mixdog 0.8.0 → 0.9.0

package/src/runtime/agent/orchestrator/tools/builtin/rg-runner.mjs

@@ -1,15 +1,105 @@
-import { spawn, execFileSync } from 'child_process';
+import { spawn, execFile } from 'child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { startChildGuardian } from '../../../../shared/child-guardian.mjs';
+import { promisify } from 'node:util';
+import os from 'node:os';
+import { acquire as acquireChildSpawnSlot } from '../../../../shared/child-spawn-gate.mjs';
+
+const execFileAsync = promisify(execFile);
+
+// ── rg orphan-reap policy (accepted risk) ────────────────────────────────
+// The previous design started a 1:1 node child-guardian per rg spawn so a
+// hard daemon kill (SIGKILL, no chance to run our own cleanup) could not leave
+// an rg orphaned. That per-process guardian is exactly what over-saturated the
+// box (each grep doubled the process count), so it has been REMOVED here and
+// deliberately NOT replaced with another per-rg guardian.
+//
+// Accepted residual risk: on a hard daemon SIGKILL an in-flight rg can briefly
+// outlive the daemon. This is judged acceptable because (a) on every NORMAL
+// path rg is reaped by this module's own timeout → SIGTERM → grace → force-kill
+// plus the force-settle backstop, so it is always collected when the daemon is
+// alive to settle the promise; (b) rg is a short-lived, self-terminating
+// (bounded by the 20s timeout) read-only process, not a long-running server; a
+// stray instance exits on its own shortly after. A shared/OS-job-based reaper
+// (one guardian for the whole daemon, or a Windows Job Object / POSIX process
+// group kill on daemon teardown) is the right long-term fix but is out of scope
+// for this change and intentionally not added per-spawn.
+
+// ── rg --threads cap ─────────────────────────────────────────────────────
+// Each rg process otherwise fans out across EVERY core; with several agents
+// running grep at once the box over-saturates and the whole batch trips the
+// 20s deadline together. Cap rg's worker threads to a fraction of the host so
+// concurrent greps share the machine. Internal dynamic default; env override
+// only — deliberately NOT exposed on any tool schema / parameter surface.
+function _rgThreadCap() {
+    const override = Number(process.env.MIXDOG_RG_THREADS);
+    if (Number.isFinite(override) && override >= 1) return Math.floor(override);
+    let cpus = 0;
+    try { cpus = os.cpus()?.length || 0; } catch { cpus = 0; }
+    return Math.max(2, Math.ceil((cpus || 4) / 4));
+}
+
+// Single source of truth for "did the caller already pin rg's thread count?".
+// Detects every form rg accepts: separated (`-j`, `--threads`) where the count
+// is the NEXT arg, short-attached (`-j8`), and long-attached (`--threads=8`).
+// Used by both the _withRgThreads injection guard and the EAGAIN retry guard
+// so the two never disagree.
+function _hasRgThreadArg(argsList) {
+    for (const a of argsList) {
+        if (typeof a !== 'string') continue;
+        if (a === '-j' || a === '--threads') return true;
+        if (/^-j\d+$/.test(a)) return true;
+        if (a.startsWith('--threads=')) return true;
+    }
+    return false;
+}
+
+// Inject `--threads N` unless the caller already pinned thread count
+// (`-j`/`--threads`/`-jN`/`--threads=N`, e.g. the EAGAIN `-j 1` retry). Does
+// not mutate; may return the ORIGINAL array unchanged when already
+// thread-pinned (callers must not assume a fresh copy).
+function _withRgThreads(argsList) {
+    if (_hasRgThreadArg(argsList)) return argsList;
+    return ['--threads', String(_rgThreadCap()), ...argsList];
+}
+
+// Build the EAGAIN single-thread retry args. If the caller already pinned a
+// thread count we strip the existing flag(s) first, then prepend `-j 1`, so the
+// retry is unambiguously single-threaded (never `-j 8 ... -j 1`). Drops both the
+// separated form (`-j N` / `--threads N` → flag + following count) and the
+// attached forms (`-jN` / `--threads=N`).
+function _rgEagainRetryArgs(argsList) {
+    const out = [];
+    for (let i = 0; i < argsList.length; i++) {
+        const a = argsList[i];
+        if (a === '-j' || a === '--threads') { i++; continue; } // skip flag + its count
+        if (typeof a === 'string' && (/^-j\d+$/.test(a) || a.startsWith('--threads='))) continue;
+        out.push(a);
+    }
+    return ['-j', '1', ...out];
+}
+
+// True only when the args are ALREADY exactly single-threaded — i.e. an EAGAIN
+// retry would change nothing. Matches the separated `-j 1` / `--threads 1` form
+// and the attached `-j1` / `--threads=1` form. Any other thread pin (e.g. -j8)
+// is NOT "single-thread pinned": the retry should still run and downshift it.
+function _isRgSingleThreadPinned(argsList) {
+    for (let i = 0; i < argsList.length; i++) {
+        const a = argsList[i];
+        if (typeof a !== 'string') continue;
+        if ((a === '-j' || a === '--threads') && String(argsList[i + 1]).trim() === '1') return true;
+        if (a === '-j1' || a === '--threads=1') return true;
+    }
+    return false;
+}
 
