@vellumai/assistant 0.12.2-staging.7 → 0.12.2

package/src/plugins/defaults/memory/v3/pool-select.ts

@@ -42,11 +42,9 @@
  *   - infrastructure failure (selector provider unavailable — e.g. a transient
  *     CES credential blip drops the API key — or no usable `tool_use` / schema
  *     mismatch surviving the short re-prompt retry) → throw
- *     {@link MemoryV3RetrievalUnavailableError}. The orchestrator keeps the
- *     stable prefix unjudged for the turn and drops the finder candidates,
- *     recording the pool with `selector_ran = 0`; the live injector renders
- *     that prefix and queues a notice that the turn drew on core memories
- *     only.
+ *     {@link MemoryV3RetrievalUnavailableError}. The live injector treats this
+ *     as a logged memory miss for the turn; shadow/observation callers swallow
+ *     it so v2 retrieval can serve the turn.
  */
 
 import type {
@@ -54,12 +52,12 @@ import type {
   Message,
   ToolUseContent,
 } from "@vellumai/plugin-api";
-import { getConfiguredProvider, safeStringSlice } from "@vellumai/plugin-api";
+import { getConfiguredProvider } from "@vellumai/plugin-api";
 import { z } from "zod";
 
 import { classifyConversationError } from "../../../../daemon/conversation-error.js";
 import type { PendingConversationNotice } from "../../../../daemon/conversation-notices.js";
-import { redactLogString, truncate } from "../host-utils.js";
+import { redactLogString, safeStringSlice, truncate } from "../host-utils.js";
 import {
   cachedTextBlock,
   extractToolUse,
@@ -502,9 +500,8 @@ export interface PoolSelection {
  *
  * An omitted `ids` keeps ALL candidates (the recall-safe "all of these are
  * relevant" signal, `keptAll: true`); an explicit `[]` keeps none; an
- * infrastructure failure (after a short re-prompt retry) throws
- * {@link MemoryV3RetrievalUnavailableError}, and the orchestrator keeps the
- * stable prefix unjudged in its place.
+ * infrastructure failure (after a short re-prompt retry) keeps none, degrading
+ * to the deterministic recall lanes the orchestrator unions in.
  *
  * `systemPrompt` is the selector's instruction scaffold; it defaults to the
  * bundled {@link SYSTEM_PROMPT} and is overridable via `memory.v3.selectorPromptPath`

package/src/plugins/defaults/memory/v3/sections.ts

@@ -1,5 +1,4 @@
-import { safeStringSlice } from "@vellumai/plugin-api";
-
+import { safeStringSlice } from "../host-utils.js";
 import type { Section, SectionIndex, Slug } from "./types.js";
 
 /**

package/src/plugins/defaults/memory/v3/shadow-plugin.ts

@@ -32,7 +32,6 @@ import {
   getMessages,
   listInstalledSkills,
   parseMessageMetadata,
-  safeStringSlice,
   stringifyMessageContent,
   VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND,
 } from "@vellumai/plugin-api";
@@ -45,7 +44,7 @@ import {
   timeLatencySubSpan,
 } from "../../../../daemon/turn-latency-sub-spans.js";
 import { enqueueMemoryJob } from "../../../../persistence/jobs-store.js";
-import { stripCommentLines } from "../host-utils.js";
+import { safeStringSlice, stripCommentLines } from "../host-utils.js";
 import { getLogger } from "../logging.js";
 import { type MemorySqlite, memorySqliteOrNull } from "../memory-db.js";
 import { getWorkspaceDir, getWorkspacePromptPath } from "../paths.js";
@@ -636,16 +635,8 @@ interface SelectionRow {
  * The row holds one section per slug: the selection's FIRST selected section
  * (pool order) stands for the page; a page selected with no section (a card,
  * or a section-less edge or learned line) logs none.
- *
- * A turn whose selector could not run (`selectorFailure`) logs no rows: its
- * selections are the stable prefix kept unjudged, and the selection table is
- * what the hot set's frecency and the learned-edge graph read as judgments.
- * The pool record still carries the turn for the inspector.
  */
 export function attributeSelections(result: OrchestrateResult): SelectionRow[] {
-  if (result.selectorFailure) {
-    return [];
-  }
   const core = new Set<Slug>(result.lanes.core);
   const hot = new Set<Slug>(result.lanes.hot);
   const fresh = new Set<Slug>(result.lanes.fresh);

package/src/plugins/defaults/tool-result-truncate/terminal.ts

@@ -6,7 +6,52 @@
  * This module is side-effect free: importing it does not register any plugin.
  */
 
