session-peer 0.1.0-preview.0 → 0.1.0-preview.1

package/CONTRIBUTING.md

@@ -35,6 +35,15 @@ npm run test:package
 npm audit
 ```
 
+Tests live in `test/*.ts`. `npm test` builds declarations, runs strict test
+type-checking, then executes the tests with Node's type-stripping flag (including
+on Node 22.13). Release/repository automation remains JavaScript.
+`npm run test:package` checks that the packed declarations resolve from a
+separate TypeScript consumer. The package root exposes only pure protocol helpers
+(`VERSION`, `VERSION_LINE`, `reply`, `envelope`); importing it does not run the CLI.
+The npm TypeScript indicator requires publishing these declarations in a new
+version; it does not retroactively alter `0.1.0-preview.0`.
+
 Python reference commit: `47c23713d0a2a3c11ebde6186afd8c43489b8b65`.
 CI checks it out separately. Python is a development oracle, never a runtime
 fallback. Match Node 22/24, macOS/Linux and the native dependency requirements.

package/README.ja.md

@@ -15,11 +15,11 @@
 - インストール済みの同じクライアントへの SSH 接続、構造化 Reply-To URI、JSON 出力。
 - 宛先や所有者が曖昧なら拒否。不確実な提出を自動再送しません。
 
-Windows、Relay 通信、MCP、wake/resume、非アクティブ queue、Antigravity、自動更新、暗黙の全エージェント検出、人間向けテキスト出力は未実装です。未対応コマンドは明示的に失敗します。汎用オーケストレーターではありません。
+Relay 通信、MCP、wake/resume、非アクティブ queue、Antigravity、自動更新、暗黙の全エージェント検出、人間向けテキスト出力は未実装です。未対応コマンドは明示的に失敗します。汎用オーケストレーターではありません。
 
 ## 必要条件
 
-macOS / Linux、Node **22.x の 22.13 以上、または 24.x**。Node 26 は対象外です。ネイティブ flock 依存には対応する x64/arm64 バイナリが必要で、純 JavaScript パッケージではありません。Codex 送信には `codex`・`lsof`・`ps`、Claude にはアクセス可能な inbox を持つ稼働中 TUI が必要です。SSH は既存の鍵・ホスト信頼と、接続先の**同一バージョン**のクライアントを使います。
+macOS / Linux / Windows native、Node **22.x の 22.13 以上、または 24.x**。Node 26 は対象外です。ネイティブロック依存には対応する x64/arm64 バイナリが必要で、純 JavaScript パッケージではありません。Codex 送信には `codex` が必要で、macOS/Linux では `lsof`・`ps` も必要です。Windows はネイティブロックと Restart Manager で所有者を確認します。Claude にはアクセス可能な inbox を持つ稼働中 TUI が必要です。SSH は既存の鍵・ホスト信頼と、接続先の**同一バージョン**のクライアントを使います。
 
 ## インストール
 
@@ -33,16 +33,18 @@ npm run build
 node dist/cli.js --version
 npm pack --ignore-scripts
 # 任意のグローバルインストール前に PATH の既存コマンドを確認
-npm install --global --ignore-scripts ./session-peer-0.1.0-preview.0.tgz
+npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
 session-peer --version
 ```
 
-期待値は `session-peer 0.1.0-preview.0 (typescript)`。`./...tgz` を省略しないでください。これは未確認のレジストリではなくローカル成果物を選択します。別途承認された npm 公開後も、パッケージ名とコマンド名は上記のままです。そのリリースのバージョン / dist-tag を確認してください。
+期待値は `session-peer 0.1.0-preview.1 (typescript)`。`./...tgz` を省略しないでください。これは未確認のレジストリではなくローカル成果物を選択します。別途承認された npm 公開後も、パッケージ名とコマンド名は上記のままです。そのリリースのバージョン / dist-tag を確認してください。
 
 ### 既存インストールとの共存
 
 インストール前後に `type -a session-peer` と `command -v session-peer` を確認します。他の実装も同名コマンドを提供するため、PATH 上の一つを選ぶか `node /absolute/path/dist/cli.js` を使ってください。`--force` で他の管理ツールのファイルを上書きしないでください。Python パッケージ・スキル・サービスを自動変更しません。削除は `npm uninstall --global session-peer` を使い、PATH を再確認します。
 
+Windows PowerShell では `Get-Command session-peer -All` で既存コマンドを確認します。Python CLI を置換せずに試すには、`npm ci --ignore-scripts`、`npm run build`、`npm pack --ignore-scripts` の後、`npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz` を実行し、`& "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version` で確認します。同じ prefix の `npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer` で削除します。
+
 ## 使い方
 
 ```sh
@@ -63,6 +65,8 @@ session-peer send --host user@machine --remote-bin /absolute/path/session-peer \
 
 既定のリモートコマンドは PATH の `session-peer`。絶対パスの `--remote-bin` で対応 Node を使うラッパーも指定できます。TypeScript マーカーと正確なバージョンを確認し、異なる実装は拒否します。BatchMode / StrictHostKeyChecking を使い、新しいホスト鍵の自動受理、リモートランタイムのインストール、Python フォールバックはしません。本文はリモートシェル引数ではなく JSON stdin で渡します。任意の `--ssh-opt`、IPv6 リテラル、Tailscale の正規名補完は非対応です。SSH alias / hostname を使ってください。片方向の接続成功は逆方向の接続を保証しません。
 
+Windows の SSH 宛先では `--remote-platform win32` を指定し、必要に応じて `--remote-bin 'C:\absolute\path\session-peer.cmd'` を使います。既に認証済みの OpenSSH 制御ソケットは `--ssh-control-path /local/absolute/socket` で選択できます。ホスト鍵の確認や新しいログイン権限を回避しません。Windows ローカルの Codex home には完全な `C:\Users\...\.codex` パスを使います。既存の Python CLI は自動削除・置換しません。
+
 ### 返信
 
 `session-peer://v1/reply?...` URI を `--to` に指定できます。不明 / 重複フィールド、不正ホスト・エンコード、明示した経路との矛盾は拒否します。`--reply-address URI` は明示的な返信先を付けますが、経路を自動推測・検証しません。新しい返信先なしで返すときは `--no-reply-to`。有効な CODEX_THREAD_ID / CODEX_SESSION_ID は参考用 From 情報になり、`--no-from` で省略できます。不明な送信者は捏造しません。peer 情報は権限ではなく、URI をシェルとして実行しません。
@@ -89,7 +93,7 @@ npm run test:package
 npm audit
 ```
 
-Python は開発時の互換検証基準のみです（v1.0.2、`47c23713d0a2a3c11ebde6186afd8c43489b8b65`）。実行時依存ではありません。テストには C コンパイラーと lsof も必要です。CI は基準コミットを固定し macOS/Linux × Node 22/24 を確認します。SQLite・Unix inbox・実 lock の fixture と、専用実 TUI の証拠 [VALIDATION.md](VALIDATION.md) は別です。fixture 成功は ACK ではありません。パッケージ内容、反復 pack ハッシュ、新規インストール、アンインストールも検証します。ネイティブ依存の通常の install script は実行せず、検証した prebuilt 経路は `--ignore-scripts` を使います。SQLite 読み取り専用接続も WAL 共有メモリー管理に関与し得るため、スナップショットではありません。
+Python は開発時の互換検証基準のみです（v1.0.2、`47c23713d0a2a3c11ebde6186afd8c43489b8b65`）。実行時依存ではありません。POSIX 契約テストには C コンパイラーと lsof も必要です。CI は基準コミットを固定し macOS/Linux/Windows × Node 22/24 を確認します。SQLite・Unix inbox・実 lock の fixture と、専用実 TUI の証拠 [VALIDATION.md](VALIDATION.md) は別です。fixture 成功は ACK ではありません。パッケージ内容、反復 pack ハッシュ、新規インストール、アンインストールも検証します。ネイティブ依存の通常の install script は実行せず、検証した prebuilt 経路は `--ignore-scripts` を使います。SQLite 読み取り専用接続も WAL 共有メモリー管理に関与し得るため、スナップショットではありません。
 
