mixdog 0.8.1 → 0.9.1

package/src/runtime/agent/orchestrator/session/manager.reactive-persist.test.mjs

@@ -0,0 +1,107 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+    _applyCompactFailurePersistToSession,
+    _sessionMessagesAdvancedBeyondCompactedOutgoing,
+} from './manager.mjs';
+
+const compacted = [
+    { role: 'user', content: 'summary turn' },
+    { role: 'user', content: 'current task' },
+];
+
+test('sessionMessagesAdvancedBeyondCompactedOutgoing: true for compacted prefix plus final assistant', () => {
+    const current = [
+        ...compacted,
+        { role: 'assistant', content: 'done' },
+    ];
+    assert.equal(_sessionMessagesAdvancedBeyondCompactedOutgoing(current, compacted), true);
+});
+
+test('sessionMessagesAdvancedBeyondCompactedOutgoing: true for compacted prefix plus empty-final assistant', () => {
+    const current = [
+        ...compacted,
+        { role: 'assistant', content: '', emptyFinal: true },
+    ];
+    assert.equal(_sessionMessagesAdvancedBeyondCompactedOutgoing(current, compacted), true);
+});
+
+test('sessionMessagesAdvancedBeyondCompactedOutgoing: false when transcript has not advanced', () => {
+    assert.equal(_sessionMessagesAdvancedBeyondCompactedOutgoing(compacted, compacted), false);
+});
+
+test('sessionMessagesAdvancedBeyondCompactedOutgoing: false when extra message is not a final assistant', () => {
+    const current = [
+        ...compacted,
+        { role: 'user', content: 'steering follow-up' },
+    ];
+    assert.equal(_sessionMessagesAdvancedBeyondCompactedOutgoing(current, compacted), false);
+});
+
+test('sessionMessagesAdvancedBeyondCompactedOutgoing: false when prefix diverges from compacted outgoing', () => {
+    const current = [
+        { role: 'user', content: 'different summary' },
+        { role: 'user', content: 'current task' },
+        { role: 'assistant', content: 'done' },
+    ];
+    assert.equal(_sessionMessagesAdvancedBeyondCompactedOutgoing(current, compacted), false);
+});
+
+test('applyCompactFailurePersistToSession: preserves providerState when transcript already advanced', () => {
+    const priorSanitized = [
+        ...compacted,
+        { role: 'assistant', content: 'done' },
+    ];
+    const session = {
+        messages: priorSanitized,
+        providerState: { continuation: 'fresh' },
+        compaction: { lastStage: 'compacting' },
+    };
+    const applied = _applyCompactFailurePersistToSession(session, {
+        priorSanitized,
+        sanitized: compacted,
+        messagesAdvanced: true,
+        error: new Error('ask failed'),
+    });
+    assert.equal(applied, true);
+    assert.deepEqual(session.messages, priorSanitized);
+    assert.deepEqual(session.providerState, { continuation: 'fresh' });
+    assert.equal(session.compaction.lastStage, 'failed');
+});
+
+test('applyCompactFailurePersistToSession: clears providerState when replacing messages with compacted outgoing', () => {
+    const priorSanitized = [
+        { role: 'user', content: 'old long history' },
+    ];
+    const session = {
+        messages: priorSanitized,
+        providerState: { stale: true },
+        compaction: { lastStage: 'compacting' },
+    };
+    const applied = _applyCompactFailurePersistToSession(session, {
+        priorSanitized,
+        sanitized: compacted,
+        messagesAdvanced: false,
+        error: { code: 'AGENT_CONTEXT_OVERFLOW' },
+    });
+    assert.equal(applied, true);
+    assert.deepEqual(session.messages, compacted);
+    assert.equal(session.providerState, undefined);
+    assert.equal(session.compaction.lastStage, 'overflow_failed');
+});
+
+test('applyCompactFailurePersistToSession: no-op when messages unchanged and not advanced', () => {
+    const session = {
+        messages: compacted,
+        providerState: { keep: true },
+    };
+    const applied = _applyCompactFailurePersistToSession(session, {
+        priorSanitized: compacted,
+        sanitized: compacted,
+        messagesAdvanced: false,
+    });
+    assert.equal(applied, false);
+    assert.deepEqual(session.providerState, { keep: true });
+});
+

