mixdog 0.9.175 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.175",
+  "version": "1.0.0",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/context-renewal-live-check.mjs

@@ -125,7 +125,8 @@ try {
   for (const spec of specs) {
     const dataDir = path.join(sandbox, spec.name);
     const db = path.join(dataDir, 'pgdata');
-    const ctl = path.join(dataDir, 'runtime', 'runtime-pg16.4+pgvector-0.8.2', 'bin', 'pg_ctl.exe');
+    const runtimeKey = fs.readFileSync(path.join(dataDir, 'runtime', 'active-version'), 'utf8').trim();
+    const ctl = path.join(dataDir, 'runtime', `runtime-${runtimeKey}`, 'bin', 'pg_ctl.exe');
     if (process.platform === 'win32' && fs.existsSync(ctl) && fs.existsSync(path.join(db, 'postmaster.pid'))) {
       const stopped = spawnSync(ctl, ['-D', db, '-m', 'fast', '-w', 'stop'], { stdio: 'inherit' });
       if (stopped.status !== 0) cleanupFailed = true;

package/scripts/plan-runtime-release-tag.mjs

@@ -0,0 +1,57 @@
+// Decides the release tag a memory runtime build publishes under.
+//
+// Published runtime assets are immutable: every app that shipped a manifest
+// naming a tag verifies that tag's assets by size and sha256, so replacing an
+// asset under a shipped tag breaks the next runtime install of all of those
+// apps. A build that would replace an asset of a shipped tag (any tag at or
+// below the bundled manifest's release_tag) moves to the next patch tag; the
+// manifest sync then points new app builds at it.
+//
+// CLI: node scripts/plan-runtime-release-tag.mjs <requested-tag> <shipped-tag> <needed-assets-file> <published-assets-file>
+// prints the tag to build. The asset files hold one asset name per line.
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+const TAG_RE = /^runtime-v(\d+)\.(\d+)\.(\d+)$/;
+
+function parseTag(tag) {
+  const match = TAG_RE.exec(String(tag ?? '').trim());
+  if (!match) throw new Error(`invalid runtime release tag: ${tag}`);
+  return match.slice(1).map(Number);
+}
+
+function compareTags(left, right) {
+  const a = parseTag(left);
+  const b = parseTag(right);
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] - b[index];
+  }
+  return 0;
+}
+
+export function planRuntimeReleaseTag({ requestedTag, shippedTag, neededAssets, publishedAssets }) {
+  const published = new Set(publishedAssets);
+  const replacesPublished = neededAssets.some((name) => published.has(name));
+  if (!replacesPublished || compareTags(requestedTag, shippedTag) > 0) return requestedTag;
+  const [major, minor, patch] = parseTag(shippedTag);
+  return `runtime-v${major}.${minor}.${patch + 1}`;
+}
+
+function readNames(path) {
+  return readFileSync(path, 'utf8')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || '').href) {
+  const [requestedTag, shippedTag, neededPath, publishedPath] = process.argv.slice(2);
+  process.stdout.write(
+    `${planRuntimeReleaseTag({
+      requestedTag,
+      shippedTag,
+      neededAssets: readNames(neededPath),
+      publishedAssets: readNames(publishedPath),
+    })}\n`
+  );
+}

