subconscious-cli 4.0.17 → 4.1.0-windows.0

package/bin/windows/hook.cjs

@@ -0,0 +1,71 @@
+// Standalone Windows hook, copied into the agent's user configuration.
+// Observational only: never block a session, leak credentials, or print payloads.
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const { randomUUID, createHash } = require('node:crypto');
+
+async function main() {
+  const [client, configPath] = process.argv.slice(2);
+  let payload = {};
+  const input = await new Promise(resolve => {
+    let text = '';
+    const finish = () => { clearTimeout(timer); process.stdin.pause(); resolve(text); };
+    const timer = setTimeout(finish, 500);
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', chunk => { text += chunk; if (text.length > 4 * 1024 * 1024) finish(); });
+    process.stdin.on('end', finish);
+    process.stdin.on('error', finish);
+  });
+  try { payload = JSON.parse(input); } catch { /* fail open */ }
+  const event = payload?.hook_event_name || '';
+  const response = client === 'cursor'
+    ? (event === 'preCompact' ? {} : { continue: true, permission: 'allow' })
+    : client === 'copilot' ? { continue: true } : {};
+  try {
+    const config = JSON.parse(await fs.readFile(configPath, 'utf8'));
+    const cid = payload?.conversation_id || payload?.session_id;
+    if (!cid || typeof cid !== 'string' || !config.apiKey || !config.gatewayUrl) return;
+    const post = async body => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 1500);
+      try {
+        const res = await fetch(`${config.gatewayUrl}/v1/agent-hooks`, {
+          method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${config.apiKey}`, 'x-subconscious-client': client },
+          body: JSON.stringify({ conversation_id: cid, hook_event_name: event, ...body }), signal: controller.signal,
+        });
+        await res.body?.cancel();
+      } catch { /* fail open */ } finally { clearTimeout(timer); }
+    };
+    if ((client === 'cursor' && event === 'beforeSubmitPrompt') || (client === 'copilot' && event === 'UserPromptSubmit')) {
+      if (typeof payload.prompt !== 'string' || !payload.prompt) return;
+      const root = payload.workspace_roots?.[0] || payload.cwd;
+      await post({ event: 'conversation_ensure', prompt: payload.prompt, workspace: typeof root === 'string' ? path.win32.basename(root) : undefined });
+    }
+    if (client === 'codex' && ['PreCompact', 'PostCompact'].includes(event)) {
+      const phase = event === 'PreCompact' ? 'start' : 'end';
+      await post({ event: 'conversation_compaction', phase, dedupe_key: `${cid}:${phase}:${payload.turn_id || randomUUID()}`, metadata: { trigger: payload.trigger, turn_id: payload.turn_id } });
+    }
+    if (client === 'cursor' && event === 'preCompact') {
+      const metadata = Object.fromEntries(['trigger', 'context_tokens', 'context_window_size', 'context_usage_percent', 'message_count', 'messages_to_compact', 'is_first_compaction'].filter(k => payload[k] != null).map(k => [k, payload[k]]));
+      await post({ event: 'conversation_compaction', phase: 'point', dedupe_key: `${cid}:${payload.generation_id ?? 'gen'}:${payload.is_first_compaction ?? false}`, metadata });
+    }
+    if (client === 'copilot' && ['PreCompact', 'UserPromptSubmit'].includes(event)) {
+      const pendingDir = path.join(path.dirname(configPath), 'subconscious-compact-pending');
+      const pending = path.join(pendingDir, createHash('sha256').update(cid).digest('hex') + '.json');
+      if (event === 'PreCompact') {
+        const token = randomUUID();
+        await fs.mkdir(pendingDir, { recursive: true });
+        await fs.writeFile(pending, JSON.stringify({ token }), { mode: 0o600 });
+        await post({ event: 'conversation_compaction', phase: 'start', dedupe_key: `${cid}:start:${token}`, metadata: { trigger: payload.trigger || 'auto' } });
+      } else {
+        try {
+          const { token } = JSON.parse(await fs.readFile(pending, 'utf8'));
+          await fs.rm(pending, { force: true });
+          await post({ event: 'conversation_compaction', phase: 'end', dedupe_key: `${cid}:end:${token}` });
+        } catch { /* no pending compaction */ }
+      }
+    }
+  } catch { /* missing/malformed config, I/O and transport errors are nonfatal */ }
+  finally { process.stdout.write(JSON.stringify(response) + '\n'); }
+}
+main().catch(() => { process.stdout.write('{}\n'); }).finally(() => { process.exitCode = 0; });

package/bin/windows/install.js

@@ -0,0 +1,97 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { powershellCommand, runWindows } from './process.js';
+
+const registry = JSON.parse(readFileSync(new URL('../registry.generated.json', import.meta.url), 'utf8'));
+const repository = 'subconscious-systems/subconscious-code';
+
+function npmInstall(command) {
+  const match = /^npm (?:i|install) -g ([@a-zA-Z0-9/._-]+)$/.exec(command || '');
+  return match ? { command: 'npm', args: ['install', '-g', match[1]] } : null;
+}
+
+export function windowsInstallSpec(id, env = process.env) {
+  const install = registry.agents.find(agent => agent.id === id)?.install;
+  const command = typeof install === 'object' ? install.win32 : undefined;
+  if (id === 'subconscious-code') return { nativeRelease: true, display: 'subc sc install' };
+  if (!command) return null; // Never fall back to a Linux installer.
