diff --git a/apps/mobile/src/features/settings/SettingsProviderAccountsRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsProviderAccountsRouteScreen.tsx
index a3b698dd9aff8..a368873f41578 100644
--- a/apps/mobile/src/features/settings/SettingsProviderAccountsRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsProviderAccountsRouteScreen.tsx
@@ -174,9 +174,12 @@ function ProviderAccount({
     !signedIn &&
     !auth.error &&
     state?.methods === undefined;
+  const hasAdvertisedSignIn = (state?.methods?.length ?? 0) > 0;
   const needsExternalSetup =
     !active &&
     !signedIn &&
+    !isDiscovering &&
+    !hasAdvertisedSignIn &&
     (provider.setup?.canAuthenticate === false ||
       (provider.driver === "acpRegistry" && state?.methods?.length === 0));
   const url =
@@ -232,7 +235,7 @@ function ProviderAccount({
   const canSignIn =
     !active &&
     !needsExternalSetup &&
-    provider.setup?.canAuthenticate !== false &&
+    (provider.setup?.canAuthenticate !== false || hasAdvertisedSignIn) &&
     provider.enabled &&
     provider.installed;
   const signInDisabled = disabled || state === null;
diff --git a/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx b/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx
index 568c6a953ffc7..e25eb79083268 100644
--- a/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx
+++ b/apps/web/src/components/settings/AddProviderInstanceDialog.environment.browser.test.tsx
@@ -244,7 +244,7 @@ describe("AddProviderInstanceDialog environment routing", () => {
     expect(actions.onOpenChange).toHaveBeenCalledWith(false);
   });
 
-  it("creates a local command in the selected environment without a sign-in step", async () => {
+  it("creates a local command in the selected environment and opens sign-in", async () => {
     setup();
     await using _screen = await render(dialog());
     await click("Show more");
@@ -271,7 +271,7 @@ describe("AddProviderInstanceDialog environment routing", () => {
     await type('input[aria-label="Environment variable value 1"]', "work");
     await click("Next");
     await type("#add-provider-label", "Deepseek Harness");
-    await click("Add instance");
+    await click("Continue to sign-in");
 
     expect(settingsHooks.useMutation).toHaveBeenCalledWith(remoteEnvironmentId);
     expect(settingsHooks.mutate).toHaveBeenCalledWith({
@@ -287,8 +287,8 @@ describe("AddProviderInstanceDialog environment routing", () => {
         ],
       },
     });
-    expect(actions.onOpenChange).toHaveBeenCalledWith(false);
-    expect(signInStep()).toBeNull();
+    expect(actions.onOpenChange).not.toHaveBeenCalled();
+    expect(signInStep()?.textContent).toContain("remote-device/acpRegistry_deepseek_harness");
   });
 
   it("rejects a queued save after the provider grant is revoked", async () => {
diff --git a/apps/web/src/components/settings/AddProviderInstanceDialog.logic.ts b/apps/web/src/components/settings/AddProviderInstanceDialog.logic.ts
index 1263c675e05b7..29e3ccac5daad 100644
--- a/apps/web/src/components/settings/AddProviderInstanceDialog.logic.ts
+++ b/apps/web/src/components/settings/AddProviderInstanceDialog.logic.ts
@@ -7,7 +7,6 @@ const ACP_REGISTRY_IDENTITY_STEP = 1;
 
 export const ADD_PROVIDER_WIZARD_STEPS = ["Provider", "Identity", "Config"] as const;
 export const ACP_REGISTRY_WIZARD_STEPS = ["Provider", "Identity", "Sign in"] as const;
-export const LOCAL_ACP_WIZARD_STEPS = ["Provider", "Identity"] as const;
 
