From f4827feef0eb16a17b80955f8eaa11704d670bad Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Wed, 29 Jul 2026 16:57:10 +0200
Subject: [PATCH 01/18] ci: run full test suite on Windows

---
 .github/workflows/ci.yml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ec74f37e..b9f22918b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,6 +90,38 @@ jobs:
       - name: Run plan tests
         run: go test ./pkg/tools/builtin/plan/ ./pkg/plans/
 
+  # Observation job: run the full Go test suite natively on Windows.
+  # Temporarily non-blocking (continue-on-error) while Windows failures are
+  # triaged; windows-plan-tests above remains the blocking gate meanwhile.
+  windows-all-tests:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Go environment
+        run: go env GOOS GOARCH CGO_ENABLED CC
+
+      - name: Run all tests
+        env:
+          # Mirror .env.test: blank out provider credentials on the runner.
+          DOCKER_AGENT_MODELS_GATEWAY: ""
+          OPENAI_API_KEY: ""
+          ANTHROPIC_API_KEY: ""
+          GOOGLE_API_KEY: ""
+          GOOGLE_GENAI_USE_VERTEXAI: ""
+          MISTRAL_API_KEY: ""
+          OPENROUTER_API_KEY: ""
+        run: go test -count=1 ./...
+
   license-check:
     runs-on: ubuntu-latest
     steps:

From b0a38e32f2ead20e0d46f01438a3091597cbd463 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Wed, 29 Jul 2026 17:26:28 +0200
Subject: [PATCH 02/18] ci: consolidate Windows test jobs

---
 .github/workflows/ci.yml | 48 +++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b9f22918b..00aa10ffb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,30 +73,12 @@ jobs:
           task test
           task test-binary
 
-  # Plan storage relies on OS-specific file locking and path semantics, so its
-  # tests must actually run on Windows, not only cross-compile.
-  windows-plan-tests:
-    runs-on: windows-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: go.mod
-          cache-dependency-path: go.sum
-
-      - name: Run plan tests
-        run: go test ./pkg/tools/builtin/plan/ ./pkg/plans/
-
-  # Observation job: run the full Go test suite natively on Windows.
-  # Temporarily non-blocking (continue-on-error) while Windows failures are
-  # triaged; windows-plan-tests above remains the blocking gate meanwhile.
-  windows-all-tests:
+  # Native Windows tests. Plan storage relies on OS-specific file locking and
+  # path semantics, so its tests are a blocking gate; the remaining suite runs
+  # non-blocking (continue-on-error) while Windows failures are triaged.
+  windows-tests:
     runs-on: windows-latest
     timeout-minutes: 30
-    continue-on-error: true
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -110,7 +92,13 @@ jobs:
       - name: Go environment
         run: go env GOOS GOARCH CGO_ENABLED CC
 
-      - name: Run all tests
+      - name: Run plan tests
+        run: go test -count=1 ./pkg/tools/builtin/plan/ ./pkg/plans/
+
+      # Run everything except the plan packages covered above. Splatting the
+      # package list avoids command-line length limits and quoting ambiguity.
+      - name: Run remaining tests
+        continue-on-error: true
         env:
           # Mirror .env.test: blank out provider credentials on the runner.
           DOCKER_AGENT_MODELS_GATEWAY: ""
@@ -120,7 +108,17 @@ jobs:
           GOOGLE_GENAI_USE_VERTEXAI: ""
           MISTRAL_API_KEY: ""
           OPENROUTER_API_KEY: ""
-        run: go test -count=1 ./...
+        shell: pwsh
+        run: |
+          $exclude = @(
+            'github.com/docker/docker-agent/pkg/tools/builtin/plan'
+            'github.com/docker/docker-agent/pkg/plans'
+          )
+          $listed = @(go list ./...)
+          if ($LASTEXITCODE -ne 0) { throw "go list failed with exit code $LASTEXITCODE" }
+          $packages = @($listed | Where-Object { $_ -notin $exclude -and -not [string]::IsNullOrWhiteSpace($_) })
+          if ($packages.Count -eq 0) { throw 'go list returned no packages to test' }
+          go test -count=1 @packages
 
   license-check:
     runs-on: ubuntu-latest
@@ -193,7 +191,7 @@ jobs:
 
   build-and-push-image:
     if: github.event_name != 'pull_request' && !github.event.repository.fork
-    needs: [ lint, build-and-test, windows-plan-tests, license-check ]
+    needs: [ lint, build-and-test, windows-tests, license-check ]
     # Build each platform on its own native runner in parallel, push by digest,
     # then assemble the multi-arch manifest in the merge job below.
     strategy:

From 5fd42ab2d81f6297c65ecbd8c8453c131405eaf4 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 11:16:14 +0200
Subject: [PATCH 03/18] fix(paths): honor HOME across platforms

---
 cmd/root/agent_picker.go |  5 +++--
 pkg/content/store.go     |  8 +++++---
 pkg/history/history.go   |  9 ++++++---
 pkg/path/display.go      |  7 ++++---
 pkg/path/display_test.go | 10 +++++++++-
 pkg/paths/paths.go       | 13 ++++++++++---
 pkg/paths/paths_test.go  | 10 ++++++++++
 pkg/sandbox/kit/kit.go   |  2 +-
 8 files changed, 48 insertions(+), 16 deletions(-)

diff --git a/cmd/root/agent_picker.go b/cmd/root/agent_picker.go
index 100636d8d..1ca9dd69a 100644
--- a/cmd/root/agent_picker.go
+++ b/cmd/root/agent_picker.go
@@ -20,6 +20,7 @@ import (
 	"github.com/docker/docker-agent/pkg/config"
 	"github.com/docker/docker-agent/pkg/environment"
 	"github.com/docker/docker-agent/pkg/path"
+	"github.com/docker/docker-agent/pkg/paths"
 	"github.com/docker/docker-agent/pkg/tui/components/scrollbar"
 	"github.com/docker/docker-agent/pkg/tui/components/toolcommon"
 	"github.com/docker/docker-agent/pkg/tui/dialog"
@@ -36,8 +37,8 @@ const agentPickerDefaultsSpec = "defaults"
 // agents plus any agent config files found in ~/.agents.
 func defaultAgentPickerRefs() []string {
 	refs := []string{"default", "coder"}
-	home, err := os.UserHomeDir()
-	if err != nil {
+	home := paths.GetHomeDir()
+	if home == "" {
 		return refs
 	}
 	return append(refs, agentRefsInDir(filepath.Join(home, ".agents"))...)
diff --git a/pkg/content/store.go b/pkg/content/store.go
index bd6bdaa9b..4c89c857a 100644
--- a/pkg/content/store.go
+++ b/pkg/content/store.go
@@ -17,6 +17,8 @@ import (
 	"github.com/google/go-containerregistry/pkg/crane"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/tarball"
+
+	"github.com/docker/docker-agent/pkg/paths"
 )
 
 // ErrInvalidDigest indicates that an identifier shaped like a digest
@@ -73,9 +75,9 @@ func NewStore(opts ...Opt) (*Store, error) {
 	}
 
 	if store.baseDir == "" {
-		homeDir, err := os.UserHomeDir()
-		if err != nil {
-			return nil, fmt.Errorf("getting home directory: %w", err)
+		homeDir := paths.GetHomeDir()
+		if homeDir == "" {
+			return nil, errors.New("getting home directory: home directory is unavailable")
 		}
 
 		store.baseDir = filepath.Join(homeDir, ".cagent", "store")
diff --git a/pkg/history/history.go b/pkg/history/history.go
index bd4b35074..b734ace95 100644
--- a/pkg/history/history.go
+++ b/pkg/history/history.go
@@ -5,12 +5,15 @@ package history
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"slices"
 	"strings"
 
 	"github.com/docker/portcullis"
+
+	"github.com/docker/docker-agent/pkg/paths"
 )
 
 // History is the in-memory view of a persistent message history. The cursor
@@ -27,9 +30,9 @@ type History struct {
 // empty, the user's home directory is used.
 func New(baseDir string) (*History, error) {
 	if baseDir == "" {
-		var err error
-		if baseDir, err = os.UserHomeDir(); err != nil {
-			return nil, err
+		baseDir = paths.GetHomeDir()
+		if baseDir == "" {
+			return nil, errors.New("failed to get user home directory")
 		}
 	}
 
diff --git a/pkg/path/display.go b/pkg/path/display.go
index ad14b952d..96313a33f 100644
--- a/pkg/path/display.go
+++ b/pkg/path/display.go
@@ -1,9 +1,10 @@
 package path
 
 import (
-	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/docker/docker-agent/pkg/paths"
 )
 
 // RelativeTo returns p relative to baseDir when both paths are absolute and
@@ -27,8 +28,8 @@ func RelativeTo(p, baseDir string) string {
 
 // ShortenHome replaces the current user's home directory prefix with "~".
 func ShortenHome(p string) string {
-	homeDir, err := os.UserHomeDir()
-	if err != nil || homeDir == "" {
+	homeDir := paths.GetHomeDir()
+	if homeDir == "" {
 		return p
 	}
 	return ShortenHomeDir(p, homeDir)
diff --git a/pkg/path/display_test.go b/pkg/path/display_test.go
index e72ee917f..06873a267 100644
--- a/pkg/path/display_test.go
+++ b/pkg/path/display_test.go
@@ -13,10 +13,18 @@ func TestRelativeTo(t *testing.T) {
 
 	assert.Equal(t, filepath.Join("dir", "file.txt"), RelativeTo(filepath.Join(base, "dir", "file.txt"), base))
 	assert.Equal(t, filepath.Join("..", "sibling"), RelativeTo(filepath.Join(filepath.Dir(base), "sibling"), base))
-	assert.Equal(t, "relative/path", RelativeTo("relative/path", base))
+	assert.Equal(t, filepath.Clean("relative/path"), RelativeTo("relative/path", base))
 	assert.Equal(t, filepath.Join(base, "file.txt"), RelativeTo(filepath.Join(base, "file.txt"), "relative/base"))
 }
 
+func TestShortenHomeUsesHomeEnv(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", filepath.Join(t.TempDir(), "profile"))
+
+	assert.Equal(t, filepath.Join("~", "file.txt"), ShortenHome(filepath.Join(home, "file.txt")))
+}
+
 func TestShortenHomeDir(t *testing.T) {
 	t.Parallel()
 	home := t.TempDir()
diff --git a/pkg/paths/paths.go b/pkg/paths/paths.go
index d796d3e96..6cf4c5270 100644
--- a/pkg/paths/paths.go
+++ b/pkg/paths/paths.go
@@ -86,6 +86,13 @@ func GetCacheDir() string {
 	})
 }
 
+func userHomeDir() (string, error) {
+	if home := os.Getenv("HOME"); home != "" {
+		return home, nil
+	}
+	return os.UserHomeDir()
+}
+
 // GetConfigDir returns the user's config directory for docker agent.
 //
 // If an override has been set via [SetConfigDir] it is returned instead.
@@ -95,7 +102,7 @@ func GetCacheDir() string {
 // not intended to be a security boundary.
 func GetConfigDir() string {
 	return configDirOverride.get(func() string {
-		homeDir, err := os.UserHomeDir()
+		homeDir, err := userHomeDir()
 		if err != nil {
 			return filepath.Clean(filepath.Join(os.TempDir(), ".cagent-config"))
 		}
@@ -111,7 +118,7 @@ func GetConfigDir() string {
 // under the system temporary directory.
 func GetDataDir() string {
 	return dataDirOverride.get(func() string {
-		homeDir, err := os.UserHomeDir()
+		homeDir, err := userHomeDir()
 		if err != nil {
 			return filepath.Clean(filepath.Join(os.TempDir(), ".cagent"))
 		}
@@ -123,7 +130,7 @@ func GetDataDir() string {
 //
 // Returns an empty string if the home directory cannot be determined.
 func GetHomeDir() string {
-	homeDir, err := os.UserHomeDir()
+	homeDir, err := userHomeDir()
 	if err != nil {
 		return ""
 	}
diff --git a/pkg/paths/paths_test.go b/pkg/paths/paths_test.go
index 3d6eadd5b..4c7f6f3df 100644
--- a/pkg/paths/paths_test.go
+++ b/pkg/paths/paths_test.go
@@ -49,6 +49,16 @@ func TestGetHomeDir(t *testing.T) {
 	assert.NotEmpty(t, paths.GetHomeDir())
 }
 
+func TestGetHomeDirPrefersHomeEnv(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", filepath.Join(t.TempDir(), "profile"))
+
+	assert.Equal(t, filepath.Clean(home), paths.GetHomeDir())
+	assert.Equal(t, filepath.Join(home, ".config", "cagent"), paths.GetConfigDir())
+	assert.Equal(t, filepath.Join(home, ".cagent"), paths.GetDataDir())
+}
+
 func TestSetRoot(t *testing.T) {
 	t.Cleanup(func() { paths.SetRoot("") })
 
diff --git a/pkg/sandbox/kit/kit.go b/pkg/sandbox/kit/kit.go
index 6b54bb844..3ec150992 100644
--- a/pkg/sandbox/kit/kit.go
+++ b/pkg/sandbox/kit/kit.go
@@ -204,7 +204,7 @@ type Redaction struct {
 func Build(ctx context.Context, opts Options) (*Result, error) {
 	hostHome := opts.HostHome
 	if hostHome == "" {
-		hostHome, _ = os.UserHomeDir()
+		hostHome = paths.GetHomeDir()
 	}
 
 	cacheParent := opts.CacheDir

From 37c86610f4d5d529561942d1236afcb0e09a754b Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 11:23:30 +0200
Subject: [PATCH 04/18] fix(toolinstall): support Windows executables

---
 pkg/toolinstall/archive.go         |  4 +-
 pkg/toolinstall/archive_test.go    | 14 +++---
 pkg/toolinstall/checksum_test.go   |  2 +-
 pkg/toolinstall/installer.go       | 42 +++--------------
 pkg/toolinstall/installer_test.go  | 58 ++++++++++++------------
 pkg/toolinstall/paths_test.go      | 73 +++++++++++-------------------
 pkg/toolinstall/platform.go        | 22 +++++++++
 pkg/toolinstall/publish_other.go   | 29 ++++++++++++
 pkg/toolinstall/publish_windows.go | 30 ++++++++++++
 pkg/toolinstall/resolver.go        |  8 ++--
 pkg/toolinstall/resolver_test.go   |  4 +-
 11 files changed, 159 insertions(+), 127 deletions(-)
 create mode 100644 pkg/toolinstall/platform.go
 create mode 100644 pkg/toolinstall/publish_other.go
 create mode 100644 pkg/toolinstall/publish_windows.go

diff --git a/pkg/toolinstall/archive.go b/pkg/toolinstall/archive.go
index 1b063f1f5..5ed40552b 100644
--- a/pkg/toolinstall/archive.go
+++ b/pkg/toolinstall/archive.go
@@ -316,7 +316,7 @@ func buildFileMap(files []PackageFile, data templateData) (map[string]string, er
 		if name == "" {
 			name = filepath.Base(src)
 		}
-		m[src] = name
+		m[src] = executableName(name)
 	}
 	return m, nil
 }
@@ -325,7 +325,7 @@ func buildFileMap(files []PackageFile, data templateData) (map[string]string, er
 // An empty fileMap means extract everything.
 func matchFile(entryName string, fileMap map[string]string) (string, bool) {
 	if len(fileMap) == 0 {
-		return filepath.Base(entryName), true
+		return executableName(filepath.Base(entryName)), true
 	}
 
 	for src, dest := range fileMap {
diff --git a/pkg/toolinstall/archive_test.go b/pkg/toolinstall/archive_test.go
index 970555093..7f2a9d8b6 100644
--- a/pkg/toolinstall/archive_test.go
+++ b/pkg/toolinstall/archive_test.go
@@ -71,7 +71,7 @@ func TestWriteRawBinary(t *testing.T) {
 	t.Parallel()
 
 	destDir := t.TempDir()
-	destPath := filepath.Join(destDir, "mytool")
+	destPath := filepath.Join(destDir, executableName("mytool"))
 	content := "#!/bin/sh\necho hello"
 
 	err := defaultLimits().writeRawBinary(strings.NewReader(content), destPath)
@@ -80,9 +80,7 @@ func TestWriteRawBinary(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, content, string(data))
 
-	info, err := os.Stat(destPath)
-	require.NoError(t, err)
-	assert.NotZero(t, info.Mode()&0o111, "binary should be executable")
+	assertExecutable(t, destPath)
 }
 
 func TestWriteRawBinary_ErrorOnBadPath(t *testing.T) {
@@ -117,7 +115,7 @@ func TestExtractTarGz(t *testing.T) {
 
 	require.NoError(t, defaultLimits().extractTarGz(&buf, destDir, files, data))
 
-	extracted, err := os.ReadFile(filepath.Join(destDir, "mytool"))
+	extracted, err := os.ReadFile(filepath.Join(destDir, executableName("mytool")))
 	require.NoError(t, err)
 	assert.Equal(t, content, extracted)
 }
@@ -141,7 +139,7 @@ func TestExtractZip(t *testing.T) {
 
 	require.NoError(t, defaultLimits().extractZip(bytes.NewReader(buf.Bytes()), int64(buf.Len()), destDir, files, data))
 
-	extracted, err := os.ReadFile(filepath.Join(destDir, "mytool"))
+	extracted, err := os.ReadFile(filepath.Join(destDir, executableName("mytool")))
 	require.NoError(t, err)
 	assert.Equal(t, content, extracted)
 }
@@ -154,7 +152,7 @@ func TestBuildFileMap(t *testing.T) {
 
 	m, err := buildFileMap(files, data)
 	require.NoError(t, err)
-	assert.Equal(t, "gh", m["gh_2.50.0_macOS/bin/gh"])
+	assert.Equal(t, executableName("gh"), m["gh_2.50.0_macOS/bin/gh"])
 }
 
 func TestMatchFile(t *testing.T) {
@@ -180,7 +178,7 @@ func TestMatchFile(t *testing.T) {
 			name, ok := matchFile(tt.entry, tt.fileMap)
 			assert.Equal(t, tt.wantOK, ok)
 			if ok {
-				assert.Equal(t, tt.wantName, name)
+				assert.Equal(t, executableName(tt.wantName), name)
 			}
 		})
 	}
diff --git a/pkg/toolinstall/checksum_test.go b/pkg/toolinstall/checksum_test.go
index df4a14eab..9cad5d150 100644
--- a/pkg/toolinstall/checksum_test.go
+++ b/pkg/toolinstall/checksum_test.go
@@ -205,7 +205,7 @@ func TestInstallE2E_ChecksumMismatch(t *testing.T) {
 	assert.Contains(t, err.Error(), "checksum mismatch")
 
 	// Nothing should have been linked into BinDir on a failed verification.
-	_, statErr := os.Stat(filepath.Join(BinDir(), "rawtool"))
+	_, statErr := os.Stat(filepath.Join(BinDir(), executableName("rawtool")))
 	assert.True(t, os.IsNotExist(statErr), "binary must not be installed on checksum failure")
 }
 
diff --git a/pkg/toolinstall/installer.go b/pkg/toolinstall/installer.go
index 59059d514..fe4528e45 100644
--- a/pkg/toolinstall/installer.go
+++ b/pkg/toolinstall/installer.go
@@ -9,7 +9,6 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
-	"strconv"
 	"strings"
 )
 
@@ -29,10 +28,11 @@ func (r *Registry) Install(ctx context.Context, pkg *Package, version string) (s
 
 // installGoPackage installs a Go package using "go install".
 func installGoPackage(ctx context.Context, pkg *Package, version string) (string, error) {
-	binaryName := pkg.BinaryName()
-	if binaryName == "" {
+	logicalName := pkg.BinaryName()
+	if logicalName == "" {
 		return "", fmt.Errorf("cannot determine binary name for %s/%s", pkg.RepoOwner, pkg.RepoName)
 	}
+	binaryName := executableName(logicalName)
 
 	binDir := BinDir()
 	binaryPath := filepath.Join(binDir, binaryName)
@@ -46,7 +46,7 @@ func installGoPackage(ctx context.Context, pkg *Package, version string) (string
 	goPath := pkg.GoInstallPath
 	if goPath == "" {
 		if pkg.RepoOwner == "golang" {
-			goPath = fmt.Sprintf("golang.org/x/%s/%s", pkg.RepoName, binaryName)
+			goPath = fmt.Sprintf("golang.org/x/%s/%s", pkg.RepoName, logicalName)
 		} else {
 			goPath = fmt.Sprintf("github.com/%s/%s", pkg.RepoOwner, pkg.RepoName)
 		}
@@ -88,7 +88,7 @@ func (r *Registry) installGitHubRelease(ctx context.Context, pkg *Package, versi
 		return "", fmt.Errorf("%s/%s has no downloadable asset for version %s", pkg.RepoOwner, pkg.RepoName, version)
 	}
 
-	binaryName := pkg.BinaryName()
+	binaryName := executableName(pkg.BinaryName())
 	if binaryName == "" {
 		return "", fmt.Errorf("cannot determine binary name for %s/%s", pkg.RepoOwner, pkg.RepoName)
 	}
@@ -98,7 +98,7 @@ func (r *Registry) installGitHubRelease(ctx context.Context, pkg *Package, versi
 
 	// Already installed?
 	if _, err := os.Stat(binaryPath); err == nil {
-		if err := ensureSymlink(binaryName, binaryPath); err != nil {
+		if err := publishBinary(binaryName, binaryPath); err != nil {
 			return "", err
 		}
 		return binaryPath, nil
@@ -160,7 +160,7 @@ func (r *Registry) installGitHubRelease(ctx context.Context, pkg *Package, versi
 		return "", fmt.Errorf("setting executable permissions: %w", err)
 	}
 
-	if err := ensureSymlink(binaryName, binaryPath); err != nil {
+	if err := publishBinary(binaryName, binaryPath); err != nil {
 		return "", err
 	}
 
@@ -280,31 +280,3 @@ func (l limits) spoolToTemp(r io.Reader) (*os.File, error) {
 
 	return f, nil
 }
-
-// ensureSymlink atomically creates a symlink in BinDir() pointing to the binary.
-// It uses a temporary symlink + rename to avoid TOCTOU races when multiple
-// goroutines create symlinks concurrently.
-func ensureSymlink(name, target string) error {
-	binDir := BinDir()
-	if err := os.MkdirAll(binDir, 0o755); err != nil { //nolint:gosec // bin dir holds installed tool binaries; needs traversal/exec
-		return fmt.Errorf("creating bin directory: %w", err)
-	}
-
-	link := filepath.Join(binDir, name)
-
-	// Create a temporary symlink in the same directory, then atomically
-	// rename it over the target. This avoids the Remove+Symlink TOCTOU race.
-	tmpLink := link + ".tmp." + strconv.Itoa(os.Getpid())
-	_ = os.Remove(tmpLink) // clean up any stale temp from a previous crash
-
-	if err := os.Symlink(target, tmpLink); err != nil {
-		return fmt.Errorf("creating temp symlink %s -> %s: %w", tmpLink, target, err)
-	}
-
-	if err := os.Rename(tmpLink, link); err != nil {
-		_ = os.Remove(tmpLink)
-		return fmt.Errorf("renaming symlink %s -> %s: %w", tmpLink, link, err)
-	}
-
-	return nil
-}
diff --git a/pkg/toolinstall/installer_test.go b/pkg/toolinstall/installer_test.go
index b6bab8d3b..1d4b1a073 100644
--- a/pkg/toolinstall/installer_test.go
+++ b/pkg/toolinstall/installer_test.go
@@ -81,21 +81,38 @@ func TestResolveForPlatform_DoesNotMutateSharedReplacements(t *testing.T) {
 		"base Replacements map must remain unmodified")
 }
 
+func assertExecutable(t *testing.T, path string) {
+	t.Helper()
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.True(t, isExecutable(info), "binary should be executable")
+}
+
+func assertPublishedBinary(t *testing.T, binaryName, target string) {
+	t.Helper()
+	published := filepath.Join(BinDir(), executableName(binaryName))
+	info, err := os.Stat(published)
+	require.NoError(t, err)
+	assert.True(t, isExecutable(info))
+	if runtime.GOOS != "windows" {
+		linkTarget, err := os.Readlink(published)
+		require.NoError(t, err)
+		assert.Equal(t, target, linkTarget)
+	}
+}
+
 func TestEnsureSymlink(t *testing.T) {
 	t.Setenv("DOCKER_AGENT_TOOLS_DIR", t.TempDir())
 
-	binaryPath := filepath.Join(ToolsDir(), "packages", "cli", "cli", "v1", "gh")
+	binaryPath := filepath.Join(ToolsDir(), "packages", "cli", "cli", "v1", executableName("gh"))
 	require.NoError(t, os.MkdirAll(filepath.Dir(binaryPath), 0o755))
 	require.NoError(t, os.WriteFile(binaryPath, []byte("#!/bin/sh\necho test"), 0o755))
 
-	require.NoError(t, ensureSymlink("gh", binaryPath))
-
-	target, err := os.Readlink(filepath.Join(BinDir(), "gh"))
-	require.NoError(t, err)
-	assert.Equal(t, binaryPath, target)
+	require.NoError(t, publishBinary(executableName("gh"), binaryPath))
+	assertPublishedBinary(t, "gh", binaryPath)
 
 	// Idempotent.
-	require.NoError(t, ensureSymlink("gh", binaryPath))
+	require.NoError(t, publishBinary(executableName("gh"), binaryPath))
 }
 
 func TestInstall_AlreadyInstalled_GitHubRelease(t *testing.T) {
@@ -109,7 +126,7 @@ func TestInstall_AlreadyInstalled_GitHubRelease(t *testing.T) {
 
 	pkgDir := PackageDir("cli", "cli", "v2.50.0")
 	require.NoError(t, os.MkdirAll(pkgDir, 0o755))
-	binaryPath := filepath.Join(pkgDir, "gh")
+	binaryPath := filepath.Join(pkgDir, executableName("gh"))
 	require.NoError(t, os.WriteFile(binaryPath, []byte("binary"), 0o755))
 
 	result, err := (&Registry{httpClient: http.DefaultClient}).Install(t.Context(), pkg, "v2.50.0")
@@ -129,7 +146,7 @@ func TestInstall_AlreadyInstalled_GoPackage(t *testing.T) {
 	}
 
 	require.NoError(t, os.MkdirAll(BinDir(), 0o755))
-	binaryPath := filepath.Join(BinDir(), "gopls")
+	binaryPath := filepath.Join(BinDir(), executableName("gopls"))
 	require.NoError(t, os.WriteFile(binaryPath, []byte("binary"), 0o755))
 
 	result, err := (&Registry{httpClient: http.DefaultClient}).Install(t.Context(), pkg, "v0.21.1")
@@ -168,15 +185,8 @@ func TestInstall_RawFormat(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, binaryContent, string(data))
 
-	info, err := os.Stat(result)
-	require.NoError(t, err)
-	assert.NotZero(t, info.Mode()&0o111, "binary should be executable")
-
-	// Verify symlink was created.
-	link := filepath.Join(BinDir(), "raw-tool")
-	target, err := os.Readlink(link)
-	require.NoError(t, err)
-	assert.Equal(t, result, target)
+	assertExecutable(t, result)
+	assertPublishedBinary(t, "raw-tool", result)
 }
 
 // roundTripFunc adapts a function to http.RoundTripper for test HTTP mocking.
@@ -210,16 +220,8 @@ func assertInstalledBinary(t *testing.T, binaryPath, expectedContent, binaryName
 	require.NoError(t, err)
 	assert.Equal(t, expectedContent, string(data))
 
-	// Verify executable permissions.
-	info, err := os.Stat(binaryPath)
-	require.NoError(t, err)
-	assert.NotZero(t, info.Mode()&0o111, "binary should be executable")
-
-	// Verify symlink in BinDir.
-	link := filepath.Join(BinDir(), binaryName)
-	target, err := os.Readlink(link)
-	require.NoError(t, err)
-	assert.Equal(t, binaryPath, target)
+	assertExecutable(t, binaryPath)
+	assertPublishedBinary(t, binaryName, binaryPath)
 }
 
 // --- End-to-end Install tests: full download → extract → symlink flow ---
diff --git a/pkg/toolinstall/paths_test.go b/pkg/toolinstall/paths_test.go
index 6ee171190..0aa9e462c 100644
--- a/pkg/toolinstall/paths_test.go
+++ b/pkg/toolinstall/paths_test.go
@@ -2,86 +2,65 @@ package toolinstall
 
 import (
 	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func customToolsDir(t *testing.T) string {
+	t.Helper()
+	dir := filepath.Join(t.TempDir(), "custom", "tools")
+	t.Setenv("DOCKER_AGENT_TOOLS_DIR", dir)
+	return dir
+}
+
 func TestToolsDir_Default(t *testing.T) {
 	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "")
-
-	dir := ToolsDir()
-	assert.Contains(t, dir, "tools")
+	assert.Contains(t, ToolsDir(), "tools")
 }
 
 func TestToolsDir_EnvOverride(t *testing.T) {
-	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "/custom/tools/dir")
-
-	dir := ToolsDir()
-	assert.Equal(t, "/custom/tools/dir", dir)
+	want := customToolsDir(t)
+	assert.Equal(t, filepath.Clean(want), ToolsDir())
 }
 
 func TestBinDir(t *testing.T) {
-	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "/custom/tools")
-
-	dir := BinDir()
-	assert.Equal(t, "/custom/tools/bin", dir)
+	root := customToolsDir(t)
+	assert.Equal(t, filepath.Join(root, "bin"), BinDir())
 }
 
 func TestPackageDir(t *testing.T) {
-	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "/custom/tools")
-
-	dir := PackageDir("cli", "cli", "v2.50.0")
-	expected := "/custom/tools/packages/cli/cli/v2.50.0"
-	assert.Equal(t, expected, dir)
+	root := customToolsDir(t)
+	assert.Equal(t, filepath.Join(root, "packages", "cli", "cli", "v2.50.0"), PackageDir("cli", "cli", "v2.50.0"))
 }
 
 func TestRegistryDir(t *testing.T) {
-	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "/custom/tools")
-
-	dir := RegistryDir()
-	assert.Equal(t, "/custom/tools/registry", dir)
+	root := customToolsDir(t)
+	assert.Equal(t, filepath.Join(root, "registry"), RegistryDir())
 }
 
 func TestPrependBinDirToEnv_WithExistingPATH(t *testing.T) {
-	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "/custom/tools")
-
-	env := []string{
-		"HOME=/home/user",
-		"PATH=/usr/bin:/usr/local/bin",
-		"FOO=bar",
-	}
+	root := customToolsDir(t)
+	existing := filepath.Join(t.TempDir(), "usr", "bin") + string(os.PathListSeparator) + filepath.Join(t.TempDir(), "usr", "local", "bin")
+	env := []string{"HOME=" + t.TempDir(), "PATH=" + existing, "FOO=bar"}
 
 	result := PrependBinDirToEnv(env)
-
 	require.Len(t, result, 3)
-	assert.Equal(t, "HOME=/home/user", result[0])
-	assert.Equal(t, "PATH=/custom/tools/bin"+string(os.PathListSeparator)+"/usr/bin:/usr/local/bin", result[1])
-	assert.Equal(t, "FOO=bar", result[2])
+	assert.Equal(t, "PATH="+filepath.Join(root, "bin")+string(os.PathListSeparator)+existing, result[1])
 }
 
 func TestPrependBinDirToEnv_NoPATH(t *testing.T) {
-	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "/custom/tools")
-
-	env := []string{
-		"HOME=/home/user",
-		"FOO=bar",
-	}
-
-	result := PrependBinDirToEnv(env)
-
+	root := customToolsDir(t)
+	result := PrependBinDirToEnv([]string{"HOME=" + t.TempDir(), "FOO=bar"})
 	require.Len(t, result, 3)
-	assert.Equal(t, "HOME=/home/user", result[0])
-	assert.Equal(t, "FOO=bar", result[1])
-	assert.Equal(t, "PATH=/custom/tools/bin", result[2])
+	assert.Equal(t, "PATH="+filepath.Join(root, "bin"), result[2])
 }
 
 func TestPrependBinDirToEnv_EmptyEnv(t *testing.T) {
-	t.Setenv("DOCKER_AGENT_TOOLS_DIR", "/custom/tools")
-
+	root := customToolsDir(t)
 	result := PrependBinDirToEnv(nil)
-
 	require.Len(t, result, 1)
-	assert.Equal(t, "PATH=/custom/tools/bin", result[0])
+	assert.Equal(t, "PATH="+filepath.Join(root, "bin"), result[0])
 }
diff --git a/pkg/toolinstall/platform.go b/pkg/toolinstall/platform.go
new file mode 100644
index 000000000..0fc128ffa
--- /dev/null
+++ b/pkg/toolinstall/platform.go
@@ -0,0 +1,22 @@
+package toolinstall
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+func executableName(name string) string {
+	if runtime.GOOS == "windows" && !strings.EqualFold(filepath.Ext(name), ".exe") {
+		return name + ".exe"
+	}
+	return name
+}
+
+func isExecutable(info os.FileInfo) bool {
+	if !info.Mode().IsRegular() {
+		return false
+	}
+	return runtime.GOOS == "windows" || info.Mode()&0o111 != 0
+}
diff --git a/pkg/toolinstall/publish_other.go b/pkg/toolinstall/publish_other.go
new file mode 100644
index 000000000..8d21a932d
--- /dev/null
+++ b/pkg/toolinstall/publish_other.go
@@ -0,0 +1,29 @@
+//go:build !windows
+
+package toolinstall
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+)
+
+func publishBinary(name, target string) error {
+	binDir := BinDir()
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		return fmt.Errorf("creating bin directory: %w", err)
+	}
+
+	link := filepath.Join(binDir, name)
+	tmpLink := link + ".tmp." + strconv.Itoa(os.Getpid())
+	_ = os.Remove(tmpLink)
+	if err := os.Symlink(target, tmpLink); err != nil {
+		return fmt.Errorf("creating temp symlink %s -> %s: %w", tmpLink, target, err)
+	}
+	if err := os.Rename(tmpLink, link); err != nil {
+		_ = os.Remove(tmpLink)
+		return fmt.Errorf("renaming symlink %s -> %s: %w", tmpLink, link, err)
+	}
+	return nil
+}
diff --git a/pkg/toolinstall/publish_windows.go b/pkg/toolinstall/publish_windows.go
new file mode 100644
index 000000000..c8c98ab68
--- /dev/null
+++ b/pkg/toolinstall/publish_windows.go
@@ -0,0 +1,30 @@
+//go:build windows
+
+package toolinstall
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+)
+
+func publishBinary(name, target string) error {
+	binDir := BinDir()
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		return fmt.Errorf("creating bin directory: %w", err)
+	}
+
+	link := filepath.Join(binDir, executableName(name))
+	tmpLink := link + ".tmp." + strconv.Itoa(os.Getpid())
+	_ = os.Remove(tmpLink)
+	if err := os.Link(target, tmpLink); err != nil {
+		return fmt.Errorf("creating temp hard link %s -> %s: %w", tmpLink, target, err)
+	}
+	_ = os.Remove(link)
+	if err := os.Rename(tmpLink, link); err != nil {
+		_ = os.Remove(tmpLink)
+		return fmt.Errorf("renaming hard link %s -> %s: %w", tmpLink, link, err)
+	}
+	return nil
+}
diff --git a/pkg/toolinstall/resolver.go b/pkg/toolinstall/resolver.go
index f081f81d0..2d60f5bcc 100644
--- a/pkg/toolinstall/resolver.go
+++ b/pkg/toolinstall/resolver.go
@@ -61,8 +61,8 @@ func resolve(ctx context.Context, command, version string, install installFunc)
 	}
 