+  if (id === 'claude-code') {
+    const primary = powershellCommand("$ErrorActionPreference = 'Stop'; Invoke-RestMethod 'https://claude.ai/install.ps1' | Invoke-Expression; if (-not $?) { exit 1 }", env);
+    return { ...primary, display: command, fallback: npmInstall(install.fallback) };
+  }
+  const spec = npmInstall(command);
+  if (!spec) throw new Error(`No safe Windows installer is defined for ${id}`);
+  return { ...spec, display: command };
+}
+
+export function windowsReleaseAsset(release, arch = process.arch) {
+  const target = { x64: 'x86_64-pc-windows-msvc', arm64: 'aarch64-pc-windows-msvc' }[arch];
+  if (!target) throw new Error(`Subconscious Code does not support Windows architecture ${arch}`);
+  const names = [`sc-${target}.zip`, `sc-${target}.exe`];
+  const asset = release.assets?.find(asset => names.includes(asset.name));
+  if (!asset) throw new Error(`Subconscious Code ${release.tag_name || 'latest'} has no published native Windows ${arch} binary. The CLI can launch an installed sc.exe, but the upstream release must include a Windows build before subc sc install can install it.`);
+  const checksum = release.assets.find(candidate => candidate.name === `${asset.name}.sha256`);
+  if (!checksum) throw new Error(`The Windows release is missing ${asset.name}.sha256; refusing an unverified installation.`);
+  return { asset, checksum };
+}
+
+export async function installWindowsSC(env, { fetchImpl = fetch, run = runWindows, home = os.homedir(), arch = process.arch, log = console.log } = {}) {
+  const version = env.SC_CODE_VERSION?.replace(/^v/, '');
+  const endpoint = version ? `tags/${encodeURIComponent('v' + version)}` : 'latest';
+  const response = await fetchImpl(`https://api.github.com/repos/${repository}/releases/${endpoint}`, { headers: { Accept: 'application/vnd.github+json' }, signal: AbortSignal.timeout(15000) });
+  if (!response.ok) throw new Error(`Could not find a Subconscious Code release (HTTP ${response.status}).`);
+  const release = await response.json();
+  const { asset, checksum } = windowsReleaseAsset(release, arch);
+  const download = async asset => {
+    const url = new URL(asset.browser_download_url);
+    if (url.origin !== 'https://github.com' || !url.pathname.startsWith(`/${repository}/releases/download/`)) throw new Error('Unexpected release download URL');
+    const response = await fetchImpl(url.href, { signal: AbortSignal.timeout(120000) });
+    if (!response.ok) throw new Error(`Download failed (HTTP ${response.status}): ${asset.name}`);
+    return Buffer.from(await response.arrayBuffer());
+  };
+  log(`Downloading Subconscious Code ${release.tag_name} for Windows ${arch}...`);
+  const [binary, checksumText] = await Promise.all([download(asset), download(checksum)]);
+  const expected = checksumText.toString('utf8').trim().split(/\s+/)[0];
+  if (!/^[a-f0-9]{64}$/i.test(expected) || createHash('sha256').update(binary).digest('hex') !== expected.toLowerCase()) throw new Error('Subconscious Code checksum verification failed');
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'subc-sc-install-'));
+  const installDir = path.resolve(env.SC_INSTALL_DIR || path.join(home, '.local', 'bin'));
+  const destination = path.join(installDir, 'sc.exe');
+  const staging = path.join(installDir, `sc-${randomUUID()}.tmp`);
+  try {
+    const extracted = path.join(dir, 'sc.exe');
+    if (asset.name.endsWith('.zip')) {
+      const archive = path.join(dir, 'release.zip');
+      await fs.writeFile(archive, binary, { flag: 'wx' });
+      // Extract only the exact root executable. No archive-controlled paths.
+      const spec = powershellCommand("$ErrorActionPreference = 'Stop'; Add-Type -AssemblyName System.IO.Compression.FileSystem; $z = [IO.Compression.ZipFile]::OpenRead($env:SUBC_ARCHIVE); try { $e = $z.GetEntry('sc.exe'); if ($null -eq $e) { throw 'Archive has no root sc.exe' }; [IO.Compression.ZipFileExtensions]::ExtractToFile($e, $env:SUBC_EXTRACTED, $false) } finally { $z.Dispose() }", { ...env, SUBC_ARCHIVE: archive, SUBC_EXTRACTED: extracted });
+      if (await run(spec.command, spec.args, { env: spec.env })) throw new Error('Could not extract the Windows release');
+    } else await fs.writeFile(extracted, binary, { flag: 'wx' });
+    const magic = (await fs.readFile(extracted)).subarray(0, 2).toString('ascii');
+    if (magic !== 'MZ') throw new Error('Release is not a Windows executable');
+    await fs.mkdir(installDir, { recursive: true });
+    await fs.copyFile(extracted, staging);
+    await fs.rename(staging, destination);
+    log(`Installed ${destination}. Run subc sc to launch it.`);
+    return 0;
+  } finally {
+    await fs.rm(staging, { force: true });
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+}
+
+export async function installWindowsAgent(id, env, run = runWindows) {
+  const spec = windowsInstallSpec(id, env);
+  if (!spec) throw new Error('Install this agent separately, then rerun subc.');
+  if (spec.nativeRelease) return installWindowsSC(env, { run });
+  let code;
+  try { code = await run(spec.command, spec.args, { env: spec.env || env }); }
+  catch (error) { if (!spec.fallback) throw error; code = 1; }
+  if (code && spec.fallback) {
+    console.error('Native installer failed; trying the npm package.');
+    code = await run(spec.fallback.command, spec.fallback.args, { env });
+  }
+  return code;
+}

package/bin/windows/launch.js

@@ -0,0 +1,97 @@
+// Native Windows launch specifications; never source or modify Unix runbooks.
