mixdog 0.9.174 → 1.0.0

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/benign-exit.mjs

@@ -14,6 +14,8 @@ import {
 // shared shell tokenizers, so quoted/commented `;` `|` `grep` can never
 // masquerade as a connector/command and hide a real failure.
 const _SEARCH_HEADS = new Set(['select-string', 'sls', 'grep', 'egrep', 'fgrep', 'findstr']);
+// `git diff` flags whose exit 1 reports a difference, not a failure.
+export const GIT_DIFF_EXIT_SIGNAL_FLAGS = new Set(['--exit-code', '--quiet', '--check']);
 const _GIT_GLOBAL_VALUE_OPTS = new Set([
   '-c',
   '-C',
@@ -75,12 +77,14 @@ export function _isBenignSearchExitOne(command, exitCode, signal, stderr) {
   const head = _normalizeHead(tokens[0]);
   if (_SEARCH_HEADS.has(head)) return true;
   if (head !== 'git') return false;
-  // `git [global-opts] diff ...` only — exact `diff` subcommand, never
-  // diff-index/diff-files/difftool — with exit-code semantics.
+  // `git [global-opts] grep ...` (no match), or `git [global-opts] diff ...`
+  // only — exact `diff` subcommand, never diff-index/diff-files/difftool —
+  // with exit-code semantics.
   let i = 1;
   while (i < tokens.length && tokens[i].startsWith('-')) {
     i += _GIT_GLOBAL_VALUE_OPTS.has(tokens[i]) && !tokens[i].includes('=') ? 2 : 1;
   }
+  if (tokens[i] === 'grep') return true;
   if (tokens[i] !== 'diff') return false;
-  return tokens.slice(i + 1).some((t) => t === '--exit-code' || t === '--quiet' || t === '--check');
+  return tokens.slice(i + 1).some((t) => GIT_DIFF_EXIT_SIGNAL_FLAGS.has(t));
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/deadline-plan.mjs

@@ -17,13 +17,16 @@ const TIMER_MAX_MS = 2_147_483_647;
 // completion is pushed to the owner. MIXDOG_SHELL_AUTO_BACKGROUND_MS
 // overrides; an explicit 0 disables. Gated on backgroundOnTimeout so
 // disabled background tasks remain foreground.
-function autoBackgroundBudget(backgroundOnTimeout, timeout) {
+// A per-call wait_ms replaces that default for the call, capped by the
+// foreground maximum.
+function autoBackgroundBudget(backgroundOnTimeout, timeout, waitMs, maxForegroundMs) {
   const raw = process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS;
   const parsed = Number(raw);
-  const defaultMs =
+  let defaultMs =
     raw != null && String(raw).trim() !== '' && Number.isFinite(parsed) && parsed >= 0
       ? Math.floor(parsed)
       : DEFAULT_SHELL_AUTO_BACKGROUND_MS;
+  if (waitMs > 0) defaultMs = Math.min(waitMs, maxForegroundMs);
   if (!backgroundOnTimeout || defaultMs <= 0) return 0;
   return timeout > 0 ? Math.min(defaultMs, timeout) : defaultMs;
 }
@@ -70,6 +73,11 @@ export function planShellDeadlines({ args, wmicRewrite, backgroundOnTimeout }) {
     // Soft/interrupt promotion happens before the foreground cap; an explicit
     // total deadline is preserved separately.
     backgroundDeadlineMs: hasHardDeadline ? totalTimeout : backgroundMaxBudget(),
-    autoBackgroundMs: autoBackgroundBudget(backgroundOnTimeout, timeout),
+    autoBackgroundMs: autoBackgroundBudget(
+      backgroundOnTimeout,
+      timeout,
+      typeof args.wait_ms === 'number' ? args.wait_ms : 0,
+      maxForegroundMs
+    ),
   };
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/spawn-env.mjs

@@ -1,3 +1,4 @@
+import { resourceAdmission } from '../../../../../shared/resource-admission.mjs';
 import {
   applyShellEgressPolicy,
   scrubLoaderVars,
@@ -8,6 +9,9 @@ import {
 export function buildShellSpawnEnv(cwd, baseEnv = process.env) {
   const spawnEnv = {
     ...baseEnv,
+    // Lets fan-out-heavy children (the test runner) size themselves to their
+    // share of the machine: up to this many shells run concurrently.
+    MIXDOG_SHELL_CONCURRENCY_CAP: String(resourceAdmission.limits.maxShells),
     LANG: 'C.UTF-8',
     LC_ALL: 'C.UTF-8',
     MIXDOG_SESSION_CWD: String(cwd || ''),

