mixdog 0.9.134 → 0.9.136

package/src/runtime/agent/orchestrator/tools/graph-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.1.16",
+  "version": "0.1.18",
   "_comment": "Synced from immutable graph-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-darwin-arm64",
-      "sha256": "29ff99fd358759b78ddd2df4096e56e80e7302c7e2b173c5a851d3198ad39e29"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.18/mixdog-graph-darwin-arm64",
+      "sha256": "c89403d4a4cd08aa27427b65e9f0efe4885fb35cbe788527b81279e03edc82eb"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-darwin-x64",
-      "sha256": "c65ecd85d3d51b061972a10ee57eae0b1b6bd0a8760eb3c260e044c10d83bd60"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.18/mixdog-graph-darwin-x64",
+      "sha256": "43765bb6598f0b7db3ba5df8348bb7221fc0e4fec5f8ad9d4d53887d4951e42f"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-linux-arm64",
-      "sha256": "4af49fb83e3f95230849c3c8c4a959f52053e81e317d038febc662ec3241fa53"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.18/mixdog-graph-linux-arm64",
+      "sha256": "ada18e0d9ca3ab8fe65098b81c8856d01992eb2f33a2f2923e886280e2b635a4"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-linux-x64",
-      "sha256": "723efc22949442abe9c60733b78ad3f59ccf15778debbfb98efe167b2d8de506"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.18/mixdog-graph-linux-x64",
+      "sha256": "724d219ec72828662f34ba7b0edf00938e8f9f00df76cb6c41675551e2c0137e"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-win32-x64.exe",
-      "sha256": "685914bc3e56c545e23c63fe236cf260c5784707720bc29d63431b923e00a83a"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.18/mixdog-graph-win32-x64.exe",
+      "sha256": "c24f4ffb0beec3f355bc4e33c02adafce2ba966df34922ec0ff2ce2cde23fe65"
     }
   }
 }

package/src/runtime/agent/orchestrator/tools/lib/native-spawn-client.mjs

@@ -1,13 +1,16 @@
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
+import { dirname, resolve as pathResolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { EventEmitter } from 'node:events';
+import { fileURLToPath } from 'node:url';
 import { hiddenSpawnOpts } from '../../../../shared/spawn-flags.mjs';
 import { packageNativeToolPath } from '../../../../shared/native-tool-paths.mjs';
 import { getPluginData } from '../../config.mjs';
 import { ensureSpawnBinary, findCachedSpawnBinary } from '../spawn-binary-fetcher.mjs';
 
 const RESTART_BACKOFF_MS = 30_000;
+const SERVER_READY_TIMEOUT_MS = 5_000;
 
 let _server = null;
 let _binaryPath = undefined;
@@ -57,29 +60,31 @@ function acceptTask(message) {
 class LineStream extends EventEmitter {
   constructor() {
     super();
-    this._pending = '';
+    this._pending = [];
   }
   setEncoding() { return this; }
   emit(event, ...args) {
     if (event === 'data' && this.listenerCount('data') === 0) {
-      this._pending += args[0] == null ? '' : String(args[0]);
+      if (args[0] != null) this._pending.push(args[0]);
       return false;
     }
     return super.emit(event, ...args);
   }
   on(event, listener) {
     const ret = super.on(event, listener);
-    if (event === 'data' && this._pending) {
+    if (event === 'data' && this._pending.length > 0) {
       const pending = this._pending;
-      this._pending = '';
-      queueMicrotask(() => listener(pending));
+      this._pending = [];
+      queueMicrotask(() => {
+        for (const chunk of pending) listener(chunk);
+      });
     }
     return ret;
   }
 }
 
 export class NativeSpawnChild extends EventEmitter {
-  constructor(id, cancel) {
+  constructor(id, cancel, send = null) {
     super();
     this.pid = undefined;
     this.killed = false;
@@ -91,9 +96,27 @@ export class NativeSpawnChild extends EventEmitter {
     this.__nativeSpawn = true;
     this._id = id;
     this._cancel = cancel;
+    this._send = send;
     this._closed = false;
   }
 