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { claudeNativeLaunch } from './claude.js';
+import { defaults, value, origin, modelIds, positiveInteger, parseOptions, writeJson } from './common.js';
+
+function connection(env, keyName) {
+  return {
+    model: value(env, 'MODEL', defaults.model),
+    base: origin(value(env, 'GATEWAY_URL', defaults.baseUrl)),
+    key: value(env, keyName, value(env, 'API_KEY')),
+  };
+}
+
+export async function windowsLaunch(id, argv, env, { tempRoot = os.tmpdir() } = {}) {
+  if (id === 'claude-code') return { command: 'claude', ...claudeNativeLaunch(argv, env) };
+  const keyName = { codex: 'CODEX_API_KEY', opencode: 'OPENCODE_API_KEY', pi: 'PI_API_KEY', 'subconscious-code': 'SC_API_KEY', 'deepseek-harness': 'DEEPSEEK_HARNESS_API_KEY' }[id];
+  const { model, base, key } = connection(env, keyName);
+  const childEnv = { ...env, SUBCONSCIOUS_API_KEY: key, SUBCONSCIOUS_GATEWAY_URL: base };
+  if (id === 'subconscious-code') {
+    return { command: 'sc', args: argv, env: { ...childEnv, SC_API_KEY: key, SC_BASE_URL: `${base}/v1`, SC_DLR_URL: base, SC_DLR_ENABLED: 'true', SC_MODEL: model } };
+  }
+  if (id === 'pi') return { command: 'pi', args: ['--provider', 'subconscious', '--model', model, ...argv], env: childEnv };
+  if (id === 'opencode') {
+    const context = positiveInteger(value(env, 'OPENCODE_CONTEXT_LIMIT', '5000000'), 'OPENCODE_CONTEXT_LIMIT');
+    const output = positiveInteger(value(env, 'OPENCODE_OUTPUT_LIMIT', '65536'), 'OPENCODE_OUTPUT_LIMIT');
+    const models = Object.fromEntries(modelIds(env).map(id => [id, { name: id, tools: true, limit: { context, output } }]));
+    childEnv.OPENCODE_CONFIG_CONTENT = JSON.stringify({
+      $schema: 'https://opencode.ai/config.json', disabled_providers: ['subconscious'],
+      provider: { 'subconscious-cli': { npm: '@ai-sdk/openai-compatible', name: 'Subconscious Gateway', options: {
+        baseURL: `${base}/v1`, apiKey: '{env:SUBCONSCIOUS_API_KEY}', headers: { 'x-subconscious-client': 'opencode' },
+      }, models } }, model: `subconscious-cli/${model}`,
+    });
+    return { command: 'opencode', args: parseOptions(argv, {}).rest, env: childEnv };
+  }
+  if (id === 'codex') {
+    const { options: opts, rest } = parseOptions(argv, { '--context-window': 1, '--max-context-window': 1, '--auto-compact-token-limit': 1, '--reasoning-effort': 1, '--subagents': true, '--external-tools': true });
+    const context = positiveInteger(opts['--context-window'] || value(env, 'CODEX_CONTEXT_WINDOW', '5000000'), 'context-window');
+    const maxContext = positiveInteger(opts['--max-context-window'] || value(env, 'CODEX_MAX_CONTEXT_WINDOW', String(context)), 'max-context-window');
+    const compact = positiveInteger(opts['--auto-compact-token-limit'] || value(env, 'CODEX_AUTO_COMPACT_TOKEN_LIMIT', '4500000'), 'auto-compact-token-limit');
+    const reasoning = opts['--reasoning-effort'] || value(env, 'CODEX_REASONING_EFFORT', 'max');
+    if (!['none', 'low', 'medium', 'high', 'max'].includes(reasoning)) throw new Error('reasoning-effort must be none, low, medium, high, or max');
+    const catalog = { models: modelIds(env).map(id => ({
+      slug: id, display_name: id, description: `Subconscious model ${id}`,
+      context_window: context, max_context_window: maxContext, auto_compact_token_limit: compact,
+      effective_context_window_percent: 95, supported_reasoning_levels: [], shell_type: 'shell_command',
+      visibility: 'list', supported_in_api: true, priority: 0,
+      service_tiers: [{ id: 'priority', name: 'Priority', description: 'Route requests through the configured priority service tier' }],
+      availability_nux: null, upgrade: null, base_instructions: 'You are Codex, a coding agent.',
+      supports_reasoning_summaries: false, support_verbosity: false, default_verbosity: null,
+      apply_patch_tool_type: 'freeform', truncation_policy: { mode: 'tokens', limit: 10000 },
+      supports_parallel_tool_calls: true, experimental_supported_tools: [],
+    })) };
+    // Validate all flags before creating a temporary directory.
