mixdog 0.9.15 → 0.9.16

package/src/runtime/agent/orchestrator/tools/builtin/search-path-diagnostics.mjs

@@ -4,8 +4,8 @@
  * thin executor; search-tool.mjs re-exports these for unchanged importers.
  */
 import { statSync } from 'fs';
-import { isAbsolute, resolve } from 'path';
-import { findBySuffixStrip, findFileByBasename } from './path-diagnostics.mjs';
+import { basename, isAbsolute, join, resolve } from 'path';
+import { findBySuffixStrip, findDirectoryByBasename, findFileByBasename, listSiblings } from './path-diagnostics.mjs';
 import { normalizeOutputPath, resolveAgainstCwd } from './path-utils.mjs';
 
 // Deterministic ENOENT recovery: when a grep path does not exist, surface
@@ -64,12 +64,64 @@ export function stripEmbeddedPathQuotes(p) {
 // not-found codes: EACCES/EPERM etc. keep their real failure semantics and
 // must not trigger same-basename guidance or the BFS scan.
 const NOT_FOUND_CODES = new Set(['ENOENT', 'ENOTDIR']);
+
+export const ENOENT_FIND_NUDGE = 'Locate with find on the basename before retrying.';
+
+function isDirectoryPathGuess(missingPath) {
+    const base = basename(String(missingPath || '').replace(/\\/g, '/'));
+    if (!base || /[*?[\]{}]/.test(base)) return false;
+    if (/\.[a-zA-Z0-9]{1,12}$/.test(base)) return false;
+    return true;
+}
+
+function nearestExistingParentRel(workDir, missingPath) {
+    try {
+        const segments = String(missingPath).replace(/\\/g, '/').split('/')
+            .filter((s) => s && s !== '.' && s !== '..' && !/^[A-Za-z]:$/.test(s));
+        for (let i = segments.length - 1; i > 0; i--) {
+            const candidate = join(workDir, ...segments.slice(0, i));
+            try {
+                if (statSync(candidate).isDirectory()) {
+                    return segments.slice(0, i).join('/');
+                }
+            } catch { /* keep walking up */ }
+        }
+        if (statSync(workDir).isDirectory()) return '.';
+    } catch { /* fall through */ }
+    return null;
+}
+
+export function spaceJoinedPathHint(requestedPath) {
+    if (typeof requestedPath !== 'string') return '';
+    const trimmed = requestedPath.trim();
+    if (!/\s/.test(trimmed)) return '';
+    const segments = trimmed.split(/\s+/).filter(Boolean);
+    if (segments.length < 2) return '';
+    return ' Pass multiple scopes as path[] array (not a space-joined string).';
+}
+
+export function appendEnoentFindNudge(text = '') {
+    const base = String(text || '');
+    if (base.includes(ENOENT_FIND_NUDGE)) return base;
+    const sep = base.length && !/\s$/.test(base) ? ' ' : '';
+    return `${base}${sep}${ENOENT_FIND_NUDGE}`;
+}
+
+export function finalizeReadFamilyEnoentTail(hint, requestedPath, errCode = 'ENOENT') {
+    if (!NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return String(hint || '');
+    return appendEnoentFindNudge(String(hint || '') + spaceJoinedPathHint(requestedPath));
+}
+
 export function resolveUniqueEnoentRedirect(workDir, missingPath, errCode = 'ENOENT') {
     if (!NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return null;
     const suffixHit = findBySuffixStrip(workDir, missingPath);
     if (suffixHit) return suffixHit;
     const elsewhere = findFileByBasename(workDir, missingPath);
     if (elsewhere.length === 1) return elsewhere[0];
+    if (isDirectoryPathGuess(missingPath)) {
+        const dirHits = findDirectoryByBasename(workDir, missingPath, { limit: 3 });
+        if (dirHits.length === 1) return dirHits[0];
+    }
     return null;
 }
 