 export interface ProviderIdentityDraft {
   readonly label: string;
diff --git a/apps/web/src/components/settings/AddProviderInstanceDialog.tsx b/apps/web/src/components/settings/AddProviderInstanceDialog.tsx
index e5074e4a9bfd1..0da2fbe9f94ce 100644
--- a/apps/web/src/components/settings/AddProviderInstanceDialog.tsx
+++ b/apps/web/src/components/settings/AddProviderInstanceDialog.tsx
@@ -46,7 +46,6 @@ import { WizardPanel, WizardPopup, WizardHeader, WizardFooter } from "../ui/wiza
 import {
   ADD_PROVIDER_WIZARD_STEPS,
   ACP_REGISTRY_WIZARD_STEPS,
-  LOCAL_ACP_WIZARD_STEPS,
   resolveAcpRegistryWizardNavigation,
   resolveWizardNavigation,
   updateProviderIdentityDraft,
@@ -277,7 +276,7 @@ export function AddProviderInstanceDialog({
     if (navigation.kind === "blocked") {
       setHasAttemptedSubmit(true);
     }
-    if (isAcpRegistry && !isLocalAcp && navigation.kind === "navigate" && navigation.step === 2) {
+    if (isAcpRegistry && navigation.kind === "navigate" && navigation.step === 2) {
       void handleSave();
       return;
     }
@@ -287,15 +286,10 @@ export function AddProviderInstanceDialog({
   const navigateToStep = (requestedStep: number) => {
     applyWizardNavigation(
       isAcpRegistry
-        ? isLocalAcp
-          ? resolveWizardNavigation(wizardStep, requestedStep, LOCAL_ACP_WIZARD_STEPS.length, {
-              instanceIdError,
-              prerequisite: { step: 0, error: acpSelectionError },
-            })
-          : resolveAcpRegistryWizardNavigation(wizardStep, requestedStep, {
-              instanceIdError,
-              selectionError: acpSelectionError,
-            })
+        ? resolveAcpRegistryWizardNavigation(wizardStep, requestedStep, {
+            instanceIdError,
+            selectionError: acpSelectionError,
+          })
         : resolveWizardNavigation(wizardStep, requestedStep, ADD_PROVIDER_WIZARD_STEPS.length, {
             instanceIdError,
           }),
@@ -409,7 +403,7 @@ export function AddProviderInstanceDialog({
       return;
     }
     onCreated?.(brandedId, driver);
-    if (isAcpRegistry && !isLocalAcp) {
+    if (isAcpRegistry) {
       setCreatedInstanceId(brandedId);
       setIsSaving(false);
       setWizardStep(2);
@@ -445,7 +439,7 @@ export function AddProviderInstanceDialog({
               currentStep={wizardStep}
               summaries={wizardStepSummaries}
               instanceIdError={instanceIdError}
-              steps={isLocalAcp ? LOCAL_ACP_WIZARD_STEPS : ACP_REGISTRY_WIZARD_STEPS}
+              steps={ACP_REGISTRY_WIZARD_STEPS}
               disabled={isSaving || isPreparingRegistryAgent || createdInstanceId !== null}
               identityStep={1}
               prerequisite={{ step: 0, error: acpSelectionError }}
@@ -752,11 +746,7 @@ export function AddProviderInstanceDialog({
                   disabled={isSaving || !canManageProviders}
                   onClick={() => void handleSave()}
                 >
-                  {isSaving
-                    ? "Adding..."
-                    : isAcpRegistry && !isLocalAcp
-                      ? "Continue to sign-in"
-                      : "Add instance"}
+                  {isSaving ? "Adding..." : isAcpRegistry ? "Continue to sign-in" : "Add instance"}
                 </Button>
               )}
             </WizardFooter>
diff --git a/apps/web/src/components/settings/ProviderAuthenticationSection.tsx b/apps/web/src/components/settings/ProviderAuthenticationSection.tsx
index f5c4ee146db2a..0582cb1224cfc 100644
--- a/apps/web/src/components/settings/ProviderAuthenticationSection.tsx
+++ b/apps/web/src/components/settings/ProviderAuthenticationSection.tsx
@@ -68,9 +68,12 @@ export function ProviderAuthenticationSection({
     !signedIn &&
     !query.error &&
     auth?.methods === undefined;
+  const hasAdvertisedSignIn = (auth?.methods?.length ?? 0) > 0;
   const needsExternalSetup =
     !active &&
     !signedIn &&
+    !isDiscovering &&
+    !hasAdvertisedSignIn &&
     (provider.setup?.canAuthenticate === false ||
       (provider.driver === "acpRegistry" && auth?.methods?.length === 0));
   const usesCredentials =
@@ -276,7 +279,9 @@ export function ProviderAuthenticationSection({
               >
                 Cancel
               </Button>
-            ) : !active && !needsExternalSetup && provider.setup?.canAuthenticate !== false ? (
+            ) : !active &&
+              !needsExternalSetup &&
+              (provider.setup?.canAuthenticate !== false || hasAdvertisedSignIn) ? (
               <Button
                 size="sm"
                 variant="outline"
diff --git a/docs/user/providers-acp.md b/docs/user/providers-acp.md
index 701d5638b3fd8..cba12d54d5f5c 100644
--- a/docs/user/providers-acp.md
+++ b/docs/user/providers-acp.md
@@ -28,17 +28,39 @@ provider instance's environment overrides to use ACP v1.
 Search only shows agents that can run on the connected server. Registry agents are third-party
 code; review an agent's source and license before adding it.
 
+Search also lists DeepSeek Harness and ZCode. T3 Code installs an agent when that command is not already available:
+
+| Agent                                                               | What T3 Code runs                                       |
+| ------------------------------------------------------------------- | ------------------------------------------------------- |
+| [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) | `dsh --profile acp` from `@deepseek-ai/dsh`             |
+| [ZCode bridge](https://github.com/supermomonga/zcode-acp)           | the `zcode-acp` binary from the bridge's GitHub release |
+
+DeepSeek Harness is the `dsh` CLI. When `dsh` is already installed, T3 Code runs that copy with
+`--profile acp` and keeps the credentials already stored in its profile. Otherwise T3 Code installs
+`@deepseek-ai/dsh`. ACP mode is a profile, not a separate program, and the sign-in step can be
+skipped when the CLI advertises no login.
+ZCode still needs ZCode desktop 3.11.2. The unofficial bridge rejects other desktop versions. Select
+**Add** for either agent, then complete the sign-in step.
+
 ## Add a local command
 
 In **Settings → Providers → Add provider**, select **Show more**, then **Local ACP command**. Enter the executable
 name or path on the selected environment, add one literal argument per row, and choose a display
-name. For DeepSeek Harness, use `dsh` with arguments `--profile` and `acp`.
+name.
+
+Available models and session controls follow each agent's advertised capabilities. DeepSeek's
+automation ACP profile does not provide transcript replay or session forking. Existing instances
+can also be used from mobile.
 
 Local commands require no registry entry or download. Environment overrides apply to the command;
 credentials and skills remain managed by the installed agent or its wrapper. Models and reasoning
 options come from ACP, including model IDs that contain JSON. T3 Code launches the executable directly
 without expanding shell expressions.
 
+On Windows, standard npm Node.js launchers (such as `dsh.cmd`) are resolved to their
+Node.js script and launched directly. Custom batch scripts still require an explicit underlying
+executable and literal arguments.
+
 ## Where agents run
 
 Registry agents always run on the machine that hosts your T3 Code server. That stays true when you
@@ -53,9 +75,10 @@ but keeps package installs. To use an existing local binary, set **Executable ov
 
 ## Signing in
 
-Open the agent's account section in **Settings → Providers** on web or desktop. Choose
-**Sign in** and, if the agent offers several methods, select one. For an installed, configured
-provider, mobile also offers **Settings → Providers**.
+Open the agent's account section in **Settings → Providers** on web or desktop, or finish the
+sign-in step shown after adding the instance. Choose **Sign in** and, if the agent offers several
+methods, select one. Local commands use this same account section once they advertise a login.
+For an installed, configured provider, mobile also offers **Settings → Providers**.
 
