mixdog 0.9.149 → 0.9.151

package/src/runtime/agent/orchestrator/tools/builtin/search-path-diagnostics.mjs

@@ -4,7 +4,7 @@
  * thin executor; search-tool.mjs re-exports these for unchanged importers.
  */
 import { statSync } from 'fs';
-import { basename, isAbsolute, join, resolve } from 'path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'path';
 import { findBySuffixStrip, findDirectoryByBasename, findFileByBasename, listSiblings } from './path-diagnostics.mjs';
 import { normalizeOutputPath, resolveAgainstCwd } from './path-utils.mjs';
 
@@ -18,6 +18,9 @@ import { normalizeOutputPath, resolveAgainstCwd } from './path-utils.mjs';
 // indexed file exists or the glob child is unavailable.
 export async function _suggestIndexedPaths(missingPath, executeChildBuiltinTool, workDir) {
     if (typeof executeChildBuiltinTool !== 'function') return '';
+    // An outside path has no indexed twin worth proposing; the project-wide
+    // glob would only spend the turn.
+    if (missingPathIsOutsideProject(workDir, missingPath)) return '';
     const base = String(missingPath).replace(/\\/g, '/').split('/').pop();
     // Skip when there is no usable basename or it carries glob magic (the
     // pattern, not a literal filename, would not map to a real file).
@@ -90,6 +93,50 @@ function cachedFileByBasename(workDir, missingPath, cache) {
     return cache.fileHits;
 }
 
+// A missing ABSOLUTE path that resolves outside the project cannot be
+// corrected by anything inside it: `/sys/block/sd*/size` is not a misplaced
+// project file, and scanning the tree for a file named `size` only spends the
+// turn (measured: three such reads burned 17.5s each and left the shared
+// search server saturated for the calls behind them). The honest recovery for
+// an outside path is its own filesystem: name the nearest directory that does
+// exist and what it holds.
+function missingPathIsOutsideProject(workDir, missingPath) {
+    const raw = String(missingPath || '');
+    if (!raw || !isAbsolute(raw)) return false;
+    if (typeof workDir !== 'string' || !workDir) return false;
+    const rel = relative(resolve(workDir), resolve(raw));
+    return !rel || rel === '..' || rel.startsWith(`..${sep}`) || rel.startsWith('../') || isAbsolute(rel);
+}
+
+function nearestExistingRealParent(missingPath) {
+    try {
+        let dir = dirname(resolve(String(missingPath)));
+        for (let depth = 0; depth < 24; depth += 1) {
+            try {
+                if (statSync(dir).isDirectory()) return dir;
+            } catch { /* keep climbing */ }
+            const parent = dirname(dir);
+            if (!parent || parent === dir) break;
+            dir = parent;
+        }
+    } catch { /* fall through */ }
+    return null;
+}
+
+function outsideProjectNotFoundHint(missingPath, actionVerb) {
+    const parent = nearestExistingRealParent(missingPath);
+    if (!parent) return ' Not found, and no parent directory of it exists either.';
+    const entries = listSiblings(parent, 12).slice(0, 5);
+    const where = `"${normalizeOutputPath(parent)}"`;
+    if (entries.length === 0) {
+        return ` Not found; ${where} exists but is empty — nothing under it to ${actionVerb.toLowerCase()}.`;
+    }
+    const magic = /[*?[\]{}]/.test(String(missingPath))
+        ? ' The path carries a glob pattern; name one of those entries directly.'
+        : '';
+    return ` Not found; the nearest existing directory ${where} holds: ${entries.map((n) => `"${n}"`).join(', ')}.${magic}`;
+}
+
 function isDirectoryPathGuess(missingPath) {
     const base = basename(String(missingPath || '').replace(/\\/g, '/'));
     if (!base || /[*?[\]{}]/.test(base)) return false;
@@ -137,6 +184,9 @@ export function finalizeReadFamilyEnoentTail(hint, requestedPath, errCode = 'ENO
 