+    const threads = positiveInteger(value(env, 'MAX_CONCURRENT_SUBAGENTS', '4'), 'MAX_CONCURRENT_SUBAGENTS');
+    const dir = await fs.mkdtemp(path.join(tempRoot, 'subc-codex-'));
+    const cleanup = () => fs.rm(dir, { recursive: true, force: true });
+    try {
+      const file = path.join(dir, 'models.json');
+      await writeJson(file, catalog);
+      const config = {
+        model, model_provider: 'subconscious', model_catalog_json: file, model_reasoning_effort: reasoning,
+        web_search: 'disabled', 'model_providers.subconscious.name': 'Subconscious',
+        'model_providers.subconscious.base_url': `${base}/v1`, 'model_providers.subconscious.wire_api': 'responses',
+        'model_providers.subconscious.env_key': 'SUBCONSCIOUS_API_KEY', 'model_providers.subconscious.stream_idle_timeout_ms': 300000,
+      };
+      if (!opts['--external-tools'] && value(env, 'CODEX_EXTERNAL_TOOLS', 'false') !== 'true') {
+        Object.assign(config, { 'features.apps': false, 'features.plugins': false, 'apps._default.enabled': false });
+      }
+      if (opts['--subagents']) Object.assign(config, { 'features.multi_agent': true, 'agents.max_threads': threads, 'agents.max_depth': 1, 'agents.interrupt_message': true });
+      const args = Object.entries(config).flatMap(([k, v]) => ['-c', `${k}=${JSON.stringify(v)}`]);
+      return { command: opts['--subagents'] ? 'npx' : 'codex', args: [...(opts['--subagents'] ? ['-y', '@openai/codex@0.132.0'] : []), ...args, ...rest], env: childEnv, cleanup };
+    } catch (error) { await cleanup(); throw error; }
+  }
+  if (id === 'deepseek-harness') {
+    const context = positiveInteger(value(env, 'DEEPSEEK_HARNESS_CONTEXT_WINDOW', '5000000'), 'DEEPSEEK_HARNESS_CONTEXT_WINDOW');
+    const maxTokens = positiveInteger(value(env, 'DEEPSEEK_HARNESS_MAX_TOKENS', '65536'), 'DEEPSEEK_HARNESS_MAX_TOKENS');
+    const models = modelIds(env);
+    const dir = await fs.mkdtemp(path.join(tempRoot, 'subc-dsh-'));
+    const cleanup = () => fs.rm(dir, { recursive: true, force: true });
+    try {
+      const file = path.join(dir, 'subconscious.cordis.yml');
+      const text = `- id: llm-pi-ai\n  config:\n    providers:\n      subconscious:\n        apiKeyEnv: SUBCONSCIOUS_API_KEY\n        displayName: Subconscious Gateway\n        api: openai-completions\n        baseURL: !!js process.env.SUBCONSCIOUS_DSH_BASE_URL\n        headers:\n          x-subconscious-client: deepseek-harness\n        compat:\n          supportsDeveloperRole: false\n          maxTokensField: max_tokens\n        defaultContextWindow: ${context}\n        defaultMaxTokens: ${maxTokens}\n        models:\n${models.map(id => `          - id: '${id}'\n            name: '${id}'\n            contextWindow: ${context}\n            maxTokens: ${maxTokens}`).join('\n')}\n- id: agent-default-model\n  config:\n    provider: subconscious\n    model: '${model}'\n`;
+      await fs.writeFile(file, text, { mode: 0o600, flag: 'wx' });
+      const mode = ['web', 'headless'].includes(argv[0]) ? argv[0] : 'web';
+      const rest = ['web', 'headless'].includes(argv[0]) ? argv.slice(1) : argv;
+      return { command: 'dsh', args: [...(mode === 'web' ? ['web'] : ['--profile', 'headless']), '--patch', file, ...rest], env: { ...childEnv, SUBCONSCIOUS_DSH_BASE_URL: `${base}/v1` }, cleanup };
+    } catch (error) { await cleanup(); throw error; }
+  }
+  throw new Error(`No native Windows launcher is available for ${id}`);
+}
+
+export async function executeWindowsLaunch(spec, run) {
+  try { return await run(spec.command, spec.args, { env: spec.env }); }
+  finally { await spec.cleanup?.(); }
+}

package/bin/windows/pi-compaction.ts

@@ -0,0 +1,29 @@
+// Windows-only Pi extension. Loaded config is relative to this installed file.