 Browser sign-in shows the agent's URL and waits for you to open or copy it before telling the
 agent to proceed. The page opens on your device, while the agent runs on the environment.
diff --git a/packages/provider-acp-registry/src/server/AcpRegistrySupport.test.ts b/packages/provider-acp-registry/src/server/AcpRegistrySupport.test.ts
index 02a32ac40250d..ef34995d02503 100644
--- a/packages/provider-acp-registry/src/server/AcpRegistrySupport.test.ts
+++ b/packages/provider-acp-registry/src/server/AcpRegistrySupport.test.ts
@@ -283,9 +283,88 @@ describe("AcpRegistrySupport", () => {
     );
   });
 
+  it.effect("anchors a relative Windows npm shim to the server directory", () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const cacheDir = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-acp-relative-shim-",
+      });
+      const shimDir = path.join(cacheDir, "npm");
+      const scriptPath = path.join(shimDir, "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js");
+      const shimPath = path.join(shimDir, "dsh.cmd");
+      const nodePath = path.join(shimDir, "node.exe");
+      const decoyDir = path.join(cacheDir, "decoy");
+      const decoyNode = path.join(decoyDir, "node.exe");
+      yield* fileSystem.makeDirectory(path.dirname(scriptPath), { recursive: true });
+      yield* fileSystem.makeDirectory(decoyDir, { recursive: true });
+      yield* fileSystem.writeFileString(scriptPath, "");
+      yield* fileSystem.writeFileString(nodePath, "");
+      yield* fileSystem.writeFileString(decoyNode, "");
+      yield* fileSystem.writeFileString(
+        shimPath,
+        [
+          "@ECHO off",
+          "GOTO start",
+          ":find_dp0",
+          "SET dp0=%~dp0",
+          "EXIT /b",
+          ":start",
+          "SETLOCAL",
+          "CALL :find_dp0",
+          'IF EXIST "%dp0%\\node.exe" (',
+          '  SET "_prog=%dp0%\\node.exe"',
+          ") ELSE (",
+          '  SET "_prog=node"',
+          "  SET PATHEXT=%PATHEXT:;.JS;=;%",
+          ")",
+          'endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\\node_modules\\@deepseek-ai\\dsh\\lib\\bin.js" %*',
+          "",
+        ].join("\n"),
+      );
+      const relativeShim = path.relative(process.cwd(), shimPath);
+      const environment = { PATH: [decoyDir, shimDir].join(";"), PATHEXT: ".EXE;.CMD" };
+      const resolver = yield* AcpRegistrySupport.makeAcpRegistryCatalog({
+        cacheDir,
+        toolsDir: `${cacheDir}/tools`,
+        registryUrl,
+      }).pipe(
+        Effect.provideService(HostProcess.Platform, "win32"),
+        Effect.provideService(HostProcess.Environment, environment),
+      );
+      const resolved = yield* resolver.resolve(
+        decodeAcpRegistrySettings({
+          source: "local",
+          commandPath: relativeShim,
+          commandArgs: ["--profile", "acp"],
+        }),
+        "/workspace",
+        environment,
+      );
+      const spawnCommand = resolved.spawn.command.replaceAll("\\", "/");
+      const scriptArg = String(resolved.spawn.args[0]).replaceAll("\\", "/");
+      expect(
+        path.isAbsolute(resolved.spawn.command) || /^[A-Za-z]:/u.test(resolved.spawn.command),
+      ).toBe(true);
+      expect(spawnCommand.endsWith("/node.exe")).toBe(true);
+      expect(spawnCommand.includes("/decoy/")).toBe(false);
+      expect(scriptArg.endsWith("/node_modules/@deepseek-ai/dsh/lib/bin.js")).toBe(true);
+      expect(
+        path.isAbsolute(String(resolved.spawn.args[0])) ||
+          /^[A-Za-z]:/u.test(String(resolved.spawn.args[0])),
+      ).toBe(true);
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        layerResolver(() => Effect.die("unexpected registry request for a local provider")),
+      ),
+    ),
+  );
+
   it.effect("resolves a local executable path and inherits the host environment", () =>
     Effect.gen(function* () {
       const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
       const cacheDir = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-acp-local-path-" });
       const commandPath = `${cacheDir}/dsh wrapper`;
       yield* fileSystem.writeFileString(commandPath, "#!/bin/sh\n");
@@ -310,6 +389,75 @@ describe("AcpRegistrySupport", () => {
       });
       expect(resolved.agent).toBeUndefined();
 
