XERJ (opens in a new tab) is an open-source search engine built for coding agents. It gives an agent the exact passage of code or documentation it needs, so the agent does not have to guess from memory. On top of it, XERJ runs the Corpus Hub: a public index of selected code that agents consult before they write their own version.
We did not apply. In October 2026 the XERJ team found Kaine Forge (opens in a new tab) on its own, reached out to us and selected it for the hub. We agreed on 19 October, and Kaine Forge now has its own contributor page (opens in a new tab) on the Corpus Hub.
XERJ pointed to one piece of work in particular: the change that lets the Kaine Forge agent desk run its builds and checks on Linux from a Windows host. The rest of this article explains that change.
The problem: checks that pass only on Linux
Kaine Forge includes an agent desk, a local software factory. It takes a GitHub issue through plan, build, check and review, then opens a draft pull request. The owner approves at two gates and merges every pull request. In Docker mode the builder and the checks run in containers. A container reaches only the AI provider through a proxy, sees no host files and holds no GitHub token, so Docker mode protects the host from a prompt-injected agent.
On a Windows host this broke in two places. The container policy accepted only Linux-style folder paths, so every container run failed with "Refusing the bind mount". The checks before shipping also still ran on the host. Some repository tests pass only on Linux and macOS, so pnpm check could not pass on Windows and the desk could not ship.
The fix
- Windows paths, with the same guard. The container policy now accepts an absolute Windows drive path such as
C:\workas a bind-mount source. It still refuses the root, the Docker pipe and network shares. - Every check on Linux. In Docker mode the ship checks now run through the same isolation port as the loop checks. A Windows host runs every check in a Linux container, as CI does.
- Executable files keep their mode. Git on Windows sets
core.fileMode=falseand keeps the executable bit only in the index. The desk now applies a container patch withgit apply --cachedon a scratch copy of the index, so new and renamed executables keep their bit. Ship carries those bits through itsgit resetandgit add. - No silent fallback. When an issue runs in Docker mode and the process has no Docker support, ship refuses to run its checks on the host.
| Step | Host mode | Docker mode |
|---|---|---|
| Planner and reviewer (read-only) | Host | Host |
| Builder | Host | Container |
Check stage (pnpm generate, loop checks) | Host | Container, one per step |
Ship checks (pnpm check before the commit) | Host | Container, one per step |
| Ship (commit, push, pull request) | Host | Host |
/**
* An absolute folder below the root: POSIX (`/x`) or a Windows drive (`C:\x`).
* No root, no relative path, no UNC share or device path (`\\server`, `\\.\pipe`).
*/
const HOST_FOLDER = /^(?:\/|[A-Za-z]:[\\/])[^\\/]/;Tests landed with the fix
The code change spans 14 TypeScript files and 438 changed lines, and its tests landed in the same commit. They cover the container policy, the patch transfer, the git steps of ship and a Docker integration run. A review round then closed the edge cases: a folder named docker_engine is mountable again, and renamed executables and quoted file names keep their bits.
What this means for clients
The same practices run on client projects. Checks run where CI runs them, agents work inside guarded containers, and a person reviews every change before it ships. Read how we apply them in agentic engineering in practice, or see our AI-assisted delivery service.
Kaine Forge is open source on GitHub (opens in a new tab). Read the change itself (opens in a new tab), or see the XERJ contributor page (opens in a new tab).