 56320 && low <= 57343) {
-					const codePoint = 65536 + (codeUnit - 55296 << 10) + (low - 56320);
-					output += String.fromCodePoint(codePoint);
-					i += 4;
-					continue;
-				}
-			}
-			i += 2;
-			continue;
-		}
-		if (codeUnit >= 56320 && codeUnit <= 57343) {
-			i += 2;
-			continue;
-		}
-		output += String.fromCodePoint(codeUnit);
-		i += 2;
-	}
-	return output;
-}
-/**
-* Decode a Buffer into a string with Python-compatible `errors` handling.
-*
-* - `'strict'` (default): throw on invalid sequences (via TextDecoder `fatal: true`)
-* - `'replace'`: substitute each invalid sequence with U+FFFD (TextDecoder default)
-* - `'ignore'`: drop invalid input sequences while preserving valid U+FFFD characters
-*
-* Falls back to `Buffer.toString(encoding)` for encodings TextDecoder does not
-* support (e.g. `hex`, `base64`, `binary`, `latin1`) — those are lossless
-* byte-to-character mappings so `errors` has no effect.
-* @internal
-*/
-function decodeTextWithErrors(data, encoding, errors = "strict") {
-	let webLabel;
-	switch (encoding) {
-		case "utf-8":
-		case "utf8":
-			webLabel = "utf-8";
-			break;
-		case "utf16le":
-		case "ucs2":
-		case "ucs-2":
-			webLabel = "utf-16le";
-			break;
-		default: webLabel = void 0;
-	}
-	if (webLabel === void 0) return data.toString(encoding);
-	if (errors === "strict") return new TextDecoder(webLabel, { fatal: true }).decode(data);
-	if (errors === "ignore") return webLabel === "utf-8" ? decodeUtf8Ignore(data) : decodeUtf16LeIgnore(data);
-	return new TextDecoder(webLabel, { fatal: false }).decode(data);
-}
-/**
-* Convert a glob pattern segment (e.g. "*.txt", "file?.log") into a RegExp.
-* Mirrors Python pathlib behavior: includes dotfiles, case-sensitive by default.
-* @internal
-*/
-function globPatternToRegex(pattern, caseSensitive) {
-	let regex = "^";
-	for (let i = 0; i < pattern.length; i++) {
-		const ch = pattern[i];
-		if (ch === void 0) break;
-		switch (ch) {
-			case "*":
-				regex += "[^/]*";
-				break;
-			case "?":
-				regex += "[^/]";
-				break;
-			case "[": {
-				const end = pattern.indexOf("]", i + 1);
-				if (end === -1) regex += "\\[";
-				else {
-					let charClass = pattern.slice(i + 1, end);
-					if (charClass.startsWith("!")) charClass = "^" + charClass.slice(1);
-					else if (charClass.startsWith("^")) charClass = "\\" + charClass;
-					regex += "[" + charClass + "]";
-					i = end;
-				}
-				break;
-			}
-			default: regex += ch.replaceAll(/[{}()+.\\^$|]/g, "\\$&");
-		}
-	}
-	regex += "$";
-	return new RegExp(regex, caseSensitive ? "" : "i");
-}
-/**
-* A Readable wrapper that preserves source backpressure while still allowing
-* consumers to read buffered output after the source has ended.
-* @internal
-*/
-var BufferedReadable = class extends Readable {
-	_source;
-	_ended = false;
-	constructor(source) {
-		super({ highWaterMark: 128 * 1024 });
-		this._source = source;
-		this._source.on("data", this._onData);
-		this._source.on("end", this._onEnd);
-		this._source.on("close", this._onClose);
-		this._source.on("error", this._onError);
-	}
-	_read() {
-		if (!this._ended && !this.destroyed) this._source.resume();
-	}
-	_destroy(error, callback) {
-		this._source.off("data", this._onData);
-		this._source.off("end", this._onEnd);
-		this._source.off("close", this._onClose);
-		this._source.off("error", this._onError);
-		callback(error);
-	}
-	_onData = (chunk) => {
-		if (!this.push(chunk)) this._source.pause();
-	};
-	_onEnd = () => {
-		this._ended = true;
-		this.push(null);
-	};
-	_onClose = () => {
-		if (!this._ended) {
-			this._ended = true;
-			this.push(null);
-		}
-	};
-	_onError = (error) => {
-		this.destroy(error);
-	};
-};
-//#endregion
-//#region ../../packages/jian/src/local.ts
-/**
-* Environment variables that spawned processes are allowed to inherit from the
-* parent process. All other variables are stripped to prevent accidental secret
-* leakage (e.g. cloud tokens, API keys, SSH agent sockets) into agent-executed
-* commands. Explicit env values passed by callers can still add or override keys.