+  // stdinPipe children only (warm shell standby): forward script text to the
+  // child's stdin via the spawn server. No-ops (false) when the child was
+  // spawned without stdinPipe or the server link is gone.
+  writeStdin(text, { close = false } = {}) {
+    if (this._closed || this.killed || typeof this._send !== 'function') return false;
+    return this._send({
+      stdinWrite: this._id,
+      data: String(text ?? ''),
+      ...(close ? { close: true } : {}),
+    });
+  }
+
+  endStdin() {
+    if (typeof this._send !== 'function') return false;
+    return this._send({ stdinClose: this._id });
+  }
+
   kill() {
     this.killed = true;
     this._cancel?.(this._id);
@@ -124,6 +147,17 @@ function _resolveBinary() {
     _binaryPath = explicit;
     return _binaryPath;
   }
+  const moduleDir = dirname(fileURLToPath(import.meta.url));
+  const binName = process.platform === 'win32' ? 'mixdog-spawn.exe' : 'mixdog-spawn';
+  const localBuild = pathResolve(
+    moduleDir,
+    '../../../../../../native/mixdog-spawn/target/release',
+    binName,
+  );
+  if (existsSync(localBuild)) {
+    _binaryPath = localBuild;
+    return _binaryPath;
+  }
   const installed = packageNativeToolPath('spawn');
   if (existsSync(installed)) {
     _binaryPath = installed;
@@ -140,6 +174,28 @@ function _setServerReferenced(server, referenced) {
   try { server?.child?.stdout?.[method]?.(); } catch {}
 }
 
+// Referenced only while a NON-idle request is pending. Idle requests (parked
+// warm shell standbys) live for minutes-to-hours; counting them would pin the
+// host event loop — a one-shot CLI or test runner could never exit.
+function _recomputeServerRef(server) {
+  let active = false;
+  for (const entry of server.pending.values()) {
+    if (!entry.idle) { active = true; break; }
+  }
+  _setServerReferenced(server, active);
+}
+
+/** Mark a pending spawn request idle (parked) or active. Idle requests do not
+ *  keep the host process alive. Returns false when the request is gone. */
+export function setNativeSpawnRequestIdle(child, idle = true) {
+  const server = _server;
+  const entry = server?.pending?.get?.(Number(child?._id));
+  if (!entry) return false;
+  entry.idle = idle === true;
+  _recomputeServerRef(server);
+  return true;
+}
+
 function _teardown(error) {
   const server = _server;
   _server = null;
@@ -164,6 +220,30 @@ function _teardown(error) {
   try { server.child.kill(); } catch {}
 }
 
+export async function shutdownNativeSpawnServer(reason = 'process-exit', timeoutMs = 1_000) {
+  const server = _server;
+  if (!server) return true;
+  const child = server.child;
+  const exited = new Promise((resolve) => {
+    child.once('exit', () => resolve(true));
+    child.once('error', () => resolve(true));
+  });
+  try { child.stdin?.end?.(); } catch {}
+  _teardown(new Error(`native spawn server shutdown (${reason})`));
+  let timer;
+  const stopped = await Promise.race([
+    exited,
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(false), Math.max(10, Number(timeoutMs) || 1_000));
+    }),
+  ]);
+  if (timer) clearTimeout(timer);
+  if (!stopped) {
+    try { child.kill('SIGKILL'); } catch {}
+  }
+  return stopped;
+}
+
 function _ensureServer() {
   if (_server) return _server;
   if (Date.now() - _lastFailureAt < RESTART_BACKOFF_MS) return null;
@@ -179,19 +259,38 @@ function _ensureServer() {
     _lastFailureAt = Date.now();
     return null;
   }
-  const server = { child, pending: new Map(), sequence: 0 };
+  const server = { child, pending: new Map(), sequence: 0, ready: false, caps: {} };
+  let resolveReady;
+  server.readyPromise = new Promise((resolve) => { resolveReady = resolve; });
+  const settleReady = (value) => {
+    if (!resolveReady) return;
+    const resolve = resolveReady;
+    resolveReady = null;
+    resolve(value);
+  };
   const lines = createInterface({ input: child.stdout });
   lines.on('line', (line) => {
     let message;
     try { message = JSON.parse(line); } catch { return; }
-    if (message?.ready === true) return;
+    if (message?.ready === true) {
+      server.caps = (message.caps && typeof message.caps === 'object') ? message.caps : {};
+      server.ready = true;
+      settleReady(true);
+      return;
+    }
     if (String(message?.event || '').startsWith('task_')) acceptTask(message);
     const pending = server.pending.get(Number(message?.id));
     if (!pending) return;
     pending.onMessage(message);
   });
-  child.on('error', (error) => { if (_server === server) _teardown(error); });
-  child.on('exit', () => { if (_server === server) _teardown(); });
+  child.on('error', (error) => {
+    settleReady(false);
+    if (_server === server) _teardown(error);
+  });
+  child.on('exit', () => {
+    settleReady(false);
+    if (_server === server) _teardown();
+  });
   child.stdin.on('error', (error) => { if (_server === server) _teardown(error); });
   _setServerReferenced(server, false);
   _server = server;
@@ -207,17 +306,40 @@ export async function warmNativeSpawnServer() {
 }
 
