mixdog 0.9.170 → 0.9.172

package/src/runtime/agent/orchestrator/tools/lib/shell-run-spawn.mjs

@@ -0,0 +1,208 @@
+// Spawn phase of one foreground shell run: argv shaping, the warm pwsh
+// standby fast path, the spawn-burst gate around process creation, and the
+// delayed live foreground record once the command has reached a shell.
+import { acquire as acquireChildSpawnSlot } from '../../../../shared/child-spawn-gate.mjs';
+import { publishForegroundShellRecord, trackForegroundShellJob } from '../builtin/shell-jobs.mjs';
+import { nativeSpawnFileCaptureReady, setNativeTaskStartedAt } from './native-spawn-client.mjs';
+import { _maybeEncodePowerShellCommand } from '../shell-powershell.mjs';
+import { spawnShellWithRetry as _spawnShellWithRetry } from './shell-spawn-retry.mjs';
+import { takeWarmShellStandby } from './shell-warm-standby.mjs';
+import { SHELL_OUTPUT_DISK_CAP } from '../shell-exec-output.mjs';
+
+// Foreground visibility threshold. Every shell readout (CLI statusline,
+// desktop island) scans the on-disk job records, so a foreground command is
+// invisible without one. Commands that settle inside this window can never
+// survive long enough for a 1 s status refresh to show them, so publishing
+// their record would only cost two file writes per command.
+// MIXDOG_SHELL_FOREGROUND_RECORD_MS overrides; 0 publishes every command.
+const _envForegroundRecord = Math.floor(Number(process.env.MIXDOG_SHELL_FOREGROUND_RECORD_MS));
+const FOREGROUND_RECORD_DELAY_MS =
+  Number.isFinite(_envForegroundRecord) && _envForegroundRecord >= 0 ? _envForegroundRecord : 300;
+
+function shapeArgv({ directArgv, shellArg, shellArgs, command, execScript }) {
+  const useDirectArgv = Array.isArray(directArgv);
+  // Direct-exe spawns already bypass the shell, so they keep using the
+  // command verbatim; only the shell-parsed form honours execScript.
+  const shellScript = !useDirectArgv && typeof execScript === 'string' && execScript ? execScript : command;
+  const spawnCommand = useDirectArgv ? String(command ?? '') : _maybeEncodePowerShellCommand(shellScript);
+  let argv;
+  if (useDirectArgv) argv = [...directArgv];
+  else if (Array.isArray(shellArgs) && shellArgs.length > 0) argv = [...shellArgs, spawnCommand];
+  else argv = [shellArg, spawnCommand];
+  return { useDirectArgv, spawnCommand, argv };
+}
+
+// Warm-standby fast path (pwsh only): a pre-spawned bootstrap pwsh reads the
+// script from stdin, skipping CreateProcess + Defender scan for this call.
+// Any miss (env drift, TTL, dead/warming standby, MIXDOG_SHELL_WARM_STANDBY=0)
+// falls through to the gated spawn.
+async function takeStandby({ run, useDirectArgv, shell, shellArg, env, cwd, command, ownerSessionId, clientHostPid }) {
+  if (useDirectArgv || shellArg !== '-Command') return null;
+  let standby = null;
+  try {
+    standby = takeWarmShellStandby({ shell, env, cwd });
+  } catch {
+    standby = null;
+  }
+  if (!standby) return null;
+  let tracked = null;
+  try {
+    tracked = await trackForegroundShellJob({
+      command,
+      cwd,
+      child: standby.spawned.child,
+      jobId: run.foregroundRecordId,
+      ownerSessionId,
+      clientHostPid,
+    });
+  } catch {}
+  if (tracked) return standby;
+  // The parked process settled or lost its native request identity.
+  // Do not feed it; replace it with a normally tracked spawn.
+  try {
+    standby.spawned.child.kill();
+  } catch {}
+  return null;
+}
+
+// Spawn-burst gate: hold a 'process-spawn' slot only across process creation
+// (CreateProcess + AV scan + EPERM retries), released the moment the child
+// exists. Bounds the Defender convoy a shell burst creates without limiting
+// how many commands RUN concurrently — the full command lifetime is
+// intentionally NOT gated: bash/pwsh commands can run for minutes and would
+// starve rg/code_graph.