-*/
-const ALLOWED_INHERITED_ENV_KEYS = [
-	"PATH",
-	"PATHEXT",
-	"SHELL",
-	"ComSpec",
-	"HOME",
-	"USER",
-	"USERNAME",
-	"LOGNAME",
-	"USERPROFILE",
-	"HOMEDRIVE",
-	"HOMEPATH",
-	"LANG",
-	"LC_ALL",
-	"LC_CTYPE",
-	"LC_MESSAGES",
-	"TERM",
-	"TERM_PROGRAM",
-	"TERM_PROGRAM_VERSION",
-	"COLORTERM",
-	"NO_COLOR",
-	"FORCE_COLOR",
-	"TMPDIR",
-	"TEMP",
-	"TMP",
-	"APPDATA",
-	"LOCALAPPDATA",
-	"XDG_CONFIG_HOME",
-	"XDG_CACHE_HOME",
-	"XDG_DATA_HOME",
-	"XDG_RUNTIME_DIR",
-	"GIT_TERMINAL_PROMPT",
-	"GIT_ASKPASS",
-	"SSH_ASKPASS",
-	"SCREAM_PID"
-];
-const isWindows = process.platform === "win32";
-/**
-* True if `candidate` is `base` itself or a descendant of `base`, compared on
-* path-component boundaries. Both paths must already be normalized. This is a
-* lexical check only; it does not resolve symlinks.
-*/
-function isWithinDirectory(candidate, base) {
-	const normalizedCandidate = normalize$1(candidate);
-	const normalizedBase = normalize$1(base);
-	const comparableCandidate = isWindows ? normalizedCandidate.toLowerCase() : normalizedCandidate;
-	const comparableBase = isWindows ? normalizedBase.toLowerCase() : normalizedBase;
-	if (comparableCandidate === comparableBase) return true;
-	const prefix = comparableBase.endsWith("/") ? comparableBase : `${comparableBase}/`;
-	return comparableCandidate.startsWith(prefix);
-}
-/**
-* Build a sanitized environment for child processes. Inherits only an explicit
-* allowlist of ambient variables, then applies caller-supplied overrides.
-*/
-function buildSafeEnv(explicit) {
-	const env = {};
-	for (const key of ALLOWED_INHERITED_ENV_KEYS) {
-		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
-	}
-	if (explicit !== void 0) for (const [key, value] of Object.entries(explicit)) env[key] = value;
-	return env;
-}
-/**
-* Build the `(dev, ino)` cycle-detection key used by `_globWalk`'s
-* visited set. Returns `null` when `ino` is 0, which Node returns on
-* filesystems that don't carry inodes (Windows FAT/exFAT, some SMB/NFS
-* mounts). A null key signals "no reliable identity for this dir" so
-* the caller skips visited tracking for that descent — cycle safety
-* is weakened on those filesystems, but normal walking works instead
-* of every directory colliding on the shared key `"<dev>:0"`.
-*/
-function cycleKey(s) {
-	if (s.ino === 0) return null;
-	return `${String(s.dev)}:${String(s.ino)}`;
-}
-var LocalProcess = class {
-	stdin;
-	stdout;
-	stderr;
-	pid;
-	_child;
-	_exitCode = null;
-	_exitPromise;
-	constructor(child) {
-		if (child.stdin === null || child.stdout === null || child.stderr === null) throw new Error("Process must be created with stdin/stdout/stderr pipes.");
-		this._child = child;
-		this.stdin = child.stdin;
-		this.stdout = new BufferedReadable(child.stdout);
-		this.stderr = new BufferedReadable(child.stderr);
-		this.pid = child.pid ?? -1;
-		this._exitPromise = new Promise((resolve, reject) => {
-			child.on("exit", (code) => {
-				this._exitCode = code ?? -1;
-				resolve(this._exitCode);
-			});
-			child.on("error", (error) => {
-				reject(error);
-			});
-		});
-	}
-	get exitCode() {
-		return this._exitCode;
-	}
-	async wait() {
-		return this._exitPromise;
-	}
-	kill(signal) {
-		if (this.pid <= 0) return Promise.resolve();
-		if (isWindows) {
-			const taskkillArgs = signal === "SIGKILL" ? [
-				"/T",
-				"/F",
-				"/PID",
-				String(this.pid)
-			] : [
-				"/T",
-				"/PID",
-				String(this.pid)
-			];
-			return new Promise((resolve, reject) => {
-				const killer = spawn("taskkill", taskkillArgs, {
-					stdio: "ignore",
-					windowsHide: true
-				});
-				killer.once("error", (err) => {
-					reject(/* @__PURE__ */ new Error(`taskkill failed to start: ${err.message}`));
-				});
-				killer.once("close", (code) => {
-					if (code === 0) resolve();
-					else reject(/* @__PURE__ */ new Error(`taskkill exited with code ${code ?? "null"}`));
-				});
-				killer.unref();
-			});
-		}
-		try {
-			process.kill(-this.pid, signal ?? "SIGTERM");
-		} catch (error) {
-			const err = error;
-			if (err.code === "ESRCH") return Promise.resolve();
-			if (err.code === "EPERM") {
-				try {
-					this._child.kill(signal ?? "SIGTERM");
-				} catch {}
-				return Promise.resolve();
-			}
-			throw error;
-		}
-		return Promise.resolve();
-	}
-};
-let atomicWriteCounter = 0;
-/**
-* A JIAN implementation that directly interacts with the local filesystem.
-*
-* Note: LocalJian maintains its own per-instance working directory (`_cwd`)
-* rather than mutating `process.cwd()`. This lets multiple LocalJian instances
-* coexist with independent cwds (e.g. when switching contexts via
-* `runWithJian`) without cross-polluting each other's relative-path resolution.
-*/
-var LocalJian = class LocalJian {
-	name = "local";
-	osEnv;
-	_cwd;
-	_rootDir;
-	constructor(osEnv, cwd, rootDir) {
-		this._cwd = normalize$1(cwd ?? process.cwd());
-		this._rootDir = rootDir === void 0 ? void 0 : normalize$1(rootDir);
-		this.osEnv = osEnv;
-	}
-	/**
-	* Construct a fresh `LocalJian` after probing the host environment.