-import { safeStringSlice } from "@vellumai/plugin-api";
+const HIGH_SURROGATE_START = 0xd800;
+const HIGH_SURROGATE_END = 0xdbff;
+const LOW_SURROGATE_START = 0xdc00;
+const LOW_SURROGATE_END = 0xdfff;
+
+function isHighSurrogate(code: number): boolean {
+  return code >= HIGH_SURROGATE_START && code <= HIGH_SURROGATE_END;
+}
+
+function isLowSurrogate(code: number): boolean {
+  return code >= LOW_SURROGATE_START && code <= LOW_SURROGATE_END;
+}
+
+/**
+ * Slice a string by code-unit indices without splitting a surrogate pair, so
+ * the result never ends or begins mid-emoji. Indices are clamped to the
+ * string bounds; a cut that would land between a high/low surrogate is nudged
+ * inward to the nearest whole code point.
+ */
+function safeStringSlice(
+  str: string,
+  start = 0,
+  end: number = str.length,
+): string {
+  let safeStart = Math.max(0, Math.min(str.length, start));
+  let safeEnd = Math.max(safeStart, Math.min(str.length, end));
+
+  if (safeEnd < str.length && safeEnd > safeStart) {
+    const lastCode = str.charCodeAt(safeEnd - 1);
+    if (isHighSurrogate(lastCode)) {
+      safeEnd--;
+    }
+  }
+
+  if (safeStart > 0 && safeStart < str.length) {
+    const firstCode = str.charCodeAt(safeStart);
+    if (isLowSurrogate(firstCode)) {
+      safeStart++;
+      if (safeStart > safeEnd) {
+        safeEnd = safeStart;
+      }
+    }
+  }
+
+  return str.slice(safeStart, safeEnd);
+}
 
 /**
  * Minimum number of characters to preserve when truncating.

package/src/runtime/AGENTS.md

@@ -303,4 +303,4 @@ The provider-level rate limiter (`providers/ratelimit.ts`) also logs warnings (m
 
 HTTP is the sole transport for client-daemon communication. The runtime HTTP server (`assistant/src/runtime/http-server.ts`) is the canonical API surface. Clients connect via HTTP for request/response operations and SSE (`GET /v1/events`) for streaming server-to-client events.
 
-A skill never calls the runtime HTTP API directly: every request from a skill targets the gateway, and `gateway-only-guard.test.ts` fails CI on a runtime-port URL in a skill. For configuration reads, use the CLI (`assistant config get`); for control-plane writes with no CLI verb, use `$INTERNAL_GATEWAY_BASE_URL`. See "Gateway-Only API Consumption" in `gateway/AGENTS.md` for the rule and its exceptions.
+When writing skills that need to call daemon configuration endpoints, use `curl` with the runtime HTTP API (JWT-authenticated via `Authorization: Bearer <jwt>`). The assistant already knows how to use `curl`.

package/src/runtime/__tests__/agent-wake.test.ts

@@ -18,10 +18,9 @@
  * route captured calls back to the originating conversation's probe arrays.
  */
 
-import { beforeEach, describe, expect, mock, spyOn, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { DiskPressureStatus } from "../../daemon/disk-pressure-guard.js";
-import { desktopAutomationLease } from "../../desktop/desktop-automation-lease.js";
 