 let _rgExecutableResolved = null;
 
-function _resolveRgExecutable() {
+async function _resolveRgExecutable() {
     const isWin = process.platform === 'win32';
     try {
         const cmd = isWin ? 'where' : 'which';
-        const out = execFileSync(cmd, ['rg'], { encoding: 'utf8', windowsHide: true }).trim();
+        const { stdout: out } = await execFileAsync(cmd, ['rg'], { encoding: 'utf8', windowsHide: true });
         const first = out.split(/\r?\n/).map((l) => l.trim()).find(Boolean);
         if (first && existsSync(first)) return first;
     } catch { /* fall through to PATH scan */ }
@@ -33,11 +123,27 @@ function _resolveRgExecutable() {
     return 'rg';
 }
 
+// Synchronous accessor for the spawn call sites — only valid AFTER
+// ensureRgResolved() has run (runRg/runRgWindowedLines await it first). Falls
+// back to the bare 'rg' if somehow called before resolution.
 function rgExecutable() {
-    if (_rgExecutableResolved === null) {
-        _rgExecutableResolved = _resolveRgExecutable();
+    return _rgExecutableResolved ?? 'rg';
+}
+
+// Async resolver: the `where`/`which` lookup used to run via execFileSync,
+// blocking the event loop ~90ms on the first grep/glob/find of a session
+// (freezing the TUI). Resolve asynchronously and cache the result; subsequent
+// calls return immediately.
+let _rgResolvePromise = null;
+async function ensureRgResolved() {
+    if (_rgExecutableResolved !== null) return _rgExecutableResolved;
+    if (!_rgResolvePromise) {
+        _rgResolvePromise = _resolveRgExecutable().then((resolved) => {
+            _rgExecutableResolved = resolved;
+            return resolved;
+        });
     }
-    return _rgExecutableResolved;
+    return _rgResolvePromise;
 }
 
 // When _resolveRgExecutable() exhausts `where`/`which` and the PATH scan and
@@ -48,13 +154,13 @@ function rgExecutable() {
 const RG_FALLBACK_FAIL_TTL_MS = 30000;
 let _rgFallbackUsable = null;
 let _rgFallbackFailAt = 0;
-function rgFallbackUsable() {
+async function rgFallbackUsable() {
     if (_rgFallbackUsable === true) return true;
     if (_rgFallbackUsable === false && (Date.now() - _rgFallbackFailAt) < RG_FALLBACK_FAIL_TTL_MS) {
         return false;
     }
     try {
-        execFileSync('rg', ['--version'], { stdio: 'ignore', windowsHide: true, timeout: 3000 });
+        await execFileAsync('rg', ['--version'], { windowsHide: true, timeout: 3000 });
         _rgFallbackUsable = true;
     } catch {
         _rgFallbackUsable = false;
@@ -65,10 +171,11 @@ function rgFallbackUsable() {
 