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -38,9 +38,9 @@ export { buildShellSpawnEnv } from './bash-tool/spawn-env.mjs';
 export { executeTaskTool } from './task-tool.mjs';
 
 // Reads cached after a mutating command must not serve pre-command state. A
-// promoted command has barely started when the tool returns, so the
-// invalidation repeats when the background job actually settles.
-function settleMutationCaches(shellEffects, backgroundJobId) {
+// promoted command has barely started when the tool returns and a queued one
+// has not started at all, so the invalidation repeats when it settles.
+function settleMutationCaches(shellEffects, backgroundJobId, queuedSettled = null) {
   const invalidate = () => {
     if (shellEffects.mutationMode === 'paths') {
       invalidateBuiltinResultCache(shellEffects.paths);
@@ -54,6 +54,7 @@ function settleMutationCaches(shellEffects, backgroundJobId) {
   if (backgroundJobId && shellEffects.mutationMode !== 'none') {
     subscribeShellJobSettled(backgroundJobId, invalidate);
   }
+  if (queuedSettled && shellEffects.mutationMode !== 'none') queuedSettled.then(invalidate).catch(() => {});
 }
 
 export async function executeBashTool(args, workDir, options = {}) {
@@ -83,6 +84,7 @@ export async function executeBashTool(args, workDir, options = {}) {
   let combinedAbort = null;
   let backgrounded = false;
   let backgroundJobId = null;
+  let queuedSettled = null;
   try {
     const invocation = await planShellInvocation({ command, resolvedSpec, cwd: bashWorkDir });
     if (invocation.failure) return invocation.failure;
@@ -117,6 +119,7 @@ export async function executeBashTool(args, workDir, options = {}) {
     });
     backgrounded = result.backgrounded === true;
     backgroundJobId = backgrounded ? result.jobId || null : null;
+    queuedSettled = backgrounded ? result.settled || null : null;
     const stdout = stripAnsi(result.stdout || '');
     const stderr = stripAnsi(result.stderr || '');
     recordShellCaptureTelemetry(options?.resultTelemetry, result, stdout, stderr);
@@ -140,11 +143,14 @@ export async function executeBashTool(args, workDir, options = {}) {
   } finally {
     combinedAbort?.cleanup?.();
     if (hoisted.hoistPath) {
-      // A promoted command still runs from the hoisted file; a foreground one
-      // is done with it now (an unconfirmed kill may keep it locked — retried).
-      if (backgrounded) cleanupArtifactOnTaskSettled(hoisted.hoistPath, backgroundJobId);
+      // A promoted or queued command still runs from the hoisted file; a
+      // foreground one is done with it now (an unconfirmed kill may keep it
+      // locked — retried).
+      if (queuedSettled) {
+        queuedSettled.then(() => removeTransportFileNow(hoisted.hoistPath)).catch(() => {});
+      } else if (backgrounded) cleanupArtifactOnTaskSettled(hoisted.hoistPath, backgroundJobId);
       else removeTransportFileNow(hoisted.hoistPath);
     }
-    settleMutationCaches(shellEffects, backgroundJobId);
+    settleMutationCaches(shellEffects, backgroundJobId, queuedSettled);
   }
 }

package/src/runtime/agent/orchestrator/tools/builtin/binary-file.mjs

@@ -3,6 +3,7 @@ import { open } from 'node:fs/promises';
 
 const HEAD_CAP = 64 * 1024;
 const TAIL_SIZE = 4 * 1024;
+const BINARY_PREVIEW_BYTES = 256;
 
 function hasUtf16Bom(buf, length = buf?.length || 0) {
   return length >= 2 && ((buf[0] === 0xff && buf[1] === 0xfe) || (buf[0] === 0xfe && buf[1] === 0xff));
@@ -79,7 +80,11 @@ export function isBinaryBuffer(buf, fileSize = buf?.length || 0) {
  * Returns the head bytes even when the null marker is in the tail so callers
  * can render a hex preview without reopening the file.
  */
-export async function inspectBinaryFile(fullPath, fileSize = 0, { previewBytes = 256, handle = null } = {}) {
+export async function inspectBinaryFile(
+  fullPath,
+  fileSize = 0,
+  { previewBytes = BINARY_PREVIEW_BYTES, handle = null } = {}
+) {
   const headBytes = fileSize > 0 ? Math.min(fileSize, HEAD_CAP) : HEAD_CAP;
   let fh;
   try {
@@ -107,8 +112,6 @@ export async function inspectBinaryFile(fullPath, fileSize = 0, { previewBytes =
   }
 }
 