 [CONTRIBUTING.md](CONTRIBUTING.md)、[RELEASING.md](RELEASING.md)、[SECURITY.md](SECURITY.md) を参照してください。公開には別途承認が必要で、自動 npm 公開はありません。[MIT](LICENSE) ライセンスです。
 
@@ -98,7 +102,7 @@ Python は開発時の互換検証基準のみです（v1.0.2、`47c23713d0a2a3c
 公式リリースとレジストリの整合性・provenance 検証が完了した後にのみ、次の正確なプレビューバージョンをインストールしてください。安定版 `latest` ではありません。公開前は上記のローカル tarball を使います。
 
 ```sh
-npm install --global --ignore-scripts session-peer@0.1.0-preview.0
+npm install --global --ignore-scripts session-peer@0.1.0-preview.1
 session-peer --version
 ```
 

package/README.ko.md

@@ -19,15 +19,16 @@ TypeScript 클라이언트입니다. Python 없이 Node.js로 실행합니다.
 - 구조화된 Reply-To URI와 JSON 결과
 - 모호한 대상·확인할 수 없는 소유권은 거부하고, 불확실한 제출은 자동 재시도하지 않음
 
-Windows, Relay 전송, MCP, wake/resume, 비활성 세션 queue, Antigravity, 자동 업데이트,
+Relay 전송, MCP, wake/resume, 비활성 세션 queue, Antigravity, 자동 업데이트,
 암묵적인 전체 에이전트 탐색, 일반 텍스트 출력은 미지원입니다. 미지원 옵션은 명시적으로
 거부하며 범용 오케스트레이터를 지향하지 않습니다.
 
 ## 요구사항
 
-macOS/Linux와 Node **22.x의 22.13 이상 또는 24.x**가 필요합니다. Node 26은
+macOS/Linux/Windows native와 Node **22.x의 22.13 이상 또는 24.x**가 필요합니다. Node 26은
 미지원입니다. 네이티브 flock 의존성에 맞는 사전 빌드 바이너리(x64/arm64)가 필요하므로
-순수 JavaScript 패키지는 아닙니다. Codex 전송에는 `codex`, `lsof`, `ps`와 저장된
+순수 JavaScript 패키지는 아닙니다. Codex 전송에는 `codex`가 필요하고 macOS/Linux에서는
+`lsof`, `ps`도 필요합니다. Windows는 네이티브 잠금과 Restart Manager로 소유자를 확인합니다. 저장된
 스레드의 유일하고 안정적인 live writer가 필요합니다. Claude는 접근 가능한 inbox가
 있는 실행 중 TUI가 필요합니다. SSH에는 OpenSSH, 기존 키·호스트 신뢰 설정과 원격의
 **동일 버전 클라이언트**가 필요합니다.
@@ -46,11 +47,11 @@ npm run build
 node dist/cli.js --version
 npm pack --ignore-scripts
 # 선택 사항: PATH에서 사용할 구현을 명시적으로 선택한 뒤 전역 설치
-npm install --global --ignore-scripts ./session-peer-0.1.0-preview.0.tgz
+npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
 session-peer --version
 ```
 
-예상 출력은 `session-peer 0.1.0-preview.0 (typescript)`입니다. 설치 명령의
+예상 출력은 `session-peer 0.1.0-preview.1 (typescript)`입니다. 설치 명령의
 `./...tgz`는 검증되지 않은 레지스트리 패키지가 아닌 로컬 산출물을 지정하므로 생략하지
 마세요. 별도 승인된 npm 발행 이후에도 패키지명은 `session-peer`, 명령은
 `session-peer`로 유지하며 해당 릴리스의 버전·dist-tag 안내를 따릅니다.
@@ -64,6 +65,18 @@ session-peer --version
 않습니다. npm 설치본 제거는 `npm uninstall --global session-peer`로 하고 PATH를
 다시 확인하세요.
 
+Windows PowerShell에서는 `Get-Command session-peer -All`로 기존 설치본을 확인하세요.
+Python CLI를 덮어쓰지 않으려면 격리 prefix에 설치·제거할 수 있습니다.
+
+```powershell
+npm ci --ignore-scripts
+npm run build
+npm pack --ignore-scripts
+npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz
+& "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version
+# 이후 제거: npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer
+```
+
 ## 사용법
 
 ```sh
@@ -95,6 +108,12 @@ Node를 선택하는 래퍼를 지정할 수 있습니다. TypeScript 표시와
 Tailscale 정규 이름 보강은 미지원이므로 SSH 별칭·호스트명을 사용하세요. 정방향 접속이
 역방향 접속을 보장하지 않습니다.
 
+Windows SSH 대상에는 `--remote-platform win32`를 명시하고, 원격 PATH에 없다면
+`--remote-bin 'C:\절대\경로\session-peer.cmd'`를 지정하세요. 이미 인증된 OpenSSH
+제어 소켓은 `--ssh-control-path /로컬/절대/소켓`으로 선택할 수 있습니다. 이는 호스트 키
+검증을 우회하거나 새 로그인을 허용하지 않습니다. Windows 로컬 Codex 홈은
+`C:\Users\...\.codex`처럼 전체 경로를 사용합니다. 기존 Python CLI는 자동 제거·교체하지 않습니다.
+
 ### 회신
 
 `session-peer://v1/reply?...` URI를 `--to`로 사용할 수 있습니다. 알 수 없거나 중복된
@@ -134,7 +153,7 @@ npm audit
 
 Python은 개발용 호환성 기준(v1.0.2 커밋
 `47c23713d0a2a3c11ebde6186afd8c43489b8b65`)일 뿐 런타임 의존성이 아닙니다. 테스트에는
-C 컴파일러와 lsof도 필요합니다. CI는 참조 커밋을 고정하고 macOS/Linux × Node 22/24를
+C 컴파일러와 lsof는 POSIX 계약 테스트에 필요합니다. CI는 참조 커밋을 고정하고 macOS/Linux/Windows × Node 22/24를
 검사합니다. 임시 SQLite·Unix inbox·실제 잠금 fixture와 [VALIDATION.md](VALIDATION.md)의
 실제 TUI 증거는 구분합니다. fixture 통과는 ACK가 아닙니다. 패키지 내용·반복 빌드 해시·
 새 환경 설치·삭제도 검사합니다. 네이티브 의존성에는 설치 스크립트가 있지만 검증한 사전
@@ -152,7 +171,7 @@ C 컴파일러와 lsof도 필요합니다. CI는 참조 커밋을 고정하고 m
 로컬 tarball 설치를 사용합니다.
 
 ```sh
-npm install --global --ignore-scripts session-peer@0.1.0-preview.0
+npm install --global --ignore-scripts session-peer@0.1.0-preview.1
 session-peer --version
 ```
 

package/README.md

@@ -21,15 +21,16 @@ a Relay server or hosted service.
 - Refuse ambiguous targets and uncertain ownership; never automatically retry
   an uncertain submission.
 
-Not implemented: Windows, Relay transport, MCP, wake/resume, inactive queueing,
+Not implemented: Relay transport, MCP, wake/resume, inactive queueing,
 Antigravity, automatic updates, implicit multi-agent discovery, or human text
 output. Unsupported commands fail explicitly; this is not a general orchestrator.
 