 // Throws a clear error only when the bare 'rg' fallback was reached AND it is
 // not actually runnable. A real resolved path short-circuits with no probe, so
-// behavior is unchanged whenever rg exists.
-function assertRgAvailable() {
-    if (rgExecutable() !== 'rg') return;
-    if (rgFallbackUsable()) return;
+// behavior is unchanged whenever rg exists. Async so the underlying lookups
+// (`where`/`which`, `rg --version`) never block the event loop.
+async function assertRgAvailable() {
+    if (await ensureRgResolved() !== 'rg') return;
+    if (await rgFallbackUsable()) return;
     const e = new Error('ripgrep (rg) not found on PATH — install ripgrep or add it to PATH');
     e.code = 'ERG_NOT_FOUND';
     throw e;
@@ -168,14 +275,19 @@ function _armRgForceSettle({ timeoutMs, isSettled, timers, proc, onForceSettle }
 // surfaced as empty stdout so callers can render "(no matches)" uniformly.
 function spawnRg(argsList, execOptions) {
     const timeoutMs = Number(execOptions?.timeout ?? 20000);
-    return new Promise((resolve, reject) => {
-        const proc = spawn(rgExecutable(), argsList, {
+    const gateSignal = execOptions?.abortSignal || execOptions?.signal || null;
+    // Gate the spawn (not the whole call) so over-saturation queues here while
+    // the cap's worth of rg keep running. The rg timeout timer is armed AFTER
+    // spawn below, so queue-wait time is excluded from the 20s deadline. No
+    // node guardian is started: rg owns its full SIGTERM→grace→force-kill +
+    // force-settle teardown, so the 1:1 guardian process was pure overhead.
+    return acquireChildSpawnSlot(gateSignal).then((releaseSlot) => new Promise((resolve, reject) => {
+        const proc = spawn(rgExecutable(), _withRgThreads(argsList), {
             cwd: execOptions?.cwd,
             env: execOptions?.env || process.env,
             windowsHide: true,
             stdio: ['ignore', 'pipe', 'pipe'],
         });
-        startChildGuardian({ childPid: proc.pid, label: 'rg-runner' });
         let stdout = '';
         let stderr = '';
         let timedOut = false;
@@ -282,17 +394,23 @@ function spawnRg(argsList, execOptions) {
             e.stderr = stderr;
             reject(e);
         });
-    });
+    // Release the gate slot exactly once on ANY settle path (resolve/reject:
+    // close, error, or force-settle). releaseSlot is idempotent.
+    }).finally(() => releaseSlot()));
 }
 
 export async function runRg(argsList, execOptions = {}) {
-    assertRgAvailable();
+    await assertRgAvailable();
     try {
         return await spawnRg(argsList, execOptions);
     } catch (err) {
         const msg = String(err?.message || err?.stderr || '');
-        if (/EAGAIN/i.test(msg) && !argsList.includes('-j')) {
-            return spawnRg(['-j', '1', ...argsList], execOptions);
+        // Retry single-threaded on EAGAIN. Skip only when the caller already
+        // pinned threads AND that pin is already -j 1 (nothing to gain); any
+        // other pin (-j8/--threads=N) is rewritten to a clean -j 1 by
+        // _rgEagainRetryArgs so we never emit conflicting thread flags.
+        if (/EAGAIN/i.test(msg) && !_isRgSingleThreadPinned(argsList)) {
+            return spawnRg(_rgEagainRetryArgs(argsList), execOptions);
         }
         throw err;
     }
@@ -304,14 +422,17 @@ function spawnRgWindowedLines(argsList, execOptions, opts = {}) {
     const lineLimit = Number.isFinite(opts.limit) ? Math.max(0, Math.floor(Number(opts.limit) || 0)) : Infinity;
     const summaryLimit = Math.max(0, Math.floor(Number(opts.summaryLimit) || 0));
     const collectLimit = lineLimit === Infinity ? Infinity : Math.max(lineLimit, summaryLimit);
-    return new Promise((resolve, reject) => {
-        const proc = spawn(rgExecutable(), argsList, {
+    const gateSignal = execOptions?.abortSignal || execOptions?.signal || null;
+    // Same gate + thread-cap + no-guardian treatment as spawnRg; queue-wait is
+    // excluded from the rg timeout (armed after spawn). releaseSlot is fired
+    // once via .finally on every settle path.
+    return acquireChildSpawnSlot(gateSignal).then((releaseSlot) => new Promise((resolve, reject) => {
+        const proc = spawn(rgExecutable(), _withRgThreads(argsList), {
             cwd: execOptions?.cwd,
             env: execOptions?.env || process.env,
             windowsHide: true,
             stdio: ['ignore', 'pipe', 'pipe'],
         });
-        startChildGuardian({ childPid: proc.pid, label: 'rg-runner-windowed' });
         let buffer = '';
         let stderr = '';
         let skipped = 0;
@@ -448,17 +569,17 @@ function spawnRgWindowedLines(argsList, execOptions, opts = {}) {
             e.stderr = stderr;
             reject(e);
         });
-    });
+    }).finally(() => releaseSlot()));
 }
 
