mixdog 0.8.0 → 0.9.0

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -6,12 +6,12 @@ const MIN_PROVIDER_TIMEOUT_MS = 30_000;
 export const STALL_TICK_MS = 15_000;
 export const DEFAULT_STALL_WARN_S = 300;
 export const DEFAULT_STALL_ABORT_S = 600;
-// First-byte (no-stream-delta) abort for the bridge stall watchdog. A wedged
+// First-byte (no-stream-delta) abort for the agent stall watchdog. A wedged
 // socket can sit at stage=requesting with zero server events. The 30s deadline
 // trialed here false-aborted slow high-reasoning first bytes (e.g. gpt-5.5
 // XHIGH, which can legitimately think >30s before the first delta) and, paired
 // with dispatch auto-retry, produced premature aborts + duplicate re-dispatches.
-// Auto-retry is now removed (bridge-retry.mjs MAX_ATTEMPTS = 1), so a single
+// Auto-retry is now removed, so a single
 // attempt must get a generous first-byte window: 300s (5 min). Env-overridable.
 export const DEFAULT_STALL_FIRST_BYTE_ABORT_S = (() => {
     const raw = process.env.MIXDOG_STALL_FIRST_BYTE_ABORT_S;
@@ -58,6 +58,14 @@ export function resolveTimeoutMs(envNames, fallbackMs, { minMs = 1_000, maxMs =
     return Math.min(Math.max(fallbackMs, minMs), maxMs);
 }
 
+// While a tool call is in flight, bump lastProgressAt on this cadence so long
+// executions stay "active" without emitting model-visible content.
+export const DEFAULT_ACTIVITY_HEARTBEAT_MS = resolveTimeoutMs(
+    'MIXDOG_AGENT_ACTIVITY_HEARTBEAT_MS',
+    30_000,
+    { minMs: 5_000, maxMs: 300_000 },
+);
+
 export const PROVIDER_FIRST_BYTE_TIMEOUT_MS = resolveTimeoutMs(
     'MIXDOG_PROVIDER_FIRST_BYTE_TIMEOUT_MS',
     Math.min(120_000, PROVIDER_MAX_BEFORE_WARN_MS),
@@ -94,19 +102,26 @@ export const PROVIDER_HTTP_RESPONSE_TIMEOUT_MS = resolveTimeoutMs(
     { minMs: 10_000, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
 );
 
-// Stream idle watchdog is OFF by default — matches Claude Code native
-// behaviour (its watchdog is gated behind CLAUDE_ENABLE_STREAM_WATCHDOG).
-// The bridge stall watchdog (STALL_ABORT_S, 600s) is the backstop for
-// genuinely dead streams; this short inter-chunk idle watchdog only adds
-// value when explicitly enabled, and otherwise prematurely kills slow
-// high-reasoning streams. Enable with MIXDOG_ENABLE_STREAM_WATCHDOG=1.
+// Stream idle watchdog is ON by default. Earlier it was OFF (reference-agent
+// parity) on the theory that a short inter-chunk timer would false-abort slow
+// high-reasoning streams — but every provider's SSE loop resets the idle timer
+// on EVERY chunk, including content-free keepalives (Anthropic `:ping`,
+// OpenAI/compat reasoning_content deltas, Gemini chunks). So a live
+// extended-thinking stream keeps the timer fresh; only a genuinely silent
+// socket (no bytes at all for the whole window) trips it. With the watchdog
+// OFF, such a wedged socket sat until the 600s agent stall backstop, which the
+// trace logs showed as the dominant mid-stream hang (sse_parse_ms p99 ~183s,
+// max ~411s). Defaulting ON with a generous 120s window cuts that tail ~5x
+// while leaving genuine reasoning pauses (kept alive by keepalive frames)
+// untouched. Force OFF with MIXDOG_ENABLE_STREAM_WATCHDOG=0.
 const _sseWatchdogRaw = process.env.MIXDOG_ENABLE_STREAM_WATCHDOG;
-export const PROVIDER_SSE_IDLE_WATCHDOG_ENABLED =
-    _sseWatchdogRaw === '1' || _sseWatchdogRaw === 'true' || _sseWatchdogRaw === 'yes';
+export const PROVIDER_SSE_IDLE_WATCHDOG_ENABLED = _sseWatchdogRaw === undefined || _sseWatchdogRaw === ''
+    ? true
+    : (_sseWatchdogRaw === '1' || _sseWatchdogRaw === 'true' || _sseWatchdogRaw === 'yes');
 