 export async function ensureNativeSpawnServer() {
-  if (_server) return true;
+  if (_server?.ready) return true;
   let binary = _resolveBinary();
   if (!binary) {
     binary = await ensureSpawnBinary(getPluginData());
     _binaryPath = binary;
   }
-  if (!_ensureServer()) {
+  const server = _ensureServer();
+  if (!server) {
     throw Object.assign(new Error('verified native spawn server could not be started'), {
       code: 'NATIVE_SPAWN_UNAVAILABLE',
     });
   }
+  if (!server.ready) {
+    let timer;
+    let ready;
+    _setServerReferenced(server, true);
+    try {
+      ready = await Promise.race([
+        server.readyPromise,
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(false), SERVER_READY_TIMEOUT_MS);
+        }),
+      ]);
+    } finally {
+      if (timer) clearTimeout(timer);
+      if (_server === server) _recomputeServerRef(server);
+    }
+    if (!ready) {
+      if (_server === server) _teardown(new Error('native spawn server ready timeout'));
+      throw Object.assign(new Error('verified native spawn server did not become ready'), {
+        code: 'NATIVE_SPAWN_UNAVAILABLE',
+      });
+    }
+  }
   return true;
 }
 
@@ -227,6 +349,11 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
   const id = ++server.sequence;
   const fake = new NativeSpawnChild(id, (cancelId) => {
     try { server.child.stdin.write(`${JSON.stringify({ cancel: cancelId })}\n`); } catch {}
+  }, (payload) => {
+    try {
+      server.child.stdin.write(`${JSON.stringify({ id: ++server.sequence, ...payload })}\n`);
+      return true;
+    } catch { return false; }
   });
   const request = {
     id,
@@ -239,6 +366,8 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
     timeoutMs: Math.max(0, Number(spawnOptions.timeoutMs) || 0),
     outputLimit: Math.max(0, Number(spawnOptions.outputLimit) || 0),
     mergeStderr: spawnOptions.mergeStderr === true,
+    rawOutput: spawnOptions.rawOutput === true,
+    ...(spawnOptions.stdinPipe === true ? { stdinPipe: true } : {}),
     command: spawnOptions.command || undefined,
     shellType: spawnOptions.shellType || undefined,
     ownerSessionId: spawnOptions.ownerSessionId || undefined,
@@ -255,7 +384,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         fake.emit('error', err);
         fake.emit('close', 1, null);
       }
-      if (server.pending.size === 0) _setServerReferenced(server, false);
+      _recomputeServerRef(server);
     },
     onMessage(message) {
       const event = String(message?.event || '');
@@ -265,8 +394,18 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         fake.emit('spawn');
         return;
       }
-      if (event === 'stdout' && message.text) fake.stdout.emit('data', String(message.text));
-      else if (event === 'stderr' && message.text) fake.stderr.emit('data', String(message.text));
+      if (event === 'stdout' && (message.dataBase64 || message.text)) {
+        const chunk = message.dataBase64
+          ? Buffer.from(String(message.dataBase64), 'base64')
+          : String(message.text);
+        fake.stdout.emit('data', chunk);
+      }
+      else if (event === 'stderr' && (message.dataBase64 || message.text)) {
+        const chunk = message.dataBase64
+          ? Buffer.from(String(message.dataBase64), 'base64')
+          : String(message.text);
+        fake.stderr.emit('data', chunk);
+      }
       else if (event === 'root_exit') {
         fake.exitCode = message.code == null ? null : Number(message.code);
         fake.signalCode = message.signal || null;
@@ -279,7 +418,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         fake.signalCode = message.signal || null;
         fake._closed = true;
         fake.emit('close', fake.exitCode, fake.signalCode);
-        if (server.pending.size === 0) _setServerReferenced(server, false);
+        _recomputeServerRef(server);
       } else if (event === 'error') {
         const detail = String(message.message || 'native spawn failed');
         const err = new Error(message.code ? `${message.code}: ${detail}` : detail);
@@ -425,7 +564,7 @@ export function adoptNativeTaskByPid({
     const finish = (task, error = null) => {
       if (timer) clearTimeout(timer);
       server.pending.delete(id);
-      if (server.pending.size === 0) _setServerReferenced(server, false);
+      _recomputeServerRef(server);
       if (error) reject(error);
       else resolve(task);
     };
@@ -468,6 +607,15 @@ export function adoptNativeTaskByPid({
   });
 }
 