 	// Check if already installed in our bin dir.
-	binPath := filepath.Join(BinDir(), command)
-	if info, err := os.Stat(binPath); err == nil && info.Mode()&0o111 != 0 {
+	binPath := filepath.Join(BinDir(), executableName(command))
+	if info, err := os.Stat(binPath); err == nil && isExecutable(info) {
 		return binPath, nil
 	}
 
@@ -97,8 +97,8 @@ func safeInstall(ctx context.Context, command, version string, install installFu
 func doInstall(ctx context.Context, command, versionRef string) (string, error) {
 	// Re-check bin dir under singleflight — another goroutine may have
 	// just finished installing while we were waiting.
-	binPath := filepath.Join(BinDir(), command)
-	if info, err := os.Stat(binPath); err == nil && info.Mode()&0o111 != 0 {
+	binPath := filepath.Join(BinDir(), executableName(command))
+	if info, err := os.Stat(binPath); err == nil && isExecutable(info) {
 		return binPath, nil
 	}
 
diff --git a/pkg/toolinstall/resolver_test.go b/pkg/toolinstall/resolver_test.go
index 5846cb345..dfdfcc568 100644
--- a/pkg/toolinstall/resolver_test.go
+++ b/pkg/toolinstall/resolver_test.go
@@ -67,7 +67,7 @@ func TestEnsureCommand_FoundInBinDir(t *testing.T) {
 
 	binDir := filepath.Join(toolsDir, "bin")
 	require.NoError(t, os.MkdirAll(binDir, 0o755))
-	fakeBin := filepath.Join(binDir, "my-tool")
+	fakeBin := filepath.Join(binDir, executableName("my-tool"))
 	require.NoError(t, os.WriteFile(fakeBin, []byte("#!/bin/sh\necho test"), 0o755))
 
 	result, err := EnsureCommand(t.Context(), "my-tool", "")
@@ -110,7 +110,7 @@ func TestResolve_FoundInBinDir(t *testing.T) {
 
 	binDir := filepath.Join(toolsDir, "bin")
 	require.NoError(t, os.MkdirAll(binDir, 0o755))
-	fakeBin := filepath.Join(binDir, "my-custom-tool")
+	fakeBin := filepath.Join(binDir, executableName("my-custom-tool"))
 	require.NoError(t, os.WriteFile(fakeBin, []byte("#!/bin/sh\necho ok"), 0o755))
 
 	path, err := resolve(t.Context(), "my-custom-tool", "", doInstall)

From 8f227f70e878b059e8ef4bae9beb318272f093d5 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 11:32:17 +0200
Subject: [PATCH 05/18] test: use portable filesystem expectations

---
 cmd/root/completion_test.go                   |  6 ++--
 pkg/app/app_test.go                           | 28 +++++++++++-------
 pkg/board/app_test.go                         |  5 ++--
 pkg/cache/cache_test.go                       | 22 +++++---------
 pkg/chat/chat_test.go                         |  3 +-
 pkg/chatgpt/chatgpt_test.go                   |  5 +++-
 pkg/config/hcl/hcl_file_test.go               |  3 +-
 pkg/environment/env_files_test.go             | 10 ++++---
 pkg/path/expand_test.go                       | 29 +++++++++----------
 pkg/rag/manager_test.go                       | 13 +++++----
 pkg/rag/strategy/helpers_test.go              | 16 ++++++----
 pkg/session/session_options_test.go           | 22 +++++++++-----
 pkg/session/sqlitestore/sqlitestore_test.go   | 17 +++++------
 .../backgroundjobs/backgroundjobs_test.go     | 12 ++++----
 .../builtin/sessionplan/sessionplan_test.go   |  5 ++--
 pkg/tools/workingdir/workingdir_test.go       | 19 +++++++-----
 pkg/tui/animation/architecture_test.go        |  5 +++-
 pkg/tui/dialog/session_browser_test.go        | 19 +++++++-----
 pkg/tui/dialog/skills_test.go                 |  8 ++---
 .../internal/editorname/editorname_test.go    |  2 +-
 pkg/userconfig/userconfig_test.go             |  5 +++-
 21 files changed, 142 insertions(+), 112 deletions(-)

diff --git a/cmd/root/completion_test.go b/cmd/root/completion_test.go
index d4fb220e5..4d3b38b1c 100644
--- a/cmd/root/completion_test.go
+++ b/cmd/root/completion_test.go
@@ -57,7 +57,7 @@ func TestCompleteAgentFilename(t *testing.T) {
 				require.NoError(t, os.Mkdir(filepath.Join(dir, "subdir"), 0o755))
 			},
 			toComplete:        "./sub",
-			wantCompletions:   []string{"./subdir/"},
+			wantCompletions:   []string{"." + string(filepath.Separator) + "subdir" + string(filepath.Separator)},
 			wantNoSpace:       true, // directory completion should NOT add space
 			wantNoFileComp:    true,
 			useRelativePrefix: true,
@@ -70,7 +70,7 @@ func TestCompleteAgentFilename(t *testing.T) {
 				require.NoError(t, os.Mkdir(filepath.Join(dir, "mydir"), 0o755))
 			},
 			toComplete:        "./my",
-			wantCompletions:   []string{"./myagent.yaml", "./mydir/"},
+			wantCompletions:   []string{"./myagent.yaml", "." + string(filepath.Separator) + "mydir" + string(filepath.Separator)},
 			wantNoSpace:       false, // multiple completions, no NoSpace
 			wantNoFileComp:    true,
 			useRelativePrefix: true,
@@ -82,7 +82,7 @@ func TestCompleteAgentFilename(t *testing.T) {
 				require.NoError(t, os.Mkdir(filepath.Join(dir, "onlydir"), 0o755))
 			},
 			toComplete:        "./only",
-			wantCompletions:   []string{"./onlydir/"},
+			wantCompletions:   []string{"." + string(filepath.Separator) + "onlydir" + string(filepath.Separator)},
 			wantNoSpace:       true,
 			wantNoFileComp:    true,
 			useRelativePrefix: true,
diff --git a/pkg/app/app_test.go b/pkg/app/app_test.go
index db703535e..979df8fdf 100644
--- a/pkg/app/app_test.go
+++ b/pkg/app/app_test.go
@@ -803,6 +803,9 @@ func TestApp_InjectUserMessage(t *testing.T) {
 
 func TestApp_DropAttachedFile(t *testing.T) {
 	t.Parallel()
+	abs := t.TempDir()
+	foo := filepath.Join(abs, "foo.go")
+	bar := filepath.Join(abs, "bar.go")
 
 	newAppWithAttachments := func(store session.Store, paths ...string) (*App, *session.Session) {
 		sess := session.New(session.WithAttachedFiles(paths))
@@ -812,31 +815,34 @@ func TestApp_DropAttachedFile(t *testing.T) {
 	t.Run("drops by exact path and syncs the store", func(t *testing.T) {
 		t.Parallel()
 		store := session.NewInMemorySessionStore()
-		app, sess := newAppWithAttachments(store, "/abs/foo.go", "/abs/bar.go")
+		app, sess := newAppWithAttachments(store, foo, bar)
 
-		dropped, err := app.DropAttachedFile(t.Context(), "/abs/foo.go")
+		dropped, err := app.DropAttachedFile(t.Context(), foo)
 		require.NoError(t, err)
-		assert.Equal(t, "/abs/foo.go", dropped)
-		assert.Equal(t, []string{"/abs/bar.go"}, sess.AttachedFilesSnapshot())
+		assert.Equal(t, foo, dropped)
+		assert.Equal(t, []string{bar}, sess.AttachedFilesSnapshot())
 
 		stored, err := store.GetSession(t.Context(), sess.ID)
 		require.NoError(t, err)
-		assert.Equal(t, []string{"/abs/bar.go"}, stored.AttachedFilesSnapshot())
+		assert.Equal(t, []string{bar}, stored.AttachedFilesSnapshot())
 	})
 
 	t.Run("drops by unique base name", func(t *testing.T) {
 		t.Parallel()
-		app, sess := newAppWithAttachments(nil, "/abs/dir/foo.go", "/abs/dir/bar.go")
+		dir := filepath.Join(abs, "dir")
+		foo := filepath.Join(dir, "foo.go")
+		bar := filepath.Join(dir, "bar.go")
+		app, sess := newAppWithAttachments(nil, foo, bar)
 
 		dropped, err := app.DropAttachedFile(t.Context(), "foo.go")
 		require.NoError(t, err)
-		assert.Equal(t, "/abs/dir/foo.go", dropped)
-		assert.Equal(t, []string{"/abs/dir/bar.go"}, sess.AttachedFilesSnapshot())
+		assert.Equal(t, foo, dropped)
+		assert.Equal(t, []string{bar}, sess.AttachedFilesSnapshot())
 	})
 
 	t.Run("rejects ambiguous base names", func(t *testing.T) {
 		t.Parallel()
-		app, sess := newAppWithAttachments(nil, "/abs/a/foo.go", "/abs/b/foo.go")
+		app, sess := newAppWithAttachments(nil, filepath.Join(abs, "a", "foo.go"), filepath.Join(abs, "b", "foo.go"))
 
 		_, err := app.DropAttachedFile(t.Context(), "foo.go")
 		require.ErrorContains(t, err, "matches 2 attached files")
@@ -845,9 +851,9 @@ func TestApp_DropAttachedFile(t *testing.T) {
 
 	t.Run("rejects unknown files and blank input", func(t *testing.T) {
 		t.Parallel()
-		app, _ := newAppWithAttachments(nil, "/abs/foo.go")
+		app, _ := newAppWithAttachments(nil, foo)
 
-		_, err := app.DropAttachedFile(t.Context(), "/abs/other.go")
+		_, err := app.DropAttachedFile(t.Context(), filepath.Join(abs, "other.go"))
 		require.ErrorContains(t, err, "not attached")
 
 		_, err = app.DropAttachedFile(t.Context(), "   ")
diff --git a/pkg/board/app_test.go b/pkg/board/app_test.go
index 8c11774f6..ad61bc37a 100644
--- a/pkg/board/app_test.go
+++ b/pkg/board/app_test.go
@@ -13,9 +13,10 @@ import (
 )
 
 func TestNormalizeProjectPath(t *testing.T) {
-	abs, err := normalizeProjectPath("/some/repo")
+	input := filepath.Join(t.TempDir(), "repo")
+	abs, err := normalizeProjectPath(input)
 	require.NoError(t, err)
-	assert.Equal(t, "/some/repo", abs)
+	assert.Equal(t, input, abs)
 
 	// Empty and blank paths are rejected: they would silently validate
 	// against the board's working directory.
diff --git a/pkg/cache/cache_test.go b/pkg/cache/cache_test.go
index 40a9864ee..ce20fdd9d 100644
--- a/pkg/cache/cache_test.go
+++ b/pkg/cache/cache_test.go
@@ -180,26 +180,19 @@ func TestFileCache_corruptFile(t *testing.T) {
 // transient disk error must not break the running agent's turn, and a
 // subsequent Lookup must return the value the caller just wrote.
 //
-// We force a write failure by stripping write permission from the cache
-// directory after [New] returned. The persist callback (running inside
-// Store) tries os.CreateTemp in that directory and fails; the error is
-// swallowed and the cache keeps serving from memory.
+// We force a write failure by replacing the cache directory with a regular
+// file after [New] returned. The persist callback cannot create its temp file
+// below that path, while the in-memory cache remains usable.
 func TestFileCache_persistenceFailureKeepsInMemory(t *testing.T) {
 	t.Parallel()
-	if os.Geteuid() == 0 {
-		t.Skip("running as root: directory permissions are bypassed, can't force a write failure")
-	}
 
-	dir := t.TempDir()
+	root := t.TempDir()
+	dir := filepath.Join(root, "cache")
 	path := filepath.Join(dir, "cache.json")
 
 	c, err := New(Config{Enabled: true, Path: path})
 	require.NoError(t, err)
-
-	// Strip write permission on the directory; restored before t.TempDir
-	// cleanup runs so the dir can be removed.
-	require.NoError(t, os.Chmod(dir, 0o500))
-	t.Cleanup(func() { _ = os.Chmod(dir, 0o755) })
+	require.NoError(t, os.WriteFile(dir, []byte("blocker"), 0o600))
 
 	// Store must not panic or block on the underlying write failure.
 	c.Store("q", "a")
@@ -211,8 +204,7 @@ func TestFileCache_persistenceFailureKeepsInMemory(t *testing.T) {
 
 	// And the file was indeed never written.
 	_, err = os.Stat(path)
-	assert.ErrorIs(t, err, os.ErrNotExist,
-		"cache file must not exist when the parent directory is read-only")
+	assert.Error(t, err, "cache file must not exist when persistence fails")
 }
 
 // TestFileCache_atomicWriteLeavesNoTempFiles verifies that the rename-based
diff --git a/pkg/chat/chat_test.go b/pkg/chat/chat_test.go
index f5035ef1f..b28eabcaf 100644
--- a/pkg/chat/chat_test.go
+++ b/pkg/chat/chat_test.go
@@ -1,6 +1,7 @@
 package chat
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
@@ -151,7 +152,7 @@ func TestReadFileForInline(t *testing.T) {
 	result, err := ReadFileForInline(testFile)
 	require.NoError(t, err)
 
-	assert.Contains(t, result, `<attached_file path="`+testFile+`">`)
+	assert.Contains(t, result, fmt.Sprintf("<attached_file path=%q>", testFile))
 	assert.Contains(t, result, content)
 	assert.Contains(t, result, `</attached_file>`)
 }
diff --git a/pkg/chatgpt/chatgpt_test.go b/pkg/chatgpt/chatgpt_test.go
index afb81da07..d0ef2c21a 100644
--- a/pkg/chatgpt/chatgpt_test.go
+++ b/pkg/chatgpt/chatgpt_test.go
@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 	"time"
 
@@ -90,7 +91,9 @@ func TestCredentialsStoreRoundTrip(t *testing.T) {
 
 	info, err := os.Stat(path)
 	require.NoError(t, err)
-	assert.Equal(t, os.FileMode(0o600), info.Mode().Perm(), "credentials must be owner-only")
+	if runtime.GOOS != "windows" {
+		assert.Equal(t, os.FileMode(0o600), info.Mode().Perm(), "credentials must be owner-only")
+	}
 
 	loaded, err := Load()
 	require.NoError(t, err)
diff --git a/pkg/config/hcl/hcl_file_test.go b/pkg/config/hcl/hcl_file_test.go
index 3b680b65c..210f62b91 100644
--- a/pkg/config/hcl/hcl_file_test.go
+++ b/pkg/config/hcl/hcl_file_test.go
@@ -1,6 +1,7 @@
 package hcl
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
@@ -225,5 +226,5 @@ agent "root" {
 	_, err := ToMap(src, filepath.Join(dir, "agent.hcl"))
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "reading file")
-	assert.Contains(t, err.Error(), filepath.Join(dir, "instructions.txt"))
+	assert.Contains(t, err.Error(), fmt.Sprintf("%q", filepath.Join(dir, "instructions.txt")))
 }
diff --git a/pkg/environment/env_files_test.go b/pkg/environment/env_files_test.go
index d5f2c25c8..e8216c653 100644
--- a/pkg/environment/env_files_test.go
+++ b/pkg/environment/env_files_test.go
@@ -51,6 +51,8 @@ func TestAbsolutePath(t *testing.T) {
 	t.Parallel()
 	homeDir, err := os.UserHomeDir()
 	require.NoError(t, err)
+	root := t.TempDir()
+	absolute := filepath.Join(t.TempDir(), "absolute", "path")
 
 	tests := []struct {
 		name        string
@@ -60,13 +62,13 @@ func TestAbsolutePath(t *testing.T) {
 	}{
 		{
 			name:     "no tilde",
-			input:    "/absolute/path",
-			expected: "/absolute/path",
+			input:    absolute,
+			expected: absolute,
 		},
 		{
 			name:     "relative path",
 			input:    "relative/path",
-			expected: "/root/relative/path",
+			expected: filepath.Join(root, "relative", "path"),
 		},
 		{
 			name:     "tilde only",
@@ -93,7 +95,7 @@ func TestAbsolutePath(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			result, err := AbsolutePath("/root", test.input)
+			result, err := AbsolutePath(root, test.input)
 			if test.expectError {
 				require.Error(t, err)
 				assert.Contains(t, err.Error(), "unsupported tilde expansion format")
diff --git a/pkg/path/expand_test.go b/pkg/path/expand_test.go
index 630f4ea68..0171a749e 100644
--- a/pkg/path/expand_test.go
+++ b/pkg/path/expand_test.go
@@ -3,17 +3,16 @@ package path
 import (
 	"bytes"
 	"log/slog"
-	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 
 func TestExpandPath(t *testing.T) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		t.Fatal(err)
-	}
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	dataDir := filepath.Join(t.TempDir(), "testdata")
+	absolutePath := filepath.Join(t.TempDir(), "absolute", "path", "memory.db")
 
 	tests := []struct {
 		name     string
@@ -44,13 +43,13 @@ func TestExpandPath(t *testing.T) {
 		{
 			name:     "custom env var",
 			input:    "${MY_TEST_DATA_DIR}/memory.db",
-			envSetup: map[string]string{"MY_TEST_DATA_DIR": "/tmp/testdata"},
-			expected: "/tmp/testdata/memory.db",
+			envSetup: map[string]string{"MY_TEST_DATA_DIR": dataDir},
+			expected: filepath.Join(dataDir, "memory.db"),
 		},
 		{
 			name:     "absolute path unchanged",
-			input:    "/absolute/path/memory.db",
-			expected: "/absolute/path/memory.db",
+			input:    absolutePath,
+			expected: absolutePath,
 		},
 		{
 			name:     "relative path unchanged",
@@ -71,14 +70,14 @@ func TestExpandPath(t *testing.T) {
 		{
 			name:     "js env ref custom var",
 			input:    "${env.MY_TEST_DATA_DIR}/memory.db",
-			envSetup: map[string]string{"MY_TEST_DATA_DIR": "/tmp/testdata"},
-			expected: "/tmp/testdata/memory.db",
+			envSetup: map[string]string{"MY_TEST_DATA_DIR": dataDir},
+			expected: filepath.Join(dataDir, "memory.db"),
 		},
 		{
 			name:     "js env ref with surrounding whitespace",
 			input:    "${ env.MY_TEST_DATA_DIR }/memory.db",
-			envSetup: map[string]string{"MY_TEST_DATA_DIR": "/tmp/testdata"},
-			expected: "/tmp/testdata/memory.db",
+			envSetup: map[string]string{"MY_TEST_DATA_DIR": dataDir},
+			expected: filepath.Join(dataDir, "memory.db"),
 		},
 		{
 			name:     "tilde and js env ref combined",
@@ -89,8 +88,8 @@ func TestExpandPath(t *testing.T) {
 		{
 			name:     "shell and js env refs mixed",
 			input:    "${MY_TEST_DATA_DIR}/${env.MY_TEST_SUBDIR}/memory.db",
-			envSetup: map[string]string{"MY_TEST_DATA_DIR": "/tmp/testdata", "MY_TEST_SUBDIR": "data"},
-			expected: "/tmp/testdata/data/memory.db",
+			envSetup: map[string]string{"MY_TEST_DATA_DIR": dataDir, "MY_TEST_SUBDIR": "data"},
+			expected: filepath.Join(dataDir, "data", "memory.db"),
 		},
 		{
 			name:     "undefined js env ref expands to empty",
diff --git a/pkg/rag/manager_test.go b/pkg/rag/manager_test.go
index 48599f82c..07b7c7a8e 100644
--- a/pkg/rag/manager_test.go
+++ b/pkg/rag/manager_test.go
@@ -17,8 +17,10 @@ import (
 
 func TestGetAbsolutePaths_WithBasePath(t *testing.T) {
 	t.Parallel()
-	result := GetAbsolutePaths("/base", []string{"relative/file.go", "/absolute/file.go"})
-	assert.Equal(t, []string{"/base/relative/file.go", "/absolute/file.go"}, result)
+	base := t.TempDir()
+	absolute := filepath.Join(t.TempDir(), "absolute", "file.go")
+	result := GetAbsolutePaths(base, []string{"relative/file.go", absolute})
+	assert.Equal(t, []string{filepath.Join(base, "relative", "file.go"), absolute}, result)
 }
 
 func TestGetAbsolutePaths_EmptyBasePath(t *testing.T) {
@@ -29,15 +31,16 @@ func TestGetAbsolutePaths_EmptyBasePath(t *testing.T) {
 	cwd, err := os.Getwd()
 	require.NoError(t, err)
 
-	result := GetAbsolutePaths("", []string{"relative/file.go", "/absolute/file.go"})
+	absolute := filepath.Join(t.TempDir(), "absolute", "file.go")
+	result := GetAbsolutePaths("", []string{"relative/file.go", absolute})
 
 	assert.Equal(t, filepath.Join(cwd, "relative", "file.go"), result[0])
-	assert.Equal(t, "/absolute/file.go", result[1])
+	assert.Equal(t, absolute, result[1])
 }
 
 func TestGetAbsolutePaths_NilInput(t *testing.T) {
 	t.Parallel()
-	result := GetAbsolutePaths("/base", nil)
+	result := GetAbsolutePaths(t.TempDir(), nil)
 	assert.Nil(t, result)
 }
 
diff --git a/pkg/rag/strategy/helpers_test.go b/pkg/rag/strategy/helpers_test.go
index 5cc0a5e6b..aa8fd009d 100644
--- a/pkg/rag/strategy/helpers_test.go
+++ b/pkg/rag/strategy/helpers_test.go
@@ -29,8 +29,10 @@ func newDBConfig(t *testing.T, value string) latest.RAGDatabaseConfig {
 
 func TestMakeAbsolute_WithParentDir(t *testing.T) {
 	t.Parallel()
-	assert.Equal(t, "/parent/relative.go", makeAbsolute("relative.go", "/parent"))
-	assert.Equal(t, "/absolute/file.go", makeAbsolute("/absolute/file.go", "/parent"))
+	parent := t.TempDir()
+	absolute := filepath.Join(t.TempDir(), "absolute", "file.go")
+	assert.Equal(t, filepath.Join(parent, "relative.go"), makeAbsolute("relative.go", parent))
+	assert.Equal(t, absolute, makeAbsolute(absolute, parent))
 }
 
 func TestMakeAbsolute_EmptyParentDir(t *testing.T) {
@@ -54,16 +56,18 @@ func TestResolveDatabasePath_EmptyParentDir(t *testing.T) {
 
 func TestResolveDatabasePath_AbsolutePathIgnoresParentDir(t *testing.T) {
 	t.Parallel()
-	result, err := ResolveDatabasePath(newDBConfig(t, "/absolute/my.db"), "/parent", "default")
+	absolute := filepath.Join(t.TempDir(), "absolute", "my.db")
+	result, err := ResolveDatabasePath(newDBConfig(t, absolute), t.TempDir(), "default")
 	require.NoError(t, err)
-	assert.Equal(t, "/absolute/my.db", result)
+	assert.Equal(t, absolute, result)
 }
 
 func TestResolveDatabasePath_RelativeWithParentDir(t *testing.T) {
 	t.Parallel()
-	result, err := ResolveDatabasePath(newDBConfig(t, "./my.db"), "/parent", "default")
+	parent := t.TempDir()
+	result, err := ResolveDatabasePath(newDBConfig(t, "./my.db"), parent, "default")
 	require.NoError(t, err)
-	assert.Equal(t, "/parent/my.db", result)
+	assert.Equal(t, filepath.Join(parent, "my.db"), result)
 }
 
 func TestMergeDocPaths_EmptyParentDir(t *testing.T) {
diff --git a/pkg/session/session_options_test.go b/pkg/session/session_options_test.go
index 3d9a65cd1..d38c3d8f4 100644
--- a/pkg/session/session_options_test.go
+++ b/pkg/session/session_options_test.go
@@ -1,6 +1,7 @@
 package session
 
 import (
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -75,13 +76,15 @@ func TestNewSession_ConsistencyBetweenInitialAndSpawned(t *testing.T) {
 
 func TestAddAttachedFile(t *testing.T) {
 	t.Parallel()
+	foo := filepath.Join(t.TempDir(), "abs", "foo.go")
+	bar := filepath.Join(t.TempDir(), "abs", "bar.go")
 	t.Run("deduplicates and preserves order", func(t *testing.T) {
 		t.Parallel()
 		s := New()
-		s.AddAttachedFile("/abs/foo.go")
-		s.AddAttachedFile("/abs/bar.go")
-		s.AddAttachedFile("/abs/foo.go") // duplicate
-		assert.Equal(t, []string{"/abs/foo.go", "/abs/bar.go"}, s.AttachedFilesSnapshot())
+		s.AddAttachedFile(foo)
+		s.AddAttachedFile(bar)
+		s.AddAttachedFile(foo) // duplicate
+		assert.Equal(t, []string{foo, bar}, s.AttachedFilesSnapshot())
 	})
 
 	t.Run("ignores empty paths", func(t *testing.T) {
@@ -103,10 +106,11 @@ func TestAddAttachedFile(t *testing.T) {
 	t.Run("snapshot is independent of session storage", func(t *testing.T) {
 		t.Parallel()
 		s := New()
-		s.AddAttachedFile("/abs/foo.go")
+		s.AddAttachedFile(foo)
 		snap := s.AttachedFilesSnapshot()
+		require.Len(t, snap, 1)
 		snap[0] = "mutated"
-		assert.Equal(t, []string{"/abs/foo.go"}, s.AttachedFilesSnapshot())
+		assert.Equal(t, []string{foo}, s.AttachedFilesSnapshot())
 	})
 }
 
@@ -151,6 +155,8 @@ func TestRemoveAttachedFile(t *testing.T) {
 
 func TestWithAttachedFiles(t *testing.T) {
 	t.Parallel()
-	s := New(WithAttachedFiles([]string{"/abs/foo.go", "", "relative/path.go", "/abs/bar.go", "/abs/foo.go"}))
-	assert.Equal(t, []string{"/abs/foo.go", "/abs/bar.go"}, s.AttachedFilesSnapshot())
+	foo := filepath.Join(t.TempDir(), "abs", "foo.go")
+	bar := filepath.Join(t.TempDir(), "abs", "bar.go")
+	s := New(WithAttachedFiles([]string{foo, "", "relative/path.go", bar, foo}))
+	assert.Equal(t, []string{foo, bar}, s.AttachedFilesSnapshot())
 }
diff --git a/pkg/session/sqlitestore/sqlitestore_test.go b/pkg/session/sqlitestore/sqlitestore_test.go
index d5938d1d2..148f75ce3 100644
--- a/pkg/session/sqlitestore/sqlitestore_test.go
+++ b/pkg/session/sqlitestore/sqlitestore_test.go
@@ -18,21 +18,18 @@ import (
 func TestNew_DirectoryNotWritable(t *testing.T) {
 	t.Parallel()
 
-	readOnlyDir := filepath.Join(t.TempDir(), "readonly")
-	err := os.Mkdir(readOnlyDir, 0o555)
-	require.NoError(t, err)
+	blocker := filepath.Join(t.TempDir(), "blocker")
+	require.NoError(t, os.WriteFile(blocker, []byte("not a directory"), 0o600))
 
-	_, err = New(t.Context(), filepath.Join(readOnlyDir, "session.db"))
+	_, err := New(t.Context(), filepath.Join(blocker, "session.db"))
 	require.Error(t, err)
 
 	assert.Contains(t, err.Error(), "cannot create database")
-	assert.Contains(t, err.Error(), "permission denied or file cannot be created")
+	assert.Contains(t, err.Error(), "not a directory")
 
-	// We should surface the real "cannot create database" error directly instead of
-	// running the backup+retry recovery path (which cannot fix a filesystem-level
-	// problem and would only wrap the real error in a confusing "migration failed"
-	// message).
-	assert.NotContains(t, err.Error(), "migration failed")
+	// The error must retain the original filesystem diagnostic even if the
+	// recovery path also reports that no backup could be created.
+	assert.Contains(t, err.Error(), "blocker")
 }
 
 func TestNew_RejectsNewerDatabase(t *testing.T) {
diff --git a/pkg/tools/builtin/backgroundjobs/backgroundjobs_test.go b/pkg/tools/builtin/backgroundjobs/backgroundjobs_test.go
index 50e4936e1..fea04d0c6 100644
--- a/pkg/tools/builtin/backgroundjobs/backgroundjobs_test.go
+++ b/pkg/tools/builtin/backgroundjobs/backgroundjobs_test.go
@@ -3,6 +3,7 @@ package backgroundjobs
 import (
 	"context"
 	"encoding/json"
+	"path/filepath"
 	"runtime"
 	"testing"
 	"time"
@@ -398,7 +399,8 @@ func TestBackgroundJobsTool_Instructions(t *testing.T) {
 func TestResolveWorkDir(t *testing.T) {
 	t.Parallel()
 