-	*
-	* Each call returns a new instance with its own `_cwd`; concurrent
-	* callers can therefore operate on independent working directories
-	* without polluting one another.
-	*/
-	static async create(cwd, rootDir, env) {
-		return new LocalJian(env ?? await detectEnvironmentFromNode(), cwd, rootDir);
-	}
-	withCwd(cwd) {
-		return new LocalJian(this.osEnv, cwd, this._rootDir);
-	}
-	_resolvePath(path) {
-		const resolved = isAbsolute$1(path) ? normalize$1(path) : join$1(this._cwd, path);
-		this._assertWithinRoot(resolved);
-		return resolved;
-	}
-	_assertWithinRoot(resolvedPath) {
-		if (this._rootDir === void 0) return;
-		if (isWithinDirectory(resolvedPath, this._rootDir)) return;
-		throw new JianPathOutsideRootError(`Path outside allowed root directory: ${resolvedPath}`, resolvedPath, this._rootDir);
-	}
-	/** Resolve path for sandboxed operations — lexical check + realpath. */
-	async _resolveSandboxedPath(path) {
-		const lexical = isAbsolute$1(path) ? normalize$1(path) : join$1(this._cwd, path);
-		if (!isWithinDirectory(lexical, this._rootDir)) throw new JianPathOutsideRootError(`Path outside allowed root directory: ${lexical}`, lexical, this._rootDir);
-		const realPath = await realpath(lexical);
-		if (!isWithinDirectory(realPath, await realpath(this._rootDir))) throw new JianPathOutsideRootError(`Path outside allowed root directory (via symlink): ${lexical}`, lexical, this._rootDir);
-		return realPath;
-	}
-	pathClass() {
-		return isWindows ? "win32" : "posix";
-	}
-	normpath(path) {
-		return normalize$1(path);
-	}
-	gethome() {
-		return normalize$1(homedir());
-	}
-	getcwd() {
-		return this._cwd;
-	}
-	/**
-	* Change the working directory of this LocalJian instance.
-	*
-	* Unlike Python's `os.chdir`, this is instance-scoped and never touches
-	* `process.cwd()`. Child processes spawned via {@link exec} inherit this
-	* instance's `_cwd`; concurrent LocalJian instances each carry their own
-	* independent cwd. If you need Python-compatible process-global cwd,
-	* call `process.chdir(x)` directly.
-	*/
-	async chdir(path) {
-		const resolved = this._rootDir !== void 0 ? await this._resolveSandboxedPath(path) : this._resolvePath(path);
-		if (!(await stat(resolved)).isDirectory()) throw new Error(`Not a directory: ${resolved}`);
-		this._cwd = resolved;
-	}
-	async realpath(path, options) {
-		const lexical = this._resolvePath(path);
-		try {
-			return normalize$1(await realpath(lexical));
-		} catch (error) {
-			const code = error.code;
-			if (!options?.allowMissing || code !== "ENOENT" && code !== "ENOTDIR") throw error;
-		}
-		const missingSegments = [];
-		let ancestor = lexical;
-		while (true) {
-			try {
-				await lstat(ancestor);
-			} catch (error) {
-				const code = error.code;
-				if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
-				const parent = dirname$2(ancestor);
-				if (parent === ancestor) throw error;
-				missingSegments.push(basename$1(ancestor));
-				ancestor = parent;
-				continue;
-			}
-			return normalize$1(join$1(normalize$1(await realpath(ancestor)), ...missingSegments.toReversed()));
-		}
-	}
-	async stat(path, options) {
-		const followSymlinks = options?.followSymlinks ?? true;
-		const resolved = this._rootDir !== void 0 && followSymlinks ? await this._resolveSandboxedPath(path) : this._resolvePath(path);
-		const s = followSymlinks ? await stat(resolved) : await lstat(resolved);
-		return {
-			stMode: s.mode,
-			stIno: s.ino,
-			stDev: s.dev,
-			stNlink: s.nlink,
-			stUid: s.uid,
-			stGid: s.gid,
-			stSize: s.size,
-			stAtime: s.atimeMs / 1e3,
-			stMtime: s.mtimeMs / 1e3,
-			stCtime: isWindows ? s.birthtimeMs / 1e3 : s.ctimeMs / 1e3
-		};
-	}
-	async *iterdir(path) {
-		const resolved = this._resolvePath(path);
-		const entries = await readdir(resolved);
-		for (const entry of entries) yield join$1(resolved, entry);
-	}
-	async *glob(path, pattern, options) {
-		const resolved = this._resolvePath(path);
-		const caseSensitive = options?.caseSensitive ?? true;
-		const physicalAllowedRoots = options?.allowedRoots === void 0 ? void 0 : await Promise.all(options.allowedRoots.map((root) => this.realpath(root, { allowMissing: true })));
-		if (!await this._isWithinPhysicalRoots(resolved, physicalAllowedRoots)) return;
-		const patternParts = pattern.split("/");
-		const initVisited = /* @__PURE__ */ new Set();
-		try {
-			const rootKey = cycleKey(await stat(resolved));
-			if (rootKey !== null) initVisited.add(rootKey);
-		} catch {}
-		yield* this._globWalk(resolved, patternParts, caseSensitive, initVisited, physicalAllowedRoots);
-	}
-	async *_globWalk(basePath, patternParts, caseSensitive, visited, physicalAllowedRoots) {
-		if (!await this._isWithinPhysicalRoots(basePath, physicalAllowedRoots)) return;
-		if (patternParts.length === 0) return;
-		const [currentPattern, ...remainingParts] = patternParts;
