mixdog 0.9.149 → 0.9.151

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -20,21 +20,32 @@ import {
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 const MAX_CAPTURE_BYTES = 128 * 1024 * 1024;
-const SUPPORTED = new Set([
-    'add', 'am', 'apply', 'archive', 'bisect', 'blame', 'branch', 'bundle',
-    'cat-file', 'check-attr', 'check-ignore', 'check-ref-format', 'checkout',
-    'cherry', 'cherry-pick', 'clean', 'clone', 'commit', 'config',
-    'count-objects', 'describe', 'diff', 'diff-files', 'diff-index', 'diff-tree',
-    'fetch', 'filter-branch', 'for-each-ref', 'format-patch', 'fsck', 'gc',
-    'grep', 'hash-object', 'help', 'init', 'log', 'ls-files', 'ls-remote',
-    'ls-tree', 'maintenance', 'merge', 'merge-base', 'merge-tree', 'mv',
-    'name-rev', 'notes', 'pack-refs', 'prune', 'pull', 'push', 'range-diff',
-    'rebase', 'reflog', 'remote', 'repack', 'replace', 'reset', 'restore',
-    'revert', 'rev-list', 'rev-parse', 'rm', 'shortlog', 'show', 'show-branch',
-    'show-ref', 'sparse-checkout', 'stash', 'status', 'submodule', 'switch',
-    'symbolic-ref', 'tag', 'update-ref', 'verify-commit', 'verify-pack',
-    'verify-tag', 'version', 'whatchanged', 'worktree', 'write-tree',
-]);
+const GIT_OUTPUT_LIMIT_MAX = 200;
+// git's subcommand namespace is open-ended: any `git-*` executable on PATH
+// (git-filter-repo, git-lfs, in-house wrappers) dispatches as a subcommand, so
+// a finite allowlist can never keep up. It rejected `git filter-repo` as an
+// "unsupported subcommand" while the shell tool still ran the very same
+// command unblocked — buying no safety and costing a whole turn. So nothing is
+// pre-rejected for being unknown: git itself reports a genuinely unknown
+// subcommand, and that error tells the model what to do next.
+//
+// Destructive history/tree rewrites stay allowed on purpose. They are usually
+// the actual job, reflog and loose objects make most of them recoverable, and
+// the workflow already gates destructive git work.
+//
+// What this tool genuinely cannot host is a command that never returns, since
+// each call occupies one synchronous turn. The classic hangs are already dead
+// via the pinned GIT_PAGER / GIT_EDITOR / GIT_SEQUENCE_EDITOR /
+// GIT_TERMINAL_PROMPT environment in runProcess, which leaves two shapes.
+//
+// A GUI subcommand blocks on a window or a stdin prompt that this process has
+// no way to satisfy.
+const GUI_OPERATIONS = new Set(['gui', 'citool', 'gitk', 'difftool', 'mergetool']);
+// A resident server's correct behaviour IS to keep running, so it can only
+// burn the full timeout here. It is not a bad command, just one in the wrong
+// tool: shell promotes a long-running process to a background task, so point
+// there instead of failing it outright.
+const SERVER_OPERATIONS = new Set(['daemon', 'instaweb']);
 // `git --version` / `git --help` are the standard availability probes and
 // arrive in global-flag position, not as subcommands. Map them onto their
 // subcommand form so the probe answers instead of erroring out.
@@ -63,12 +74,12 @@ export const GIT_TOOL_DEF = {
         openWorldHint: true,
         compressible: true,
     },
-    description: 'Run one Git command directly, without a shell. History, blame, and old commits are evidence only when the task itself is about the past; work on current code ends at status and diff. Use diff directly when changed content for a known target is required; status is the repository summary. Shell operators and substitution are rejected. Repository mutations are serialized. Successful output is compacted.',
+    description: 'Run one Git command directly, without a shell. Owns repository state, diffs, history, and mutations. Use diff for known targets; otherwise use status alone to discover targets. Shell operators and substitution are rejected. Repository mutations are serialized. Successful output is compacted.',
     inputSchema: {
         type: 'object',
         properties: {
             command: { type: 'string', description: 'Full command beginning with git. Quote arguments as for a shell; shell operators are not allowed.' },
-            output_limit: { type: 'integer', minimum: 1, maximum: 500, description: 'Item/line cap. Default 50; git log defaults to 10.' },
+            output_limit: { type: 'integer', minimum: 1, maximum: GIT_OUTPUT_LIMIT_MAX, description: 'Item/line cap. Default 50; git log defaults to 10.' },
         },
         required: ['command'],
         additionalProperties: false,
@@ -98,7 +109,7 @@ export const GIT_STAGE_TOOL_DEF = {
                 ],
                 description: 'Exact change ID or IDs to stage.',
             },
-            output_limit: { type: 'integer', minimum: 1, maximum: 500, description: 'Status line cap; default 50.' },
+            output_limit: { type: 'integer', minimum: 1, maximum: GIT_OUTPUT_LIMIT_MAX, description: 'Status line cap; default 50.' },
         },
         required: ['diff_id', 'change_ids'],
         additionalProperties: false,
@@ -196,7 +207,13 @@ function parseCommand(command, workDir) {
     }
     const rawOperation = String(tokens[index] || '').toLowerCase();
     const operation = OPERATION_ALIASES.get(rawOperation) ?? rawOperation;
-    if (!SUPPORTED.has(operation)) throw new Error(`unsupported git subcommand: ${rawOperation || '(missing)'}`);
+    if (!operation) throw new Error('git requires a subcommand');
+    if (GUI_OPERATIONS.has(operation)) {
+        throw new Error(`git ${operation} opens an interactive GUI and would never return here; use its non-interactive form (diff, merge, add -p)`);
+    }
+    if (SERVER_OPERATIONS.has(operation)) {
+        throw new Error(`git ${operation} is a long-running server; start it with the shell tool so it becomes a background task`);
+    }
     return { command: String(command), cwd, globalArgs, operation, args: tokens.slice(index + 1) };
 }
 