@@ -100,6 +152,24 @@ export function buildNotFoundHint(workDir, missingPath, actionVerb, errCode = 'E
     if (elsewhere.length) {
         return ` Not found at this path; the same filename exists at: ${elsewhere.map((p) => `"${normalizeOutputPath(p)}"`).join(', ')}. ${actionVerb} that path directly.`;
     }
+    if (isDirectoryPathGuess(missingPath)) {
+        const dirHits = findDirectoryByBasename(workDir, missingPath, { limit: 5 });
+        if (dirHits.length > 1) {
+            return ` Not found at this path; same-named directories exist at: ${dirHits.slice(0, 5).map((p) => `"${normalizeOutputPath(p)}"`).join(', ')}. ${actionVerb} one of those paths directly.`;
+        }
+        if (dirHits.length === 1) {
+            return ` Not found at this path; the same directory name exists at: "${normalizeOutputPath(dirHits[0])}". ${actionVerb} that path directly.`;
+        }
+        const parentRel = nearestExistingParentRel(workDir, missingPath);
+        if (parentRel) {
+            const resolvedParent = parentRel === '.' ? workDir : resolveAgainstCwd(parentRel, workDir);
+            const siblings = listSiblings(resolvedParent, 5);
+            if (siblings.length) {
+                const shown = parentRel === '.' ? '.' : normalizeOutputPath(parentRel);
+                return ` Not found at this path; under "${shown}" try: ${siblings.map((n) => `"${n}"`).join(', ')}.`;
+            }
+        }
+    }
     return '';
 }
 
@@ -146,7 +216,7 @@ export function basePathDiagnostic(basePaths, workDir) {
             return `${normalizeOutputPath(basePath)}: ${st.isDirectory() ? 'path exists (dir)' : 'path exists (file)'}`;
         } catch (err) {
             return `${normalizeOutputPath(basePath)}: path does not exist (${err?.code || 'ENOENT'})`
-                + buildNotFoundHint(workDir, resolved, 'Search', err?.code);
+                + finalizeReadFamilyEnoentTail(buildNotFoundHint(workDir, resolved, 'Search', err?.code), basePath, err?.code);
         }
     }).join('; ');
 }

package/src/runtime/agent/orchestrator/tools/builtin/search-tool.mjs

@@ -18,6 +18,7 @@ import {
     _suggestIndexedPaths,
     basePathDiagnostic,
     buildNotFoundHint,
+    finalizeReadFamilyEnoentTail,
     tryReadFamilyEnoentRedirect,
     isUncOrSmbPath,
     relativePathPrefix,
@@ -431,7 +432,13 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
     const rawPatterns = Array.isArray(rawPattern)
         ? rawPattern.filter(p => typeof p === 'string' && p)
         : (rawPattern ? (expandLegacyEscapedAlternationPattern(String(rawPattern)) || [String(rawPattern)]) : []);
-    const patterns = uniqueStrings(rawPatterns.map(normalizeSearchPattern));
+    let patterns = uniqueStrings(rawPatterns.map(normalizeSearchPattern));
+    const GREP_PATTERN_ARRAY_CAP = 10;
+    let patternCapNote = '';
+    if (patterns.length > GREP_PATTERN_ARRAY_CAP) {
+        patternCapNote = `[capped at ${GREP_PATTERN_ARRAY_CAP} of ${patterns.length} patterns]\n`;
+        patterns = patterns.slice(0, GREP_PATTERN_ARRAY_CAP);
+    }
     if (patterns.length === 0) {
         if (args.glob || hasGlobMagic(args.path)) {
             const globArgs = {
@@ -646,7 +653,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
         if (!windowed.length) {
             const patternStr = patterns.length === 1 ? JSON.stringify(patterns[0]) : JSON.stringify(patterns);
             const globStr = normalizedGlobPatterns.length > 0 ? ` glob=${JSON.stringify(normalizedGlobPatterns)}` : '';
-            return `${chunkPrefix}(no matches) pattern=${patternStr} path=${searchPath}${globStr}`;
+            return `${patternCapNote}${chunkPrefix}(no matches) pattern=${patternStr} path=${searchPath}${globStr}`;
         }
         return formatGrepOutput({
             windowed,
@@ -665,7 +672,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
             globPatterns: normalizedGlobPatterns,
             fileType,
             filenameOmitted: false,
-            prefix: chunkPrefix,
+            prefix: patternCapNote + chunkPrefix,
         });
     }
 