package/src/defaults/skills/xlsx/SKILL.md

@@ -37,6 +37,7 @@ Excel proves the numbers and makes their meaning readable. Keep sourced inputs a
 1. Settle the table first: headers, one row per record, consistent units, numeric cells as numbers (not text), dates as ISO strings (both backends store `2026-09-30` as the Excel date under `yyyy-mm-dd`, so date arithmetic is `=D5-DATE(2026,9,22)`, not `DATEVALUE`), percentages as fractions (`0.15`, formatted `0.0%`). A figure written as text is stored as the number Excel types from it, on both backends — `"1,234"` under `#,##0`, `"15%"` as 0.15 under `0%` — and any other text stays exactly as written (`"1-2"`, `"007"`, `"1e3"`, `"TRUE"` never become a date, a 7, a 1000, or a truth value). Keep the same `design.content` model as the deck or document in the same package.
 2. For a report, design the reading order, sheet roles, column proportions, chart placement and intended screen/print use. Author with native cell, style, merge and chart operations by default. `compose_sheet` is an opt-in preset only when its table-plus-panel structure already fits; do not select it merely to save calls. Batch all known operations. Use `describe format:'xlsx' operation:<op>` when fields are unknown; cell styles belong in `properties`.
 3. Add sheets with `add_sheet`, then native ranges and formulas targeting `sheet`. Use `set_formula` for derived cells and `define_name` for reused inputs. Check representative formulas against the intended ranges before extending a model; clean recalculation proves evaluation, not correct modelling. A design specimen is optional, not required for every workbook.
+   If `create` fails, stop dependent `open`, `render`, and `finalize` calls: a failed creation is not an artifact. Correct the reported inputs and resume only from a successful `create` result.
 4. Raw tabular files (`.csv`, `.tsv`) take `set_range` with a 2D `values` array and `append_row`; they carry no styles, formulas, or multiple sheets.
 5. `finalize` recalculates and returns current rendered pages for review; add `auditProfile:'financial-model'` for a decision model. Read the actual images as in `report-design.md`, with concrete keep/fix observations about hierarchy, charts and print layout. Correct material issues and rerender, rather than filling a pass checklist. Complete with `design:{ reviewed:true, reviewToken:<current token>, critique:[{ page:1, verdict:'pass', note:<page-specific observations> }, ...] }`. This records agent review, not user approval. CSV/TSV needs no visual approval. Resolve validation failures against their original baseline, never by reopening as a new baseline.
 

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -4,6 +4,7 @@ import { countJsonNextCalls } from './tools/next-call-utils.mjs';
 import { parseGrepContextHeader, splitGrepLinePrefix } from './tools/builtin/grep-formatting.mjs';
 import { isReadOnlyNavigationMiss } from './session/result-classification.mjs';
 import { nonNegativeInt } from '../../shared/numbers.mjs';
+import { isUserControlCancellation } from '../../shared/tool-status.mjs';
 import {
   appendAgentTrace,
   normalizeSessionId,
@@ -128,7 +129,7 @@ function traceAgentCompact({
 }
 
 const TOOL_ARG_KEYS = {
-  read: ['path', 'offset', 'limit', 'line', 'context'],
+  read: ['file_path', 'path', 'offset', 'limit', 'line', 'context'],
   grep: ['pattern', 'path', 'glob', 'output_mode', 'head_limit', 'offset'],
   glob: ['pattern', 'path', 'head_limit', 'offset', 'sort'],
   find: ['query', 'path', 'head_limit'],
@@ -211,12 +212,11 @@ function summarizeToolArgs(toolName, args) {
   for (const key of keys) {
     if (Object.hasOwn(args, key)) out[key] = compactTraceArgValue(args[key], key);
   }
-  for (const countKey of ['edits', 'writes']) {
+  // Arrays are clipped to 6 entries above; the count keeps batch-limit
+  // failures (more than 10 read/grep targets) diagnosable.
+  for (const countKey of ['edits', 'writes', 'file_path', 'path']) {
     if (Array.isArray(args[countKey])) out[`${countKey}_count`] = args[countKey].length;
   }
-  if (toolName === 'read' && Array.isArray(args.path)) {
-    out.path_count = args.path.length;
-  }
   return Object.keys(out).length ? out : null;
 }
 
@@ -414,17 +414,12 @@ function classifyToolFailure(resultText, toolName) {
   if (/\[tool-input-validation\]/.test(text)) return 'schema/args';
   // These are emitted validation/cancellation contracts, not keywords found
   // somewhere in a quoted document, command output, or error preview.
-  if (
-    /^(?:Browser command interrupted by local user input\.|computer_session_aborted: queued command was cancelled before execution|computer_user_control_active:)/i.test(
-      leading
-    )
-  )
-    return 'expected-cancellation';
+  if (isUserControlCancellation(leading)) return 'expected-cancellation';
   if (
     /^The arguments provided to `[^`]+` are invalid JSON and could not be parsed:/i.test(leading) ||
     /^new Goal tasks must omit ids; use updates for existing tasks$/i.test(leading) ||
     /^goal task exceeds \d+ characters$/i.test(leading) ||
-    /^goal (?:tasks|updates) support at most \d+ entries$/i.test(leading) ||
+    /^goal (?:tasks|updates) support at most \d+ entries(?:$|;)/i.test(leading) ||
     /^goal arguments contain unknown fields:/i.test(leading) ||
     /^Unsupported field for GitHub [\w.]+\.$/i.test(leading) ||
     /^browser action "[^"]+" (?:does not accept input field|requires input\.|accepts only one input target form|fields must be inside input:|input\.[^\n]*(?:must be|requires|accepts at most))/i.test(