@@ -273,12 +290,22 @@ function commandFailure(plan, result, limit = 50) {
     // Bounded like every success path: an unbounded failure dump from a large
     // repository cost far more context than the diagnosis it carried.
     const max = Math.min(Math.max(limit, 20), 40);
-    return fail(reason, {
+    const detail = {
         exit: result.exitCode,
         signal: result.signal,
         stderr: failureText(result.stderr, max),
         stdout: failureText(result.stdout, max),
-    });
+    };
+    // Exit 128 is git's state/precondition verdict (identity unset, bare
+    // repository, dubious ownership, missing ref) and stderr carries git's
+    // own explanation — the ANSWER the caller acts on next. The error
+    // envelope pushed callers into shell fallbacks for ordinary repository
+    // state. Spawn errors, timeouts, aborts, overflow and usage exits (129)
+    // keep failure semantics.
+    if (result.exitCode === 128 && !result.error && !result.timedOut && !result.aborted && !result.overflow) {
+        return JSON.stringify({ ok: false, reason, ...detail });
+    }
+    return fail(reason, detail);
 }
 
 // Non-zero exits that ARE the answer rather than a failure: git reports
@@ -761,7 +788,7 @@ export async function executeGitStageTool(input, workDir, options = {}) {
             hint: 'Run git diff in the current Project and use its diff_id/change_ids.',
         });
     }
-    const limit = Math.min(500, Math.max(1, Number(input?.output_limit) || 50));
+    const limit = Math.min(GIT_OUTPUT_LIMIT_MAX, Math.max(1, Number(input?.output_limit) || 50));
     const signal = options?.signal || options?.abortSignal || null;
     const repo = snapshot.repo;
     return withGitRepoWriteLock(repo, () => withBuiltinPathLocks([repo], () => withAdvisoryLocks([repo], async () => {
@@ -815,7 +842,7 @@ export async function executeGitTool(input, workDir, options = {}) {
         return fail('git archive requires -o/--output; binary stdout is not returned');
     }
     const limitDefault = plan.operation === 'log' ? 10 : 50;
-    const limit = Math.min(500, Math.max(1, Number(input.output_limit) || limitDefault));
+    const limit = Math.min(GIT_OUTPUT_LIMIT_MAX, Math.max(1, Number(input.output_limit) || limitDefault));
     const signal = options?.signal || options?.abortSignal || null;
     if (plan.operation === 'init' || plan.operation === 'clone') {
         const target = creationTarget(plan);