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -9,11 +9,49 @@ import { randomBytes } from 'crypto';
 import { join } from 'path';
 import { Worker } from 'worker_threads';
 import { getPluginData } from '../config.mjs';
+import { isAgentOwner } from '../agent-owner.mjs';
 import { renameWithRetrySync, updateJsonAtomicSync, writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { sanitizeContentForStoredHistory } from '../providers/media-normalization.mjs';
 
 const _lastSaveError = new Map(); // id -> { message, at }
 const SESSION_SUMMARY_INDEX_VERSION = 1;
 
+// The live in-memory session (and every model request)
+// retains attached image bytes across turns so multi-turn recognition works.
+// The persisted session JSON, however, replaces image content with a short
+// text placeholder at serialization time — keeping session files small without
+// starving the model of the image mid-conversation. Returns the same object
+// reference when nothing changed (no-image sessions pay only a shallow scan).
+function _sessionForDisk(session) {
+    // Strip the in-flight live-turn alias (askSession sets session.liveTurnMessages
+    // for the turn duration so contextStatus() can estimate live context growth).
+    // It is a transient duplicate of the working transcript and must never be
+    // serialized: mid-turn saves (persistIterationMetrics) would otherwise bloat
+    // the session file and persist a non-canonical message array.
+    const hasLiveTurn = session && typeof session === 'object'
+        && Object.prototype.hasOwnProperty.call(session, 'liveTurnMessages');
+    const messages = Array.isArray(session?.messages) ? session.messages : null;
+    if (!messages || messages.length === 0) {
+        if (!hasLiveTurn) return session;
+        const { liveTurnMessages: _drop, ...rest } = session;
+        return rest;
+    }
+    let changed = false;
+    const out = messages.map((m) => {
+        if (!m || typeof m !== 'object') return m;
+        const content = sanitizeContentForStoredHistory(m.content);
+        if (content !== m.content) { changed = true; return { ...m, content }; }
+        return m;
+    });
+    if (!changed) {
+        if (!hasLiveTurn) return session;
+        const { liveTurnMessages: _drop, ...rest } = session;
+        return rest;
+    }
+    const { liveTurnMessages: _drop, ...rest } = session;
+    return { ...rest, messages: out };
+}
+
 function _renameWithRetrySync(tmp, target) {
     return renameWithRetrySync(tmp, target);
 }
@@ -77,7 +115,6 @@ function _isPreviewNoise(text) {
     if (!value) return true;
     if (value.startsWith('<system-reminder>')) return true;
     if (/^Reference files:/i.test(value)) return true;
-    if (value.includes('<!-- bp3-sentinel -->')) return true;
     return false;
 }
 
@@ -133,7 +170,7 @@ function _sessionSummary(session) {
         cwd: session.cwd || '',
         provider: session.provider || null,
         model: session.model || null,
-        bridgeTag: session.bridgeTag || null,
+        agentTag: session.agentTag || null,
         task_id: session.task_id || session.taskId || null,
         permission: session.permission || null,
         toolPermission: session.toolPermission || null,
@@ -163,7 +200,7 @@ function _normalizeSummaryRow(row) {
         cwd: row.cwd || '',
         provider: row.provider || null,
         model: row.model || null,
-        bridgeTag: row.bridgeTag || null,
+        agentTag: row.agentTag || null,
         task_id: row.task_id || null,
         permission: row.permission || null,
         toolPermission: row.toolPermission || null,
@@ -278,19 +315,6 @@ function _clearDebounce(id) {
     if (t) { clearTimeout(t); _debounceTimers.delete(id); }
 }
 