+async function gatedSpawn({
+  run,
+  argv,
+  shell,
+  shellArg,
+  env,
+  cwd,
+  abortSignal,
+  command,
+  ownerSessionId,
+  clientHostPid,
+}) {
+  const releaseSpawnSlot = await acquireChildSpawnSlot(abortSignal || null, 'process-spawn', {
+    ownerKey: ownerSessionId,
+  });
+  // Gate drain can grant several waiters in one tick. Yield so CreateProcess
+  // + AV does not freeze graph/patch/search callbacks in that same turn.
+  await new Promise((resolve) => setImmediate(resolve));
+  if (abortSignal?.aborted) {
+    try {
+      releaseSpawnSlot();
+    } catch {
+      /* idempotent */
+    }
+    throw abortSignal.reason || new Error('aborted');
+  }
+  // CC parity (ShellCommand.ts): give the child its OWN fds on the capture
+  // files so its output never depends on a reader living in this process. A
+  // job the caller deliberately leaves running — a task's server — then
+  // keeps writing after we exit; on a pipe it dies on its next write the
+  // moment our reader is gone.
+  const { taskOutput } = run;
+  const capture = nativeSpawnFileCaptureReady() ? taskOutput.openDirectCapture() : null;
+  try {
+    return await _spawnShellWithRetry({
+      shell,
+      argv,
+      shellArg,
+      cwd,
+      spawnOptions: {
+        env,
+        cwd,
+        outputLimit: SHELL_OUTPUT_DISK_CAP,
+        rawOutput: true,
+        jobId: run.foregroundRecordId,
+        command,
+        ownerSessionId,
+        clientHostPid,
+        ...(capture
+          ? {
+              stdoutPath: taskOutput.stdoutPath,
+              stderrPath: taskOutput.stderrPath,
+            }
+          : {}),
+        // POSIX: detached gives the child its own process group so treeKill can
+        // signal the whole group. Windows detached has different console
+        // semantics, so it stays off there.
+      },
+    });
+  } finally {
+    try {
+      releaseSpawnSlot();
+    } catch {
+      /* idempotent */
+    }
+  }
+}
+
+/**
+ * Spawn the command's shell (or reuse a warm standby) and stamp the run with
+ * the moment the command reached it. Throws on spawn failure; the caller
+ * turns that into the spawn-failed result.
+ */
+export async function spawnShellChild({
+  run,
+  shell,
+  shellArg,
+  shellArgs,
+  command,
+  env,
+  cwd,
+  abortSignal,
+  directArgv,
+  execScript,
+  ownerSessionId,
+  clientHostPid,
+}) {
+  const { useDirectArgv, spawnCommand, argv } = shapeArgv({ directArgv, shellArg, shellArgs, command, execScript });
+  const onChildError = (err) => {
+    run.spawnError = run.spawnError || err;
+    run.failurePhase = 'tool';
+    run.failureReason = 'spawn failed';
+    if (run.settle) run.settle(1, null);
+    else run.pendingChildError = run.pendingChildError || err;
+  };
+  const standby = await takeStandby({
+    run,
+    useDirectArgv,
+    shell,
+    shellArg,
+    env,
+    cwd,
+    command,
+    ownerSessionId,
+    clientHostPid,
+  });
+  const spawned =
+    standby?.spawned ??
+    (await gatedSpawn({ run, argv, shell, shellArg, env, cwd, abortSignal, command, ownerSessionId, clientHostPid }));
+  run.child = spawned.child;
+  spawned.attachErrorHandler(onChildError);
+  // Feed the standby only after the error handler is attached; server
+  // messages cannot be processed before this synchronous block yields.
+  if (standby) standby.feed(spawnCommand, cwd);
+  // The command has now reached a shell. This is the start moment every
+  // readout measures from, and the point from which a still-running
+  // command deserves to be visible in the shell readouts.