+      const shimDir = path.join(cacheDir, "npm");
+      const scriptPath = path.join(shimDir, "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js");
+      const shimPath = path.join(shimDir, "dsh.cmd");
+      const nodePath = path.join(shimDir, "node.exe");
+      yield* fileSystem.makeDirectory(path.dirname(scriptPath), { recursive: true });
+      yield* fileSystem.writeFileString(scriptPath, "");
+      yield* fileSystem.writeFileString(nodePath, "");
+      yield* fileSystem.writeFileString(
+        shimPath,
+        [
+          "@ECHO off",
+          "GOTO start",
+          ":find_dp0",
+          "SET dp0=%~dp0",
+          "EXIT /b",
+          ":start",
+          "SETLOCAL",
+          "CALL :find_dp0",
+          'IF EXIST "%dp0%\\node.exe" (',
+          '  SET "_prog=%dp0%\\node.exe"',
+          ") ELSE (",
+          '  SET "_prog=node"',
+          "  SET PATHEXT=%PATHEXT:;.JS;=;%",
+          ")",
+          'endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\\node_modules\\@deepseek-ai\\dsh\\lib\\bin.js" %*',
+          "",
+        ].join("\n"),
+      );
+      const windowsEnvironment = { PATH: shimDir, PATHEXT: ".EXE;.CMD" };
+      const npmResolver = yield* AcpRegistrySupport.makeAcpRegistryCatalog({
+        cacheDir,
+        toolsDir: `${cacheDir}/tools`,
+        registryUrl,
+      }).pipe(
+        Effect.provideService(HostProcess.Platform, "win32"),
+        Effect.provideService(HostProcess.Environment, windowsEnvironment),
+      );
+      const npmSettings = decodeAcpRegistrySettings({
+        source: "local",
+        commandPath: shimPath,
+        commandArgs: ["--profile", "acp"],
+      });
+      expect(yield* npmResolver.inspect(npmSettings, windowsEnvironment)).toMatchObject({
+        status: "ready",
+        distribution: "local",
+      });
+      expect(
+        yield* npmResolver.resolve(npmSettings, "/workspace", windowsEnvironment),
+      ).toMatchObject({
+        distribution: "local",
+        spawn: {
+          command: nodePath,
+          args: [scriptPath, "--profile", "acp"],
+          cwd: "/workspace",
+          env: windowsEnvironment,
+          shell: false,
+        },
+      });
+      yield* fileSystem.remove(nodePath);
+      for (const failure of [
+        yield* npmResolver.inspect(npmSettings, windowsEnvironment).pipe(Effect.flip),
+        yield* npmResolver.resolve(npmSettings, "/workspace", windowsEnvironment).pipe(Effect.flip),
+      ]) {
+        expect(failure).toMatchObject({
+          reason: "runner_unavailable",
+          detail: "Node.js is required to launch this npm ACP command.",
+        });
+      }
+
       for (const extension of [".cmd", ".BAT"]) {
         const windowsResolver = yield* AcpRegistrySupport.makeAcpRegistryCatalog({
           cacheDir,
@@ -1675,6 +1823,111 @@ describe("AcpRegistrySupport", () => {
       ),
     );
   });
+
+  it.effect("runs an installed dsh for the supplemental DeepSeek record", () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const cacheDir = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-acp-dsh-path-" });
+      const binDir = `${cacheDir}/bin`;
+      const dshPath = `${binDir}/dsh`;
+      yield* fileSystem.makeDirectory(binDir);
+      yield* fileSystem.writeFileString(dshPath, "#!/bin/sh\n");
+      yield* fileSystem.chmod(dshPath, 0o755);
+      const environment = { PATH: binDir };
+      const resolver = yield* AcpRegistrySupport.makeAcpRegistryCatalog({
+        cacheDir,
+        toolsDir: `${cacheDir}/tools`,
+        registryUrl: "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json",
+      }).pipe(Effect.provideService(HostProcess.Environment, environment));
+      const deepseekSettings = decodeAcpRegistrySettings({ agentId: "deepseek-harness" });
+
+      expect(yield* resolver.prepare({ agentId: "deepseek-harness" })).toMatchObject({
+        agentId: "deepseek-harness",
+        prepared: true,
+      });
+      expect(yield* resolver.inspect(deepseekSettings, environment)).toMatchObject({
+        status: "ready",
+        distribution: "local",
+      });
+      const resolved = yield* resolver.resolve(deepseekSettings, "/workspace", environment);
+      expect(resolved.distribution).toBe("local");
+      expect(resolved.spawn.command.replaceAll("\\", "/")).toMatch(/\/bin\/dsh$/);
+      expect(resolved.spawn.args).toEqual(["--profile", "acp"]);
+      expect(resolved.spawn.shell).toBe(false);
+      expect(yield* fileSystem.exists(`${cacheDir}/tools`)).toBe(false);
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        layerResolver((request) =>
+          Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              new Response(JSON.stringify({ version: "1.0.0", agents: [] })),
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
+
+  it.effect("keeps an official DeepSeek entry on its own distribution when dsh is installed", () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const cacheDir = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-acp-dsh-official-",
+      });
+      const binDir = `${cacheDir}/bin`;
+      yield* fileSystem.makeDirectory(binDir);
+      yield* fileSystem.writeFileString(`${binDir}/dsh`, "#!/bin/sh\n");
+      yield* fileSystem.chmod(`${binDir}/dsh`, 0o755);
+      const environment = { PATH: binDir };
+      const resolver = yield* AcpRegistrySupport.makeAcpRegistryCatalog({
+        cacheDir,
+        toolsDir: `${cacheDir}/tools`,
+        registryUrl: "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json",
+      }).pipe(Effect.provideService(HostProcess.Environment, environment));
+      const deepseekSettings = decodeAcpRegistrySettings({ agentId: "deepseek-harness" });
+
+      const prepared = yield* resolver.prepare({ agentId: "deepseek-harness" }).pipe(Effect.flip);
+      expect(prepared.reason).toBe("runner_unavailable");
+      expect(yield* resolver.inspect(deepseekSettings, environment)).toMatchObject({
+        status: "missing_runner",
+        distribution: "npx",
+        runner: "npm",
+      });
+      const resolved = yield* resolver
+        .resolve(deepseekSettings, "/workspace", environment)
+        .pipe(Effect.flip);
+      expect(resolved.reason).toBe("runner_unavailable");
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        layerResolver((request) =>
+          Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              new Response(
+                JSON.stringify({
+                  version: "1.0.0",
+                  agents: [
+                    {
+                      id: "deepseek-harness",
+                      name: "Official DeepSeek",
+                      version: "9.9.9",
+                      description: "Official registry entry",
+                      distribution: {
+                        npx: { package: "@official/deepseek-harness@9.9.9", args: ["acp"] },
+                      },
+                    },
+                  ],
+                }),
+              ),
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
 });
 
 describe("acpRegistryManagedBinaryDirectories", () => {
diff --git a/packages/provider-acp-registry/src/server/AcpRegistrySupport.ts b/packages/provider-acp-registry/src/server/AcpRegistrySupport.ts
index 99b1cfdc9f958..70550ae60712c 100644
--- a/packages/provider-acp-registry/src/server/AcpRegistrySupport.ts
+++ b/packages/provider-acp-registry/src/server/AcpRegistrySupport.ts
@@ -17,6 +17,7 @@ import { cliArchiveTarCommand } from "@t3tools/shared/cliRelease";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import {
   mergePathEntries,
+  npmShimScript,
   resolveSpawnCommand,
   SpawnExecutableResolution,
 } from "@t3tools/shared/shell";
@@ -32,6 +33,11 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as AcpRegistryRuntimeCoordinator from "./AcpRegistryRuntimeCoordinator.ts";
+import {
+  SUPPLEMENTAL_ACP_AGENT_RECORDS,
+  appendMissingAgents,
+  supplementalPathCommand,
+} from "./supplementalAgents.ts";
 import * as PlatformError from "effect/PlatformError";
 import * as Ref from "effect/Ref";
 import * as Schema from "effect/Schema";
@@ -187,6 +193,16 @@ export interface AcpRegistryIndex {
 