-// Flush all debounced sessions synchronously on process exit / SIGTERM.
-// This prevents losing the last turn's tool-result writes.
-function _drainAllDebounced() {
-    for (const [id, t] of _debounceTimers) {
-        clearTimeout(t);
-        _debounceTimers.delete(id);
-        const cur = _savePending.get(id);
-        if (cur && cur.debouncing && cur.payload) {
-            try { _doSaveSync(cur.payload); } catch { /* best-effort */ }
-            _savePending.delete(id);
-        }
-    }
-}
 // Self-registered exit drain; bare 'exit' hook stays as idempotent backup. Use the more comprehensive
 // drainSessionStore so debounce + scheduled + writing payloads all flush.
 process.on('exit', drainSessionStore);
@@ -468,7 +492,7 @@ function _doSaveSync(payload) {
     const target = sessionPath(id);
     const tmp = target + '.' + randomBytes(6).toString('hex') + '.tmp';
     try {
-        writeFileSync(tmp, JSON.stringify(session), 'utf-8');
+        writeFileSync(tmp, JSON.stringify(_sessionForDisk(session)), 'utf-8');
         if (_shouldDrop(id, opts)) {
             try { unlinkSync(tmp); } catch { /* ignore cleanup failure */ }
             return;
@@ -490,7 +514,21 @@ function _shouldDrop(id, opts) {
     const target = sessionPath(id);
     if (!existsSync(target)) return false;
     try {
-        const onDisk = JSON.parse(readFileSync(target, 'utf-8'));
+        const raw = readFileSync(target, 'utf-8');
+        // Tombstone check only needs `closed` and `generation`. Avoid a full
+        // JSON.parse of the entire session (which can be MBs on long chats and
+        // ran on every save). Fast-path a regex scan; only fall back to a full
+        // parse if the lightweight scan is inconclusive.
+        const closedMatch = /"closed"\s*:\s*(true|false)/.exec(raw);
+        if (closedMatch && closedMatch[1] === 'false') return false;
+        if (closedMatch && closedMatch[1] === 'true') {
+            const genMatch = /"generation"\s*:\s*(-?\d+)/.exec(raw);
+            const diskGen = genMatch ? Number(genMatch[1]) : 0;
+            return diskGen >= expected;
+        }
+        // No `closed` key found by scan — not a tombstone, so nothing to drop.
+        if (!closedMatch && !/"closed"/.test(raw)) return false;
+        const onDisk = JSON.parse(raw);
         const diskGen = typeof onDisk.generation === 'number' ? onDisk.generation : 0;
         return onDisk.closed === true && diskGen >= expected;
     } catch {
@@ -557,7 +595,7 @@ async function _doSave(payload) {
     const target = sessionPath(id);
     const tmp = target + '.' + randomBytes(6).toString('hex') + '.tmp';
     try {
-        await fsp.writeFile(tmp, JSON.stringify(session), 'utf-8');
+        await fsp.writeFile(tmp, JSON.stringify(_sessionForDisk(session)), 'utf-8');
         // Second check: between the temp write and the rename, closeSession()
         // may have planted a tombstone. Re-check on disk; if a newer tombstone
         // now exists, discard our temp file rather than let rename clobber it.
@@ -596,7 +634,7 @@ export function markSessionClosed(id, reason = 'manual') {
     const target = sessionPath(id);
     const tmp = target + '.' + randomBytes(6).toString('hex') + '.tmp';
     try {
-        writeFileSync(tmp, JSON.stringify(tombstone), 'utf-8');
+        writeFileSync(tmp, JSON.stringify(_sessionForDisk(tombstone)), 'utf-8');
         _renameWithRetrySync(tmp, target);
     } catch {
         try { unlinkSync(tmp); } catch { /* ignore */ }
@@ -672,11 +710,11 @@ export function deleteSession(id) {
     return removed;
 }
 const DEFAULT_SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes idle — aligned with Anthropic 5m messages tier and OpenAI in-memory cache window
-// Completed bridge agents (idle/done/error) live until terminal reap — must
+// Completed agents (idle/done/error) live until terminal reap - must
 // match TERMINAL_REAP_MS / _scheduleBridgeReap (3_600_000) in index.mjs and
-// bridge-stall-watchdog.mjs so the store sweep is the durable 1h reaper.
-const BRIDGE_TERMINAL_TTL_MS = 60 * 60 * 1000;
-const BRIDGE_TERMINAL_STATUSES = new Set(['idle', 'done', 'error']);
+// agent stall watchdog, so the store sweep is the durable 1h reaper.
+const AGENT_TERMINAL_TTL_MS = 60 * 60 * 1000;
+const AGENT_TERMINAL_STATUSES = new Set(['idle', 'done', 'error']);
 // Hard wall-clock ceiling for sessions stuck in status='running'. The
 // stream-watchdog should abort stalled streams within ~120s, but if it misses
 // one (process crash, watchdog not started, provider never returned), this
@@ -807,9 +845,9 @@ export function sweepStaleSessions(ttlMs, options = {}) {
                 remaining++;
                 continue;
             }
-            // Sweep bridge-owned and ownerless (legacy) sessions; skip explicit
+            // Sweep agent-owned and ownerless (legacy) sessions; skip explicit
             // user sessions before touching heartbeat sidecars.
-            if (typeof row.owner === 'string' && row.owner.length > 0 && row.owner !== 'bridge') {
+            if (typeof row.owner === 'string' && row.owner.length > 0 && !isAgentOwner(row)) {
                 remaining++;
                 continue;
             }
@@ -829,9 +867,9 @@ export function sweepStaleSessions(ttlMs, options = {}) {
                 remaining++;
                 continue;
             }
-            const isCompletedBridge = row.owner === 'bridge'
-                && BRIDGE_TERMINAL_STATUSES.has(row.status);
-            const sessionMaxAge = isCompletedBridge ? BRIDGE_TERMINAL_TTL_MS : maxAge;
+            const isCompletedAgent = isAgentOwner(row)
+                && AGENT_TERMINAL_STATUSES.has(row.status);
+            const sessionMaxAge = isCompletedAgent ? AGENT_TERMINAL_TTL_MS : maxAge;
             if (now - lastActive > sessionMaxAge) {
                 try { markSessionClosed(row.id, 'idle-sweep'); }
                 catch (err) {