 export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs(
     'MIXDOG_PROVIDER_SSE_IDLE_TIMEOUT_MS',
-    90_000,
+    120_000,
     { minMs: 10_000, maxMs: STALL_WARN_MS },
 );
 
@@ -143,15 +158,15 @@ export const PROVIDER_RETRY_JITTER_RATIO = (() => {
     return 0.2;
 })();
 
-export function resolveBridgeStallThresholds(role, env = process.env) {
+export function resolveAgentStallThresholds(role, env = process.env) {
     const cfg = role ? getHiddenRole(role) : null;
     const cfgAbort = cfg?.stallCap?.idleSeconds > 0 ? cfg.stallCap.idleSeconds : STALL_ABORT_S;
     const envOverride = envThresholdSeconds(env);
     const abort = envOverride != null ? envOverride : cfgAbort;
-    // Mid-stream "slow" warning disabled — a bridge stall now notifies ONLY at
+    // Mid-stream "slow" warning disabled — an agent stall now notifies ONLY at
     // the abort deadline (10 min default). warn === abort means the watchdog's
     // warn branch (verdict 'ok' && stale >= warn) can never fire before 'stall',
-    // so the only notification a stalled bridge worker emits is at the deadline.
+    // so the only notification a stalled agent worker emits is at the deadline.
     const warn = abort;
     // First-byte deadline: a request still in 'requesting' that never produced a
     // single SSE delta is hung, not slow-reasoning. Abort on this shorter deadline
@@ -160,7 +175,7 @@ export function resolveBridgeStallThresholds(role, env = process.env) {
     return { warn, abort, firstByteAbort };
 }
 
-export function resolveBridgeToolThresholdSeconds(role, thresholdSeconds) {
+export function resolveAgentToolThresholdSeconds(role, thresholdSeconds) {
     const cfg = role ? getHiddenRole(role) : null;
     if (cfg?.stallCap?.toolRunningSeconds > 0) return cfg.stallCap.toolRunningSeconds;
     return thresholdSeconds;
@@ -206,7 +221,7 @@ export function createTimeoutSignal(parentSignal, timeoutMs, label) {
 // replaced-by-newer-request). Used for the streaming generation phase, where a fixed
 // total-lifetime cap would false-abort a stream that is still emitting SSE deltas; the
 // streaming phase is bounded instead by the per-attempt first-byte timeout, the parent
-// signal, and the bridge stall watchdog (STALL_ABORT_S, progress-based). cleanup()
+// signal, and the agent stall watchdog (STALL_ABORT_S, progress-based). cleanup()
 // detaches the parent listener so no listener leaks on the (long-lived) parent signal.
 export function createPassthroughSignal(parentSignal) {
     if (!parentSignal) return { signal: null, cleanup: () => {} };

package/src/runtime/agent/orchestrator/tool-loop-guard.mjs

@@ -1,229 +1,13 @@
 /**
- * Shell file-lookup classifier + soft-warn marker stripper.
+ * Soft-warn marker stripper.
  *
  * The tool-loop guard subsystem (repeated/fanned-out tool-use detection and its
- * soft-warn sidecars) was removed once every warn path had been disabled. Two
- * standalone utilities remain:
- *   • classifyBashFileLookupCommand — detects a `bash` call whose first token is
- *     a file-lookup that has a dedicated in-process tool (read/grep/glob/list).
- *     Used by the bridge-worker permission gate to block the shell route.
- *   • classifyBridgeWorkerGitMutationCommand — detects bridge-worker shell
- *     calls that try to run git operations reserved for Lead.
+ * soft-warn sidecars) was removed once every warn path had been disabled. This
+ * module now retains a single utility:
  *   • stripSoftWarns — strips legacy soft-warn marker blocks from outbound
  *     bodies so older transcripts that still carry them stay clean.
  */
 