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.test.mjs

@@ -187,17 +187,38 @@ test('git and deferred git_stage expose separate compact contracts', () => {
     assert.deepEqual(Object.keys(properties), ['command', 'output_limit']);
     assert.deepEqual(GIT_TOOL_DEF.inputSchema.required, ['command']);
     assert.equal(properties.command.minLength, undefined);
+    assert.equal(properties.output_limit.maximum, 200);
     const stageProperties = GIT_STAGE_TOOL_DEF.inputSchema.properties;
     assert.deepEqual(Object.keys(stageProperties), ['diff_id', 'change_ids', 'output_limit']);
     assert.deepEqual(GIT_STAGE_TOOL_DEF.inputSchema.required, ['diff_id', 'change_ids']);
     assert.equal(stageProperties.change_ids.anyOf[1].maxItems, 50);
+    assert.equal(stageProperties.output_limit.maximum, 200);
     assert.equal(GIT_STAGE_TOOL_DEF.annotations.destructiveHint, true);
     assert.doesNotMatch(GIT_TOOL_DEF.description, /confirm/i);
-    assert.match(GIT_TOOL_DEF.description, /Use diff directly when changed content for a known target is required/i);
+    assert.match(GIT_TOOL_DEF.description, /Owns repository state, diffs, history, and mutations/i);
+    assert.match(GIT_TOOL_DEF.description, /Use diff for known targets; otherwise use status alone to discover targets/i);
     assert.match(GIT_TOOL_DEF.description, /Run one Git command directly, without a shell/i);
     assert.match(GIT_TOOL_DEF.description, /repository mutations are serialized/i);
 });
 
+test('git clamps oversized output requests to 200 lines', async (t) => {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-git-output-cap-'));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const repo = join(root, 'repo');
+    parseOk(await executeGitTool({ command: `git init ${quote(repo)}` }, root));
+    parseOk(await git(repo, 'config user.name "Mixdog Test"'));
+    parseOk(await git(repo, 'config user.email mixdog@example.invalid'));
+    writeFileSync(
+        join(repo, 'large.txt'),
+        `${Array.from({ length: 250 }, (_, index) => `line-${index}`).join('\n')}\n`,
+    );
+    parseOk(await git(repo, 'add -- large.txt'));
+    parseOk(await git(repo, 'commit -m large'));
+    const shown = parseOk(await git(repo, 'show HEAD:large.txt', { output_limit: 500 }));
+    assert.equal(shown.lines.length, 200);
+    assert.equal(shown.omitted, 50);
+});
+
 // `git --version` is how a caller checks whether git exists at all; rejecting
 // it as an "unsupported subcommand" turned the probe into a dead turn.
 test('git availability probes answer instead of erroring', async (t) => {
@@ -208,6 +229,34 @@ test('git availability probes answer instead of erroring', async (t) => {
     assert.match(probe, /git version/i);
 });
 
