QwenLM
diff --git a/‎packages/acp-bridge/src/bridge.test.ts‎
Lines changed: 5 additions & 1 deletion b/‎packages/acp-bridge/src/bridge.test.ts‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎packages/cli/src/acp-integration/acpAgent.test.ts‎
Lines changed: 36 additions & 0 deletions b/‎packages/cli/src/acp-integration/acpAgent.test.ts‎
Lines changed: 36 additions & 0 deletions
diff --git a/‎packages/cli/src/acp-integration/acpAgent.ts‎
Lines changed: 8 additions & 1 deletion b/‎packages/cli/src/acp-integration/acpAgent.ts‎
Lines changed: 8 additions & 1 deletion
diff --git a/‎packages/cli/src/acp-integration/live/capture-screen-context.test.ts‎
Lines changed: 22 additions & 17 deletions b/‎packages/cli/src/acp-integration/live/capture-screen-context.test.ts‎
Lines changed: 22 additions & 17 deletions
diff --git a/‎packages/cli/src/commands/review/cleanup.test.ts‎
Lines changed: 11 additions & 0 deletions b/‎packages/cli/src/commands/review/cleanup.test.ts‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎packages/cli/src/commands/review/drive.test.ts‎
Lines changed: 14 additions & 3 deletions b/‎packages/cli/src/commands/review/drive.test.ts‎
Lines changed: 14 additions & 3 deletions
diff --git a/‎packages/cli/src/commands/review/fetch-pr.test.ts‎
Lines changed: 8 additions & 3 deletions b/‎packages/cli/src/commands/review/fetch-pr.test.ts‎
Lines changed: 8 additions & 3 deletions
diff --git a/‎packages/cli/src/commands/review/lib/git.integration.test.ts‎
Lines changed: 11 additions & 6 deletions b/‎packages/cli/src/commands/review/lib/git.integration.test.ts‎
Lines changed: 11 additions & 6 deletions
diff --git a/‎packages/cli/src/commands/review/lib/same-file.test.ts‎
Lines changed: 101 additions & 3 deletions b/‎packages/cli/src/commands/review/lib/same-file.test.ts‎
Lines changed: 101 additions & 3 deletions
@@ -26962,8 +26962,12 @@ describe('createAcpSessionBridge', () => {
         expect(stderrSpy).toHaveBeenCalledWith(
           expect.stringContaining('updated session metadata'),
         );
+        // The audit line prints the id through JSON.stringify, which escapes
+        // the backslashes of a Windows-spelled session id.
         expect(stderrSpy).toHaveBeenCalledWith(
-          expect.stringContaining(session.sessionId),
+          expect.stringContaining(
+            JSON.stringify(session.sessionId).slice(1, -1),
+          ),
         );
         expect(stderrSpy).toHaveBeenCalledWith(
           expect.stringContaining('pr=9517'),
 
@@ -5330,6 +5330,42 @@ describe('QwenAgent MCP SSE/HTTP support', () => {
     },
   );
 
+  it.skipIf(process.platform === 'win32')(
+    'rejects a Live managed relocation through a symlinked allowed root',
+    async () => {
+      await withEmptyTrustedFolders(async (directory) => {
+        const realRoot = path.join(directory, 'real-root');
+        const target = path.join(realRoot, 'conversation-symlinked-root');
+        await fs.mkdir(target, { recursive: true, mode: 0o700 });
+        const linkedRoot = path.join(directory, 'Conversations');
+        await fs.symlink(realRoot, linkedRoot);
+        const canonicalTarget = await fs.realpath(target);
+        const settings = makeSessionSettings({
+          mcpServers: {},
+          security: { folderTrust: { enabled: true } },
+        });
+        const { agent, agentPromise, sessionId } = await bootRelocatableSession(
+          settings,
+          'expected-capability',
+        );
+
+        try {
+          await expect(
+            agent.extMethod(SERVE_CONTROL_EXT_METHODS.sessionCd, {
+              sessionId,
+              path: canonicalTarget,
+              allowedRoots: [linkedRoot],
+              managedRelocation: 'live-conversation',
+            }),
+          ).rejects.toThrow('owner-only allowed root');
+        } finally {
+          mockConnectionState.resolve();
+          await agentPromise;
+        }
+      });
+    },
+  );
+
   it('sessionArtifactsPersist rejects a missing session id', async () => {
     const { agent, agentPromise } = await bootAcpAgent();
 