 const decodeRegistryIndexEnvelope = Schema.decodeUnknownEffect(AcpRegistryIndexEnvelope);
 const decodeRegistryAgent = Schema.decodeUnknownOption(AcpRegistryAgent);
+export const supplementalAcpAgents: ReadonlyArray<AcpRegistryAgent> =
+  SUPPLEMENTAL_ACP_AGENT_RECORDS.flatMap((candidate) => {
+    const decoded = decodeRegistryAgent(candidate);
+    return Option.isSome(decoded) ? [decoded.value] : [];
+  });
+const supplementalAgentSet = new Set<AcpRegistryAgent>(supplementalAcpAgents);
+
+function installedCommandForSupplementalAgent(agent: AcpRegistryAgent): string | undefined {
+  return supplementalAgentSet.has(agent) ? supplementalPathCommand(agent.id) : undefined;
+}
 const decodeJson = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
 const decodeNpmPackageManifest = Schema.decodeUnknownEffect(
   Schema.fromJsonString(NpmPackageManifest),
@@ -645,6 +661,8 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
     digester.digest(Digest.sha256, data).pipe(Effect.map(Hex.encode), Effect.orDie);
   const fileSystem = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
+  const absoluteSpawnPath = (filePath: string) =>
+    path.isAbsolute(filePath) ? filePath : path.resolve(filePath);
   const httpClient = yield* HttpClient.HttpClient;
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const { settings: hostSettings } = yield* ProviderHost.ProviderHost;
@@ -774,9 +792,17 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
     return { version: envelope.version, agents } satisfies AcpRegistryIndex;
   });
 
+  const supplementOfficialRegistry = (registry: AcpRegistryIndex): AcpRegistryIndex =>
+    registryUrl === ACP_REGISTRY_URL
+      ? { ...registry, agents: appendMissingAgents(registry.agents, supplementalAcpAgents) }
+      : registry;
   const readCachedRegistry = fileSystem
     .readFileString(registryCachePath)
-    .pipe(Effect.flatMap(decodeRegistryText), Effect.option);
+    .pipe(
+      Effect.flatMap(decodeRegistryText),
+      Effect.map(supplementOfficialRegistry),
+      Effect.option,
+    );
 
   const writeRegistryCache = (text: string) =>
     random.uuidV4().pipe(
@@ -851,7 +877,7 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
         detail: "ACP Registry index is not valid UTF-8.",
       });
     }
-    const registry = yield* decodeRegistryText(collected.text);
+    const registry = supplementOfficialRegistry(yield* decodeRegistryText(collected.text));
     yield* writeRegistryCache(collected.text);
     return registry;
   });
@@ -1678,7 +1704,14 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
       const registry = yield* refreshRegistry();
       const agent = yield* findAgent(registry, input.agentId);
       const distribution = yield* compatibleDistribution(agent, "auto");
-      if (distribution.kind === "binary") {
+      const localCommandName = installedCommandForSupplementalAgent(agent);
+      const localCommand =
+        localCommandName === undefined
+          ? undefined
+          : resolveExecutable(localCommandName, platform, hostEnvironment);
+      if (localCommand !== undefined) {
+        yield* validateLocalExecutable(localCommand);
+      } else if (distribution.kind === "binary") {
         // Only explicit command overrides may use PATH copies with different ACP capabilities.
         yield* withInstallPermit(agent.id)(
           installBinary(agent, distribution.binaryTarget!).pipe(
@@ -1700,7 +1733,7 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
   );
 
   const validateLocalExecutable = (command: string) =>
-    platform === "win32" && /\.(?:cmd|bat)$/iu.test(command)
+    platform === "win32" && /\.(?:cmd|bat)$/iu.test(command) && npmShimScript(command) === undefined
       ? Effect.fail(
           new AcpRegistryError({
             reason: "runner_unavailable",
@@ -1710,13 +1743,42 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
         )
       : Effect.void;
 
+  const launchLocalExecutable = (
+    command: string,
+    args: ReadonlyArray<string>,
+    env: NodeJS.ProcessEnv,
+  ) => {
+    const script = platform === "win32" ? npmShimScript(command) : undefined;
+    if (script === undefined) return { command, args };
+    const absoluteCommand = absoluteSpawnPath(command);
+    const separatorIndex = Math.max(
+      absoluteCommand.lastIndexOf("/"),
+      absoluteCommand.lastIndexOf("\\"),
+    );
+    const adjacentNode =
+      separatorIndex >= 0 ? `${absoluteCommand.slice(0, separatorIndex + 1)}node.exe` : "node.exe";
+    const node =
+      resolveExecutable(adjacentNode, platform, env) ?? resolveExecutable("node", platform, env);
+    if (node === undefined) {
+      return new AcpRegistryError({
+        reason: "runner_unavailable",
+        detail: "Node.js is required to launch this npm ACP command.",
+      });
+    }
+    return { command: absoluteSpawnPath(node), args: [absoluteSpawnPath(script), ...args] };
+  };
+
   const inspect: AcpRegistryCatalog["Service"]["inspect"] = Effect.fn("AcpRegistryCatalog.inspect")(
     function* (settings, environment) {
       if (settings.source === "local") {
         const command = settings.commandPath.trim();
         if (!command) return { status: "unconfigured" } as const;
         const executable = resolveExecutable(command, platform, environment ?? hostEnvironment);
-        if (executable !== undefined) yield* validateLocalExecutable(executable);
+        if (executable !== undefined) {
+          yield* validateLocalExecutable(executable);
+          const launched = launchLocalExecutable(executable, [], environment ?? hostEnvironment);
+          if (isAcpRegistryError(launched)) return yield* launched;
+        }
         return executable === undefined
           ? ({
               status: "missing_runner",
@@ -1762,6 +1824,22 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
             } as const);
       }
 