 ## Requirements
 
-macOS or Linux; Node **22.13+ within 22.x or 24.x**. Node 26 is not supported.
+macOS, Linux or native Windows; Node **22.13+ within 22.x or 24.x**. Node 26 is not supported.
 The native flock dependency needs a matching prebuilt binary (x64/arm64); this
-is not a pure-JavaScript package. Codex sends also need `codex`, `lsof` and `ps`.
+is not a pure-JavaScript package. Codex sends need `codex`; macOS/Linux also
+need `lsof` and `ps`. Windows uses native lock and Restart Manager inspection.
 Claude needs a live TUI with an accessible native inbox. SSH requires OpenSSH,
 existing key/host trust and the **same client version** on the destination.
 
@@ -47,11 +48,11 @@ npm run build
 node dist/cli.js --version
 npm pack --ignore-scripts
 # Optional global install: first check which session-peer your PATH selects.
-npm install --global --ignore-scripts ./session-peer-0.1.0-preview.0.tgz
+npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
 session-peer --version
 ```
 
-Expected: `session-peer 0.1.0-preview.0 (typescript)`. Keep the `./...tgz` path;
+Expected: `session-peer 0.1.0-preview.1 (typescript)`. Keep the `./...tgz` path;
 it selects the locally built artifact, not an unverified registry package.
 After a separately approved npm release, the package will remain `session-peer`
 while the command remains `session-peer`; follow that release's version/dist-tag.
@@ -65,6 +66,18 @@ or call this build explicitly with `node /absolute/path/dist/cli.js`. Do not use
 is installed, removed or reconfigured automatically. To remove this npm install,
 run `npm uninstall --global session-peer` and recheck PATH.
 
+On Windows PowerShell, inspect competing commands with
+`Get-Command session-peer -All`. To avoid replacing the Python CLI, use an isolated prefix:
+
+```powershell
+npm ci --ignore-scripts
+npm run build
+npm pack --ignore-scripts
+npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz
+& "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version
+# Later: npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer
+```
+
 ## Use
 
 ```sh
@@ -97,6 +110,14 @@ JSON stdin request, not remote shell arguments. Arbitrary `--ssh-opt`, IPv6
 literals and Tailscale canonical-name enrichment are not supported; use an SSH
 alias/hostname. Forward access does not establish reverse access.
 
+For a Windows SSH destination, add `--remote-platform win32` and select a
+Windows `--remote-bin 'C:\absolute\path\session-peer.cmd'` if needed. A previously
+authenticated OpenSSH control socket can be selected with
+`--ssh-control-path /absolute/local/socket`; this does not bypass host-key
+verification or grant a new login. For local Windows Codex commands, use a full
+`C:\Users\...\.codex` path for `--codex-home`. The Python CLI, if present,
+is not removed or replaced by this preview.
+
 ### Replies
 
 Use a `session-peer://v1/reply?...` URI as `--to`. Unknown/duplicate fields,
@@ -137,8 +158,9 @@ npm audit
 
 Python is only the development conformance oracle (v1.0.2 commit
 `47c23713d0a2a3c11ebde6186afd8c43489b8b65`), never a runtime dependency. Tests also
-need a C compiler and lsof. CI pins the reference and covers macOS/Linux × Node
-22/24. Temporary SQLite, Unix inbox and real lock fixtures are distinct from
+need a C compiler and lsof for the POSIX contract suite. CI pins the reference
+and covers macOS/Linux/Windows × Node 22/24. Temporary
+SQLite, Unix inbox and real lock fixtures are distinct from
 the dedicated real-TUI evidence in [VALIDATION.md](VALIDATION.md). A green fixture
 test is not an ACK. Package tests inspect contents, repeat-pack hashes, clean
 install and uninstall. The native dependency normally has an install script;
@@ -156,7 +178,7 @@ install the exact preview below. It is not the stable `latest` channel. Before
 publication, keep using the local tarball instructions above.
 
 ```sh
-npm install --global --ignore-scripts session-peer@0.1.0-preview.0
+npm install --global --ignore-scripts session-peer@0.1.0-preview.1
 session-peer --version
 ```
 

package/README.zh-CN.md

@@ -15,11 +15,11 @@
 - 通过 SSH 调用远端已安装的同版本客户端，支持结构化 Reply-To URI 和 JSON 输出。
 - 目标或进程归属不明确时拒绝操作；不会自动重试结果不确定的提交。
 
-未实现 Windows、Relay 传输、MCP、wake/resume、非活跃会话排队、Antigravity、自动更新、隐式多代理发现及面向人的文本输出。不支持的命令会明确失败；这不是通用编排器。
+未实现 Relay 传输、MCP、wake/resume、非活跃会话排队、Antigravity、自动更新、隐式多代理发现及面向人的文本输出。不支持的命令会明确失败；这不是通用编排器。
 
 ## 环境要求
 
-macOS 或 Linux；Node **22.x 中的 22.13 及以上，或 24.x**。不支持 Node 26。原生 flock 依赖需要匹配的 x64/arm64 预编译二进制，本包不是纯 JavaScript 实现。Codex 发送还需要 `codex`、`lsof`、`ps`；Claude 需要运行中的 TUI 及可访问的原生 inbox。SSH 使用已有密钥和主机信任，远端必须安装**同版本**客户端。
+macOS、Linux 或 Windows native；Node **22.x 中的 22.13 及以上，或 24.x**。不支持 Node 26。原生锁依赖需要匹配的 x64/arm64 预编译二进制，本包不是纯 JavaScript 实现。Codex 发送需要 `codex`，macOS/Linux 还需要 `lsof`、`ps`；Windows 使用原生锁和 Restart Manager 验证所有者。Claude 需要运行中的 TUI 及可访问的原生 inbox。SSH 使用已有密钥和主机信任，远端必须安装**同版本**客户端。
 
 ## 安装
 
@@ -33,16 +33,18 @@ npm run build
 node dist/cli.js --version
 npm pack --ignore-scripts
 # 可选：全局安装前先检查 PATH 选择的现有命令
-npm install --global --ignore-scripts ./session-peer-0.1.0-preview.0.tgz
+npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
 session-peer --version
 ```
 
-预期输出：`session-peer 0.1.0-preview.0 (typescript)`。保留 `./...tgz` 路径，确保安装的是本地构建产物，而非未验证的注册表包。将来另行批准 npm 发布后，包名和命令名仍如上所示，请按该次发布的版本 / dist-tag 安装。
+预期输出：`session-peer 0.1.0-preview.1 (typescript)`。保留 `./...tgz` 路径，确保安装的是本地构建产物，而非未验证的注册表包。将来另行批准 npm 发布后，包名和命令名仍如上所示，请按该次发布的版本 / dist-tag 安装。
 
 ### 与已有安装共存
 
 安装前后用 `type -a session-peer` 和 `command -v session-peer` 检查实际执行项。其他实现也可能提供同名命令；请选择 PATH 上的一种，或显式运行 `node /absolute/path/dist/cli.js`。不要用 `--force` 覆盖其他管理器的文件。本包不会自动安装、删除或调整 Python 包、技能或服务。卸载使用 `npm uninstall --global session-peer`，随后再次检查 PATH。
 
+在 Windows PowerShell 中用 `Get-Command session-peer -All` 检查已有命令。为了不替换 Python CLI，可先执行 `npm ci --ignore-scripts`、`npm run build`、`npm pack --ignore-scripts`，再用 `npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz` 安装到隔离目录。以 `& "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version` 验证，并可用 `npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer` 卸载。
+
 ## 使用
 
 ```sh
@@ -63,6 +65,8 @@ session-peer send --host user@machine --remote-bin /absolute/path/session-peer \
 