+import { readFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+export default function (pi: { on: (event: string, handler: (...args: any[]) => any) => void }) {
+  for (const [eventName, phase] of [['session_before_compact', 'start'], ['session_compact', 'end']]) {
+    pi.on(eventName, async (event: any, ctx: any) => {
+      const session = ctx?.sessionManager?.getSessionId?.();
+      if (!session) return;
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 1500);
+      try {
+        const config = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'subconscious-windows.json'), 'utf8'));
+        const url = process.env.SUBCONSCIOUS_GATEWAY_URL || config.gatewayUrl;
+        const key = process.env.SUBCONSCIOUS_API_KEY || config.apiKey;
+        if (!url || !key) return;
+        const response = await fetch(`${url.replace(/\/+$/, '')}/v1/agent-hooks`, {
+          method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${key}`, 'x-subconscious-client': 'pi' },
+          body: JSON.stringify({ event: 'conversation_compaction', conversation_id: session, phase, hook_event_name: eventName, dedupe_key: `${session}:${phase}:${randomUUID()}`, metadata: { reason: event?.reason, tokens_before: event?.preparation?.tokensBefore, from_extension: event?.fromExtension } }),
+          signal: controller.signal,
+        });
+        await response.body?.cancel();
+      } catch { /* observational: never cancel or replace compaction */ }
+      finally { clearTimeout(timer); }
+    });
+  }
+}

package/bin/windows/process.js

@@ -0,0 +1,157 @@
+// Windows process handling. Unix callers keep using their existing launch paths.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn, spawnSync, execFileSync } from 'node:child_process';
+
+export function windowsEnv(...sources) {
+  const result = {};
+  for (const source of sources) {
+    for (const [key, value] of Object.entries(source || {})) {
+      if (value !== undefined && value !== null) result[key.toUpperCase()] = String(value);
+    }
+  }
+  return result;
+}
+
+export function windowsBinDirs(environment = process.env, home = os.homedir()) {
+  const env = windowsEnv(environment);
+  return [...new Set([
+    env.APPDATA && path.win32.join(env.APPDATA, 'npm'),
+    env.USERPROFILE && path.win32.join(env.USERPROFILE, '.local', 'bin'),
+    home && path.win32.join(home, '.local', 'bin'),
+    env.LOCALAPPDATA && path.win32.join(env.LOCALAPPDATA, 'Microsoft', 'WinGet', 'Links'),
+    env.SYSTEMROOT && path.win32.join(env.SYSTEMROOT, 'System32', 'config', 'systemprofile', '.local', 'bin'),
+    env.SYSTEMROOT && path.win32.join(env.SYSTEMROOT, 'System32'),
+    env.SYSTEMROOT && path.win32.join(env.SYSTEMROOT, 'System32', 'WindowsPowerShell', 'v1.0'),
+    path.dirname(process.execPath),
+  ].filter(Boolean))];
+}
+
+export function windowsPath(extraDirs, currentPath = '') {
+  const seen = new Set();
+  return [...extraDirs, ...currentPath.split(';')].filter(dir => {
+    const key = dir.replace(/^"|"$/g, '').replace(/[\\/]+$/, '').toLowerCase();
+    if (!key || seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).map(dir => dir.replace(/^"|"$/g, '')).join(';');
+}
+
+export function resolveWindowsExecutable(command, options = {}) {
+  const env = windowsEnv(options.env || process.env);
+  const pathApi = options.pathApi || path.win32;
+  const isFile = options.isFile || (file => { try { return fs.statSync(file).isFile(); } catch { return false; } });
+  const extensions = [...new Set(['.exe', '.com', ...(env.PATHEXT || '.CMD;.BAT').split(';').map(x => x.toLowerCase()), ''])];
+  const hasExtension = extensions.some(ext => ext && command.toLowerCase().endsWith(ext));
+  const dirs = /[\\/]/.test(command) ? [''] : [
+    ...(options.preferredDirs || []),
+    ...(env.PATH || '').split(';').filter(Boolean),
+    ...windowsBinDirs(env, options.home),
+  ];
+  for (const dir of dirs) {
+    for (const ext of hasExtension ? [''] : extensions) {
+      const candidate = dir ? pathApi.join(dir.replace(/^"|"$/g, ''), command + ext) : command + ext;
+      if (isFile(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
+// npm shims pass %* through cmd.exe, which reinterprets quotes, JSON, %, &,
+// newlines, etc. Resolve their quoted entry point and run it with Node directly.
+// This also supports npm/npx and VS Code's code.cmd without invoking a shell.
+export function windowsInvocation(command, args = [], environment = process.env, options = {}) {
+  const env = windowsEnv(environment);
+  const resolve = options.resolve || resolveWindowsExecutable;
+  const executable = resolve(command, { env, ...options });
+  if (!executable) throw new Error(`Could not find ${command} on the Windows PATH.`);
+  if (!/\.(cmd|bat)$/i.test(executable)) return { command: executable, args, env };
+  const readFile = options.readFile || (file => fs.readFileSync(file, 'utf8'));
+  const pathApi = options.pathApi || path.win32;
+  const contents = readFile(executable);
+  const candidates = [...contents.matchAll(/%(?:dp0%|~dp0)[\\/]?([^"\r\n]+)"/gi)];
+  const name = pathApi.basename(executable).replace(/\.(cmd|bat)$/i, '').toLowerCase();
+  let electron;
+  if (/ELECTRON_RUN_AS_NODE\s*=\s*1/i.test(contents)) {
+    electron = candidates.map(match => pathApi.resolve(pathApi.dirname(executable), match[1])).find(target => /\.exe$/i.test(target) && !/node\.exe$/i.test(target) && fs.existsSync(target));
+  }
+  for (const match of candidates) {
+    const target = pathApi.resolve(pathApi.dirname(executable), match[1]);
+    // A shim's first executable is often node.exe, not the agent entry point.