+      const localCommandName = installedCommandForSupplementalAgent(agent);
+      const localCommand =
+        localCommandName === undefined
+          ? undefined
+          : resolveExecutable(localCommandName, platform, environment ?? hostEnvironment);
+      if (localCommand !== undefined) {
+        yield* validateLocalExecutable(localCommand);
+        return {
+          status: "ready",
+          agentId,
+          version: null,
+          distribution: "local",
+          ...(documentationUrl ? { documentationUrl } : {}),
+        } as const;
+      }
+
       if (distribution.kind === "binary") {
         return yield* withInstallPermit(agent.id)(
           Effect.gen(function* () {
@@ -1843,9 +1921,17 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
           });
         }
         yield* validateLocalExecutable(command);
+        const launched = launchLocalExecutable(command, settings.commandArgs, env);
+        if (isAcpRegistryError(launched)) return yield* launched;
         return {
           distribution: "local",
-          spawn: { command, args: settings.commandArgs, cwd, env, shell: false },
+          spawn: {
+            command: launched.command,
+            args: launched.args,
+            cwd,
+            env,
+            shell: false,
+          },
         } satisfies ResolvedAcpRegistryAgent;
       }
       const agentId = settings.agentId.trim();
@@ -1864,6 +1950,31 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
       let commandBinDirectory: string | undefined;
       const effectiveEnvironment = environment ?? hostEnvironment;
       const commandOverride = settings.commandPath.trim();
+      const localCommandName = installedCommandForSupplementalAgent(agent);
+      const localCommand =
+        commandOverride.length === 0 && localCommandName !== undefined
+          ? resolveExecutable(localCommandName, platform, effectiveEnvironment)
+          : undefined;
+      if (localCommand !== undefined) {
+        yield* validateLocalExecutable(localCommand);
+        const launched = launchLocalExecutable(
+          localCommand,
+          distribution.args,
+          effectiveEnvironment,
+        );
+        if (isAcpRegistryError(launched)) return yield* launched;
+        return {
+          agent,
+          distribution: "local",
+          spawn: {
+            command: launched.command,
+            args: launched.args,
+            cwd,
+            env: effectiveEnvironment,
+            shell: false,
+          },
+        } satisfies ResolvedAcpRegistryAgent;
+      }
       if (commandOverride.length > 0) {
         const resolvedOverride = resolveExecutable(commandOverride, platform, effectiveEnvironment);
         if (resolvedOverride === undefined) {
diff --git a/packages/provider-acp-registry/src/server/driver.test.ts b/packages/provider-acp-registry/src/server/driver.test.ts
index fbb4f16e97c75..ecec575f7fd48 100644
--- a/packages/provider-acp-registry/src/server/driver.test.ts
+++ b/packages/provider-acp-registry/src/server/driver.test.ts
@@ -126,6 +126,57 @@ describe("acpRegistrySnapshotReadiness", () => {
     ).toBe("unknown");
   });
 