 export async function runRgWindowedLines(argsList, execOptions = {}, opts = {}) {
-    assertRgAvailable();
+    await assertRgAvailable();
     try {
         return await spawnRgWindowedLines(argsList, execOptions, opts);
     } catch (err) {
         const msg = String(err?.message || err?.stderr || '');
-        if (/EAGAIN/i.test(msg) && !argsList.includes('-j')) {
-            return spawnRgWindowedLines(['-j', '1', ...argsList], execOptions, opts);
+        if (/EAGAIN/i.test(msg) && !_isRgSingleThreadPinned(argsList)) {
+            return spawnRgWindowedLines(_rgEagainRetryArgs(argsList), execOptions, opts);
         }
         throw err;
     }

package/src/runtime/agent/orchestrator/tools/builtin/search-builders.mjs

@@ -114,13 +114,13 @@ export function buildGrepRgArgs(parts) {
     return rgArgs;
 }
 
-export function buildGlobCacheKey({ patterns, basePath, headLimit, offset, extraIgnore }) {
+export function buildGlobCacheKey({ patterns, basePath, headLimit, offset, extraIgnore, sort }) {
     // extraIgnore (rg ignore globs from _extraIgnoreDirs) alters which files
     // match, so it MUST partake in the key — otherwise calls that differ only
     // by extra ignores collide and return stale over-/under-filtered results.
     // Sorted so the same ignore set in any order maps to one key.
     const extra = Array.isArray(extraIgnore) && extraIgnore.length ? [...extraIgnore].sort().join('\x01') : '';
-    return ['glob', patterns.join('\x01'), basePath, headLimit ?? '', offset ?? '', extra].join('|');
+    return ['glob', patterns.join('\x01'), basePath, headLimit ?? '', offset ?? '', sort || 'natural', extra].join('|');
 }
 
 export function buildListCacheKey(parts) {

package/src/runtime/agent/orchestrator/tools/builtin/search-tool.mjs

@@ -30,11 +30,14 @@ import {
 import {
     cacheGet,
     cacheSet,
+    runResultCacheInFlight,
     statPathsForMtime,
 } from './cache-layers.mjs';
 import { recordReadSnapshot } from './read-snapshot-runtime.mjs';
 import { applyGrepContextLeadPolicy, GREP_CONTEXT_MAX } from './arg-guard.mjs';
 
+const MIXDOG_GREP_CASE_HINT_PROBE = /^(1|true|yes|on)$/i.test(String(process.env.MIXDOG_GREP_CASE_HINT_PROBE || ''));
+
 function expandLegacyEscapedAlternationPattern(rawPattern) {
     if (typeof rawPattern !== 'string' || !rawPattern.includes('\\|')) return null;
     const parts = rawPattern.split('\\|').map((part) => part.trim()).filter(Boolean);
@@ -180,6 +183,14 @@ function splitGlobString(value) {
     return out;
 }
 
+function isRedundantAllFilesGlob(value) {
+    const g = canonicalizeGlobSlashes(String(value || '').trim())
+        .replace(/^\.\//, '')
+        .replace(/^\/+/, '')
+        .replace(/\/+$/, '');
+    return g === '**/*' || g === '**';
+}
+
 function resolveSearchScope(root, workDir) {
     return isAbsolute(root) ? resolve(root) : resolveAgainstCwd(root, workDir);
 }
@@ -226,46 +237,6 @@ function parseGrepCountLine(line) {
     return { path, count };
 }
 