 默认远程命令是 PATH 中的 `session-peer`。绝对路径 `--remote-bin` 也可选择使用受支持 Node 的包装器。握手检查 TypeScript 标记及精确版本，不同实现会被拒绝。SSH 使用 BatchMode 和 StrictHostKeyChecking，不自动接受新主机密钥、不安装远程运行时，也不会退回 Python。消息通过 JSON stdin 传输，不放进远程 shell 参数。不支持任意 `--ssh-opt`、IPv6 字面量或 Tailscale 规范名补全，请使用 SSH 别名 / 主机名。正向访问不意味着反向访问已配置。
 
+对于 Windows SSH 目标，请指定 `--remote-platform win32`；若远端 PATH 中没有命令，再使用 `--remote-bin 'C:\absolute\path\session-peer.cmd'`。可用 `--ssh-control-path /local/absolute/socket` 选择已认证的 OpenSSH 控制套接字；这不会跳过主机密钥验证或授予新登录。Windows 本机的 Codex home 使用完整 `C:\Users\...\.codex` 路径。已有 Python CLI 不会被自动删除或替换。
+
 ### 回复
 
 可将 `session-peer://v1/reply?...` URI 用作 `--to`。未知 / 重复字段、不安全主机、错误编码及与显式路由的冲突都会被拒绝。`--reply-address URI` 添加显式回信地址，不自动推断或验证回程。回复时不附加新地址可用 `--no-reply-to`。有效的 CODEX_THREAD_ID / CODEX_SESSION_ID 可提供参考性 From 信息，`--no-from` 可省略；不会虚构未知发送者。peer 元数据不是授权，Reply-To URI 也不会作为 shell 文本执行。
@@ -89,7 +93,7 @@ npm run test:package
 npm audit
 ```
 
-Python 只用作开发时的兼容性基准（v1.0.2，`47c23713d0a2a3c11ebde6186afd8c43489b8b65`），不是运行时依赖。测试还需要 C 编译器和 lsof。CI 固定基准提交，覆盖 macOS/Linux × Node 22/24。临时 SQLite、Unix inbox、真实锁 fixture 与 [VALIDATION.md](VALIDATION.md) 中专用真实 TUI 的证据分开记录；fixture 通过不是 ACK。包测试检查文件清单、重复打包哈希、全新安装与卸载。原生依赖通常有安装脚本，已验证的预编译路径使用 `--ignore-scripts`。SQLite 只读连接仍可能参与 WAL 共享内存管理，不能视为快照。
+Python 只用作开发时的兼容性基准（v1.0.2，`47c23713d0a2a3c11ebde6186afd8c43489b8b65`），不是运行时依赖。POSIX 契约测试还需要 C 编译器和 lsof。CI 固定基准提交，覆盖 macOS/Linux/Windows × Node 22/24。临时 SQLite、Unix inbox、真实锁 fixture 与 [VALIDATION.md](VALIDATION.md) 中专用真实 TUI 的证据分开记录；fixture 通过不是 ACK。包测试检查文件清单、重复打包哈希、全新安装与卸载。原生依赖通常有安装脚本，已验证的预编译路径使用 `--ignore-scripts`。SQLite 只读连接仍可能参与 WAL 共享内存管理，不能视为快照。
 
 参见 [CONTRIBUTING.md](CONTRIBUTING.md)、[RELEASING.md](RELEASING.md) 和 [SECURITY.md](SECURITY.md)。发布需单独批准，未启用自动 npm 发布。采用 [MIT](LICENSE) 许可证。
 
@@ -98,7 +102,7 @@ Python 只用作开发时的兼容性基准（v1.0.2，`47c23713d0a2a3c11ebde618
 仅在官方发布以及注册表完整性、provenance 验证完成后，安装以下精确预览版本。它不是稳定版 `latest`。公开前继续使用上述本地 tarball 安装。
 