 function resolveUniqueEnoentRedirect(workDir, missingPath, errCode = 'ENOENT', cache = null) {
     if (!NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return null;
+    // Redirecting an outside path INTO the project would answer a different
+    // question than the one asked.
+    if (missingPathIsOutsideProject(workDir, missingPath)) return null;
     const suffixHit = cachedSuffixStrip(workDir, missingPath, cache);
     if (suffixHit) return suffixHit;
     const elsewhere = cachedFileByBasename(workDir, missingPath, cache);
@@ -183,6 +233,9 @@ export function buildNotFoundHint(workDir, missingPath, actionVerb, errCode = 'E
     if (/^[A-Za-z]:(?![\\/])[^\\/]/.test(rawMissing.replace(/\\/g, '\\'))) {
         return ` The path has a drive letter but no separator after it — the backslashes were probably lost in escaping. Re-issue with forward slashes (e.g. "C:/tmp/smp").`;
     }
+    if (missingPathIsOutsideProject(workDir, missingPath)) {
+        return outsideProjectNotFoundHint(missingPath, actionVerb);
+    }
     if (resolveUniqueEnoentRedirect(workDir, missingPath, errCode, cache)) return '';
     const elsewhere = cachedFileByBasename(workDir, missingPath, cache);
     if (elsewhere.length) {

package/src/runtime/agent/orchestrator/tools/builtin/task-tool.mjs

@@ -20,6 +20,7 @@ import {
     TASK_WAIT_TIMEOUT_MIN_MS,
 } from './builtin-tools.mjs';
 import { getAbortSignalForSession } from '../../session/abort-lookup.mjs';
+import { beginInterruptibleTaskWait } from '../../session/task-wait-control.mjs';
 import {
     acknowledgeBackgroundTaskCompletion,
     cancelBackgroundTask,
@@ -160,39 +161,63 @@ export async function executeTaskTool(args, options = {}) {
     const isShellTask = task.surface === 'shell';
 
     if (action === 'read' || action === 'wait') {
+        let waitInterruptedByUser = false;
         if (action === 'wait') {
             if (!isShellTask) return `Error: task wait is only available for shell tasks: ${taskId}`;
             // The turn's abort signal must cut the wait short; a cancelled turn
             // cannot sit out the remaining ceiling.
-            let waitSignal = null;
-            try { waitSignal = (await getAbortSignalForSession(options?.sessionId)) || null; }
-            catch { waitSignal = null; }
+            let turnSignal = null;
+            try { turnSignal = (await getAbortSignalForSession(options?.sessionId)) || null; }
+            catch { turnSignal = null; }
+            const waitControl = beginInterruptibleTaskWait(options?.sessionId, turnSignal);
+            const waitSignal = waitControl.signal;
             const waitTimeoutMs = resolveTaskWaitTimeoutMs(args.timeout_ms);
-            // A shell task whose descendants outlived the shell process has no
-            // native job to subscribe to — the process it belonged to is gone.
-            // Its registry promise (resolved by the descendant observer) is the
-            // completion event in that case.
-            if (!peekShellJob(taskId) && task.status === 'running' && task.promise) {
-                await new Promise((resolve) => {
-                    const timer = setTimeout(resolve, waitTimeoutMs);
-                    timer.unref?.();
-                    const done = () => { clearTimeout(timer); resolve(); };
-                    task.promise.then(done, done);
-                    if (waitSignal) {
-                        if (waitSignal.aborted) done();
-                        else waitSignal.addEventListener('abort', done, { once: true });
-                    }
-                });
-            } else {
-                await waitForShellJob(taskId, {
-                    timeoutMs: waitTimeoutMs,
-                    signal: waitSignal,
-                });
+            try {
+                // A shell task whose descendants outlived the shell process has no
+                // native job to subscribe to — the process it belonged to is gone.
+                // Its registry promise (resolved by the descendant observer) is the
+                // completion event in that case.
+                if (!peekShellJob(taskId) && task.status === 'running' && task.promise) {
+                    await new Promise((resolve) => {
+                        const timer = setTimeout(resolve, waitTimeoutMs);
+                        timer.unref?.();
+                        const done = () => {
+                            clearTimeout(timer);
+                            if (waitSignal) {
+                                try { waitSignal.removeEventListener('abort', done); } catch {}
+                            }
+                            resolve();
+                        };
+                        task.promise.then(done, done);
+                        if (waitSignal) {
+                            if (waitSignal.aborted) done();
+                            else waitSignal.addEventListener('abort', done, { once: true });
+                        }
+                    });
+                } else {
+                    await waitForShellJob(taskId, {
+                        timeoutMs: waitTimeoutMs,
+                        signal: waitSignal,
+                    });
+                }
+            } finally {
+                waitInterruptedByUser = waitControl.interruptedByUser;
+                waitControl.dispose();
             }
         }
         if (isShellTask) refreshShellTask(taskId, { includeRunning: true });
         const latest = getBackgroundTask(taskId, { context: options }) || task;
-        const rendered = renderBackgroundTask(latest, { includeResult: true });
+        let rendered = renderBackgroundTask(latest, { includeResult: true });
+        if (action === 'wait' && latest.status === 'running') {
+            if (waitInterruptedByUser) {
+                rendered += '\n\nWait interrupted by new user input; task still running. Handle the new message now and call task wait again only when its result is needed.';
+            } else {
+                // In-band report cue: the static "periodic reports" rule does not
+                // survive a long tool loop, so a ceiling-hit wait carries the
+                // protocol reminder itself.
+                rendered += '\n\nWait ceiling reached; task still running. If periodic reports were requested, write the user-facing report now, then call task wait for the next interval; otherwise continue independent work or end the turn.';
+            }
+        }
         if (acknowledgeBackgroundTaskCompletion(taskId, { context: options })) {
             recordDeliveredCompletion({ executionId: taskId });
         }