 
@@ -3176,8 +3176,15 @@ interface ActivePromptCall {
 }
 
 function isOwnerOnlyDirectory(stats: Stats): boolean {
-  if (process.platform === 'win32') return false;
   if (stats.isSymbolicLink() || !stats.isDirectory()) return false;
+  if (process.platform === 'win32') {
+    // Node's fs.Stats exposes no ownership or permission bits on Windows, so
+    // the POSIX mode/uid check has no equivalent here. Containment then rests
+    // on the structural checks around this predicate — symlink rejection and
+    // dev/ino identity across the realpath round trip — the same trade-off
+    // serve/live/discovery.ts already makes on this platform.
+    return true;
+  }
   if (typeof process.getuid === 'function' && stats.uid !== process.getuid()) {
     return false;
   }
 
@@ -73,25 +73,30 @@ describe('CaptureScreenContextTool', () => {
     await expect(readFile(file.path)).rejects.toThrow();
   });
 
-  it('rejects a symlink and deletes only the Host-provided link', async () => {
-    const target = await captureFile();
-    const link = join(target.directory, 'linked.png');
-    await symlink(target.path, link);
-    const tool = new CaptureScreenContextTool(
-      async () => ({
-        appName: 'Finder',
-        accessibilityText: '',
-        screenshotPath: link,
-      }),
-      target.directory,
-    );
+  // The rejection relies on O_NOFOLLOW, which libuv ignores on win32; the
+  // tool is macOS-scoped, matching the symlink-test skips elsewhere.
+  it.skipIf(process.platform === 'win32')(
+    'rejects a symlink and deletes only the Host-provided link',
+    async () => {
+      const target = await captureFile();
+      const link = join(target.directory, 'linked.png');
+      await symlink(target.path, link);
+      const tool = new CaptureScreenContextTool(
+        async () => ({
+          appName: 'Finder',
+          accessibilityText: '',
+          screenshotPath: link,
+        }),
+        target.directory,
+      );
 
-    const result = await tool.build({}).execute(new AbortController().signal);
+      const result = await tool.build({}).execute(new AbortController().signal);
 
-    expect(result.error?.message).toBeTruthy();
-    await expect(readFile(target.path)).resolves.toEqual(PNG);
-    await expect(readFile(link)).rejects.toThrow();
-  });
+      expect(result.error?.message).toBeTruthy();
+      await expect(readFile(target.path)).resolves.toEqual(PNG);
+      await expect(readFile(link)).rejects.toThrow();
+    },
+  );
 
   it('rejects a screenshot outside the Host private directory', async () => {
     const outside = await captureFile();
 
@@ -51,6 +51,17 @@ const mocks = vi.hoisted(() => ({
   aoneWhoamiAccount: vi.fn(() => 'reviewer'),
 }));
 
+// The fixtures below key on POSIX path literals (`/repo/.qwen/tmp/…`), but
+// cleanup.ts and the helpers it calls (redirectedAncestor, promptRecordDir,
+// the deadline readers) run those strings through node:path. On Windows that
+// would spell them with a drive letter and backslashes, so no literal-keyed
+// mock or assertion could ever match. Pin POSIX semantics for this module
+// graph; on POSIX hosts this is the identity.
+vi.mock('node:path', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:path')>();
+  return { ...actual, ...actual.posix, default: actual.posix };
+});
+
 vi.mock('node:child_process', async (importOriginal) => {
   const actual = await importOriginal<typeof import('node:child_process')>();
   return {
 