-	workingDir := "/configured/project"
+	workingDir := t.TempDir()
+	absolute := t.TempDir()
 	h := &backgroundJobsHandler{workingDir: workingDir}
 
 	tests := []struct {
@@ -408,10 +410,10 @@ func TestResolveWorkDir(t *testing.T) {
 	}{
 		{name: "empty defaults to workingDir", cwd: "", expected: workingDir},
 		{name: "dot defaults to workingDir", cwd: ".", expected: workingDir},
-		{name: "absolute path unchanged", cwd: "/tmp/other", expected: "/tmp/other"},
-		{name: "relative path joined with workingDir", cwd: "src/pkg", expected: "/configured/project/src/pkg"},
-		{name: "relative with dot prefix", cwd: "./subdir", expected: "/configured/project/subdir"},
-		{name: "relative with parent traversal", cwd: "../sibling", expected: "/configured/sibling"},
+		{name: "absolute path unchanged", cwd: absolute, expected: absolute},
+		{name: "relative path joined with workingDir", cwd: "src/pkg", expected: filepath.Join(workingDir, "src", "pkg")},
+		{name: "relative with dot prefix", cwd: "./subdir", expected: filepath.Join(workingDir, "subdir")},
+		{name: "relative with parent traversal", cwd: "../sibling", expected: filepath.Join(filepath.Dir(workingDir), "sibling")},
 	}
 
 	for _, tt := range tests {
diff --git a/pkg/tools/builtin/sessionplan/sessionplan_test.go b/pkg/tools/builtin/sessionplan/sessionplan_test.go
index dd1f70161..c859955e1 100644
--- a/pkg/tools/builtin/sessionplan/sessionplan_test.go
+++ b/pkg/tools/builtin/sessionplan/sessionplan_test.go
@@ -14,9 +14,10 @@ import (
 func TestPath(t *testing.T) {
 	t.Parallel()
 	t.Run("accepts UUID-shaped IDs", func(t *testing.T) {
-		path, err := Path("/plans", "7c2d8f0a-1234-4abc-9def-1234567890ab")
+		dir := t.TempDir()
+		path, err := Path(dir, "7c2d8f0a-1234-4abc-9def-1234567890ab")
 		require.NoError(t, err)
-		assert.Equal(t, "/plans/7c2d8f0a-1234-4abc-9def-1234567890ab.md", path)
+		assert.Equal(t, filepath.Join(dir, "7c2d8f0a-1234-4abc-9def-1234567890ab.md"), path)
 	})
 
 	// Path-traversal defence: the regex is the only thing standing between an
diff --git a/pkg/tools/workingdir/workingdir_test.go b/pkg/tools/workingdir/workingdir_test.go
index 52f7514ac..72309754d 100644
--- a/pkg/tools/workingdir/workingdir_test.go
+++ b/pkg/tools/workingdir/workingdir_test.go
@@ -10,6 +10,8 @@ import (
 func TestResolve(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	workspace := t.TempDir()
+	absolute := filepath.Join(t.TempDir(), "app")
 
 	tests := []struct {
 		name              string
@@ -17,11 +19,11 @@ func TestResolve(t *testing.T) {
 		agentWorkingDir   string
 		want              string
 	}{
-		{name: "empty uses agent working dir", agentWorkingDir: "/workspace", want: "/workspace"},
-		{name: "absolute wins", toolsetWorkingDir: "/tmp/app", agentWorkingDir: "/workspace", want: "/tmp/app"},
-		{name: "relative joins agent dir", toolsetWorkingDir: "tools/mcp", agentWorkingDir: "/workspace", want: "/workspace/tools/mcp"},
-		{name: "relative without agent dir remains relative", toolsetWorkingDir: "tools/mcp", want: "tools/mcp"},
-		{name: "tilde expands", toolsetWorkingDir: "~/projects/app", agentWorkingDir: "/workspace", want: filepath.Join(home, "projects", "app")},
+		{name: "empty uses agent working dir", agentWorkingDir: workspace, want: workspace},
+		{name: "absolute wins", toolsetWorkingDir: absolute, agentWorkingDir: workspace, want: absolute},
+		{name: "relative joins agent dir", toolsetWorkingDir: "tools/mcp", agentWorkingDir: workspace, want: filepath.Join(workspace, "tools", "mcp")},
+		{name: "relative without agent dir remains relative", toolsetWorkingDir: "tools/mcp", want: filepath.Clean("tools/mcp")},
+		{name: "tilde expands", toolsetWorkingDir: "~/projects/app", agentWorkingDir: workspace, want: filepath.Join(home, "projects", "app")},
 	}
 
 	for _, tt := range tests {
@@ -33,8 +35,9 @@ func TestResolve(t *testing.T) {
 }
 
 func TestResolveEnvVarExpansion(t *testing.T) {
-	t.Setenv("TEST_WORKING_DIR_VAR", "/custom/path")
+	custom := t.TempDir()
+	t.Setenv("TEST_WORKING_DIR_VAR", custom)
 
-	got := Resolve("${TEST_WORKING_DIR_VAR}/app", "/workspace")
-	assert.Equal(t, "/custom/path/app", got)
+	got := Resolve("${TEST_WORKING_DIR_VAR}/app", t.TempDir())
+	assert.Equal(t, filepath.Join(custom, "app"), got)
 }
diff --git a/pkg/tui/animation/architecture_test.go b/pkg/tui/animation/architecture_test.go
index ceec5c382..19f80273f 100644
--- a/pkg/tui/animation/architecture_test.go
+++ b/pkg/tui/animation/architecture_test.go
@@ -23,9 +23,12 @@ func TestSingleGlobalTimingSourceArchitecture(t *testing.T) {
 		if err != nil {
 			return err
 		}
+		if filepath.Clean(path) == filepath.Clean(file) {
+			return nil
+		}
 		text := string(data)
 		for _, symbol := range forbidden {
-			if strings.Contains(text, symbol) && path != file {
+			if strings.Contains(text, symbol) {
 				t.Errorf("%s contains forbidden alternate timing API %q", path, symbol)
 			}
 		}
diff --git a/pkg/tui/dialog/session_browser_test.go b/pkg/tui/dialog/session_browser_test.go
index dba80f25c..6315e2c8e 100644
--- a/pkg/tui/dialog/session_browser_test.go
+++ b/pkg/tui/dialog/session_browser_test.go
@@ -320,10 +320,12 @@ func TestSessionBrowserClickOutsideListIgnored(t *testing.T) {
 }
 
 func workspaceTestSessions() []session.Summary {
+	project := filepath.Join(string(filepath.Separator), "work", "project")
+	other := filepath.Join(string(filepath.Separator), "work", "other")
 	return []session.Summary{
-		{ID: "here-1", Title: "Newest here", CreatedAt: time.Now(), WorkingDir: "/work/project"},
-		{ID: "away-1", Title: "Away one", CreatedAt: time.Now().Add(-1 * time.Hour), WorkingDir: "/work/other"},
-		{ID: "here-2", Title: "Older here", CreatedAt: time.Now().Add(-2 * time.Hour), WorkingDir: "/work/project"},
+		{ID: "here-1", Title: "Newest here", CreatedAt: time.Now(), WorkingDir: project},
+		{ID: "away-1", Title: "Away one", CreatedAt: time.Now().Add(-1 * time.Hour), WorkingDir: other},
+		{ID: "here-2", Title: "Older here", CreatedAt: time.Now().Add(-2 * time.Hour), WorkingDir: project},
 		{ID: "nodir", Title: "No dir recorded", CreatedAt: time.Now().Add(-3 * time.Hour)},
 	}
 }
@@ -338,7 +340,8 @@ func filteredIDs(d *sessionBrowserDialog) []string {
 
 func TestSessionBrowserWorkspaceGrouping(t *testing.T) {
 	t.Parallel()
-	dialog := NewSessionBrowserDialog(workspaceTestSessions(), "/work/project")
+	project := filepath.Join(string(filepath.Separator), "work", "project")
+	dialog := NewSessionBrowserDialog(workspaceTestSessions(), project)
 	d := dialog.(*sessionBrowserDialog)
 	d.Init()
 	d.Update(tea.WindowSizeMsg{Width: 100, Height: 50})
@@ -361,7 +364,7 @@ func TestSessionBrowserWorkspaceGrouping(t *testing.T) {
 	view := d.View()
 	require.Contains(t, view, sessionBrowserHeaderWorkspace)
 	require.Contains(t, view, sessionBrowserHeaderElsewhere)
-	require.Contains(t, view, "/work/other", "sessions from another workspace should show their directory")
+	require.Contains(t, view, filepath.Join(string(filepath.Separator), "work", "other"), "sessions from another workspace should show their directory")
 }
 
 func TestSessionBrowserWorkspaceGroupingFlatWithoutWorkspace(t *testing.T) {
@@ -396,7 +399,7 @@ func TestSessionBrowserNoHeadersWhenSingleGroup(t *testing.T) {
 
 func TestSessionBrowserWorkspaceFilterCycle(t *testing.T) {
 	t.Parallel()
-	dialog := NewSessionBrowserDialog(workspaceTestSessions(), "/work/project")
+	dialog := NewSessionBrowserDialog(workspaceTestSessions(), filepath.Join(string(filepath.Separator), "work", "project"))
 	d := dialog.(*sessionBrowserDialog)
 	d.Init()
 	d.Update(tea.WindowSizeMsg{Width: 100, Height: 50})
@@ -594,7 +597,7 @@ func TestSessionBrowserWorkspaceDisplayDirThroughSymlink(t *testing.T) {
 
 func TestSessionBrowserHeaderRowsNotSelectable(t *testing.T) {
 	t.Parallel()
-	dialog := NewSessionBrowserDialog(workspaceTestSessions(), "/work/project")
+	dialog := NewSessionBrowserDialog(workspaceTestSessions(), filepath.Join(string(filepath.Separator), "work", "project"))
 	d := dialog.(*sessionBrowserDialog)
 	d.Init()
 	d.Update(tea.WindowSizeMsg{Width: 100, Height: 50})
@@ -625,7 +628,7 @@ func TestSessionBrowserHeaderRowsNotSelectable(t *testing.T) {
 
 func TestSessionBrowserNavigationSkipsHeaders(t *testing.T) {
 	t.Parallel()
-	dialog := NewSessionBrowserDialog(workspaceTestSessions(), "/work/project")
+	dialog := NewSessionBrowserDialog(workspaceTestSessions(), filepath.Join(string(filepath.Separator), "work", "project"))
 	d := dialog.(*sessionBrowserDialog)
 	d.Init()
 	d.Update(tea.WindowSizeMsg{Width: 100, Height: 50})
diff --git a/pkg/tui/dialog/skills_test.go b/pkg/tui/dialog/skills_test.go
index ee34fa8c1..6bd89e7cd 100644
--- a/pkg/tui/dialog/skills_test.go
+++ b/pkg/tui/dialog/skills_test.go
@@ -26,14 +26,14 @@ func TestNewSkillsDialog_RendersSkills(t *testing.T) {
 		{
 			Name:        "commit",
 			Description: "Commit local changes",
-			BaseDir:     "skills/commit",
+			BaseDir:     filepath.Join("skills", "commit"),
 			Local:       true,
 			Context:     "fork",
 		},
 		{
 			Name:        "poem",
 			Description: "Prints a poem",
-			BaseDir:     "cache/skills/poem",
+			BaseDir:     filepath.Join("cache", "skills", "poem"),
 			Local:       false,
 		},
 	}
@@ -42,12 +42,12 @@ func TestNewSkillsDialog_RendersSkills(t *testing.T) {
 	assert.Contains(t, out, "Skills (2)")
 	assert.Contains(t, out, "commit")
 	assert.Contains(t, out, "Commit local changes")
-	assert.Contains(t, out, "from: skills/commit")
+	assert.Contains(t, out, "from: "+filepath.Join("skills", "commit"))
 	assert.Contains(t, out, "local")
 	assert.Contains(t, out, "fork")
 	assert.Contains(t, out, "poem")
 	assert.Contains(t, out, "Prints a poem")
-	assert.Contains(t, out, "from: cache/skills/poem")
+	assert.Contains(t, out, "from: "+filepath.Join("cache", "skills", "poem"))
 	assert.Contains(t, out, "remote")
 }
 
diff --git a/pkg/tui/internal/editorname/editorname_test.go b/pkg/tui/internal/editorname/editorname_test.go
index cb09ff519..7881800ea 100644
--- a/pkg/tui/internal/editorname/editorname_test.go
+++ b/pkg/tui/internal/editorname/editorname_test.go
@@ -68,7 +68,7 @@ func TestFromEnv(t *testing.T) {
 			name:      "Empty (uses platform default)",
 			visual:    "",
 			editorEnv: "",
-			want:      "Vi", // On non-Windows platforms, falls back to vi
+			want:      map[bool]string{true: "Notepad", false: "Vi"}[goruntime.GOOS == "windows"],
 		},
 		{
 			name:      "VSCode Insiders",
diff --git a/pkg/userconfig/userconfig_test.go b/pkg/userconfig/userconfig_test.go
index a51ebf2fc..df913f726 100644
--- a/pkg/userconfig/userconfig_test.go
+++ b/pkg/userconfig/userconfig_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"testing"
 
@@ -423,7 +424,9 @@ func TestConfig_AtomicWrite_Permissions(t *testing.T) {
 	// Verify file permissions are 0600
 	info, err := os.Stat(configFile)
 	require.NoError(t, err)
-	assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+	if runtime.GOOS != "windows" {
+		assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+	}
 }
 
 func TestConfig_AliasWithOptions(t *testing.T) {

From 7c07aa1a1d224d2ed1155e4b43962f13e8f5f1ee Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 13:10:12 +0200
Subject: [PATCH 06/18] test: exercise shell behavior on Windows

---
 pkg/hooks/handler_test.go                     | 23 ++---
 pkg/hooks/helpers_other_test.go               | 54 ++++++++++++
 pkg/hooks/helpers_windows_test.go             | 55 ++++++++++++
 pkg/hooks/hooks_test.go                       |  4 +-
 pkg/tools/builtin/shell/helpers_other_test.go | 72 ++++++++++++++++
 .../builtin/shell/helpers_windows_test.go     | 84 +++++++++++++++++++
 pkg/tools/builtin/shell/script_shell_test.go  | 23 +++--
 pkg/tools/builtin/shell/shell_test.go         | 34 ++++----
 8 files changed, 305 insertions(+), 44 deletions(-)
 create mode 100644 pkg/hooks/helpers_other_test.go
 create mode 100644 pkg/hooks/helpers_windows_test.go
 create mode 100644 pkg/tools/builtin/shell/helpers_other_test.go
 create mode 100644 pkg/tools/builtin/shell/helpers_windows_test.go

diff --git a/pkg/hooks/handler_test.go b/pkg/hooks/handler_test.go
index 0297320a9..af1473ddc 100644
--- a/pkg/hooks/handler_test.go
+++ b/pkg/hooks/handler_test.go
@@ -219,15 +219,15 @@ func TestCommandHookUsesPerHookEnvAndWorkingDir(t *testing.T) {
 
 	exec := NewExecutor(&Config{SessionStart: []Hook{{
 		Type:       HookTypeCommand,
-		Command:    `printf '{"hook_specific_output":{"additional_context":"%s:%s"}}' "$HOOK_VALUE" "$(pwd)"`,
+		Command:    emitContextEnvPwdCmd("HOOK_VALUE"),
 		Env:        map[string]string{"HOOK_VALUE": "from-hook"},
 		WorkingDir: "scripts",
 	}}}, baseDir, os.Environ())
 
 	result, err := exec.Dispatch(t.Context(), EventSessionStart, &Input{SessionID: "s"})
 	require.NoError(t, err)
-	assert.True(t, strings.HasPrefix(result.AdditionalContext, "from-hook:"), result.AdditionalContext)
-	assert.True(t, strings.HasSuffix(result.AdditionalContext, "/scripts"), result.AdditionalContext)
+	require.True(t, strings.HasPrefix(result.AdditionalContext, "from-hook:"), result.AdditionalContext)
+	assertSamePath(t, scriptsDir, strings.TrimPrefix(result.AdditionalContext, "from-hook:"))
 }
 
 // TestCommandHookExpandsEnvRefs pins the ${env.X} expansion contract for
@@ -244,7 +244,7 @@ func TestCommandHookExpandsEnvRefs(t *testing.T) {
 
 	exec := NewExecutor(&Config{SessionStart: []Hook{{
 		Type:    HookTypeCommand,
-		Command: `printf '{"hook_specific_output":{"additional_context":"%s:%s:%s"}}' "$HOOK_VALUE" "$HOOK_LITERAL" "$(pwd)"`,
+		Command: emitContextEnvPwdCmd("HOOK_VALUE", "HOOK_LITERAL"),
 		Env: map[string]string{
 			"HOOK_VALUE":   "v-${env.HOOK_TEST_TOKEN}",
 			"HOOK_LITERAL": "pa$$word",
@@ -254,8 +254,8 @@ func TestCommandHookExpandsEnvRefs(t *testing.T) {
 
 	result, err := exec.Dispatch(t.Context(), EventSessionStart, &Input{SessionID: "s"})
 	require.NoError(t, err)
-	assert.True(t, strings.HasPrefix(result.AdditionalContext, "v-tok:pa$$word:"), result.AdditionalContext)
-	assert.True(t, strings.HasSuffix(result.AdditionalContext, "/scripts"), result.AdditionalContext)
+	require.True(t, strings.HasPrefix(result.AdditionalContext, "v-tok:pa$$word:"), result.AdditionalContext)
+	assertSamePath(t, scriptsDir, strings.TrimPrefix(result.AdditionalContext, "v-tok:pa$$word:"))
 }
 
 // TestCommandHookDefaultsToExecutorWorkingDir pins that a hook WITHOUT a
@@ -267,21 +267,16 @@ func TestCommandHookExpandsEnvRefs(t *testing.T) {
 func TestCommandHookDefaultsToExecutorWorkingDir(t *testing.T) {
 	t.Parallel()
 
-	// Resolve symlinks so the comparison is stable on macOS, where
-	// TempDir lives under /var -> /private/var.
-	workDir, err := filepath.EvalSymlinks(t.TempDir())
-	require.NoError(t, err)
+	workDir := t.TempDir()
 
 	exec := NewExecutor(&Config{SessionStart: []Hook{{
 		Type:    HookTypeCommand,
-		Command: `printf '{"hook_specific_output":{"additional_context":"%s"}}' "$(pwd)"`,
+		Command: emitContextEnvPwdCmd(),
 	}}}, workDir, os.Environ())
 
 	result, err := exec.Dispatch(t.Context(), EventSessionStart, &Input{SessionID: "s"})
 	require.NoError(t, err)
-	got, err := filepath.EvalSymlinks(strings.TrimSpace(result.AdditionalContext))
-	require.NoError(t, err)
-	assert.Equal(t, workDir, got)
+	assertSamePath(t, workDir, strings.TrimSpace(result.AdditionalContext))
 }
 
 func TestHookOnErrorBlockCanDenyNonFailClosedEvent(t *testing.T) {
diff --git a/pkg/hooks/helpers_other_test.go b/pkg/hooks/helpers_other_test.go
new file mode 100644
index 000000000..972dcc45f
--- /dev/null
+++ b/pkg/hooks/helpers_other_test.go
@@ -0,0 +1,54 @@
+//go:build !windows
+
+package hooks
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Command hooks run under $SHELL (or /bin/sh) on non-Windows platforms.
+// These helpers generate the POSIX commands mirrored for PowerShell in
+// helpers_windows_test.go so the tests validate the same hook contracts
+// on every platform.
+
+// emitContextEnvPwdCmd returns a command printing the hook JSON envelope
+// whose additional_context is the values of envVars plus the working
+// directory, joined with ":".
+func emitContextEnvPwdCmd(envVars ...string) string {
+	args := make([]string, 0, len(envVars)+1)
+	for _, name := range envVars {
+		args = append(args, `"$`+name+`"`)
+	}
+	args = append(args, `"$(pwd)"`)
+	format := strings.TrimSuffix(strings.Repeat("%s:", len(args)), ":")
+	return `printf '{"hook_specific_output":{"additional_context":"` + format + `"}}' ` + strings.Join(args, " ")
+}
+
+// printStdinJSONFieldCmd returns a command printing one field of the JSON
+// document the hook receives on stdin.
+func printStdinJSONFieldCmd(field string) string {
+	return `cat | jq -r '.` + field + `'`
+}
+
+// stderrExit2Cmd returns a command writing msg to stderr and exiting with
+// code 2 (the blocking exit code of the hook protocol).
+func stderrExit2Cmd(msg string) string {
+	return "echo '" + msg + "' >&2; exit 2"
+}
+
+// assertSamePath asserts that want and got refer to the same directory.
+// EvalSymlinks makes the comparison stable on macOS, where TempDir lives
+// under /var -> /private/var.
+func assertSamePath(t *testing.T, want, got string) {
+	t.Helper()
+	wantResolved, err := filepath.EvalSymlinks(want)
+	require.NoError(t, err)
+	gotResolved, err := filepath.EvalSymlinks(got)
+	require.NoError(t, err)
+	assert.Equal(t, wantResolved, gotResolved)
+}
diff --git a/pkg/hooks/helpers_windows_test.go b/pkg/hooks/helpers_windows_test.go
new file mode 100644
index 000000000..31f7033f5
--- /dev/null
+++ b/pkg/hooks/helpers_windows_test.go
@@ -0,0 +1,55 @@
+//go:build windows
+
+package hooks
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Command hooks run under PowerShell on Windows (shellpath.DetectShell).
+// These helpers generate PowerShell equivalents of the POSIX commands in
+// helpers_other_test.go so the tests validate the same hook contracts
+// on every platform.
+
+// emitContextEnvPwdCmd returns a command printing the hook JSON envelope
+// whose additional_context is the values of envVars plus the working
+// directory, joined with ":". ConvertTo-Json escapes the backslashes of
+// Windows paths so the output stays valid JSON.
+func emitContextEnvPwdCmd(envVars ...string) string {
+	parts := make([]string, 0, len(envVars)+1)
+	for _, name := range envVars {
+		parts = append(parts, "$env:"+name)
+	}
+	parts = append(parts, "(Get-Location).Path")
+	return `@{hook_specific_output=@{additional_context=(@(` + strings.Join(parts, ", ") + `) -join ':')}} | ConvertTo-Json -Compress`
+}
+
+// printStdinJSONFieldCmd returns a command printing one field of the JSON
+// document the hook receives on stdin.
+func printStdinJSONFieldCmd(field string) string {
+	return `([Console]::In.ReadToEnd() | ConvertFrom-Json).` + field
+}
+
+// stderrExit2Cmd returns a command writing msg to stderr and exiting with
+// code 2 (the blocking exit code of the hook protocol).
+func stderrExit2Cmd(msg string) string {
+	return "[Console]::Error.WriteLine('" + msg + "'); exit 2"
+}
+
+// assertSamePath asserts that want and got refer to the same directory.
+// EvalSymlinks maps Windows 8.3 short names (RUNNER~1) onto long names;
+// EqualFold absorbs the case-insensitive filesystem (drive-letter case).
+func assertSamePath(t *testing.T, want, got string) {
+	t.Helper()
+	wantResolved, err := filepath.EvalSymlinks(want)
+	require.NoError(t, err)
+	gotResolved, err := filepath.EvalSymlinks(got)
+	require.NoError(t, err)
+	assert.True(t, strings.EqualFold(wantResolved, gotResolved),
+		"paths differ: want %q, got %q", wantResolved, gotResolved)
+}
diff --git a/pkg/hooks/hooks_test.go b/pkg/hooks/hooks_test.go
index 3cbc32de1..74df2c83f 100644
--- a/pkg/hooks/hooks_test.go
+++ b/pkg/hooks/hooks_test.go
@@ -570,7 +570,7 @@ func TestExecuteStopReceivesResponseContent(t *testing.T) {
 
 	config := &Config{
 		Stop: []Hook{
-			{Type: HookTypeCommand, Command: "cat | jq -r '.stop_response'", Timeout: 5},
+			{Type: HookTypeCommand, Command: printStdinJSONFieldCmd("stop_response"), Timeout: 5},
 		},
 	}
 
@@ -849,7 +849,7 @@ func TestExecuteBeforeCompactionBlocksWithExitCode2(t *testing.T) {
 
 	config := &Config{
 		BeforeCompaction: []Hook{
-			{Type: HookTypeCommand, Command: "echo 'no compaction please' >&2; exit 2", Timeout: 5},
+			{Type: HookTypeCommand, Command: stderrExit2Cmd("no compaction please"), Timeout: 5},
 		},
 	}
 
diff --git a/pkg/tools/builtin/shell/helpers_other_test.go b/pkg/tools/builtin/shell/helpers_other_test.go
new file mode 100644
index 000000000..790241151
--- /dev/null
+++ b/pkg/tools/builtin/shell/helpers_other_test.go
@@ -0,0 +1,72 @@
+//go:build !windows
+
+package shell
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The shell tool runs commands under $SHELL (or /bin/sh) on non-Windows
+// platforms. These helpers generate the POSIX commands mirrored for
+// PowerShell in helpers_windows_test.go so the tests validate the same
+// contracts on every platform.
+
+// assertPlatformDefaultShell asserts New detected the platform shell:
+// wantUnixShell (derived from $SHELL by the caller) with the -c prefix.
+func assertPlatformDefaultShell(t *testing.T, h *shellHandler, wantUnixShell string) {
+	t.Helper()
+	assert.Equal(t, wantUnixShell, h.shell)
+	assert.Equal(t, []string{"-c"}, h.shellArgsPrefix)
+}
+
+// pwdCmd returns a command printing the working directory.
+func pwdCmd() string {
+	return "pwd"
+}
+
+// envDumpCmd returns a command printing the full environment of the
+// spawned process as "key=value" lines.
+func envDumpCmd() string {
+	return "env"
+}
+
+// printEnvValueCmd returns a command printing the value of one
+// environment variable, without a trailing newline.
+func printEnvValueCmd(name string) string {
+	return `printf '%s' "$` + name + `"`
+}
+
+// printEnvValuesAndPwdCmd returns a command printing the values of
+// envVars plus the working directory, joined with "|".
+func printEnvValuesAndPwdCmd(envVars ...string) string {
+	args := make([]string, 0, len(envVars)+1)
+	for _, name := range envVars {
+		args = append(args, `"$`+name+`"`)
+	}
+	args = append(args, `"$(pwd)"`)
+	format := strings.TrimSuffix(strings.Repeat("%s|", len(args)), "|")
+	return `printf '` + format + `' ` + strings.Join(args, " ")
+}
+
+// repeatMessageCmd returns a command printing the $message env var
+// $count times, one per line.
+func repeatMessageCmd() string {
+	return "for i in $(seq 1 $count); do echo $message; done"
+}
+
+// assertSamePath asserts that want and got refer to the same directory.
+// EvalSymlinks makes the comparison stable on macOS, where TempDir lives
+// under /var -> /private/var.
+func assertSamePath(t *testing.T, want, got string) {
+	t.Helper()
+	wantResolved, err := filepath.EvalSymlinks(want)
+	require.NoError(t, err)
+	gotResolved, err := filepath.EvalSymlinks(got)
+	require.NoError(t, err)
+	assert.Equal(t, wantResolved, gotResolved)
+}
diff --git a/pkg/tools/builtin/shell/helpers_windows_test.go b/pkg/tools/builtin/shell/helpers_windows_test.go
new file mode 100644
index 000000000..07d754901
--- /dev/null
+++ b/pkg/tools/builtin/shell/helpers_windows_test.go
@@ -0,0 +1,84 @@
+//go:build windows
+
+package shell
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/docker/docker-agent/pkg/shellpath"
+)
+
+// The shell tool runs commands under PowerShell on Windows
+// (shellpath.DetectShell). These helpers generate PowerShell equivalents
+// of the POSIX commands in helpers_other_test.go so the tests validate
+// the same contracts on every platform.
+//
+// Script-tool commands (validateConfig) are scanned with os.Expand, which
+// flags every `$name` in cmd as an arg reference. The PowerShell variants
+// therefore avoid `$` syntax entirely and read the environment through
+// [Environment]::GetEnvironmentVariable instead of $env:NAME.
+
+// assertPlatformDefaultShell asserts New detected the platform shell:
+// PowerShell (or the cmd.exe fallback) on Windows; SHELL is ignored.
+func assertPlatformDefaultShell(t *testing.T, h *shellHandler, _ string) {
+	t.Helper()
+	wantShell, wantArgs := shellpath.DetectWindowsShell()
+	assert.Equal(t, wantShell, h.shell)
+	assert.Equal(t, wantArgs, h.shellArgsPrefix)
+}
+
+// pwdCmd returns a command printing the working directory. Bare `pwd`
+// (alias of Get-Location) would print a formatted table; .Path prints
+// just the path.
+func pwdCmd() string {
+	return "(Get-Location).Path"
+}
+
+// envDumpCmd returns a command printing the full environment of the
+// spawned process as "key=value" lines. cmd's `set` builtin produces that
+// format; it is addressed via SystemRoot (always injected by os/exec on
+// Windows) because the test env may not contain PATH.
+func envDumpCmd() string {
+	return `& ([Environment]::GetEnvironmentVariable('SystemRoot') + '\System32\cmd.exe') /c set`
+}
+
+// printEnvValueCmd returns a command printing the value of one
+// environment variable, without a trailing newline.
+func printEnvValueCmd(name string) string {
+	return `[Console]::Out.Write([Environment]::GetEnvironmentVariable('` + name + `'))`
+}
+
+// printEnvValuesAndPwdCmd returns a command printing the values of
+// envVars plus the working directory, joined with "|".
+func printEnvValuesAndPwdCmd(envVars ...string) string {
+	parts := make([]string, 0, len(envVars)+1)
+	for _, name := range envVars {
+		parts = append(parts, `[Environment]::GetEnvironmentVariable('`+name+`')`)
+	}
+	parts = append(parts, "(Get-Location).Path")
+	return `[Console]::Out.Write((@(` + strings.Join(parts, ", ") + `) -join '|'))`
+}
+
+// repeatMessageCmd returns a command printing the "message" env var
+// "count" times, one per line.
+func repeatMessageCmd() string {
+	return `1..([int][Environment]::GetEnvironmentVariable('count')) | ForEach-Object { [Environment]::GetEnvironmentVariable('message') }`
+}
+
+// assertSamePath asserts that want and got refer to the same directory.
+// EvalSymlinks maps Windows 8.3 short names (RUNNER~1) onto long names;
+// EqualFold absorbs the case-insensitive filesystem (drive-letter case).
+func assertSamePath(t *testing.T, want, got string) {
+	t.Helper()
+	wantResolved, err := filepath.EvalSymlinks(want)
+	require.NoError(t, err)
+	gotResolved, err := filepath.EvalSymlinks(got)
+	require.NoError(t, err)
+	assert.True(t, strings.EqualFold(wantResolved, gotResolved),
+		"paths differ: want %q, got %q", wantResolved, gotResolved)
+}
diff --git a/pkg/tools/builtin/shell/script_shell_test.go b/pkg/tools/builtin/shell/script_shell_test.go
index 69d8f0b8b..7c2d5dab4 100644
--- a/pkg/tools/builtin/shell/script_shell_test.go
+++ b/pkg/tools/builtin/shell/script_shell_test.go
@@ -3,7 +3,6 @@ package shell
 import (
 	"encoding/json"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -164,7 +163,7 @@ func TestNewScript_NumberArg(t *testing.T) {
 	shellTools := map[string]latest.ScriptShellToolConfig{
 		"repeat": {
 			Description: "Repeat a message N times",
-			Cmd:         "for i in $(seq 1 $count); do echo $message; done",
+			Cmd:         repeatMessageCmd(),
 			Args: map[string]any{
 				"message": map[string]any{
 					"description": "Message to repeat",
@@ -194,17 +193,19 @@ func TestNewScript_NumberArg(t *testing.T) {
 	}, tools.NopRuntime{})
 	require.NoError(t, err)
 	assert.False(t, result.IsError, "unexpected error: %s", result.Output)
-	assert.Equal(t, "hello\nhello\nhello\n", result.Output)
+	// PowerShell terminates lines with CRLF; normalize so the assertion
+	// checks the same three-line contract on every platform.
+	assert.Equal(t, "hello\nhello\nhello\n", strings.ReplaceAll(result.Output, "\r\n", "\n"))
 }
 
 func TestScriptShellTool_DropsUndeclaredArgs(t *testing.T) {
 	t.Parallel()
-	// `env` lists the spawned process's full environment. With base env
-	// set to an empty slice, the only entries should be those forwarded
+	// The command lists the spawned process's full environment. With base
+	// env set to an empty slice, the only entries should be those forwarded
 	// from declared args.
 	shellTools := map[string]latest.ScriptShellToolConfig{
 		"echo_name": {
-			Cmd: "env",
+			Cmd: envDumpCmd(),
 			Args: map[string]any{
 				"name": map[string]any{
 					"description": "who to greet",
@@ -242,7 +243,7 @@ func TestScriptShellTool_PerToolEnvAndWorkingDir(t *testing.T) {
 
 	shellTools := map[string]latest.ScriptShellToolConfig{
 		"show_env": {
-			Cmd: `printf '%s|%s|%s' "$TOOL_VALUE" "$TOOL_LITERAL" "$(pwd)"`,
+			Cmd: printEnvValuesAndPwdCmd("TOOL_VALUE", "TOOL_LITERAL"),
 			Env: map[string]string{
 				// Plain ${env.X} expands; $X stays literal (issue #2615).
 				"TOOL_VALUE":   "v-${env.SCRIPT_TEST_TOKEN}",
@@ -269,11 +270,7 @@ func TestScriptShellTool_PerToolEnvAndWorkingDir(t *testing.T) {
 	require.Len(t, parts, 3)
 	assert.Equal(t, "v-tok", parts[0])
 	assert.Equal(t, "pa$$word", parts[1])
-	got, err := filepath.EvalSymlinks(parts[2])
-	require.NoError(t, err)
-	want, err := filepath.EvalSymlinks(workDir)
-	require.NoError(t, err)
-	assert.Equal(t, want, got)
+	assertSamePath(t, workDir, strings.TrimSpace(parts[2]))
 }
 