 // ── Per-conversation capture registry ────────────────────────────────
 //
@@ -502,13 +501,6 @@ function makeWakeConversation(options: {
         `tools:${snapshotAllowedTools()?.join(",") ?? "all"}`,
       );
     },
-    // Mirrors Conversation.setPreactivatedSkillIds; the wake's tool-scope
-    // restore calls it, and a double without it throws inside the restore
-    // closure, leaving every field restored after it untouched.
-    preactivatedSkillIds: undefined as string[] | undefined,
-    setPreactivatedSkillIds(ids: string[] | undefined) {
-      this.preactivatedSkillIds = ids;
-    },
     get wakePersonaOverride() {
       return wakePersonaOverride;
     },
@@ -1365,42 +1357,6 @@ describe("wakeAgentForOpportunity", () => {
     expect(conversation.toolContextPin).toBeUndefined();
   });
 
-  test("applies wireToolDefinitions alongside the allowlist and restores it after the wake", async () => {
-    const replay = [
-      { name: "remember", description: "Save", input_schema: {} },
-      { name: "bell_jingle", description: "Ring", input_schema: {} },
-    ];
-    let replayDuringRun: unknown;
-    const conversation = makeWakeConversation({
-      runImpl: async (input) => {
-        replayDuringRun = conversation.wireToolReplay;
-        return runResult([
-          ...input,
-          { role: "assistant", content: [{ type: "text", text: "Saved." }] },
-        ]);
-      },
-    });
-
-    const result = await wakeAgentForOpportunity(
-      {
-        conversationId: conversation.conversationId,
-        hint: "review for memories",
-        source: "memory-retrospective",
-        allowedTools: ["remember"],
-        toolGateMode: "execution",
-        wireToolDefinitions: replay,
-      },
-      { resolveTarget: async () => conversation },
-    );
-
-    expect(result).toEqual({ invoked: true, producedToolCalls: false });
-    // The replay array is live on the conversation for the duration of the
-    // run (the tool resolver returns it as the wire array)...
-    expect(replayDuringRun).toEqual(replay);
-    // ...and cleared alongside the allowlist + gate mode after the wake.
-    expect(conversation.wireToolReplay).toBeUndefined();
-  });
-
   test("defaults to the wire gate mode when toolGateMode is absent", async () => {
     let gateModeDuringRun: string | undefined;
     const conversation = makeWakeConversation({
@@ -1561,47 +1517,6 @@ describe("wakeAgentForOpportunity", () => {
     expect(conversation.pushedMessages[2]).toEqual(followupAssistant);
   });
 
-  for (const fails of [false, true]) {
-    test(`releases desktop control before a ${fails ? "failed" : "completed"} wake drains the queue`, async () => {
-      const conversation = makeWakeConversation({
-        scriptedAssistant: {
-          role: "assistant",
-          content: [{ type: "text", text: "reply" }],
-        },
-        ...(fails
-          ? {
-              runImpl: async () => {
-                throw new Error("wake failed");
-              },
-            }
-          : {}),
-      });
-      const release = spyOn(desktopAutomationLease, "releaseForConversation");
-      const setProcessing = conversation.setProcessing.bind(conversation);
-      conversation.setProcessing = (processing) => {
-        if (!processing) {
-          expect(release).toHaveBeenCalledWith(conversation.conversationId);
-        }
-        setProcessing(processing);
-      };
-      try {
-        const result = await wakeAgentForOpportunity(
-          {
-            conversationId: conversation.conversationId,
-            hint: "x",
-            source: "unit-test",
-          },
-          { resolveTarget: async () => conversation },
-        );
-        expect(result.invoked).toBe(!fails);
-        expect(release).toHaveBeenCalledTimes(1);
-        expect(conversation.drainQueueCalls).toBe(1);
-      } finally {
-        release.mockRestore();
-      }
-    });
-  }
-
   test("marks processing true during the run and false afterwards", async () => {
     const conversation = makeWakeConversation({
       baseline: [{ role: "user", content: [{ type: "text", text: "hi" }] }],