@@ -727,9 +734,9 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
         });
         if (redirected) return redirected;
         const msg = `Error: path does not exist: ${normalizeOutputPath(grepResolvedPath)} (${err?.code || 'ENOENT'})`;
-        const hint = buildNotFoundHint(workDir, grepResolvedPath, 'Search', err?.code);
-        if (hint) return msg + hint;
-        return msg + await _suggestIndexedPaths(grepResolvedPath, executeChildBuiltinTool, workDir);
+        let hint = buildNotFoundHint(workDir, grepResolvedPath, 'Search', err?.code);
+        if (!hint) hint = await _suggestIndexedPaths(grepResolvedPath, executeChildBuiltinTool, workDir);
+        return msg + finalizeReadFamilyEnoentTail(hint, searchPath, err?.code);
     }
     const filenameOmitted = forceGrepFilename ? false : grepStat.isFile();
 
@@ -864,7 +871,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
                 } catch { /* best-effort hint */ }
             }
         }
-        const out = body + rgPartialSuffix;
+        const out = patternCapNote + body + rgPartialSuffix;
         const shownLines = headLimit === Infinity ? windowed : windowed.slice(0, headLimit);
         const remaining = Math.max(0, totalWindowed - shownLines.length);
         // Mirrors formatGrepOutput truncation / totalKnown semantics.
@@ -969,7 +976,7 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
                         globPatterns: normalizedGlobPatterns,
                         fileType,
                         filenameOmitted,
-                        prefix: '[regex parse fallback: fixed-string terms]\n',
+                        prefix: patternCapNote + '[regex parse fallback: fixed-string terms]\n',
                     }) || `(no matches) fixed_terms=${JSON.stringify(fixedPatterns)} path=${searchPath}`;
                     recordGrepReadSnapshot(grepStat);
                     return body + rgPartialSuffix;
@@ -1037,6 +1044,12 @@ export async function executeGlobTool(args, workDir, options = {}) {
     if (patterns.length === 0) {
         patterns = ['*'];
     }
+    const GLOB_PATTERN_ARRAY_CAP = 10;
+    let globPatternCapNote = '';
+    if (patterns.length > GLOB_PATTERN_ARRAY_CAP) {
+        globPatternCapNote = `[capped at ${GLOB_PATTERN_ARRAY_CAP} of ${patterns.length} patterns]\n`;
+        patterns = patterns.slice(0, GLOB_PATTERN_ARRAY_CAP);
+    }
 
     const basePaths = (Array.isArray(args.path) && args.path.length > 0)
         ? args.path
@@ -1174,7 +1187,7 @@ export async function executeGlobTool(args, workDir, options = {}) {
             }
             const hint = buildNotFoundHint(workDir, rgCwd, 'Search', err?.code);
             return {
-                error: `path does not exist: ${normalizeOutputPath(rgCwd)} (${err?.code || 'ENOENT'})${hint}`,
+                error: `path does not exist: ${normalizeOutputPath(rgCwd)} (${err?.code || 'ENOENT'})${finalizeReadFamilyEnoentTail(hint, root, err?.code)}`,
                 paths: [],
                 stdoutTruncated: false,
             };
@@ -1261,7 +1274,7 @@ export async function executeGlobTool(args, workDir, options = {}) {
     const body = capped.length > 0
         ? `${capped.join('\n')}${remaining > 0 ? `\n... [${remaining} more entries of ${totalBeforeOffset} total — pass offset:${offset + capped.length} to continue]` : ''}${errSuffix}`
         : '';
-    const out = body || emptyDiag || '(no files found)';
+    const out = globPatternCapNote + (body || emptyDiag || '(no files found)');
     if (options?.scopedCacheOutcome && (accumTruncated || rgStdoutTruncated || rgStdoutPartial || remaining > 0)) {
         markScopedCacheIncomplete(options.scopedCacheOutcome);
     }