package/src/runtime/agent/orchestrator/session/tool-result-offload.mjs

@@ -12,7 +12,7 @@ const TOOL_RESULT_SEARCH_THRESHOLD_CHARS = 50_000;
 const TOOL_RESULT_GREP_THRESHOLD_CHARS = 20_000;
 export const TOOL_RESULT_OFFLOAD_PREFIX = '[tool output offloaded:';
 
-// Per-tool persistence limits mirror Claude Code's per-tool maxResultSizeChars
+// Per-tool persistence limits mirror reference per-tool maxResultSizeChars
 // rather than a single global value: Grep persists at 20k (CC GrepTool), Glob
 // and list/find_* at the 50k system default (CC DEFAULT_MAX_RESULT_SIZE_CHARS;
 // tighter than CC Glob's 100k by design), and shell/bash_session/task at 30k
@@ -127,7 +127,7 @@ export async function maybeOffloadToolResult(sessionId, toolCallId, toolName, re
 // tool-results/<sessionId>/*.txt entry, rmdirs the directory, and drops
 // the sessionId entry from the module-level counter Map so a long-running
 // mcp-server process doesn't accumulate per-session state across the
-// lifetime of the bridge.
+// lifetime of the agent runtime.
 export async function clearOffloadSession(sessionId) {
     if (!sessionId) return;
     _offloadCounters.delete(sessionId);

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -6,12 +6,12 @@ const MIN_PROVIDER_TIMEOUT_MS = 30_000;
 export const STALL_TICK_MS = 15_000;
 export const DEFAULT_STALL_WARN_S = 300;
 export const DEFAULT_STALL_ABORT_S = 600;
-// First-byte (no-stream-delta) abort for the bridge stall watchdog. A wedged
+// First-byte (no-stream-delta) abort for the agent stall watchdog. A wedged
 // socket can sit at stage=requesting with zero server events. The 30s deadline
 // trialed here false-aborted slow high-reasoning first bytes (e.g. gpt-5.5
 // XHIGH, which can legitimately think >30s before the first delta) and, paired
 // with dispatch auto-retry, produced premature aborts + duplicate re-dispatches.
-// Auto-retry is now removed (bridge-retry.mjs MAX_ATTEMPTS = 1), so a single
+// Auto-retry is now removed, so a single
 // attempt must get a generous first-byte window: 300s (5 min). Env-overridable.
 export const DEFAULT_STALL_FIRST_BYTE_ABORT_S = (() => {
     const raw = process.env.MIXDOG_STALL_FIRST_BYTE_ABORT_S;
@@ -58,6 +58,14 @@ export function resolveTimeoutMs(envNames, fallbackMs, { minMs = 1_000, maxMs =
     return Math.min(Math.max(fallbackMs, minMs), maxMs);
 }
 