package/src/runtime/agent-wake.ts

@@ -107,7 +107,6 @@ import {
   persistWakeTriggerMessage,
   scopeWakeAllowedTools,
 } from "../daemon/wake-conversation-ops.js";
-import { desktopAutomationLease } from "../desktop/desktop-automation-lease.js";
 import {
   recordCompactionEndBestEffort,
   recordCompactionStartBestEffort,
@@ -119,7 +118,7 @@ import {
   setAgentLoopExitReasonOnLatestLog,
 } from "../persistence/llm-request-log-store.js";
 import type { SystemPromptPersonaOverride } from "../prompts/system-prompt.js";
-import type { Message, ToolDefinition } from "../providers/types.js";
+import type { Message } from "../providers/types.js";
 import {
   type UntrustedContentSource,
   wrapUntrustedContent,
@@ -351,17 +350,6 @@ export interface WakeOptions {
    * skill-management authoring tools callable directly.
    */
   preactivateSkillIds?: readonly string[];
-  /**
-   * Tool definitions to send verbatim as the wake's wire tool array, in place
-   * of the ones the conversation would resolve for itself. Used by fork-based
-   * memory retrospectives to replay the SOURCE conversation's recorded surface
-   * (`getConversationToolSurface`) so the provider prompt-cache prefix matches
-   * the source's live turns byte for byte. Definitions only: what may execute
-   * is still decided by `allowedTools` and the turn's own active set. Applied
-   * and restored alongside `allowedTools`; ignored when `allowedTools` is
-   * absent.
-   */
-  wireToolDefinitions?: readonly ToolDefinition[];
   /**
    * Explicit persona/channel slugs for the wake's system-prompt build,
    * applied to the conversation for the duration of the run and restored
@@ -1422,7 +1410,6 @@ export async function wakeAgentForOpportunity(
      * is one function rather than a rebuild bolted onto either half.
      */
     const restoreWakeTurnScope = (): void => {
-      desktopAutomationLease.releaseForConversation(conversationId);
       restoreWakeAllowedTools();
       clearWakePersonaOverride();
       syncWakeLoopSystemPrompt();
@@ -1435,12 +1422,9 @@ export async function wakeAgentForOpportunity(
         restoreWakeToolScope = scopeWakeAllowedTools(
           conversation,
           new Set(opts.allowedTools),
-          {
-            gateMode: opts.toolGateMode,
-            toolContextPin: opts.toolContextPin,
-            preactivateSkillIds: opts.preactivateSkillIds,
-            wireToolDefinitions: opts.wireToolDefinitions,
-          },
+          opts.toolGateMode,
+          opts.toolContextPin,
+          opts.preactivateSkillIds,
         );
         return true;
       } catch (err) {

package/src/runtime/guardian-action-service.ts

@@ -16,6 +16,21 @@ import {
   isApprovalAction,
 } from "./channel-approval-types.js";
 
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+/**
+ * Legacy actions that map to canonical ones during client rollout.
+ * All temporal/persistent approval variants collapse to approve_once.
+ * Keep until all clients are updated and no in-flight buttons remain.
+ */
+const LEGACY_ACTION_MAP: Record<string, string> = {
+  approve_10m: "approve_once",
+  approve_conversation: "approve_once",
+  approve_always: "approve_once",
+};
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -83,8 +98,8 @@ export async function processGuardianDecision(
 ): Promise<ProcessGuardianDecisionResult> {
   const { requestId, conversationId, channel, actorContext } = params;
 
-  // 1. Validate the action
-  const action = params.action;
+  // 1. Canonicalize legacy actions, then validate
+  const action = LEGACY_ACTION_MAP[params.action] ?? params.action;
   if (!isApprovalAction(action)) {
     return {
       ok: false,

package/src/runtime/guardian-reply-router.ts

@@ -153,6 +153,12 @@ export interface GuardianReplyResult {
 // Callback data parser — format: "apr:<requestId>:<action>"
 // ---------------------------------------------------------------------------
 