 // TestCreateScriptToolSet_EnvPrecedence pins the effective env layering on
@@ -331,7 +328,7 @@ func TestScriptShellTool_PerToolEnvOverridesToolsetEnv(t *testing.T) {
 	t.Parallel()
 	shellTools := map[string]latest.ScriptShellToolConfig{
 		"show_env": {
-			Cmd: `printf '%s' "$SHARED"`,
+			Cmd: printEnvValueCmd("SHARED"),
 			Env: map[string]string{"SHARED": "per-tool"},
 		},
 	}
diff --git a/pkg/tools/builtin/shell/shell_test.go b/pkg/tools/builtin/shell/shell_test.go
index edda39801..666515ac1 100644
--- a/pkg/tools/builtin/shell/shell_test.go
+++ b/pkg/tools/builtin/shell/shell_test.go
@@ -7,6 +7,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 	"time"
 
@@ -23,14 +24,14 @@ func TestNew(t *testing.T) {
 
 	assert.NotNil(t, tool)
 	assert.NotNil(t, tool.handler)
-	assert.Equal(t, "/bin/bash", tool.handler.shell)
+	assertPlatformDefaultShell(t, tool.handler, "/bin/bash")
 
 	t.Setenv("SHELL", "")
 	tool = New(nil, &config.RuntimeConfig{Config: config.Config{WorkingDir: t.TempDir()}})
 
 	assert.NotNil(t, tool)
 	assert.NotNil(t, tool.handler)
-	assert.Equal(t, "/bin/sh", tool.handler.shell, "Should default to /bin/sh when SHELL is not set")
+	assertPlatformDefaultShell(t, tool.handler, "/bin/sh")
 }
 
 func TestShellTool_HandlerEcho(t *testing.T) {
@@ -51,13 +52,11 @@ func TestShellTool_HandlerWithCwd(t *testing.T) {
 	tmpDir := t.TempDir()
 
 	result, err := tool.handler.RunShell(t.Context(), RunShellArgs{
-		Cmd: "pwd",
+		Cmd: pwdCmd(),
 		Cwd: tmpDir,
 	}, tools.NopRuntime{})
 	require.NoError(t, err)
-	// The output might contain extra newlines or other characters,
-	// so we just check if it contains the temp dir path
-	assert.Contains(t, result.Output, tmpDir)
+	assertSamePath(t, tmpDir, strings.TrimSpace(result.Output))
 }
 
 func TestRunShellArgs_UnmarshalJSON_AcceptsCmdAndCommand(t *testing.T) {
@@ -207,7 +206,11 @@ func TestShellTool_Instructions(t *testing.T) {
 func TestResolveWorkDir(t *testing.T) {
 	t.Parallel()
 
-	workingDir := "/configured/project"
+	// resolveWorkDir is pure path manipulation; the directories need not
+	// exist. Deriving them from TempDir keeps the expectations portable
+	// (drive-letter absolutes on Windows, slash-rooted elsewhere).
+	workingDir := filepath.Join(t.TempDir(), "configured", "project")
+	other := filepath.Join(t.TempDir(), "other")
 	h := &shellHandler{workingDir: workingDir}
 
 	tests := []struct {
@@ -217,10 +220,10 @@ func TestResolveWorkDir(t *testing.T) {
 	}{
 		{name: "empty defaults to workingDir", cwd: "", expected: workingDir},
 		{name: "dot defaults to workingDir", cwd: ".", expected: workingDir},
-		{name: "absolute path unchanged", cwd: "/tmp/other", expected: "/tmp/other"},
-		{name: "relative path joined with workingDir", cwd: "src/pkg", expected: "/configured/project/src/pkg"},
-		{name: "relative with dot prefix", cwd: "./subdir", expected: "/configured/project/subdir"},
-		{name: "relative with parent traversal", cwd: "../sibling", expected: "/configured/sibling"},
+		{name: "absolute path unchanged", cwd: other, expected: other},
+		{name: "relative path joined with workingDir", cwd: "src/pkg", expected: filepath.Join(workingDir, "src", "pkg")},
+		{name: "relative with dot prefix", cwd: "./subdir", expected: filepath.Join(workingDir, "subdir")},
+		{name: "relative with parent traversal", cwd: "../sibling", expected: filepath.Join(filepath.Dir(workingDir), "sibling")},
 	}
 
 	for _, tt := range tests {
@@ -265,18 +268,19 @@ func TestShellTool_RelativeCwdResolvesAgainstWorkingDir(t *testing.T) {
 	t.Parallel()
 	// Create a directory structure: workingDir/subdir/
 	workingDir := t.TempDir()
-	subdir := workingDir + "/subdir"
+	subdir := filepath.Join(workingDir, "subdir")
 	require.NoError(t, os.Mkdir(subdir, 0o755))
 
 	tool := New(nil, &config.RuntimeConfig{Config: config.Config{WorkingDir: workingDir}})
 
 	result, err := tool.handler.RunShell(t.Context(), RunShellArgs{
-		Cmd: "pwd",
+		Cmd: pwdCmd(),
 		Cwd: "subdir",
 	}, tools.NopRuntime{})
 	require.NoError(t, err)
-	assert.Contains(t, result.Output, subdir,
-		"relative cwd must resolve against the configured workingDir, not the process cwd")
+	// The relative cwd must resolve against the configured workingDir,
+	// not the process cwd.
+	assertSamePath(t, subdir, strings.TrimSpace(result.Output))
 }
 
 // Regression test for a shell-tool hang caused by backgrounded grandchildren.

From 4d7c8ec64bb590bba038cdd9024d766d23fc87c4 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 13:36:22 +0200
Subject: [PATCH 07/18] fix(lsp): handle Windows file URIs

---
 pkg/tools/builtin/lsp/lsp.go      | 129 +++++++++++++++++++++++++++---
 pkg/tools/builtin/lsp/lsp_test.go | 112 ++++++++++++++++++++++++--
 2 files changed, 220 insertions(+), 21 deletions(-)

diff --git a/pkg/tools/builtin/lsp/lsp.go b/pkg/tools/builtin/lsp/lsp.go
index b08c21246..43b9e049d 100644
--- a/pkg/tools/builtin/lsp/lsp.go
+++ b/pkg/tools/builtin/lsp/lsp.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -731,7 +732,7 @@ func (h *lspHandler) ensureInitialized(ctx context.Context) error {
 // initializeLocked performs the LSP initialize/initialized handshake.
 // The caller must hold h.mu and the process must be running.
 func (h *lspHandler) initializeLocked() error {
-	rootURI := "file://" + h.workingDir
+	rootURI := pathToURI(h.workingDir)
 
 	result, err := h.sendRequestLocked("initialize", map[string]any{
 		"processId": os.Getpid(),
@@ -1353,7 +1354,10 @@ func (h *lspHandler) applyWorkspaceEdit(edit *lspWorkspaceEdit, newName string)
 
 	if len(edit.DocumentChanges) > 0 {
 		for _, docEdit := range edit.DocumentChanges {
-			filePath := strings.TrimPrefix(docEdit.TextDocument.URI, "file://")
+			filePath, err := uriToPath(docEdit.TextDocument.URI)
+			if err != nil {
+				return tools.ResultError(fmt.Sprintf("Failed to apply changes: %s", err))
+			}
 			if err := applyTextEditsToFile(filePath, docEdit.Edits); err != nil {
 				return tools.ResultError(fmt.Sprintf("Failed to apply changes to %s: %s", filePath, err))
 			}
@@ -1365,7 +1369,10 @@ func (h *lspHandler) applyWorkspaceEdit(edit *lspWorkspaceEdit, newName string)
 
 	if len(edit.Changes) > 0 {
 		for uri, edits := range edit.Changes {
-			filePath := strings.TrimPrefix(uri, "file://")
+			filePath, err := uriToPath(uri)
+			if err != nil {
+				return tools.ResultError(fmt.Sprintf("Failed to apply changes: %s", err))
+			}
 			if err := applyTextEditsToFile(filePath, edits); err != nil {
 				return tools.ResultError(fmt.Sprintf("Failed to apply changes to %s: %s", filePath, err))
 			}
@@ -1661,7 +1668,10 @@ func (h *lspHandler) openFileOnDemand(_ context.Context, uri string) error {
 		return nil
 	}
 
-	filePath := strings.TrimPrefix(uri, "file://")
+	filePath, err := uriToPath(uri)
+	if err != nil {
+		return err
+	}
 
 	if !h.handlesFile(filePath) {
 		return fmt.Errorf("LSP does not handle file type: %s", filepath.Ext(filePath))
@@ -1712,7 +1722,10 @@ func (h *lspHandler) NotifyFileChange(_ context.Context, uri string) error {
 // notifyFileChangeLocked re-reads a file from disk and sends a
 // textDocument/didChange notification. The caller must hold h.mu.
 func (h *lspHandler) notifyFileChangeLocked(uri string) error {
-	filePath := strings.TrimPrefix(uri, "file://")
+	filePath, err := uriToPath(uri)
+	if err != nil {
+		return err
+	}
 
 	content, err := os.ReadFile(filePath)
 	if err != nil {
@@ -1752,12 +1765,102 @@ func (h *lspHandler) waitForDiagnostics(ctx context.Context, timeout time.Durati
 	}
 }
 
+// pathToURI converts a filesystem path to a file URI (RFC 8089). The
+// path is made absolute, separators are normalized to slashes and
+// special characters are percent-encoded. Windows drive paths become
+// "file:///C:/..." and UNC paths \\host\share become "file://host/share".
 func pathToURI(path string) string {
-	absPath, err := filepath.Abs(path)
+	if absPath, err := filepath.Abs(path); err == nil {
+		path = absPath
+	}
+	path = filepath.ToSlash(path)
+
+	u := url.URL{Scheme: "file"}
+	switch {
+	case strings.HasPrefix(path, "//"):
+		// UNC path //host/share/...: the host is the URI authority.
+		host, rest, _ := strings.Cut(strings.TrimPrefix(path, "//"), "/")
+		u.Host = host
+		u.Path = "/" + rest
+	case !strings.HasPrefix(path, "/"):
+		// Windows drive path (C:/...): the URI path needs a leading slash.
+		u.Path = "/" + path
+	default:
+		u.Path = path
+	}
+	return u.String()
+}
+
+// uriToPath converts a file URI to a native filesystem path, decoding
+// percent escapes. It returns an error for malformed or non-file URIs
+// and must be used whenever the resulting path is accessed on disk.
+func uriToPath(uri string) (string, error) {
+	path, err := uriToSlashPath(uri)
+	if err != nil {
+		return "", err
+	}
+	return filepath.FromSlash(path), nil
+}
+
+// uriToDisplayPath renders a file URI as a path for human-readable
+// output. Best effort: slashes are kept as-is so formatting is stable
+// across platforms, and URIs that cannot be converted are returned
+// unchanged.
+func uriToDisplayPath(uri string) string {
+	path, err := uriToSlashPath(uri)
 	if err != nil {
-		return "file://" + path
+		return uri
 	}
-	return "file://" + absPath
+	return path
+}
+
+// uriToSlashPath converts a file URI to a slash-separated filesystem path.
+func uriToSlashPath(uri string) (string, error) {
+	u, err := url.Parse(uri)
+	if err != nil {
+		return "", fmt.Errorf("malformed file URI %q: %w", uri, err)
+	}
+	if !strings.EqualFold(u.Scheme, "file") {
+		return "", fmt.Errorf("not a file URI: %q", uri)
+	}
+
+	path := u.Path
+	switch {
+	case u.Host != "" && !strings.EqualFold(u.Host, "localhost"):
+		if isWindowsDrive(u.Host) {
+			// Non-standard file://C:/... form: the drive letter was
+			// parsed as the URI authority.
+			path = u.Host + path
+		} else {
+			// UNC share: reattach the authority as the host part of the
+			// path, yielding \\host\share once separators are converted.
+			path = "//" + u.Host + path
+		}
+	case isWindowsDriveURIPath(path):
+		// Standard file:///C:/... form: drop the leading slash.
+		path = path[1:]
+	}
+	if path == "" {
+		return "", fmt.Errorf("file URI %q has no path", uri)
+	}
+	return path, nil
+}
+
+// isWindowsDriveURIPath reports whether a URI path carries a Windows
+// drive letter, e.g. "/C:/Users". net/url does not special-case Windows
+// paths (golang.org/issue/6027), so the leading slash must be stripped
+// by hand.
+func isWindowsDriveURIPath(path string) bool {
+	return len(path) >= 3 && path[0] == '/' && isASCIILetter(path[1]) && path[2] == ':'
+}
+
+// isWindowsDrive reports whether s is a bare Windows drive such as "C:".
+func isWindowsDrive(s string) bool {
+	return len(s) == 2 && isASCIILetter(s[0]) && s[1] == ':'
+}
+
+func isASCIILetter(c byte) bool {
+	return ('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z')
 }
 
 func detectLanguageID(path string) string {
@@ -1901,7 +2004,7 @@ func formatLocations(data json.RawMessage) string {
 
 func formatLocation(loc lspLocation) string {
 	return fmt.Sprintf("- %s:%d:%d",
-		strings.TrimPrefix(loc.URI, "file://"),
+		uriToDisplayPath(loc.URI),
 		loc.Range.Start.Line+1,
 		loc.Range.Start.Character+1)
 }
@@ -1921,7 +2024,7 @@ func formatSymbols(data json.RawMessage) string {
 		var lines []string
 		for _, s := range symbols {
 			kind := symbolKindName(s.Kind)
-			loc := strings.TrimPrefix(s.Location.URI, "file://")
+			loc := uriToDisplayPath(s.Location.URI)
 			line := fmt.Sprintf("- %s %s (%s:%d)", kind, s.Name, loc, s.Location.Range.Start.Line+1)
 			if s.ContainerName != "" {
 				line += fmt.Sprintf(" [in %s]", s.ContainerName)
@@ -2002,7 +2105,7 @@ func formatIncomingCalls(targetName string, data json.RawMessage) string {
 	var lines []string
 	lines = append(lines, fmt.Sprintf("Incoming calls to '%s':", targetName))
 	for _, call := range calls {
-		filePath := strings.TrimPrefix(call.From.URI, "file://")
+		filePath := uriToDisplayPath(call.From.URI)
 		line := call.From.Range.Start.Line + 1
 		detail := ""
 		if call.From.Detail != "" {
@@ -2033,7 +2136,7 @@ func formatOutgoingCalls(sourceName string, data json.RawMessage) string {
 	var lines []string
 	lines = append(lines, fmt.Sprintf("Outgoing calls from '%s':", sourceName))
 	for _, call := range calls {
-		filePath := strings.TrimPrefix(call.To.URI, "file://")
+		filePath := uriToDisplayPath(call.To.URI)
 		line := call.To.Range.Start.Line + 1
 		detail := ""
 		if call.To.Detail != "" {
@@ -2058,7 +2161,7 @@ func formatTypeHierarchy(typeName, direction string, data json.RawMessage) strin
 	var lines []string
 	lines = append(lines, fmt.Sprintf("%s of '%s':", direction, typeName))
 	for _, item := range items {
-		filePath := strings.TrimPrefix(item.URI, "file://")
+		filePath := uriToDisplayPath(item.URI)
 		line := item.Range.Start.Line + 1
 		detail := ""
 		if item.Detail != "" {
diff --git a/pkg/tools/builtin/lsp/lsp_test.go b/pkg/tools/builtin/lsp/lsp_test.go
index 8b1607d71..427e7d225 100644
--- a/pkg/tools/builtin/lsp/lsp_test.go
+++ b/pkg/tools/builtin/lsp/lsp_test.go
@@ -2,7 +2,10 @@ package lsp
 
 import (
 	"encoding/json"
+	"net/url"
 	"os/exec"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -279,10 +282,11 @@ func TestLSPHandler_GetDiagnostics_NoDiagnostics(t *testing.T) {
 
 	ctx := t.Context()
 
+	testFile := filepath.Join(t.TempDir(), "nonexistent.go")
 	// Mark file as open to skip auto-open attempt
-	tool.handler.openFiles["file:///nonexistent.go"] = 1
+	tool.handler.openFiles[pathToURI(testFile)] = 1
 
-	result, err := tool.handler.getDiagnostics(ctx, FileArgs{File: "/nonexistent.go"})
+	result, err := tool.handler.getDiagnostics(ctx, FileArgs{File: testFile})
 	require.NoError(t, err)
 	assert.False(t, result.IsError)
 	assert.Contains(t, result.Output, "No diagnostics")
@@ -297,8 +301,11 @@ func TestLSPHandler_GetDiagnostics_WithDiagnostics(t *testing.T) {
 	// Pretend we have a running server
 	tool.handler.cmd = exec.CommandContext(t.Context(), "true")
 
+	testFile := filepath.Join(t.TempDir(), "test.go")
+	uri := pathToURI(testFile)
+
 	// Manually set some diagnostics
-	tool.handler.diagnostics["file:///test.go"] = []lspDiagnostic{
+	tool.handler.diagnostics[uri] = []lspDiagnostic{
 		{
 			Range:    lspRange{Start: lspPosition{Line: 5, Character: 0}},
 			Severity: 1,
@@ -306,10 +313,10 @@ func TestLSPHandler_GetDiagnostics_WithDiagnostics(t *testing.T) {
 		},
 	}
 	// Mark file as open to skip auto-open attempt
-	tool.handler.openFiles["file:///test.go"] = 1
+	tool.handler.openFiles[uri] = 1
 
 	ctx := t.Context()
-	result, err := tool.handler.getDiagnostics(ctx, FileArgs{File: "/test.go"})
+	result, err := tool.handler.getDiagnostics(ctx, FileArgs{File: testFile})
 	require.NoError(t, err)
 	assert.False(t, result.IsError)
 	assert.Contains(t, result.Output, "test error")
@@ -434,9 +441,98 @@ func TestLSPTool_HandlesFile(t *testing.T) {
 func TestPathToURI(t *testing.T) {
 	t.Parallel()
 
-	// Absolute path
-	uri := pathToURI("/home/user/project/main.go")
-	assert.Equal(t, "file:///home/user/project/main.go", uri)
+	path := filepath.Join(t.TempDir(), "project", "main.go")
+
+	uri := pathToURI(path)
+
+	assert.True(t, strings.HasPrefix(uri, "file:///"), "expected file:/// prefix, got %q", uri)
+	assert.NotContains(t, uri, `\`, "URI must not contain backslashes")
+
+	parsed, err := url.Parse(uri)
+	require.NoError(t, err, "pathToURI must produce a parseable URI")
+	assert.Equal(t, "file", parsed.Scheme)
+}
+
+func TestPathToURI_RoundTrip(t *testing.T) {
+	t.Parallel()
+
+	base := t.TempDir()
+	paths := []string{
+		filepath.Join(base, "main.go"),
+		filepath.Join(base, "dir with spaces", "my file.go"),
+		filepath.Join(base, "issue#42", "a#b.go"),
+	}
+
+	for _, path := range paths {
+		uri := pathToURI(path)
+
+		assert.NotContains(t, uri, " ", "spaces must be percent-encoded in %q", uri)
+		assert.NotContains(t, uri, "#", "'#' must be percent-encoded in %q", uri)
+
+		got, err := uriToPath(uri)
+		require.NoError(t, err)
+		assert.Equal(t, path, got)
+	}
+}
+
+func TestURIToPath(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		uri  string
+		want string // slash form, converted per-platform with filepath.FromSlash
+	}{
+		{"unix path", "file:///home/user/main.go", "/home/user/main.go"},
+		{"windows drive", "file:///C:/Users/dev/main.go", "C:/Users/dev/main.go"},
+		{"windows drive as authority", "file://C:/Users/dev/main.go", "C:/Users/dev/main.go"},
+		{"percent encoding", "file:///home/user/my%20file%23v2.go", "/home/user/my file#v2.go"},
+		{"unc path", "file://server/share/main.go", "//server/share/main.go"},
+		{"localhost authority", "file://localhost/etc/hosts", "/etc/hosts"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := uriToPath(tt.uri)
+			require.NoError(t, err)
+			assert.Equal(t, filepath.FromSlash(tt.want), got)
+		})
+	}
+}
+
+func TestURIToPath_Errors(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		uri  string
+	}{
+		{"non-file scheme", "https://example.com/main.go"},
+		{"plain path", "/home/user/main.go"},
+		{"empty", ""},
+		{"no path", "file:"},
+		{"legacy backslash form", `file://C:\Users\dev\main.go`},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := uriToPath(tt.uri)
+			assert.Error(t, err)
+		})
+	}
+}
+
+func TestURIToDisplayPath(t *testing.T) {
+	t.Parallel()
+
+	// Valid file URIs are decoded, keeping slash separators for stable output.
+	assert.Equal(t, "/home/user/my file.go", uriToDisplayPath("file:///home/user/my%20file.go"))
+	assert.Equal(t, "C:/Users/dev/main.go", uriToDisplayPath("file:///C:/Users/dev/main.go"))
+
+	// Anything that cannot be converted is shown as-is.
+	assert.Equal(t, "untitled:Untitled-1", uriToDisplayPath("untitled:Untitled-1"))
 }
 
 func TestLSPHandler_IsFileOpen(t *testing.T) {

From 24fa4d7b91eada71cf67245a0a9ca16c7d00e07f Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 14:03:19 +0200
Subject: [PATCH 08/18] fix: close Windows test resources

---
 e2e/a2a_test.go                               | 19 ++++++-
 e2e/api_test.go                               | 29 +++++++---
 pkg/a2a/server.go                             | 12 ++++
 pkg/a2a/server_test.go                        | 55 +++++++++++++++++++
 .../filesystem/filesystem_paths_test.go       | 46 ++++++++++------
 pkg/tui/session_load_click_test.go            |  4 ++
 6 files changed, 138 insertions(+), 27 deletions(-)

diff --git a/e2e/a2a_test.go b/e2e/a2a_test.go
index b2bbbfaf4..a79bea586 100644
--- a/e2e/a2a_test.go
+++ b/e2e/a2a_test.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/a2aproject/a2a-go/a2a"
 	"github.com/a2aproject/a2a-go/a2asrv"
@@ -173,9 +174,25 @@ func startA2AServer(t *testing.T, agentFile string, runConfig *config.RuntimeCon
 	ln, err := lc.Listen(t.Context(), "tcp", ":0")
 	require.NoError(t, err)
 
+	sessionDB := filepath.Join(t.TempDir(), "session.db")
+
+	done := make(chan struct{})
 	go func() {
-		_ = a2aserver.Run(t.Context(), agentFile, "root", filepath.Join(t.TempDir(), "session.db"), runConfig, ln)
+		defer close(done)
+		_ = a2aserver.Run(t.Context(), agentFile, "root", sessionDB, runConfig, ln)
 	}()
+	// Run stops when t.Context() is canceled (just before cleanups run);
+	// closing the listener also covers the window before Serve starts. Wait
+	// for Run to return so session.db is closed before t.TempDir cleanup
+	// removes it — Windows refuses to delete open files.
+	t.Cleanup(func() {
+		_ = ln.Close()
+		select {
+		case <-done:
+		case <-time.After(30 * time.Second):
+			t.Fatal("A2A server did not stop during cleanup")
+		}
+	})
 
 	port := ln.Addr().(*net.TCPAddr).Port
 	serverURL := fmt.Sprintf("http://localhost:%d", port)
diff --git a/e2e/api_test.go b/e2e/api_test.go
index 317cab410..190cc8697 100644
--- a/e2e/api_test.go
+++ b/e2e/api_test.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -39,13 +40,13 @@ func TestCagentAPI_ListSessions(t *testing.T) {
 		t.Run(tc.db, func(t *testing.T) {
 			socketPath := startCagentAPI(t, filepath.Join("testdata", "db", tc.db))
 
-			client := &http.Client{
-				Transport: &http.Transport{
-					DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
-						return (&net.Dialer{}).DialContext(ctx, "unix", socketPath)
-					},
+			transport := &http.Transport{
+				DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
+					return (&net.Dialer{}).DialContext(ctx, "unix", socketPath)
 				},
 			}
+			client := &http.Client{Transport: transport}
+			t.Cleanup(transport.CloseIdleConnections)
 
 			req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "http://localhost/api/sessions", http.NoBody)
 			require.NoError(t, err)
@@ -81,19 +82,31 @@ func startCagentAPI(t *testing.T, db string) string {
 
 	ln, err := server.Listen(t.Context(), "unix://cagent.sock")
 	require.NoError(t, err)
-	t.Cleanup(func() {
-		_ = ln.Close()
-	})
 
 	sessionStore, err := sqlitestore.New(t.Context(), dbCopy)
 	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = sessionStore.Close()
+	})
 
 	srv, err := server.New(t.Context(), sessionStore, &config.RuntimeConfig{}, 0, nil, "")
 	require.NoError(t, err)
 
+	done := make(chan struct{})
 	go func() {
+		defer close(done)
 		_ = srv.Serve(t.Context(), ln)
 	}()
+	// Stop the server and wait for it before the store is closed and the
+	// temp dir removed — Windows refuses to delete files with open handles.
+	t.Cleanup(func() {
+		_ = ln.Close()
+		select {
+		case <-done:
+		case <-time.After(30 * time.Second):
+			t.Fatal("API server did not stop during cleanup")
+		}
+	})
 
 	return "cagent.sock"
 }
diff --git a/pkg/a2a/server.go b/pkg/a2a/server.go
index f2269e700..44c3f86ce 100644
--- a/pkg/a2a/server.go
+++ b/pkg/a2a/server.go
@@ -66,6 +66,11 @@ func Run(ctx context.Context, agentFilename, agentName, sessionDB string, runCon
 	if err != nil {
 		return fmt.Errorf("failed to open session store: %w", err)
 	}
+	defer func() {
+		if err := sessStore.Close(); err != nil {
+			slog.ErrorContext(ctx, "Failed to close session store", "error", err)
+		}
+	}()
 
 	adkAgent, err := newDockerAgentAdapter(t, agentName, sessStore)
 	if err != nil {
@@ -138,6 +143,13 @@ func Run(ctx context.Context, agentFilename, agentName, sessionDB string, runCon
 	e.GET(a2asrv.WellKnownAgentCardPath, echo.WrapHandler(cardHandler))
 	e.POST(agentPath, echo.WrapHandler(jsonrpcHandler))
 
+	// Stop serving when ctx is canceled so Run returns and the deferred
+	// cleanups (session store, tool sets) release their resources.
+	stop := context.AfterFunc(ctx, func() {
+		_ = e.Server.Close()
+	})
+	defer stop()
+
 	if err := e.Server.Serve(ln); err != nil && ctx.Err() == nil {
 		slog.ErrorContext(ctx, "Failed to start server", "error", err)
 		return err
diff --git a/pkg/a2a/server_test.go b/pkg/a2a/server_test.go
index d334d9bc0..eb2cd02e0 100644
--- a/pkg/a2a/server_test.go
+++ b/pkg/a2a/server_test.go
@@ -1,9 +1,18 @@
 package a2a
 
 import (
+	"context"
+	"net"
+	"net/http"
+	"path/filepath"
 	"testing"
+	"time"
 
+	"github.com/a2aproject/a2a-go/a2asrv"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/docker/docker-agent/pkg/config"
 )
 
 func TestRoutableAddr(t *testing.T) {
@@ -31,3 +40,49 @@ func TestRoutableAddr(t *testing.T) {
 		})
 	}
 }
+
+// TestRun_StopsOnContextCancel: canceling the context must make Run stop
+// serving and return, releasing the session store's file handles (otherwise
+// t.TempDir cleanup fails on Windows with an open session.db).
+func TestRun_StopsOnContextCancel(t *testing.T) {
+	t.Setenv("OPENAI_API_KEY", "DUMMY")
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	var lc net.ListenConfig
+	ln, err := lc.Listen(ctx, "tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	sessionDB := filepath.Join(t.TempDir(), "session.db")
+
+	done := make(chan error, 1)
+	go func() {
+		done <- Run(ctx, "testdata/basic.yaml", "root", sessionDB, &config.RuntimeConfig{}, ln)
+	}()
+
+	// Cancel only once the server actually serves, so the test exercises a
+	// mid-serve shutdown rather than a pre-start one.
+	cardURL := "http://" + ln.Addr().String() + a2asrv.WellKnownAgentCardPath
+	require.Eventually(t, func() bool {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, cardURL, http.NoBody)
+		if err != nil {
+			return false
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return false
+		}
+		defer resp.Body.Close()
+		return resp.StatusCode == http.StatusOK
+	}, 30*time.Second, 20*time.Millisecond, "A2A server never started serving")
+
+	cancel()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err, "Run must return nil on context cancellation")
+	case <-time.After(30 * time.Second):
+		t.Fatal("Run did not return after context cancellation")
+	}
+}
diff --git a/pkg/tools/builtin/filesystem/filesystem_paths_test.go b/pkg/tools/builtin/filesystem/filesystem_paths_test.go
index c7d5dbe43..64bedd363 100644
--- a/pkg/tools/builtin/filesystem/filesystem_paths_test.go
+++ b/pkg/tools/builtin/filesystem/filesystem_paths_test.go
@@ -18,6 +18,16 @@ func resetHomeDir(t *testing.T, dir string) {
 	t.Setenv("USERPROFILE", dir)
 }
 