-const BINARY_PREVIEW_BYTES = 256;
-
 export function formatBinaryReadPreviewFromBuffer(
   buffer,
   displayPath,

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -48,7 +48,7 @@ export const BUILTIN_TOOLS = [
       compressible: false,
     },
     description:
-      "Read file windows or images. One call per read stage: {file_path, offset, limit} entries for every located site (≤10 per call), never a whole large file. Content in context is never read again. Missing paths are reported, never replaced. Directories: list. Binaries: bounded hex. Rows carry no line numbers; `[lines a-b]` gives each block's range. Never count rows: before writing a line number, copy it from grep, code_graph or git diff output; otherwise cite path and symbol.",
+      "Read file windows or images. One call per read stage: {file_path, offset, limit} entries for every located site (≤10 files per call), never a whole large file. Content in context is never read again. Missing paths are reported, never replaced. Directories: list. Binaries: bounded hex. Rows carry no line numbers; `[lines a-b]` gives each block's range. Never count rows: before writing a line number, copy it from grep, code_graph or git diff output; otherwise cite path and symbol.",
     inputSchema: {
       type: 'object',
       properties: {
@@ -66,7 +66,7 @@ export const BUILTIN_TOOLS = [
                     type: 'object',
                     properties: {
                       file_path: { type: 'string' },
-                      offset: { type: 'integer', minimum: 1, maximum: PUBLIC_READ_WINDOW_MAX },
+                      offset: { type: 'integer', minimum: 1 },
                       limit: { type: 'integer', minimum: 1, maximum: PUBLIC_READ_WINDOW_MAX },
                     },
                     required: ['file_path'],
@@ -82,7 +82,6 @@ export const BUILTIN_TOOLS = [
         offset: {
           type: 'integer',
           minimum: 1,
-          maximum: PUBLIC_READ_WINDOW_MAX,
           description: '1-based start line; default 1; batch default.',
         },
         limit: {
@@ -147,7 +146,7 @@ export const BUILTIN_TOOLS = [
       openWorldHint: true,
       compressible: true,
     },
-    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 10s foreground window (not a timeout), unfinished work continues under task_id; use task wait, not read polling.'}`,
+    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 10s foreground window (not a timeout; wait_ms extends it up to 120s for one call, e.g. a test suite), unfinished work continues under task_id; use task wait, not read polling. If no execution slot frees within the admission wait, the command is queued as a background task with a task_id.'}`,
     inputSchema: {
       type: 'object',
       properties: {
@@ -158,6 +157,13 @@ export const BUILTIN_TOOLS = [
           description:
             'Hard kill deadline in ms (omit or 0 = none), separate from the 10s foreground window; set one for throwaway probes so a slow check fails fast.',
         },
+        wait_ms: {
+          type: 'integer',
+          minimum: 1000,
+          maximum: 120000,
+          description:
+            'Foreground wait in ms before unfinished work continues as a background task (default 10000); raise it for a command that should return its result in this call.',
+        },
       },
       required: ['command'],
       additionalProperties: false,
@@ -364,7 +370,7 @@ export const BUILTIN_TOOLS = [
           description: 'Known directory; defaults to the current Project.',
         },
         hidden: { type: 'boolean', description: 'Include dotfiles.' },
-        meta: { type: 'boolean', description: 'Per-entry size bytes, UTC mtime, octal mode.' },
+        meta: { type: 'boolean', description: 'Per-entry size bytes, UTC mtime, octal mode; text files also get a line count.' },
         limit: {
           type: 'integer',
           minimum: 0,