+    if (/\.(exe|com)$/i.test(target)) {
+      if (!electron && !/node\.exe$/i.test(target) && fs.existsSync(target)) return { command: target, args, env };
+      continue;
+    }
+    if (['npm', 'npx'].includes(name) && pathApi.basename(target) !== `${name}-cli.js`) continue;
+    let source;
+    try { source = readFile(target); } catch { continue; }
+    if (!/\.[cm]?js$/i.test(target) && !/^#![^\r\n]*\bnode\b/.test(source)) continue;
+    return { command: electron || process.execPath, args: [target, ...args], env: electron ? { ...env, ELECTRON_RUN_AS_NODE: '1' } : env };
+  }
+  throw new Error(`Cannot safely launch the custom batch wrapper ${executable}. Install the native executable or standard npm package for ${command}.`);
+}
+
+export function spawnWindows(command, args, options = {}) {
+  const invocation = windowsInvocation(command, args, options.env || process.env);
+  return spawn(invocation.command, invocation.args, { ...options, env: invocation.env, shell: false });
+}
+
+export function spawnWindowsSync(command, args, options = {}) {
+  try {
+    const invocation = windowsInvocation(command, args, options.env || process.env);
+    return spawnSync(invocation.command, invocation.args, { ...options, env: invocation.env, shell: false });
+  } catch (error) { return { error, status: null, stdout: '', stderr: '' }; }
+}
+
+export function runWindows(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawnWindows(command, args, { stdio: 'inherit', ...options });
+    const forward = signal => { try { child.kill(signal); } catch { /* already exited */ } };
+    const interrupt = () => forward('SIGINT');
+    const terminate = () => forward('SIGTERM');
+    process.on('SIGINT', interrupt);
+    process.on('SIGTERM', terminate);
+    const cleanup = () => {
+      process.off('SIGINT', interrupt);
+      process.off('SIGTERM', terminate);
+    };
+    child.once('error', error => { cleanup(); reject(error); });
+    child.once('close', (code, signal) => {
+      cleanup();
+      resolve(code ?? (signal === 'SIGINT' ? 130 : 143));
+    });
+  });
+}
+
+export function readWindowsVersion(command, env) {
+  try {
+    const invocation = windowsInvocation(command, ['--version'], env);
+    return execFileSync(invocation.command, invocation.args, {
+      env: invocation.env, encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch { return ''; }
+}
+
+export function powershellCommand(source, env = process.env) {
+  // Only fixed application source is encoded here. Dynamic data uses env vars.
+  return { command: 'powershell.exe', args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(source, 'utf16le').toString('base64')], env: windowsEnv(env) };
+}
+
+export function openWindowsBrowser(url) {
+  const invocation = powershellCommand('Start-Process -FilePath $env:SUBC_BROWSER_URL', { ...process.env, SUBC_BROWSER_URL: url });
+  return runWindows(invocation.command, invocation.args, { env: invocation.env, stdio: 'ignore' });
+}
+
+export function windowsEditor(requested, environment = process.env) {
+  const env = windowsEnv(environment);
+  const text = requested || env.VISUAL?.trim() || env.EDITOR?.trim() || 'notepad.exe';
+  // An existing full path may contain spaces without quotes. Otherwise accept
+  // double-quoted argv, preserving Windows backslashes and rejecting shell use.
+  const parts = fs.existsSync(text) ? [text] : text.match(/"[^"]*"|[^\s"]+/g) || [];
+  if ((text.match(/"/g) || []).length % 2) throw new Error('Unmatched quote in VISUAL / EDITOR');
+  const [command, ...args] = parts.map(part => part.replace(/^"|"$/g, ''));
+  if (!command) throw new Error('Editor is empty');
+  if (/^(code|code-insiders)(\.cmd|\.exe)?$/i.test(path.win32.basename(command)) && !args.includes('--wait')) args.unshift('--wait');
+  return { command, args };
+}

package/bin/windows/setup.js

@@ -0,0 +1,168 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { defaults, origin, value, modelIds, positiveInteger, parseOptions, object, readJson, writeJson } from './common.js';
+
+const owned = command => {
+  if (typeof command !== 'string') return false;
+  if (/subconscious-hook\.(?:sh|cjs)/.test(command)) return true;
+  const encoded = /-EncodedCommand ([A-Za-z0-9+/=]+)$/i.exec(command)?.[1];
+  return Boolean(encoded && Buffer.from(encoded, 'base64').toString('utf16le').startsWith('# SUBC_WINDOWS_HOOK\n'));
+};
+const providerName = 'Subconscious Gateway';
+const exists = async file => { try { await fs.access(file); return true; } catch { return false; } };
+
+// Hook hosts expect command strings. Keep paths and credentials out of shell
+// syntax: PowerShell decodes data, then invokes Node with an argv array.