package/src/runtime/agent/orchestrator/tools/builtin/tool-output-limit.mjs

@@ -9,6 +9,7 @@ function _envInt(name, fallback) {
 }
 export const TOOL_OUTPUT_MAX_BYTES = _envInt('MIXDOG_TOOL_OUTPUT_MAX_BYTES', 50 * 1024);
 export const LOCATOR_OUTPUT_MAX_BYTES = _envInt('MIXDOG_LOCATOR_OUTPUT_MAX_BYTES', 20 * 1024);
+export const GREP_OUTPUT_MAX_BYTES = _envInt('MIXDOG_GREP_OUTPUT_MAX_BYTES', 10 * 1024);
 export const CODE_GRAPH_OUTPUT_MAX_BYTES = _envInt('MIXDOG_CODE_GRAPH_OUTPUT_MAX_BYTES', 30 * 1024);
 // recall/memory search returns model-facing prose blocks; uncapped multi-query
 // browses were observed injecting 42KB in one call (2026-08-05 audit). Same

package/src/runtime/agent/orchestrator/tools/builtin/write-symlink.test.mjs

@@ -0,0 +1,153 @@
+// Writing through a symlink must land on the file the link points at and leave
+// the link in place. The atomic rename would otherwise replace the link with a
+// regular file and silently detach layouts like nginx's sites-enabled/default
+// from sites-available/default.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    lstatSync,
+    mkdtempSync,
+    readFileSync,
+    realpathSync,
+    rmSync,
+    statSync,
+    symlinkSync,
+    writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { atomicWrite, symlinkWriteTarget } from './atomic-write.mjs';
+import { tryExecuteExternalToolAdapter } from './external-tool-adapters.mjs';
+
+function makeDir() {
+    return mkdtempSync(join(tmpdir(), 'mixdog-write-symlink-'));
+}
+
+// Windows without Developer Mode / admin rights refuses symlink creation
+// (EPERM), so the host capability decides whether these cases can run.
+function symlinkSupported(dir) {
+    try {
+        writeFileSync(join(dir, 'probe.txt'), 'x');
+        symlinkSync(join(dir, 'probe.txt'), join(dir, 'probe.link'));
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+test('symlinkWriteTarget resolves a live link and nothing else', (t) => {
+    const dir = makeDir();
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    const real = join(dir, 'real.txt');
+    const link = join(dir, 'link.txt');
+    writeFileSync(real, 'a\n');
+    symlinkSync(real, link);
+
+    assert.equal(symlinkWriteTarget(link), realpathSync(real));
+    assert.equal(symlinkWriteTarget(real), null);
+    assert.equal(symlinkWriteTarget(join(dir, 'missing.txt')), null);
+    // A dangling link has no target to resolve, so the caller keeps its path.
+    const dangling = join(dir, 'dangling.link');
+    symlinkSync(join(dir, 'gone.txt'), dangling);
+    assert.equal(symlinkWriteTarget(dangling), null);
+});
+
+test('atomicWrite writes through a symlink and keeps the link', async (t) => {
+    const dir = makeDir();
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    const real = join(dir, 'real.conf');
+    const link = join(dir, 'link.conf');
+    writeFileSync(real, 'old\n');
+    symlinkSync(real, link);
+
+    await atomicWrite(link, 'new\n');
+
+    assert.equal(readFileSync(real, 'utf8'), 'new\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});
+
+test('the expected-target guard still fires when the real file moved', async (t) => {
+    const dir = makeDir();
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    const real = join(dir, 'guard.conf');
+    const link = join(dir, 'guard.link');