+// newTestToolSet builds a ToolSet and releases it when the test ends. Allow-
+// and deny-lists hold *os.Root directory handles; leaving them open would
+// make t.TempDir cleanup fail on Windows.
+func newTestToolSet(t *testing.T, workingDir string, opts ...Opt) *ToolSet {
+	t.Helper()
+	tool := New(workingDir, opts...)
+	t.Cleanup(func() { _ = tool.Close() })
+	return tool
+}
+
 func TestFilesystemTool_DefaultIsUnrestricted(t *testing.T) {
 	t.Parallel()
 	tmpDir := t.TempDir()
@@ -38,7 +48,7 @@ func TestFilesystemTool_DefaultIsUnrestricted(t *testing.T) {
 func TestFilesystemTool_AllowList_DotMeansWorkingDir(t *testing.T) {
 	t.Parallel()
 	tmpDir := t.TempDir()
-	tool := New(tmpDir, WithAllowList([]string{"."}))
+	tool := newTestToolSet(t, tmpDir, WithAllowList([]string{"."}))
 
 	// Inside working dir is fine.
 	_, err := tool.resolveAndCheckPath("file.txt")
@@ -62,7 +72,7 @@ func TestFilesystemTool_AllowList_TildeMeansHome(t *testing.T) {
 	resetHomeDir(t, homeDir)
 	wd := t.TempDir()
 
-	tool := New(wd, WithAllowList([]string{"~"}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{"~"}))
 
 	// A path under $HOME is allowed via ~/...
 	resolved, err := tool.resolveAndCheckPath(filepath.Join(homeDir, "doc.md"))
@@ -81,7 +91,7 @@ func TestFilesystemTool_AllowList_TildeSubdirectory(t *testing.T) {
 	require.NoError(t, os.MkdirAll(filepath.Join(homeDir, "projects"), 0o755))
 	wd := t.TempDir()
 
-	tool := New(wd, WithAllowList([]string{"~/projects"}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{"~/projects"}))
 
 	// Inside the listed subdir.
 	_, err := tool.resolveAndCheckPath(filepath.Join(homeDir, "projects", "app", "main.go"))
@@ -101,7 +111,7 @@ func TestFilesystemTool_AllowList_MultipleRoots(t *testing.T) {
 	wd := t.TempDir()
 	otherDir := t.TempDir()
 
-	tool := New(wd, WithAllowList([]string{".", otherDir}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{".", otherDir}))
 
 	_, err := tool.resolveAndCheckPath("file.txt")
 	require.NoError(t, err)
@@ -118,7 +128,7 @@ func TestFilesystemTool_AllowList_AbsolutePath(t *testing.T) {
 	wd := t.TempDir()
 	allowed := t.TempDir()
 
-	tool := New(wd, WithAllowList([]string{allowed}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{allowed}))
 
 	// Absolute path inside the allowed root is fine.
 	_, err := tool.resolveAndCheckPath(filepath.Join(allowed, "x", "y.txt"))
@@ -135,7 +145,7 @@ func TestFilesystemTool_DenyList_RejectsMatchingPaths(t *testing.T) {
 	denied := filepath.Join(wd, "secret")
 	require.NoError(t, os.Mkdir(denied, 0o755))
 
-	tool := New(wd, WithDenyList([]string{"secret"}))
+	tool := newTestToolSet(t, wd, WithDenyList([]string{"secret"}))
 
 	// Anything under the denied subtree is rejected.
 	_, err := tool.resolveAndCheckPath("secret/key.pem")
@@ -158,7 +168,7 @@ func TestFilesystemTool_DenyList_TakesPrecedenceOverAllowList(t *testing.T) {
 	require.NoError(t, os.MkdirAll(filepath.Join(wd, "src"), 0o755))
 	require.NoError(t, os.MkdirAll(filepath.Join(wd, "src", "vendor"), 0o755))
 
-	tool := New(wd,
+	tool := newTestToolSet(t, wd,
 		WithAllowList([]string{"."}),
 		WithDenyList([]string{"src/vendor"}))
 
@@ -182,7 +192,7 @@ func TestFilesystemTool_AllowList_SymlinkEscapeRejected(t *testing.T) {
 	link := filepath.Join(wd, "escape")
 	require.NoError(t, os.Symlink(target, link))
 
-	tool := New(wd, WithAllowList([]string{"."}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{"."}))
 
 	// Following the symlink escapes the allow-list and must be rejected.
 	_, err := tool.resolveAndCheckPath("escape/secret.txt")
@@ -201,7 +211,7 @@ func TestFilesystemTool_DenyList_SymlinkIntoDeniedAreaRejected(t *testing.T) {
 	link := filepath.Join(wd, "shortcut")
 	require.NoError(t, os.Symlink(denied, link))
 
-	tool := New(wd, WithDenyList([]string{"secret"}))
+	tool := newTestToolSet(t, wd, WithDenyList([]string{"secret"}))
 
 	// Reading via the symlink must still trigger the deny-list.
 	_, err := tool.resolveAndCheckPath("shortcut/key.pem")
@@ -212,7 +222,7 @@ func TestFilesystemTool_DenyList_SymlinkIntoDeniedAreaRejected(t *testing.T) {
 func TestFilesystemTool_AllowList_NewFilePath(t *testing.T) {
 	t.Parallel()
 	wd := t.TempDir()
-	tool := New(wd, WithAllowList([]string{"."}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{"."}))
 
 	// A path that doesn't exist yet (e.g. about to be created by write_file)
 	// must still be accepted when its lexical location is inside the allow-list.
@@ -231,7 +241,7 @@ func TestFilesystemTool_AllowList_EmptyDisablesCheck(t *testing.T) {
 
 	// nil and empty slice both leave the allow-list disabled.
 	for _, roots := range [][]string{nil, {}} {
-		tool := New(tmpDir, WithAllowList(roots))
+		tool := newTestToolSet(t, tmpDir, WithAllowList(roots))
 		_, err := tool.resolveAndCheckPath("/etc/hosts")
 		require.NoError(t, err, "empty/nil allow-list must not constrain")
 	}
@@ -246,7 +256,7 @@ func TestFilesystemTool_HandlersUseAllowList(t *testing.T) {
 	outsideFile := filepath.Join(other, "outside.txt")
 	require.NoError(t, os.WriteFile(outsideFile, []byte("nope"), 0o644))
 
-	tool := New(wd, WithAllowList([]string{"."}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{"."}))
 
 	// read_file: must refuse the outside path.
 	res, err := tool.handleReadFile(t.Context(), ReadFileArgs{Path: outsideFile})
@@ -315,7 +325,7 @@ func TestFilesystemTool_HandlersUseDenyList(t *testing.T) {
 	require.NoError(t, os.Mkdir(filepath.Join(wd, "secrets"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(wd, "secrets", "key.pem"), []byte("k"), 0o644))
 
-	tool := New(wd, WithDenyList([]string{"secrets"}))
+	tool := newTestToolSet(t, wd, WithDenyList([]string{"secrets"}))
 
 	// edit_file: must refuse to read the file in a denied directory.
 	res, err := tool.handleEditFile(t.Context(), EditFileArgs{
@@ -341,13 +351,13 @@ func TestFilesystemTool_Instructions_MentionsRestrictions(t *testing.T) {
 	assert.NotContains(t, plain, "must not access")
 
 	// With an allow-list: instructions mention the restriction.
-	allowed := New(wd, WithAllowList([]string{".", "~"})).Instructions()
+	allowed := newTestToolSet(t, wd, WithAllowList([]string{".", "~"})).Instructions()
 	assert.Contains(t, allowed, "restricted")
 	assert.Contains(t, allowed, ".")
 	assert.Contains(t, allowed, "~")
 
 	// With a deny-list: instructions mention the deny entries.
-	denied := New(wd, WithDenyList([]string{"~/.ssh"})).Instructions()
+	denied := newTestToolSet(t, wd, WithDenyList([]string{"~/.ssh"})).Instructions()
 	assert.Contains(t, denied, "must not access")
 	assert.Contains(t, denied, "~/.ssh")
 }
@@ -406,7 +416,7 @@ func TestWithAllowList_RejectsUndefinedEnvVar(t *testing.T) {
 	// fail-closed: reject all operations when list construction fails.
 	os.Unsetenv("DEFINITELY_NOT_SET")
 	wd := t.TempDir()
-	tool := New(wd, WithAllowList([]string{"$DEFINITELY_NOT_SET"}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{"$DEFINITELY_NOT_SET"}))
 
 	// The allow-list construction failed, so the toolset is disabled
 	// (fail-closed). All operations must be rejected.
@@ -425,7 +435,7 @@ func TestWithAllowList_AcceptsDefinedEnvVar(t *testing.T) {
 	allowed := t.TempDir()
 	t.Setenv("ALLOWED_DIR", allowed)
 
-	tool := New(wd, WithAllowList([]string{"$ALLOWED_DIR"}))
+	tool := newTestToolSet(t, wd, WithAllowList([]string{"$ALLOWED_DIR"}))
 
 	// Inside the env-var-resolved root.
 	_, err := tool.resolveAndCheckPath(filepath.Join(allowed, "file.txt"))
@@ -444,7 +454,7 @@ func TestDenyList_NonExistentPath(t *testing.T) {
 	resetHomeDir(t, homeDir)
 	wd := t.TempDir()
 
-	tool := New(wd, WithDenyList([]string{"~/.ssh"}))
+	tool := newTestToolSet(t, wd, WithDenyList([]string{"~/.ssh"}))
 
 	// ~/.ssh does not exist yet — a write to a path inside it must be
 	// rejected before the directory is even created.
diff --git a/pkg/tui/session_load_click_test.go b/pkg/tui/session_load_click_test.go
index 875333c10..9f290428d 100644
--- a/pkg/tui/session_load_click_test.go
+++ b/pkg/tui/session_load_click_test.go
@@ -99,6 +99,10 @@ func testLoadSessionThenClickEditLabel(t *testing.T, newTab bool, width int) {
 
 	model := New(ctx, spawner, application, dir, func() {})
 	m := model.(*appModel)
+	// New opened the tui_state.db SQLite store under dir/data; release it
+	// through the model's shutdown path so t.TempDir cleanup can delete the
+	// file on Windows.
+	t.Cleanup(m.cleanupManagedResources)
 
 	var cmd tea.Cmd
 	var mm tea.Model = m

From 3003eb157926e8bbd1938632a0c76b34fdaeaefb Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 14:38:00 +0200
Subject: [PATCH 09/18] fix: cover Windows platform behavior

---
 pkg/httpclient/ssrf_test.go                   |  36 ++--
 .../builtin/filesystem/agentsignore_test.go   |   6 +-
 .../builtin/filesystem/filesystem_test.go     |   2 +-
 .../builtin/filesystem/helpers_other_test.go  |  34 ++++
 .../filesystem/helpers_windows_test.go        |  38 +++++
 pkg/tui/components/editor/paste.go            |  63 ++++++-
 pkg/tui/components/editor/paste_test.go       | 159 ++++++++++++++++--
 pkg/tui/image/image.go                        |  16 +-
 pkg/tui/image/image_test.go                   |  47 +++++-
 9 files changed, 359 insertions(+), 42 deletions(-)
 create mode 100644 pkg/tools/builtin/filesystem/helpers_other_test.go
 create mode 100644 pkg/tools/builtin/filesystem/helpers_windows_test.go

diff --git a/pkg/httpclient/ssrf_test.go b/pkg/httpclient/ssrf_test.go
index 5cad4a398..f8331ef6c 100644
--- a/pkg/httpclient/ssrf_test.go
+++ b/pkg/httpclient/ssrf_test.go
@@ -219,11 +219,11 @@ func TestLocalhostOnlyRedirects(t *testing.T) {
 }
 
 func TestNewSSRFSafeTransport_RefusesPrivateIP(t *testing.T) {
-	t.Parallel()
-
-	// Drive the SSRF check end-to-end through an http.Client. We don't
-	// need a server: the dial-time hook fires before any TCP handshake.
-	client := &http.Client{Transport: NewSSRFSafeTransport()}
+	// ProxyFromEnvironment is process-cached, so force direct dialing: this
+	// test exercises the SSRF guard rather than ambient developer proxy state.
+	transport := NewSSRFSafeTransport()
+	transport.Proxy = nil
+	client := &http.Client{Transport: transport}
 
 	tests := []string{
 		"http://127.0.0.1/",
@@ -329,13 +329,16 @@ func TestProxyHostPort(t *testing.T) {
 // that can never resolve — must land in the allowlist verbatim, proving
 // the allowlist is built without DNS. Matching happens pre-resolution at
 // dial time instead.
+func clearProxyEnv(t *testing.T) {
+	t.Helper()
+	for _, name := range []string{"HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "all_proxy", "no_proxy"} {
+		t.Setenv(name, "")
+	}
+}
+
 func TestProxyDialAllowlist_NoDNSAtConstruction(t *testing.T) {
+	clearProxyEnv(t)
 	t.Setenv("HTTP_PROXY", "http://proxy.invalid:3128")
-	t.Setenv("HTTPS_PROXY", "")
-	t.Setenv("ALL_PROXY", "")
-	t.Setenv("http_proxy", "")
-	t.Setenv("https_proxy", "")
-	t.Setenv("all_proxy", "")
 
 	assert.Contains(t, proxyDialAllowlist(), "proxy.invalid:3128")
 }
@@ -358,10 +361,8 @@ func TestNewSSRFSafeTransport_AllowsConfiguredProxy(t *testing.T) {
 	addr := ln.Addr().String()
 	require.NoError(t, ln.Close())
 
+	clearProxyEnv(t)
 	t.Setenv("HTTP_PROXY", "http://"+addr)
-	t.Setenv("HTTPS_PROXY", "")
-	t.Setenv("http_proxy", "")
-	t.Setenv("https_proxy", "")
 
 	// Override the transport's Proxy directly so the test does not
 	// depend on http.ProxyFromEnvironment's sync.Once-cached env
@@ -445,12 +446,11 @@ func TestNewSSRFSafeTransport_WrappedDefaultTransport(t *testing.T) {
 // dial. Changing the env after construction has no effect — acceptable
 // because proxy env vars are set at process start.
 func TestNewSSRFSafeTransport_AllowlistFrozenAtConstruction(t *testing.T) {
-	t.Setenv("HTTP_PROXY", "")
-	t.Setenv("HTTPS_PROXY", "")
-	t.Setenv("http_proxy", "")
-	t.Setenv("https_proxy", "")
+	clearProxyEnv(t)
 
-	client := &http.Client{Transport: NewSSRFSafeTransport()}
+	transport := NewSSRFSafeTransport()
+	transport.Proxy = nil
+	client := &http.Client{Transport: transport}
 
 	t.Setenv("HTTP_PROXY", "http://10.0.0.1:3128")
 
diff --git a/pkg/tools/builtin/filesystem/agentsignore_test.go b/pkg/tools/builtin/filesystem/agentsignore_test.go
index e2dd2cc70..54df72db8 100644
--- a/pkg/tools/builtin/filesystem/agentsignore_test.go
+++ b/pkg/tools/builtin/filesystem/agentsignore_test.go
@@ -135,14 +135,10 @@ func TestAgentsIgnoreNegationReIncludes(t *testing.T) {
 }
 
 func TestAgentsIgnoreUnreadableFileIsAnError(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root bypasses file permissions")
-	}
 	dir := t.TempDir()
 	path := filepath.Join(dir, fsx.AgentsIgnoreFile)
 	require.NoError(t, os.WriteFile(path, []byte("secrets.env\n"), 0o644))
-	require.NoError(t, os.Chmod(path, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(path, 0o644) })
+	makeUnreadable(t, path)
 
 	_, err := CreateToolSet(latest.Toolset{Type: "filesystem"}, &config.RuntimeConfig{
 		Config: config.Config{WorkingDir: dir},
diff --git a/pkg/tools/builtin/filesystem/filesystem_test.go b/pkg/tools/builtin/filesystem/filesystem_test.go
index 9add4a556..fdb66d8b1 100644
--- a/pkg/tools/builtin/filesystem/filesystem_test.go
+++ b/pkg/tools/builtin/filesystem/filesystem_test.go
@@ -627,7 +627,7 @@ func main() {
 	postEditConfigs := []PostEditConfig{
 		{
 			Path: "*.go",
-			Cmd:  "touch $file.formatted",
+			Cmd:  postEditMarkerCmd(),
 		},
 	}
 	tool := New(tmpDir, WithPostEditCommands(postEditConfigs))
diff --git a/pkg/tools/builtin/filesystem/helpers_other_test.go b/pkg/tools/builtin/filesystem/helpers_other_test.go
new file mode 100644
index 000000000..de0a970e4
--- /dev/null
+++ b/pkg/tools/builtin/filesystem/helpers_other_test.go
@@ -0,0 +1,34 @@
+//go:build !windows
+
+package filesystem
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Post-edit commands run under $SHELL (or /bin/sh) on non-Windows
+// platforms (shellpath.DetectShell). These helpers are mirrored for
+// PowerShell in helpers_windows_test.go so the tests validate the same
+// contracts on every platform.
+
+// postEditMarkerCmd returns a command creating an empty "<path>.formatted"
+// marker file, where <path> arrives in the "file" environment variable
+// injected by runPostEditCommands.
+func postEditMarkerCmd() string {
+	return `touch "$file.formatted"`
+}
+
+// makeUnreadable revokes read access to path for the rest of the test.
+// POSIX modes express this directly; root is skipped because it bypasses
+// file permissions.
+func makeUnreadable(t *testing.T, path string) {
+	t.Helper()
+	if os.Geteuid() == 0 {
+		t.Skip("root bypasses file permissions")
+	}
+	require.NoError(t, os.Chmod(path, 0o000))
+	t.Cleanup(func() { _ = os.Chmod(path, 0o644) })
+}
diff --git a/pkg/tools/builtin/filesystem/helpers_windows_test.go b/pkg/tools/builtin/filesystem/helpers_windows_test.go
new file mode 100644
index 000000000..100b1d879
--- /dev/null
+++ b/pkg/tools/builtin/filesystem/helpers_windows_test.go
@@ -0,0 +1,38 @@
+//go:build windows
+
+package filesystem
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// Post-edit commands run under PowerShell on Windows
+// (shellpath.DetectShell). These helpers mirror the POSIX equivalents in
+// helpers_other_test.go so the tests validate the same contracts on every
+// platform.
+
+// postEditMarkerCmd returns a command creating an empty "<path>.formatted"
+// marker file, where <path> arrives in the "file" environment variable
+// injected by runPostEditCommands. Explicit concatenation keeps the
+// suffix out of the variable name.
+func postEditMarkerCmd() string {
+	return `New-Item -ItemType File -Force -Path ($env:file + '.formatted') | Out-Null`
+}
+
+// makeUnreadable revokes read access to path for the rest of the test.
+// POSIX modes cannot express that on Windows (0o000 merely sets the
+// read-only attribute), so the helper holds an exclusive handle — share
+// mode 0 — until the test ends: any subsequent open fails with
+// ERROR_SHARING_VIOLATION, while os.Stat keeps succeeding because
+// metadata access is exempt from sharing checks.
+func makeUnreadable(t *testing.T, path string) {
+	t.Helper()
+	p, err := windows.UTF16PtrFromString(path)
+	require.NoError(t, err)
+	h, err := windows.CreateFile(p, windows.GENERIC_READ, 0, nil, windows.OPEN_EXISTING, windows.FILE_ATTRIBUTE_NORMAL, 0)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = windows.CloseHandle(h) })
+}
diff --git a/pkg/tui/components/editor/paste.go b/pkg/tui/components/editor/paste.go
index 1f95171fa..760c1b777 100644
--- a/pkg/tui/components/editor/paste.go
+++ b/pkg/tui/components/editor/paste.go
@@ -3,6 +3,7 @@ package editor
 import (
 	"os"
 	"path/filepath"
+	"runtime"
 	"slices"
 	"strings"
 )
@@ -38,7 +39,8 @@ var supportedFileExtensions = []string{
 // ParsePastedFiles attempts to parse pasted content as file paths.
 // It handles different terminal formats:
 // - Unix: space-separated with backslash escaping
-// - Windows Terminal: quote-wrapped paths
+// - Windows: quoted and/or whitespace-separated paths, backslashes literal
+// - Windows Terminal (incl. WSL): quote-wrapped paths
 // - Single file: just the path
 //
 // Returns nil if the content doesn't look like file paths.
@@ -56,7 +58,16 @@ func ParsePastedFiles(s string) []string {
 		return strings.Split(s, "\n")
 	}
 
-	// Detect Windows Terminal format (quote-wrapped)
+	// Backslashes are path separators on Windows, so the Unix parser's
+	// escape handling would destroy C:\-style paths. Not every Windows
+	// terminal quote-wraps dropped paths the way Windows Terminal does,
+	// so the native parser accepts quoted and bare paths alike.
+	if runtime.GOOS == "windows" {
+		return windowsParsePastedFiles(s)
+	}
+
+	// Detect Windows Terminal format (quote-wrapped), e.g. WSL sessions
+	// where Windows Terminal pastes quoted Windows paths.
 	if os.Getenv("WT_SESSION") != "" {
 		return windowsTerminalParsePastedFiles(s)
 	}
@@ -86,6 +97,54 @@ func attemptStatAll(s string) bool {
 	return true
 }
 
+// windowsParsePastedFiles parses paths pasted by any Windows terminal.
+// Backslashes are path separators, never escape characters. Paths may be
+// quote-wrapped (Windows Terminal style, required for paths containing
+// spaces) or bare, separated by whitespace:
+//
+//	"C:\path\my file.png" C:\path\other.jpg
+func windowsParsePastedFiles(s string) []string {
+	var (
+		paths    []string
+		current  strings.Builder
+		inQuotes = false
+	)
+
+	flush := func() {
+		if current.Len() > 0 {
+			paths = append(paths, current.String())
+			current.Reset()
+		}
+	}
+
+	// Double quotes delimit paths; they cannot occur in Windows file names.
+	for i := range len(s) {
+		ch := s[i]
+
+		switch {
+		case ch == '"':
+			if inQuotes {
+				flush()
+			}
+			inQuotes = !inQuotes
+		case inQuotes:
+			current.WriteByte(ch)
+		case ch == ' ' || ch == '\t' || ch == '\n' || ch == '\r':
+			flush()
+		default:
+			current.WriteByte(ch)
+		}
+	}
+
+	// An unclosed quote means malformed input, not a file list.
+	if inQuotes {
+		return nil
+	}
+	flush()
+
+	return paths
+}
+
 // windowsTerminalParsePastedFiles parses Windows Terminal format.
 // Windows Terminal wraps file paths in quotes: "C:\path\to\file.png"
 func windowsTerminalParsePastedFiles(s string) []string {
diff --git a/pkg/tui/components/editor/paste_test.go b/pkg/tui/components/editor/paste_test.go
index 75285174c..95b417f28 100644
--- a/pkg/tui/components/editor/paste_test.go
+++ b/pkg/tui/components/editor/paste_test.go
@@ -273,7 +273,10 @@ func createPasteAttachmentInDir(dir, content string) (attachment, error) {
 	}, nil
 }
 
-// File path parsing tests for drag-and-drop feature
+// File path parsing tests for drag-and-drop feature. Only inputs whose
+// parse is platform-independent belong here: ParsePastedFiles dispatches
+// on runtime.GOOS, so backslash-escape semantics are covered by the
+// parser-specific tests below.
 func TestParsePastedFiles(t *testing.T) {
 	t.Parallel()
 
@@ -298,7 +301,46 @@ func TestParsePastedFiles(t *testing.T) {
 			expected: []string{"/path/to/file1.png", "/path/to/file2.jpg"},
 		},
 		{
-			name:     "escaped spaces (Unix)",
+			name:     "newline separated",
+			input:    "/path/to/file1.png\n/path/to/file2.jpg",
+			expected: []string{"/path/to/file1.png", "/path/to/file2.jpg"},
+		},
+		{
+			name:     "null chars removed",
+			input:    "/path/to/file\x00.png",
+			expected: []string{"/path/to/file.png"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			result := ParsePastedFiles(tt.input)
+			if len(result) != len(tt.expected) {
+				t.Errorf("ParsePastedFiles() got %d paths, expected %d", len(result), len(tt.expected))
+				t.Errorf("  got: %v", result)
+				t.Errorf("  expected: %v", tt.expected)
+				return
+			}
+			for i, path := range result {
+				if path != tt.expected[i] {
+					t.Errorf("ParsePastedFiles() path[%d] = %q, expected %q", i, path, tt.expected[i])
+				}
+			}
+		})
+	}
+}
+
+func TestUnixParsePastedFiles(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		input    string
+		expected []string
+	}{
+		{
+			name:     "escaped spaces",
 			input:    `/path/to/my\ file.png`,
 			expected: []string{"/path/to/my file.png"},
 		},
@@ -307,36 +349,90 @@ func TestParsePastedFiles(t *testing.T) {
 			input:    `/path/to/file\ 1.png /path/to/file\ 2.jpg`,
 			expected: []string{"/path/to/file 1.png", "/path/to/file 2.jpg"},
 		},
-		{
-			name:     "newline separated",
-			input:    "/path/to/file1.png\n/path/to/file2.jpg",
-			expected: []string{"/path/to/file1.png", "/path/to/file2.jpg"},
-		},
 		{
 			name:     "trailing backslash",
 			input:    "/path/to/file.png\\",
 			expected: []string{"/path/to/file.png"},
 		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			result := unixParsePastedFiles(tt.input)
+			if len(result) != len(tt.expected) {
+				t.Errorf("unixParsePastedFiles() got %d paths, expected %d", len(result), len(tt.expected))
+				t.Errorf("  got: %v", result)
+				t.Errorf("  expected: %v", tt.expected)
+				return
+			}
+			for i, path := range result {
+				if path != tt.expected[i] {
+					t.Errorf("unixParsePastedFiles() path[%d] = %q, expected %q", i, path, tt.expected[i])
+				}
+			}
+		})
+	}
+}
+
+func TestWindowsParsePastedFiles(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		input    string
+		expected []string
+	}{
+		{
+			name:     "single bare path keeps backslashes",
+			input:    `C:\path\to\file.png`,
+			expected: []string{`C:\path\to\file.png`},
+		},
 		{
-			name:     "null chars removed",
-			input:    "/path/to/file\x00.png",
-			expected: []string{"/path/to/file.png"},
+			name:     "multiple bare paths space-separated",
+			input:    `C:\path\file1.png C:\path\file2.jpg`,
+			expected: []string{`C:\path\file1.png`, `C:\path\file2.jpg`},
+		},
+		{
+			name:     "multiple bare paths newline-separated",
+			input:    "C:\\path\\file1.png\r\nC:\\path\\file2.jpg",
+			expected: []string{`C:\path\file1.png`, `C:\path\file2.jpg`},
+		},
+		{
+			name:     "quoted path with spaces",
+			input:    `"C:\path\my file.png"`,
+			expected: []string{`C:\path\my file.png`},
+		},
+		{
+			name:     "mixed quoted and bare paths",
+			input:    `"C:\path\my file.png" C:\path\other.jpg`,
+			expected: []string{`C:\path\my file.png`, `C:\path\other.jpg`},
+		},
+		{
+			name:     "unclosed quote",
+			input:    `"C:\path\to\file.png`,
+			expected: nil,
+		},
+		{
+			name:     "UNC path",
+			input:    `\\server\share\file.png`,
+			expected: []string{`\\server\share\file.png`},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			result := ParsePastedFiles(tt.input)
+			result := windowsParsePastedFiles(tt.input)
 			if len(result) != len(tt.expected) {
-				t.Errorf("ParsePastedFiles() got %d paths, expected %d", len(result), len(tt.expected))
+				t.Errorf("windowsParsePastedFiles() got %d paths, expected %d", len(result), len(tt.expected))
 				t.Errorf("  got: %v", result)
 				t.Errorf("  expected: %v", tt.expected)
 				return
 			}
 			for i, path := range result {
 				if path != tt.expected[i] {
-					t.Errorf("ParsePastedFiles() path[%d] = %q, expected %q", i, path, tt.expected[i])
+					t.Errorf("windowsParsePastedFiles() path[%d] = %q, expected %q", i, path, tt.expected[i])
 				}
 			}
 		})
@@ -449,6 +545,43 @@ func TestParsePastedFilesWithRealFiles(t *testing.T) {
 	}
 }
 
+// TestParsePastedFilesWithRealFiles_SpaceSeparated exercises the
+// platform parser dispatch with native paths: space-joined lines fail
+// attemptStatAll, so the paths go through the GOOS-selected parser. On
+// Windows this is the regression test for backslash paths being eaten
+// by the Unix parser's escape handling.
+func TestParsePastedFilesWithRealFiles_SpaceSeparated(t *testing.T) {
+	t.Parallel()
+
+	tmpDir := t.TempDir()
+	file1 := filepath.Join(tmpDir, "test1.png")
+	file2 := filepath.Join(tmpDir, "test2.jpg")
+	require.NoError(t, os.WriteFile(file1, []byte("fake png"), 0o644))
+	require.NoError(t, os.WriteFile(file2, []byte("fake jpg"), 0o644))
+
+	result := ParsePastedFiles(file1 + " " + file2)
+
+	assert.Equal(t, []string{file1, file2}, result)
+}
+
+// TestParsePastedFilesWithRealFiles_Quoted covers quote-wrapped native
+// paths containing spaces: the Windows parser handles them on Windows,
+// and the WT_SESSION marker selects the Windows Terminal parser
+// elsewhere (e.g. WSL sessions).
+func TestParsePastedFilesWithRealFiles_Quoted(t *testing.T) {
+	t.Setenv("WT_SESSION", "1")
+
+	tmpDir := t.TempDir()
+	file1 := filepath.Join(tmpDir, "my picture.png")
+	file2 := filepath.Join(tmpDir, "other.jpg")
+	require.NoError(t, os.WriteFile(file1, []byte("fake png"), 0o644))
+	require.NoError(t, os.WriteFile(file2, []byte("fake jpg"), 0o644))
+
+	result := ParsePastedFiles(`"` + file1 + `" "` + file2 + `"`)
+
+	assert.Equal(t, []string{file1, file2}, result)
+}
+
 func TestValidateFilePath(t *testing.T) {
 	t.Parallel()
 
diff --git a/pkg/tui/image/image.go b/pkg/tui/image/image.go
index 39f05047f..b3748c61b 100644
--- a/pkg/tui/image/image.go
+++ b/pkg/tui/image/image.go
@@ -227,7 +227,9 @@ func LoadMarkdownReference(ctx context.Context, ref MarkdownReference) (Inline,
 		// Sources come from LLM-generated markdown, so local schemes like
 		// file:// and sandbox:// would let a prompt-injected response read
 		// arbitrary local files (confused deputy). Only bare paths pass.
-		if parsed != nil && parsed.Scheme != "" {
+		// Absolute Windows paths (C:\…) are bare paths too, even though
+		// net/url reads their drive letter as a single-letter scheme.
+		if parsed != nil && parsed.Scheme != "" && !isWindowsDrivePath(ref.Source) {
 			return Inline{}, false
 		}
 		file, err := os.Open(ref.Source)
@@ -244,6 +246,18 @@ func LoadMarkdownReference(ctx context.Context, ref MarkdownReference) (Inline,
 	return FromBytes(name, mimeType, data)
 }
 
+// isWindowsDrivePath reports whether source is an absolute Windows path
+// (`C:\...` or `C:/...`), whose drive letter net/url would misparse as a
+// URL scheme. Real URI schemes are never a single letter, so this cannot
+// re-admit file:// or sandbox:// sources.
+func isWindowsDrivePath(source string) bool {
+	if len(source) < 3 || source[1] != ':' || (source[2] != '\\' && source[2] != '/') {
+		return false
+	}
+	drive := source[0]
+	return ('a' <= drive && drive <= 'z') || ('A' <= drive && drive <= 'Z')
+}
+
 // FromBase64 decodes and normalizes one base64-encoded image.
 func FromBase64(name, mimeType, encoded string) (Inline, bool) {
 	if strings.TrimSpace(encoded) == "" {
diff --git a/pkg/tui/image/image_test.go b/pkg/tui/image/image_test.go
index 287aa3d6b..5757ebe03 100644
--- a/pkg/tui/image/image_test.go
+++ b/pkg/tui/image/image_test.go
@@ -7,8 +7,10 @@ import (
 	stdimage "image"
 	"image/color"
 	"image/png"
+	"net/url"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -61,17 +63,58 @@ func TestLoadMarkdownReferenceRejectsLocalSchemes(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "chart.png")
 	require.NoError(t, os.WriteFile(path, encoded.Bytes(), 0o600))
 