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -54,6 +54,29 @@ function sleep(ms) {
 const JOB_STATUS_PREVIEW_MAX_BYTES = 4096;
 const JOB_STATUS_PREVIEW_MAX_LINES = 20;
 const JOB_STATUS_PREVIEW_MAX_CHARS = 1200;
+// Hard ceiling on a background job's on-disk stdout+stderr. Mirrors the
+// foreground SHELL_OUTPUT_DISK_CAP (shell-command.mjs) so a runaway
+// background loop is killed and flagged instead of filling the filesystem.
+const SHELL_JOB_OUTPUT_DISK_CAP = 100 * 1024 * 1024;
+// Poll cadence for the adopted-job output-cap self-tick (mirrors the
+// foreground sizeWatchdog in shell-command.mjs).
+const ADOPTED_JOB_CAP_POLL_MS = 1_000;
+
+// Combined byte size of a job's spilled stdout/stderr files, or 0 if
+// unreadable. mergeStderr collapses both onto stdoutPath, so count it once.
+function shellJobOutputBytes(detail) {
+    let total = 0;
+    const seen = new Set();
+    for (const p of [detail?.stdoutPath, detail?.stderrPath]) {
+        if (!p || seen.has(p)) continue;
+        seen.add(p);
+        try {
+            if (existsSync(p)) total += statSync(p).size;
+        } catch { /* ignore */ }
+    }
+    return total;
+}
+
 function shellQuoteSingle(s) {
     return `'${String(s).replace(/'/g, `'\"'\"'`)}'`;
 }
@@ -333,6 +356,19 @@ function refreshShellJob(jobId) {
         _unregisterLiveJobPid(detail.pid);
         return detail;
     }
+    // Output size watchdog: cap the job's spilled stdout/stderr at the same
+    // ceiling as foreground runs. Past it, SIGKILL the tree and flag the job
+    // so a runaway producer cannot fill the filesystem.
+    if (shellJobOutputBytes(detail) > SHELL_JOB_OUTPUT_DISK_CAP) {
+        killProcessTree(detail.pid, 'SIGKILL');
+        detail.status = 'failed';
+        detail.exitCode = 137;
+        detail.finishedAt = new Date().toISOString();
+        detail.error = `output exceeded ${SHELL_JOB_OUTPUT_DISK_CAP} byte cap`;
+        writeShellJobDetail(detail);
+        _unregisterLiveJobPid(detail.pid);
+        return detail;
+    }
     if (detail.pid && !isPidAlive(detail.pid)) {
         detail.status = 'failed';
         detail.finishedAt = new Date().toISOString();
@@ -668,10 +704,29 @@ export function adoptForegroundShellJob({ command, cwd, pid, timeoutMs, mergeStd
     if (Number.isFinite(pid) && pid > 0) {
         _installShellJobsExitHook();
         _registerLiveJobPid(pid, jobId);
+        // Adopted jobs have no staged wrapper timer and may have no active
+        // task waiter, so nothing would call refreshShellJob() to enforce the
+        // output cap / timeout. Drive a periodic tick until the job settles.
+        _armAdoptedJobCapPoll(jobId);
     }
     return { ...detail, exitPath, donePath };
 }
 
+// Periodic self-tick for adopted (auto-backgrounded) jobs: refreshShellJob
+// runs the SHELL_JOB_OUTPUT_DISK_CAP + timeout watchdogs. Stops once the job
+// leaves 'running'. unref()'d so it never pins the host process.
+function _armAdoptedJobCapPoll(jobId) {
+    const tick = setInterval(() => {
+        let detail = null;
+        try { detail = refreshShellJob(jobId); } catch { /* ignore */ }
+        if (!detail || detail.status !== 'running') {
+            clearInterval(tick);
+        }
+    }, ADOPTED_JOB_CAP_POLL_MS);
+    if (typeof tick.unref === 'function') tick.unref();
+    return tick;
+}
+
 function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, shellArg, shellArgs, shellType, clientHostPid }) {
     // Route ANY PowerShell shell to the PS wrapper, regardless of platform.
     // Gating on win32 sent shell:'powershell' on macOS/Linux down the POSIX

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -25,7 +25,8 @@ import {
 } from './paths.mjs';
 import { ensureNativePatchBinaryAvailable } from './native-server.mjs';
 import { assertPathReachable } from '../builtin/fs-reachability.mjs';
-import { dispatchNativePatch, dispatchJsPatchEntries } from './dispatch.mjs';
+import { dispatchNativePatch } from './dispatch.mjs';
+import { normalizeOutputPath } from '../builtin.mjs';
 import {
   planV4ARenameSections,
   applyV4ARenameSections,
@@ -40,6 +41,10 @@ function isPatchErrorText(text) {
 }
 
 const APPLY_PATCH_UI_DIFF_MAX_CHARS = 64 * 1024;
+// Reject oversized patch bodies before parse / native Buffer.from
+// (native-server.mjs Buffer.from(patchText)). A few MB covers any legitimate
+// multi-file edit; past this it is a runaway / accidental blob.
+const APPLY_PATCH_MAX_BYTES = 8 * 1024 * 1024;
 const APPLY_PATCH_UI_DIFF_REGISTRY_MAX = 64;
 const _applyPatchUiDiffByCallId = new Map();
 