package/src/runtime/agent/orchestrator/tools/builtin/device-paths.mjs

@@ -1,206 +1 @@
-// G6: device path block list (reference parity). Reading these paths
-// would either hang (waiting for stdin / tty) or produce infinite output
-// (/dev/zero, /dev/random). The device block list catches pseudo-files on
-// POSIX hosts that a user-allowed path can still hit.
-const BLOCKED_DEVICE_PATHS = new Set([
-  '/dev/zero',
-  '/dev/random',
-  '/dev/urandom',
-  '/dev/full',
-  '/dev/stdin',
-  '/dev/tty',
-  '/dev/console',
-  '/dev/stdout',
-  '/dev/stderr',
-  '/dev/fd/0',
-  '/dev/fd/1',
-  '/dev/fd/2',
-]);
-
-export function isBlockedDevicePath(p) {
-  if (BLOCKED_DEVICE_PATHS.has(p)) return true;
-  // /proc/self/fd/0-2 and /proc/<pid>/fd/0-2 are Linux aliases for stdio.
-  if (
-    typeof p === 'string' &&
-    p.startsWith('/proc/') &&
-    (p.endsWith('/fd/0') || p.endsWith('/fd/1') || p.endsWith('/fd/2'))
-  )
-    return true;
-  return false;
-}
-
-// R1: UNC / SMB share paths (\\server\share or //server/share). Reading these
-// causes Windows to auto-authenticate to the remote host, leaking the NTLM
-// hash of the current user to any attacker-controlled SMB target. The prefix
-// is rejected before stat. Accepts both
-// backslash and forward-slash leaders so a normalize that picked either form
-// is caught.
-export function isUncPath(p) {
-  if (typeof p !== 'string' || p.length < 2) return false;
-  return (p[0] === '\\' && p[1] === '\\') || (p[0] === '/' && p[1] === '/');
-}
-
-// R2: Windows reserved device basenames (CON, NUL, PRN, AUX, COM0-9, LPT0-9)
-// and raw-device namespace prefixes (\\.\ DosDevices, \\?\ NT namespace).
-// CON/NUL etc. are kernel-level aliases that never resolve to real files
-// when used as bare names; \\.\PhysicalDrive0 / \\.\CON allow raw device
-// access. Basenames with a real extension (nul.bin) are ordinary files.
-const WIN_RESERVED_BASENAMES = new Set([
-  'CON',
-  'NUL',
-  'PRN',
-  'AUX',
-  // CONIN$ / CONOUT$ are the console input/output device aliases; the
-  // trailing '$' is part of the name and survives stem extraction
-  // (cut happens at the first '.'/':' only).
-  'CONIN$',
-  'CONOUT$',
-  'COM0',
-  'COM1',
-  'COM2',
-  'COM3',
-  'COM4',
-  'COM5',
-  'COM6',
-  'COM7',
-  'COM8',
-  'COM9',
-  'LPT0',
-  'LPT1',
-  'LPT2',
-  'LPT3',
-  'LPT4',
-  'LPT5',
-  'LPT6',
-  'LPT7',
-  'LPT8',
-  'LPT9',
-  // Win32 normalizes the Latin-1 superscript digits ¹ (U+00B9), ²
-  // (U+00B2), ³ (U+00B3) to 1/2/3 when resolving device names, so
-  // COM¹/COM²/COM³ and LPT¹/LPT²/LPT³ open the real COM1-3/LPT1-3
-  // devices. toUpperCase() leaves these codepoints unchanged, so they
-  // must be listed literally.
-  'COM\u00B9',
-  'COM\u00B2',
-  'COM\u00B3',
-  'LPT\u00B9',
-  'LPT\u00B2',
-  'LPT\u00B3',
-]);
-// Unicode invisibles (BOM, zero-width joiners, bidi controls) that Win32
-// path-open codepaths collapse or ignore.
-const WIN32_IGNORED_INVISIBLES = /[\uFEFF\u200B-\u200F\u202A-\u202E\u2066-\u2069]/g;
-export function isWindowsDevicePath(p) {
-  if (typeof p !== 'string' || p.length === 0) return false;
-  // \\.\ and \\?\ raw-device / DOS-device namespace (both slash forms).
-  if (p.startsWith('\\\\.\\') || p.startsWith('\\\\?\\')) return true;
-  if (p.startsWith('//./') || p.startsWith('//?/')) return true;
-  // Reserved basenames (CON/NUL/PRN/AUX/COM*/LPT*) are device aliases ONLY on
-  // Windows; on POSIX a file literally named `con.txt` is a normal regular
-  // file. Gate the basename check to win32 so non-Windows reads of such names
-  // aren't false-rejected (the \\.\ / \\?\ namespace checks above stay
-  // unconditional). reviewer-flagged false positive.
-  if (process.platform !== 'win32') return false;
-  // Basename match, case-insensitive, extension-stripped. R12: splitting
-  // on '.' alone missed NTFS ADS suffixes (NUL:stream, CON:stream) and
-  // trailing Win32-ignored dots/spaces ("CON. ", "NUL. ") that the
-  // kernel still resolves to the reserved device. Compute the stem by
-  // cutting at the FIRST '.' or ':' in the basename, then stripping
-  // any trailing dots/spaces that Win32 silently drops.
-  const lastSep = Math.max(p.lastIndexOf('\\'), p.lastIndexOf('/'));
-  const base = lastSep >= 0 ? p.slice(lastSep + 1) : p;
-  let cut = base.length;
-  for (let i = 0; i < base.length; i += 1) {
-    const ch = base.charCodeAt(i);