+// While a tool call is in flight, bump lastProgressAt on this cadence so long
+// executions stay "active" without emitting model-visible content.
+export const DEFAULT_ACTIVITY_HEARTBEAT_MS = resolveTimeoutMs(
+    'MIXDOG_AGENT_ACTIVITY_HEARTBEAT_MS',
+    30_000,
+    { minMs: 5_000, maxMs: 300_000 },
+);
+
 export const PROVIDER_FIRST_BYTE_TIMEOUT_MS = resolveTimeoutMs(
     'MIXDOG_PROVIDER_FIRST_BYTE_TIMEOUT_MS',
     Math.min(120_000, PROVIDER_MAX_BEFORE_WARN_MS),
@@ -94,19 +102,26 @@ export const PROVIDER_HTTP_RESPONSE_TIMEOUT_MS = resolveTimeoutMs(
     { minMs: 10_000, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
 );
 
-// Stream idle watchdog is OFF by default — matches Claude Code native
-// behaviour (its watchdog is gated behind CLAUDE_ENABLE_STREAM_WATCHDOG).
-// The bridge stall watchdog (STALL_ABORT_S, 600s) is the backstop for
-// genuinely dead streams; this short inter-chunk idle watchdog only adds
-// value when explicitly enabled, and otherwise prematurely kills slow
-// high-reasoning streams. Enable with MIXDOG_ENABLE_STREAM_WATCHDOG=1.
+// Stream idle watchdog is ON by default. Earlier it was OFF (reference-agent
+// parity) on the theory that a short inter-chunk timer would false-abort slow
+// high-reasoning streams — but every provider's SSE loop resets the idle timer
+// on EVERY chunk, including content-free keepalives (Anthropic `:ping`,
+// OpenAI/compat reasoning_content deltas, Gemini chunks). So a live
+// extended-thinking stream keeps the timer fresh; only a genuinely silent
+// socket (no bytes at all for the whole window) trips it. With the watchdog
+// OFF, such a wedged socket sat until the 600s agent stall backstop, which the
+// trace logs showed as the dominant mid-stream hang (sse_parse_ms p99 ~183s,
+// max ~411s). Defaulting ON with a generous 120s window cuts that tail ~5x
+// while leaving genuine reasoning pauses (kept alive by keepalive frames)
+// untouched. Force OFF with MIXDOG_ENABLE_STREAM_WATCHDOG=0.
 const _sseWatchdogRaw = process.env.MIXDOG_ENABLE_STREAM_WATCHDOG;
-export const PROVIDER_SSE_IDLE_WATCHDOG_ENABLED =
-    _sseWatchdogRaw === '1' || _sseWatchdogRaw === 'true' || _sseWatchdogRaw === 'yes';
+export const PROVIDER_SSE_IDLE_WATCHDOG_ENABLED = _sseWatchdogRaw === undefined || _sseWatchdogRaw === ''
+    ? true
+    : (_sseWatchdogRaw === '1' || _sseWatchdogRaw === 'true' || _sseWatchdogRaw === 'yes');
 
 export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs(
     'MIXDOG_PROVIDER_SSE_IDLE_TIMEOUT_MS',
-    90_000,
+    120_000,
     { minMs: 10_000, maxMs: STALL_WARN_MS },
 );
 
@@ -143,15 +158,15 @@ export const PROVIDER_RETRY_JITTER_RATIO = (() => {
     return 0.2;
 })();
 
-export function resolveBridgeStallThresholds(role, env = process.env) {
+export function resolveAgentStallThresholds(role, env = process.env) {
     const cfg = role ? getHiddenRole(role) : null;
     const cfgAbort = cfg?.stallCap?.idleSeconds > 0 ? cfg.stallCap.idleSeconds : STALL_ABORT_S;
     const envOverride = envThresholdSeconds(env);
     const abort = envOverride != null ? envOverride : cfgAbort;
-    // Mid-stream "slow" warning disabled — a bridge stall now notifies ONLY at
+    // Mid-stream "slow" warning disabled — an agent stall now notifies ONLY at
     // the abort deadline (10 min default). warn === abort means the watchdog's
     // warn branch (verdict 'ok' && stale >= warn) can never fire before 'stall',
-    // so the only notification a stalled bridge worker emits is at the deadline.
+    // so the only notification a stalled agent worker emits is at the deadline.
     const warn = abort;
     // First-byte deadline: a request still in 'requesting' that never produced a
     // single SSE delta is hung, not slow-reasoning. Abort on this shorter deadline
@@ -160,7 +175,7 @@ export function resolveBridgeStallThresholds(role, env = process.env) {
     return { warn, abort, firstByteAbort };
 }
 