@@ -107,6 +112,10 @@ async function apply_patch(args, cwd, options = {}) {
   if (isCompactedPlaceholderPatch(patchStr)) {
     throw new Error('patch body is a compacted-history placeholder ([mixdog compacted …]), not real patch content. Re-read the target file span and write a fresh patch; never resubmit compacted output as new tool input.');
   }
+  const patchByteLen = Buffer.byteLength(patchStr, 'utf8');
+  if (patchByteLen > APPLY_PATCH_MAX_BYTES) {
+    throw new Error(`apply_patch: patch too large (${patchByteLen} bytes > ${APPLY_PATCH_MAX_BYTES} byte cap); split into smaller patches`);
+  }
   const requestedFormat = String(args?.format || '').toLowerCase();
   if (requestedFormat && requestedFormat !== 'unified' && requestedFormat !== 'v4a') {
     throw new Error('apply_patch: "format" must be "unified" or "v4a"');
@@ -233,22 +242,18 @@ async function apply_patch(args, cwd, options = {}) {
     }
     const insideEntries = entries.filter((entry) => !isResolvedPathOutsideBase(entry.fullPath, basePath));
     const outsideEntries = entries.filter((entry) => isResolvedPathOutsideBase(entry.fullPath, basePath));
+    if (outsideEntries.length > 0) {
+      const rels = outsideEntries.map((e) => normalizeOutputPath(e.fullPath || e.displayPath || '(unknown)')).join(', ');
+      return wrapPatchMutationOutput(
+        `Error: apply_patch target resolves outside base path (../ or absolute not allowed): ${rels}`,
+        mutationPlan,
+        { backend: 'native-patch' },
+      );
+    }
     const parsedInside = (parsed || []).filter(
       (entry) => !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath),
     );
     const resultParts = [];
-    if (outsideEntries.length > 0) {
-      const jsResult = await dispatchJsPatchEntries({
-        rows: outsideEntries,
-        parsed,
-        basePath,
-        dryRun,
-        fuzzy,
-        readStateScope,
-      });
-      if (isPatchErrorText(jsResult)) return wrapPatchMutationOutput(jsResult, mutationPlan, { backend: 'js-patch' });
-      resultParts.push(jsResult);
-    }
     if (insideEntries.length > 0) {
       const nativePatchStr = rewriteHeaderPaths(renderParsedUnifiedPatch(parsedInside), headerRewrites);
       const nativeResult = await dispatchNativePatch({
@@ -331,6 +336,9 @@ function maybeCapturePatchReplay(args, cwd, errorText) {
     for (const rel of rels) {
       try {
         const abs = isAbsolute(rel) ? rel : pathResolve(basePath, rel);
+        // Never persist snapshots for targets outside basePath — a malicious
+        // or malformed patch could otherwise exfiltrate arbitrary files.
+        if (isResolvedPathOutsideBase(abs, basePath)) { files[rel] = null; continue; }
         files[rel] = existsSync(abs) ? readFileSync(abs, 'utf8') : null;
       } catch { files[rel] = null; }
     }