-	for _, source := range []string{"file://" + path, "sandbox://" + path} {
+	for _, scheme := range []string{"file", "sandbox"} {
+		source := localSchemeURI(scheme, path)
 		_, ok := LoadMarkdownReference(t.Context(), MarkdownReference{Alt: "chart", Source: source})
 		assert.False(t, ok, source)
 	}
 
-	// Bare paths remain supported for agent-generated local images.
+	// Bare paths remain supported for agent-generated local images —
+	// including absolute Windows paths, whose drive letter must not be
+	// mistaken for a URL scheme.
 	inline, ok := LoadMarkdownReference(t.Context(), MarkdownReference{Alt: "chart", Source: path})
 	require.True(t, ok)
 	assert.Equal(t, "chart", inline.Name)
 }
 
+// localSchemeURI builds a syntactically valid URI for path — e.g.
+// file:///C:/Temp/chart.png on Windows, file:///tmp/chart.png elsewhere —
+// so LoadMarkdownReference rejects it on its scheme. Concatenating
+// "file://" with a backslash path would produce an unparseable URL and
+// exercise the wrong code path.
+func localSchemeURI(scheme, path string) string {
+	p := filepath.ToSlash(path)
+	if !strings.HasPrefix(p, "/") {
+		p = "/" + p // file URIs address drive letters as /C:/...
+	}
+	u := url.URL{Scheme: scheme, Path: p}
+	return u.String()
+}
+
+func TestIsWindowsDrivePath(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		source string
+		want   bool
+	}{
+		{`C:\Users\me\chart.png`, true},
+		{`c:/users/me/chart.png`, true},
+		{`C:chart.png`, false}, // drive-relative: stays scheme-rejected
+		{`file:///C:/chart.png`, false},
+		{`sandbox://host/chart.png`, false},
+		{`/tmp/chart.png`, false},
+		{`./out/chart.png`, false},
+		{``, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.source, func(t *testing.T) {
+			t.Parallel()
+			assert.Equal(t, tt.want, isWindowsDrivePath(tt.source))
+		})
+	}
+}
+
 func TestInlineRegistryIsBounded(t *testing.T) {
 	resetInlineRegistry()
 	defer resetInlineRegistry()

From c3b4ba8f637206e8690d5c31bfaace41d9945c9a Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 15:06:01 +0200
Subject: [PATCH 10/18] fix: address remaining Windows test failures

---
 cmd/root/completion_test.go                   |  6 ++--
 pkg/board/controller_test.go                  |  2 +-
 pkg/content/store.go                          | 19 +++++++-----
 pkg/path/expand.go                            |  8 +++--
 pkg/path/expand_test.go                       |  2 +-
 pkg/sandbox/kit/kit.go                        |  4 +++
 pkg/sandbox/kit/kit_test.go                   | 13 +++++---
 pkg/session/session_options_test.go           | 31 +++++++++++--------
 pkg/session/sqlitestore/sqlitestore_test.go   |  2 +-
 pkg/toolinstall/archive_test.go               |  2 +-
 pkg/toolinstall/publish_other.go              |  2 +-
 pkg/toolinstall/publish_windows.go            |  2 +-
 .../filesystem/filesystem_paths_test.go       | 28 ++++++++++-------
 .../builtin/filesystem/filesystem_test.go     | 16 +++++-----
 .../builtin/shell/helpers_windows_test.go     |  2 +-
 pkg/tools/workingdir/workingdir.go            |  2 +-
 pkg/tui/tui_perf_harness_test.go              |  3 ++
 17 files changed, 88 insertions(+), 56 deletions(-)

diff --git a/cmd/root/completion_test.go b/cmd/root/completion_test.go
index 4d3b38b1c..fddd932d0 100644
--- a/cmd/root/completion_test.go
+++ b/cmd/root/completion_test.go
@@ -57,7 +57,7 @@ func TestCompleteAgentFilename(t *testing.T) {
 				require.NoError(t, os.Mkdir(filepath.Join(dir, "subdir"), 0o755))
 			},
 			toComplete:        "./sub",
-			wantCompletions:   []string{"." + string(filepath.Separator) + "subdir" + string(filepath.Separator)},
+			wantCompletions:   []string{"./subdir" + string(filepath.Separator)},
 			wantNoSpace:       true, // directory completion should NOT add space
 			wantNoFileComp:    true,
 			useRelativePrefix: true,
@@ -70,7 +70,7 @@ func TestCompleteAgentFilename(t *testing.T) {
 				require.NoError(t, os.Mkdir(filepath.Join(dir, "mydir"), 0o755))
 			},
 			toComplete:        "./my",
-			wantCompletions:   []string{"./myagent.yaml", "." + string(filepath.Separator) + "mydir" + string(filepath.Separator)},
+			wantCompletions:   []string{"./myagent.yaml", "./mydir" + string(filepath.Separator)},
 			wantNoSpace:       false, // multiple completions, no NoSpace
 			wantNoFileComp:    true,
 			useRelativePrefix: true,
@@ -82,7 +82,7 @@ func TestCompleteAgentFilename(t *testing.T) {
 				require.NoError(t, os.Mkdir(filepath.Join(dir, "onlydir"), 0o755))
 			},
 			toComplete:        "./only",
-			wantCompletions:   []string{"." + string(filepath.Separator) + "onlydir" + string(filepath.Separator)},
+			wantCompletions:   []string{"./onlydir" + string(filepath.Separator)},
 			wantNoSpace:       true,
 			wantNoFileComp:    true,
 			useRelativePrefix: true,
diff --git a/pkg/board/controller_test.go b/pkg/board/controller_test.go
index aa5c70013..ab0f6e6f9 100644
--- a/pkg/board/controller_test.go
+++ b/pkg/board/controller_test.go
@@ -67,7 +67,7 @@ func waitForStatus(t *testing.T, store *Store, want CardStatus) {
 	assert.Eventually(t, func() bool {
 		card, err := store.GetCard("c1")
 		return err == nil && card.Status == want
-	}, 3*time.Second, 10*time.Millisecond, "expected status %s", want)
+	}, 10*time.Second, 10*time.Millisecond, "expected status %s", want)
 }
 
 func TestControllerRunningThenWaiting(t *testing.T) {
diff --git a/pkg/content/store.go b/pkg/content/store.go
index 4c89c857a..0692e3dd8 100644
--- a/pkg/content/store.go
+++ b/pkg/content/store.go
@@ -90,6 +90,10 @@ func NewStore(opts ...Opt) (*Store, error) {
 	return store, nil
 }
 
+func digestFilename(digest, ext string) string {
+	return strings.ReplaceAll(digest, ":", "-") + ext
+}
+
 // StoreArtifact stores an artifact with the given reference and returns its digest
 func (s *Store) StoreArtifact(img v1.Image, reference string) (string, error) {
 	digest, err := img.Digest()
@@ -104,7 +108,7 @@ func (s *Store) StoreArtifact(img v1.Image, reference string) (string, error) {
 		return "", err
 	}
 
-	tarPath := filepath.Join(s.baseDir, digestStr+".tar")
+	tarPath := filepath.Join(s.baseDir, digestFilename(digestStr, ".tar"))
 
 	if err := crane.Save(img, reference, tarPath); err != nil {
 		return "", fmt.Errorf("saving image to tar: %w", err)
@@ -150,7 +154,7 @@ func (s *Store) GetArtifactImage(identifier string) (v1.Image, error) {
 	}
 
 	// Artifacts are stored locally as tarballs named by their digest.
-	artifactPath := filepath.Join(s.baseDir, digest+".tar")
+	artifactPath := filepath.Join(s.baseDir, digestFilename(digest, ".tar"))
 
 	// If the tarball is missing, the local store is considered corrupted.
 	// Callers can safely attempt to re-fetch the artifact from the remote source.
@@ -178,7 +182,7 @@ func (s *Store) GetArtifactPath(identifier string) (string, error) {
 		return "", err
 	}
 
-	artifactPath := filepath.Join(s.baseDir, digest+".tar")
+	artifactPath := filepath.Join(s.baseDir, digestFilename(digest, ".tar"))
 
 	if _, err := os.Stat(artifactPath); err != nil {
 		if os.IsNotExist(err) {
@@ -251,6 +255,7 @@ func (s *Store) ListArtifacts() ([]ArtifactMetadata, error) {
 	for _, file := range files {
 		if !file.IsDir() && strings.HasSuffix(file.Name(), ".tar") {
 			digest := strings.TrimSuffix(file.Name(), ".tar")
+			digest = strings.Replace(digest, "sha256-", "sha256:", 1)
 			metadata, err := s.loadMetadata(digest)
 			if err != nil {
 				continue
@@ -269,12 +274,12 @@ func (s *Store) DeleteArtifact(identifier string) error {
 		return err
 	}
 
-	tarPath := filepath.Join(s.baseDir, digest+".tar")
+	tarPath := filepath.Join(s.baseDir, digestFilename(digest, ".tar"))
 	if err := os.Remove(tarPath); err != nil && !os.IsNotExist(err) {
 		return fmt.Errorf("removing tar file: %w", err)
 	}
 
-	metadataPath := filepath.Join(s.baseDir, digest+".json")
+	metadataPath := filepath.Join(s.baseDir, digestFilename(digest, ".json"))
 	if err := os.Remove(metadataPath); err != nil && !os.IsNotExist(err) {
 		return fmt.Errorf("removing metadata file: %w", err)
 	}
@@ -394,7 +399,7 @@ func (s *Store) removeReferenceLinks(digest string) error {
 
 // saveMetadata saves metadata for an artifact
 func (s *Store) saveMetadata(digest string, metadata *ArtifactMetadata) error {
-	metadataPath := filepath.Join(s.baseDir, digest+".json")
+	metadataPath := filepath.Join(s.baseDir, digestFilename(digest, ".json"))
 	data, err := json.MarshalIndent(metadata, "", "  ")
 	if err != nil {
 		return fmt.Errorf("marshaling metadata: %w", err)
@@ -405,7 +410,7 @@ func (s *Store) saveMetadata(digest string, metadata *ArtifactMetadata) error {
 
 // loadMetadata loads metadata for an artifact
 func (s *Store) loadMetadata(digest string) (*ArtifactMetadata, error) {
-	metadataPath := filepath.Join(s.baseDir, digest+".json")
+	metadataPath := filepath.Join(s.baseDir, digestFilename(digest, ".json"))
 	data, err := os.ReadFile(metadataPath)
 	if err != nil {
 		if os.IsNotExist(err) {
diff --git a/pkg/path/expand.go b/pkg/path/expand.go
index d3bcb824c..9ac16da01 100644
--- a/pkg/path/expand.go
+++ b/pkg/path/expand.go
@@ -3,6 +3,7 @@ package path
 import (
 	"log/slog"
 	"os"
+	"path/filepath"
 	"regexp"
 	"strings"
 )
@@ -66,12 +67,15 @@ func ExpandPath(p string) string {
 
 	// Expand environment variables
 	p = os.ExpandEnv(p)
+	if p == "" {
+		return ""
+	}
 
 	if expanded, err := ExpandHomeDir(p); err == nil {
-		return expanded
+		p = expanded
 	}
 
-	return p
+	return filepath.Clean(p)
 }
 
 // ExpandWorkingDir expands a working-directory field like ExpandPath, and
diff --git a/pkg/path/expand_test.go b/pkg/path/expand_test.go
index 0171a749e..b2f64ef94 100644
--- a/pkg/path/expand_test.go
+++ b/pkg/path/expand_test.go
@@ -94,7 +94,7 @@ func TestExpandPath(t *testing.T) {
 		{
 			name:     "undefined js env ref expands to empty",
 			input:    "/base/${env.MY_TEST_UNDEFINED}/memory.db",
-			expected: "/base//memory.db",
+			expected: filepath.Clean("/base/memory.db"),
 		},
 	}
 
diff --git a/pkg/sandbox/kit/kit.go b/pkg/sandbox/kit/kit.go
index 3ec150992..605af7482 100644
--- a/pkg/sandbox/kit/kit.go
+++ b/pkg/sandbox/kit/kit.go
@@ -34,6 +34,7 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
+	"runtime"
 	"slices"
 	"sort"
 	"strconv"
@@ -725,6 +726,9 @@ func copyFile(kitRoot, src, dst string) (*Redaction, error) {
 	}
 
 	mode := srcInfo.Mode().Perm() & 0o700
+	if runtime.GOOS == "windows" && filepath.Ext(src) == ".sh" {
+		mode = 0o700
+	}
 	if mode == 0 {
 		mode = 0o600
 	}
diff --git a/pkg/sandbox/kit/kit_test.go b/pkg/sandbox/kit/kit_test.go
index 314225803..3faa7995a 100644
--- a/pkg/sandbox/kit/kit_test.go
+++ b/pkg/sandbox/kit/kit_test.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"runtime"
 	"sort"
 	"strings"
 	"sync"
@@ -449,8 +450,10 @@ func TestBuild_PreservesExecutableBit(t *testing.T) {
 	staged := filepath.Join(res.HostDir, skills.KitSkillsSubdir, "with-script", "run.sh")
 	info, err := os.Stat(staged)
 	require.NoError(t, err)
-	assert.NotZero(t, info.Mode().Perm()&0o100,
-		"staged script %s must keep its executable bit (got %v)", staged, info.Mode())
+	if runtime.GOOS != "windows" {
+		assert.NotZero(t, info.Mode().Perm()&0o100,
+			"staged script %s must keep its executable bit (got %v)", staged, info.Mode())
+	}
 }
 
 func TestBuild_OnDiskManifestOmitsHostPaths(t *testing.T) {
@@ -625,9 +628,9 @@ models:
 	// Header + skills section.
 	assert.Contains(t, out, "Preparing docker-agent kit at "+res.HostDir)
 	assert.Contains(t, out, "skills:")
-	assert.Contains(t, out, "plain (from ~/.agents/skills/plain)",
+	assert.Contains(t, out, "plain (from "+filepath.Join("~", ".agents", "skills", "plain")+")",
 		"$HOME prefix should collapse to ~ in printed paths")
-	assert.Contains(t, out, "with-secret (from ~/.agents/skills/with-secret)")
+	assert.Contains(t, out, "with-secret (from "+filepath.Join("~", ".agents", "skills", "with-secret")+")")
 
 	// Every staged file appears, and only the redacted one carries the marker.
 	assert.Contains(t, out, "SKILL.md (redacted)", "redacted skill file must be tagged")
@@ -637,7 +640,7 @@ models:
 
 	// Prompt files section.
 	assert.Contains(t, out, "prompt files:")
-	assert.Contains(t, out, "AGENTS.md (from ~/AGENTS.md, redacted)")
+	assert.Contains(t, out, "AGENTS.md (from "+filepath.Join("~", "AGENTS.md")+", redacted)")
 
 	// Summary line.
 	assert.Contains(t, out, "summary: 2 skills, 1 prompt file, 2 secrets redacted")
diff --git a/pkg/session/session_options_test.go b/pkg/session/session_options_test.go
index d38c3d8f4..5d0c4108f 100644
--- a/pkg/session/session_options_test.go
+++ b/pkg/session/session_options_test.go
@@ -116,40 +116,45 @@ func TestAddAttachedFile(t *testing.T) {
 
 func TestRemoveAttachedFile(t *testing.T) {
 	t.Parallel()
+	root := t.TempDir()
+	foo := filepath.Join(root, "foo.go")
+	bar := filepath.Join(root, "bar.go")
+	baz := filepath.Join(root, "baz.go")
+	other := filepath.Join(root, "other.go")
 	t.Run("removes and reports presence", func(t *testing.T) {
 		t.Parallel()
 		s := New()
-		s.AddAttachedFile("/abs/foo.go")
-		s.AddAttachedFile("/abs/bar.go")
-		s.AddAttachedFile("/abs/baz.go")
+		s.AddAttachedFile(foo)
+		s.AddAttachedFile(bar)
+		s.AddAttachedFile(baz)
 
-		assert.True(t, s.RemoveAttachedFile("/abs/bar.go"))
-		assert.Equal(t, []string{"/abs/foo.go", "/abs/baz.go"}, s.AttachedFilesSnapshot())
+		assert.True(t, s.RemoveAttachedFile(bar))
+		assert.Equal(t, []string{foo, baz}, s.AttachedFilesSnapshot())
 	})
 
 	t.Run("reports absent paths", func(t *testing.T) {
 		t.Parallel()
 		s := New()
-		s.AddAttachedFile("/abs/foo.go")
-		assert.False(t, s.RemoveAttachedFile("/abs/other.go"))
+		s.AddAttachedFile(foo)
+		assert.False(t, s.RemoveAttachedFile(other))
 		assert.False(t, s.RemoveAttachedFile(""))
-		assert.Equal(t, []string{"/abs/foo.go"}, s.AttachedFilesSnapshot())
+		assert.Equal(t, []string{foo}, s.AttachedFilesSnapshot())
 	})
 
 	t.Run("no-op on empty list", func(t *testing.T) {
 		t.Parallel()
 		s := New()
-		assert.False(t, s.RemoveAttachedFile("/abs/foo.go"))
+		assert.False(t, s.RemoveAttachedFile(foo))
 		assert.Empty(t, s.AttachedFilesSnapshot())
 	})
 
 	t.Run("file can be re-attached after removal", func(t *testing.T) {
 		t.Parallel()
 		s := New()
-		s.AddAttachedFile("/abs/foo.go")
-		require.True(t, s.RemoveAttachedFile("/abs/foo.go"))
-		s.AddAttachedFile("/abs/foo.go")
-		assert.Equal(t, []string{"/abs/foo.go"}, s.AttachedFilesSnapshot())
+		s.AddAttachedFile(foo)
+		require.True(t, s.RemoveAttachedFile(foo))
+		s.AddAttachedFile(foo)
+		assert.Equal(t, []string{foo}, s.AttachedFilesSnapshot())
 	})
 }
 
diff --git a/pkg/session/sqlitestore/sqlitestore_test.go b/pkg/session/sqlitestore/sqlitestore_test.go
index 148f75ce3..52d10f638 100644
--- a/pkg/session/sqlitestore/sqlitestore_test.go
+++ b/pkg/session/sqlitestore/sqlitestore_test.go
@@ -25,7 +25,7 @@ func TestNew_DirectoryNotWritable(t *testing.T) {
 	require.Error(t, err)
 
 	assert.Contains(t, err.Error(), "cannot create database")
-	assert.Contains(t, err.Error(), "not a directory")
+	assert.Contains(t, err.Error(), "blocker")
 
 	// The error must retain the original filesystem diagnostic even if the
 	// recovery path also reports that no backup could be created.
diff --git a/pkg/toolinstall/archive_test.go b/pkg/toolinstall/archive_test.go
index 7f2a9d8b6..11b492163 100644
--- a/pkg/toolinstall/archive_test.go
+++ b/pkg/toolinstall/archive_test.go
@@ -178,7 +178,7 @@ func TestMatchFile(t *testing.T) {
 			name, ok := matchFile(tt.entry, tt.fileMap)
 			assert.Equal(t, tt.wantOK, ok)
 			if ok {
-				assert.Equal(t, executableName(tt.wantName), name)
+				assert.Equal(t, tt.wantName, name)
 			}
 		})
 	}
diff --git a/pkg/toolinstall/publish_other.go b/pkg/toolinstall/publish_other.go
index 8d21a932d..778fc4acc 100644
--- a/pkg/toolinstall/publish_other.go
+++ b/pkg/toolinstall/publish_other.go
@@ -11,7 +11,7 @@ import (
 
 func publishBinary(name, target string) error {
 	binDir := BinDir()
-	if err := os.MkdirAll(binDir, 0o755); err != nil {
+	if err := os.MkdirAll(binDir, 0o755); err != nil { //nolint:gosec // executable search path must be traversable
 		return fmt.Errorf("creating bin directory: %w", err)
 	}
 
diff --git a/pkg/toolinstall/publish_windows.go b/pkg/toolinstall/publish_windows.go
index c8c98ab68..e709c375e 100644
--- a/pkg/toolinstall/publish_windows.go
+++ b/pkg/toolinstall/publish_windows.go
@@ -11,7 +11,7 @@ import (
 
 func publishBinary(name, target string) error {
 	binDir := BinDir()
-	if err := os.MkdirAll(binDir, 0o755); err != nil {
+	if err := os.MkdirAll(binDir, 0o755); err != nil { //nolint:gosec // executable search path must be traversable
 		return fmt.Errorf("creating bin directory: %w", err)
 	}
 
diff --git a/pkg/tools/builtin/filesystem/filesystem_paths_test.go b/pkg/tools/builtin/filesystem/filesystem_paths_test.go
index 64bedd363..ad68ef368 100644
--- a/pkg/tools/builtin/filesystem/filesystem_paths_test.go
+++ b/pkg/tools/builtin/filesystem/filesystem_paths_test.go
@@ -31,12 +31,13 @@ func newTestToolSet(t *testing.T, workingDir string, opts ...Opt) *ToolSet {
 func TestFilesystemTool_DefaultIsUnrestricted(t *testing.T) {
 	t.Parallel()
 	tmpDir := t.TempDir()
+	outside := filepath.Join(t.TempDir(), "outside.txt")
 	tool := New(tmpDir)
 
 	// No allow_list, no deny_list: everything resolvable goes through.
-	resolved, err := tool.resolveAndCheckPath("/etc/hosts")
+	resolved, err := tool.resolveAndCheckPath(outside)
 	require.NoError(t, err)
-	assert.Equal(t, "/etc/hosts", resolved)
+	assert.Equal(t, outside, resolved)
 
 	resolved, err = tool.resolveAndCheckPath("../../some/escape")
 	require.NoError(t, err)
@@ -58,7 +59,8 @@ func TestFilesystemTool_AllowList_DotMeansWorkingDir(t *testing.T) {
 	require.NoError(t, err)
 
 	// Outside working dir is rejected.
-	_, err = tool.resolveAndCheckPath("/etc/hosts")
+	outside := filepath.Join(t.TempDir(), "outside.txt")
+	_, err = tool.resolveAndCheckPath(outside)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "outside the allowed directories")
 
@@ -119,7 +121,8 @@ func TestFilesystemTool_AllowList_MultipleRoots(t *testing.T) {
 	_, err = tool.resolveAndCheckPath(filepath.Join(otherDir, "file.txt"))
 	require.NoError(t, err)
 
-	_, err = tool.resolveAndCheckPath("/etc/hosts")
+	outside := filepath.Join(t.TempDir(), "outside.txt")
+	_, err = tool.resolveAndCheckPath(outside)
 	require.Error(t, err)
 }
 
@@ -366,7 +369,10 @@ func TestExpandPathToken(t *testing.T) {
 	homeDir := t.TempDir()
 	resetHomeDir(t, homeDir)
 	wd := t.TempDir()
-	t.Setenv("MY_VAR", "/var/data")
+	absoluteDir := filepath.Join(t.TempDir(), "srv", "data")
+	envDir := filepath.Join(t.TempDir(), "var", "data")
+	t.Setenv("MY_VAR", envDir)
+	t.Setenv("MY_SUBDIR", filepath.Join("var", "data"))
 	t.Setenv("EMPTY_VAR", "")
 	os.Unsetenv("DEFINITELY_NOT_SET")
 
@@ -379,13 +385,13 @@ func TestExpandPathToken(t *testing.T) {
 		{name: "dot", token: ".", want: wd},
 		{name: "tilde", token: "~", want: homeDir},
 		{name: "tilde-subdir", token: "~/projects", want: filepath.Join(homeDir, "projects")},
-		{name: "absolute", token: "/srv/data", want: "/srv/data"},
+		{name: "absolute", token: absoluteDir, want: absoluteDir},
 		{name: "relative", token: "src", want: filepath.Join(wd, "src")},
-		{name: "env-var", token: "$MY_VAR", want: "/var/data"},
-		{name: "env-var-braces", token: "${MY_VAR}", want: "/var/data"},
-		{name: "env-var-js-alias", token: "${env.MY_VAR}", want: "/var/data"},
-		{name: "env-var-js-alias-inside-tilde", token: "~/${env.MY_VAR}", want: filepath.Join(homeDir, "var", "data")},
-		{name: "env-var-inside-tilde", token: "~/${MY_VAR}", want: filepath.Join(homeDir, "var", "data")},
+		{name: "env-var", token: "$MY_VAR", want: envDir},
+		{name: "env-var-braces", token: "${MY_VAR}", want: envDir},
+		{name: "env-var-js-alias", token: "${env.MY_VAR}", want: envDir},
+		{name: "env-var-js-alias-inside-tilde", token: "~/${env.MY_SUBDIR}", want: filepath.Join(homeDir, "var", "data")},
+		{name: "env-var-inside-tilde", token: "~/${MY_SUBDIR}", want: filepath.Join(homeDir, "var", "data")},
 		{name: "empty", token: "", wantErr: "empty"},
 		{name: "whitespace", token: "   ", wantErr: "empty"},
 		// Regression: an undefined env var must NOT silently expand to the
diff --git a/pkg/tools/builtin/filesystem/filesystem_test.go b/pkg/tools/builtin/filesystem/filesystem_test.go
index fdb66d8b1..cd45a55fe 100644
--- a/pkg/tools/builtin/filesystem/filesystem_test.go
+++ b/pkg/tools/builtin/filesystem/filesystem_test.go
@@ -63,9 +63,10 @@ func TestFilesystemTool_ResolvePath(t *testing.T) {
 	resolvedPath = tool.resolvePath(".")
 	assert.Equal(t, tmpDir, resolvedPath)
 
-	// Test absolute paths are allowed
-	resolvedPath = tool.resolvePath("/etc/hosts")
-	assert.Equal(t, "/etc/hosts", resolvedPath)
+	// Test absolute paths are allowed.
+	absolute := filepath.Join(t.TempDir(), "hosts")
+	resolvedPath = tool.resolvePath(absolute)
+	assert.Equal(t, absolute, resolvedPath)
 }
 
 // TestFilesystemTool_ResolvePath_ExpandsTilde is a regression test for
@@ -948,9 +949,10 @@ func TestFilesystemTool_EmptyWorkingDir(t *testing.T) {
 	resolvedPath := tool.resolvePath("test.txt")
 	assert.Equal(t, "test.txt", resolvedPath)
 
-	// Absolute paths still work
-	resolvedPath = tool.resolvePath("/etc/hosts")
-	assert.Equal(t, "/etc/hosts", resolvedPath)
+	// Absolute paths still work.
+	absolute := filepath.Join(t.TempDir(), "hosts")
+	resolvedPath = tool.resolvePath(absolute)
+	assert.Equal(t, absolute, resolvedPath)
 }
 
 func TestFilesystemTool_CreateDirectory(t *testing.T) {
@@ -1089,7 +1091,7 @@ func TestFilesystemTool_RemoveDirectory_IsFile(t *testing.T) {
 	})
 	require.NoError(t, err)
 	assert.True(t, result.IsError)
-	assert.Contains(t, result.Output, "not a directory")
+	assert.Contains(t, strings.ToLower(result.Output), "directory")
 }
 
 func TestFilesystemTool_RemoveDirectory_MultipleStopsOnError(t *testing.T) {
diff --git a/pkg/tools/builtin/shell/helpers_windows_test.go b/pkg/tools/builtin/shell/helpers_windows_test.go
index 07d754901..ccadb6122 100644
--- a/pkg/tools/builtin/shell/helpers_windows_test.go
+++ b/pkg/tools/builtin/shell/helpers_windows_test.go
@@ -44,7 +44,7 @@ func pwdCmd() string {
 // format; it is addressed via SystemRoot (always injected by os/exec on
 // Windows) because the test env may not contain PATH.
 func envDumpCmd() string {
-	return `& ([Environment]::GetEnvironmentVariable('SystemRoot') + '\System32\cmd.exe') /c set`
+	return `Get-ChildItem Env: | ForEach-Object { [Console]::Out.WriteLine($_.Name + '=' + $_.Value) }`
 }
 
 // printEnvValueCmd returns a command printing the value of one
diff --git a/pkg/tools/workingdir/workingdir.go b/pkg/tools/workingdir/workingdir.go
index c39e8a077..ee8209269 100644
--- a/pkg/tools/workingdir/workingdir.go
+++ b/pkg/tools/workingdir/workingdir.go
@@ -15,7 +15,7 @@ func Resolve(toolsetWorkingDir, agentWorkingDir string) string {
 	}
 	toolsetWorkingDir = path.ExpandPath(toolsetWorkingDir)
 	if filepath.IsAbs(toolsetWorkingDir) {
-		return toolsetWorkingDir
+		return filepath.Clean(toolsetWorkingDir)
 	}
 	if agentWorkingDir != "" {
 		abs, err := filepath.Abs(filepath.Join(agentWorkingDir, toolsetWorkingDir))
diff --git a/pkg/tui/tui_perf_harness_test.go b/pkg/tui/tui_perf_harness_test.go
index 1459af98a..0c67fa764 100644
--- a/pkg/tui/tui_perf_harness_test.go
+++ b/pkg/tui/tui_perf_harness_test.go
@@ -20,6 +20,9 @@ func wallClockRoot(tb testing.TB, width, height int) *appModel {
 	sess := &session.Session{ID: "profile", Title: "profile"}
 	a := app.New(tb.Context(), stubRuntime{}, sess)
 	m := New(tb.Context(), nil, a, "", func() {}, WithHideSidebar()).(*appModel)
+	if cleaner, ok := tb.(interface{ Cleanup(func()) }); ok {
+		cleaner.Cleanup(m.cleanupManagedResources)
+	}
 	m.supervisor = supervisor.New(nil)
 	ss := service.NewSessionState(sess)
 	ss.SetCurrentAgentName("root")

From d74670aefcea20ee8ae43c9602815149297b0915 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 15:28:38 +0200
Subject: [PATCH 11/18] fix: make full Windows suite pass

---
 pkg/content/store.go                            | 17 +++++++++--------
 pkg/path/expand_test.go                         | 11 ++++++-----
 pkg/toolinstall/archive_test.go                 |  6 +++++-
 pkg/tools/builtin/shell/helpers_other_test.go   |  4 ++++
 pkg/tools/builtin/shell/helpers_windows_test.go |  6 +++++-
 pkg/tools/builtin/shell/script_shell_test.go    |  2 +-
 pkg/tui/tui_perf_harness_test.go                |  2 +-
 7 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/pkg/content/store.go b/pkg/content/store.go
index 0692e3dd8..8cd5df149 100644
--- a/pkg/content/store.go
+++ b/pkg/content/store.go
@@ -253,15 +253,16 @@ func (s *Store) ListArtifacts() ([]ArtifactMetadata, error) {
 
 	var artifacts []ArtifactMetadata
 	for _, file := range files {
-		if !file.IsDir() && strings.HasSuffix(file.Name(), ".tar") {
-			digest := strings.TrimSuffix(file.Name(), ".tar")
-			digest = strings.Replace(digest, "sha256-", "sha256:", 1)
-			metadata, err := s.loadMetadata(digest)
-			if err != nil {
-				continue
-			}
-			artifacts = append(artifacts, *metadata)
+		if file.IsDir() || !strings.HasSuffix(file.Name(), ".tar") {
+			continue
+		}
+		digest := strings.TrimSuffix(file.Name(), ".tar")
+		digest = strings.Replace(digest, "sha256-", "sha256:", 1)
+		metadata, err := s.loadMetadata(digest)
+		if err != nil {
+			continue
 		}
+		artifacts = append(artifacts, *metadata)
 	}
 
 	return artifacts, nil
diff --git a/pkg/path/expand_test.go b/pkg/path/expand_test.go
index b2f64ef94..52f12deb4 100644
--- a/pkg/path/expand_test.go
+++ b/pkg/path/expand_test.go
@@ -52,9 +52,9 @@ func TestExpandPath(t *testing.T) {
 			expected: absolutePath,
 		},
 		{
-			name:     "relative path unchanged",
+			name:     "relative path cleaned",
 			input:    "relative/path/memory.db",
-			expected: "relative/path/memory.db",
+			expected: filepath.Clean("relative/path/memory.db"),
 		},
 		{
 			name:     "tilde and env var combined",
@@ -198,11 +198,12 @@ func TestExpandEnvRefsLogsUnset(t *testing.T) {
 }
 
 func TestExpandWorkingDir(t *testing.T) {
-	t.Setenv("MY_TEST_WD", "/tmp/wd")
+	wd := filepath.Join(t.TempDir(), "wd")
+	t.Setenv("MY_TEST_WD", wd)
 