-    if (ch === 0x2e /* . */ || ch === 0x3a /* : */) {
-      cut = i;
-      break;
-    }
-  }
-  let stem = base.slice(0, cut);
-  // R14: strip Unicode invisibles (BOM, zero-width joiners, bidi controls)
-  // BEFORE the trailing-dot / reserved-name checks. Win32 GetFinalPathName
-  // and a number of file APIs collapse / ignore these characters when
-  // opening, so "CON\u200B" or "\uFEFFCON" can resolve to the CON device
-  // even though byte-comparison says "not reserved". Drop them defensively.
-  stem = stem.replace(WIN32_IGNORED_INVISIBLES, '');
-  // Strip trailing dots / spaces — Win32 ignores them when opening a
-  // file, so "CON. " and "CON " resolve to CON. Loop instead of regex
-  // to keep allocation-free hot path.
-  let end = stem.length;
-  while (end > 0) {
-    const ch = stem.charCodeAt(end - 1);
-    if (ch === 0x2e /* . */ || ch === 0x20 /* SP */) {
-      end -= 1;
-      continue;
-    }
-    break;
-  }
-  stem = stem.slice(0, end).toUpperCase();
-  if (!WIN_RESERVED_BASENAMES.has(stem)) return false;
-  // Bare device alias only (NUL, CON, …). A dotted extension means a normal
-  // file even when the stem matches a reserved name (dir/nul.bin).
-  return cut >= base.length;
-}
-
-// R12: Win32 path-component guard. Rejects any path component that
-// (a) ends in '.' or ' ' — Win32 silently strips trailing dots/spaces
-// when opening, so the kernel resolves a DIFFERENT path than the one
-// the guard sees, bypassing string-based device/UNC checks; or
-// (b) contains ':' after the optional `<drive>:` prefix — colon inside
-// a component names an NTFS Alternate Data Stream (e.g. `file.txt:hidden`),
-// which is a hidden writable channel attached to another file.
-// Legitimate Windows filenames never have trailing dot/space or embedded
-// ':' in any component, so unconditional rejection is safe.
-export function hasUnsafeWin32Component(p) {
-  if (process.platform !== 'win32') return false;
-  if (typeof p !== 'string' || p.length === 0) return false;
-  // Strip optional drive prefix (`C:` / `c:`) so the drive colon is not
-  // mistaken for an ADS marker. \\.\ / \\?\ raw-device prefixes are
-  // already rejected by isWindowsDevicePath; treat their bytes as
-  // ordinary components here so a `\\?\C:\foo:stream` still trips.
-  let rest = p;
-  if (
-    rest.length >= 2 &&
-    rest.charCodeAt(1) === 0x3a /* : */ &&
-    ((rest.charCodeAt(0) >= 0x41 && rest.charCodeAt(0) <= 0x5a) ||
-      (rest.charCodeAt(0) >= 0x61 && rest.charCodeAt(0) <= 0x7a))
-  ) {
-    rest = rest.slice(2);
-  }
-  // Split on both Win32 separators.
-  const parts = rest.split(/[\\/]+/);
-  for (const rawPart of parts) {
-    if (!rawPart) continue;
-    // R14: strip Unicode invisibles (BOM, zero-width joiners, bidi controls)
-    // BEFORE the trailing-dot / ADS-colon checks. Win32 ignores these
-    // characters in many path-open codepaths, so "foo \u200B" (trailing
-    // space + ZWSP) or "name\uFEFF:stream" must still trip the guard.
-    const part = rawPart.replace(WIN32_IGNORED_INVISIBLES, '');
-    if (!part) continue;
-    // `.` and `..` are the standard current/parent-dir components — they end
-    // in '.' but are NOT a trailing-dot bypass, so exempt them (without this
-    // a default relative path like "." or "src/.." is rejected on Windows).
-    // Any other trailing dot/space is still unsafe.
-    if (part === '.' || part === '..') continue;
-    const last = part.charCodeAt(part.length - 1);
-    if (last === 0x2e /* . */ || last === 0x20 /* SP */) return true;
-    if (part.indexOf(':') >= 0) return true;
-  }
-  return false;
-}
-
-// R2: Stat-based special-file reject. FIFOs, character devices, block devices,
-// and sockets pass a normal statSync but reading them either hangs (FIFO with
-// no writer, socket) or produces unbounded output (/dev/zero, /dev/random).
-// Must be called AFTER statSync (or fstatSync) — the string-based device
-// guard catches well-known paths, this catches arbitrary user paths that
-// happen to point at a special inode (custom mknod, symlink targets, etc.).
-export function isSpecialFileStat(st) {
-  if (!st || typeof st !== 'object') return false;
-  try {
-    return st.isFIFO() || st.isCharacterDevice() || st.isBlockDevice() || st.isSocket();
-  } catch {
-    return false;
-  }
-}
+export * from '../../../../shared/device-paths.mjs';