+// git dispatches any `git-*` executable on PATH as a subcommand, so a finite
+// allowlist could only ever go stale. An unknown name must reach git itself —
+// whatever git answers is actionable, an "unsupported subcommand" refusal was
+// not, and the shell tool ran the same command anyway.
+test('git forwards unknown subcommands to git instead of pre-rejecting them', async (t) => {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-git-open-'));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const repo = join(root, 'repo');
+    parseOk(await executeGitTool({ command: `git init ${quote(repo)}` }, root));
+    for (const command of ['git filter-repo --version', 'git fast-export --help']) {
+        assert.doesNotMatch(String(await executeGitTool({ command }, repo)), /unsupported git subcommand/);
+    }
+});
+
+// The only commands this tool cannot host are the ones that never return: a
+// GUI blocks on a window nobody can click, and a resident server burns the
+// full timeout by working correctly. The server case is a routing hint, not a
+// verdict — shell can hold it as a background task.
+test('git refuses only non-returning subcommands and routes servers to shell', async (t) => {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-git-deny-'));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const repo = join(root, 'repo');
+    parseOk(await executeGitTool({ command: `git init ${quote(repo)}` }, root));
+    assert.match(String(await executeGitTool({ command: 'git mergetool' }, repo)), /interactive GUI/i);
+    assert.match(String(await executeGitTool({ command: 'git daemon --export-all' }, repo)), /shell tool/i);
+    assert.match(String(await executeGitTool({ command: 'git' }, repo)), /requires a subcommand/i);
+});
+
 test('git stages selected change IDs and rejects stale diff snapshots without touching the index', async (t) => {
     const root = mkdtempSync(join(tmpdir(), 'mixdog-git-stage-'));
     t.after(() => rmSync(root, { recursive: true, force: true }));

package/src/runtime/agent/orchestrator/tools/builtin/grep-output-budget.test.mjs

@@ -0,0 +1,31 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import { executeBuiltinTool } from '../builtin.mjs';
+
+test('grep rendered output is capped at 10 KiB', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'mixdog-grep-budget-'));
+    try {
+        const file = join(root, 'large.txt');
+        const body = Array.from(
+            { length: 400 },
+            (_, index) => `${index + 1} needle ${'x'.repeat(160)}`,
+        ).join('\n');
+        await writeFile(file, body);
+        const out = await executeBuiltinTool('grep', {
+            pattern: 'needle',
+            path: file,
+            mode: 'content',
+            limit: 250,
+            offset: 0,
+            context: 2,
+        }, root);
+        assert.ok(Buffer.byteLength(out, 'utf8') <= 10 * 1024);
+        assert.match(out, /\[grep output capped at 10240 bytes;/);
+    } finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});

package/src/runtime/agent/orchestrator/tools/builtin/grep-single-file-rescue.test.mjs