+  run.commandStartedAtMs = Date.now();
+  setNativeTaskStartedAt(run.foregroundRecordId, run.commandStartedAtMs);
+  run.foregroundRecordTimer = setTimeout(() => {
+    run.foregroundRecordTimer = null;
+    if (run.settled || run.autoBackgrounded || !run.child?.pid) return;
+    run.foregroundRecordPublished = true;
+    publishForegroundShellRecord({
+      jobId: run.foregroundRecordId,
+      command,
+      cwd,
+      pid: run.child.pid,
+      startedAtMs: run.commandStartedAtMs,
+      ownerSessionId,
+      clientHostPid,
+    });
+  }, FOREGROUND_RECORD_DELAY_MS);
+  run.foregroundRecordTimer.unref?.();
+}

package/src/runtime/agent/orchestrator/tools/lib/shell-run-state.mjs

@@ -0,0 +1,175 @@
+// Explicit state of one foreground shell run (execShellCommand) plus the
+// small lifecycle helpers every phase shares: lease release, abort-handler
+// detach, timer teardown, the live foreground record, and the confirmed
+// tree-kill. The spawn, settle and auto-background phases live in their own
+// modules and read/write this one record.
+import { randomUUID } from 'node:crypto';
+import { retireForegroundShellRecord } from '../builtin/shell-jobs.mjs';
+import { ShellTextDecoder, TaskOutput, treeKill } from '../shell-exec-output.mjs';
+
+// Treekill + exit confirmation. treeKill alone leaves settle() pending on
+// 'close'/'exit'; on Windows a taskkill miss or a grandchild holding stdio
+// fds keeps the dispatch stalled until the upstream ceiling. Covers every
+// kill path (timeout / pre-aborted / abort / capture-error / size-watchdog)
+// so the hang risk does not live on outside the timeout branch.
+// A single 5 s force-settle was NOT enough: settling on that timer while
+// the tree was still alive released the admission lease and the capture
+// files under a running process. Each deadline now RE-issues the kill and
+// re-arms; only a confirmed exit settles normally, and the bounded last
+// resort settles with killUnconfirmed so cleanup follows the real exit.
+const KILL_CONFIRM_INTERVAL_MS = 5000;
+const KILL_CONFIRM_ATTEMPTS = 3;
+
+export function createShellRun({ abortSignal, resolve }) {
+  const taskId = `shell_${randomUUID().slice(0, 8)}`;
+  let resultResolved = false;
+  return {
+    taskId,
+    taskOutput: new TaskOutput(taskId),
+    // The command text is NEVER inspected or rewritten here: whatever the
+    // caller wrote reaches the shell byte for byte, trailing `&` included.
+    // A command that detaches work is dealt with AFTER it runs, by observing
+    // whether the shell's process group / tree still holds live processes
+    // (see the descendant probe in settle()).
+    stdoutDecoder: new ShellTextDecoder(),
+    stderrDecoder: new ShellTextDecoder(),
+    abortSignal,
+    // _startMs covers admission lease + policy preflight too, so it overstates
+    // how long the command itself has run; before a shell exists it is the
+    // only stamp available (see elapsedSinceStart).
+    startMs: Date.now(),
+    resolveResult(result) {
+      if (resultResolved) return false;
+      resultResolved = true;
+      resolve(result);
+      return true;
+    },
+    isResolved: () => resultResolved,
+    timedOut: false,
+    killed: false,
+    killCause: null,
+    failurePhase: null,
+    failureReason: null,
+    spawnError: null,
+    pendingChildError: null,
+    settle: null,
+    settled: false,
+    timer: null,
+    abortHandler: null,
+    partialOutput: false,
+    // Moment the shell PROCESS itself exited. The gap between it and the
+    // stdio close is the win32 evidence that descendants inherited (and still
+    // hold) this command's stdout/stderr — see lib/shell-descendants.mjs.
+    rootExitAtMs: 0,
+    resourceLease: null,
+    progressTimer: null,
+    outputTailTimer: null,
+    lastOutputTail: '',
+    // Auto-background transition flag. Set the moment the autoBackgroundMs
+    // timer fires and promotes the still-running child. Once true the normal
+    // settle()/close/exit/treeKill paths are inert for this run — the call
+    // has already resolved with a 'backgrounded' result and the child's
+    // lifecycle is owned by the shell-jobs registry. Mutually exclusive with
+    // `settled`: whichever transition wins first wins for good.