-// File-lookup-via-shell detector. Matches a `bash` command whose first token
-// is a unix find/grep/cat/ls/head/tail OR a powershell file-discovery cmdlet
-// (Get-ChildItem / Select-String / Get-Content). These have dedicated tools
-// (glob / grep / read / list) per rules/shared/01-tool.md; using bash routes
-// around the in-process tool cache and the path-permission check, and the
-// outputs were observed in PG telemetry running 100x slower than the dedicated
-// path. Get-CimInstance / Win32_Process etc. are NOT matched — process
-// enumeration genuinely needs the shell. One advisory per session per matched
-// command class; subsequent matches stay silent so the model isn't drowned.
-const SHELL_FILE_LOOKUP_COMMANDS = [
-    'find', 'ls', 'grep', 'rg', 'fd', 'cat', 'head', 'tail',
-    'sed', 'awk', 'less', 'more', 'wc', 'tree',
-    // File-metadata mirror paths called out in rules/shared/01-tool.md
-    // Tool Routing section. Added after probe HS-A3 surfaced that the
-    // rule explicitly lists `stat`, `du`, `file`, and `ls -l` as
-    // forbidden mirror paths but the policy under-enforced them.
-    'stat', 'du', 'file',
-    'dir', 'type', 'findstr',
-    'Get-ChildItem', 'gci', 'Select-String', 'sls', 'Get-Content', 'gc',
-].join('|');
-const BASH_FILE_LOOKUP_RE = new RegExp(
-    `^\\s*(?:git\\s+(?:grep|ls-files)\\b|(?:${SHELL_FILE_LOOKUP_COMMANDS})\\b)`,
-    'i',
-);
-// Wrapper / eval forms that route the same file-lookup intent through a host
-// shell (`bash -c "grep ..."`, `pwsh -Command Get-Content ...`) or an
-// inline interpreter eval (`node -e fs.readFileSync(...)`,
-// `python -c "open(...)"`). Without these the advisory was bypassable just
-// by quoting the call inside another command.
-const BASH_WRAPPER_FILE_LOOKUP_RE = new RegExp(
-    `^\\s*(?:bash|sh|zsh|fish|dash)\\b[^\\n]*\\s-\\w*c\\w*\\s+["']?\\s*(?:${SHELL_FILE_LOOKUP_COMMANDS})\\b`,
-    'i',
-);
-const CMD_WRAPPER_FILE_LOOKUP_RE = /^\s*cmd(?:\.exe)?\s+\/[cs]\s+["']?\s*(?:dir|type|findstr)\b/i;
-const PWSH_WRAPPER_FILE_LOOKUP_RE = /^\s*(?:pwsh|powershell)(?:\.exe)?\b[\s\S]*?(?:-|\/)(?:Command|c)\s+["']?\s*(?:Get-ChildItem|gci|dir|ls|Select-String|sls|Get-Content|gc|cat|type)\b/i;
-const NODE_FS_EVAL_RE = /^\s*node(?:\.exe)?\b[\s\S]*?\s-e\s+["'](?![\s\S]*\bJSON\.parse\s*\()[\s\S]*?\b(?:fs\.|readFileSync|readFile|readdirSync|readdir|statSync|stat)\b/i;
-const PYTHON_OPEN_EVAL_RE = /^\s*python3?(?:\.exe)?\b[\s\S]*?\s-c\s+["'][\s\S]*?\b(?:open\s*\(|Path\s*\(|read_text\s*\(|read_bytes\s*\(|iterdir\s*\()/i;
-function _classifyBashFileLookup(command) {
-    if (typeof command !== 'string' || !command) return null;
-    const direct = command.match(BASH_FILE_LOOKUP_RE);
-    if (direct) return direct[0].trim().toLowerCase();
-    if (BASH_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'bash-wrapped';
-    if (CMD_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'cmd-wrapped';
-    if (PWSH_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'pwsh-wrapped';
-    if (NODE_FS_EVAL_RE.test(command)) return 'node-fs-eval';