package/src/runtime/agent/orchestrator/tools/builtin/find-files-tool.mjs

@@ -247,7 +247,7 @@ function invalidWindowError(field, value) {
 // The find request as the walk sees it: the root, the name pattern (a glob
 // in `path` becomes the pattern), the filters and the page.
 function findFilesRequest(args, workDir) {
-  args.path = coerceReadFamilyPathArg(args.path, workDir);
+  args.path = coerceReadFamilyPathArg(args.path);
   args.path = normalizeInputPath(args.path);
   let inputPath = args.path || '.';
   let namePattern = typeof args.name === 'string' ? args.name : null;

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -3,6 +3,7 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 import { tokenizeDirectArgv } from './shell-direct-exe.mjs';
+import { GIT_DIFF_EXIT_SIGNAL_FLAGS } from './bash-tool/benign-exit.mjs';
 import { withBuiltinPathLocks } from './path-locks.mjs';
 import { withAdvisoryLocks } from './advisory-lock.mjs';
 import { withGitRepoReadLock, withGitRepoWriteLock } from './git-repo-rw-lock.mjs';
@@ -154,8 +155,13 @@ function commandResult(plan, result, limit) {
   const output = capOutput(appendText(String(result.stdout || ''), String(result.stderr || '')), limit);
   if (succeeded(result)) return { text: output, failed: false };
   const processError = result.error || result.timedOut || result.aborted || result.overflow || result.exitCode == null;
+  // An exit signal is still a non-zero exit, so a command array stops on it;
+  // the outcome line only keeps the card from reporting a failure.
+  const exitHeader = exitSignal(plan, result)
+    ? `exit ${result.exitCode}\n[outcome: no-match]`
+    : `exit ${result.exitCode}`;
   return {
-    text: appendText(processError ? fail(gitFailureReason(plan, result)) : `exit ${result.exitCode}`, output),
+    text: appendText(processError ? fail(gitFailureReason(plan, result)) : exitHeader, output),
     failed: true,
   };
 }
@@ -337,6 +343,18 @@ function succeeded(result) {
   return result?.exitCode === 0 && !result.error && !result.timedOut && !result.aborted && !result.overflow;
 }
 
+// `git grep` exits 1 for no match and `git diff --exit-code/--quiet/--check`
+// exits 1 to report a difference; the shell tool marks the same exits as
+// signals, so the git tool does too.
+function exitSignal(plan, result) {
+  if (result.exitCode !== 1 || String(result.stderr || '').trim()) return false;
+  if (plan.operation === 'grep') return true;
+  if (plan.operation !== 'diff') return false;
+  const separator = plan.args.indexOf('--');
+  const options = separator === -1 ? plan.args : plan.args.slice(0, separator);
+  return options.some((arg) => GIT_DIFF_EXIT_SIGNAL_FLAGS.has(arg));
+}
+
 // ENOENT from the spawn itself is a capability fact, not a git error: the
 // executable is absent. Naming it stops the caller from re-running git a
 // different way to find out.
@@ -780,8 +798,26 @@ function splitChainedGitCommands(command) {
   return commands.length > 1 ? commands : null;
 }
 
-export async function executeGitTool(input, workDir, options = {}) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) return fail('git requires an arguments object');
+// The tool only runs git, so a submitted command that omits the leading `git`
+// ("status --short") gets it instead of a rejection. Only whole submitted
+// commands are prefixed; a `&&` piece after the first still has to be a full
+// git command, so non-git chain segments stay refused.
+function withGitPrefix(command) {
+  if (typeof command !== 'string') return command;
+  const text = String(unwrapQuotedCommand(command)).trim();
+  const first = text ? tokenizeDirectArgv(text)?.[0] : '';
+  if (!first || /(^|[\\/])git(?:\.exe)?$/i.test(first)) return command;
+  return `git ${text}`;
+}
+
+export async function executeGitTool(rawInput, workDir, options = {}) {
+  if (!rawInput || typeof rawInput !== 'object' || Array.isArray(rawInput))
+    return fail('git requires an arguments object');
+  const input = {
+    ...rawInput,
+    command: Array.isArray(rawInput.command) ? rawInput.command.map(withGitPrefix) : withGitPrefix(rawInput.command),
+  };
+  if (rawInput.command === undefined) delete input.command;
   const action = input.action ?? 'command';
   if (action === 'stage') {
     if (input.command !== undefined || input.include_stage_ids !== undefined) {