 ```sh
-npm install --global --ignore-scripts session-peer@0.1.0-preview.0
+npm install --global --ignore-scripts session-peer@0.1.0-preview.1
 session-peer --version
 ```
 

package/RELEASING.md

@@ -113,6 +113,21 @@ Prepare a new immutable preview version through a PR. Dispatch main with mode
 already exist; published versions are refused. One `npm stage publish` runs
 with OIDC and the preview tag.
 
+### 0.1.0-preview.1 candidate
+
+This candidate includes the merged TypeScript declaration, SSH preflight,
+publication-verification and native Windows changes (#7–#10). Its publication
+mode is `trusted-stage`; `bootstrap-token` is reserved for preview.0 and must
+not be reused. The existing `latest` tag is retained. For this
+exact candidate, preflight requires both `latest` and `preview` to point to
+preview.0, confirms the registry has no `0.1.0-preview.1` version, and requires
+the exact-main CI gate. No npm tag action is part of this release. After npm
+stage approval, verification requires `preview` to point to preview.1 while
+`latest` still points to preview.0. An unversioned install continues to select
+preview.0; use the explicit `session-peer@0.1.0-preview.1` version for testing.
+Other prerelease `latest` states remain blocked, including future candidates.
+Do not infer publication from local packaging, a green PR, or an approved stage.
+
 **A successful staged run is pending approval, not a public release.** Record its
 stage ID from npm output. Review its tarball against the retained manifest and
 approve with 2FA in npmjs.com or interactive `npm stage approve`. OIDC cannot
@@ -142,6 +157,22 @@ checks. Inspect registry/staged state and retained evidence first. Read-only
 verification of the exact artifact may be repeated; publication may not.
 A broken/partial public release requires a reviewed new version and approval.
 
+### First publication propagation and tag state
+
+The first public `0.1.0-preview.0` upload returned success, while its workflow
+verification initially saw registry 404 responses. The exact tarball, provenance
+and isolated install were later verified, but the run remains failed. Verification
+now waits for up to 30 read attempts (two seconds between reads) before reporting
+that a published version is still invisible. Never re-upload that version.
+
+The registry also assigned both `preview` and `latest` to the initial preview
+despite the explicit `--tag preview`. The preview.1 gate preserves this exact
+legacy `latest` value and refuses any change to it; the exception does not apply
+to later versions. Review the current tags and agree on a separate operator
+action in npm before changing a tag; the workflow never does so. A verification
+failure from the tag check does not mean the upload failed. Record upload,
+registry propagation, tag state and install verification separately.
+
 ## Sources
 
 - [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)

package/VALIDATION.md

@@ -3,6 +3,17 @@
 This is preview evidence, not an npm release or a claim of complete Python parity.
 Python reference: v1.0.2, commit `47c23713d0a2a3c11ebde6186afd8c43489b8b65`.
 
+## 0.1.0-preview.1 candidate
+
+After #7–#10 were merged, the versioned candidate passed the local macOS
+arm64 Node 22 contract suite (23 passed, two Windows-only tests skipped),
+TypeScript test type-check, package/declaration smoke test, four-README
+repository checks and `npm audit` (zero vulnerabilities). The package smoke
+test repeated packing with the same SHA-256 and verified isolated install and
+uninstall. The new candidate was not sent to a live agent and was not published
+by these checks. Windows Node 22/24 and macOS/Linux Node 22/24 must also pass
+on the candidate PR and exact merged `main` commit before publication.
+
 ## Automated checks
 
 - 14 tests pass locally on macOS arm64 / Node 22.14.0.
@@ -17,6 +28,30 @@ Python reference: v1.0.2, commit `47c23713d0a2a3c11ebde6186afd8c43489b8b65`.
 
 ## Real TUI and SSH checks
 
+### Native Windows candidate — 2026-09-27 KST
+
+An isolated prefix under the Windows user's Temp directory was installed from
+this branch's local tarball. The existing Python CLI was not removed or
+overwritten. Node 24.16.0 and npm 11.13.0 were present. Windows native
+`list` found the live Claude inbox; Codex dry-run verified the saved thread,
+kernel lock, single same-user `codex.exe` opener and stable start time. Mac
+mini → Windows SSH preflight used an explicit Windows platform, remote `.cmd`
+path and an already authenticated OpenSSH control socket; no host-key bypass
+or new login was introduced.
+
+One message per target was submitted from this candidate through Windows SSH.
+The CLI returned Claude `posted` and Codex `queued`, with
+`consumptionConfirmed:false`. The user separately confirmed exact response
+lines in both Windows native TUIs:
+
+- Claude: `ACK TS-WIN4-CLAUDE-20260927-A`
+- Codex: `ACK TS-WIN4-CODEX-20260927-B`
+
+These ACKs are user-observed responses, not direct terminal-pane capture by
+the test runner. No retry was made. This is one-shot evidence, not a soak or
+all-architecture qualification. Windows x64 was tested; Windows arm64 and
+Node 22 remain untested in this live check. Python remains installed.
+
 Dedicated, newly created Claude/Codex test TUIs only. The user approved trusting
 the two otherwise empty test folders. Agent permissions were not changed.
 Each route passed discovery and no-delivery dry-run before exactly one send.
@@ -69,7 +104,7 @@ package/release fixtures, not claimed as new live ACK evidence.
 
 ## Not covered / not released
 
-Windows, native x64 agent interaction, IPv6 literals, Relay/MCP/wake, full Python
+Windows arm64, IPv6 literals, Relay/MCP/wake, full Python
 CLI parity, automatic reverse-route detection, npm registry publishing and
 provenance are outside this historical evidence. Publication preparation now
 removes the private flag, but actual publishing still needs separate approval

package/dist/cli.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { type Done } from './process.js';
+type Options = {
+    command: 'list' | 'send';
+    values: Map<string, string>;
+    flags: Set<string>;
+};
+export declare function parse(args: string[]): Options;
+export declare function sshPreflightFailure(result: Done, expected: string): string | undefined;
+export {};

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { hostname } from 'node:os';
+import { lstatSync } from 'node:fs';
 import { claude, codex, Refusal } from './discovery.js';
 import { executable, run, UnknownOutcome } from './process.js';
 import { checkMessage, send } from './send.js';
@@ -18,7 +19,7 @@ export function parse(args) {
                 throw new Refusal('invalid_option');
             flags.add(key);
         }
-        else if (['--agent', '--codex-home', '--codex-bin', '--output-format', '--to', '--message', '-m', '--host', '--remote-bin', '--reply-address'].includes(key)) {
+        else if (['--agent', '--codex-home', '--codex-bin', '--output-format', '--to', '--message', '-m', '--host', '--remote-bin', '--remote-platform', '--ssh-control-path', '--reply-address'].includes(key)) {
             const name = key === '-m' ? '--message' : key;
             const value = split > 0 ? token.slice(split + 1) : args[++i];
             if (value === undefined || values.has(name))
@@ -60,8 +61,23 @@ export function parse(args) {
     }
     if (values.has('--host'))
         host(values.get('--host'));
+    if (values.has('--ssh-control-path')) {
+        if (!values.has('--host'))
+            throw new Refusal('inapplicable_option');
+        try {
+            if (!lstatSync(values.get('--ssh-control-path')).isSocket())
+                throw new Error('not_socket');
+        }
+        catch {
+            throw new Refusal('invalid_ssh_control_path');
+        }
+    }
+    if (values.has('--remote-platform') && (!values.has('--host') || !['posix', 'win32'].includes(values.get('--remote-platform'))))
+        throw new Refusal('invalid_remote_platform');
     if (values.has('--remote-bin')) {
-        if (!values.has('--host') || !/^\/[\x20-\x7e]+$/.test(values.get('--remote-bin')))
+        const binary = values.get('--remote-bin');
+        if (!values.has('--host') || (values.get('--remote-platform') === 'win32' ?
+            !/^[A-Za-z]:\\[^\r\n]+$/.test(binary) : !/^\/[\x20-\x7e]+$/.test(binary)))
             throw new Refusal('invalid_remote_bin');
     }
     return { command, values, flags };
@@ -84,15 +100,46 @@ async function input() {
     }
 }
 const quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+// Classify only the no-message version preflight. Never expose SSH stderr,
+// which can contain user paths or agent output.
+export function sshPreflightFailure(result, expected) {
+    if (result.interrupted)
+        return 'ssh_preflight_timeout';
+    if (!result.spawned)
+        return 'ssh_unavailable';
+    const detail = result.stderr;