+  it("offers sign-in for an installed local command before its probe", () => {
+    const snapshot = buildCheckedAcpRegistrySnapshot({
+      ...identity,
+      settings: decodeSettings({ source: "local", commandPath: "kimi", commandArgs: ["acp"] }),
+      checkedAt: "2026-08-13T10:00:00.000Z",
+      inspection: {
+        status: "ready",
+        agentId: "kimi",
+        version: null,
+        distribution: "local",
+      },
+    });
+
+    expect(snapshot.installed).toBe(true);
+    expect(snapshot.setup?.canAuthenticate).toBe(true);
+  });
+
+  it("hides sign-in after a local probe advertises no auth methods", () => {
+    const snapshot = buildCheckedAcpRegistrySnapshot({
+      ...identity,
+      settings: decodeSettings({
+        source: "local",
+        commandPath: "dsh",
+        commandArgs: ["--profile", "acp"],
+      }),
+      checkedAt: "2026-08-13T10:00:00.000Z",
+      inspection: {
+        status: "ready",
+        agentId: "dsh",
+        version: null,
+        distribution: "local",
+      },
+      probe: {
+        probe: {
+          instanceId: identity.instanceId,
+          ready: true,
+          icon: null,
+          authMethods: [],
+          models: [],
+          currentModelId: null,
+          configOptions: [],
+          sessionManagement: noSessionManagement,
+        },
+        slashCommands: [],
+        skills: [],
+      },
+    });
+
+    expect(snapshot.setup?.canAuthenticate).toBe(false);
+  });
+
   it("overlays live configuration without dropping probe-owned session capabilities", () => {
     const provider = buildCheckedAcpRegistrySnapshot({
       ...identity,
diff --git a/packages/provider-acp-registry/src/server/driver.ts b/packages/provider-acp-registry/src/server/driver.ts
index ef3e0c3e7416c..7207d20c34ee1 100644
--- a/packages/provider-acp-registry/src/server/driver.ts
+++ b/packages/provider-acp-registry/src/server/driver.ts
@@ -221,13 +221,13 @@ function baseSnapshot(
     setup: {
       canInstall: false,
       ...(input.documentationUrl ? { documentationUrl: input.documentationUrl } : {}),
+      // A finished probe with no auth methods is the only proof that sign-in is unavailable.
+      // Until then, an installed local command is offered the same account step as a registry agent.
       canAuthenticate:
         input.installed &&
         (input.probe
           ? input.probe.probe.authMethods.length > 0
-          : input.settings.source === "local"
-            ? (input.probeError?.authMethods?.length ?? 0) > 0
-            : input.settings.agentId.length > 0),
+          : input.settings.source === "local" || input.settings.agentId.length > 0),
     },
     ...(input.message ? { message: input.message } : {}),
     models: modelsFromDiscovery(input.probe?.probe, input.settings.customModels),
diff --git a/packages/provider-acp-registry/src/server/supplementalAgents.test.ts b/packages/provider-acp-registry/src/server/supplementalAgents.test.ts
new file mode 100644
index 0000000000000..4200c87bd07d0
--- /dev/null
+++ b/packages/provider-acp-registry/src/server/supplementalAgents.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "@effect/vitest";
+
+import { supplementalAcpAgents } from "./AcpRegistrySupport.ts";
+import { appendMissingAgents, supplementalPathCommand } from "./supplementalAgents.ts";
+
+describe("supplemental ACP agents", () => {
+  it("registers DeepSeek Harness and the ZCode bridge", () => {
+    expect(supplementalAcpAgents.map((agent) => agent.id)).toEqual([
+      "deepseek-harness",
+      "zcode-acp",
+    ]);
+    expect(supplementalAcpAgents[0]?.distribution.npx).toMatchObject({
+      package: "@deepseek-ai/dsh@0.2.2-rc.1",
+      args: ["--profile", "acp"],
+    });
+    expect(supplementalAcpAgents[1]?.distribution.binary?.["windows-x86_64"]?.cmd).toBe(
+      "zcode-acp.exe",
+    );
+  });
+
+  it("uses an installed dsh before downloading DeepSeek Harness", () => {
+    expect(supplementalPathCommand("deepseek-harness")).toBe("dsh");
+    expect(supplementalPathCommand("zcode-acp")).toBeUndefined();
+  });
+
+  it("keeps an official entry when the same id is already published", () => {
+    const official = { id: "deepseek-harness", name: "Official" };
+    expect(appendMissingAgents([official], [{ id: "deepseek-harness", name: "Local" }])).toEqual([
+      official,
+    ]);
+    expect(appendMissingAgents([], [{ id: "zcode-acp", name: "ZCode" }])).toEqual([
+      { id: "zcode-acp", name: "ZCode" },
+    ]);
+  });
+});
diff --git a/packages/provider-acp-registry/src/server/supplementalAgents.ts b/packages/provider-acp-registry/src/server/supplementalAgents.ts
new file mode 100644
index 0000000000000..1f9cf904a93c9
--- /dev/null
+++ b/packages/provider-acp-registry/src/server/supplementalAgents.ts
@@ -0,0 +1,79 @@
+// Agents the official ACP Registry does not publish. They use the same install
+// and sign-in path as registry entries, and are skipped when an official id appears.
+export const SUPPLEMENTAL_ACP_AGENT_RECORDS = [
+  {
+    id: "deepseek-harness",
+    name: "DeepSeek Harness",
+    version: "0.2.2-rc.1",
+    description:
+      "DeepSeek Harness CLI. T3 runs an installed dsh with --profile acp, and installs @deepseek-ai/dsh only when dsh is not already on PATH. Credentials stay in the dsh profile.",
+    authors: ["DeepSeek"],
+    license: "MIT",
+    website: "https://github.com/deepseek-ai/deepseek-harness",
+    repository: "https://github.com/deepseek-ai/deepseek-harness",
+    distribution: {
+      npx: {
+        package: "@deepseek-ai/dsh@0.2.2-rc.1",
+        args: ["--profile", "acp"],
+      },
+    },
+  },
+  {
+    id: "zcode-acp",
+    name: "ZCode",
+    version: "0.3.2",
+    description:
+      "Unofficial ACP bridge for ZCode desktop 3.11.2. Other desktop versions are rejected. T3 downloads zcode-acp and starts it.",
+    authors: ["supermomonga"],
+    website: "https://github.com/supermomonga/zcode-acp",
+    repository: "https://github.com/supermomonga/zcode-acp",
+    distribution: {
+      binary: {
+        "darwin-aarch64": {
+          archive:
+            "https://github.com/supermomonga/zcode-acp/releases/download/v0.3.2/zcode-acp-darwin-arm64",
+          cmd: "zcode-acp",
+          sha256: "34d129c47bf5d50d3c00a55bbd16563d530f6edf0bbe7ee78a70da9ba1075fb3",
+        },
+        "darwin-x86_64": {
+          archive:
+            "https://github.com/supermomonga/zcode-acp/releases/download/v0.3.2/zcode-acp-darwin-x64",
+          cmd: "zcode-acp",
+          sha256: "b8bd83e9ad86117f4fbd488463fa5569f9577352377150c83e9596d935ee6504",
+        },
+        "linux-aarch64": {
+          archive:
+            "https://github.com/supermomonga/zcode-acp/releases/download/v0.3.2/zcode-acp-linux-arm64",
+          cmd: "zcode-acp",
+          sha256: "b8cdfffe55e922eebb6a295faa9db301cdc2e9e93d3dd38c0648514b8f33a16b",
+        },
+        "linux-x86_64": {
+          archive:
+            "https://github.com/supermomonga/zcode-acp/releases/download/v0.3.2/zcode-acp-linux-x64",
+          cmd: "zcode-acp",
+          sha256: "7c9c09b2961be81ae36bd700de097d4f06d91409d4178b6220e123768bffe4dd",
+        },
+        "windows-x86_64": {
+          archive:
+            "https://github.com/supermomonga/zcode-acp/releases/download/v0.3.2/zcode-acp-windows-x64.exe",
+          cmd: "zcode-acp.exe",
+          sha256: "2b88b1815544687a8b7e212255ae9e306307556dd590512f12eb40ef96cab225",
+        },
+      },
+    },
+  },
+] as const;
+
+/** Prefer this PATH command over a fresh install. Absent for agents that must be downloaded. */
+export function supplementalPathCommand(agentId: string): string | undefined {
+  return agentId === "deepseek-harness" ? "dsh" : undefined;
+}
+
+export function appendMissingAgents<Agent extends { readonly id: string }>(
+  agents: ReadonlyArray<Agent>,
+  extra: ReadonlyArray<Agent>,
+): ReadonlyArray<Agent> {
+  const present = new Set(agents.map((agent) => agent.id));
+  const missing = extra.filter((agent) => !present.has(agent.id));
+  return missing.length === 0 ? agents : [...agents, ...missing];
+}
diff --git a/packages/shared/src/shell.test.ts b/packages/shared/src/shell.test.ts
index d4e831f2af4bd..2a277d5ad33c0 100644
--- a/packages/shared/src/shell.test.ts
+++ b/packages/shared/src/shell.test.ts
@@ -28,6 +28,7 @@ import {
   mergePathEntries,
   mergePathValues,
   npmShimExecutable,
+  npmShimScript,
   preferGitForWindowsBinary,
   readEnvironmentFromLoginShell,
   readEnvironmentFromWindowsShell,
@@ -1216,3 +1217,65 @@ describe("pathSetupCommand", () => {
     ).toBeUndefined();
   });
 });
+
+describe("npmShimScript", () => {
+  const shim =
+    '@ECHO off\nGOTO start\n:find_dp0\nSET dp0=%~dp0\nEXIT /b\n:start\nSETLOCAL\nCALL :find_dp0\n\nIF EXIST "%dp0%\\node.exe" (\n  SET "_prog=%dp0%\\node.exe"\n) ELSE (\n  SET "_prog=node"\n  SET PATHEXT=%PATHEXT:;.JS;=;%\n)\n\nendLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\\node_modules\\@deepseek-ai\\dsh\\lib\\bin.js" %*\n';
+  const command = "C:\\npm\\dsh.cmd";
+  it("resolves a Node shim while refusing shell additions and missing scripts", () => {
+    expect(
+      npmShimScript(
+        command,
+        () => shim,
+        () => true,
+      ),
+    ).toBe("C:\\npm\\node_modules\\@deepseek-ai\\dsh\\lib\\bin.js");
+    expect(
+      npmShimScript(
+        "/tmp/npm/dsh.cmd",
+        () => shim,
+        (filePath) => filePath === "/tmp/npm/node_modules/@deepseek-ai/dsh/lib/bin.js",
+      ),
+    ).toBe("/tmp/npm/node_modules/@deepseek-ai/dsh/lib/bin.js");
+    expect(
+      npmShimScript(
+        command,
+        () => shim + "echo unsafe\n",
+        () => true,
+      ),
+    ).toBeUndefined();
+    expect(
+      npmShimScript(
+        command,
+        () => shim,
+        () => false,
+      ),
+    ).toBeUndefined();
+  });
+
+  it("resolves an npm 12 Node shim and rejects extra launch arguments", () => {
+    const npm12 =
+      '@ECHO off\nGOTO start\n:find_dp0\nSET dp0=%~dp0\nEXIT /b\n:start\nSETLOCAL\nCALL :find_dp0\n\nIF EXIST "%dp0%\\node.exe" (\n  SET "_prog=%dp0%\\node.exe"\n) ELSE (\n  SET "_prog=node"\n)\n\nendLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & set PATHEXT=%PATHEXT:;.JS;=;% & "%_prog%"  "%dp0%\\node_modules\\@deepseek-ai\\dsh\\lib\\bin.js" %*\n';
+    expect(
+      npmShimScript(
+        command,
+        () => npm12,
+        () => true,
+      ),
+    ).toBe("C:\\npm\\node_modules\\@deepseek-ai\\dsh\\lib\\bin.js");
+    expect(
+      npmShimScript(
+        command,
+        () => npm12.replace('"%_prog%"  "%dp0%', '"%_prog%" --experimental-strip-types "%dp0%'),
+        () => true,
+      ),
+    ).toBeUndefined();
+    expect(
+      npmShimScript(
+        command,
+        () => npm12 + "echo unsafe\n",
+        () => true,
+      ),
+    ).toBeUndefined();
+  });
+});
diff --git a/packages/shared/src/shell.ts b/packages/shared/src/shell.ts
index 8a0e0be51922a..d3c6161d6d5a9 100644
--- a/packages/shared/src/shell.ts
+++ b/packages/shared/src/shell.ts
@@ -760,6 +760,67 @@ export function npmShimExecutable(
   return isFile(executable) ? executable : undefined;
 }
 