@@ -935,7 +935,7 @@ describe("the verify brief's bound-address recipe actually captures", () => {
 
   it.skipIf(!have('curl') || !have('mktemp'))(
     "puts the service's own address in the drive log, not the response body",
-    () => {
+    async () => {
       const { pattern, script } = recipe();
       const dir = mkdtempSync(join(tmpdir(), 'drv-recipe-'));
       // A service whose RESPONSE BODY also carries a listening-on line: if the
@@ -948,7 +948,7 @@ describe("the verify brief's bound-address recipe actually captures", () => {
           "import http from 'node:http';",
           "const s=http.createServer((_q,r)=>{r.writeHead(200);r.end('listening on http://127.0.0.1:59999\\n')});",
           "s.listen(0,'127.0.0.1',()=>console.log(`svc listening on http://127.0.0.1:${s.address().port}`));",
-          'setTimeout(()=>process.exit(0),20000);',
+          'setTimeout(()=>process.exit(0),5000);',
         ].join('\n'),
       );
 
@@ -990,7 +990,18 @@ describe("the verify brief's bound-address recipe actually captures", () => {
         readdirSync(dir).filter((f) => f.endsWith('.log') && f !== 'drive.log'),
       ).toEqual([]);
 
-      rmSync(dir, { recursive: true, force: true });
+      // On Windows the backgrounded service keeps the working directory
+      // busy (EBUSY) until its self-exit timer fires; retry the removal
+      // until the handle is released.
+      for (let attempt = 0; ; attempt++) {
+        try {
+          rmSync(dir, { recursive: true, force: true });
+          break;
+        } catch (error) {
+          if (attempt >= 40) throw error;
+          await new Promise((resolve) => setTimeout(resolve, 250));
+        }
+      }
     },
   );
 });
 
@@ -7,7 +7,8 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { createHash } from 'node:crypto';
 import type { Argv, CommandModule } from 'yargs';
-import { resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
 import {
   fetchPrCommand,
   countDiffChangedLines,
@@ -4183,7 +4184,11 @@ describe('fetch-pr --resume', () => {
 });
 
 describe('fetch-pr --resume bookkeeping is counted, not merely called', () => {
-  const OUT = '/tmp/fetch-report.json';
+  // The deadline helpers derive the record dir through resolve(OUT), so OUT
+  // must be a native absolute path: a POSIX literal gains a drive letter and
+  // backslashes on Windows, the disk-routing mock below stops matching, and
+  // /tmp also maps to an unwritable drive root there.
+  const OUT = join(tmpdir(), 'fetch-report.json');
   const DIFF_BYTES = 'diff --git a/f b/f\n--- a/f\n+++ b/f\n@@ -1 +1 @@\n+x\n';
 
   function prevReport(over: Record<string, unknown> = {}): string {
@@ -4474,7 +4479,7 @@ describe('fetch-pr --resume bookkeeping is counted, not merely called', () => {
       actualDeadline.writeRoundCapStop(OUT, 2, 2, now + 2000);
 
       await run();
-      const stampsFile = `${recordDir}/budget-rounds.json`;
+      const stampsFile = join(recordDir, 'budget-rounds.json');
       // Resume 1 kept the stop — and the stamps that price its rounds.
       expect(actualDeadline.readBudgetStop(OUT)).not.toBeNull();
       expect(realFs.existsSync(stampsFile)).toBe(true);
 
@@ -32,6 +32,11 @@ function git(...args: string[]): string {
   return execFileSync('git', args, { cwd: repo, encoding: 'utf8' });
 }
 
+// Git prints worktree paths with forward slashes on Windows, while
+// `join`/`realpathSync` build backslash spellings there; compare both sides
+// slash-normalized (the identity on POSIX).
+const fwd = (value: string): string => value.replace(/\\/g, '/');
+
 beforeEach(() => {
   repo = mkdtempSync(join(tmpdir(), 'review-wt-'));
 