-		if (currentPattern === "**") {
-			if (remainingParts.length > 0) yield* this._globWalk(basePath, remainingParts, caseSensitive, visited, physicalAllowedRoots);
-			else yield basePath;
-			let entries;
-			try {
-				entries = await readdir(basePath);
-			} catch {
-				return;
-			}
-			for (const entry of entries) {
-				const fullPath = join$1(basePath, entry);
-				if (this._rootDir && !isWithinDirectory(fullPath, this._rootDir)) continue;
-				let entryStat;
-				try {
-					entryStat = await stat(fullPath);
-				} catch {
-					continue;
-				}
-				if (entryStat.isDirectory()) {
-					const key = cycleKey(entryStat);
-					if (key !== null && visited.has(key)) continue;
-					yield* this._globWalk(fullPath, patternParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots);
-				} else if (remainingParts.length === 0 && await this._isWithinPhysicalRoots(fullPath, physicalAllowedRoots)) yield fullPath;
-			}
-		} else {
-			const regex = globPatternToRegex(currentPattern ?? "", caseSensitive);
-			let entries;
-			try {
-				entries = await readdir(basePath);
-			} catch {
-				return;
-			}
-			for (const entry of entries) {
-				if (!regex.test(entry)) continue;
-				const fullPath = join$1(basePath, entry);
-				if (this._rootDir && !isWithinDirectory(fullPath, this._rootDir)) continue;
-				if (remainingParts.length === 0) {
-					if (await this._isWithinPhysicalRoots(fullPath, physicalAllowedRoots)) yield fullPath;
-				} else {
-					let entryStat;
-					try {
-						entryStat = await stat(fullPath);
-					} catch {
-						continue;
-					}
-					if (entryStat.isDirectory()) {
-						const key = cycleKey(entryStat);
-						if (key !== null && visited.has(key)) continue;
-						yield* this._globWalk(fullPath, remainingParts, caseSensitive, key !== null ? new Set([...visited, key]) : visited, physicalAllowedRoots);
-					}
-				}
-			}
-		}
-	}
-	async _isWithinPhysicalRoots(path, physicalAllowedRoots) {
-		if (physicalAllowedRoots === void 0) return true;
-		try {
-			const physicalPath = normalize$1(await realpath(path));
-			return physicalAllowedRoots.some((root) => isWithinDirectory(physicalPath, root));
-		} catch {
-			return false;
-		}
-	}
-	async readBytes(path, n) {
-		const resolved = this._resolvePath(path);
-		if (n === void 0) return Buffer.from(await readFile(resolved));
-		const fh = await open(resolved, "r");
-		try {
-			const buf = Buffer.alloc(n);
-			const { bytesRead } = await fh.read(buf, 0, n, 0);
-			return buf.subarray(0, bytesRead);
-		} finally {
-			await fh.close();
-		}
-	}
-	async readText(path, options) {
-		const resolved = this._resolvePath(path);
-		const encoding = options?.encoding ?? "utf-8";
-		const errors = options?.errors ?? "strict";
-		return decodeTextWithErrors(await readFile(resolved), encoding, errors);
-	}
-	async *readLines(path, options) {
-		const stream = createReadStream(this._resolvePath(path), {
-			encoding: options?.encoding ?? "utf-8",
-			highWaterMark: 64 * 1024
-		});
-		let remainder = "";
-		try {
-			for await (const chunk of stream) {
-				const lines = (remainder + chunk).split("\n");
-				remainder = lines.pop() ?? "";
-				for (const line of lines) yield line + "\n";
-			}
-		} finally {
-			stream.destroy();
-		}
-		if (remainder !== "") yield remainder;
-	}
-	async writeBytes(path, data) {
-		await writeFile(this._resolvePath(path), data);
-		return data.length;
-	}
-	async writeText(path, data, options) {
-		const resolved = this._resolvePath(path);
-		const encoding = options?.encoding ?? "utf-8";
-		if ((options?.mode ?? "w") === "a") await appendFile(resolved, data, encoding);
-		else await writeFile(resolved, data, encoding);
-		return data.length;
-	}
-	async writeTextAtomic(path, data, options) {
-		const resolved = this._resolvePath(path);
-		const encoding = options?.encoding ?? "utf-8";
-		const tmpPath = `${resolved}.${process.pid}.${Date.now().toString(36)}.${(atomicWriteCounter++).toString(36)}.tmp`;
-		await writeFile(tmpPath, data, encoding);
-		await rename(tmpPath, resolved);
-		return data.length;
-	}
-	async mkdir(path, options) {
-		const resolved = this._resolvePath(path);
-		const parents = options?.parents ?? false;
-		const existOk = options?.existOk ?? false;
-		if (parents) {
-			if (!existOk) try {
-				if ((await stat(resolved)).isDirectory()) throw new JianFileExistsError(`${resolved} already exists`);
-			} catch (error) {
-				if (error instanceof JianFileExistsError) throw error;
-				if (error.code !== "ENOENT") throw error;
-			}
-			await mkdir(resolved, { recursive: true });
-			return;
-		}
-		try {
-			await mkdir(resolved);
-		} catch (error) {
-			if (existOk && error instanceof Error && "code" in error && error.code === "EEXIST") {
-				if (!(await stat(resolved)).isDirectory()) throw new JianFileExistsError(`${resolved} already exists but is not a directory`);
-				return;