+export function windowsHookCommand(client, script, config, node = process.execPath) {
+  const data = Buffer.from(JSON.stringify({ client, script, config, node })).toString('base64');
+  const source = `# SUBC_WINDOWS_HOOK\n$d = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${data}')) | ConvertFrom-Json\n& $d.node $d.script $d.client $d.config\nexit 0`;
+  return `powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand ${Buffer.from(source, 'utf16le').toString('base64')}`;
+}
+
+export function mergeHooks(document, client, command) {
+  const result = structuredClone(object(document, 'hooks configuration'));
+  const hooks = object(result.hooks ?? {}, 'hooks');
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) throw new Error(`hooks.${event} must be an array; leaving it unchanged`);
+    const kept = [];
+    for (const entry of entries) {
+      object(entry, `hooks.${event} entry`);
+      if (Array.isArray(entry.hooks)) {
+        for (const hook of entry.hooks) object(hook, `hooks.${event} command`);
+        const filtered = entry.hooks.filter(hook => !owned(hook.command));
+        if (filtered.length || entry.hooks.length === 0) kept.push({ ...entry, hooks: filtered });
+      } else if (entry.hooks !== undefined) {
+        throw new Error(`hooks.${event}.hooks must be an array; leaving it unchanged`);
+      } else if (!owned(entry.command)) kept.push(entry);
+    }
+    if (kept.length) hooks[event] = kept;
+    else delete hooks[event];
+  }
+  if (command) {
+    const events = { codex: ['PreCompact', 'PostCompact'], cursor: ['beforeSubmitPrompt', 'preCompact'], copilot: ['UserPromptSubmit', 'PreCompact'] }[client];
+    for (const event of events) {
+      const hook = { type: 'command', command, timeout: client === 'copilot' ? 5 : 3 };
+      const entry = client === 'codex' ? { hooks: [{ ...hook, statusMessage: 'Reporting Subconscious compaction' }] } : hook;
+      hooks[event] = [...(hooks[event] || []), entry];
+    }
+  }
+  result.hooks = hooks;
+  if (client === 'cursor' && command) result.version ??= 1;
+  return result;
+}
+
+export async function windowsSetup(id, action, argv, environment, { home = os.homedir(), log = console.log } = {}) {
+  const schema = { '--gateway-url': 1, '--api-key': 1, '--model': 1 };
+  if (id === 'copilot') Object.assign(schema, { '--vscode-app': 1, '--max-input-tokens': 1, '--max-output-tokens': 1 });
+  if (id === 'pi') Object.assign(schema, { '--context-window': 1, '--max-tokens': 1 });
+  const { options } = parseOptions(argv, schema, { strict: true });
+  const env = { ...environment, ...(options['--model'] ? { MODEL: options['--model'] } : {}) };
+  const gatewayUrl = origin(options['--gateway-url'] || value(env, 'GATEWAY_URL', defaults.baseUrl));
+  const apiKey = options['--api-key'] || value(env, 'API_KEY');
+  const installing = action === 'install';
+  const removing = action === 'uninstall';
+  const needsKey = ['codex', 'cursor', 'copilot', 'pi'].includes(id);
+  if (installing && needsKey && !apiKey) throw new Error('An API key is required for setup. Run subc login first.');
+
+  if (['codex', 'cursor', 'copilot'].includes(id)) {
+    const dir = id === 'codex' ? (env.CODEX_DIR || env.CODEX_HOME || path.join(home, '.codex')) : path.join(home, `.${id}`);
+    const hooksFile = id === 'copilot' ? path.join(dir, 'hooks', 'subconscious-hooks.json') : path.join(dir, 'hooks.json');
+    const script = path.join(dir, 'hooks', 'subconscious-hook.cjs');
+    const config = path.join(dir, 'subconscious-windows.json');
+    const document = await readJson(hooksFile, {});
+    // Validate all existing user configuration before writing any files.
+    const merged = mergeHooks(document, id, installing ? windowsHookCommand(id, script, config) : null);
+    let providerFile, providers;
+    if (id === 'copilot') {
+      const apps = ['Code', 'Code - Insiders', 'VSCodium'];
+      const appData = env.APPDATA || path.join(home, 'AppData', 'Roaming');
+      let app = options['--vscode-app'] || env.VSCODE_APP;
+      if (app && !apps.includes(app)) throw new Error('--vscode-app must be Code, Code - Insiders, or VSCodium');
+      if (!app) {
+        for (const candidate of apps) if (await exists(path.join(appData, candidate, 'User'))) { app = candidate; break; }
+        app ||= 'Code';
+      }
+      providerFile = path.join(appData, app, 'User', 'chatLanguageModels.json');
+      const current = await readJson(providerFile, []);
+      if (!Array.isArray(current)) throw new Error(`${providerFile} must be a JSON array; leaving it unchanged`);
+      for (const provider of current) object(provider, 'language model provider');
+      providers = current.filter(provider => provider.name !== providerName);
+      if (installing) {
+        const context = positiveInteger(options['--max-input-tokens'] || value(env, 'COPILOT_MAX_INPUT_TOKENS', '5000000'), 'max-input-tokens');
+        const maxTokens = positiveInteger(options['--max-output-tokens'] || value(env, 'COPILOT_MAX_OUTPUT_TOKENS', '65536'), 'max-output-tokens');
+        providers.push({ name: providerName, vendor: 'customendpoint', apiKey: '${input:chat.lm.secret.subconscious-gateway}', apiType: 'messages', models: modelIds(env).map(id => ({
+          id, name: `Subconscious ${id}`, url: `${gatewayUrl}/v1/messages`, toolCalling: true, vision: false,
+          maxInputTokens: context, maxOutputTokens: maxTokens, thinking: true, streaming: true,