package/src/runtime/agent/orchestrator/providers/anthropic-api-transport.mjs

@@ -21,6 +21,7 @@ import {
 } from './retry-classifier.mjs';
 import { PROVIDER_FIRST_BYTE_TIMEOUT_MS, createTimeoutSignal } from '../stall-policy.mjs';
 import { noteFastModeCapacityError } from './anthropic-fast-mode.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { notifyCurrentAnthropicRateLimit } from './admission-scheduler.mjs';
 
 /**
@@ -103,6 +104,7 @@ export function createAnthropicApiTransport({ client, label, opts, useModel, par
   const requestStreamingResponse = () =>
     withRetry(
       async ({ signal: attemptSignal }) => {
+        noteRequestServiceTier(params.speed);
         const res = await client.messages.create(params, requestOptions(attemptSignal)).asResponse();
         if (!res.ok) {
           const text = await res.text().catch(() => '');
@@ -156,7 +158,10 @@ export function createAnthropicApiTransport({ client, label, opts, useModel, par
 
   const requestNonStreamingMessage = (nonStreamingParams, signal) =>
     withRetry(
-      async ({ signal: attemptSignal }) => client.messages.create(nonStreamingParams, requestOptions(attemptSignal)),
+      async ({ signal: attemptSignal }) => {
+        noteRequestServiceTier(nonStreamingParams.speed);
+        return client.messages.create(nonStreamingParams, requestOptions(attemptSignal));
+      },
       {
         ...retryPolicy(signal, `${label} Anthropic non-streaming fallback`, `${label}-nonstreaming-request`),
         onRetry: ({ attempt, maxAttempts, lastErr, delayMs }) =>

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-request.mjs

@@ -12,6 +12,7 @@ import { traceAgentFetch } from '../agent-trace.mjs';
 import { createAbortController } from '../../../shared/abort-controller.mjs';
 import { notifyCurrentAnthropicRateLimit } from './admission-scheduler.mjs';
 import { noteFastModeCapacityError } from './anthropic-fast-mode.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import {
   ANTHROPIC_RETRY_BACKOFF_MS,
   ANTHROPIC_RETRY_JITTER_RATIO,
@@ -66,6 +67,7 @@ export function createAnthropicOAuthRequest({
       // provider-visible cache breakpoint off the cached one — the
       // exact COLD-turn bug this change fixes. Order is fixed:
       // build → sanitize (once) → mark → prepare image bytes → JSON.stringify.
+      noteRequestServiceTier(requestBody?.speed);
       const response = await postMessages({
         accessToken,
         requestBody,

package/src/runtime/agent/orchestrator/providers/cursor.mjs

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { getAgentApiKey } from '../../../shared/config.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import {
   knownToolNamesFromOpenAITools,
   parseToolCalls,
@@ -510,6 +511,15 @@ function selectParameterizedCursorVariant(group, requested, sendOpts = {}) {
   };
 }
 