+    if (/host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED|no [^\n]*host key is known/i.test(detail))
+        return 'ssh_host_key_untrusted';
+    if (/permission denied \(|authentication failed|too many authentication failures|tailnet policy does not permit/i.test(detail))
+        return 'ssh_authentication_refused';
+    if (/could not resolve hostname|name or service not known|network is unreachable|no route to host|connection timed out|connection refused|operation timed out/i.test(detail))
+        return 'ssh_unreachable';
+    if (result.code === 127 && /not found|no such file|not recognized/i.test(detail))
+        return 'remote_cli_missing';
+    if (result.code === 0 && result.stdout.trim() !== expected)
+        return 'remote_version_mismatch';
+    if (result.code !== 0)
+        return 'ssh_preflight_failed';
+    return undefined;
+}
 async function remote(options, message) {
     const { values, flags, command } = options;
     const target = host(values.get('--host'));
     const binary = values.get('--remote-bin') ?? 'session-peer';
+    const windows = values.get('--remote-platform') === 'win32';
+    const invoke = (flag) => {
+        if (!windows)
+            return `${quote(binary)} ${flag}`;
+        const code = `& '${binary.replace(/'/g, "''")}' ${flag}`;
+        return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${Buffer.from(code, 'utf16le').toString('base64')}`;
+    };
     const ssh = executable('ssh');
-    const base = ['-T', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes', '-o', 'ConnectTimeout=10', '--', target];
-    const preflight = await run(ssh, [...base, `${quote(binary)} --version`], { timeout: 15000 });
-    if (preflight.interrupted || preflight.code !== 0 || preflight.stdout.trim() !== VERSION_LINE)
-        throw new Refusal('remote_version_unverified', 1);
+    const base = ['-T', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes', '-o', 'ConnectTimeout=10',
+        ...(values.has('--ssh-control-path') ? ['-S', values.get('--ssh-control-path')] : []), '--', target];
+    const preflight = await run(ssh, [...base, invoke('--version')], { timeout: 15000 });
+    const preflightError = sshPreflightFailure(preflight, VERSION_LINE);
+    if (preflightError)
+        throw new Refusal(preflightError, 1);
     const args = [command, '--json'];
     for (const [key, value] of values)
         if (['--agent', '--codex-home', '--codex-bin', '--to'].includes(key))
@@ -103,7 +150,7 @@ async function remote(options, message) {
         args.push('--dry-run');
     if (command === 'send')
         args.push('--message', message, '--no-from', '--no-reply-to');
-    const done = await run(ssh, [...base, `${quote(binary)} --stdio-request`], {
+    const done = await run(ssh, [...base, invoke('--stdio-request')], {
         timeout: 90000, input: JSON.stringify({ schemaVersion: 1, args })
     });
     const uncertain = () => { if (command === 'send' && !flags.has('--dry-run') && done.spawned)
@@ -132,13 +179,13 @@ try {
     const [major, minor] = process.versions.node.split('.').map(Number);
     if (!((major === 22 && minor >= 13) || major === 24))
         throw new Refusal('unsupported_node_version');
-    if (!['darwin', 'linux'].includes(process.platform))
+    if (!['darwin', 'linux', 'win32'].includes(process.platform))
         throw new Refusal('unsupported_platform');
     let args = process.argv.slice(2);
     if (args.length === 1 && args[0] === '--version')
         console.log(VERSION_LINE);
     else if (args.length === 1 && ['--help', '-h'].includes(args[0]))
-        console.log('session-peer (TypeScript preview): list --agent claude|codex --json; send --to TARGET --message TEXT --json [--dry-run] [--host HOST] [--remote-bin ABSOLUTE_PATH]. Codex requires --codex-home. Relay/MCP/wake/Windows unsupported.');
+        console.log('session-peer (TypeScript preview): list --agent claude|codex --json; send --to TARGET --message TEXT --json [--dry-run] [--host HOST] [--remote-bin ABSOLUTE_PATH]. Codex requires --codex-home. Relay/MCP/wake unsupported.');
     else {
         const wire = args.length === 1 && args[0] === '--stdio-request';
         if (wire) {
@@ -156,7 +203,7 @@ try {
         }
         command = ['list', 'send'].includes(args[0] ?? '') ? args[0] : 'unknown';
         const options = parse(args);
-        if (wire && (options.values.has('--host') || options.values.has('--remote-bin')))
+        if (wire && (options.values.has('--host') || options.values.has('--remote-bin') || options.values.has('--remote-platform') || options.values.has('--ssh-control-path')))
             throw new Refusal('nested_transport_forbidden');
         let message;
         if (command === 'send') {

package/dist/discovery.d.ts

@@ -0,0 +1,10 @@
+type Row = Record<string, unknown>;
+export declare class Refusal extends Error {
+    readonly code: string;
+    readonly exitCode: number;
+    constructor(code: string, exitCode?: number);
+}
+export declare function canonical(path: string): string;
+export declare function claude(all: boolean): Row;
+export declare function codex(path: string, all: boolean): Promise<Row>;
+export {};

package/dist/discovery.js

@@ -2,6 +2,7 @@
 import { readFileSync, readdirSync, realpathSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
+import { windowsProcessStart } from './windows.js';
 export class Refusal extends Error {
     code;
     exitCode;
@@ -33,6 +34,8 @@ export function canonical(path) {
 function alive(pid) {
     if (pid <= 1)
         return false;
+    if (process.platform === 'win32')
+        return windowsProcessStart(pid) !== undefined;
     try {
         process.kill(pid, 0);
         return true;
@@ -71,20 +74,31 @@ export function claude(all) {
         if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid > 2147483647)
             continue;
         const matches = pid === Number(entry.slice(0, -5));
-        const live = matches && alive(pid);
+        let live = matches && alive(pid);
+        if (live && process.platform === 'win32') {
+            const started = typeof record.startedAt === 'number' && Number.isSafeInteger(record.startedAt) && record.startedAt > 0 ? record.startedAt : NaN;
+            const ticks = windowsProcessStart(pid);
+            const actual = ticks === undefined ? NaN : Number((ticks - 116444736000000000n) / 10000n);
+            live = Number.isFinite(started) && Number.isFinite(actual) && actual <= started + 2000;
+        }
         const socket = typeof record.messagingSocketPath === 'string' ? record.messagingSocketPath : '';
         let inbox = false;
         if (socket) {
-            try {
-                inbox = statSync(socket).isSocket();
-            }
-            catch { /* Inaccessible is not reachable. */ }
+            if (process.platform === 'win32')
+                inbox = /^\\\\\.\\pipe\\[^\r\n]+$/i.test(socket);
+            else
+                try {
+                    inbox = statSync(socket).isSocket();
+                }
+                catch { /* Inaccessible is not reachable. */ }
         }
         const row = { agent: 'claude', pid, socket, alive: live, reachable: live && inbox };
         for (const key of ['name', 'status', 'cwd', 'kind', 'version', 'tmux'])
             row[key] = record[key] ?? null;
         if (!matches)
             row.staleReason = 'record_pid_mismatch';
+        else if (!live && process.platform === 'win32')
+            row.staleReason = 'process_unverified';
         if (all || row.reachable)
             sessions.push(row);
     }

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { VERSION, VERSION_LINE, reply, envelope } from './protocol.js';

package/dist/index.js

@@ -0,0 +1,2 @@
+// Pure protocol helpers; importing this entry point never executes the CLI.
+export { VERSION, VERSION_LINE, reply, envelope } from './protocol.js';

package/dist/process.d.ts

@@ -0,0 +1,16 @@
+export declare class UnknownOutcome extends Error {
+}
+export declare function executable(name: string): string;
+export type Done = {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    spawned: boolean;
+    interrupted: boolean;
+};
+export declare function run(binary: string, args: string[], options?: {
+    env?: NodeJS.ProcessEnv;
+    input?: string;
+    timeout?: number;
+    limit?: number;
+}): Promise<Done>;

package/dist/process.js

@@ -5,8 +5,10 @@ import { Refusal } from './discovery.js';
 export class UnknownOutcome extends Error {
 }
 export function executable(name) {
-    const paths = isAbsolute(name) ? [name] : name.includes('/') ? [] :
-        (process.env.PATH ?? '').split(delimiter).filter(Boolean).map(p => join(p, name));
+    const windows = process.platform === 'win32';
+    const names = windows && !/\.(?:exe|cmd|bat)$/i.test(name) ? [name + '.exe', name + '.cmd', name] : [name];
+    const paths = isAbsolute(name) ? [name] : name.includes('/') || name.includes('\\') ? [] :
+        (process.env.PATH ?? '').split(delimiter).filter(Boolean).flatMap(p => names.map(n => join(p, n)));