-// Per-pattern file-count probe for array grby: runs ONE rg --files-with-matches
-// per pattern (reusing the same scope/glob/type/flags as the merged search) so
-// the summary line can surface patterns that matched zero files — otherwise the
-// merged result hides which member of the array contributed nothing.
-async function _perPatternFileCounts({ patterns, searchPath, globPatterns, caseInsensitive, multilineMode, fileType, workDir }) {
-    const results = await Promise.all(patterns.map(async (pattern) => {
-        try {
-            const rgArgs = buildGrepRgArgs({
-                patterns: [pattern],
-                searchPath,
-                globPatterns,
-                outputMode: 'files_with_matches',
-                caseInsensitive,
-                showLineNumbers: false,
-                beforeN: null,
-                afterN: null,
-                contextN: null,
-                multilineMode,
-                fileType,
-                onlyMatching: false,
-            });
-            const stdout = await runRg(rgArgs, { cwd: workDir });
-            // A boxed partial/truncated stdout means the count is not the true
-            // total — render '?' rather than a misleadingly-low or zero number.
-            if (stdout && typeof stdout === 'object' && (stdout.partial || stdout.truncated)) return null;
-            return String(stdout).split('\n').filter(Boolean).length;
-        } catch {
-            // Probe threw → count unknown, NOT zero.
-            return null;
-        }
-    }));
-    // Quote first (so newline/control chars can't inject footer lines), then
-    // truncate the quoted string to 40 chars — matches the no-match path.
-    const trunc = (p) => {
-        const q = JSON.stringify(p);
-        return q.length > 40 ? `${q.slice(0, 40)}...` : q;
-    };
-    return `\n# per-pattern: ${patterns.map((p, i) => `${trunc(p)}=${results[i] === null ? '?' : `${results[i]} files`}`).join(', ')}`;
-}
-
 function formatGrepOutput({ windowed, totalWindowed, totalKnown, headLimit, offset, outputMode, patterns: _patterns, beforeN, afterN, contextN, searchPath, grepResolvedPath: _grepResolvedPath, workDir, globPatterns: _globPatterns, fileType: _fileType, filenameOmitted = false, prefix = '', broadAdvisory: _broadAdvisory = true }) {
     const lines = headLimit === Infinity ? windowed : windowed.slice(0, headLimit);
     const normalized = lines.map((line) => relativeGrepLine(line, workDir, outputMode === 'files_with_matches', outputMode, filenameOmitted));
@@ -378,7 +349,9 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
     // ripgrep `--glob` uses forward slashes on all platforms; canonicalize
     // `\`→`/` (win32 only) so a `**\*.ts` filter matches instead of being
     // parsed as an escape sequence.
-    const normalizedGlobPatterns = uniqueStrings(globPatterns.map(canonicalizeGlobSlashes));
+    const normalizedGlobPatterns = uniqueStrings(globPatterns
+        .map(canonicalizeGlobSlashes)
+        .filter((g) => !isRedundantAllFilesGlob(g)));
 
     const ALLOWED_OUTPUT_MODES = new Set(['files_with_matches', 'content', 'count']);
     const rawOutputMode = typeof args.output_mode === 'string' ? args.output_mode.trim() : '';
@@ -484,6 +457,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
     // drift detection. So only the fresh-compute path (below) records a read.
     if (cached !== null) return cached;
 
+    return await runResultCacheInFlight(cacheKey, async () => {
     let grepStat;
     try { grepStat = statSync(grepResolvedPath); }
     catch (err) {
@@ -597,7 +571,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
             // pre-offset matches) just means the window skipped past real
             // case-sensitive hits, so the hint would be misleading.
             const trueZeroMatch = offset === 0 && totalWindowed === 0;
-            if (trueZeroMatch && !caseInsensitive && patterns.length === 1 && /[A-Za-z]/.test(patterns[0])) {
+            if (MIXDOG_GREP_CASE_HINT_PROBE && trueZeroMatch && !caseInsensitive && patterns.length === 1 && /[A-Za-z]/.test(patterns[0])) {
                 try {
                     const probeArgs = buildGrepRgArgs({
                         patterns,
@@ -620,21 +594,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
                 } catch { /* best-effort hint */ }
             }
         }
-        // Array-pattern visibility: append a per-pattern file-count summary so
-        // zero-hit members of the merged result are not silently hidden.
-        let perPatternSummary = '';
-        if (patterns.length > 1) {
-            perPatternSummary = await _perPatternFileCounts({
-                patterns,
-                searchPath,
-                globPatterns: normalizedGlobPatterns,
-                caseInsensitive,
-                multilineMode,
-                fileType,
-                workDir: rgSpawnCwd,
-            });
-        }
-        const out = body + rgPartialSuffix + perPatternSummary;
+        const out = body + rgPartialSuffix;
         const shownLines = headLimit === Infinity ? windowed : windowed.slice(0, headLimit);
         const remaining = Math.max(0, totalWindowed - shownLines.length);
         // Mirrors formatGrepOutput truncation / totalKnown semantics.
@@ -749,6 +709,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
         const msg = stderr || err?.message || String(err);
         return `Error: ${msg.slice(0, 500)}`;
     }
+    });
 }
 