+// Capability handshake: true only after the connected spawn server announced
+// stdinPipe support in its ready line. An older binary silently ignores the
+// unknown stdinPipe field and gives the child a null stdin — a standby taken
+// in that state would run an EMPTY script and report exit 0 without ever
+// executing the command. Gate the warm-standby feature on this.
+export function nativeSpawnSupportsStdinPipe() {
+  return _server?.caps?.stdinPipe === true;
+}
+
 export function _resetNativeSpawnClientForTest() {
   _teardown(new Error('test reset'));
   _binaryPath = undefined;

package/src/runtime/agent/orchestrator/tools/lib/shell-warm-standby.mjs

@@ -0,0 +1,162 @@
+// Warm pwsh standby: one pre-spawned PowerShell per (shell path, env
+// signature) waits with a stdin-reading bootstrap. Taking it skips
+// CreateProcess + Defender scan (~300ms warm, ~1.8s cold) for the next shell
+// call; the script arrives via the spawn server's stdinWrite message and runs
+// with identical exit-code/stdout/stderr semantics. Any miss falls back to
+// the regular gated spawn. MIXDOG_SHELL_WARM_STANDBY=0 disables.
+import { createHash } from 'node:crypto';
+import { nativeSpawnSupportsStdinPipe, setNativeSpawnRequestIdle, tryNativeSpawn } from './native-spawn-client.mjs';
+import { SHELL_OUTPUT_DISK_CAP } from '../shell-exec-output.mjs';
+
+// Bootstrap: pre-warm scriptblock compilation while parked, re-decode stdin
+// as UTF-8 (console input encoding would mangle non-ASCII), then dot-source
+// the fed script so exit codes, $LASTEXITCODE and terminating errors behave
+// exactly like `-Command <script>`.
+const STANDBY_BOOTSTRAP = "$null = . ([scriptblock]::Create('$null')); [Console]::InputEncoding=[System.Text.UTF8Encoding]::new($false); . ([scriptblock]::Create([Console]::In.ReadToEnd()))";
+const STANDBY_ARGS = ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', STANDBY_BOOTSTRAP];
+const _configuredIdleMs = Number(process.env.MIXDOG_SHELL_WARM_STANDBY_IDLE_MS);
+const STANDBY_TTL_MS = Number.isFinite(_configuredIdleMs) && _configuredIdleMs >= 100
+    ? Math.floor(_configuredIdleMs)
+    : 2 * 60_000;
+
+let _slot = null; // { native, shell, envSig, createdAt }
+let _slotIdleTimer = null;
+
+function _clearSlotIdleTimer() {
+    if (!_slotIdleTimer) return;
+    clearTimeout(_slotIdleTimer);
+    _slotIdleTimer = null;
+}
+
+function _armSlotIdleTimer(slot) {
+    _clearSlotIdleTimer();
+    _slotIdleTimer = setTimeout(() => {
+        _slotIdleTimer = null;
+        if (_slot !== slot) return;
+        _slot = null;
+        try { slot.native.child.kill(); } catch { /* best-effort */ }
+    }, STANDBY_TTL_MS);
+    _slotIdleTimer.unref?.();
+}
+
+function _disabled() {
+    return process.env.MIXDOG_SHELL_WARM_STANDBY === '0';
+}
+
+function envSignature(env) {
+    const entries = Object.entries(env || {})
+        .map(([key, value]) => `${key}=${value}`)
+        .sort()
+        .join('\n');
+    return createHash('sha256').update(entries).digest('hex');
+}
+
+function _slotAlive(slot) {
+    return Boolean(slot
+        && slot.native?.child
+        && slot.native.child.exitCode == null
+        && !slot.native.child.killed);
+}
+
+function psQuote(value) {
+    return String(value).replace(/'/g, "''");
+}
+
+/** Pre-spawn the next standby (fire-and-forget; a live one is kept). */
+export function ensureWarmShellStandby({ shell, env }) {
+    if (_disabled() || !shell) return;
+    // Old spawn binaries ignore stdinPipe (null stdin → instant-EOF standby
+    // that would ack commands without running them); require the handshake.
+    if (!nativeSpawnSupportsStdinPipe()) return;
+    if (_slotAlive(_slot)) return;