package/src/runtime/agent/orchestrator/tools/patch/paths.mjs

@@ -45,8 +45,19 @@ export function resolveBasePath(cwd, basePath) {
 }
 
 export function isResolvedPathOutsideBase(fullPath, basePath) {
-  const rel = pathRelative(pathResolve(basePath), pathResolve(fullPath)).replace(/\\/g, '/');
-  if (!rel || isAbsolute(rel)) return true;
+  // Realpath-resolve so a symlink INSIDE base that points outside is caught:
+  // a lexical relative check only sees the pre-resolution path. Resolve the
+  // nearest existing ancestor (create-mode leaves don't exist yet) on both
+  // sides, then compare.
+  const realBase = realpathNearestExistingAncestor(pathResolve(basePath));
+  const realFull = realpathNearestExistingAncestor(pathResolve(fullPath));
+  const rel = pathRelative(realBase, realFull).replace(/\\/g, '/');
+  // rel === '' means realFull IS realBase — e.g. a create-mode target whose
+  // nearest existing ancestor is base itself, or a direct child. That is
+  // inside base, so pass. Only reject an absolute rel (different root/drive)
+  // or one that escapes via '..'.
+  if (rel === '') return false;
+  if (isAbsolute(rel)) return true;
   return rel.split(/[\\/]+/).some((part) => part === '..');
 }
 

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -2,7 +2,7 @@
 // conversion. Moved verbatim from patch.mjs; anchor/context matching, EOF
 // handling, rename atomicity, and conversion output are all unchanged.
 
-import { readFileSync, lstatSync, mkdirSync } from 'node:fs';
+import { readFileSync, lstatSync, mkdirSync, realpathSync } from 'node:fs';
 import { unlink } from 'node:fs/promises';
 import { dirname as pathDirname } from 'node:path';
 import {
@@ -304,6 +304,24 @@ function v4aRenamePathKey(absPath) {
   return process.platform === 'win32' ? String(absPath || '').toLowerCase() : String(absPath || '');
 }
 
+// True when src and dest point at the SAME physical file despite differing
+// path strings — the case-only rename case on a case-insensitive fs (macOS,
+// Windows). realpathSync collapses casing to the canonical on-disk form, so
+// equal realpaths prove same-file. This is authoritative and requires BOTH
+// paths to actually exist: if either realpath fails (e.g. dest missing on a
+// case-SENSITIVE fs — a normal rename), the paths are NOT the same file, so
+// the source must still be unlinked. Never guess "same file" from a
+// lowercase string match: that false-positives on case-sensitive fs and turns
+// a rename into a copy that leaks the source.
+function renameTargetsSamePhysicalFile(srcFull, destFull) {
+  if (srcFull === destFull) return false;
+  try {
+    return realpathSync(srcFull) === realpathSync(destFull);
+  } catch {
+    return false;
+  }
+}
+
 function v4aSpecialFileStatMessage(displayPath) {
   return `apply_patch: cannot patch special file (FIFO / character / block device / socket): ${normalizeOutputPath(displayPath)}`;
 }
@@ -319,9 +337,13 @@ function lstatV4APatchTarget(fullPath, displayPath) {
 function validateV4ARenameSection(section, basePath, seenDestKeys) {
   const srcFull = resolveV4AEntryPath(basePath, section.path);
   const destFull = resolveV4AEntryPath(basePath, section.movePath);
-  if (v4aRenamePathKey(srcFull) === v4aRenamePathKey(destFull)) {
+  // Case-only rename (foo.js -> Foo.js) on a case-insensitive fs resolves to
+  // the same key but is a legitimate rename. Reject "same path" only when the
+  // raw paths are byte-identical; a case-only difference falls through.