-    if (PYTHON_OPEN_EVAL_RE.test(command)) return 'python-open-eval';
-    return null;
-}
-
-export function classifyBashFileLookupCommand(command) {
-    return _classifyBashFileLookup(command);
-}
-
-const SHELL_WRAPPER_COMMANDS = new Set([
-    'bash', 'sh', 'zsh', 'fish', 'dash',
-    'cmd', 'cmd.exe',
-    'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
-]);
-const POSIX_SHELL_WRAPPER_COMMANDS = new Set(['bash', 'sh', 'zsh', 'fish', 'dash']);
-const CMD_SHELL_WRAPPER_COMMANDS = new Set(['cmd', 'cmd.exe']);
-const POWERSHELL_WRAPPER_COMMANDS = new Set(['pwsh', 'pwsh.exe', 'powershell', 'powershell.exe']);
-const SHELL_SEPARATORS = new Set([';', '\n', '&&', '||', '|', '&']);
-const READONLY_GIT_SUBCOMMANDS = new Set([
-    'status', 'diff', 'show', 'log', 'rev-parse', 'ls-files', 'grep', 'blame', 'describe', 'merge-base',
-]);
-
-function shellTokenizeLoose(command) {
-    const tokens = [];
-    let current = '';
-    let quote = null;
-    let escape = false;
-    const push = () => {
-        if (current !== '') tokens.push(current);
-        current = '';
-    };
-    const pushSep = (sep) => {
-        push();
-        tokens.push(sep);
-    };
-    for (let i = 0; i < command.length; i += 1) {
-        const ch = command[i];
-        if (escape) {
-            current += ch;
-            escape = false;
-            continue;
-        }
-        if (ch === '\\') {
-            escape = true;
-            continue;
-        }
-        if (quote) {
-            if (ch === quote) quote = null;
-            else current += ch;
-            continue;
-        }
-        if (ch === '\'' || ch === '"') {
-            quote = ch;
-            continue;
-        }
-        if (ch === '\n') {
-            pushSep('\n');
-            continue;
-        }
-        if (ch === ';') {
-            pushSep(';');
-            continue;
-        }
-        if ((ch === '&' || ch === '|') && command[i + 1] === ch) {
-            pushSep(`${ch}${ch}`);
-            i += 1;
-            continue;
-        }
-        if (ch === '|' || ch === '&') {
-            pushSep(ch);
-            continue;
-        }
-        if (/\s/.test(ch)) {
-            push();
-            continue;
-        }
-        current += ch;
-    }
-    push();
-    return tokens;
-}
-
-function isCommandPosition(tokens, index) {
-    for (let i = index - 1; i >= 0; i -= 1) {
-        if (!tokens[i]) continue;
-        return SHELL_SEPARATORS.has(tokens[i]);
-    }
-    return true;
-}
-
-function skipGitGlobalOptions(tokens, index) {
-    let i = index;
-    while (i < tokens.length) {
-        const token = String(tokens[i] || '');
-        const lower = token.toLowerCase();
-        if (!token || SHELL_SEPARATORS.has(token)) return i;
-        if (lower === '-c' || lower === '-C' || lower === '--git-dir' || lower === '--work-tree' || lower === '--namespace') {
-            i += 2;
-            continue;
-        }
-        if (/^(?:--git-dir|--work-tree|--namespace)=/i.test(token)) {
-            i += 1;
-            continue;
-        }