-			}
-			throw error;
-		}
-	}
-	async exec(...args) {
-		return this.execWithEnv(args, void 0);
-	}
-	async execWithEnv(args, env) {
-		const command = args[0];
-		if (command === void 0) throw new Error("LocalJian.execWithEnv(): at least one argument (the command to run) is required.");
-		const child = spawn(command, args.slice(1), {
-			cwd: this._cwd,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			detached: !isWindows,
-			env: buildSafeEnv(env)
-		});
-		try {
-			await waitForSpawn(child);
-		} catch (error) {
-			if (error instanceof Error) throw new JianExecError(`Failed to spawn ${command}: ${error.message}`, command, error.code);
-			throw error;
-		}
-		return new LocalProcess(child);
-	}
-};
-function waitForSpawn(child) {
-	return new Promise((resolve, reject) => {
-		const onSpawn = () => {
-			child.off("error", onError);
-			resolve();
-		};
-		const onError = (err) => {
-			child.off("spawn", onSpawn);
-			reject(err);
-		};
-		child.once("spawn", onSpawn);
-		child.once("error", onError);
-	});
-}
-new AsyncLocalStorage();
-//#endregion
 //#region ../../packages/agent-core/src/rpc/core-impl.ts
 const ENV_CACHE_TTL_MS = 10080 * 60 * 1e3;
 /**
@@ -133927,7 +134592,7 @@ async function guidedGoalSetup(host) {
 		host.showNotice(t("goal.storm_breaker"), t("goal.conflict_loop"));
 		return;
 	}
-	const { TextInputDialogComponent } = await import("./text-input-dialog-DDUarM0_.mjs");
+	const { TextInputDialogComponent } = await import("./text-input-dialog-DBgQwxaO.mjs");
 	const initialDesc = await promptText(host, TextInputDialogComponent, {
 		title: t("goal.setup_title_initial"),
 		subtitle: t("goal.setup_desc_hint"),
@@ -133948,7 +134613,7 @@ async function guidedGoalSetup(host) {
 	await showGoalConfigWizard(host, session, confirmed.trim() || objective, false);
 }
 async function showGoalConfigWizard(host, session, objective, replace) {
-	const { TextInputDialogComponent } = await import("./text-input-dialog-DDUarM0_.mjs");
+	const { TextInputDialogComponent } = await import("./text-input-dialog-DBgQwxaO.mjs");
 	const turnInput = await promptNumber(host, TextInputDialogComponent, {
 		title: t("goal.wizard_title", { objective }),
 		subtitle: t("goal.budget_turns_hint"),
@@ -140124,26 +140789,36 @@ async function writeUpdateCache(value, filePath = getUpdateStateFile()) {
 	await writeJsonFile(filePath, UpdateCacheSchema, value);
 }
 //#endregion
+//#region src/utils/exec/npm.ts
+function npmLaunchPlan(args, platform = process.platform, comspec = process.env["ComSpec"]) {
+	if (platform !== "win32") return {
+		command: "npm",
+		args,
+		windowsVerbatimArguments: false,
+		platform
+	};
+	return {
+		command: comspec ?? "cmd.exe",
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			buildCmdCommandLine("npm.cmd", args)
+		],
+		windowsVerbatimArguments: true,
+		platform
+	};
+}
+//#endregion
 //#region src/cli/update/cdn.ts
 const NPM_TIMEOUT_MS = 3e3;
 /**
-* Resolve the npm executable name for the current platform.
-*
-* On Windows, `npm` is actually `npm.cmd` — a batch file. Node's child_process
-* can execute `.cmd` files directly without `shell: true`, but only when the
-* filename includes the `.cmd` extension. Using `'npm'` without `.cmd` would
-* fail with ENOENT on Windows.
-*
-* We deliberately avoid `shell: true` because passing args alongside
-* `shell: true` triggers Node's DEP0190 deprecation warning on every spawn.
-*/
-function npmExecutable$1() {
-	return process.platform === "win32" ? "npm.cmd" : "npm";
-}
-/**
 * Query the latest published Scream Code version from the npm registry
 * via `npm view scream-code version`.
 *
+* The argv comes from `npmLaunchPlan`, so a Windows host goes through
+* `cmd.exe` — see there for why the `.cmd` shim cannot be spawned directly.
+*
 * **Throws** on any failure (network error, npm not in PATH, non-semver
 * output). Callers must catch — `refreshUpdateCache` deliberately lets the
 * error propagate so the existing cache stays intact instead of being
@@ -140152,13 +140827,16 @@ function npmExecutable$1() {
 * `execFileImpl` is injectable for tests; defaults to a promisified spawn.
 */
 async function fetchLatestVersionFromNpm(execFileImpl = execFile) {
-	const { stdout } = await promisify(execFileImpl)(npmExecutable$1(), [
+	const execAsync = promisify(execFileImpl);
+	const npm = npmLaunchPlan([
 		"view",
 		"scream-code",
 		"version"
-	], {
+	]);
+	const { stdout } = await execAsync(npm.command, [...npm.args], {
 		timeout: NPM_TIMEOUT_MS,
-		maxBuffer: 1024
+		maxBuffer: 1024,
+		windowsVerbatimArguments: npm.windowsVerbatimArguments
 	});
 	const raw = stdout.trim();
 	if (valid(raw) === null) throw new Error(`npm view 返回的版本号不是合法 semver: ${JSON.stringify(raw)}`);
@@ -140198,15 +140876,6 @@ function selectUpdateTarget(currentVersion, latest) {
 * Network-error detection with user-friendly Chinese prompts.