+    let native = null;
+    try {
+        native = tryNativeSpawn({
+            shell: String(shell),
+            argv: STANDBY_ARGS,
+            spawnOptions: {
+                env,
+                cwd: process.cwd(),
+                outputLimit: SHELL_OUTPUT_DISK_CAP,
+                rawOutput: true,
+                stdinPipe: true,
+                shellType: 'powershell',
+                command: '(warm shell standby)',
+            },
+        });
+    } catch { native = null; }
+    if (!native?.child) return;
+    // Parked standby must not pin the host event loop (a one-shot CLI or test
+    // runner would otherwise never exit); reactivated at take time.
+    setNativeSpawnRequestIdle(native.child, true);
+    const slot = {
+        native,
+        shell: String(shell),
+        envSig: envSignature(env),
+        createdAt: Date.now(),
+    };
+    const release = () => {
+        if (_slot !== slot) return;
+        _slot = null;
+        _clearSlotIdleTimer();
+    };
+    native.child.once('close', release);
+    native.child.once('error', release);
+    _slot = slot;
+    _armSlotIdleTimer(slot);
+}
+
+/** Take the parked standby for immediate use, or null on any mismatch.
+ *  Always refills so the NEXT call finds a warm one. */
+export function takeWarmShellStandby({ shell, env, cwd }) {
+    if (_disabled() || !shell) return null;
+    const slot = _slot;
+    const refill = () => { try { ensureWarmShellStandby({ shell, env }); } catch { /* best-effort */ } };
+    const usable = _slotAlive(slot)
+        && slot.shell === String(shell)
+        && typeof slot.native.child.writeStdin === 'function'
+        && Number.isFinite(slot.native.child.pid) && slot.native.child.pid > 0
+        && Date.now() - slot.createdAt <= STANDBY_TTL_MS
+        && slot.envSig === envSignature(env);
+    if (!usable) {
+        // Stale (TTL/env/shell drift): kill so it cannot linger; a still-
+        // warming slot (no pid yet) is left in place for a later call.
+        if (_slotAlive(slot) && Number.isFinite(slot.native.child.pid)
+            && (slot.shell !== String(shell)
+                || Date.now() - slot.createdAt > STANDBY_TTL_MS
+                || slot.envSig !== envSignature(env))) {
+            _slot = null;
+            _clearSlotIdleTimer();
+            try { slot.native.child.kill(); } catch { /* best-effort */ }
+        }
+        refill();
+        return null;
+    }
+    _slot = null;
+    _clearSlotIdleTimer();
+    // Back to active: the caller is about to run a real command on it and the
+    // host must stay alive until that command settles.
+    setNativeSpawnRequestIdle(slot.native.child, false);
+    refill();
+    const feed = (commandText, workDir) => {
+        // cwd prelude: the standby was spawned in the daemon cwd. Set-Location
+        // fixes $PWD and native-child working dirs; Environment.CurrentDirectory
+        // fixes .NET relative-path APIs.
+        const prelude = workDir
+            ? `Set-Location -LiteralPath '${psQuote(workDir)}'; [System.Environment]::CurrentDirectory = '${psQuote(workDir)}'; `
+            : '';
+        // Single atomic write+EOF: a separate close message can race ahead
+        // of the server's async write thread and feed an empty script.
+        slot.native.child.writeStdin(prelude + String(commandText ?? ''), { close: true });
+    };
+    return { spawned: slot.native, feed };
+}
+
+export function _resetWarmShellStandbyForTest() {
+    const slot = _slot;
+    _slot = null;
+    _clearSlotIdleTimer();
+    if (slot?.native?.child) {
+        try { slot.native.child.kill(); } catch { /* best-effort */ }
+    }
+}