-export function resolveBridgeToolThresholdSeconds(role, thresholdSeconds) {
+export function resolveAgentToolThresholdSeconds(role, thresholdSeconds) {
     const cfg = role ? getHiddenRole(role) : null;
     if (cfg?.stallCap?.toolRunningSeconds > 0) return cfg.stallCap.toolRunningSeconds;
     return thresholdSeconds;
@@ -206,7 +221,7 @@ export function createTimeoutSignal(parentSignal, timeoutMs, label) {
 // replaced-by-newer-request). Used for the streaming generation phase, where a fixed
 // total-lifetime cap would false-abort a stream that is still emitting SSE deltas; the
 // streaming phase is bounded instead by the per-attempt first-byte timeout, the parent
-// signal, and the bridge stall watchdog (STALL_ABORT_S, progress-based). cleanup()
+// signal, and the agent stall watchdog (STALL_ABORT_S, progress-based). cleanup()
 // detaches the parent listener so no listener leaks on the (long-lived) parent signal.
 export function createPassthroughSignal(parentSignal) {
     if (!parentSignal) return { signal: null, cleanup: () => {} };

package/src/runtime/agent/orchestrator/tool-loop-guard.mjs

@@ -1,229 +1,13 @@
 /**
- * Shell file-lookup classifier + soft-warn marker stripper.
+ * Soft-warn marker stripper.
  *
  * The tool-loop guard subsystem (repeated/fanned-out tool-use detection and its
- * soft-warn sidecars) was removed once every warn path had been disabled. Two
- * standalone utilities remain:
- *   • classifyBashFileLookupCommand — detects a `bash` call whose first token is
- *     a file-lookup that has a dedicated in-process tool (read/grep/glob/list).
- *     Used by the bridge-worker permission gate to block the shell route.
- *   • classifyBridgeWorkerGitMutationCommand — detects bridge-worker shell
- *     calls that try to run git operations reserved for Lead.
+ * soft-warn sidecars) was removed once every warn path had been disabled. This
+ * module now retains a single utility:
  *   • stripSoftWarns — strips legacy soft-warn marker blocks from outbound
  *     bodies so older transcripts that still carry them stay clean.
  */
 