 */
 const INSTALL_TIMEOUT_MS = 3e5;
-/**
-* Resolve the npm executable name for the current platform.
-*
-* On Windows, `npm` is `npm.cmd` — a batch file Node can spawn directly
-* without `shell: true` (which would trigger DEP0190 when args are passed).
-*/
-function npmExecutable() {
-	return process.platform === "win32" ? "npm.cmd" : "npm";
-}
 const NETWORK_ERROR_PATTERNS = [
 	/ETIMEDOUT/i,
 	/ENOTFOUND/i,
@@ -140227,11 +140896,44 @@ const NETWORK_ERROR_PATTERNS = [
 function isNetworkError(message) {
 	return NETWORK_ERROR_PATTERNS.some((p) => p.test(message));
 }
-async function runInstallStep(cmd, args, cwd, label, timeoutMs = INSTALL_TIMEOUT_MS) {
+/**
+* Reap an install step whose timeout expired.
+*
+* On Windows the direct child is `cmd.exe` (see `npmLaunchPlan`), so signalling
+* it stops the wrapper and leaves the `npm` / `node` beneath it running — there
+* is no process group on Windows to signal instead. `killProcessTree` makes up
+* for that with `taskkill /F /T /PID`, which walks the tree. POSIX has no
+* wrapper in between, so the child itself is signalled exactly as before.
+*
+* Never rejects: the step has already failed with a timeout and the caller is
+* told so, and a reaper that could not run must not turn that into a different
+* error.
+*/
+async function reapTimedOutStep(child, platform) {
+	if (platform !== "win32") {
+		child.kill("SIGTERM");
+		return;
+	}
+	try {
+		await killProcessTree(child.pid ?? 0, {
+			signal: "SIGTERM",
+			platform
+		});
+	} catch {}
+}
+/**
+* Run one install step. `launch` comes from `npmLaunchPlan`, so a Windows host
+* gets the `cmd.exe` command line its `.cmd` shim needs; `spawn` receives the
+* matching `windowsVerbatimArguments` flag because the line is already quoted.
+* `launch` also carries the platform, which is what the timeout teardown
+* branches on.
+*/
+async function runInstallStep(launch, cwd, label, timeoutMs = INSTALL_TIMEOUT_MS) {
 	return new Promise((resolve) => {
-		const child = spawn(cmd, args, {
+		const child = spawn(launch.command, [...launch.args], {
 			cwd,
-			stdio: "pipe"
+			stdio: "pipe",
+			windowsVerbatimArguments: launch.windowsVerbatimArguments
 		});
 		let stderr = "";
 		let settled = false;
@@ -140239,14 +140941,14 @@ async function runInstallStep(cmd, args, cwd, label, timeoutMs = INSTALL_TIMEOUT
 			stderr += d.toString();
 		});
 		const timer = setTimeout(() => {
-			if (!settled) {
-				settled = true;
-				child.kill("SIGTERM");
+			if (settled) return;
+			settled = true;
+			reapTimedOutStep(child, launch.platform).then(() => {
 				resolve({
 					ok: false,
 					message: `${label}${t("update.timeout")}\n` + t("update.network_hint")
 				});
-			}
+			});
 		}, timeoutMs);
 		const finalize = (result) => {
 			if (settled) return;
@@ -140301,7 +141003,7 @@ async function handleUpdateCommand(host) {
 	}
 	host.showStatus(t("update.updating", { version: target.version }));
 	host.showStatus(t("update.npm_install"));
-	const result = await runInstallStep(npmExecutable(), installLatestArgs(), void 0, t("update.install_label"));
+	const result = await runInstallStep(npmLaunchPlan(installLatestArgs()), void 0, t("update.install_label"));
 	if (!result.ok) {
 		host.showError(`❌ ${result.message}`);
 		return;
@@ -145652,4 +146354,4 @@ async function handleBuiltInSlashCommand(host, name, args) {
 	}
 }
 //#endregion
-export { handleExportDebugZipCommand as $, encodeWorkDirKey as $n, lerpGradient as $t, highlightLines as A, embeddingFailureDetail as An, isTurnElapsedEnabled as At, ActivityGroupComponent as B, detectShellEnvironment as Bn, ENABLE_TERMINAL_THEME_REPORTING as Bt, handleCcCommand as C, getLlmNotSetMessage as Cn, clearInfoPanelState as Ct, ToolCallComponent as D, sortSlashCommands as Dn, createEditorTheme as Dt, UserMessageComponent as E, BUILTIN_SLASH_COMMANDS as En, resolveThemeSync as Et, StatusMessageComponent as F, PULSE_WAVE_FRAMES as Fn, detectTerminalTheme as Ft, AgentGroupComponent as G, CLI_COMMAND_NAME as Gn, QUERY_TERMINAL_THEME as Gt, estimateTokens as H, getInputHistoryFile as Hn, OSC11_RESPONSE as Ht, replaceTabs as I, TuiConfigParseError