@@ -0,0 +1,106 @@
+// A file scope the shared native search server could not serve is answered by
+// reading that one file, so a starved queue costs a bounded wait instead of a
+// whole turn. The scanner declines whenever it cannot reproduce the request.
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import { runGrepSingleFileRescue } from './lib/grep-single-file-rescue.mjs';
+
+const STATUS = 'Name:\tnode\nUid:\t0\t0\t0\t0\nGid:\t0\t0\t0\t0\nCapEff:\t000001ffffffffff\n';
+
+function request(overrides) {
+    return {
+        caseInsensitive: false,
+        multilineMode: false,
+        onlyMatching: false,
+        fileType: null,
+        outputMode: 'content',
+        showLineNumbers: true,
+        withFilename: false,
+        filenameOmitted: true,
+        beforeN: 0,
+        afterN: 0,
+        contextN: 0,
+        headLimit: 250,
+        offset: 0,
+        patternCapNote: '',
+        globPatterns: [],
+        ...overrides,
+    };
+}
+
+async function withStatusFile(run) {
+    const root = await mkdtemp(join(tmpdir(), 'mixdog-grep-rescue-'));
+    try {
+        const file = join(root, 'status');
+        await writeFile(file, STATUS);
+        return await run({ root, file });
+    } finally {
+        await rm(root, { recursive: true, force: true });
+    }
+}
+
+test('a missed file scope is scanned directly and reports the same matches', async () => {
+    await withStatusFile(async ({ root, file }) => {
+        const out = await runGrepSingleFileRescue(request({
+            filePath: file,
+            searchPath: file,
+            grepResolvedPath: file,
+            workDir: root,
+            patterns: ['^(Uid|Gid|Cap(Inh|Prm|Eff|Bnd|Amb))'],
+        }));
+        assert.match(out, /2:Uid:/);
+        assert.match(out, /3:Gid:/);
+        assert.match(out, /4:CapEff:/);
+        assert.doesNotMatch(out, /Name:/);
+        assert.match(out, /scanned directly/);
+    });
+});
+
+test('counts and no-match answers keep the ordinary grep shapes', async () => {
+    await withStatusFile(async ({ root, file }) => {
+        const counted = await runGrepSingleFileRescue(request({
+            filePath: file,
+            searchPath: file,
+            grepResolvedPath: file,
+            workDir: root,
+            outputMode: 'count',
+            patterns: ['^(Uid|Gid)'],
+        }));
+        assert.match(counted, /\b2\b/);
+
+        const empty = await runGrepSingleFileRescue(request({
+            filePath: file,
+            searchPath: file,
+            grepResolvedPath: file,
+            workDir: root,
+            patterns: ['NoSuchFieldHere'],
+        }));
+        assert.match(empty, /\(no matches\)/);
+    });
+});
+
+test('a request the scanner cannot reproduce declines instead of guessing', async () => {
+    await withStatusFile(async ({ root, file }) => {
+        const base = {
+            filePath: file,
+            searchPath: file,
+            grepResolvedPath: file,
+            workDir: root,
+        };
+        // Regex JS cannot compile: the caller keeps the native error.
+        assert.equal(await runGrepSingleFileRescue(request({
+            ...base,
+            patterns: ['a{2,1}'],
+        })), null);
+        // Multiline matching spans lines; this scanner is line-oriented.
+        assert.equal(await runGrepSingleFileRescue(request({
+            ...base,
+            patterns: ['Uid'],
+            multilineMode: true,
+        })), null);
+    });
+});

package/src/runtime/agent/orchestrator/tools/builtin/lib/absolute-glob-expand.mjs