+const LEGACY_CALLBACK_MAP: Record<string, string> = {
+  approve_10m: "approve_once",
+  approve_conversation: "approve_once",
+  approve_always: "approve_once",
+};
+
 interface ParsedCallback {
   requestId: string;
   action: ApprovalAction;
@@ -164,7 +170,8 @@ function parseCallbackAction(data: string): ParsedCallback | null {
     return null;
   }
   const requestId = parts[1];
-  const action = parts.slice(2).join(":");
+  const rawAction = parts.slice(2).join(":");
+  const action = LEGACY_CALLBACK_MAP[rawAction] ?? rawAction;
   if (!requestId || !isApprovalAction(action)) {
     return null;
   }

package/src/runtime/routes/channel-route-shared.ts

@@ -29,6 +29,13 @@ export function requiredDecisionKeywords(
 // Callback data parser — format: "apr:<requestId>:<action>"
 // ---------------------------------------------------------------------------
 
+/** Map legacy callback actions to canonical ones for in-flight buttons. */
+const LEGACY_CALLBACK_MAP: Record<string, string> = {
+  approve_10m: "approve_once",
+  approve_conversation: "approve_once",
+  approve_always: "approve_once",
+};
+
 export function parseCallbackData(
   data: string,
   sourceChannel?: string,
@@ -38,7 +45,8 @@ export function parseCallbackData(
     return null;
   }
   const requestId = parts[1];
-  const action = parts.slice(2).join(":");
+  const rawAction = parts.slice(2).join(":");
+  const action = LEGACY_CALLBACK_MAP[rawAction] ?? rawAction;
   if (!requestId || !isApprovalAction(action)) {
     return null;
   }

package/src/runtime/routes/desktop-setup-routes.test.ts

@@ -79,8 +79,8 @@ describe("desktop setup route feature gate", () => {
       setOverridesForTesting({ "assistant-desktop": true });
       expect(route.handler({})).toEqual(
         route.method === "GET"
-          ? { state: "required", automationActive: false }
-          : { state: "installing", stage: "packages", automationActive: false },
+          ? { state: "required" }
+          : { state: "installing", stage: "packages" },
       );
       expect(route.method === "GET" ? status : start).toHaveBeenCalledTimes(1);
       expect(route.method === "GET" ? start : status).not.toHaveBeenCalled();

package/src/runtime/routes/desktop-setup-routes.ts

@@ -1,7 +1,6 @@
 import { z } from "zod";
 
 import { getConfig } from "../../config/loader.js";
-import { desktopAutomationLease } from "../../desktop/desktop-automation-lease.js";
 import { desktopDependencyInstaller } from "../../desktop/desktop-dependencies.js";
 import { isVirtualDesktopEnabled } from "../../desktop/virtual-desktop-feature.js";
 import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
@@ -10,7 +9,6 @@ import type { RouteDefinition } from "./types.js";
 
 const statusSchema = z.object({
   state: z.enum(["required", "installing", "ready", "failed", "unsupported"]),
-  automationActive: z.boolean().optional(),
   stage: z.enum(["packages", "chrome", "checking"]).optional(),
 });
 
@@ -26,11 +24,9 @@ export const ROUTES: RouteDefinition[] = ["GET", "POST"].map((method) => ({
         "Virtual desktop is available only on enabled platform-hosted assistants",
       );
     }
-    const status =
-      method === "GET"
-        ? desktopDependencyInstaller.getStatus()
-        : desktopDependencyInstaller.start();
-    return { ...status, automationActive: desktopAutomationLease.isActive };
+    return method === "GET"
+      ? desktopDependencyInstaller.getStatus()
+      : desktopDependencyInstaller.start();
   },
   summary:
     method === "GET"