+  if (v4aRenamePathKey(srcFull) === v4aRenamePathKey(destFull) && srcFull === destFull) {
     return `apply_patch: V4A rename source and destination are the same path (${normalizeOutputPath(section.path)})`;
   }
+  const caseOnlyRename = v4aRenamePathKey(srcFull) === v4aRenamePathKey(destFull) && srcFull !== destFull;
   const destKey = v4aRenamePathKey(destFull);
   if (seenDestKeys.has(destKey)) {
     return `apply_patch: duplicate V4A rename destination ${normalizeOutputPath(section.movePath)}`;
@@ -349,6 +371,14 @@ function validateV4ARenameSection(section, basePath, seenDestKeys) {
     if (!destSt.isFile()) {
       return `apply_patch: V4A rename destination is not a regular file: ${normalizeOutputPath(section.movePath)}`;
     }
+    // Destination already exists. On a case-insensitive fs a case-only rename
+    // (foo.js -> Foo.js) resolves dest to the SAME physical file as src — that
+    // is the intended re-case, not a clobber, so allow it. Confirm via realpath
+    // (canonical path collapses case) so the guard can't false-reject. Any
+    // other existing destination would be clobbered by atomicWrite; refuse.
+    if (!caseOnlyRename && !renameTargetsSamePhysicalFile(srcFull, destFull)) {
+      return `apply_patch: V4A rename destination already exists: ${normalizeOutputPath(section.movePath)}; delete it first or choose a new name`;
+    }
   } catch (err) {
     if (err?.code !== 'ENOENT') {
       return `apply_patch: V4A rename destination unreadable: ${normalizeOutputPath(section.movePath)} (${err?.code || err?.message || String(err)})`;
@@ -363,6 +393,12 @@ function validateV4ARenameSection(section, basePath, seenDestKeys) {
 async function applyV4ARenameSection(section, basePath, options = {}) {
   const srcFull = resolveV4AEntryPath(basePath, section.path);
   const destFull = resolveV4AEntryPath(basePath, section.movePath);
+  // Case-only rename on a case-insensitive fs: src and dest are the SAME
+  // physical file. atomicWrite(destFull) rewrites (and re-cases) it; the
+  // source unlink below would then delete the just-written file, so skip it.
+  const caseOnlySameFile =
+    (v4aRenamePathKey(srcFull) === v4aRenamePathKey(destFull) && srcFull !== destFull)
+    || renameTargetsSamePhysicalFile(srcFull, destFull);
   const displaySrc = normalizeOutputPath(section.path);
   const displayDest = normalizeOutputPath(section.movePath);
   let sourceLines;
@@ -398,7 +434,7 @@ async function applyV4ARenameSection(section, basePath, options = {}) {
   mkdirSync(pathDirname(destFull), { recursive: true });
   try {
     await atomicWrite(destFull, newContent, { sessionId: options.readStateScope });
-    await unlink(srcFull);
+    if (!caseOnlySameFile) await unlink(srcFull);
   } catch (err) {
     try {
       if (destBefore === null) {
@@ -407,9 +443,11 @@ async function applyV4ARenameSection(section, basePath, options = {}) {
         await atomicWrite(destFull, destBefore, { sessionId: options.readStateScope });
       }
     } catch {}
-    try {
-      await atomicWrite(srcFull, originalContent, { sessionId: options.readStateScope });
-    } catch {}
+    if (!caseOnlySameFile) {
+      try {
+        await atomicWrite(srcFull, originalContent, { sessionId: options.readStateScope });
+      } catch {}
+    }
     throw new Error(`apply_patch: V4A rename failed for ${displaySrc} → ${displayDest} (${err?.message || String(err)})`);
   }
   invalidateBuiltinResultCache([srcFull, destFull]);