+const NPM_NODE_SHIM_BODY = [
+  'IF EXIST "%dp0%\\node.exe" (',
+  '  SET "_prog=%dp0%\\node.exe"',
+  ") ELSE (",
+  '  SET "_prog=node"',
+  "  SET PATHEXT=%PATHEXT:;.JS;=;%",
+  ")",
+].join("\n");
+
+// cmd-shim 9, bundled with npm 12, moves that PATHEXT assignment onto the launch line.
+const NPM_NODE_SHIM_BODY_V9 = [
+  'IF EXIST "%dp0%\\node.exe" (',
+  '  SET "_prog=%dp0%\\node.exe"',
+  ") ELSE (",
+  '  SET "_prog=node"',
+  ")",
+].join("\n");
+
+const NPM_NODE_SHIM_LAUNCH =
+  /^endLocal & goto #_undefined_# 2>NUL \|\| title %COMSPEC% & "%_prog%"  "%dp0%\\([^"%]+)" %\*$/;
+const NPM_NODE_SHIM_LAUNCH_V9 =
+  /^endLocal & goto #_undefined_# 2>NUL \|\| title %COMSPEC% & set PATHEXT=%PATHEXT:;\.JS;=;% & "%_prog%"  "%dp0%\\([^"%]+)" %\*$/;
+
+function npmNodeShimTarget(body: ReadonlyArray<string>): string | undefined {
+  const launch = body.at(-1);
+  if (launch === undefined) return undefined;
+  if (body.length === 7 && body.slice(0, -1).join("\n") === NPM_NODE_SHIM_BODY) {
+    return NPM_NODE_SHIM_LAUNCH.exec(launch)?.[1];
+  }
+  if (body.length === 6 && body.slice(0, -1).join("\n") === NPM_NODE_SHIM_BODY_V9) {
+    return NPM_NODE_SHIM_LAUNCH_V9.exec(launch)?.[1];
+  }
+  return undefined;
+}
+
+// Keep the shim directory's original prefix. win32.join turns a POSIX temp path into a drive-root path.
+function joinShimTarget(shimPath: string, target: string): string {
+  const separatorIndex = Math.max(shimPath.lastIndexOf("/"), shimPath.lastIndexOf("\\"));
+  const directory = separatorIndex >= 0 ? shimPath.slice(0, separatorIndex + 1) : "";
+  const separator = shimPath.includes("\\") ? "\\" : "/";
+  return `${directory}${target.replaceAll(/[\\/]/g, separator)}`;
+}
+
+export function npmShimScript(
+  shimPath: string,
+  readFile: (filePath: string) => string | undefined = readFileSyncOrUndefined,
+  isFile: (filePath: string) => boolean = isFileSync,
+): string | undefined {
+  if (NodePath.win32.extname(shimPath).toLowerCase() !== ".cmd") return undefined;
+  const lines = readFile(shimPath)
+    ?.split(/\r?\n/)
+    .filter((line) => line.length > 0);
+  if (!lines || NPM_EXECUTABLE_SHIM_PREFIX.some((expected, index) => lines[index] !== expected)) {
+    return undefined;
+  }
+  const target = npmNodeShimTarget(lines.slice(NPM_EXECUTABLE_SHIM_PREFIX.length));
+  if (!target) return undefined;
+  const script = joinShimTarget(shimPath, target);
+  return isFile(script) ? script : undefined;
+}
+
 export type XcodeGitLocator = (env: NodeJS.ProcessEnv) => string | undefined;
 
 // xcrun honors DEVELOPER_DIR and the `xcode-select` choice, as the shim does.