@@ -0,0 +1,129 @@
+// Direct filesystem expansion for an ABSOLUTE glob pattern.
+//
+// The inventory walker never follows a symlinked directory — the right call on
+// a project tree, where following them means cycles and duplicated subtrees.
+// But a virtual filesystem is built almost entirely out of symlinks:
+// /sys/block/sda is a link into /sys/devices, and /sys/block/sda/device is
+// another one. A pattern like /sys/block/sd*/size therefore enumerates NOTHING
+// through the walker, and the caller is told the path does not exist while it
+// plainly does.
+//
+// The pattern itself is the bound here: only segments that match are descended,
+// one readdir per surviving directory, no recursive `**`, plus a candidate cap
+// and a wall-clock deadline. Returns the matches (possibly empty), or null when
+// the pattern is not expandable this way and the caller should keep its own
+// answer.
+import { readdir, stat } from 'node:fs/promises';
+import { isAbsolute, join, parse } from 'node:path';
+
+import { hasGlobMagic, normalizeOutputPath } from '../path-utils.mjs';
+
+const DEFAULT_DEADLINE_MS = 1_500;
+const DEFAULT_CANDIDATE_CAP = 200;
+
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/** One path SEGMENT's matcher, or null when the segment uses a construct this
+ *  expander will not approximate. */
+function segmentMatcher(segment) {
+    if (segment.includes('**')) return null;
+    let source = '';
+    for (let index = 0; index < segment.length; index += 1) {
+        const char = segment[index];
+        if (char === '*') { source += '[^/]*'; continue; }
+        if (char === '?') { source += '[^/]'; continue; }
+        if (char === '[') {
+            const end = segment.indexOf(']', index + 1);
+            if (end < 0) return null;
+            source += segment.slice(index, end + 1);
+            index = end;
+            continue;
+        }
+        if (char === '{') {
+            const end = segment.indexOf('}', index + 1);
+            if (end < 0) return null;
+            const alternatives = segment.slice(index + 1, end).split(',').map(escapeRegExp);
+            source += `(?:${alternatives.join('|')})`;
+            index = end;
+            continue;
+        }
+        source += escapeRegExp(char);
+    }
+    try {
+        return new RegExp(`^${source}$`, process.platform === 'win32' ? 'i' : '');
+    } catch {
+        return null;
+    }
+}
+
+export async function expandAbsoluteGlob(pattern, {
+    limit = 25,
+    deadlineMs = DEFAULT_DEADLINE_MS,
+    candidateCap = DEFAULT_CANDIDATE_CAP,
+} = {}) {
+    const raw = String(pattern || '').replace(/\\/g, '/');
+    if (!raw || !isAbsolute(raw) || !hasGlobMagic(raw)) return null;
+    const root = parse(raw).root;
+    if (!root) return null;
+    const segments = raw.slice(root.length).split('/').filter(Boolean);
+    if (segments.length === 0) return null;
+    const stopAt = Date.now() + Math.max(1, deadlineMs);
+
+    let current = [root];
+    for (const segment of segments) {
+        if (Date.now() >= stopAt) return null;
+        if (!hasGlobMagic(segment)) {
+            current = current.map((dir) => join(dir, segment));
+            continue;
+        }
+        const matcher = segmentMatcher(segment);
+        if (!matcher) return null;
+        const next = [];
+        for (const dir of current) {
+            if (next.length >= candidateCap || Date.now() >= stopAt) break;
+            let entries;
+            try { entries = await readdir(dir); } catch { continue; }
+            for (const name of entries) {
+                if (!matcher.test(name)) continue;
+                next.push(join(dir, name));
+                if (next.length >= candidateCap) break;
+            }
+        }
+        current = next;
+        if (current.length === 0) return [];
+    }
+
+    // stat (not lstat) so a symlinked target counts as the file/dir it names —
+    // that is the whole point of expanding these scopes.
+    const found = [];
+    for (const candidate of current) {
+        if (found.length >= limit || Date.now() >= stopAt) break;
+        try {
+            const info = await stat(candidate);
+            if (info.isFile() || info.isDirectory()) found.push(normalizeOutputPath(candidate));
+        } catch { /* a pattern match that cannot be stat'ed is not a result */ }
+    }
+    return found;
+}
+
+/** Expand every absolute pattern in a list; returns deduped matches in order. */
+export async function expandAbsoluteGlobs(patterns, options = {}) {
+    const list = (Array.isArray(patterns) ? patterns : [patterns]).filter(
+        (value) => typeof value === 'string' && value,
+    );
+    const seen = new Set();
+    const out = [];
+    for (const pattern of list) {
+        if (out.length >= (options.limit ?? 25)) break;
+        const matches = await expandAbsoluteGlob(pattern, options);
+        if (!matches) continue;
+        for (const match of matches) {
+            if (seen.has(match)) continue;
+            seen.add(match);
+            out.push(match);
+        }
+    }
+    return out;
+}

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-context-expander.mjs

@@ -12,11 +12,12 @@ import {
 import {
     relativePathPrefix,
 } from '../search-path-diagnostics.mjs';
+import { GREP_OUTPUT_MAX_BYTES } from '../tool-output-limit.mjs';
 import {
     relativeGrepLine,
 } from './search-input-helpers.mjs';
 
-export const GREP_CONTEXT_CHAR_BUDGET_DEFAULT = 5_000;
+export const GREP_CONTEXT_CHAR_BUDGET_DEFAULT = GREP_OUTPUT_MAX_BYTES;
 const GREP_FOCUSED_CONTEXT_RADIUS = 12;
 const GREP_FOCUSED_RAW_BLOCKS = 3;
 // Anchors must stay usable as evidence without a follow-up read: keep the