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -24,6 +24,7 @@ import {
   extractPowerShellCommandInner,
 } from './shell-powershell.mjs';
 import { spawnShellWithRetry as _spawnShellWithRetry } from './lib/shell-spawn-retry.mjs';
+import { takeWarmShellStandby } from './lib/shell-warm-standby.mjs';
 
 export {
   _maybeEncodePowerShellCommand,
@@ -34,7 +35,7 @@ export {
 // renders a path marker instead of pasting the tail. Matches the
 // SHELL_OUTPUT_MAX_CHARS used by the smart-truncate renderer in
 // builtin.mjs so spilled output and inline output share the same boundary.
-import { SHELL_OUTPUT_INLINE_CAP, SHELL_OUTPUT_DISK_CAP, stripAnsi, treeKill, TaskOutput, ExecResult } from './shell-exec-output.mjs';
+import { SHELL_OUTPUT_INLINE_CAP, SHELL_OUTPUT_DISK_CAP, stripAnsi, treeKill, TaskOutput, ExecResult, ShellTextDecoder } from './shell-exec-output.mjs';
 export { stripAnsi, ExecResult } from './shell-exec-output.mjs';
 
 async function _execPolicyBlockMessage(command) {
@@ -199,6 +200,7 @@ export function execShellCommand({
   timeoutMs,
   abortSignal,
   autoBackgroundMs,
+  startInBackground = false,
   onProgress,
   onOutputTail,
   clientHostPid,
@@ -219,6 +221,8 @@ export function execShellCommand({
     };
     const taskId = `shell_${randomUUID().slice(0, 8)}`;
     const taskOutput = new TaskOutput(taskId);
+    const stdoutDecoder = new ShellTextDecoder();
+    const stderrDecoder = new ShellTextDecoder();
     let timedOut = false;
     let killed = false;
     let killCause = null;
@@ -340,11 +344,23 @@ export function execShellCommand({
         else pendingChildError = pendingChildError || err;
       };
       _onChildErrorRef = _onChildError;
+      // Warm-standby fast path (pwsh only): a pre-spawned bootstrap pwsh
+      // reads the script from stdin, skipping CreateProcess + Defender scan
+      // for this call. Any miss (env drift, TTL, dead/warming standby,
+      // MIXDOG_SHELL_WARM_STANDBY=0) falls through to the gated spawn below.
+      let _standby = null;
+      if (!_useDirectArgv && shellArg === '-Command') {
+        try { _standby = takeWarmShellStandby({ shell, env, cwd }); } catch { _standby = null; }
+      }
       // Spawn-burst gate: hold a 'process-spawn' slot only across process
       // creation (CreateProcess + AV scan + EPERM retries), released the
       // moment the child exists. Bounds the Defender convoy a shell burst
       // creates without limiting how many commands RUN concurrently — the
       // full-lifetime gating concern in the note below stays true.
+      let spawned = null;
+      if (_standby) {
+        spawned = _standby.spawned;
+      } else {
       const _releaseSpawnSlot = await acquireChildSpawnSlot(abortSignal || null, 'process-spawn', {
         ownerKey: ownerSessionId,
       });
@@ -355,7 +371,6 @@ export function execShellCommand({
         try { _releaseSpawnSlot(); } catch { /* idempotent */ }
         throw abortSignal.reason || new Error('aborted');
       }
-      let spawned;
       try {
         spawned = await _spawnShellWithRetry({
         shell,
@@ -366,6 +381,7 @@ export function execShellCommand({
         env,
         cwd,
         outputLimit: SHELL_OUTPUT_DISK_CAP,
+        rawOutput: true,
         // NOTE (child-spawn-gate): the full command lifetime is intentionally
         // NOT gated — bash/pwsh commands can run for minutes and would starve
         // rg/code_graph. Only the spawn window above holds a slot.
@@ -378,8 +394,12 @@ export function execShellCommand({
       } finally {
         try { _releaseSpawnSlot(); } catch { /* idempotent */ }
       }
+      }
       child = spawned.child;
       spawned.adoptErrorHandler(_onChildError);
+      // Feed the standby only after the error handler is attached; server
+      // messages cannot be processed before this synchronous block yields.
+      if (_standby) _standby.feed(_spawnCommand, cwd);
     } catch (err) {
       const cleanupError = await releaseResourceLease();
       const spawnText = String((err && err.message) || err);
@@ -412,21 +432,21 @@ export function execShellCommand({
     }
 