+    autoBackgrounded: false,
+    autoBackgroundJobId: null,
+    autoBgTimer: null,
+    killUnconfirmed: false,
+    child: null,
+    // Live foreground record. Stamped with the moment the command actually
+    // reached a shell — not lease/preflight entry, and not a warm standby's
+    // process-creation time.
+    commandStartedAtMs: 0,
+    foregroundRecordId: `job_${Date.now()}_${randomUUID().slice(0, 6)}`,
+    foregroundRecordTimer: null,
+    foregroundRecordPublished: false,
+  };
+}
+
+export async function releaseResourceLease(run) {
+  if (!run.resourceLease) return null;
+  const lease = run.resourceLease;
+  run.resourceLease = null;
+  try {
+    await lease.release();
+    return null;
+  } catch (error) {
+    return error;
+  }
+}
+
+export function detachAbortHandler(run) {
+  if (run.abortSignal && run.abortHandler) {
+    try {
+      run.abortSignal.removeEventListener('abort', run.abortHandler);
+    } catch {}
+    run.abortHandler = null;
+  }
+}
+
+export function clearProgressTimers(run) {
+  if (run.progressTimer) {
+    clearInterval(run.progressTimer);
+    run.progressTimer = null;
+  }
+  if (run.outputTailTimer) {
+    clearInterval(run.outputTailTimer);
+    run.outputTailTimer = null;
+  }
+}
+
+// The foreground capture is over (settled or promoted): stop every local
+// watchdog/timer so none of them can treeKill the child afterwards.
+export function clearForegroundTimers(run) {
+  if (run.timer) {
+    clearTimeout(run.timer);
+    run.timer = null;
+  }
+  clearProgressTimers(run);
+  if (run.autoBgTimer) {
+    clearTimeout(run.autoBgTimer);
+    run.autoBgTimer = null;
+  }
+}
+
+export function clearForegroundRecord(run) {
+  if (run.foregroundRecordTimer) {
+    clearTimeout(run.foregroundRecordTimer);
+    run.foregroundRecordTimer = null;
+  }
+  if (!run.foregroundRecordPublished) return;
+  run.foregroundRecordPublished = false;
+  try {
+    retireForegroundShellRecord(run.foregroundRecordId);
+  } catch {}
+}
+
+// Runtime of the COMMAND (see startMs).
+export const elapsedSinceStart = (run) => Math.max(0, Date.now() - (run.commandStartedAtMs || run.startMs));
+
+export function treeKillForceSettle(run, cause) {
+  run.killed = true;
+  run.killCause = run.killCause || cause || 'runtime-guard';
+  let attempts = 0;
+  const armConfirmation = () => {
+    const deadline = setTimeout(() => {
+      if (run.settled || run.autoBackgrounded) return;
+      // A confirmed exit is settled by the child's own close/exit
+      // handlers with its real status; nothing to force here.
+      if (run.child?.exitCode != null || run.child?.signalCode != null) return;
+      attempts += 1;
+      if (attempts < KILL_CONFIRM_ATTEMPTS) {
+        treeKill(run.child);
+        armConfirmation();
+        return;
+      }
+      run.partialOutput = true;
+      run.killUnconfirmed = true;
+      run.failureReason = run.failureReason || 'kill unconfirmed';
+      run.settle(1, 'SIGKILL');
+    }, KILL_CONFIRM_INTERVAL_MS);
+    if (deadline.unref) deadline.unref();
+  };
+  treeKill(run.child);
+  armConfirmation();
+}

package/src/runtime/agent/orchestrator/tools/lib/shell-spawn-retry.mjs

@@ -47,8 +47,8 @@ export async function spawnShellWithRetry({ shell, argv, spawnOptions, shellArg,
           console.error(
             '[shell-spawn-retry] ' +
               JSON.stringify({
-                code: (err && err.code) || null,
-                syscall: (err && err.syscall) || null,
+                code: err?.code || null,
+                syscall: err?.syscall || null,
                 shell,
                 cwd,
                 activeSpawnCount: activeShellSpawns,

package/src/runtime/agent/orchestrator/tools/lib/shell-warm-standby.mjs

@@ -58,7 +58,7 @@ function envSignature(env) {
 }
 
 function _slotAlive(slot) {
-  return Boolean(slot && slot.native?.child && slot.native.child.exitCode == null && !slot.native.child.killed);
+  return Boolean(slot?.native?.child && slot.native.child.exitCode == null && !slot.native.child.killed);
 }
 
 function psQuote(value) {

package/src/runtime/agent/orchestrator/tools/patch/apply-patch/codex-batch.mjs

@@ -0,0 +1,245 @@
+// Codex batch: validate the complete patch before writing (one operation per
+// target), then apply it in one shot under path locks with all-or-nothing
+// rollback.