-        if (lower === '--no-pager' || lower === '-p' || lower === '--literal-pathspecs' || lower === '--glob-pathspecs' || lower === '--noglob-pathspecs' || lower === '--icase-pathspecs') {
-            i += 1;
-            continue;
-        }
-        if (/^-/.test(token)) {
-            i += 1;
-            continue;
-        }
-        return i;
-    }
-    return i;
-}
-
-function readonlyGitInvocation(tokens, subIndex) {
-    const sub = String(tokens[subIndex] || '').toLowerCase();
-    if (!READONLY_GIT_SUBCOMMANDS.has(sub)) return false;
-    if (sub === 'remote') {
-        const next = String(tokens[subIndex + 1] || '').toLowerCase();
-        return !next || next === '-v' || next === '--verbose' || next === 'show';
-    }
-    if (sub === 'branch') {
-        const rest = tokens.slice(subIndex + 1).filter((token) => token && !SHELL_SEPARATORS.has(token));
-        return rest.length === 0 || rest.every((token) => ['--show-current', '-a', '-r', '-v', '-vv', '--all', '--remotes', '--verbose', '--contains', '--merged', '--no-merged'].includes(String(token).toLowerCase()));
-    }
-    return true;
-}
-
-function isShellCommandArgFlag(wrapper, flag) {
-    const lower = String(flag || '').toLowerCase();
-    if (POSIX_SHELL_WRAPPER_COMMANDS.has(wrapper)) return /^-\w*c\w*$/.test(lower);
-    if (CMD_SHELL_WRAPPER_COMMANDS.has(wrapper)) return lower === '/c';
-    if (POWERSHELL_WRAPPER_COMMANDS.has(wrapper)) return lower === '-command' || lower === '/command' || lower === '-c';
-    return false;
-}
-
-export function classifyBridgeWorkerGitMutationCommand(command) {
-    if (typeof command !== 'string' || !command.trim()) return null;
-    const tokens = shellTokenizeLoose(command);
-    for (let i = 0; i < tokens.length; i += 1) {
-        const token = String(tokens[i] || '').toLowerCase();
-        if (!token || SHELL_SEPARATORS.has(token) || !isCommandPosition(tokens, i)) continue;
-        if (SHELL_WRAPPER_COMMANDS.has(token)) {
-            for (let j = i + 1; j < tokens.length; j += 1) {
-                const flag = String(tokens[j] || '').toLowerCase();
-                if (SHELL_SEPARATORS.has(flag)) break;
-                if (!isShellCommandArgFlag(token, flag)) continue;
-                const nested = tokens.slice(j + 1).join(' ');
-                const nestedHit = classifyBridgeWorkerGitMutationCommand(nested || '');
-                if (nestedHit) return nestedHit;
-                break;
-            }
-            continue;
-        }
-        if (token !== 'git' && token !== 'git.exe') continue;
-        const subIndex = skipGitGlobalOptions(tokens, i + 1);
-        const sub = String(tokens[subIndex] || '').toLowerCase();
-        if (!sub || SHELL_SEPARATORS.has(sub)) return 'git';
-        if (readonlyGitInvocation(tokens, subIndex)) continue;
-        return `git ${sub}`;
-    }
-    return null;
-}
-
 // Strip soft-warn marker blocks (header ⚠ <label> through next blank line / EOF)
 // from outbound bodies. Never call on tool-result bodies fed back to the model.
 // New compact format: each warn is a single line starting with `⚠ <Label>(` and ending at newline.