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -698,6 +698,11 @@ export function execShellCommand({
       // Every subsequent stdout/stderr chunk must hit disk — the call is
       // about to resolve and nobody will drain the in-memory buffers again.
       try { taskOutput.forceSpill(); } catch {}
+      // The foreground sizeWatchdog was cleared above; the output cap now
+      // travels with the adopted job — adoptForegroundShellJob arms a periodic
+      // refreshShellJob tick that enforces SHELL_JOB_OUTPUT_DISK_CAP against the
+      // same spill files (stdoutPath/stderrPath below), killing + flagging a
+      // runaway background producer even with no active task waiter.
       const stdoutPath = taskOutput.spilled ? taskOutput.stdoutPath : null;
       const stderrPath = taskOutput.spilled ? taskOutput.stderrPath : null;
       let job = null;

package/src/runtime/channels/backends/telegram.mjs

@@ -92,6 +92,7 @@ class TelegramBackend {
   _polling = false;
   _pollAbort = null;
   _connectPromise = null;
+  _pollGen = 0;
   _offset = 0;
   _typingIntervals = /* @__PURE__ */ new Map();
   constructor(config, stateDir) {
@@ -141,12 +142,25 @@ class TelegramBackend {
     }
     return a;
   }
-  _isAllowedChat(chatId) {
+  _isAllowedChat(chatId, userId) {
     const access = this.loadAccess();
     if (!access || access.dmPolicy === "disabled") return false;
     const key = String(chatId);
-    if (this.mainChannelId && key === String(this.mainChannelId)) return true;
-    if (key in (access.channels ?? {})) return true;
+    const uid = userId != null ? String(userId) : null;
+    // Mirror discord.mjs gate(): a configured channel/group's allowFrom list
+    // (when non-empty) restricts to those user IDs, even though the chatId
+    // itself is allowed. An empty allowFrom stays open (existing behavior).
+    const channelPolicy = access.channels?.[key];
+    if (this.mainChannelId && key === String(this.mainChannelId)) {
+      const allowFrom = channelPolicy?.allowFrom ?? [];
+      if (allowFrom.length > 0 && (uid == null || !allowFrom.includes(uid))) return false;
+      return true;
+    }
+    if (channelPolicy) {
+      const allowFrom = channelPolicy.allowFrom ?? [];
+      if (allowFrom.length > 0 && (uid == null || !allowFrom.includes(uid))) return false;
+      return true;
+    }
     if ((access.allowFrom ?? []).includes(key)) return true;
     return false;
   }
@@ -200,12 +214,16 @@ class TelegramBackend {
       }
       this._polling = true;
       // Fire-and-forget the poll loop; it self-reschedules until _polling clears.
-      void this._pollLoop();
+      // Bump the generation so a loop started by an earlier connect()/backoff
+      // cycle (still asleep in its retry delay) recognizes it's stale and
+      // exits instead of running a second loop alongside this one.
+      const gen = ++this._pollGen;
+      void this._pollLoop(gen);
     })();
     return this._connectPromise;
   }
-  async _pollLoop() {
-    while (this._polling) {
+  async _pollLoop(gen) {
+    while (this._polling && gen === this._pollGen) {
       const ac = new AbortController();
       this._pollAbort = ac;
       // getUpdates long-poll: server holds up to `timeout`s; give the client
@@ -232,13 +250,14 @@ class TelegramBackend {
         }
       } catch (err) {
         clearTimeout(timer);
-        if (!this._polling) break; // disconnect() aborted us — exit quietly.
+        if (!this._polling || gen !== this._pollGen) break; // disconnect()/reconnect superseded us — exit quietly.
         // 409 = another getUpdates/webhook consumer is active; other errors are
         // transient. Back off and continue rather than crashing the loop.
         const status = err?.status;
         const backoff = status === 409 ? 5_000 : 2_000;
         process.stderr.write(`mixdog telegram: getUpdates error (${status ?? "net"}); retrying in ${backoff}ms\n`);
         await new Promise((r) => setTimeout(r, backoff));
+        if (!this._polling || gen !== this._pollGen) break;
       } finally {
         this._pollAbort = null;
       }
@@ -247,10 +266,10 @@ class TelegramBackend {
   _handleUpdate(u) {
     const msg = u.message;
     if (!msg) return; // non-message update (we only asked for messages).
+    const from = msg.from ?? {};
     const chatId = msg.chat?.id;
     if (chatId == null) return;
-    if (!this._isAllowedChat(chatId)) return;
-    const from = msg.from ?? {};
+    if (!this._isAllowedChat(chatId, from.id)) return;
     if (from.is_bot) return; // ignore bot echoes / other bots.
     const text = msg.text ?? msg.caption ?? "";
     const receivedAtMs = Date.now();
@@ -275,6 +294,7 @@ class TelegramBackend {
   }
   async disconnect() {
     this._polling = false;
+    this._pollGen++;
     try { this._pollAbort?.abort(); } catch {}
     this._pollAbort = null;
     for (const interval of this._typingIntervals.values()) clearInterval(interval);

package/src/runtime/channels/lib/event-queue.mjs

@@ -221,9 +221,13 @@ ${p.item.prompt}`).join("\n\n")}`;
       };
       logEvent(`${name}: processing batch of ${claimedPairs.length}`);
       const injected = this.executeItem(batchItem, null);
-      for (const { file: claimedPath } of claimedPairs) {
+      for (const { file: claimedPath, item: originalItem } of claimedPairs) {
         if (injected) this.moveInProgressToProcessed(claimedPath, "batched");
-        else this.requeueClaimed(claimedPath, batchItem);
+        // Requeue each claimant with its own original item, not the combined
+        // batchItem — otherwise every retry re-inflates that file's prompt
+        // with the whole prior batch's text, and re-batching next tick
+        // compounds it further.
+        else this.requeueClaimed(claimedPath, originalItem);
       }
     }
   }