+import { parsePatch } from 'diff';
+import { withBuiltinPathLocks } from '../../builtin.mjs';
+import { withAdvisoryLocks } from '../../builtin/advisory-lock.mjs';
+import { wrapPatchMutationOutput } from '../mutation-output.mjs';
+import { ensureNativePatchBinaryAvailable } from '../native-server.mjs';
+import {
+  canFallbackCountedUnified,
+  hasUnifiedBareV4AHunk,
+  isV4APatchInput,
+  parseUnifiedBareV4APatch,
+  parseUnifiedCountedAsV4APatch,
+  parseV4APatch,
+  prepareInput,
+} from '../parsing.mjs';
+import { preValidateNativeBatch, resolveV4AEntryPath, splitParsedModifyWaves } from '../paths.mjs';
+import { rewriteParsedReadRedirects, rewriteV4AReadRedirects } from '../read-redirects.mjs';
+import { setPatchReplayPreSnapshots } from '../replay-capture.mjs';
+import { capturePatchRollbackState, restorePatchRollbackState } from '../rollback-state.mjs';
+import { coalesceCompatibleV4ASections } from '../section-coalesce.mjs';
+import { registerCommittedPatchUiDiff } from '../ui-diff.mjs';
+import {
+  applyV4ARenameSections,
+  convertV4ASectionsToUnifiedPatch,
+  formatV4ARenameSuccessLines,
+  planV4ARenameSections,
+} from '../v4a-convert.mjs';
+import { applyParsedWave, isPatchErrorText } from '../wave.mjs';
+
+// Convert the body to a unified patch (V4A / bare-@@ / counted-unified
+// fallback), split it into unique-target waves and pre-validate each. Returns
+// { error } for the outcomes the tool reports as text; parse failures throw.
+export async function prepareCodexBatch({
+  patchStr,
+  requestedFormat,
+  basePath,
+  readStateScope,
+  preParsedV4ASections,
+  v4aConvertOpts,
+  mutationPlan,
+}) {
+  let inputPatchStr = patchStr;
+  let v4aRenamePlan = null;
+  if (isV4APatchInput(patchStr, requestedFormat)) {
+    try {
+      const parsedSections =
+        preParsedV4ASections || rewriteV4AReadRedirects(parseV4APatch(patchStr), basePath, readStateScope);
+      const allSections = coalesceCompatibleV4ASections(parsedSections, basePath);
+      v4aRenamePlan = await planV4ARenameSections(allSections, basePath);
+      inputPatchStr = await convertV4ASectionsToUnifiedPatch(v4aRenamePlan.remainingSections, basePath, v4aConvertOpts);
+      if (v4aRenamePlan.renameSections.length > 0) {
+        mutationPlan =
+          v4aRenamePlan.remainingSections.length > 0
+            ? { sourceTool: 'apply_patch', engine: 'v4a-patch', reason: 'v4a-mixed' }
+            : { sourceTool: 'apply_patch', engine: 'v4a-rename', reason: 'v4a-move' };
+      }
+    } catch (err) {
+      throw new Error(`apply_patch: V4A parse failed — ${err?.message || String(err)}`);
+    }
+  } else if (requestedFormat !== 'unified' && hasUnifiedBareV4AHunk(patchStr)) {
+    try {
+      const sections = rewriteV4AReadRedirects(parseUnifiedBareV4APatch(patchStr), basePath, readStateScope);
+      inputPatchStr = await convertV4ASectionsToUnifiedPatch(sections, basePath, v4aConvertOpts);
+    } catch (err) {
+      throw new Error(`apply_patch: bare @@ parse failed — ${err?.message || String(err)}`);
+    }
+  }
+  let normalizedPatchStr = prepareInput(inputPatchStr);