as In, parseOsc11BackgroundTheme as It, getBreathingFrame as J, PRODUCT_NAME as Jn, TERMINAL_THEME_DARK as Jt, WelcomeComponent as K, CLI_UI_MODE as Kn, TERMINAL_FOCUS_IN as Kt, sanitizeShellOutput as L, TuiLikePreferencesSchema as Ln, DISABLE_TERMINAL_FOCUS_REPORTING as Lt, CachedContainer as M, hasEmbeddingModelCache as Mn, createThemeStyles as Mt, ThinkingComponent as N, startManualEmbeddingDownload as Nn, contrastTextHex as Nt, renderDiffLines as O, isExperimentalFlagEnabled as On, createMarkdownTheme as Ot, NoticeMessageComponent as P, PIXEL_PULSE_FRAMES as Pn, getColorPalette as Pt, refineGoal as Q, ScreamHarness as Qn, FooterComponent as Qt, SkillActivationComponent as R, loadTuiConfig as Rn, DISABLE_TERMINAL_THEME_REPORTING as Rt, readJsonlFile as S, getCtrlDHint as Sn, supportsBalance as St, handleRevokeCommand as T, buildSkillSlashCommands as Tn, showUsage as Tt, getSharedSpeedTracker as U, getLogDir as Un, OSC11_RESPONSE_PREFIX as Ut, charsForTokenBudget as V, getDataDir as Vn, OSC11_QUERY as Vt, BackgroundAgentStatusComponent as W, detectInstallSource as Wn, OSC11_RESPONSE_PREFIX_NO_ESC as Wt, CompactionComponent as X, fetchCatalog as Xn, isBusy as Xt, resetBreathingClock as Y, DEFAULT_CATALOG_URL as Yn, TERMINAL_THEME_LIGHT as Yt, clearGoalState as Z, saveCatalogCache as Zn, isStreaming as Zt, handleUpdateCommand as _, EXIT_CONFIRM_WINDOW_MS as _n, handleYoloCommand as _t, syncDiagramCapabilityPrompt as a, printableChar as an, resolveScreamHome as ar, toTerminalHyperlink as at, readUpdateCache as b, TIP_ROTATION_INTERVAL_MS as bn, showSettingsSelector as bt, disposeChildren as c, appendStreamingArgsPreview as cn, resolveGlobalLogPath as cr, handleAutoCommand as ct, isPlanExpandable as d, isTodoItemShape as dn, ErrorCodes as dr, handleEditorCommand as dt, SubagentSlots as en, normalizeWorkDir as er, handleExportMdCommand as et, MoonLoader as f, parseStreamingArgs as fn, SCREAM_ERROR_INFO as fr, handleFusionPlanCommand as ft, handleMcpCommand as g, EMPTY_SESSION_HINT_URL as gn, handleWolfpackCommand as gt, handleChannelCommand as h, truncateErrorMessage as hn, handleThemeCommand as ht, buildRoleAdditionalText as i, handleLogoutCommand as in, MCP_OAUTH_AUTHORIZATION_URL_TOOL_UPDATE as ir, isInternalMessage as it, langFromPath as j, getKnowledgeStore as jn, toggleEmptySessionHint as jt, renderDiffLinesClustered as k, setExperimentalFlags as kn, isEmptySessionHintDismissed as kt, hasDispose as l, argsRecord as ln, isScreamError as lr, handleBotCommand as lt, handleMemoryCommand as m, stringValue as mn, handlePlanCommand as mt, clearEvalPanelState as n, handleSearchCommand as nn, readSessionIndex as nr, handleInitCommand as nt, handleExtensionCommand as o, STATUS_BULLET as on, flushDiagnosticLogs as or, changeThinkingLevel as ot, formatMemoryMemoForInjection as p, serializeToolResultOutput as pn, handleModelCommand as pt, BREATHE_CYCLE_MS as q, CLI_USER_AGENT_PRODUCT as qn, TERMINAL_FOCUS_OUT as qt, openUrl as r, handleConnectCommand as rn, removeSessionIndexEntry as rr, handleTitleCommand as rt, handleSkillCommand as s, appendSessionHeaderHint as sn, log as sr, getModelCycleLevel as st, dispatchInput as t, handleTraceCommand as tn, appendSessionIndexEntry as tr, handleForkCommand as tt, isExpandable as u, formatErrorMessage as un, isOrphanedToolCallError as ur, handleCompactCommand as ut, selectUpdateTarget as v, MAIN_AGENT_ID$1 as vn, showModelPicker as vt, getDaemonInstructions as w, getNoActiveSessionMessage as wn, showStatusReport as wt, appendJsonlLine as x, getCtrlCHint as xn, refreshProviderBalance as xt, refreshUpdateCache as y, SESSION_TIPS as yn, showPermissionPicker as yt, AssistantMessageComponent as z, saveTuiConfig as zn, ENABLE_TERMINAL_FOCUS_REPORTING as zt };