 export async function executeGlobTool(args, workDir, options = {}) {
@@ -835,6 +796,8 @@ export async function executeGlobTool(args, workDir, options = {}) {
         return `Error: invalid offset ${JSON.stringify(args.offset)}; expected a non-negative integer`;
     }
     const offset = offsetCoerced === null || offsetCoerced === 0 ? 0 : offsetCoerced;
+    const rawSort = typeof args.sort === 'string' ? args.sort.trim() : '';
+    const sortMode = rawSort === 'mtime' ? 'mtime' : 'natural';
     // Internal-only ignore extension (see normalizeGlobArgs). Caller (e.g.
     // ai-wrapped-dispatch broad-cwd preflight) appends basename ignore globs
     // so head_limit bounds SOURCE entries rather than artifact noise.
@@ -860,10 +823,11 @@ export async function executeGlobTool(args, workDir, options = {}) {
         .map((root) => normalizeOutputPath(resolvedForSearchRoot(root)))
         .sort()
         .join('\x01');
-    const cacheKey = buildGlobCacheKey({ patterns, basePath: cacheBasePath, headLimit, offset, extraIgnore: extraIgnoreGlobs });
+    const cacheKey = buildGlobCacheKey({ patterns, basePath: cacheBasePath, headLimit, offset, extraIgnore: extraIgnoreGlobs, sort: sortMode });
     const cached = cacheGet(cacheKey);
     if (cached !== null) return cached;
 
+    return await runResultCacheInFlight(cacheKey, async () => {
     const globGroups = [...groups.entries()];
 
     const allFiles = [];
@@ -929,23 +893,26 @@ export async function executeGlobTool(args, workDir, options = {}) {
     }
 
     const unique = Array.from(new Set(allFiles));
-    // Bound the post-rg stat phase: a single hung stat (dead mount /
-    // unresponsive network path) must not pin glob until the 600s bridge stall
-    // watchdog. Per-stat 5s deadline → a hung entry is treated as stat-failed
-    // and dropped, while normal local stats (sub-ms) are unaffected.
-    const withStatAll = await statPathsForMtime(unique, workDir, 64, { deadlineMs: 5000 });
-    const withStat = withStatAll.filter((entry) => entry?.stat != null);
-    withStat.sort((a, b) => {
-        const dm = b.mtime - a.mtime;
-        if (dm !== 0) return dm;
-        return globMtimeTiePath(a).localeCompare(globMtimeTiePath(b));
-    });
-    const totalBeforeOffset = withStat.length;
-    const windowed = offset > 0 ? withStat.slice(offset) : withStat;
-    const capped = (headLimit === Infinity ? windowed : windowed.slice(0, headLimit)).map((entry) => {
-        const abs = entry.full || resolveAgainstCwd(entry.path, workDir);
-        return relativeSearchResultPath(abs, workDir);
-    });
+    let orderedPaths;
+    if (sortMode === 'mtime') {
+        // Opt-in mtime sorting is intentionally slower: it stats every match.
+        // Bound the post-rg stat phase so a hung mount cannot pin glob until
+        // the agent stall watchdog fires.
+        const withStatAll = await statPathsForMtime(unique, workDir, 64, { deadlineMs: 5000 });
+        const withStat = withStatAll.filter((entry) => entry?.stat != null);
+        withStat.sort((a, b) => {
+            const dm = b.mtime - a.mtime;
+            if (dm !== 0) return dm;
+            return globMtimeTiePath(a).localeCompare(globMtimeTiePath(b));
+        });
+        orderedPaths = withStat.map((entry) => entry.full || resolveAgainstCwd(entry.path, workDir));
+    } else {
+        orderedPaths = unique.map((entry) => isAbsolute(entry) ? resolve(entry) : resolveAgainstCwd(entry, workDir));
+    }
+    const totalBeforeOffset = orderedPaths.length;
+    const windowed = offset > 0 ? orderedPaths.slice(offset) : orderedPaths;
+    const capped = (headLimit === Infinity ? windowed : windowed.slice(0, headLimit))
+        .map((abs) => relativeSearchResultPath(abs, workDir));
     const remaining = windowed.length - capped.length;
     const truncSuffix = accumTruncated
         ? '\n... [truncated at accumulation cap (50000)]'
@@ -979,4 +946,5 @@ export async function executeGlobTool(args, workDir, options = {}) {
         try { options.onProgress(`found ${totalBeforeOffset} files`); } catch { /* best-effort */ }
     }
     return out;
+    });
 }