@@ -75,7 +80,7 @@ describe('releaseWorktree', () => {
 
     expect(existsSync(join(repo, 'wt'))).toBe(false);
     // Not `.not.toContain('wt')` — the fixture's own path holds that substring.
-    expect(git('worktree', 'list')).not.toContain(join(repo, 'wt'));
+    expect(fwd(git('worktree', 'list'))).not.toContain(fwd(join(repo, 'wt')));
   });
 
   it('removes an unregistered non-empty leftover git no longer tracks', () => {
@@ -86,7 +91,7 @@ describe('releaseWorktree', () => {
     mkdirSync(join(repo, 'wt', 'junk'), { recursive: true });
     writeFileSync(join(repo, 'wt', 'junk', 'f'), 'x');
     // Negative control: it is not a registered worktree.
-    expect(git('worktree', 'list')).not.toContain(join(repo, 'wt'));
+    expect(fwd(git('worktree', 'list'))).not.toContain(fwd(join(repo, 'wt')));
 
     expect(releaseWorktree(join(repo, 'wt'))).toMatchObject({
       existed: true,
@@ -169,8 +174,8 @@ describe('releaseWorktree', () => {
     // macOS (`/var` → `/private/var`): the raw spelling passes there only by
     // accident — the canonical path happens to contain it as a substring —
     // and would not on a Linux fixture reached through a symlinked ancestor.
-    expect(git('worktree', 'list')).toContain(
-      join(realpathSync(repo), 'victim'),
+    expect(fwd(git('worktree', 'list'))).toContain(
+      fwd(join(realpathSync(repo), 'victim')),
     );
     expect(existsSync(join(repo, 'victim', 'keep.txt'))).toBe(true);
   });
@@ -193,8 +198,8 @@ describe('releaseWorktree', () => {
     expect(got.freed).toBe(false);
     expect(got.reason).toContain('symlink');
     // Registered and on disk, both.
-    expect(git('worktree', 'list')).toContain(
-      join(realpathSync(repo), 'real', 'victim'),
+    expect(fwd(git('worktree', 'list'))).toContain(
+      fwd(join(realpathSync(repo), 'real', 'victim')),
     );
     expect(existsSync(join(repo, 'real', 'victim', 'keep.txt'))).toBe(true);
   });
 
@@ -4,20 +4,63 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   linkSync,
   mkdirSync,
   mkdtempSync,
   realpathSync,
   rmSync,
+  statSync,
   symlinkSync,
   writeFileSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { isSameFile } from './same-file.js';
 
+// Lets a test pose as a volume that exposes no inode numbers: statSync
+// reports ino 0 while enabled, everything else delegates to the real thing.
+const inoZeroVolume = vi.hoisted(() => ({ enabled: false }));
+// Lets a test pose as a case-insensitive volume (FAT/exFAT/SMB): every
+// registered case-variant spelling stats and canonicalises as the file it
+// names. The NATIVE canonicaliser reports the on-disk spelling — that is
+// what GetFinalPathNameByHandleW does on Windows — while the JS walker
+// echoes the caller's own spelling back.
+const caseInsensitiveVolume = vi.hoisted(() => ({
+  aliases: new Map<string, string>(),
+}));
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs')>();
+  const resolveAlias = (filePath: string): string =>
+    caseInsensitiveVolume.aliases.get(filePath) ?? filePath;
+  const statSync = ((filePath: string) => {
+    const stats = actual.statSync(resolveAlias(String(filePath)));
+    if (inoZeroVolume.enabled) stats.ino = 0;
+    return stats;
+  }) as typeof actual.statSync;
+  const realpathSync = Object.assign(
+    (filePath: Parameters<typeof actual.realpathSync>[0]) => {
+      const caller = String(filePath);
+      const resolved = actual.realpathSync(resolveAlias(caller));
+      return caseInsensitiveVolume.aliases.has(caller)
+        ? join(dirname(resolved), basename(caller))
+        : resolved;
+    },
+    {
+      native: (filePath: Parameters<typeof actual.realpathSync>[0]) =>
+        actual.realpathSync(resolveAlias(String(filePath))),
+    },
+  ) as unknown as typeof actual.realpathSync;
+  return {
+    ...actual,
+    statSync,
+    realpathSync,
+    default: { ...actual, statSync, realpathSync },
+  };
+});
+
 describe('isSameFile', () => {
   let dir: string;
 