+export { handleExportDebugZipCommand as $, encodeWorkDirKey as $n, lerpGradient as $t, highlightLines as A, embeddingFailureDetail as An, isTurnElapsedEnabled as At, ActivityGroupComponent as B, detectShellEnvironment as Bn, ENABLE_TERMINAL_THEME_REPORTING as Bt, handleCcCommand as C, getLlmNotSetMessage as Cn, clearInfoPanelState as Ct, ToolCallComponent as D, sortSlashCommands as Dn, createEditorTheme as Dt, UserMessageComponent as E, BUILTIN_SLASH_COMMANDS as En, resolveThemeSync as Et, StatusMessageComponent as F, PULSE_WAVE_FRAMES as Fn, detectTerminalTheme as Ft, AgentGroupComponent as G, CLI_COMMAND_NAME as Gn, QUERY_TERMINAL_THEME as Gt, estimateTokens as H, getInputHistoryFile as Hn, OSC11_RESPONSE as Ht, replaceTabs as I, TuiConfigParseError as In, parseOsc11BackgroundTheme as It, getBreathingFrame as J, PRODUCT_NAME as Jn, TERMINAL_THEME_DARK as Jt, WelcomeComponent as K, CLI_UI_MODE as Kn, TERMINAL_FOCUS_IN as Kt, sanitizeShellOutput as L, TuiLikePreferencesSchema as Ln, DISABLE_TERMINAL_FOCUS_REPORTING as Lt, CachedContainer as M, hasEmbeddingModelCache as Mn, createThemeStyles as Mt, ThinkingComponent as N, startManualEmbeddingDownload as Nn, contrastTextHex as Nt, renderDiffLines as O, isExperimentalFlagEnabled as On, createMarkdownTheme as Ot, NoticeMessageComponent as P, PIXEL_PULSE_FRAMES as Pn, getColorPalette as Pt, refineGoal as Q, ScreamHarness as Qn, FooterComponent as Qt, SkillActivationComponent as R, loadTuiConfig as Rn, DISABLE_TERMINAL_THEME_REPORTING as Rt, readJsonlFile as S, getCtrlDHint as Sn, supportsBalance as St, handleRevokeCommand as T, buildSkillSlashCommands as Tn, showUsage as Tt, getSharedSpeedTracker as U, getLogDir as Un, OSC11_RESPONSE_PREFIX as Ut, charsForTokenBudget as V, getDataDir as Vn, OSC11_QUERY as Vt, BackgroundAgentStatusComponent as W, detectInstallSource as Wn, OSC11_RESPONSE_PREFIX_NO_ESC as Wt, CompactionComponent as X, fetchCatalog as Xn, isBusy as Xt, resetBreathingClock as Y, DEFAULT_CATALOG_URL as Yn, TERMINAL_THEME_LIGHT as Yt, clearGoalState as Z, saveCatalogCache as Zn, isStreaming as Zt, handleUpdateCommand as _, EXIT_CONFIRM_WINDOW_MS as _n, handleYoloCommand as _t, syncDiagramCapabilityPrompt as a, printableChar as an, isRealUserPrompt as ar, toTerminalHyperlink as at, readUpdateCache as b, TIP_ROTATION_INTERVAL_MS as bn, showSettingsSelector as bt, disposeChildren as c, appendStreamingArgsPreview as cn, log as cr, handleAutoCommand as ct, isPlanExpandable as d, isTodoItemShape as dn, isOrphanedToolCallError as dr, handleEditorCommand as dt, SubagentSlots as en, normalizeWorkDir as er, handleExportMdCommand as et, MoonLoader as f, parseStreamingArgs as fn, ErrorCodes as fr, handleFusionPlanCommand as ft, handleMcpCommand as g, EMPTY_SESSION_HINT_URL as gn, handleWolfpackCommand as gt, handleChannelCommand as h, truncateErrorMessage as hn, handleThemeCommand as ht, buildRoleAdditionalText as i, handleLogoutCommand as in, MCP_OAUTH_AUTHORIZATION_URL_TOOL_UPDATE as ir, isInternalMessage as it, langFromPath as j, getKnowledgeStore as jn, toggleEmptySessionHint as jt, renderDiffLinesClustered as k, setExperimentalFlags as kn, isEmptySessionHintDismissed as kt, hasDispose as l, argsRecord as ln, resolveGlobalLogPath as lr, handleBotCommand as lt, handleMemoryCommand as m, stringValue as mn, handlePlanCommand as mt, clearEvalPanelState as n, handleSearchCommand as nn, readSessionIndex as nr, handleInitCommand as nt, handleExtensionCommand as o, STATUS_BULLET as on, resolveScreamHome as or, changeThinkingLevel as ot, formatMemoryMemoForInjection as p, serializeToolResultOutput as pn, SCREAM_ERROR_INFO as pr, handleModelCommand as pt, BREATHE_CYCLE_MS as q, CLI_USER_AGENT_PRODUCT as qn, TERMINAL_FOCUS_OUT as qt, openUrl as r, handleConnectCommand as rn, removeSessionIndexEntry as rr, handleTitleCommand as rt, handleSkillCommand as s, appendSessionHeaderHint as sn, flushDiagnosticLogs as sr, getModelCycleLevel as st, dispatchInput as t, handleTraceCommand as tn, appendSessionIndexEntry as tr, handleForkCommand as tt, isExpandable as u, formatErrorMessage as un, isScreamError as ur, handleCompactCommand as ut, selectUpdateTarget as v, MAIN_AGENT_ID$1 as vn, showModelPicker as vt, getDaemonInstructions as w, getNoActiveSessionMessage as wn, showStatusReport as wt, appendJsonlLine as x, getCtrlCHint as xn, refreshProviderBalance as xt, refreshUpdateCache as y, SESSION_TIPS as yn, showPermissionPicker as yt, AssistantMessageComponent as z, saveTuiConfig as zn, ENABLE_TERMINAL_FOCUS_REPORTING as zt };