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-path-fanout.mjs

@@ -16,7 +16,7 @@ import { runRgWindowedLines } from '../native-search-runner.mjs';
 import { statReachable } from '../fs-reachability.mjs';
 import { markScopedCacheIncomplete } from '../../../session/cache/scoped-cache-outcome.mjs';
 import { GREP_CONTEXT_MAX, hasUnsupportedRipgrepRegex } from '../arg-guard.mjs';
-import { coerceNonNegInt, resolveHeadLimit } from './search-input-helpers.mjs';
+import { resolveSearchWindow } from './search-input-helpers.mjs';
 import { formatGrepFanoutSections, formatGrepOutput, grepNoMatchesBody } from './grep-output.mjs';
 import { expandGrepAnchorContextOutput } from './grep-context-expander.mjs';
 
@@ -55,10 +55,8 @@ function combinedPathRequest(args, defaultHeadLimit) {
   const rawMode = typeof args.output_mode === 'string' ? args.output_mode.trim() : '';
   if (!['', 'content', 'content_with_context', 'files_with_matches'].includes(rawMode)) return null;
   const outMode = rawMode === 'files_with_matches' ? 'files_with_matches' : 'content';
-  const hlRaw = coerceNonNegInt(args.head_limit);
-  if (Number.isNaN(hlRaw)) return null;
-  const offRaw = coerceNonNegInt(args.offset);
-  if (Number.isNaN(offRaw)) return null;
+  const window = resolveSearchWindow(args, defaultHeadLimit);
+  if (window.error) return null;
   const ctxRaw = args['-C'] !== undefined && args['-C'] !== null && args['-C'] !== '' ? args['-C'] : args.context;
   let contextN = null;
   if (ctxRaw !== undefined && ctxRaw !== null && ctxRaw !== '') {
@@ -69,8 +67,8 @@ function combinedPathRequest(args, defaultHeadLimit) {
   return {
     pattern,
     outMode,
-    headLimit: resolveHeadLimit(hlRaw, defaultHeadLimit),
-    offset: offRaw === null ? 0 : offRaw,
+    headLimit: window.headLimit,
+    offset: window.offset,
     contextN,
     // Leave contextN null for the automatic window: the expander reads that as
     // "no caller-requested radius" and applies the asymmetric default.