+    writeFileSync(real, 'old\n');
+    symlinkSync(real, link);
+    const before = statSync(link);
+
+    // Somebody else rewrites the real file after the snapshot was taken.
+    writeFileSync(real, 'rewritten by another writer\n');
+
+    await assert.rejects(
+        () => atomicWrite(link, 'mine\n', {
+            expectedTargetSnapshot: {
+                exists: true,
+                size: before.size,
+                mtimeMs: before.mtimeMs,
+                ctimeMs: before.ctimeMs,
+                ino: before.ino,
+            },
+        }),
+        (err) => err?.code === 'ESTALE_TARGET',
+    );
+    assert.equal(readFileSync(real, 'utf8'), 'rewritten by another writer\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});
+
+test('edit updates through a symlink and keeps the link', async (t) => {
+    const dir = makeDir();
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    const real = join(dir, 'sites-available.conf');
+    const link = join(dir, 'sites-enabled.conf');
+    writeFileSync(real, 'root /var/www/html;\nindex index.html;\n');
+    symlinkSync(real, link);
+
+    const result = String(await tryExecuteExternalToolAdapter('edit', {
+        file_path: link,
+        old_string: 'root /var/www/html;',
+        new_string: 'root /usr/share/novnc;',
+    }, dir, {}));
+
+    assert.match(result, /^Updated /);
+    assert.equal(readFileSync(real, 'utf8'), 'root /usr/share/novnc;\nindex index.html;\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});
+
+test('write replaces content through a symlink and keeps the link', async (t) => {
+    const dir = makeDir();
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    const real = join(dir, 'payload.txt');
+    const link = join(dir, 'payload.link');
+    writeFileSync(real, 'old\n');
+    symlinkSync(real, link);
+
+    const result = String(await tryExecuteExternalToolAdapter('write', {
+        file_path: link,
+        contents: 'fresh\n',
+    }, dir, {}));
+
+    assert.match(result, /^Updated /);
+    assert.equal(readFileSync(real, 'utf8'), 'fresh\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});

package/src/runtime/agent/orchestrator/tools/builtin.mjs

@@ -75,6 +75,7 @@ import {
     READ_STREAM_RANGE_MIN_BYTES,
 } from './builtin/read-constants.mjs';
 import {
+    GREP_OUTPUT_MAX_BYTES,
     LOCATOR_OUTPUT_MAX_BYTES,
     capLineOrientedToolOutput,
 } from './builtin/tool-output-limit.mjs';
@@ -495,7 +496,16 @@ export async function executeBuiltinTool(name, args, cwd, options = {}) {
     const _locatorCap = _explicitCap
         ? Math.min(_explicitCap, LOCATOR_OUTPUT_MAX_BYTES)
         : LOCATOR_OUTPUT_MAX_BYTES;
-    const _budgetedResult = _LOCATOR_BUDGET_TOOLS.has(toolName)
+    const _grepCap = _explicitCap
+        ? Math.min(_explicitCap, GREP_OUTPUT_MAX_BYTES)
+        : GREP_OUTPUT_MAX_BYTES;
+    const _budgetedResult = toolName === 'grep'
+        ? capLineOrientedToolOutput(
+            _withNotices,
+            _grepCap,
+            (kept) => `[grep output capped at ${_grepCap} bytes; ${kept.length} line(s) shown, remainder omitted]`,
+        )
+        : _LOCATOR_BUDGET_TOOLS.has(toolName)
         ? capLineOrientedToolOutput(
             _withNotices,
             _locatorCap,

package/src/runtime/agent/orchestrator/tools/code-graph/aggregate-anchor-relocation.test.mjs