package/src/runtime/agent/orchestrator/tools/bash-session.mjs

@@ -41,7 +41,7 @@ import * as nodeUtil from 'node:util';
 import { existsSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { invalidateBuiltinResultCache, analyzeShellCommandEffects, preflightShellLargeFileProbe } from './builtin.mjs';
-import { markCodeGraphDirtyPaths, drainCodeGraphCache } from './code-graph.mjs';
+import { markCodeGraphDirtyPaths, drainCodeGraphCache } from './code-graph-state.mjs';
 import { maybeRewriteWmicProcessCommand } from './shell-policy.mjs';
 import { _maybeEncodePowerShellCommand } from './shell-command.mjs';
 import { _captureTrackedMtimes, _trackedDriftNoteAfter, _injectionBlockTargets, getDedupedDestructiveWarnings } from './builtin/bash-tool.mjs';
@@ -49,6 +49,8 @@ import { scrubLoaderVars, scrubProviderSecrets } from './env-scrub.mjs';
 import { checkExecPolicyMessage } from './bash-policy-scan.mjs';
 import { startChildGuardian } from '../../../shared/child-guardian.mjs';
 
+globalThis.__mixdogBashSessionRuntimeLoaded = true;
+
 // Default 600 s (10 min), max 1800 s. Aligned with the one-shot bash tool's
 // 600 s default (builtin/bash-tool.mjs); the persistent shell carries
 // longer-running pipelines (build/test/install) than one-shot calls, so a
@@ -171,15 +173,18 @@ function _startReaper() {
                 _killSession(id, 'idle-timeout');
             }
         }
-        if (_sessions.size === 0) {
-            clearInterval(_reaperTimer);
-            _reaperTimer = null;
-        }
+        _clearReaperIfIdle();
     }, 30_000);
     // Don't keep the event loop alive just for the reaper.
     if (typeof _reaperTimer.unref === 'function') _reaperTimer.unref();
 }
 
+function _clearReaperIfIdle() {
+    if (_sessions.size !== 0 || !_reaperTimer) return;
+    clearInterval(_reaperTimer);
+    _reaperTimer = null;
+}
+
 // Kill a spawned shell along with any child processes it forked. Posix path
 // signals the process group (pgid == pid because we spawn with detached:true),
 // so `sleep 1000 &` or a node server started inside the session is reaped
@@ -239,6 +244,17 @@ async function _killSession(id, _reason) {
     try { s.proc.stdin?.end(); } catch { /* ignore */ }
     _killProcessTree(s.proc);
     await Promise.race([exited, new Promise((r) => setTimeout(r, 3000))]);
+    _clearReaperIfIdle();
+}
+
+function _killSessionNow(id, _reason) {
+    const s = _sessions.get(id);
+    if (!s) return false;
+    _sessions.delete(id);
+    try { s.proc.stdin?.end(); } catch { /* ignore */ }
+    _killProcessTree(s.proc);
+    _clearReaperIfIdle();
+    return true;
 }
 
 function shellQuoteSingle(s) {
@@ -713,10 +729,21 @@ export function closeBashSession(sessionId, reason = 'external-close') {
     return true;
 }
 
+export async function shutdownBashSessions(reason = 'runtime-close') {
+    const ids = [..._sessions.keys()];
+    await Promise.allSettled(ids.map((id) => _killSession(id, reason)));
+    _clearReaperIfIdle();
+    return { closed: ids.length };
+}
+
 // Best-effort cleanup on process exit so orphan bash children don't linger
 // when the plugin host shuts down. Self-registered exit drain; bare 'exit' hook stays as idempotent backup.
-export function drainBashSessions() {
-    for (const id of [..._sessions.keys()]) _killSession(id, 'process-exit');
+export function drainBashSessions(reason = 'process-exit') {
+    let closed = 0;
+    for (const id of [..._sessions.keys()]) {
+        if (_killSessionNow(id, reason)) closed += 1;
+    }
+    return { closed };
 }
 if (typeof process?.on === 'function') {
     process.on('exit', drainBashSessions);

package/src/runtime/agent/orchestrator/tools/builtin/advisory-lock.mjs

@@ -1,4 +1,4 @@
-// Cross-process advisory lock for write/edit operations. Uses a sibling
+// Cross-process advisory lock for patch/write operations. Uses a sibling
 // lockfile written exclusively (`wx`) and a process.kill(pid, 0) liveness
 // check to clean up after crashed holders. Pair with the in-process
 // withPathLock for the same target: in-process serialises async callers

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -311,6 +311,24 @@ function guardList(a) {
     return null;
 }
 