@@ -31,15 +74,70 @@ describe('isSameFile', () => {
     rmSync(dir, { recursive: true, force: true });
   });
 
-  it('treats two hard links to one file as the same file', () => {
+  it('treats two hard links to one file as the same file', (ctx) => {
     const original = join(dir, 'original.json');
     writeFileSync(original, '{}');
     const linked = join(dir, 'linked.json');
     linkSync(original, linked);
+    // Hard-link identity rides dev/ino; on volumes that expose no inode
+    // numbers (ino 0) the comparison degrades to canonical spellings by
+    // design and cannot see through a hard link.
+    if (Number(statSync(original).ino) === 0) {
+      ctx.skip();
+      return;
+    }
     expect(isSameFile(original, linked)).toBe(true);
     expect(isSameFile(linked, original)).toBe(true);
   });
 
+  it('decides by canonical spelling when inodes are unverifiable', () => {
+    // FAT/exFAT-style volumes report ino 0 for every file; the comparison
+    // must fall back to canonical spellings there — never equating distinct
+    // files through a shared zero, never missing two spellings of one path.
+    const left = join(dir, 'ino-left.json');
+    const right = join(dir, 'ino-right.json');
+    writeFileSync(left, '{}');
+    writeFileSync(right, '{}');
+    mkdirSync(join(dir, 'ino-real'));
+    writeFileSync(join(dir, 'ino-real', 'aliased.json'), '{}');
+    symlinkSync(join(dir, 'ino-real'), join(dir, 'ino-link'));
+    const aliased = join(dir, 'ino-real', 'aliased.json');
+    const throughLink = join(dir, 'ino-link', 'aliased.json');
+    inoZeroVolume.enabled = true;
+    try {
+      expect(isSameFile(left, right)).toBe(false);
+      expect(isSameFile(aliased, throughLink)).toBe(true);
+      expect(isSameFile(throughLink, aliased)).toBe(true);
+    } finally {
+      inoZeroVolume.enabled = false;
+    }
+  });
+
+  it('equates case-variant spellings when inodes are unverifiable', () => {
+    // FAT/exFAT/SMB volumes are case-insensitive AND report ino 0 for every
+    // file, so both spellings of one file stat there. The fallback must
+    // compare through the canonicaliser that folds case (realpathSync.native
+    // — GetFinalPathNameByHandleW on Windows), not the JS walker that echoes
+    // the caller's spelling: a false `false` silently disables the
+    // anti-clobber guards that consume this predicate.
+    const real = join(dir, 'Report.md');
+    writeFileSync(real, '{}');
+    const variant = join(dir, 'report.md');
+    caseInsensitiveVolume.aliases.set(variant, real);
+    inoZeroVolume.enabled = true;
+    try {
+      expect(isSameFile(real, variant)).toBe(true);
+      expect(isSameFile(variant, real)).toBe(true);
+      // Two genuinely distinct files stay distinct under the same pose.
+      const other = join(dir, 'other.md');
+      writeFileSync(other, '{}');
+      expect(isSameFile(real, other)).toBe(false);
+    } finally {
+      inoZeroVolume.enabled = false;
+      caseInsensitiveVolume.aliases.clear();
+    }
+  });
+
   it('treats two distinct files as different files', () => {
     const left = join(dir, 'left.json');
     const right = join(dir, 'right.json');