+// Fast is a RequestedModel parameter on parameterized models and an id
+// suffix on raw variants.
+function cursorSelectionIsFast(selection) {
+  if (selection.parameters?.length) {
+    return selection.parameters.some((parameter) => parameter.id === 'fast' && parameter.value === 'true');
+  }
+  return parseCursorVariantId(selection.modelId).fast;
+}
+
 function selectCursorVariant(group, { effort = null, fast = false } = {}) {
   if (!Array.isArray(group) || group.length === 0) return null;
   const normalizedEffort =
@@ -680,11 +690,13 @@ class CursorProviderBase {
       sendOpts.sessionId || sendOpts.providerCacheKey || sendOpts.promptCacheKey || `cursor-call:${randomUUID()}`
     );
     const openAiTools = tools?.length ? toOpenAITools(tools) : undefined;
-    const dispatch = () =>
-      this._dispatchChat(
+    const dispatch = () => {
+      noteRequestServiceTier(cursorSelectionIsFast(cursorSelection) ? 'fast' : '');
+      return this._dispatchChat(
         this._chatBody(messages, { cursorSelection, sessionScope, openAiTools, toolChoice: sendOpts.toolChoice }),
         { runtime, accessToken, signal, sendOpts, openAiTools }
       );
+    };
     let assembled;
     try {
       assembled = await dispatch();
@@ -702,9 +714,15 @@ class CursorProviderBase {
       assembled = await dispatch();
     }
     const rawUsage = assembled.rawUsage;
+    // A pinned raw variant (effort/Fast suffix) bills as its catalog model;
+    // the Fast part is carried by the request's tier, not the id.
+    const pinned = parseCursorVariantId(canonicalCursorModelId(String(model || '').trim()));
+    const pricingModel =
+      pinned.baseId !== pinned.id && this._cursorCatalog?.groups?.has(pinned.baseId) ? pinned.baseId : undefined;
     return {
       content: assembled.content || '',
       model: model || assembled.model || 'auto',
+      ...(pricingModel ? { pricingModel } : {}),
       toolCalls: assembled.toolCalls,
       stopReason: assembled.stopReason,
       ...(assembled.reasoningContent ? { reasoningContent: assembled.reasoningContent } : {}),

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -39,6 +39,7 @@ import {
   resolveProviderCacheKey,
 } from '../agent-runtime/cache-strategy.mjs';
 import { preconnect } from '../../../shared/llm/http-agent.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { sendViaHttpSse, _envFlag } from './openai-oauth-http-sse.mjs';
 import { warmCodexClientVersion } from './codex-client-meta.mjs';
 import { CODEX_BACKEND_ORIGIN } from './openai-codex-endpoints.mjs';
@@ -209,6 +210,8 @@ export class OpenAIOAuthProvider {
     const authState = { tokens: await _authP };
     await _verP;
     const body = await _bodyP;
+    // Every WS/HTTP attempt of this send carries this body's tier unchanged.
+    noteRequestServiceTier(body.service_tier);
     // poolKey != cacheKey by design. poolKey isolates socket/delta state per
     // session. cacheKey is body.prompt_cache_key and affects prompt-cache
     // routing only; Codex handshake identity comes from sendOpts and remains

package/src/runtime/agent/orchestrator/providers/openai-ws.mjs

@@ -23,6 +23,7 @@ import { applyOpenAIDirectCachePolicy, openAiDirectSupportsFast } from './openai
 import { streamCallbacks } from './lib/send-callbacks.mjs';
 import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { resolveProviderCacheKey, resolveProviderPromptCacheLane } from '../agent-runtime/cache-strategy.mjs';
 
 function applyOpenAIDirectFastTier(body, model, opts) {
@@ -122,6 +123,7 @@ export class OpenAIDirectProvider {
     // so a model can opt into Fast even when the OAuth catalog does not
     // advertise a Fast tier for its OAuth endpoint.
     applyOpenAIDirectFastTier(body, useModel, opts);
+    noteRequestServiceTier(body.service_tier);
     // Keep public response storage and model-specific cache options out of
     // the shared OAuth payload. Storage opt-out still forces full frames in
     // _computeDelta; retained output items make those frames self-contained.