+function guardFind(a) {
+    if (!hasOwn(a, 'query') || typeof a.query !== 'string' || a.query.trim().length === 0) {
+        return `Error: find requires non-empty string "query" (got ${describeType(a.query)})`;
+    }
+    if (hasOwn(a, 'path') && !isString(a.path)) {
+        return `Error: find arg "path" must be a string (got ${describeType(a.path)})`;
+    }
+    if (hasOwn(a, 'head_limit') && a.head_limit !== undefined && a.head_limit !== null) {
+        if (!isFiniteInt(a.head_limit)) {
+            return `Error: find arg "head_limit" must be a finite integer (got ${describeType(a.head_limit)})`;
+        }
+        if (a.head_limit < 0) {
+            return `Error: find arg "head_limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
+        }
+    }
+    return null;
+}
+
 function guardGlob(a) {
     // path alias root; pattern aliases glob/name/file_pattern
     for (const k of ['path', 'root']) {
@@ -365,6 +383,7 @@ const GUARDS = {
     shell: guardShell,
     task: guardTask,
     list: guardList,
+    find: guardFind,
     glob: guardGlob,
     code_graph: guardCodeGraph,
 };

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -4,7 +4,7 @@ import { wrapCommandWithSnapshot } from '../shell-snapshot.mjs';
 import { getDestructiveCommandWarning } from '../destructive-warning.mjs';
 import { maybeRewriteWmicProcessCommand } from '../shell-policy.mjs';
 import { buildBashPolicyScanTargets, checkExecPolicyMessage, injectionBlockTargets } from '../bash-policy-scan.mjs';
-import { markCodeGraphDirtyPaths, drainCodeGraphCache } from '../code-graph.mjs';
+import { markCodeGraphDirtyPaths, drainCodeGraphCache } from '../code-graph-state.mjs';
 import {
     buildJobNotFoundMessage,
     startBackgroundShellJob,
@@ -60,7 +60,7 @@ export function _trackedDriftNoteAfter(_scope, _pre) {
 // AbortSignal (e.g. the MCP/request signal threaded through options.abortSignal).
 // Returns null when neither is present so existing session-only behavior is
 // preserved unchanged. Uses AbortSignal.any when available; falls back to a
-// manual controller + listener bridge otherwise. The returned signal aborts as
+// manual controller + listener path otherwise. The returned signal aborts as
 // soon as either input signal aborts, which propagates to execShellCommand /
 // executeBashSessionTool and triggers the same child-kill path the session
 // signal already drives.
@@ -343,7 +343,7 @@ export async function executeBashTool(args, workDir, options = {}) {
             // the background task finished (no polling tool is auto-driven). The
             // notify ctx is threaded down from the MCP dispatch frame
             // (server-main agentContext / _dispatchByModule) the same way the
-            // bridge/explore-style tools receive notifyFn/routingSessionId/clientHostPid.
+            // agent/explore-style tools receive notifyFn/routingSessionId/clientHostPid.
             // Missing notifyFn (e.g. a non-MCP caller) degrades to a stderr
             // diagnostic inside watchBackgroundShellJob — never fails the spawn.
             try {
@@ -548,12 +548,12 @@ export async function executeTaskTool(args, options = {}) {
 
     const taskId = typeof args.task_id === 'string' ? args.task_id.trim() : '';
     if (!taskId) return 'Error: task_id is required';
-    // bridge_* / sess_* are bridge-worker / orchestrator session ids, not
-    // background shell jobs. task only resolves `shell mode=async`
-    // jobs, so surface a self-correcting hint instead of the bare
-    // "job not found" that otherwise invites a wrong-tool retry loop.
-    if (/^(?:bridge_|sess_)/.test(taskId)) {
-        return `Error: "${taskId}" is a bridge/session id, not a background task_id. Bridge agents deliver completion notifications; use bridge list/read only for manual recovery.`;
+    // sess_* values are agent/orchestrator session ids, not background shell
+    // tasks. task only resolves `shell mode=async` tasks, so surface a
+    // self-correcting hint instead of the bare "task not found" that otherwise
+    // invites a wrong-tool retry loop.
+    if (/^sess_/.test(taskId)) {
+        return `Error: "${taskId}" is an agent/session id, not a background task_id. Agent tasks deliver completion notifications; use agent list/read only for manual recovery.`;
     }
 
     const task = getBackgroundTask(taskId, { context: options });