Describe the bug

Hello! Here is the AI summary of the issue I have experienced with running "agency copilot"

Summary

On Windows, copilot.exe hard-crashes repeatedly (native access violation) when the
notifications setting is enabled. This setting shows an OS notification (with system
sound) when the agent needs user attention or finishes a turn. The crash is in the
native desktop-notification addon, not in the JS/agent logic. Setting
"notifications": false stops the crashes in that path.

Environment

• OS: Windows (Windows_NT)
• Shell: PowerShell
• Copilot CLI version: 1.0.69.0 (also observed on later 1.0.7x builds)
• Setting: notifications: true in ~/.copilot/settings.json

Frequency / impact

• 42 crashes over Jul 7-9, 2026 (~14 per day) captured in Windows Error Reporting
  (C:\ProgramData\Microsoft\Windows\WER\ReportArchive, product copilot.exe).
• Crashes cluster at turn completion / when the agent requests user attention while the
  terminal window is not focused (OS toasts are suppressed when the terminal has
  focus, so the crash only fires when a toast is actually raised).

Crash signatures (two consistent families, from minidump forensics)

• Family A (root cause): 0xC0000005 read access violation at
  cli-native.node+0x4fc08 - identical faulting offset every time.
  cli-native.node is the native N-API addon that hosts desktop notifications
  (Rust notify-rust 4.18.0 + windows-core / windows-registry WinRT interop).
• Family B (abort twin): 0xC0000409 __fastfail at copilot.exe+0x2224369
  (Node/V8 abort path, i.e. Rust panic=abort / napi_fatal_error).

Likely root cause

The faulting addon embeds the WinRT COM guard string
"Object has been over-released." (a refcount-underflow guard). Combined with the
varied crashing thread IDs, this points to a COM/threading use-after-free (or
double-release) when a Windows toast notification is raised from a worker/non-UI
thread. The MCP client (rmcp/tokio, which lives in the separate runtime.node
module) never appears in any crash frame - MCP is not involved.

Steps to reproduce

1. On Windows, set "notifications": true in ~/.copilot/settings.json.
2. Run Copilot CLI, start an agent turn, and switch focus away from the terminal so a
   toast is raised when the turn completes / requests attention.
3. Repeat across turns - copilot.exe crashes (WER AppCrash_copilot.exe reports and
   %LOCALAPPDATA%\CrashDumps\copilot.exe.<pid>.dmp dumps are produced).

Workaround

Set "notifications": false in ~/.copilot/settings.json. Crashes in the toast path
stop.

Suggested fix direction

Marshal the toast notification call onto a proper STA/UI thread (or serialize access to
the WinRT toast object) and audit the COM refcounting in the notify-rust / WinRT path
inside cli-native.node to eliminate the over-release / use-after-free.

Affected version

1.0.69.0

Steps to reproduce the behavior

1. On Windows, set "notifications": true in ~/.copilot/settings.json.
2. Run Copilot CLI, start an agent turn, and switch focus away from the terminal so a
   toast is raised when the turn completes / requests attention.
3. Repeat across turns - copilot.exe crashes (WER AppCrash_copilot.exe reports and
   %LOCALAPPDATA%\CrashDumps\copilot.exe.<pid>.dmp dumps are produced).

Expected behavior

No crash

Additional context

AppCrash_copilot.exe_59af35ac2065dc596cd298fca29c8e048a8e9_6e03009c_2fa2e280-cedd-4017-a8bd-68044c93cd23.zip