     for (const path of paths) {
         try {
             accessSync(path, constants.X_OK);
@@ -19,7 +21,7 @@ export function executable(name) {
 }
 export function run(binary, args, options = {}) {
     return new Promise(resolve => {
-        let stdout = '', bytes = 0, spawned = false, interrupted = false;
+        let stdout = '', stderr = '', bytes = 0, spawned = false, interrupted = false;
         const child = spawn(binary, args, { shell: false, env: options.env ?? process.env, stdio: ['pipe', 'pipe', 'pipe'] });
         const stop = () => { interrupted = true; child.kill('SIGKILL'); };
         const timer = setTimeout(stop, options.timeout ?? 3000);
@@ -34,10 +36,16 @@ export function run(binary, args, options = {}) {
                 stdout += part;
         });
         // Drain but never report native stderr (it may contain message text/credentials).
-        child.stderr.on('data', (part) => { bytes += part.length; if (bytes > (options.limit ?? 1024 * 1024))
-            stop(); });
+        // Retain stderr only for allowlisted error classification. Never include it in CLI output.
+        child.stderr.on('data', (part) => {
+            bytes += part.length;
+            if (stderr.length < 4096)
+                stderr += part.toString('utf8').slice(0, 4096 - stderr.length);
+            if (bytes > (options.limit ?? 1024 * 1024))
+                stop();
+        });
         child.once('error', () => { interrupted = true; });
-        child.once('close', code => { clearTimeout(timer); resolve({ code, stdout, spawned, interrupted }); });
+        child.once('close', code => { clearTimeout(timer); resolve({ code, stdout, stderr, spawned, interrupted }); });
         child.stdin.end(options.input);
     });
 }

package/dist/protocol.d.ts

@@ -0,0 +1,9 @@
+export declare const VERSION = "0.1.0-preview.1";
+export declare const VERSION_LINE = "session-peer 0.1.0-preview.1 (typescript)";
+export declare function host(value: string): string;
+export declare function reply(value: string): {
+    to: string;
+    host?: string;
+    home?: string;
+};
+export declare function envelope(text: string, noFrom: boolean, address?: string): string;

package/dist/protocol.js

@@ -1,6 +1,6 @@
 import { Refusal } from './discovery.js';
 import { uuid } from './writer.js';
-export const VERSION = '0.1.0-preview.0';
+export const VERSION = '0.1.0-preview.1';
 export const VERSION_LINE = `session-peer ${VERSION} (typescript)`;
 export function host(value) {
     if (value.length > 255 || !/^(?:[A-Za-z0-9_][A-Za-z0-9_.-]*@)?[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(value))

package/dist/send.d.ts

@@ -0,0 +1,10 @@
+export type SendOptions = {
+    to: string;
+    home?: string;
+    codexBin?: string;
+    message: string;
+    dryRun?: boolean;
+};
+export declare function checkMessage(text: string, codex?: boolean): void;
+export declare function postSocket(path: string, text: string): Promise<void>;
+export declare function send(options: SendOptions): Promise<Record<string, unknown>>;

package/dist/send.js

@@ -2,6 +2,7 @@ import { createConnection } from 'node:net';
 import { canonical, claude, Refusal } from './discovery.js';
 import { executable, run, UnknownOutcome } from './process.js';
 import { resolveWriter, uuid } from './writer.js';
+import { postWindowsPipe } from './windows.js';
 export function checkMessage(text, codex = false) {
     if (!text.trim() || text.includes('\0') || [...text].length > 1_000_000 ||
         (codex && Buffer.byteLength(text, 'utf8') > 32768))
@@ -83,6 +84,9 @@ export async function send(options) {
     const rechecked = select();
     if (row.pid !== rechecked.pid || row.socket !== rechecked.socket)
         throw new Refusal('target_changed', 1);
-    await postSocket(String(row.socket), options.message);
+    if (process.platform === 'win32')
+        await postWindowsPipe(String(row.socket), Number(row.pid), options.message);
+    else
+        await postSocket(String(row.socket), options.message);
     return result;
 }

package/dist/windows.d.ts

@@ -0,0 +1,9 @@
+export type WindowsProcess = {
+    pid: number;
+    uid: string;
+    command: string;
+    start: string;
+};
+export declare function inspectWindows(mode: 'identity' | 'openers', value: string): WindowsProcess[];
+export declare function windowsProcessStart(pid: number): bigint | undefined;
+export declare function postWindowsPipe(pipe: string, pid: number, text: string): Promise<void>;

package/dist/windows.js

@@ -0,0 +1,171 @@
+import { readdirSync, readFileSync, lstatSync } from 'node:fs';
+import { join } from 'node:path';
+import { createConnection } from 'node:net';
+import { spawnSync } from 'node:child_process';
+import { Refusal } from './discovery.js';
+import { UnknownOutcome } from './process.js';
+// Get-CimInstance and Restart Manager are Windows read-only APIs. The script
+// emits only PID, SID, executable basename and creation time. No arguments,
+// command line, message body, token or file contents are returned.
+const inspectScript = String.raw `
+$ErrorActionPreference = 'Stop'
+Add-Type -TypeDefinition @'
+using System;
+using System.Text;
+using System.Runtime.InteropServices;
+public static class Reader {
+  [StructLayout(LayoutKind.Sequential)] public struct Time { public uint Lo; public uint Hi; }
+  [StructLayout(LayoutKind.Sequential)] public struct Unique { public uint Pid; public Time Start; }
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct Info {
+    public Unique Process;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=256)] public string App;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=64)] public string Service;
+    public uint Kind; public uint Status; public uint Session;
+    [MarshalAs(UnmanagedType.Bool)] public bool Restartable;
+  }
+  [DllImport("Rstrtmgr.dll", CharSet=CharSet.Unicode)] public static extern int RmStartSession(out uint session, uint flags, StringBuilder key);
+  [DllImport("Rstrtmgr.dll", CharSet=CharSet.Unicode)] public static extern int RmRegisterResources(uint session, uint files, string[] paths, uint apps, IntPtr app, uint services, IntPtr svc);
+  [DllImport("Rstrtmgr.dll")] public static extern int RmGetList(uint session, out uint needed, ref uint count, [In,Out] Info[] info, ref uint reasons);
+  [DllImport("Rstrtmgr.dll")] public static extern int RmEndSession(uint session);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, uint pid);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetProcessTimes(IntPtr handle, out Time creation, out Time exit, out Time kernel, out Time user);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  public static ulong Start(uint pid) {
+    var handle = OpenProcess(0x1000, false, pid);
+    if (handle == IntPtr.Zero) throw new Exception("process_unavailable");
+    try {
+      Time created, exited, kernel, user;
+      if (!GetProcessTimes(handle, out created, out exited, out kernel, out user)) throw new Exception("process_unavailable");
+      return ((ulong)created.Hi << 32) | created.Lo;
+    } finally { CloseHandle(handle); }
+  }
+}
+'@
+function Identity([uint32]$identifier, [string]$expected = '') {
+  $item = Get-CimInstance Win32_Process -Filter "ProcessId = $identifier"
+  if (!$item) { throw 'process_unavailable' }
+  $start = [string][Reader]::Start($identifier)
+  if ($expected -and $start -ne $expected) { throw 'process_replaced' }
+  $owner = Invoke-CimMethod -InputObject $item -MethodName GetOwnerSid
+  if (!$owner.Sid) { throw 'owner_unavailable' }
+  return @{pid=[int]$identifier; uid=[string]$owner.Sid; command=[string]$item.Name; start=$start}
+}
+function Openers([string]$location) {
+  [uint32]$session = 0
+  $key = New-Object System.Text.StringBuilder 33
+  if ([Reader]::RmStartSession([ref]$session, 0, $key) -ne 0) { throw 'rm_start_failed' }
+  try {
+    $paths = [string[]]@($location)
+    if ([Reader]::RmRegisterResources($session, 1, $paths, 0, [IntPtr]::Zero, 0, [IntPtr]::Zero) -ne 0) { throw 'rm_register_failed' }
+    [uint32]$needed = 0; [uint32]$count = 128; [uint32]$reasons = 0
+    $rows = New-Object 'Reader+Info[]' 128
+    if ([Reader]::RmGetList($session, [ref]$needed, [ref]$count, $rows, [ref]$reasons) -ne 0 -or $count -gt 128) { throw 'rm_list_failed' }
+    $result = @()
+    for ($i=0; $i -lt $count; $i++) {
+      $ticks = ([uint64]$rows[$i].Process.Start.Hi -shl 32) -bor $rows[$i].Process.Start.Lo
+      $result += Identity $rows[$i].Process.Pid ([string]$ticks)
+    }
+    return ,$result
+  } finally { [void][Reader]::RmEndSession($session) }
+}
+`;
+export function inspectWindows(mode, value) {
+    if (process.platform !== 'win32')
+        throw new Refusal('windows_inspection_unavailable', 1);
+    const encodedValue = Buffer.from(value, 'utf8').toString('base64');
+    const code = inspectScript + `
+$value = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedValue}'))
+try {