package/src/runtime/agent/orchestrator/runtime-core/goal-tasks.mjs

@@ -34,7 +34,18 @@ export function optionalGoalTaskChanges({ tasks, updates } = {}) {
 export function normalizeGoalTasks(input, previous = [], { strict = false } = {}) {
   if (input == null) return previous.map((task) => ({ ...task }));
   if (!Array.isArray(input)) throw new Error('goal tasks must be an array');
-  if (input.length > MAX_GOAL_TASKS) throw new Error(`goal tasks support at most ${MAX_GOAL_TASKS} entries`);
+  if (input.length > MAX_GOAL_TASKS) {
+    // Settled rows count toward the cap; set_tasks may omit them (only
+    // unfinished tasks must be retained), which is how a long Goal makes room.
+    const settled = previous.some((task) => GOAL_TASK_SETTLED.includes(task?.status));
+    throw new Error(
+      `goal tasks support at most ${MAX_GOAL_TASKS} entries${
+        settled
+          ? '; completed and dropped tasks count, so to add more send set_tasks with only the unfinished tasks plus the new ones'
+          : ''
+      }`
+    );
+  }
   const previousByText = new Map(previous.map((task) => [clean(task?.text), task]));
   const reservedIds = new Set([...previous, ...input].map((task) => clean(task?.id)).filter(Boolean));
   let nextId = 1;

package/src/runtime/agent/orchestrator/session/result-classification.mjs

@@ -61,7 +61,7 @@ const ZERO_MATCH_PREFIXES = [
 const READ_ONLY_NAVIGATION_TOOLS = new Set(['find', 'glob', 'grep', 'list', 'read', 'code_graph']);
 
 const NAVIGATION_MISS_RE =
-  /\b(?:enoent|enotdir)\b|path does not exist|directory does not exist|no such (?:file|path)|not found at this path|file not found in graph/i;
+  /\b(?:enoent|enotdir)\b|path does not exist|directory does not exist|no such (?:file|path)|not found at this path|file not found\b|symbol "[^"\n]*" not found in /i;
 
 export function isReadOnlyNavigationMiss(toolName, result) {
   if (!READ_ONLY_NAVIGATION_TOOLS.has(String(toolName || '').toLowerCase())) return false;

package/src/runtime/agent/orchestrator/session/transcript-restore/tool-result-status.mjs

@@ -3,7 +3,11 @@
  * session runtime.
  */
 import { stripShellExitHeader, toolErrorDisplay } from './tool-result-text.mjs';
-import { normalizeToolTerminalStatus, toolResultTerminalStatus } from '../../../../shared/tool-status.mjs';
+import {
+  hasBenignExitOutcome,
+  normalizeToolTerminalStatus,
+  toolResultTerminalStatus,
+} from '../../../../shared/tool-status.mjs';
 import { isReadOnlyNavigationMiss } from '../result-classification.mjs';
 import { formatAggregateDetail, summarizeToolResult, toolLoadingTargets } from '../../../../shared/tool-surface.mjs';
 import { normalizeToolName } from '../../../../shared/tool-primitives.mjs';
@@ -43,7 +47,7 @@ export function shellCommandExitCode(text) {
 export function toolCallOutcome(message, rawText) {
   if (normalizeToolName(message?.toolName || message?.name) === 'git') {
     const exitCode = gitResultExitCode(rawText);
-    if (exitCode !== null) return { isCallError: false, isExitError: true, exitCode };
+    if (exitCode !== null) return { isCallError: false, isExitError: !hasBenignExitOutcome(rawText), exitCode };
     if (gitResultError(rawText)) return { isCallError: true, isExitError: false, exitCode: null };
   }
   const exitCode = shellCommandExitCode(rawText);
@@ -51,7 +55,7 @@ export function toolCallOutcome(message, rawText) {
     // Every completed shell result carries `[exit code: N]` — including 0.
     // A non-zero code is a command failure unless execution marked a known
     // successful no-match/no-change outcome.
-    const benignExit = exitCode !== 0 && /^\[outcome:\s*(?:no-match|no-change)\]\s*$/im.test(String(rawText || ''));
+    const benignExit = exitCode !== 0 && hasBenignExitOutcome(rawText);
     return { isCallError: false, isExitError: exitCode !== 0 && !benignExit, exitCode };
   }
   if (isReadOnlyNavigationMiss(message?.toolName || message?.name, rawText)) {