@@ -0,0 +1,55 @@
+// A sentinel-free cwd that HOLDS one project answers an anchored call by
+// adopting that project; a genuinely ambiguous tree still refuses, but names
+// where to anchor instead.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+import { executeCodeGraphTool } from './dispatch.mjs';
+
+const PY = 'class Mean:\n    def compute(self):\n        return 42\n';
+
+function makeRepo(root, name) {
+    const repo = join(root, name);
+    mkdirSync(join(repo, '.git'), { recursive: true });
+    mkdirSync(join(repo, 'tools'), { recursive: true });
+    writeFileSync(join(repo, 'tools', 'compute_mean.py'), PY);
+    return repo;
+}
+
+test('a relative anchor held by exactly one child project adopts that project', async (t) => {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-anchor-one-'));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    makeRepo(root, 'caffe');
+
+    const out = String(await executeCodeGraphTool(
+        'code_graph',
+        { mode: 'symbols', files: 'tools/compute_mean.py' },
+        root,
+    ));
+    assert.doesNotMatch(out, /Refusing to index an arbitrary tree/);
+    assert.match(out, /compute/);
+});
+
+test('two child projects holding the same anchor stay refused, with the roots named', async (t) => {
+    const root = mkdtempSync(join(tmpdir(), 'mixdog-anchor-many-'));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    makeRepo(root, 'caffe');
+    makeRepo(root, 'caffe-fork');
+
+    let message = '';
+    try {
+        await executeCodeGraphTool(
+            'code_graph',
+            { mode: 'symbols', files: 'tools/compute_mean.py' },
+            root,
+        );
+    } catch (error) {
+        message = String(error?.message || error);
+    }
+    assert.match(message, /Refusing to index an arbitrary tree/);
+    assert.match(message, /Project roots under this cwd/);
+    assert.match(message, /"caffe"/);
+});

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch.mjs

@@ -365,6 +365,47 @@ function _boundedExactFileAggregateRoot(args, baseCwd) {
   return roots.size === 1 ? [...roots][0] : null;
 }
 
+// A sentinel-free working directory that HOLDS a project (a container's /app
+// with one cloned repo under it) answered every anchored call with a refusal:
+// the caller wrote the anchor the way the repo's own docs do
+// (`tools/compute_image_mean.cpp`), it does not exist under /app, and no root
+// could be derived from a path that resolves nowhere. The relative anchor is
+// still unambiguous whenever exactly ONE child project holds it — that project
+// is the answer, and adopting it is the same recovery read and grep already
+// perform for a misplaced path. Ambiguity (several holders, none, an absolute
+// anchor, a wildcard) keeps refusing.
+function _relocateAggregateAnchorsUnderChildProject(args, baseCwd) {
+  if (!_hasAggregateFileArgs(args)) return null;
+  const files = _collectGraphFileList(args);
+  if (files.length === 0) return null;
+  for (const file of files) {
+    if (_AGGREGATE_FILE_WILDCARD_RE.test(file) || isAbsolute(file)) return null;
+    if (existsSync(pathResolve(baseCwd, file))) return null;
+  }
+  const holders = _childProjectRoots(baseCwd, { cap: 8 })
+    .filter((root) => pathResolve(root) !== pathResolve(baseCwd))
+    .filter((root) => files.every((file) => {
+      try {
+        return statSync(pathResolve(root, file)).isFile();
+      } catch {
+        return false;
+      }
+    }));
+  if (holders.length !== 1) return null;
+  const root = pathResolve(holders[0]);
+  const remap = (file) => pathResolve(root, String(file || '').trim());
+  return {
+    root,
+    args: {
+      ...args,
+      file: typeof args?.file === 'string' && args.file.trim() ? remap(args.file) : args?.file,
+      files: Array.isArray(args?.files)
+        ? args.files.map(remap)
+        : (typeof args?.files === 'string' && args.files.trim() ? remap(args.files) : args?.files),
+    },
+  };
+}
+
 export function _resolveBoundedSentinelFreeAggregateRootForTest(args, baseCwd) {
   if (!_hasAggregateFileArgs(args)) return null;
   const base = pathResolve(baseCwd);
@@ -1045,13 +1086,23 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
       stopAtUserBoundary: !explicitCwdArg,
     }) || _resolveBoundedSentinelFreeAggregateRootForTest(args, baseCwd)
       || _boundedExactFileAggregateRoot(args, baseCwd);
-    if (!aggregateRoot) {
+    const relocated = aggregateRoot ? null : _relocateAggregateAnchorsUnderChildProject(args, baseCwd);
+    if (!aggregateRoot && !relocated) {
+      // Name the projects that DO sit under this cwd: the refusal is only
+      // actionable if the caller learns where to anchor instead.
+      const candidates = _childProjectRoots(baseCwd, { cap: 5 })
+        .filter((root) => pathResolve(root) !== pathResolve(baseCwd))
+        .map((root) => `"${pathBasename(root)}"`);
       throw new Error(
         `${name}: cwd '${baseCwd}' is not inside a project and aggregate file anchors do not all `
-        + `exist under exactly one detectable project root. Refusing to index an arbitrary tree.`,
+        + `exist under exactly one detectable project root. Refusing to index an arbitrary tree.`
+        + (candidates.length
+          ? ` Project roots under this cwd: ${candidates.join(', ')} — anchor the call inside one of them.`
+          : ''),
       );
     }
-    effectiveCwd = aggregateRoot;
+    effectiveCwd = relocated ? relocated.root : aggregateRoot;
+    if (relocated) args = relocated.args;
     args = _absolutizeAggregateFileArgs(args, baseCwd);
   }
   if (fileArg && !hasAggregateFileArgs) {