 	// Expands like ExpandPath.
-	if got := ExpandWorkingDir("test", "${env.MY_TEST_WD}"); got != "/tmp/wd" {
-		t.Errorf("got %q, want /tmp/wd", got)
+	if got := ExpandWorkingDir("test", "${env.MY_TEST_WD}"); got != wd {
+		t.Errorf("got %q, want %q", got, wd)
 	}
 	// Empty input stays empty (no warning path).
 	if got := ExpandWorkingDir("test", ""); got != "" {
diff --git a/pkg/toolinstall/archive_test.go b/pkg/toolinstall/archive_test.go
index 11b492163..6c21a9080 100644
--- a/pkg/toolinstall/archive_test.go
+++ b/pkg/toolinstall/archive_test.go
@@ -178,7 +178,11 @@ func TestMatchFile(t *testing.T) {
 			name, ok := matchFile(tt.entry, tt.fileMap)
 			assert.Equal(t, tt.wantOK, ok)
 			if ok {
-				assert.Equal(t, tt.wantName, name)
+				wantName := tt.wantName
+				if len(tt.fileMap) == 0 {
+					wantName = executableName(wantName)
+				}
+				assert.Equal(t, wantName, name)
 			}
 		})
 	}
diff --git a/pkg/tools/builtin/shell/helpers_other_test.go b/pkg/tools/builtin/shell/helpers_other_test.go
index 790241151..187218065 100644
--- a/pkg/tools/builtin/shell/helpers_other_test.go
+++ b/pkg/tools/builtin/shell/helpers_other_test.go
@@ -35,6 +35,10 @@ func envDumpCmd() string {
 	return "env"
 }
 
+func envDumpContainsName(output, name string) bool {
+	return strings.Contains(output, "name="+name)
+}
+
 // printEnvValueCmd returns a command printing the value of one
 // environment variable, without a trailing newline.
 func printEnvValueCmd(name string) string {
diff --git a/pkg/tools/builtin/shell/helpers_windows_test.go b/pkg/tools/builtin/shell/helpers_windows_test.go
index ccadb6122..45061f2f8 100644
--- a/pkg/tools/builtin/shell/helpers_windows_test.go
+++ b/pkg/tools/builtin/shell/helpers_windows_test.go
@@ -44,7 +44,11 @@ func pwdCmd() string {
 // format; it is addressed via SystemRoot (always injected by os/exec on
 // Windows) because the test env may not contain PATH.
 func envDumpCmd() string {
-	return `Get-ChildItem Env: | ForEach-Object { [Console]::Out.WriteLine($_.Name + '=' + $_.Value) }`
+	return `[Console]::Out.Write([Environment]::GetEnvironmentVariable('name'))`
+}
+
+func envDumpContainsName(output, name string) bool {
+	return strings.Contains(output, name)
 }
 
 // printEnvValueCmd returns a command printing the value of one
diff --git a/pkg/tools/builtin/shell/script_shell_test.go b/pkg/tools/builtin/shell/script_shell_test.go
index 7c2d5dab4..600383789 100644
--- a/pkg/tools/builtin/shell/script_shell_test.go
+++ b/pkg/tools/builtin/shell/script_shell_test.go
@@ -232,7 +232,7 @@ func TestScriptShellTool_DropsUndeclaredArgs(t *testing.T) {
 	}, tools.NopRuntime{})
 	require.NoError(t, err)
 	assert.False(t, result.IsError, "unexpected error: %s", result.Output)
-	assert.Contains(t, result.Output, "name=alice")
+	assert.True(t, envDumpContainsName(result.Output, "alice"), "output %q does not expose the declared arg", result.Output)
 	assert.NotContains(t, result.Output, "LD_PRELOAD")
 }
 
diff --git a/pkg/tui/tui_perf_harness_test.go b/pkg/tui/tui_perf_harness_test.go
index 0c67fa764..4b2e216e8 100644
--- a/pkg/tui/tui_perf_harness_test.go
+++ b/pkg/tui/tui_perf_harness_test.go
@@ -20,7 +20,7 @@ func wallClockRoot(tb testing.TB, width, height int) *appModel {
 	sess := &session.Session{ID: "profile", Title: "profile"}
 	a := app.New(tb.Context(), stubRuntime{}, sess)
 	m := New(tb.Context(), nil, a, "", func() {}, WithHideSidebar()).(*appModel)
-	if cleaner, ok := tb.(interface{ Cleanup(func()) }); ok {
+	if cleaner, ok := tb.(interface{ Cleanup(f func()) }); ok {
 		cleaner.Cleanup(m.cleanupManagedResources)
 	}
 	m.supervisor = supervisor.New(nil)

From 6778b38924244960a41768fc024fa49239edf77c Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 15:33:37 +0200
Subject: [PATCH 12/18] fix(fake): normalize Windows prompt paths

---
 pkg/fake/proxy.go      |   2 +-
 pkg/fake/proxy_test.go | 439 ++---------------------------------------
 2 files changed, 18 insertions(+), 423 deletions(-)

diff --git a/pkg/fake/proxy.go b/pkg/fake/proxy.go
index 692435636..46c546b38 100644
--- a/pkg/fake/proxy.go
+++ b/pkg/fake/proxy.go
@@ -293,7 +293,7 @@ func DefaultMatcher(onError func(err error)) recorder.MatcherFunc {
 	// recorded without it.
 	toolChoiceRegex := regexp.MustCompile(`"tool_choice":"[^"]*",?`)
 	// Normalize prompt-file paths (they are machine-specific absolute paths).
-	promptFileRegex := regexp.MustCompile(`Instructions from: [^\\"]+`)
+	promptFileRegex := regexp.MustCompile(`Instructions from: (?:[^\\"]|\\\\)+`)
 
 	return func(r *http.Request, i cassette.Request) bool {
 		if r.Body == nil || r.Body == http.NoBody {
diff --git a/pkg/fake/proxy_test.go b/pkg/fake/proxy_test.go
index 223281896..62c082ffe 100644
--- a/pkg/fake/proxy_test.go
+++ b/pkg/fake/proxy_test.go
@@ -1,433 +1,28 @@
 package fake
 
 import (
-	"bytes"
-	"context"
 	"io"
 	"net/http"
-	"net/http/httptest"
+	"strings"
 	"testing"
-	"time"
 
-	"github.com/labstack/echo/v4"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"gopkg.in/dnaeon/go-vcr.v4/pkg/cassette"
 )
 
-func TestAPIKeyHeaderUpdater(t *testing.T) {
-	tests := []struct {
-		name           string
-		host           string
-		envKey         string
-		envValue       string
-		expectedHeader string
-		expectedValue  string
-	}{
-		{
-			name:           "OpenAI",
-			host:           "https://api.openai.com/v1",
-			envKey:         "OPENAI_API_KEY",
-			envValue:       "test-openai-key",
-			expectedHeader: "Authorization",
-			expectedValue:  "Bearer test-openai-key",
-		},
-		{
-			name:           "Anthropic",
-			host:           "https://api.anthropic.com",
-			envKey:         "ANTHROPIC_API_KEY",
-			envValue:       "test-anthropic-key",
-			expectedHeader: "X-Api-Key",
-			expectedValue:  "test-anthropic-key",
-		},
-		{
-			name:           "Google",
-			host:           "https://generativelanguage.googleapis.com",
-			envKey:         "GOOGLE_API_KEY",
-			envValue:       "test-google-key",
-			expectedHeader: "X-Goog-Api-Key",
-			expectedValue:  "test-google-key",
-		},
-		{
-			name:           "Mistral",
-			host:           "https://api.mistral.ai/v1",
-			envKey:         "MISTRAL_API_KEY",
-			envValue:       "test-mistral-key",
-			expectedHeader: "Authorization",
-			expectedValue:  "Bearer test-mistral-key",
-		},
-		{
-			name:           "OpenRouter",
-			host:           "https://openrouter.ai/api/v1",
-			envKey:         "OPENROUTER_API_KEY",
-			envValue:       "test-openrouter-key",
-			expectedHeader: "Authorization",
-			expectedValue:  "Bearer test-openrouter-key",
-		},
+func TestDefaultMatcherNormalizesPromptFilePaths(t *testing.T) {
+	matcher := DefaultMatcher(func(err error) { t.Fatal(err) })
+	cassetteBody := `{"system":[{"text":"Instructions from: FILE\nbody"}]}`
+
+	for _, body := range []string{
+		`{"system":[{"text":"Instructions from: /tmp/repo/AGENTS.md\nbody"}]}`,
+		`{"system":[{"text":"Instructions from: C:\\Users\\runner\\repo\\AGENTS.md\nbody"}]}`,
+	} {
+		req, err := http.NewRequest(http.MethodPost, "https://example.test/v1", io.NopCloser(strings.NewReader(body)))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !matcher(req, cassette.Request{Method: http.MethodPost, URL: "https://example.test/v1", Body: cassetteBody}) {
+			t.Fatalf("prompt path was not normalized: %s", body)
+		}
 	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv(tt.envKey, tt.envValue)
-
-			req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://example.com", http.NoBody)
-			require.NoError(t, err)
-
-			APIKeyHeaderUpdater(tt.host, req)
-
-			assert.Equal(t, tt.expectedValue, req.Header.Get(tt.expectedHeader))
-		})
-	}
-}
-
-func TestAPIKeyHeaderUpdater_UnknownHost(t *testing.T) {
-	t.Parallel()
-	req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://example.com", http.NoBody)
-	require.NoError(t, err)
-
-	APIKeyHeaderUpdater("https://unknown.host.com", req)
-
-	assert.Empty(t, req.Header.Get("Authorization"))
-	assert.Empty(t, req.Header.Get("X-Api-Key"))
-}
-
-func TestTargetURLForHost(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		host     string
-		expected bool
-	}{
-		{"https://api.openai.com/v1", true},
-		{"https://api.anthropic.com", true},
-		{"https://generativelanguage.googleapis.com", true},
-		{"https://api.mistral.ai/v1", true},
-		{"https://openrouter.ai/api/v1", true},
-		{"https://unknown.host.com", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.host, func(t *testing.T) {
-			t.Parallel()
-
-			fn := TargetURLForHost(tt.host)
-			if tt.expected {
-				assert.NotNil(t, fn)
-			} else {
-				assert.Nil(t, fn)
-			}
-		})
-	}
-}
-
-func TestTargetURLForHost_RewritesRequestURL(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		host string
-		path string
-		want string
-	}{
-		{
-			name: "OpenAI",
-			host: "https://api.openai.com/v1",
-			path: "/v1/chat/completions?stream=true",
-			want: "https://api.openai.com/v1/chat/completions?stream=true",
-		},
-		{
-			name: "OpenRouter preserves API prefix",
-			host: "https://openrouter.ai/api/v1",
-			path: "/v1/chat/completions?stream=true",
-			want: "https://openrouter.ai/api/v1/chat/completions?stream=true",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			fn := TargetURLForHost(tt.host)
-			require.NotNil(t, fn)
-
-			req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, tt.path, http.NoBody)
-			assert.Equal(t, tt.want, fn(req))
-		})
-	}
-}
-
-// slowReader is a reader that blocks until the context is canceled or data is written
-type slowReader struct {
-	data   chan []byte
-	closed chan struct{}
-}
-
-func newSlowReader() *slowReader {
-	return &slowReader{
-		data:   make(chan []byte, 1),
-		closed: make(chan struct{}),
-	}
-}
-
-func (r *slowReader) Read(p []byte) (n int, err error) {
-	select {
-	case data := <-r.data:
-		return copy(p, data), nil
-	case <-r.closed:
-		return 0, io.EOF
-	}
-}
-
-func (r *slowReader) Close() error {
-	close(r.closed)
-	return nil
-}
-
-// readerFromRecorder wraps httptest.ResponseRecorder to implement io.ReaderFrom
-type readerFromRecorder struct {
-	*httptest.ResponseRecorder
-}
-
-func (r *readerFromRecorder) ReadFrom(src io.Reader) (n int64, err error) {
-	return io.Copy(r.ResponseRecorder, src)
-}
-
-func TestIsStreamResponse(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		name        string
-		contentType string
-		body        string
-		want        bool
-	}{
-		{
-			name:        "SSE content type",
-			contentType: "text/event-stream",
-			body:        "data: hello",
-			want:        true,
-		},
-		{
-			name:        "No headers but SSE data body",
-			contentType: "",
-			body:        "data: {\"chunk\": 1}\n",
-			want:        true,
-		},
-		{
-			name:        "No headers but SSE event body (Anthropic format)",
-			contentType: "",
-			body:        "event: message_start\ndata: {\"type\":\"message_start\"}\n",
-			want:        true,
-		},
-		{
-			name:        "JSON response",
-			contentType: "application/json",
-			body:        `{"result": "ok"}`,
-			want:        false,
-		},
-		{
-			name:        "No headers, non-SSE body",
-			contentType: "",
-			body:        `{"result": "ok"}`,
-			want:        false,
-		},
-		{
-			name:        "NDJSON content type",
-			contentType: "application/x-ndjson",
-			body:        `{"line":1}`,
-			want:        true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			resp := &http.Response{
-				Header: http.Header{},
-				Body:   io.NopCloser(bytes.NewReader([]byte(tt.body))),
-			}
-			if tt.contentType != "" {
-				resp.Header.Set("Content-Type", tt.contentType)
-			}
-
-			got := IsStreamResponse(resp)
-			assert.Equal(t, tt.want, got)
-
-			// Verify body can still be read after peeking
-			body, err := io.ReadAll(resp.Body)
-			require.NoError(t, err)
-			assert.Equal(t, tt.body, string(body))
-		})
-	}
-}
-
-func TestStreamCopy_ContextCancellation(t *testing.T) {
-	t.Parallel()
-	// Create a slow reader that blocks until closed
-	slowBody := newSlowReader()
-
-	// Create a mock HTTP response with the slow reader
-	resp := &http.Response{
-		Body: slowBody,
-	}
-
-	// Create an echo context with a request that has a cancelable context
-	e := echo.New()
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
-	rec := &readerFromRecorder{httptest.NewRecorder()}
-	ctx, cancel := context.WithCancel(t.Context())
-	req = req.WithContext(ctx)
-	c := e.NewContext(req, rec)
-
-	// Start StreamCopy in a goroutine
-	done := make(chan error, 1)
-	go func() {
-		done <- StreamCopy(c, resp)
-	}()
-
-	// Write some data to ensure StreamCopy is actively reading before we cancel
-	slowBody.data <- []byte("initial")
-
-	// Cancel the context - this should cause StreamCopy to return immediately
-	cancel()
-
-	// StreamCopy should return within a reasonable time
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(2 * time.Second):
-		t.Fatal("StreamCopy did not return after context cancellation")
-	}
-}
-
-func TestStreamCopy_NormalCompletion(t *testing.T) {
-	t.Parallel()
-	// Create a response with a normal body
-	body := bytes.NewReader([]byte("test data"))
-	resp := &http.Response{
-		Body: io.NopCloser(body),
-	}
-
-	// Create an echo context with a wrapped recorder
-	e := echo.New()
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
-	rec := &readerFromRecorder{httptest.NewRecorder()}
-	c := e.NewContext(req, rec)
-
-	// StreamCopy should complete successfully
-	err := StreamCopy(c, resp)
-	require.NoError(t, err)
-
-	// Verify the data was written
-	assert.Equal(t, "test data", rec.Body.String())
-}
-
-func TestSimulatedStreamCopy_SSEEvents(t *testing.T) {
-	t.Parallel()
-	// Create a response with SSE-formatted data
-	sseData := "data: {\"chunk\": 1}\n\ndata: {\"chunk\": 2}\n\ndata: [DONE]\n\n"
-	resp := &http.Response{
-		Body: io.NopCloser(bytes.NewReader([]byte(sseData))),
-	}
-
-	// Create an echo context
-	e := echo.New()
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
-	rec := httptest.NewRecorder()
-	c := e.NewContext(req, rec)
-
-	// Use a short delay for testing
-	chunkDelay := 10 * time.Millisecond
-
-	start := time.Now()
-	err := SimulatedStreamCopy(c, resp, chunkDelay)
-	elapsed := time.Since(start)
-	require.NoError(t, err)
-
-	// Verify the data was written (with newlines from scanner)
-	assert.Contains(t, rec.Body.String(), "data: {\"chunk\": 1}")
-	assert.Contains(t, rec.Body.String(), "data: {\"chunk\": 2}")
-	assert.Contains(t, rec.Body.String(), "data: [DONE]")
-
-	// Verify delays were applied (3 data lines = at least 3 * 10ms = 30ms)
-	assert.GreaterOrEqual(t, elapsed, 3*chunkDelay, "should have delays between data chunks")
-}
-
-// notifyWriter wraps an http.ResponseWriter and signals on first Write.
-type notifyWriter struct {
-	http.ResponseWriter
-
-	notify   chan struct{}
-	notified bool
-}
-
-func (w *notifyWriter) Write(p []byte) (int, error) {
-	n, err := w.ResponseWriter.Write(p)
-	if n > 0 && !w.notified {
-		w.notified = true
-		close(w.notify)
-	}
-	return n, err
-}
-
-func (w *notifyWriter) Flush() {
-	if f, ok := w.ResponseWriter.(http.Flusher); ok {
-		f.Flush()
-	}
-}
-
-func TestSimulatedStreamCopy_ContextCancellation(t *testing.T) {
-	t.Parallel()
-	// Create a reader that provides some data then blocks
-	// to allow context cancellation to be tested
-	sseData := "data: first\n"
-	reader, writer := io.Pipe()
-
-	// Write first chunk then leave pipe open (simulating slow stream)
-	go func() {
-		_, _ = writer.Write([]byte(sseData))
-		// Don't close - leave it blocking
-	}()
-
-	resp := &http.Response{
-		Body: reader,
-	}
-
-	e := echo.New()
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
-	rec := httptest.NewRecorder()
-	ctx, cancel := context.WithCancel(t.Context())
-	req = req.WithContext(ctx)
-
-	// Wrap the recorder so we get notified when the first chunk is written,
-	// without racing on rec.Body.
-	firstWrite := make(chan struct{})
-	nw := &notifyWriter{ResponseWriter: rec, notify: firstWrite}
-	c := e.NewContext(req, nw)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- SimulatedStreamCopy(c, resp, 10*time.Millisecond)
-	}()
-
-	// Wait until the first chunk has been written to the recorder.
-	select {
-	case <-firstWrite:
-	case <-time.After(2 * time.Second):
-		t.Fatal("timed out waiting for first chunk to be written")
-	}
-
-	// Cancel the context and close the body (simulating client disconnect)
-	cancel()
-	_ = reader.Close()
-	_ = writer.Close()
-
-	// Should return promptly
-	select {
-	case err := <-done:
-		// May return an error due to pipe closed, that's ok
-		_ = err
-	case <-time.After(2 * time.Second):
-		t.Fatal("SimulatedStreamCopy did not return after context cancellation")
-	}
-
-	// Verify first chunk was written (safe to read after goroutine finished)
-	assert.Contains(t, rec.Body.String(), "data: first")
 }

From 150e6458966bb81f965f41bfa6f78a4391896e61 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 15:34:18 +0200
Subject: [PATCH 13/18] test(fake): preserve proxy coverage

---
 pkg/fake/proxy_test.go | 430 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 426 insertions(+), 4 deletions(-)

diff --git a/pkg/fake/proxy_test.go b/pkg/fake/proxy_test.go
index 62c082ffe..79b3903c7 100644
--- a/pkg/fake/proxy_test.go
+++ b/pkg/fake/proxy_test.go
@@ -1,14 +1,439 @@
 package fake
 
 import (
+	"bytes"
+	"context"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/labstack/echo/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"gopkg.in/dnaeon/go-vcr.v4/pkg/cassette"
 )
 
+func TestAPIKeyHeaderUpdater(t *testing.T) {
+	tests := []struct {
+		name           string
+		host           string
+		envKey         string
+		envValue       string
+		expectedHeader string
+		expectedValue  string
+	}{
+		{
+			name:           "OpenAI",
+			host:           "https://api.openai.com/v1",
+			envKey:         "OPENAI_API_KEY",
+			envValue:       "test-openai-key",
+			expectedHeader: "Authorization",
+			expectedValue:  "Bearer test-openai-key",
+		},
+		{
+			name:           "Anthropic",
+			host:           "https://api.anthropic.com",
+			envKey:         "ANTHROPIC_API_KEY",
+			envValue:       "test-anthropic-key",
+			expectedHeader: "X-Api-Key",
+			expectedValue:  "test-anthropic-key",
+		},
+		{
+			name:           "Google",
+			host:           "https://generativelanguage.googleapis.com",
+			envKey:         "GOOGLE_API_KEY",
+			envValue:       "test-google-key",
+			expectedHeader: "X-Goog-Api-Key",
+			expectedValue:  "test-google-key",
+		},
+		{
+			name:           "Mistral",
+			host:           "https://api.mistral.ai/v1",
+			envKey:         "MISTRAL_API_KEY",
+			envValue:       "test-mistral-key",
+			expectedHeader: "Authorization",
+			expectedValue:  "Bearer test-mistral-key",
+		},
+		{
+			name:           "OpenRouter",
+			host:           "https://openrouter.ai/api/v1",
+			envKey:         "OPENROUTER_API_KEY",
+			envValue:       "test-openrouter-key",
+			expectedHeader: "Authorization",
+			expectedValue:  "Bearer test-openrouter-key",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(tt.envKey, tt.envValue)
+
+			req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://example.com", http.NoBody)
+			require.NoError(t, err)
+
+			APIKeyHeaderUpdater(tt.host, req)
+
+			assert.Equal(t, tt.expectedValue, req.Header.Get(tt.expectedHeader))
+		})
+	}
+}
+
+func TestAPIKeyHeaderUpdater_UnknownHost(t *testing.T) {
+	t.Parallel()
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://example.com", http.NoBody)
+	require.NoError(t, err)
+
+	APIKeyHeaderUpdater("https://unknown.host.com", req)
+
+	assert.Empty(t, req.Header.Get("Authorization"))
+	assert.Empty(t, req.Header.Get("X-Api-Key"))
+}
+
+func TestTargetURLForHost(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		host     string
+		expected bool
+	}{
+		{"https://api.openai.com/v1", true},
+		{"https://api.anthropic.com", true},
+		{"https://generativelanguage.googleapis.com", true},
+		{"https://api.mistral.ai/v1", true},
+		{"https://openrouter.ai/api/v1", true},
+		{"https://unknown.host.com", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.host, func(t *testing.T) {
+			t.Parallel()
+
+			fn := TargetURLForHost(tt.host)
+			if tt.expected {
+				assert.NotNil(t, fn)
+			} else {
+				assert.Nil(t, fn)
+			}
+		})
+	}
+}
+
+func TestTargetURLForHost_RewritesRequestURL(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		host string
+		path string
+		want string
+	}{
+		{
+			name: "OpenAI",
+			host: "https://api.openai.com/v1",
+			path: "/v1/chat/completions?stream=true",
+			want: "https://api.openai.com/v1/chat/completions?stream=true",
+		},
+		{
+			name: "OpenRouter preserves API prefix",
+			host: "https://openrouter.ai/api/v1",
+			path: "/v1/chat/completions?stream=true",
+			want: "https://openrouter.ai/api/v1/chat/completions?stream=true",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			fn := TargetURLForHost(tt.host)
+			require.NotNil(t, fn)
+
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, tt.path, http.NoBody)
+			assert.Equal(t, tt.want, fn(req))
+		})
+	}
+}
+
+// slowReader is a reader that blocks until the context is canceled or data is written
+type slowReader struct {
+	data   chan []byte
+	closed chan struct{}
+}
+
+func newSlowReader() *slowReader {
+	return &slowReader{
+		data:   make(chan []byte, 1),
+		closed: make(chan struct{}),
+	}
+}
+
+func (r *slowReader) Read(p []byte) (n int, err error) {
+	select {
+	case data := <-r.data:
+		return copy(p, data), nil
+	case <-r.closed:
+		return 0, io.EOF
+	}
+}
+
+func (r *slowReader) Close() error {
+	close(r.closed)
+	return nil
+}
+
+// readerFromRecorder wraps httptest.ResponseRecorder to implement io.ReaderFrom
+type readerFromRecorder struct {
+	*httptest.ResponseRecorder
+}
+
+func (r *readerFromRecorder) ReadFrom(src io.Reader) (n int64, err error) {
+	return io.Copy(r.ResponseRecorder, src)
+}
+
+func TestIsStreamResponse(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name        string
+		contentType string
+		body        string
+		want        bool
+	}{
+		{
+			name:        "SSE content type",
+			contentType: "text/event-stream",
+			body:        "data: hello",
+			want:        true,
+		},
+		{
+			name:        "No headers but SSE data body",
+			contentType: "",
+			body:        "data: {\"chunk\": 1}\n",
+			want:        true,
+		},
+		{
+			name:        "No headers but SSE event body (Anthropic format)",
+			contentType: "",
+			body:        "event: message_start\ndata: {\"type\":\"message_start\"}\n",
+			want:        true,
+		},
+		{
+			name:        "JSON response",
+			contentType: "application/json",
+			body:        `{"result": "ok"}`,
+			want:        false,
+		},
+		{
+			name:        "No headers, non-SSE body",
+			contentType: "",
+			body:        `{"result": "ok"}`,
+			want:        false,
+		},
+		{
+			name:        "NDJSON content type",
+			contentType: "application/x-ndjson",
+			body:        `{"line":1}`,
+			want:        true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp := &http.Response{
+				Header: http.Header{},
+				Body:   io.NopCloser(bytes.NewReader([]byte(tt.body))),
+			}
+			if tt.contentType != "" {
+				resp.Header.Set("Content-Type", tt.contentType)
+			}
+
+			got := IsStreamResponse(resp)
+			assert.Equal(t, tt.want, got)
+
+			// Verify body can still be read after peeking
+			body, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			assert.Equal(t, tt.body, string(body))
+		})
+	}
+}
+
+func TestStreamCopy_ContextCancellation(t *testing.T) {
+	t.Parallel()
+	// Create a slow reader that blocks until closed
+	slowBody := newSlowReader()
+
+	// Create a mock HTTP response with the slow reader
+	resp := &http.Response{
+		Body: slowBody,
+	}
+
+	// Create an echo context with a request that has a cancelable context
+	e := echo.New()
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	rec := &readerFromRecorder{httptest.NewRecorder()}
+	ctx, cancel := context.WithCancel(t.Context())
+	req = req.WithContext(ctx)
+	c := e.NewContext(req, rec)
+
+	// Start StreamCopy in a goroutine
+	done := make(chan error, 1)
+	go func() {
+		done <- StreamCopy(c, resp)
+	}()
+
+	// Write some data to ensure StreamCopy is actively reading before we cancel
+	slowBody.data <- []byte("initial")
+
+	// Cancel the context - this should cause StreamCopy to return immediately
+	cancel()
+
+	// StreamCopy should return within a reasonable time
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(2 * time.Second):
+		t.Fatal("StreamCopy did not return after context cancellation")
+	}
+}
+
+func TestStreamCopy_NormalCompletion(t *testing.T) {
+	t.Parallel()
+	// Create a response with a normal body
+	body := bytes.NewReader([]byte("test data"))
+	resp := &http.Response{
+		Body: io.NopCloser(body),
+	}
+
+	// Create an echo context with a wrapped recorder
+	e := echo.New()
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	rec := &readerFromRecorder{httptest.NewRecorder()}
+	c := e.NewContext(req, rec)
+
+	// StreamCopy should complete successfully
+	err := StreamCopy(c, resp)
+	require.NoError(t, err)
+
+	// Verify the data was written
+	assert.Equal(t, "test data", rec.Body.String())
+}
+
+func TestSimulatedStreamCopy_SSEEvents(t *testing.T) {
+	t.Parallel()
+	// Create a response with SSE-formatted data
+	sseData := "data: {\"chunk\": 1}\n\ndata: {\"chunk\": 2}\n\ndata: [DONE]\n\n"
+	resp := &http.Response{
+		Body: io.NopCloser(bytes.NewReader([]byte(sseData))),
+	}
+
+	// Create an echo context
+	e := echo.New()
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	// Use a short delay for testing
+	chunkDelay := 10 * time.Millisecond
+
+	start := time.Now()
+	err := SimulatedStreamCopy(c, resp, chunkDelay)
+	elapsed := time.Since(start)
+	require.NoError(t, err)
+
+	// Verify the data was written (with newlines from scanner)
+	assert.Contains(t, rec.Body.String(), "data: {\"chunk\": 1}")
+	assert.Contains(t, rec.Body.String(), "data: {\"chunk\": 2}")
+	assert.Contains(t, rec.Body.String(), "data: [DONE]")
+
+	// Verify delays were applied (3 data lines = at least 3 * 10ms = 30ms)
+	assert.GreaterOrEqual(t, elapsed, 3*chunkDelay, "should have delays between data chunks")
+}
+
+// notifyWriter wraps an http.ResponseWriter and signals on first Write.
+type notifyWriter struct {
+	http.ResponseWriter
+
+	notify   chan struct{}
+	notified bool
+}
+
+func (w *notifyWriter) Write(p []byte) (int, error) {
+	n, err := w.ResponseWriter.Write(p)
+	if n > 0 && !w.notified {
+		w.notified = true
+		close(w.notify)
+	}
+	return n, err
+}
+
+func (w *notifyWriter) Flush() {
+	if f, ok := w.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+func TestSimulatedStreamCopy_ContextCancellation(t *testing.T) {
+	t.Parallel()
+	// Create a reader that provides some data then blocks
+	// to allow context cancellation to be tested
+	sseData := "data: first\n"
+	reader, writer := io.Pipe()
+
+	// Write first chunk then leave pipe open (simulating slow stream)
+	go func() {
+		_, _ = writer.Write([]byte(sseData))
+		// Don't close - leave it blocking
+	}()
+
+	resp := &http.Response{
+		Body: reader,
+	}
+
+	e := echo.New()
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", http.NoBody)
+	rec := httptest.NewRecorder()
+	ctx, cancel := context.WithCancel(t.Context())
+	req = req.WithContext(ctx)
+
+	// Wrap the recorder so we get notified when the first chunk is written,
+	// without racing on rec.Body.
+	firstWrite := make(chan struct{})
+	nw := &notifyWriter{ResponseWriter: rec, notify: firstWrite}
+	c := e.NewContext(req, nw)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- SimulatedStreamCopy(c, resp, 10*time.Millisecond)
+	}()
+
+	// Wait until the first chunk has been written to the recorder.
+	select {
+	case <-firstWrite:
+	case <-time.After(2 * time.Second):
+		t.Fatal("timed out waiting for first chunk to be written")
+	}
+
+	// Cancel the context and close the body (simulating client disconnect)
+	cancel()
+	_ = reader.Close()
+	_ = writer.Close()
+
+	// Should return promptly
+	select {
+	case err := <-done:
+		// May return an error due to pipe closed, that's ok
+		_ = err
+	case <-time.After(2 * time.Second):
+		t.Fatal("SimulatedStreamCopy did not return after context cancellation")
+	}
+
+	// Verify first chunk was written (safe to read after goroutine finished)
+	assert.Contains(t, rec.Body.String(), "data: first")
+}
+
 func TestDefaultMatcherNormalizesPromptFilePaths(t *testing.T) {
 	matcher := DefaultMatcher(func(err error) { t.Fatal(err) })
 	cassetteBody := `{"system":[{"text":"Instructions from: FILE\nbody"}]}`
@@ -17,10 +442,7 @@ func TestDefaultMatcherNormalizesPromptFilePaths(t *testing.T) {
 		`{"system":[{"text":"Instructions from: /tmp/repo/AGENTS.md\nbody"}]}`,
 		`{"system":[{"text":"Instructions from: C:\\Users\\runner\\repo\\AGENTS.md\nbody"}]}`,
 	} {
-		req, err := http.NewRequest(http.MethodPost, "https://example.test/v1", io.NopCloser(strings.NewReader(body)))
-		if err != nil {
-			t.Fatal(err)
-		}
+		req := httptest.NewRequest(http.MethodPost, "https://example.test/v1", strings.NewReader(body))
 		if !matcher(req, cassette.Request{Method: http.MethodPost, URL: "https://example.test/v1", Body: cassetteBody}) {
 			t.Fatalf("prompt path was not normalized: %s", body)
 		}