+  const v4aRenameOnly = v4aRenamePlan?.renameSections?.length > 0 && v4aRenamePlan.remainingSections.length === 0;
+
+  let parsed = [];
+  if (!v4aRenameOnly)
+    try {
+      parsed = parsePatch(normalizedPatchStr);
+    } catch (err) {
+      if (!canFallbackCountedUnified(patchStr, requestedFormat, err)) {
+        throw new Error(
+          `apply_patch: parse failed — ${err?.message || String(err)}; prefer V4A envelope for multi-hunk edits (no @@ line counts)`
+        );
+      }
+      try {
+        const sections = rewriteV4AReadRedirects(parseUnifiedCountedAsV4APatch(patchStr), basePath, readStateScope);
+        inputPatchStr = await convertV4ASectionsToUnifiedPatch(sections, basePath, v4aConvertOpts);
+        normalizedPatchStr = prepareInput(inputPatchStr);
+        parsed = parsePatch(normalizedPatchStr);
+        mutationPlan = {
+          sourceTool: 'apply_patch',
+          engine: 'v4a-patch',
+          reason: 'unified-count-fallback',
+        };
+      } catch (fallbackErr) {
+        throw new Error(
+          `apply_patch: parse failed — ${err?.message || String(err)}; V4A fallback failed — ${fallbackErr?.message || String(fallbackErr)}`
+        );
+      }
+    }
+  if (!v4aRenameOnly) {
+    parsed = rewriteParsedReadRedirects(parsed, basePath, readStateScope);
+  }
+  if (!v4aRenameOnly && (!Array.isArray(parsed) || parsed.length === 0)) {
+    return { error: 'Error: patch contained no file sections' };
+  }
+  // Validate Codex's one-operation-per-target rule and build one batch.
+  let parsedWaves = v4aRenameOnly ? [] : [parsed];
+  if (!v4aRenameOnly) {
+    try {
+      parsedWaves = splitParsedModifyWaves(parsed, basePath);
+    } catch (err) {
+      return { error: `Error: ${err?.message || String(err)}` };
+    }
+  }
+
+  if (!v4aRenameOnly) {
+    try {
+      await ensureNativePatchBinaryAvailable();
+    } catch (err) {
+      return { error: `Error: ${err?.message || String(err)}` };
+    }
+  }
+  // Pre-validate each wave independently: a wave only ever holds unique
+  // targets, so the native batch's per-file semantics stay intact.
+  const waveDispatch = [];
+  if (!v4aRenameOnly) {
+    try {
+      for (const wparsed of parsedWaves) {
+        const { entries, headerRewrites } = await preValidateNativeBatch(wparsed, basePath);
+        waveDispatch.push({ parsed: wparsed, entries, headerRewrites });
+      }
+    } catch (err) {
+      return { error: `Error: ${err?.message || String(err)}` };
+    }
+  }
+
+  const lockPaths = [
+    ...new Set(waveDispatch.flatMap((wd) => wd.entries.map((entry) => entry.fullPath))),
+    ...(v4aRenamePlan?.renameSections || []).flatMap((section) => {
+      const src = resolveV4AEntryPath(basePath, section.path);
+      const dest = resolveV4AEntryPath(basePath, section.movePath);
+      return [src, dest];
+    }),
+  ];
+  return { waveDispatch, v4aRenamePlan, v4aRenameOnly, mutationPlan, lockPaths };
+}
+
+// Apply the validated batch in one shot: renames first, then the single wave
+// via applyParsedWave (native + JS split). Returns the model-surface text.