package/src/runtime/agent/orchestrator/tools/env-scrub.mjs

@@ -135,5 +135,21 @@ export function scrubRuntimeRootVars(env) {
     delete env.MIXDOG_WORKER_MODE;
     delete env.MIXDOG_DAEMON_SPAWNED_FOR;
     delete env.MIXDOG_SUPERVISOR_PID;
+    // Same identity family as MIXDOG_SUPERVISOR_PID above, and the last one
+    // missing: MIXDOG_SERVER_PID is the DAEMON's own pid. A child that
+    // inherits it advertises the daemon as its server in active-instance.json,
+    // so the liveness/staleness checks in runtime-paths.mjs judge an unrelated
+    // process. Internal forks blank or re-set it explicitly after this
+    // boundary (see memory-runtime-proxy.mjs).
+    delete env.MIXDOG_SERVER_PID;
+    // Electron execution-MODE leak: a packaged desktop/daemon host runs its
+    // node entrypoints with ELECTRON_RUN_AS_NODE=1. Inherited by a child, it
+    // silently converts every Electron app that child launches into a bare
+    // node interpreter — Unity Hub, VS Code, Slack and friends stop booting
+    // their own CLI and hand the argv to node instead, which eats a leading
+    // `--` as its end-of-options marker and rejects app flags as bad node
+    // options. Internal daemon/worker forks that genuinely need node mode set
+    // this explicitly after the boundary and are unaffected.
+    delete env.ELECTRON_RUN_AS_NODE;
     return env;
 }

package/src/runtime/agent/orchestrator/tools/env-scrub.test.mjs

@@ -1,7 +1,7 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 
-import { applyShellEgressPolicy } from './env-scrub.mjs';
+import { applyShellEgressPolicy, scrubRuntimeRootVars } from './env-scrub.mjs';
 