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-request.mjs

@@ -3,7 +3,6 @@
 // an early answer (`result`), a delegation to the glob tool (`delegate`), or
 // the resolved `request` the search itself runs from.
 import { isAbsolute } from 'node:path';
-import { markScopedCacheIncomplete } from '../../../session/cache/scoped-cache-outcome.mjs';
 import { applyGrepContextLeadPolicy, GREP_CONTEXT_MAX, hasUnsupportedRipgrepRegex } from '../arg-guard.mjs';
 import { statReachable } from '../fs-reachability.mjs';
 import {
@@ -20,9 +19,9 @@ import { isUncOrSmbPath, resolveSearchScope, uncRefusalMessage } from '../search
 import { _grepDefaultHeadLimit } from './grep-context-expander.mjs';
 import { grepMissingPatternMessage } from './grep-output.mjs';
 import {
-  coerceNonNegInt,
+  capPatternList,
   isRedundantAllFilesGlob,
-  resolveHeadLimit,
+  resolveSearchWindow,
   stringList,
   uniqueStrings,
 } from './search-input-helpers.mjs';
@@ -137,19 +136,9 @@ function resolveGrepWindow(args) {
   // Filename-only and count searches are explicit: callers must opt into
   // `files_with_matches` or `count` when they only need existence/count data.
   const outputMode = rawOutputMode === 'content_with_context' ? 'content' : rawOutputMode || 'content';
-  const headLimitRaw = args.head_limit;
-  const headLimitCoerced = coerceNonNegInt(headLimitRaw);
-  if (Number.isNaN(headLimitCoerced)) {
-    return {
-      result: `Error: invalid limit ${JSON.stringify(headLimitRaw)}; expected a non-negative integer (0 = unlimited)`,
-    };
-  }
-  const headLimit = resolveHeadLimit(headLimitCoerced, _grepDefaultHeadLimit());
-  const offsetCoerced = coerceNonNegInt(args.offset);
-  if (Number.isNaN(offsetCoerced)) {
-    return { result: `Error: invalid offset ${JSON.stringify(args.offset)}; expected a non-negative integer` };
-  }
-  const offset = offsetCoerced || 0;
+  const window = resolveSearchWindow(args, _grepDefaultHeadLimit());
+  if (window.error) return { result: window.error };
+  const { headLimit, headLimitCoerced, offset } = window;
   const context = resolveGrepContextFlags(args, wantAutoContext);
   if (context.result !== undefined) return context;
   return { outputMode, headLimit, headLimitCoerced, offset, ...context };
@@ -215,15 +204,8 @@ function resolveGrepFileType(rawType) {
 // never cache it as complete. Applies to every downstream path (fan-out,
 // chunk-merge, single combined).
 function capGrepPatterns(requested, options) {
-  if (requested.length <= GREP_PATTERN_ARRAY_CAP) {
-    return { patterns: requested, patternCapNote: '', patternCapTotal: 0 };
-  }
-  if (options?.scopedCacheOutcome) markScopedCacheIncomplete(options.scopedCacheOutcome);
-  return {
-    patterns: requested.slice(0, GREP_PATTERN_ARRAY_CAP),
-    patternCapNote: `[capped at ${GREP_PATTERN_ARRAY_CAP} of ${requested.length} patterns]\n`,
-    patternCapTotal: requested.length,
-  };
+  const { patterns, note, total } = capPatternList(requested, GREP_PATTERN_ARRAY_CAP, options);
+  return { patterns, patternCapNote: note, patternCapTotal: total };
 }
 
 // A pattern-less grep with a glob or magic path is a file search in disguise.

package/src/runtime/agent/orchestrator/tools/builtin/lib/list-helpers.mjs

@@ -1,5 +1,7 @@
 import { buildNotFoundHint, finalizeReadFamilyEnoentTail } from '../search-path-diagnostics.mjs';
+import { open } from 'node:fs/promises';
 import { normalizeErrorMessage } from '../path-diagnostics.mjs';
+import { isBinaryBuffer } from '../binary-file.mjs';
 import { isUncPath, isWindowsDevicePath, hasUnsafeWin32Component } from '../device-paths.mjs';
 import { normalizeOutputPath, resolveAgainstCwd } from '../path-utils.mjs';
 
@@ -29,7 +31,7 @@ export function normalizeListHeadLimit(raw, defaultCap) {
 // remote host (NTLM hash leak); a raw-device / reserved-name path can
 // hang or grant raw access. Mirrors the read path's string-based checks.
 // Returns an Error string when the path is blocked, else null.
-export function listGuardPath(p) {
+function listGuardPath(p) {
   if (isUncPath(p))
     return `Error: cannot walk UNC / SMB path (network credential leak risk): ${normalizeOutputPath(p)}`;
   if (isWindowsDevicePath(p))
@@ -53,3 +55,27 @@ export function guardedWalkRoot(inputPath, workDir) {
 export function pageContinuationLine(offset, shown, total) {
   return `... [entries ${offset + 1}-${offset + shown} of ${total}; pass offset:${offset + shown} to continue]`;
 }
+
+const LINE_COUNT_MAX_BYTES = 2 * 1024 * 1024;
+
+/** Line count of a text file for list meta rows; null for binaries, files over
+ *  the size cap, and anything unreadable. */
+export async function countTextFileLines(fullPath, size) {
+  if (!(size <= LINE_COUNT_MAX_BYTES)) return null;
+  let handle;
+  try {
+    handle = await open(fullPath, 'r');
+    const buf = Buffer.alloc(size);
+    const { bytesRead } = await handle.read(buf, 0, size, 0);
+    const data = buf.subarray(0, bytesRead);
+    if (bytesRead === 0) return 0;
+    if (isBinaryBuffer(data, bytesRead)) return null;
+    let lines = 0;
+    for (let i = data.indexOf(10); i !== -1; i = data.indexOf(10, i + 1)) lines += 1;
+    return data[bytesRead - 1] === 10 ? lines : lines + 1;
+  } catch {
+    return null;
+  } finally {
+    await handle?.close().catch(() => {});
+  }
+}