+export async function runCodexBatch({ batch, basePath, v4aConvertOpts, rejectedV4AHunks, waveOpts }) {
+  const { waveDispatch, v4aRenamePlan, v4aRenameOnly, mutationPlan } = batch;
+  let v4aRenameResults = [];
+  if (v4aRenamePlan?.renameSections?.length) {
+    v4aRenameResults = await applyV4ARenameSections(v4aRenamePlan.renameSections, basePath, v4aConvertOpts);
+  }
+  if (v4aRenameOnly) {
+    const lines = formatV4ARenameSuccessLines(v4aRenameResults);
+    if (lines.length === 0) return 'Error: patch contained no applicable file sections';
+    return wrapPatchMutationOutput(`${lines.join('\n')}\n`, mutationPlan, { executor: 'v4a-rename' });
+  }
+  const res = await applyParsedWave(waveDispatch[0], basePath, waveOpts);
+  const executor = res.executor;
+  if (res.error) return wrapPatchMutationOutput(res.error, mutationPlan, { executor });
+  let combined = res.text;
+  const renameLines = formatV4ARenameSuccessLines(v4aRenameResults);
+  if (renameLines.length > 0 && !isPatchErrorText(combined)) {
+    combined = `${renameLines.join('\n')}\n${combined}`;
+  }
+  if (!isPatchErrorText(combined) && rejectedV4AHunks.length > 0) {
+    const tail = [
+      '',
+      `hunk-level rejected (rejectPartial=false, V4A): ${rejectedV4AHunks.length}`,
+      ...rejectedV4AHunks.map(
+        (r) =>
+          `  REJECT ${r.file || '(unknown)'} — ${String(r.reason || '')
+            .split(';')[0]
+            .trim()}`
+      ),
+    ];
+    return wrapPatchMutationOutput(`${combined}\n${tail.join('\n')}`, mutationPlan, { executor });
+  }
+  return wrapPatchMutationOutput(combined, mutationPlan, { executor });
+}
+
+// Codex mode applies the validated batch in one shot. A batch that mixes
+// native (in-base) with JS (out-of-base) entries commits the native writes
+// before the JS entries run. Snapshot every touched path up front and restore
+// it whenever the batch fails — by returned Error text OR by a thrown error
+// (V4A rename, persistence) — so mode:"atomic" really is all-or-nothing
+// instead of leaving an earlier commit in place.
+export function applyCodexBatchWithRollback({ batch, basePath, dryRun, readStateScope, options, runBatch }) {
+  const { lockPaths, v4aRenamePlan } = batch;
+  const registerUiDiff = (rollbackSnapshots) =>
+    registerCommittedPatchUiDiff({
+      callId: options?.toolCallId,
+      sessionId: options?.sessionId,
+      basePath,
+      beforeSnapshots: rollbackSnapshots,
+      paths: lockPaths,
+      renameSections: v4aRenamePlan?.renameSections,
+    });
+  return withBuiltinPathLocks(lockPaths, () =>
+    withAdvisoryLocks(lockPaths, async () => {
+      let rollbackSnapshots = [];
+      if (!dryRun) {
+        try {
+          rollbackSnapshots = capturePatchRollbackState(lockPaths);
+          setPatchReplayPreSnapshots(options?.replayCapture, rollbackSnapshots);
+        } catch (err) {
+          return `Error: ${err?.message || String(err)}`;
+        }
+      }
+      // Restoration errors are never swallowed: an incomplete rollback is
+      // reported verbatim so the caller never reads a false all-or-nothing.
+      const withRollback = (outcome) => {
+        const rollbackErrors = restorePatchRollbackState(rollbackSnapshots, readStateScope);
+        return {
+          text:
+            rollbackErrors.length === 0
+              ? `${outcome}\n--- rolled back: every touched path was restored to its pre-patch state ---`
+              : [outcome, '--- rollback incomplete ---', ...rollbackErrors].join('\n'),
+          rollbackErrors,
+        };
+      };
+      let outcome;
+      try {
+        outcome = await runBatch();
+      } catch (err) {
+        // A thrown failure (e.g. V4A rename) took the same path to disk as a
+        // returned one, so it takes the same path back out.
+        if (dryRun) throw err;
+        const rolledBack = withRollback(`Error: ${err?.message || String(err)}`);
+        if (rolledBack.rollbackErrors.length > 0) registerUiDiff(rollbackSnapshots);
+        return rolledBack.text;
+      }
+      if (dryRun) return outcome;
+      if (!isPatchErrorText(outcome)) {
+        registerUiDiff(rollbackSnapshots);
+        return outcome;
+      }
+      const rolledBack = withRollback(outcome);
+      if (rolledBack.rollbackErrors.length > 0) registerUiDiff(rollbackSnapshots);
+      return rolledBack.text;
+    })
+  );
+}