 test('web-search disabled preserves ordinary shell network environment', () => {
     const previous = process.env.MIXDOG_FEATURE_WEB_SEARCH;
@@ -23,3 +23,35 @@ test('web-search disabled preserves ordinary shell network environment', () => {
         else process.env.MIXDOG_FEATURE_WEB_SEARCH = previous;
     }
 });
+
+test('spawned children never inherit the Electron execution-mode switch', () => {
+    // ELECTRON_RUN_AS_NODE=1 turns any Electron app the child launches into a
+    // bare node interpreter, which swallows a leading `--` as its
+    // end-of-options marker and rejects the app's own CLI flags.
+    const env = {
+        ELECTRON_RUN_AS_NODE: '1',
+        PATH: '/usr/bin',
+        MIXDOG_DATA_DIR: '/home/u/.mixdog/data',
+    };
+    scrubRuntimeRootVars(env);
+    assert.equal(env.ELECTRON_RUN_AS_NODE, undefined);
+    // The child still needs to locate its tools and user data.
+    assert.equal(env.PATH, '/usr/bin');
+    assert.equal(env.MIXDOG_DATA_DIR, '/home/u/.mixdog/data');
+});
+
+test('runtime-root scrub clears host identity and leaves user environment intact', () => {
+    const env = {
+        MIXDOG_ROOT: '/app/resources/runtime.asar',
+        NODE_ENV: 'production',
+        MIXDOG_DAEMON_HOST: '1',
+        MIXDOG_WORKER_MODE: '1',
+        MIXDOG_DAEMON_SPAWNED_FOR: 'session',
+        MIXDOG_SUPERVISOR_PID: '4242',
+        MIXDOG_SERVER_PID: '74976',
+        ELECTRON_RUN_AS_NODE: '1',
+        HOME: '/home/u',
+    };
+    assert.equal(scrubRuntimeRootVars(env), env);
+    assert.deepEqual(env, { HOME: '/home/u' });
+});

package/src/runtime/agent/orchestrator/tools/graph-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.1.19",
+  "version": "0.1.20",
   "_comment": "Synced from immutable graph-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.19/mixdog-graph-darwin-arm64",
-      "sha256": "7829ad6e428f090843907fd76c2e7b45b9c2314f706776614004fe6715a09313"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.20/mixdog-graph-darwin-arm64",
+      "sha256": "d059f2ab33cb7f97b7c96b4e21e3d16880cc44baf1400ce81374a1031a11ddd9"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.19/mixdog-graph-darwin-x64",
-      "sha256": "84d43ad67fda7399d633d93e51438a01ed817137153e9c6ecb8f911e255b235e"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.20/mixdog-graph-darwin-x64",
+      "sha256": "c91873322ce6390a7103daa4b872e31de1abbe7e922967727f41b5b7b2f21373"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.19/mixdog-graph-linux-arm64",
-      "sha256": "9a0590415b40e90723653205f9476210d031216edff6225b1391a7f350900a12"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.20/mixdog-graph-linux-arm64",
+      "sha256": "e8183e1a36aae1887245bd55b94fae6d3fa874bb350559de95ea6ca65a14c6a0"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.19/mixdog-graph-linux-x64",
-      "sha256": "5bd08eb666c9ad82b0b152ee6207b6c315182b861c60baf58f76d87025dcc2bc"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.20/mixdog-graph-linux-x64",
+      "sha256": "40142ad17359cc2eb490f639de7c358c4449ca36dc7bbb966bff9a21f81df40f"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.19/mixdog-graph-win32-x64.exe",
-      "sha256": "f1a0ed0058797655ca231078da0ceacd0d35a71289a8089c7ba637fcd8634a03"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.20/mixdog-graph-win32-x64.exe",
+      "sha256": "a727ca6ea385d715232ce246c2519037ccd74b509e57d97ad7c1b4a61c26aade"
     }
   }
 }

package/src/runtime/agent/orchestrator/tools/lib/native-spawn-client.mjs

@@ -861,7 +861,15 @@ export function promoteNativeTask({
 } = {}) {
   const key = String(jobId || '').trim();
   const server = _server;
-  if (server?.caps?.promoteTask !== true || !getNativeTask(key)) return null;
+  // Distinguish the two promotion-unavailable causes: a silent null here used
+  // to surface as an unexplained SIGKILL ("background-promotion-failed") with
+  // no way to tell a capability gap from a missing task record afterwards.
+  if (server?.caps?.promoteTask !== true) {
+    throw new Error('native runner lacks promoteTask capability');
+  }
+  if (!getNativeTask(key)) {
+    throw new Error(`no native task record for jobId ${key || '(empty)'}`);
+  }
   return requestNativeTaskState(key, {
     promoteTask: key,
     timeoutMs,