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/benign-exit.mjs

@@ -14,6 +14,8 @@ import {
 // shared shell tokenizers, so quoted/commented `;` `|` `grep` can never
 // masquerade as a connector/command and hide a real failure.
 const _SEARCH_HEADS = new Set(['select-string', 'sls', 'grep', 'egrep', 'fgrep', 'findstr']);
+// `git diff` flags whose exit 1 reports a difference, not a failure.
+export const GIT_DIFF_EXIT_SIGNAL_FLAGS = new Set(['--exit-code', '--quiet', '--check']);
 const _GIT_GLOBAL_VALUE_OPTS = new Set([
   '-c',
   '-C',
@@ -75,12 +77,14 @@ export function _isBenignSearchExitOne(command, exitCode, signal, stderr) {
   const head = _normalizeHead(tokens[0]);
   if (_SEARCH_HEADS.has(head)) return true;
   if (head !== 'git') return false;
-  // `git [global-opts] diff ...` only — exact `diff` subcommand, never
-  // diff-index/diff-files/difftool — with exit-code semantics.
+  // `git [global-opts] grep ...` (no match), or `git [global-opts] diff ...`
+  // only — exact `diff` subcommand, never diff-index/diff-files/difftool —
+  // with exit-code semantics.
   let i = 1;
   while (i < tokens.length && tokens[i].startsWith('-')) {
     i += _GIT_GLOBAL_VALUE_OPTS.has(tokens[i]) && !tokens[i].includes('=') ? 2 : 1;
   }
+  if (tokens[i] === 'grep') return true;
   if (tokens[i] !== 'diff') return false;
-  return tokens.slice(i + 1).some((t) => t === '--exit-code' || t === '--quiet' || t === '--check');
+  return tokens.slice(i + 1).some((t) => GIT_DIFF_EXIT_SIGNAL_FLAGS.has(t));
 }

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -58,6 +58,7 @@ export const BUILTIN_TOOLS = [
             {
               type: 'array',
               minItems: 1,
+              maxItems: PUBLIC_PATH_BATCH_LIMIT,
               items: {
                 anyOf: [
                   { type: 'string' },

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -3,6 +3,7 @@ import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 import { tokenizeDirectArgv } from './shell-direct-exe.mjs';
+import { GIT_DIFF_EXIT_SIGNAL_FLAGS } from './bash-tool/benign-exit.mjs';
 import { withBuiltinPathLocks } from './path-locks.mjs';
 import { withAdvisoryLocks } from './advisory-lock.mjs';
 import { withGitRepoReadLock, withGitRepoWriteLock } from './git-repo-rw-lock.mjs';
@@ -154,8 +155,13 @@ function commandResult(plan, result, limit) {
   const output = capOutput(appendText(String(result.stdout || ''), String(result.stderr || '')), limit);
   if (succeeded(result)) return { text: output, failed: false };
   const processError = result.error || result.timedOut || result.aborted || result.overflow || result.exitCode == null;
+  // An exit signal is still a non-zero exit, so a command array stops on it;
+  // the outcome line only keeps the card from reporting a failure.
+  const exitHeader = exitSignal(plan, result)
+    ? `exit ${result.exitCode}\n[outcome: no-match]`
+    : `exit ${result.exitCode}`;
   return {
-    text: appendText(processError ? fail(gitFailureReason(plan, result)) : `exit ${result.exitCode}`, output),
+    text: appendText(processError ? fail(gitFailureReason(plan, result)) : exitHeader, output),
     failed: true,
   };
 }
@@ -337,6 +343,18 @@ function succeeded(result) {
   return result?.exitCode === 0 && !result.error && !result.timedOut && !result.aborted && !result.overflow;
 }
 
+// `git grep` exits 1 for no match and `git diff --exit-code/--quiet/--check`
+// exits 1 to report a difference; the shell tool marks the same exits as
+// signals, so the git tool does too.
+function exitSignal(plan, result) {
+  if (result.exitCode !== 1 || String(result.stderr || '').trim()) return false;
+  if (plan.operation === 'grep') return true;
+  if (plan.operation !== 'diff') return false;
+  const separator = plan.args.indexOf('--');
+  const options = separator === -1 ? plan.args : plan.args.slice(0, separator);
+  return options.some((arg) => GIT_DIFF_EXIT_SIGNAL_FLAGS.has(arg));
+}
+
 // ENOENT from the spawn itself is a capability fact, not a git error: the
 // executable is absent. Naming it stops the caller from re-running git a
 // different way to find out.
@@ -780,8 +798,26 @@ function splitChainedGitCommands(command) {
   return commands.length > 1 ? commands : null;
 }
 