+  $result = if ('${mode}' -eq 'identity') { @(Identity ([uint32]$value)) } else { @(Openers $value) }
+  ConvertTo-Json -InputObject @($result) -Compress -Depth 4
+} catch { exit 1 }
+`;
+    const done = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+        '$script = [Console]::In.ReadToEnd(); Invoke-Expression $script'], { input: code, encoding: 'utf8', timeout: 8000, maxBuffer: 65536, windowsHide: true });
+    if (done.status !== 0 || done.error)
+        throw new Refusal('windows_owner_inspection_failed', 1);
+    let rows;
+    try {
+        rows = JSON.parse(done.stdout);
+    }
+    catch {
+        throw new Refusal('windows_owner_inspection_failed', 1);
+    }
+    if (!Array.isArray(rows) || rows.length > 128 || rows.some(row => !row || !Number.isSafeInteger(row.pid) || row.pid <= 0 ||
+        typeof row.uid !== 'string' || !row.uid.startsWith('S-') ||
+        typeof row.command !== 'string' || !row.command ||
+        typeof row.start !== 'string' || !/^\d+$/.test(row.start))) {
+        throw new Refusal('windows_owner_inspection_failed', 1);
+    }
+    return rows;
+}
+export function windowsProcessStart(pid) {
+    try {
+        const rows = inspectWindows('identity', String(pid));
+        return rows.length === 1 ? BigInt(rows[0].start) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function authLine(pid) {
+    const directory = join(process.env.CLAUDE_CONFIG_DIR || process.env.ANTHROPIC_CONFIG_DIR ||
+        join(process.env.USERPROFILE || '', '.claude'), 'sessions');
+    let names;
+    try {
+        names = readdirSync(directory).filter(name => new RegExp(`^${pid}\\.[^.]+\\.key$`).test(name));
+    }
+    catch {
+        throw new Refusal('windows_inbox_auth_unavailable', 1);
+    }
+    if (names.length !== 1)
+        throw new Refusal('windows_inbox_auth_unavailable', 1);
+    const file = join(directory, names[0]);
+    try {
+        const entry = lstatSync(file);
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 16384)
+            throw new Error('invalid_key');
+        const value = JSON.parse(readFileSync(file, 'utf8'));
+        const token = value?.peerToken;
+        if (typeof token !== 'string' || !token.trim())
+            throw new Error('invalid_key');
+        return JSON.stringify({ type: 'auth', token }) + '\n';
+    }
+    catch {
+        throw new Refusal('windows_inbox_auth_unavailable', 1);
+    }
+}
+export async function postWindowsPipe(pipe, pid, text) {
+    if (!/^\\\\\.\\pipe\\[^\r\n]+$/i.test(pipe))
+        throw new Refusal('invalid_windows_pipe', 1);
+    const auth = authLine(pid);
+    const payload = auth + JSON.stringify({ type: 'user', message: { role: 'user', content: text } }) + '\n';
+    return new Promise((resolve, reject) => {
+        let connected = false, finished = false;
+        const socket = createConnection(pipe);
+        const timeout = setTimeout(() => finish(new Error('timeout')), 10000);
+        const finish = (error) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timeout);
+            socket.destroy();
+            if (error)
+                reject(connected ? new UnknownOutcome() : new Refusal('inbox_unreachable', 1));
+            else
+                resolve();
+        };
+        socket.once('error', error => finish(error));
+        socket.once('connect', () => {
+            connected = true;
+            socket.write(payload, error => {
+                if (error)
+                    return finish(error);
+                const drain = setTimeout(() => finish(), 2000);
+                socket.once('close', () => { clearTimeout(drain); finish(); });
+                socket.once('data', () => { clearTimeout(drain); finish(); });
+            });
+        });
+    });
+}

package/dist/writer.d.ts

@@ -0,0 +1,8 @@
+export declare const uuid: (value: string) => boolean;
+export declare function probeLock(path: string): Promise<'free' | 'held' | 'absent' | 'unknown'>;
+export declare function inspectWriter(home: string, id: string): Promise<{
+    activity: string;
+    identity: string;
+}>;
+export declare function homes(selected: string): string[];
+export declare function resolveWriter(selected: string, id: string): Promise<string>;

package/dist/writer.js

@@ -4,6 +4,7 @@ import { isAbsolute, join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { canonical, Refusal } from './discovery.js';
 import { executable, run } from './process.js';
+import { inspectWindows } from './windows.js';
 const missing = (error) => ['ENOENT', 'ENOTDIR'].includes(error.code ?? '');
 export const uuid = (value) => /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i.test(value);
 function snapshot(path) {
@@ -16,18 +17,30 @@ export async function probeLock(path) {
         const before = lstatSync(path);
         if (!before.isFile() || before.isSymbolicLink())
             return 'unknown';
-        const { flockSync } = await import('fs-ext-extra-prebuilt');
-        fd = openSync(path, constants.O_RDWR | constants.O_NOFOLLOW);
+        const locks = await import('fs-ext-extra-prebuilt');
+        fd = openSync(path, constants.O_RDWR | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW));
         const after = fstatSync(fd);
         if (before.dev !== after.dev || before.ino !== after.ino)
             return 'unknown';
-        try {
-            flockSync(fd, 'exnb');
+        if (process.platform === 'win32') {
+            try {
+                locks.lockFileExSync(fd, locks.constants.LOCKFILE_EXCLUSIVE_LOCK | locks.constants.LOCKFILE_FAIL_IMMEDIATELY, 0, 0, 0xffffffff, 0xffffffff);
+            }
+            catch (error) {
+                return ['EAGAIN', 'EACCES', 'EWOULDBLOCK'].includes(error.code ?? '') ||
+                    error.errno === 33 ? 'held' : 'unknown';
+            }
+            locks.unlockFileExSync(fd, 0, 0, 0xffffffff, 0xffffffff);
         }
-        catch (error) {
-            return ['EAGAIN', 'EACCES', 'EWOULDBLOCK'].includes(error.code ?? '') ? 'held' : 'unknown';
+        else {
+            try {
+                locks.flockSync(fd, 'exnb');
+            }
+            catch (error) {
+                return ['EAGAIN', 'EACCES', 'EWOULDBLOCK'].includes(error.code ?? '') ? 'held' : 'unknown';
+            }
+            locks.flockSync(fd, 'un');
         }
-        flockSync(fd, 'un');
         return 'free';
     }
     catch (error) {
@@ -43,6 +56,10 @@ async function sample(path) {
     if (state !== 'held')
         return { state, fingerprint: '', owners: [], valid: true };
     const fingerprint = snapshot(path);
+    if (process.platform === 'win32') {
+        const owners = inspectWindows('openers', path);
+        return { state, fingerprint, owners, valid: true };
+    }
     const listed = await run(executable('lsof'), ['-nP', '-F0pcu', '--', path]);
     const owners = [];
     let current;
@@ -76,9 +93,10 @@ export async function inspectWriter(home, id) {
     await delay(250);
     const after = await sample(path);
     const owner = after.owners[0];
+    const ownId = process.platform === 'win32' ? inspectWindows('identity', String(process.pid))[0]?.uid : process.getuid?.();
     if (!before.valid || !after.valid || before.state !== after.state || before.fingerprint !== after.fingerprint ||
         before.owners.length !== 1 || after.owners.length !== 1 || JSON.stringify(before.owners) !== JSON.stringify(after.owners) ||
-        !owner?.start || owner.uid !== process.getuid?.() || !/^codex(?:-|$)/i.test(owner.command ?? '')) {
+        !owner?.start || !ownId || owner.uid !== ownId || !/^codex(?:\.exe|-|$)/i.test(owner.command ?? '')) {
         throw new Refusal('active_writer_unverified', 1);
     }
     return { activity: 'live_writer', identity: JSON.stringify({ fingerprint: after.fingerprint, ...owner }) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "session-peer",
-  "version": "0.1.0-preview.0",
+  "version": "0.1.0-preview.1",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -8,9 +8,13 @@
     "tag": "preview"
   },
   "repository": { "type": "git", "url": "git+https://github.com/abruption/session-peer-ts.git" },
-  "os": ["darwin", "linux"],
+  "os": ["darwin", "linux", "win32"],
   "description": "Python-free local and SSH client for Claude Code and Codex sessions (preview)",
   "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" }
+  },
   "license": "MIT",
   "engines": {
     "node": "^22.13.0 || ^24.0.0"
@@ -31,8 +35,10 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test test/*.test.mjs",
-    "test:package": "npm run build && node test/package-smoke.mjs"
+    "test": "npm run build && npm run test:types && node --experimental-strip-types --test test/*.test.ts",
+    "test:types": "tsc -p tsconfig.test.json",
+    "test:windows": "npm run build && npm run test:types && node --experimental-strip-types --test test/windows.test.ts",
+    "test:package": "npm run build && node --experimental-strip-types test/package-smoke.ts"
   },
   "devDependencies": {
     "@types/node": "22.13.10",