+          requestHeaders: { 'x-subconscious-client': 'copilot' },
+        })) });
+      }
+    }
+    if (action === 'status') {
+      const hasHook = Object.values(document.hooks || {}).some(entries => entries.some(entry => owned(entry.command) || entry.hooks?.some(hook => owned(hook.command))));
+      log(`${id}: ${hasHook ? 'Subconscious hooks installed' : 'no Subconscious hooks'} (${hooksFile})`);
+      if (providerFile) log(`Model configuration: ${providerFile}`);
+      return 0;
+    }
+    if (installing) {
+      await fs.mkdir(path.dirname(script), { recursive: true });
+      await fs.copyFile(new URL('./hook.cjs', import.meta.url), script);
+      await writeJson(config, { gatewayUrl, apiKey });
+    }
+    if (installing || await exists(hooksFile)) await writeJson(hooksFile, merged);
+    if (providerFile && (installing || await exists(providerFile))) await writeJson(providerFile, providers);
+    if (removing) {
+      await fs.rm(script, { force: true });
+      await fs.rm(config, { force: true });
+    }
+    if (installing && id === 'cursor') log(`In Cursor Settings, use ${gatewayUrl}/v1, your API key, and model ${value(env, 'MODEL', defaults.model)}. Restart Cursor to load hooks.`);
+    if (installing && id === 'copilot') log('Restart VS Code, select a Subconscious model, and enter your API key when prompted.');
+    log(`${id}: Windows integration ${installing ? 'installed' : 'removed'}.`);
+    return 0;
+  }
+  if (id === 'pi') {
+    const dir = env.PI_CODING_AGENT_DIR || path.join(home, '.pi', 'agent');
+    const modelsFile = path.join(dir, 'models.json');
+    const document = object(await readJson(modelsFile, {}), 'Pi models');
+    const providers = object(document.providers ?? {}, 'Pi providers');
+    if (action === 'status') { log(`Pi: ${providers.subconscious ? 'Subconscious provider installed' : 'not installed'} (${modelsFile})`); return 0; }
+    const extension = path.join(dir, 'extensions', 'subconscious-compaction.ts');
+    const config = path.join(dir, 'subconscious-windows.json');
+    if (installing) {
+      const context = positiveInteger(options['--context-window'] || value(env, 'PI_CONTEXT_WINDOW', '5000000'), 'context-window');
+      const maxTokens = positiveInteger(options['--max-tokens'] || value(env, 'PI_MAX_TOKENS', '65536'), 'max-tokens');
+      providers.subconscious = { baseUrl: `${gatewayUrl}/v1`, api: 'openai-completions', apiKey, headers: { 'x-subconscious-client': 'pi' }, models: modelIds(env).map(id => ({ id, contextWindow: context, maxTokens, compat: { sendSessionAffinityHeaders: true, sessionAffinityFormat: 'openai-nosession' } })) };
+      await fs.mkdir(path.dirname(extension), { recursive: true });
+      await fs.copyFile(new URL('./pi-compaction.ts', import.meta.url), extension);
+      await writeJson(config, { gatewayUrl, apiKey });
+    } else {
+      delete providers.subconscious;
+      await fs.rm(extension, { force: true });
+      await fs.rm(config, { force: true });
+    }
+    if (installing || await exists(modelsFile)) await writeJson(modelsFile, { ...document, providers });
+    log(`Pi: Windows integration ${installing ? 'installed' : 'removed'}.`);
+    return 0;
+  }
+  if (id === 'claude-code' || id === 'opencode') {
+    const dir = path.join(home, id === 'claude-code' ? '.claude' : '.opencode');
+    const legacy = path.join(dir, id === 'claude-code' ? 'subconscious-gateway.env' : 'subconscious.env');
+    let present = await exists(legacy);
+    if (id === 'opencode') {
+      const file = path.join(dir, 'opencode.json');
+      const document = object(await readJson(file, {}), 'OpenCode configuration');
+      if (document.provider !== undefined) object(document.provider, 'OpenCode providers');
+      present ||= Boolean(document.provider?.subconscious);
+      if (removing && await exists(file)) {
+        if (document.provider) delete document.provider.subconscious;
+        if (document.model?.startsWith('subconscious/')) delete document.model;
+        await writeJson(file, document);
+      }
+      if (removing) await fs.rm(path.join(env.XDG_CONFIG_HOME || path.join(home, '.config'), 'opencode', 'plugins', 'subconscious-compaction.ts'), { force: true });
+    }
+    if (removing) await fs.rm(legacy, { force: true });
+    log(`${id}: ${removing ? 'legacy integration removed' : present ? 'legacy integration exists' : 'launch-only; no legacy integration'}.`);
+    return 0;
+  }
+  throw new Error(`No native Windows setup is available for ${id}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "subconscious-cli",
-  "version": "4.0.17",
+  "version": "4.1.0-windows.0",
   "description": "CLI for Subconscious — run Subconscious Code, Claude Code, Codex, OpenCode, DeepSeek Harness, Cursor, Copilot, and Pi",
   "bin": {
     "subc": "bin/cli.js"
@@ -9,6 +9,7 @@
     "build:tui": "node scripts/build-tui.js",
     "build:tui:host": "node scripts/build-tui.js --host",
     "test": "node --test",
+    "test:windows": "node --test test/windows.test.js test/models.test.js test/auth.test.js test/tui.test.js test/update-check.test.js test/sessions.test.js test/branding.test.js test/claude-version.test.js test/usage.test.js test/release.test.js",
     "test:tui": "go -C tui test ./...",
     "prepack": "npm run build:tui",
     "prepublishOnly": "node scripts/require-publish-script.js"