-// File-lookup-via-shell detector. Matches a `bash` command whose first token
-// is a unix find/grep/cat/ls/head/tail OR a powershell file-discovery cmdlet
-// (Get-ChildItem / Select-String / Get-Content). These have dedicated tools
-// (glob / grep / read / list) per rules/shared/01-tool.md; using bash routes
-// around the in-process tool cache and the path-permission check, and the
-// outputs were observed in PG telemetry running 100x slower than the dedicated
-// path. Get-CimInstance / Win32_Process etc. are NOT matched — process
-// enumeration genuinely needs the shell. One advisory per session per matched
-// command class; subsequent matches stay silent so the model isn't drowned.
-const SHELL_FILE_LOOKUP_COMMANDS = [
-    'find', 'ls', 'grep', 'rg', 'fd', 'cat', 'head', 'tail',
-    'sed', 'awk', 'less', 'more', 'wc', 'tree',
-    // File-metadata mirror paths called out in rules/shared/01-tool.md
-    // Tool Routing section. Added after probe HS-A3 surfaced that the
-    // rule explicitly lists `stat`, `du`, `file`, and `ls -l` as
-    // forbidden mirror paths but the policy under-enforced them.
-    'stat', 'du', 'file',
-    'dir', 'type', 'findstr',
-    'Get-ChildItem', 'gci', 'Select-String', 'sls', 'Get-Content', 'gc',
-].join('|');
-const BASH_FILE_LOOKUP_RE = new RegExp(
-    `^\\s*(?:git\\s+(?:grep|ls-files)\\b|(?:${SHELL_FILE_LOOKUP_COMMANDS})\\b)`,
-    'i',
-);
-// Wrapper / eval forms that route the same file-lookup intent through a host
-// shell (`bash -c "grep ..."`, `pwsh -Command Get-Content ...`) or an
-// inline interpreter eval (`node -e fs.readFileSync(...)`,
-// `python -c "open(...)"`). Without these the advisory was bypassable just
-// by quoting the call inside another command.
-const BASH_WRAPPER_FILE_LOOKUP_RE = new RegExp(
-    `^\\s*(?:bash|sh|zsh|fish|dash)\\b[^\\n]*\\s-\\w*c\\w*\\s+["']?\\s*(?:${SHELL_FILE_LOOKUP_COMMANDS})\\b`,
-    'i',
-);
-const CMD_WRAPPER_FILE_LOOKUP_RE = /^\s*cmd(?:\.exe)?\s+\/[cs]\s+["']?\s*(?:dir|type|findstr)\b/i;
-const PWSH_WRAPPER_FILE_LOOKUP_RE = /^\s*(?:pwsh|powershell)(?:\.exe)?\b[\s\S]*?(?:-|\/)(?:Command|c)\s+["']?\s*(?:Get-ChildItem|gci|dir|ls|Select-String|sls|Get-Content|gc|cat|type)\b/i;
-const NODE_FS_EVAL_RE = /^\s*node(?:\.exe)?\b[\s\S]*?\s-e\s+["'](?![\s\S]*\bJSON\.parse\s*\()[\s\S]*?\b(?:fs\.|readFileSync|readFile|readdirSync|readdir|statSync|stat)\b/i;
-const PYTHON_OPEN_EVAL_RE = /^\s*python3?(?:\.exe)?\b[\s\S]*?\s-c\s+["'][\s\S]*?\b(?:open\s*\(|Path\s*\(|read_text\s*\(|read_bytes\s*\(|iterdir\s*\()/i;
-function _classifyBashFileLookup(command) {
-    if (typeof command !== 'string' || !command) return null;
-    const direct = command.match(BASH_FILE_LOOKUP_RE);
-    if (direct) return direct[0].trim().toLowerCase();
-    if (BASH_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'bash-wrapped';
-    if (CMD_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'cmd-wrapped';
-    if (PWSH_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'pwsh-wrapped';
-    if (NODE_FS_EVAL_RE.test(command)) return 'node-fs-eval';
-    if (PYTHON_OPEN_EVAL_RE.test(command)) return 'python-open-eval';
-    return null;
-}
-
-export function classifyBashFileLookupCommand(command) {
-    return _classifyBashFileLookup(command);
-}
-
-const SHELL_WRAPPER_COMMANDS = new Set([
-    'bash', 'sh', 'zsh', 'fish', 'dash',
-    'cmd', 'cmd.exe',
-    'pwsh', 'pwsh.exe', 'powershell', 'powershell.exe',
-]);
-const POSIX_SHELL_WRAPPER_COMMANDS = new Set(['bash', 'sh', 'zsh', 'fish', 'dash']);
-const CMD_SHELL_WRAPPER_COMMANDS = new Set(['cmd', 'cmd.exe']);
-const POWERSHELL_WRAPPER_COMMANDS = new Set(['pwsh', 'pwsh.exe', 'powershell', 'powershell.exe']);
-const SHELL_SEPARATORS = new Set([';', '\n', '&&', '||', '|', '&']);
-const READONLY_GIT_SUBCOMMANDS = new Set([
-    'status', 'diff', 'show', 'log', 'rev-parse', 'ls-files', 'grep', 'blame', 'describe', 'merge-base',
-]);
-
-function shellTokenizeLoose(command) {
-    const tokens = [];
-    let current = '';
-    let quote = null;
-    let escape = false;
-    const push = () => {
-        if (current !== '') tokens.push(current);
-        current = '';
-    };
-    const pushSep = (sep) => {
-        push();
-        tokens.push(sep);
-    };
-    for (let i = 0; i < command.length; i += 1) {
-        const ch = command[i];
-        if (escape) {
-            current += ch;
-            escape = false;
-            continue;
-        }
-        if (ch === '\\') {
-            escape = true;
-            continue;
-        }
-        if (quote) {
-            if (ch === quote) quote = null;
-            else current += ch;