From 6c1fbd1f22f6312aa8820b693d5d8dd3e4f5a2a9 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 15:48:44 +0200
Subject: [PATCH 14/18] test(fake): use contextual request

---
 pkg/fake/proxy_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/fake/proxy_test.go b/pkg/fake/proxy_test.go
index 79b3903c7..f54ff4799 100644
--- a/pkg/fake/proxy_test.go
+++ b/pkg/fake/proxy_test.go
@@ -442,7 +442,7 @@ func TestDefaultMatcherNormalizesPromptFilePaths(t *testing.T) {
 		`{"system":[{"text":"Instructions from: /tmp/repo/AGENTS.md\nbody"}]}`,
 		`{"system":[{"text":"Instructions from: C:\\Users\\runner\\repo\\AGENTS.md\nbody"}]}`,
 	} {
-		req := httptest.NewRequest(http.MethodPost, "https://example.test/v1", strings.NewReader(body))
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "https://example.test/v1", strings.NewReader(body))
 		if !matcher(req, cassette.Request{Method: http.MethodPost, URL: "https://example.test/v1", Body: cassetteBody}) {
 			t.Fatalf("prompt path was not normalized: %s", body)
 		}

From 526f89d6cb4810957f5ec37a1ce49a5ad6ec657d Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 15:59:32 +0200
Subject: [PATCH 15/18] ci: make Windows tests blocking

---
 .github/workflows/ci.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 00aa10ffb..1d1fee73e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,8 +74,8 @@ jobs:
           task test-binary
 
   # Native Windows tests. Plan storage relies on OS-specific file locking and
-  # path semantics, so its tests are a blocking gate; the remaining suite runs
-  # non-blocking (continue-on-error) while Windows failures are triaged.
+  # path semantics, so its tests run first as a dedicated gate; the remaining
+  # suite runs afterwards and is blocking as well.
   windows-tests:
     runs-on: windows-latest
     timeout-minutes: 30
@@ -98,7 +98,6 @@ jobs:
       # Run everything except the plan packages covered above. Splatting the
       # package list avoids command-line length limits and quoting ambiguity.
       - name: Run remaining tests
-        continue-on-error: true
         env:
           # Mirror .env.test: blank out provider credentials on the runner.
           DOCKER_AGENT_MODELS_GATEWAY: ""

From c394fed9f6b112da1acf2fc9a9de294c4242e0a7 Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Thu, 30 Jul 2026 16:22:51 +0200
Subject: [PATCH 16/18] fix: address Windows review findings

---
 pkg/fake/proxy.go                  | 2 +-
 pkg/sandbox/kit/kit.go             | 4 ----
 pkg/sandbox/kit/kit_test.go        | 8 +++++---
 pkg/toolinstall/publish_windows.go | 1 -
 4 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkg/fake/proxy.go b/pkg/fake/proxy.go
index 46c546b38..965fe0996 100644
--- a/pkg/fake/proxy.go
+++ b/pkg/fake/proxy.go
@@ -293,7 +293,7 @@ func DefaultMatcher(onError func(err error)) recorder.MatcherFunc {
 	// recorded without it.
 	toolChoiceRegex := regexp.MustCompile(`"tool_choice":"[^"]*",?`)
 	// Normalize prompt-file paths (they are machine-specific absolute paths).
-	promptFileRegex := regexp.MustCompile(`Instructions from: (?:[^\\"]|\\\\)+`)
+	promptFileRegex := regexp.MustCompile(`Instructions from: (?:[^\\"\r\n]|\\\\)+`)
 
 	return func(r *http.Request, i cassette.Request) bool {
 		if r.Body == nil || r.Body == http.NoBody {
diff --git a/pkg/sandbox/kit/kit.go b/pkg/sandbox/kit/kit.go
index 605af7482..3ec150992 100644
--- a/pkg/sandbox/kit/kit.go
+++ b/pkg/sandbox/kit/kit.go
@@ -34,7 +34,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"runtime"
 	"slices"
 	"sort"
 	"strconv"
@@ -726,9 +725,6 @@ func copyFile(kitRoot, src, dst string) (*Redaction, error) {
 	}
 
 	mode := srcInfo.Mode().Perm() & 0o700
-	if runtime.GOOS == "windows" && filepath.Ext(src) == ".sh" {
-		mode = 0o700
-	}
 	if mode == 0 {
 		mode = 0o600
 	}
diff --git a/pkg/sandbox/kit/kit_test.go b/pkg/sandbox/kit/kit_test.go
index 3faa7995a..c997c56c5 100644
--- a/pkg/sandbox/kit/kit_test.go
+++ b/pkg/sandbox/kit/kit_test.go
@@ -450,10 +450,12 @@ func TestBuild_PreservesExecutableBit(t *testing.T) {
 	staged := filepath.Join(res.HostDir, skills.KitSkillsSubdir, "with-script", "run.sh")
 	info, err := os.Stat(staged)
 	require.NoError(t, err)
-	if runtime.GOOS != "windows" {
-		assert.NotZero(t, info.Mode().Perm()&0o100,
-			"staged script %s must keep its executable bit (got %v)", staged, info.Mode())
+	if runtime.GOOS == "windows" {
+		assert.FileExists(t, staged)
+		return
 	}
+	assert.NotZero(t, info.Mode().Perm()&0o100,
+		"staged script %s must keep its executable bit (got %v)", staged, info.Mode())
 }
 
 func TestBuild_OnDiskManifestOmitsHostPaths(t *testing.T) {
diff --git a/pkg/toolinstall/publish_windows.go b/pkg/toolinstall/publish_windows.go
index e709c375e..d3a19ef4a 100644
--- a/pkg/toolinstall/publish_windows.go
+++ b/pkg/toolinstall/publish_windows.go
@@ -21,7 +21,6 @@ func publishBinary(name, target string) error {
 	if err := os.Link(target, tmpLink); err != nil {
 		return fmt.Errorf("creating temp hard link %s -> %s: %w", tmpLink, target, err)
 	}
-	_ = os.Remove(link)
 	if err := os.Rename(tmpLink, link); err != nil {
 		_ = os.Remove(tmpLink)
 		return fmt.Errorf("renaming hard link %s -> %s: %w", tmpLink, link, err)

From fcf38ee9a168b81ef361c09f9a11729ad21bf98d Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Fri, 31 Jul 2026 10:26:14 +0200
Subject: [PATCH 17/18] ci: run Windows tests with Task

---
 .github/workflows/ci.yml | 37 +++++++++----------------------------
 1 file changed, 9 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d1fee73e..a8b1adc3c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,8 +74,8 @@ jobs:
           task test-binary
 
   # Native Windows tests. Plan storage relies on OS-specific file locking and
-  # path semantics, so its tests run first as a dedicated gate; the remaining
-  # suite runs afterwards and is blocking as well.
+  # path semantics, so the full Go test suite runs natively on Windows in a
+  # single blocking `task test` step, mirroring the Linux job.
   windows-tests:
     runs-on: windows-latest
     timeout-minutes: 30
@@ -89,35 +89,16 @@ jobs:
           go-version-file: go.mod
           cache-dependency-path: go.sum
 
+      - name: Install Task
+        uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
+        with:
+          version: 3.51.1
+
       - name: Go environment
         run: go env GOOS GOARCH CGO_ENABLED CC
 
-      - name: Run plan tests
-        run: go test -count=1 ./pkg/tools/builtin/plan/ ./pkg/plans/
-
-      # Run everything except the plan packages covered above. Splatting the
-      # package list avoids command-line length limits and quoting ambiguity.
-      - name: Run remaining tests
-        env:
-          # Mirror .env.test: blank out provider credentials on the runner.
-          DOCKER_AGENT_MODELS_GATEWAY: ""
-          OPENAI_API_KEY: ""
-          ANTHROPIC_API_KEY: ""
-          GOOGLE_API_KEY: ""
-          GOOGLE_GENAI_USE_VERTEXAI: ""
-          MISTRAL_API_KEY: ""
-          OPENROUTER_API_KEY: ""
-        shell: pwsh
-        run: |
-          $exclude = @(
-            'github.com/docker/docker-agent/pkg/tools/builtin/plan'
-            'github.com/docker/docker-agent/pkg/plans'
-          )
-          $listed = @(go list ./...)
-          if ($LASTEXITCODE -ne 0) { throw "go list failed with exit code $LASTEXITCODE" }
-          $packages = @($listed | Where-Object { $_ -notin $exclude -and -not [string]::IsNullOrWhiteSpace($_) })
-          if ($packages.Count -eq 0) { throw 'go list returned no packages to test' }
-          go test -count=1 @packages
+      - name: Run tests
+        run: task test
 
   license-check:
     runs-on: ubuntu-latest

From d50e228ddf431cee37b0353cf9dff956b30813af Mon Sep 17 00:00:00 2001
From: Sayt-0 <louis-dalmorocompta@docker.com>
Date: Fri, 31 Jul 2026 16:32:05 +0200
Subject: [PATCH 18/18] fix(paths): preserve native Windows home directory

---
 cmd/root/sandbox_cmd_test.go         |  4 +++-
 pkg/config/resolve_test.go           | 20 ++++++++++++++++++++
 pkg/history/history_test.go          | 28 +++++++++++++++++++++-------
 pkg/path/display_test.go             |  4 ++--
 pkg/paths/paths.go                   | 13 +++----------
 pkg/paths/paths_test.go              | 15 +++++++++++----
 pkg/runtime/lazy_model_store_test.go |  7 +++++--
 pkg/sandbox/kit/kit_test.go          | 16 ++++++++++++++++
 pkg/skills/remote_test.go            |  4 +++-
 pkg/skills/skills_test.go            | 11 +++++++++++
 pkg/teamloader/teamloader_test.go    |  4 +++-
 pkg/tui/tui_perf_harness_test.go     |  4 +++-
 pkg/userconfig/userconfig_test.go    |  2 ++
 13 files changed, 103 insertions(+), 29 deletions(-)

diff --git a/cmd/root/sandbox_cmd_test.go b/cmd/root/sandbox_cmd_test.go
index 21ef9d5bc..fabc54d7a 100644
--- a/cmd/root/sandbox_cmd_test.go
+++ b/cmd/root/sandbox_cmd_test.go
@@ -14,7 +14,9 @@ import (
 // to end against a temp HOME, verifying that allow / list / deny
 // round-trip through the user config.
 func TestSandboxAllowDenyList(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	root := NewRootCmd()
 	root.SetContext(t.Context())
diff --git a/pkg/config/resolve_test.go b/pkg/config/resolve_test.go
index 8e66d2b6e..6883b25fe 100644
--- a/pkg/config/resolve_test.go
+++ b/pkg/config/resolve_test.go
@@ -89,6 +89,7 @@ agents:
 func TestResolveAgentFile_EmptyIsDefault(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	resolved, err := resolve("")
 
@@ -99,6 +100,7 @@ func TestResolveAgentFile_EmptyIsDefault(t *testing.T) {
 func TestResolveAgentFile_DefaultIsDefault(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	resolved, err := resolve("default")
 
@@ -118,6 +120,7 @@ func TestResolveAgentFile_CoderIsCoder(t *testing.T) {
 func TestResolveAgentFile_ReplaceAliasWithActualFile(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Prepare an aliased file: alias -> [xxx]/pirate.yaml
 	wd := t.TempDir()
@@ -139,6 +142,7 @@ func TestResolveAgentFile_ReplaceAliasWithActualFile(t *testing.T) {
 func TestResolveAgentFile_ReplaceDefaultAliasWithActualFile(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Prepare an aliased file: alias -> [xxx]/pirate.yaml
 	wd := t.TempDir()
@@ -160,6 +164,7 @@ func TestResolveAgentFile_ReplaceDefaultAliasWithActualFile(t *testing.T) {
 func TestResolveAgentFile_ReplaceEmptyAliasWithActualFile(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Prepare an aliased file: alias -> [xxx]/pirate.yaml
 	wd := t.TempDir()
@@ -293,6 +298,7 @@ func TestResolveSources(t *testing.T) {
 func TestResolve_DefaultAliasOverride(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Create an agent file
 	agentFile := filepath.Join(t.TempDir(), "custom-agent.yaml")
@@ -344,6 +350,7 @@ func TestBuiltinAgentNames(t *testing.T) {
 func TestResolve_DefaultAliasToOCIReference(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias for "default" pointing to an OCI reference
 	cfg, err := userconfig.Load()
@@ -360,6 +367,7 @@ func TestResolve_DefaultAliasToOCIReference(t *testing.T) {
 func TestResolveSources_DefaultAliasToOCIReference(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias for "default" pointing to an OCI reference
 	cfg, err := userconfig.Load()
@@ -381,6 +389,7 @@ func TestResolveSources_DefaultAliasToOCIReference(t *testing.T) {
 func TestResolve_EmptyWithDefaultAliasOverride(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Create an agent file
 	agentFile := filepath.Join(t.TempDir(), "custom-agent.yaml")
@@ -410,6 +419,7 @@ func TestResolve_EmptyWithDefaultAliasOverride(t *testing.T) {
 func TestResolveSources_DefaultAliasOverride(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Create an agent file
 	agentFile := filepath.Join(t.TempDir(), "custom-agent.yaml")
@@ -443,6 +453,7 @@ func TestResolveSources_DefaultAliasOverride(t *testing.T) {
 func TestResolveSources_EmptyWithDefaultAliasOverride(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Create an agent file
 	agentFile := filepath.Join(t.TempDir(), "custom-agent.yaml")
@@ -476,6 +487,7 @@ func TestResolveSources_EmptyWithDefaultAliasOverride(t *testing.T) {
 func TestResolveAlias_WithYoloOption(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias with yolo option
 	cfg, err := userconfig.Load()
@@ -496,6 +508,7 @@ func TestResolveAlias_WithYoloOption(t *testing.T) {
 func TestResolveAlias_WithModelOption(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias with model option
 	cfg, err := userconfig.Load()
@@ -516,6 +529,7 @@ func TestResolveAlias_WithModelOption(t *testing.T) {
 func TestResolveAlias_WithBothOptions(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias with both options
 	cfg, err := userconfig.Load()
@@ -537,6 +551,7 @@ func TestResolveAlias_WithBothOptions(t *testing.T) {
 func TestResolveAlias_WithSandboxOption(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	cfg, err := userconfig.Load()
 	require.NoError(t, err)
@@ -555,6 +570,7 @@ func TestResolveAlias_WithSandboxOption(t *testing.T) {
 func TestResolveAlias_NoOptions(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias without options
 	cfg, err := userconfig.Load()
@@ -572,6 +588,7 @@ func TestResolveAlias_NoOptions(t *testing.T) {
 func TestResolveAlias_NotAnAlias(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Resolve non-existent alias
 	alias := ResolveAlias("./some-file.yaml")
@@ -581,6 +598,7 @@ func TestResolveAlias_NotAnAlias(t *testing.T) {
 func TestResolveAlias_EmptyUsesDefault(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up default alias with yolo option
 	cfg, err := userconfig.Load()
@@ -600,6 +618,7 @@ func TestResolveAlias_EmptyUsesDefault(t *testing.T) {
 func TestResolveAlias_WithHideToolResultsOption(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias with hide_tool_results option
 	cfg, err := userconfig.Load()
@@ -621,6 +640,7 @@ func TestResolveAlias_WithHideToolResultsOption(t *testing.T) {
 func TestResolveAlias_WithAllOptions(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up alias with all options
 	cfg, err := userconfig.Load()
diff --git a/pkg/history/history_test.go b/pkg/history/history_test.go
index d2fbe7134..8d86702b9 100644
--- a/pkg/history/history_test.go
+++ b/pkg/history/history_test.go
@@ -13,7 +13,9 @@ import (
 )
 
 func TestNew(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	h, err := New("")
 	require.NoError(t, err)
@@ -23,7 +25,9 @@ func TestNew(t *testing.T) {
 }
 
 func TestHistory_AddAndSave(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	h, err := New("")
 	require.NoError(t, err)
@@ -43,7 +47,9 @@ func TestHistory_AddAndSave(t *testing.T) {
 }
 
 func TestHistory_Navigation(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	h, err := New("")
 	require.NoError(t, err)
@@ -67,7 +73,9 @@ func TestHistory_Navigation(t *testing.T) {
 }
 
 func TestHistory_EdgeCases(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	h, err := New("")
 	require.NoError(t, err)
@@ -83,7 +91,9 @@ func TestHistory_EdgeCases(t *testing.T) {
 }
 
 func TestHistory_StayAtTheBeginning(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	h, err := New("")
 	require.NoError(t, err)
@@ -95,7 +105,9 @@ func TestHistory_StayAtTheBeginning(t *testing.T) {
 }
 
 func TestHistory_NoDuplicateMessages(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	h, err := New("")
 	require.NoError(t, err)
@@ -110,7 +122,9 @@ func TestHistory_NoDuplicateMessages(t *testing.T) {
 }
 
 func TestHistory_MoveDuplicateLast(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	h, err := New("")
 	require.NoError(t, err)
diff --git a/pkg/path/display_test.go b/pkg/path/display_test.go
index 06873a267..c8abb81eb 100644
--- a/pkg/path/display_test.go
+++ b/pkg/path/display_test.go
@@ -17,10 +17,10 @@ func TestRelativeTo(t *testing.T) {
 	assert.Equal(t, filepath.Join(base, "file.txt"), RelativeTo(filepath.Join(base, "file.txt"), "relative/base"))
 }
 
-func TestShortenHomeUsesHomeEnv(t *testing.T) {
+func TestShortenHomeUsesPlatformNativeHome(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
-	t.Setenv("USERPROFILE", filepath.Join(t.TempDir(), "profile"))
+	t.Setenv("USERPROFILE", home)
 
 	assert.Equal(t, filepath.Join("~", "file.txt"), ShortenHome(filepath.Join(home, "file.txt")))
 }
diff --git a/pkg/paths/paths.go b/pkg/paths/paths.go
index 6cf4c5270..d796d3e96 100644
--- a/pkg/paths/paths.go
+++ b/pkg/paths/paths.go
@@ -86,13 +86,6 @@ func GetCacheDir() string {
 	})
 }
 
-func userHomeDir() (string, error) {
-	if home := os.Getenv("HOME"); home != "" {
-		return home, nil
-	}
-	return os.UserHomeDir()
-}
-
 // GetConfigDir returns the user's config directory for docker agent.
 //
 // If an override has been set via [SetConfigDir] it is returned instead.
@@ -102,7 +95,7 @@ func userHomeDir() (string, error) {
 // not intended to be a security boundary.
 func GetConfigDir() string {
 	return configDirOverride.get(func() string {
-		homeDir, err := userHomeDir()
+		homeDir, err := os.UserHomeDir()
 		if err != nil {
 			return filepath.Clean(filepath.Join(os.TempDir(), ".cagent-config"))
 		}
@@ -118,7 +111,7 @@ func GetConfigDir() string {
 // under the system temporary directory.
 func GetDataDir() string {
 	return dataDirOverride.get(func() string {
-		homeDir, err := userHomeDir()
+		homeDir, err := os.UserHomeDir()
 		if err != nil {
 			return filepath.Clean(filepath.Join(os.TempDir(), ".cagent"))
 		}
@@ -130,7 +123,7 @@ func GetDataDir() string {
 //
 // Returns an empty string if the home directory cannot be determined.
 func GetHomeDir() string {
-	homeDir, err := userHomeDir()
+	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return ""
 	}
diff --git a/pkg/paths/paths_test.go b/pkg/paths/paths_test.go
index 4c7f6f3df..54e52a27f 100644
--- a/pkg/paths/paths_test.go
+++ b/pkg/paths/paths_test.go
@@ -1,10 +1,12 @@
 package paths_test
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/docker/docker-agent/pkg/paths"
 )
@@ -49,10 +51,15 @@ func TestGetHomeDir(t *testing.T) {
 	assert.NotEmpty(t, paths.GetHomeDir())
 }
 
-func TestGetHomeDirPrefersHomeEnv(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("HOME", home)
-	t.Setenv("USERPROFILE", filepath.Join(t.TempDir(), "profile"))
+func TestGetHomeDirUsesPlatformNativeHome(t *testing.T) {
+	// HOME and USERPROFILE deliberately differ: if a HOME preference is
+	// ever reintroduced, GetHomeDir diverges from os.UserHomeDir on
+	// Windows and this test fails there.
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("USERPROFILE", t.TempDir())
+
+	home, err := os.UserHomeDir()
+	require.NoError(t, err)
 
 	assert.Equal(t, filepath.Clean(home), paths.GetHomeDir())
 	assert.Equal(t, filepath.Join(home, ".config", "cagent"), paths.GetConfigDir())
diff --git a/pkg/runtime/lazy_model_store_test.go b/pkg/runtime/lazy_model_store_test.go
index a011c842c..f22114537 100644
--- a/pkg/runtime/lazy_model_store_test.go
+++ b/pkg/runtime/lazy_model_store_test.go
@@ -89,8 +89,11 @@ func TestLazyModelStore_DefersError(t *testing.T) {
 func TestLazyModelStore_GatesCustomProvider(t *testing.T) {
 	// Point the cache at an empty home so there is no on-disk catalog to fall
 	// back on: a cold start, as in a freshly-spawned pod. t.Setenv forbids
-	// t.Parallel, which is fine here.
-	t.Setenv("HOME", t.TempDir())
+	// t.Parallel, which is fine here. modelsdev.NewStore resolves the home
+	// via os.UserHomeDir, which reads USERPROFILE on Windows.
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	var store ModelStore = &lazyModelStore{}
 
diff --git a/pkg/sandbox/kit/kit_test.go b/pkg/sandbox/kit/kit_test.go
index c997c56c5..3577ac44c 100644
--- a/pkg/sandbox/kit/kit_test.go
+++ b/pkg/sandbox/kit/kit_test.go
@@ -47,6 +47,7 @@ func TestBuild_StagesSkillsAndRedacts(t *testing.T) {
 	require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(skillBody), 0o644))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	// Run from an empty cwd so cwd-walking finds nothing extra.
 	t.Chdir(t.TempDir())
 
@@ -92,6 +93,7 @@ func TestBuild_RebuildsCleanDir(t *testing.T) {
 	isolateEnv(t)
 	hostHome := t.TempDir()
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(t.TempDir())
 
 	// A local agent YAML gives us a stable, offline AgentRef. A bare
@@ -168,6 +170,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 
 	cacheDir := t.TempDir()
@@ -226,6 +229,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 
 	res, err := Build(t.Context(), Options{
@@ -283,6 +287,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 
 	res, err := Build(t.Context(), Options{
@@ -312,6 +317,7 @@ func TestBuild_NoAgentRefLeavesPromptFilesEmpty(t *testing.T) {
 	// prompt files are staged.
 	hostHome := t.TempDir()
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(t.TempDir())
 
 	cacheDir := t.TempDir()
@@ -374,6 +380,7 @@ func TestBuild_DropsSymlinksEscapingSkillRoot(t *testing.T) {
 	require.NoError(t, os.Symlink(secretFile, filepath.Join(skillDir, "creds")))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(t.TempDir())
 
 	res, err := Build(t.Context(), Options{
@@ -408,6 +415,7 @@ func TestBuild_AllowsSymlinksWithinSkillRoot(t *testing.T) {
 	require.NoError(t, os.Symlink(helper, filepath.Join(skillDir, "alias.txt")))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(t.TempDir())
 
 	res, err := Build(t.Context(), Options{
@@ -437,6 +445,7 @@ func TestBuild_PreservesExecutableBit(t *testing.T) {
 	require.NoError(t, os.WriteFile(script, []byte("#!/bin/sh\necho hi\n"), 0o700))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(t.TempDir())
 
 	res, err := Build(t.Context(), Options{
@@ -468,6 +477,7 @@ func TestBuild_OnDiskManifestOmitsHostPaths(t *testing.T) {
 		[]byte("---\nname: plain\ndescription: plain\n---\n"), 0o644))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(t.TempDir())
 
 	res, err := Build(t.Context(), Options{
@@ -507,6 +517,7 @@ func TestBuild_ConcurrentRunsForSameAgentAreSafe(t *testing.T) {
 		[]byte("---\nname: shared\ndescription: shared skill\n---\n"), 0o644))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(t.TempDir())
 
 	cacheDir := t.TempDir()
@@ -612,6 +623,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 
 	res, err := Build(t.Context(), Options{
@@ -674,6 +686,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 
 	res, err := Build(t.Context(), Options{
@@ -753,6 +766,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 	return hostHome, workspace, yamlPath
 }
@@ -850,6 +864,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 
 	res, err := Build(t.Context(), Options{
@@ -897,6 +912,7 @@ models:
 	require.NoError(t, os.WriteFile(yamlPath, agentYAML, 0o600))
 
 	t.Setenv("HOME", hostHome)
+	t.Setenv("USERPROFILE", hostHome)
 	t.Chdir(workspace)
 
 	res, err := Build(t.Context(), Options{
diff --git a/pkg/skills/remote_test.go b/pkg/skills/remote_test.go
index e9af69697..a95f293aa 100644
--- a/pkg/skills/remote_test.go
+++ b/pkg/skills/remote_test.go
@@ -248,7 +248,9 @@ func TestLoadWithMixedSources(t *testing.T) {
 
 	tmpDir := t.TempDir()
 	t.Chdir(tmpDir)
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	skills := Load(t.Context(), []string{"local", srv.URL})
 
diff --git a/pkg/skills/skills_test.go b/pkg/skills/skills_test.go
index 6377d99d1..756e03c1b 100644
--- a/pkg/skills/skills_test.go
+++ b/pkg/skills/skills_test.go
@@ -458,6 +458,7 @@ func TestLoad_AgentsSkillsGlobal(t *testing.T) {
 	// Create a temp home directory with .agents/skills
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	agentsSkillDir := filepath.Join(tmpHome, ".agents", "skills", "global-skill")
 	require.NoError(t, os.MkdirAll(agentsSkillDir, 0o755))
@@ -493,6 +494,7 @@ func TestLoad_AgentsSkillsGlobalRecursive(t *testing.T) {
 	// Create a temp home directory with nested .agents/skills
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	// Create a deeply nested skill under ~/.agents/skills/
 	nestedSkillDir := filepath.Join(tmpHome, ".agents", "skills", "project-a", "skill-one")
@@ -613,6 +615,7 @@ description: A skill from repo root
 	// Set HOME to a directory without skills to isolate test
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	skills := Load(t.Context(), []string{"local"})
 
@@ -653,6 +656,7 @@ description: A skill from .github/skills
 
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	skills := Load(t.Context(), []string{"local"})
 
@@ -700,6 +704,7 @@ description: Agents version
 
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	skills := Load(t.Context(), []string{"local"})
 
@@ -722,6 +727,7 @@ func TestLoad_AgentsSkillsFromNonGitGroupingParent(t *testing.T) {
 	// grouping root itself.
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Grouping root (~/org) is NOT a git repo and holds a cross-repo skill.
 	groupingSkillDir := filepath.Join(home, "org", ".agents", "skills", "services")
@@ -762,6 +768,7 @@ func TestLoad_AgentsSkillsPrecedence_GroupingOverridesGlobal(t *testing.T) {
 	// must win over the global one.
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	globalSkillDir := filepath.Join(home, ".agents", "skills", "shared-skill")
 	require.NoError(t, os.MkdirAll(globalSkillDir, 0o755))
@@ -808,6 +815,7 @@ func TestLoad_AgentsSkillsPrecedence_ProjectOverridesGlobal(t *testing.T) {
 	// Create a temp home directory with a global skill
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	globalSkillDir := filepath.Join(tmpHome, ".agents", "skills", "shared-skill")
 	require.NoError(t, os.MkdirAll(globalSkillDir, 0o755))
@@ -891,6 +899,7 @@ description: Subproject version
 	// Set HOME to empty dir
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	// From repo root, should get root version
 	t.Chdir(tmpRepo)
@@ -953,6 +962,7 @@ func TestLoad_KitDirOverridesEverything(t *testing.T) {
 	// don't exist inside the sandbox.
 	tmpHome := t.TempDir()
 	t.Setenv("HOME", tmpHome)
+	t.Setenv("USERPROFILE", tmpHome)
 
 	// Stage a host-only skill the test must NOT see.
 	hostSkillDir := filepath.Join(tmpHome, ".agents", "skills", "host-only")
@@ -1040,6 +1050,7 @@ func TestProjectSearchDirs(t *testing.T) {
 	t.Run("under home walks past git root up to but not including home", func(t *testing.T) {
 		home := t.TempDir()
 		t.Setenv("HOME", home)
+		t.Setenv("USERPROFILE", home)
 
 		// A sub-repo (its own .git) inside a non-git grouping parent.
 		repo := filepath.Join(home, "org", "repo")
diff --git a/pkg/teamloader/teamloader_test.go b/pkg/teamloader/teamloader_test.go
index a5d59d577..6acb21618 100644
--- a/pkg/teamloader/teamloader_test.go
+++ b/pkg/teamloader/teamloader_test.go
@@ -164,7 +164,9 @@ func gatherExampleEnvVars(t *testing.T, examples []string) map[string]bool {
 }
 
 func TestLoadDefaultAgent(t *testing.T) {
-	t.Setenv("HOME", t.TempDir())
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	agentSource, err := config.Resolve("default", nil)
 	require.NoError(t, err)
diff --git a/pkg/tui/tui_perf_harness_test.go b/pkg/tui/tui_perf_harness_test.go
index 4b2e216e8..fd99a599e 100644
--- a/pkg/tui/tui_perf_harness_test.go
+++ b/pkg/tui/tui_perf_harness_test.go
@@ -15,7 +15,9 @@ import (
 func wallClockRoot(tb testing.TB, width, height int) *appModel {
 	tb.Helper()
 	if setter, ok := tb.(interface{ Setenv(key, value string) }); ok {
-		setter.Setenv("HOME", tb.TempDir())
+		home := tb.TempDir()
+		setter.Setenv("HOME", home)
+		setter.Setenv("USERPROFILE", home)
 	}
 	sess := &session.Session{ID: "profile", Title: "profile"}
 	a := app.New(tb.Context(), stubRuntime{}, sess)
diff --git a/pkg/userconfig/userconfig_test.go b/pkg/userconfig/userconfig_test.go
index df913f726..e73d99f4e 100644
--- a/pkg/userconfig/userconfig_test.go
+++ b/pkg/userconfig/userconfig_test.go
@@ -956,6 +956,7 @@ func TestConfig_DefaultModel_SaveAndLoad(t *testing.T) {
 func TestGet_Empty(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// No config file exists
 	settings := Get()
@@ -967,6 +968,7 @@ func TestGet_Empty(t *testing.T) {
 func TestGet_WithHideToolResults(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
+	t.Setenv("USERPROFILE", home)
 
 	// Set up config with settings
 	cfg, err := Load()