     const _stdoutData = (chunk) => {
-      taskOutput.writeStdout(chunk);
+      const text = stdoutDecoder.write(chunk);
+      if (text) taskOutput.writeStdout(text);
       if (taskOutput.binaryOutput && !settled && !autoBackgrounded) _treeKillForceSettle('binary-output');
       if (taskOutput.writeError && !settled && !autoBackgrounded) _treeKillForceSettle('output-capture-error');
     };
     const _stderrData = (chunk) => {
-      taskOutput.writeStderr(chunk);
+      const text = stderrDecoder.write(chunk);
+      if (text) taskOutput.writeStderr(text);
       if (taskOutput.binaryOutput && !settled && !autoBackgrounded) _treeKillForceSettle('binary-output');
       if (taskOutput.writeError && !settled && !autoBackgrounded) _treeKillForceSettle('output-capture-error');
     };
     if (child.stdout) {
-      child.stdout.setEncoding('utf-8');
       child.stdout.on('data', _stdoutData);
     }
     if (child.stderr) {
-      child.stderr.setEncoding('utf-8');
       child.stderr.on('data', _stderrData);
     }
 
@@ -443,6 +463,10 @@ export function execShellCommand({
         autoBgTimer = null;
       }
       detachAbortHandler();
+      const stdoutTail = stdoutDecoder.end();
+      const stderrTail = stderrDecoder.end();
+      if (stdoutTail) taskOutput.writeStdout(stdoutTail);
+      if (stderrTail) taskOutput.writeStderr(stderrTail);
       // getStdout/getStderr can throw on a spilled-file read failure (EBADF
       // after unlink race, EACCES). Without this catch the rejection bubbles
       // up and leaves the outer settle promise unresolved, hanging the call.
@@ -684,7 +708,9 @@ export function execShellCommand({
       const secs = Math.max(0, Math.round((Date.now() - _startMs) / 1000));
       const _verb = reason === 'timeout'
         ? `moved to background at timeout after ${secs}s`
-        : `auto-backgrounded after ${secs}s`;
+        : (reason === 'explicit'
+          ? 'started in background'
+          : `auto-backgrounded after ${secs}s`);
       resolveResult(
         new ExecResult({
           stdout,
@@ -795,7 +821,9 @@ export function execShellCommand({
     // Arm the auto-background timer only for the genuine foreground one-shot
     // path: a positive threshold strictly below the hard timeout, and not a
     // trailing-`&` background command (those already detach + settle on exit).
-    if (
+    if (startInBackground && !_isBackground) {
+      setImmediate(() => { fireAutoBackground({ reason: 'explicit' }); });
+    } else if (
       typeof autoBackgroundMs === 'number' &&
       autoBackgroundMs > 0 &&
       !_isBackground &&