package/src/runtime/routes/guardian-approval-interception.ts

@@ -299,30 +299,6 @@ export async function handleApprovalInterception(
 
       return { handled: true, type: "stale_ignored" };
     }
-
-    // An approval callback that names no approval action is a button press
-    // the daemon does not serve (an id outside the decision vocabulary, or an
-    // answer token aimed at a card this rail does not resolve). It is never
-    // text: the channel normalizers copy callback data into `content`, so
-    // letting it fall through would hand the raw callback to the
-    // conversational and natural-language parsers, which can read a token
-    // like `approve_always` as an approval. Consume it as a stale button.
-    if (callbackData.startsWith("apr:")) {
-      log.warn(
-        { conversationId, callbackData },
-        "Approval callback carries no approval action, ignoring stale button press",
-      );
-      if (approvalMessageId) {
-        editStaleApprovalMessage({
-          replyCallbackUrl,
-          chatId: conversationExternalId,
-          messageId: approvalMessageId,
-          assistantId,
-          conversationId,
-        });
-      }
-      return { handled: true, type: "stale_ignored" };
-    }
   }
 
   // ── Conversational approval engine for plain-text messages ──

package/src/runtime/routes/inbound-message-handler.ts

@@ -1531,7 +1531,8 @@ export async function handleChannelInbound({
         sourceMetadata.account.length > 0
           ? sourceMetadata.account
           : undefined;
-      const botMentioned = sourceMetadata?.botMentioned === true;
+      const slackBotMentioned =
+        sourceChannel === "slack" && sourceMetadata?.slackBotMentioned === true;
 
       // ── DM cold-start backfill ──
       // First time a Slack DM without thread_ts lands in a conversation that
@@ -1624,7 +1625,7 @@ export async function handleChannelInbound({
         approvalCopyGenerator,
         chatType: sourceChatType,
         clientTimezone: inboundClientTimezone,
-        botMentioned,
+        slackBotMentioned,
         slackInbound,
         channelInbound,
       });

package/src/runtime/routes/inbound-stages/background-dispatch.test.ts

@@ -1169,7 +1169,7 @@ describe("channel activity timing", () => {
       externalChatId: channelId,
       trustCtx,
       metadataHints: [],
-      botMentioned: true,
+      slackBotMentioned: true,
       replyCallbackUrl: `https://example.test/deliver/slack?channel=${channelId}&threadTs=${threadTs}`,
     });
 

package/src/runtime/routes/inbound-stages/background-dispatch.ts

@@ -105,11 +105,8 @@ export interface BackgroundProcessingParams {
   chatType?: string;
   /** IANA timezone reported by the active client for the current turn. */
   clientTimezone?: string;
-  /**
-   * The message addresses the assistant by name, as stated by the channel
-   * (`sourceMetadata.botMentioned`). Absent means not established.
-   */
-  botMentioned?: boolean;
+  /** Slack app_mention/direct bot mention signal from the gateway. */
+  slackBotMentioned?: boolean;
   /**
    * Slack-specific inbound metadata extracted at the HTTP boundary. Threaded
    * through to `persistUserMessage` so the row can be tagged with a
@@ -169,7 +166,7 @@ export function processChannelMessageInBackground(
     sourceLanguageCode,
     chatType,
     clientTimezone,
-    botMentioned,
+    slackBotMentioned,
     slackInbound,
     channelInbound,
     slackReactionRowMeta,
@@ -207,7 +204,7 @@ export function processChannelMessageInBackground(
       initiatorUserId: slackInbound?.actorExternalUserId,
       startImmediately: shouldShowActivityImmediately({
         chatType,
-        botMentioned,
+        botMentioned: slackBotMentioned,
       }),
     });
     const stopApprovalWatcher = replyCallbackUrl

package/src/schedule/run-script.ts

@@ -1,7 +1,6 @@
 import { buildSanitizedEnv } from "../tools/terminal/safe-env.js";
 import {
   buildShellInvocation,
-  buildShellSpawnFlags,
   terminateProcessTree,
 } from "../util/host-process.js";
 import { getLogger } from "../util/logger.js";
@@ -65,9 +64,10 @@ export async function runScript(
   const shell = buildShellInvocation(command);
   const proc = Bun.spawn([shell.command, ...shell.args], {
     cwd,
-    ...buildShellSpawnFlags(),
+    detached: true,
     stdout: "pipe",
     stderr: "pipe",
+    windowsHide: true,
     env: {
       ...buildSanitizedEnv(),
       // __SCHEDULE_ID lets a saved command find its own dir; __SCHEDULE_RUN_ID