-            continue;
-        }
-        if (ch === '\'' || ch === '"') {
-            quote = ch;
-            continue;
-        }
-        if (ch === '\n') {
-            pushSep('\n');
-            continue;
-        }
-        if (ch === ';') {
-            pushSep(';');
-            continue;
-        }
-        if ((ch === '&' || ch === '|') && command[i + 1] === ch) {
-            pushSep(`${ch}${ch}`);
-            i += 1;
-            continue;
-        }
-        if (ch === '|' || ch === '&') {
-            pushSep(ch);
-            continue;
-        }
-        if (/\s/.test(ch)) {
-            push();
-            continue;
-        }
-        current += ch;
-    }
-    push();
-    return tokens;
-}
-
-function isCommandPosition(tokens, index) {
-    for (let i = index - 1; i >= 0; i -= 1) {
-        if (!tokens[i]) continue;
-        return SHELL_SEPARATORS.has(tokens[i]);
-    }
-    return true;
-}
-
-function skipGitGlobalOptions(tokens, index) {
-    let i = index;
-    while (i < tokens.length) {
-        const token = String(tokens[i] || '');
-        const lower = token.toLowerCase();
-        if (!token || SHELL_SEPARATORS.has(token)) return i;
-        if (lower === '-c' || lower === '-C' || lower === '--git-dir' || lower === '--work-tree' || lower === '--namespace') {
-            i += 2;
-            continue;
-        }
-        if (/^(?:--git-dir|--work-tree|--namespace)=/i.test(token)) {
-            i += 1;
-            continue;
-        }
-        if (lower === '--no-pager' || lower === '-p' || lower === '--literal-pathspecs' || lower === '--glob-pathspecs' || lower === '--noglob-pathspecs' || lower === '--icase-pathspecs') {
-            i += 1;
-            continue;
-        }
-        if (/^-/.test(token)) {
-            i += 1;
-            continue;
-        }
-        return i;
-    }
-    return i;
-}
-
-function readonlyGitInvocation(tokens, subIndex) {
-    const sub = String(tokens[subIndex] || '').toLowerCase();
-    if (!READONLY_GIT_SUBCOMMANDS.has(sub)) return false;
-    if (sub === 'remote') {
-        const next = String(tokens[subIndex + 1] || '').toLowerCase();
-        return !next || next === '-v' || next === '--verbose' || next === 'show';
-    }
-    if (sub === 'branch') {
-        const rest = tokens.slice(subIndex + 1).filter((token) => token && !SHELL_SEPARATORS.has(token));
-        return rest.length === 0 || rest.every((token) => ['--show-current', '-a', '-r', '-v', '-vv', '--all', '--remotes', '--verbose', '--contains', '--merged', '--no-merged'].includes(String(token).toLowerCase()));
-    }
-    return true;
-}
-
-function isShellCommandArgFlag(wrapper, flag) {
-    const lower = String(flag || '').toLowerCase();
-    if (POSIX_SHELL_WRAPPER_COMMANDS.has(wrapper)) return /^-\w*c\w*$/.test(lower);
-    if (CMD_SHELL_WRAPPER_COMMANDS.has(wrapper)) return lower === '/c';
-    if (POWERSHELL_WRAPPER_COMMANDS.has(wrapper)) return lower === '-command' || lower === '/command' || lower === '-c';
-    return false;
-}
-
-export function classifyBridgeWorkerGitMutationCommand(command) {
-    if (typeof command !== 'string' || !command.trim()) return null;
-    const tokens = shellTokenizeLoose(command);
-    for (let i = 0; i < tokens.length; i += 1) {
-        const token = String(tokens[i] || '').toLowerCase();
-        if (!token || SHELL_SEPARATORS.has(token) || !isCommandPosition(tokens, i)) continue;
-        if (SHELL_WRAPPER_COMMANDS.has(token)) {
-            for (let j = i + 1; j < tokens.length; j += 1) {
-                const flag = String(tokens[j] || '').toLowerCase();
-                if (SHELL_SEPARATORS.has(flag)) break;
-                if (!isShellCommandArgFlag(token, flag)) continue;
-                const nested = tokens.slice(j + 1).join(' ');
-                const nestedHit = classifyBridgeWorkerGitMutationCommand(nested || '');
-                if (nestedHit) return nestedHit;
-                break;
-            }
-            continue;
-        }
-        if (token !== 'git' && token !== 'git.exe') continue;
-        const subIndex = skipGitGlobalOptions(tokens, i + 1);
-        const sub = String(tokens[subIndex] || '').toLowerCase();
-        if (!sub || SHELL_SEPARATORS.has(sub)) return 'git';
-        if (readonlyGitInvocation(tokens, subIndex)) continue;
-        return `git ${sub}`;
-    }
-    return null;
-}
-
 // Strip soft-warn marker blocks (header ⚠ <label> through next blank line / EOF)
 // from outbound bodies. Never call on tool-result bodies fed back to the model.
 // New compact format: each warn is a single line starting with `⚠ <Label>(` and ending at newline.