package/src/tools/host-terminal/host-shell.ts

@@ -23,10 +23,8 @@ import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import {
   buildShellInvocation,
-  buildShellSpawnFlags,
   prependUniquePathEntries,
   terminateProcessTree,
-  watchShellProcessStart,
 } from "../../util/host-process.js";
 import { getLogger } from "../../util/logger.js";
 import type { CompletedBackgroundTool } from "../background-tool-registry.js";
@@ -457,9 +455,9 @@ export const hostShellTool = {
         cwd: workingDir,
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
-        ...buildShellSpawnFlags(),
+        detached: true,
+        windowsHide: true,
       });
-      const launch = watchShellProcessStart(child);
 
       const collector = attachBoundedStdio(child);
       let timedOut = false;
@@ -485,9 +483,7 @@ export const hostShellTool = {
         }
         completed = true;
         clearTimeout(timer);
-        const result = collector.format(code, timedOut, timeoutSec, {
-          started: launch.didStart(),
-        });
+        const result = collector.format(code, timedOut, timeoutSec);
         // Cancel takes precedence over the SIGKILL-induced error result.
         const status = aborted
           ? "cancelled"
@@ -633,9 +629,9 @@ export const hostShellTool = {
         cwd: workingDir,
         env: hostEnv,
         stdio: ["ignore", "pipe", "pipe"],
-        ...buildShellSpawnFlags(),
+        detached: true,
+        windowsHide: true,
       });
-      const launch = watchShellProcessStart(child);
       const collector = attachBoundedStdio(child, {
         onOutput: context.onOutput,
       });
@@ -661,9 +657,7 @@ export const hostShellTool = {
         clearTimeout(timer);
         context.signal?.removeEventListener("abort", onAbort);
 
-        const result = collector.format(code, timedOut, timeoutSec, {
-          started: launch.didStart(),
-        });
+        const result = collector.format(code, timedOut, timeoutSec);
 
         resolve({
           content: result.content,

package/src/tools/shared/filesystem/file-ops-service.ts

@@ -4,7 +4,6 @@ import { dirname, join } from "node:path";
 import { minimatch } from "minimatch";
 
 import { ensureDir, pathExists } from "../../../util/fs.js";
-import { surrogateSafeWindow } from "../../../util/unicode.js";
 import { isAbortLikeError } from "../abort.js";
 import { applyEdit } from "./edit-engine.js";
 import * as Err from "./errors.js";
@@ -103,6 +102,37 @@ function truncationNotice(
   return `\n\n[Truncated: characters ${start}-${end} of ${totalChars}. Read on with start_index=${end}.]`;
 }
 
+const isHighSurrogate = (code: number): boolean =>
+  code >= 0xd800 && code <= 0xdbff;
+const isLowSurrogate = (code: number): boolean =>
+  code >= 0xdc00 && code <= 0xdfff;
+
+/**
+ * Character window that never splits a surrogate pair. A split leaves a lone
+ * half at each edge, and each encodes to U+FFFD, so the character is lost from
+ * both this window and the next one paged in after it.
+ */
+export function surrogateSafeWindow(
+  total: number,
+  charCodeAt: (index: number) => number,
+  requestedStart: number,
+  maxChars: number,
+): { start: number; end: number } {
+  let start = Math.max(0, Math.min(requestedStart, total));
+  if (start > 0 && start < total && isLowSurrogate(charCodeAt(start))) {
+    start -= 1;
+  }
+
+  let end = Math.min(total, start + maxChars);
+  if (end > start && end < total && isHighSurrogate(charCodeAt(end - 1))) {
+    // Backing off would empty a one-character window, which stalls paging on
+    // the same offset, so take the whole pair instead.
+    end = end - 1 > start ? end - 1 : Math.min(total, end + 1);
+  }
+
+  return { start, end };
+}
+
 export class FileSystemOps {
   private policy: PathPolicy;
   private sizeLimit: number | undefined;