-export async function executeGitTool(input, workDir, options = {}) {
-  if (!input || typeof input !== 'object' || Array.isArray(input)) return fail('git requires an arguments object');
+// The tool only runs git, so a submitted command that omits the leading `git`
+// ("status --short") gets it instead of a rejection. Only whole submitted
+// commands are prefixed; a `&&` piece after the first still has to be a full
+// git command, so non-git chain segments stay refused.
+function withGitPrefix(command) {
+  if (typeof command !== 'string') return command;
+  const text = String(unwrapQuotedCommand(command)).trim();
+  const first = text ? tokenizeDirectArgv(text)?.[0] : '';
+  if (!first || /(^|[\\/])git(?:\.exe)?$/i.test(first)) return command;
+  return `git ${text}`;
+}
+
+export async function executeGitTool(rawInput, workDir, options = {}) {
+  if (!rawInput || typeof rawInput !== 'object' || Array.isArray(rawInput))
+    return fail('git requires an arguments object');
+  const input = {
+    ...rawInput,
+    command: Array.isArray(rawInput.command) ? rawInput.command.map(withGitPrefix) : withGitPrefix(rawInput.command),
+  };
+  if (rawInput.command === undefined) delete input.command;
   const action = input.action ?? 'command';
   if (action === 'stage') {
     if (input.command !== undefined || input.include_stage_ids !== undefined) {

package/src/runtime/memory/lib/runtime-fetcher.mjs

@@ -7,9 +7,12 @@ import { __mixdogMemoryLog } from './memory-log.mjs';
 // Downloads and verifies a prebuilt native PG runtime from the mixdog GitHub
 // release manifest.
 //
-// Layout: <dataDir>/runtime/runtime-{ver}/  +  <dataDir>/runtime/active-version
+// Layout: <dataDir>/runtime/runtime-{key}/  +  <dataDir>/runtime/active-version
+// holding {key}. New installs key the directory by version plus asset digest;
+// installs from before that keep their bare-version key and stay valid.
 // Atomic swap: write active-version.tmp then rename → active-version.
-// GC: removes stale runtime-* dirs and staging-* dirs on every ensureRuntime call.
+// GC: removes stale runtime-* dirs and staging-* dirs on every ensureRuntime
+// call, but only a dir that can be moved aside whole (never one in use).
 //
 // Public API: ensureRuntime(dataDir) → { runtimeDir, pgBinDir, libDir, sharePath, version }
 
@@ -21,6 +24,7 @@ import {
   openSync,
   readFileSync,
   readdirSync,
+  renameSync,
   rmSync,
   statSync,
   unlinkSync,
@@ -109,6 +113,38 @@ function runtimeVerDir(runtimeDir, ver) {
   return join(runtimeDir, `runtime-${ver}`);
 }
 
+// A rebuilt asset of the same version gets its own directory, so installing it
+// never touches the tree a still-running PostgreSQL may hold open.
+function runtimeInstallKey(version, sha256) {
+  return `${version}-${String(sha256).slice(0, 12)}`;
+}
+
+// True while a PostgreSQL from this runtime is running: a running executable
+// cannot be opened for writing (EBUSY on Windows, ETXTBSY on Linux).
+function runtimeDirInUse(dir) {
+  const exe = join(dir, 'bin', process.platform === 'win32' ? 'postgres.exe' : 'postgres');
+  try {
+    closeSync(openSync(exe, 'r+'));
+    return false;
+  } catch (error) {
+    return error?.code === 'EBUSY' || error?.code === 'ETXTBSY';
+  }
+}
+
+// Remove a runtime dir only when nothing runs from it, moving it aside whole
+// first. Deleting in place could strip a running PostgreSQL's files and the
+// sha stamp while the locked binaries survive, leaving a tree that looks
+// installed but is not; an in-use dir makes this throw and stays intact.
+function discardRuntimeDir(runtimeDir, dir) {
+  if (runtimeDirInUse(dir)) throw new Error(`[runtime-fetcher] runtime dir is in use: ${dir}`);
+  const trash = join(
+    runtimeDir,
+    `staging-discard-${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`
+  );
+  renameSync(dir, trash);
+  rmSync(trash, { recursive: true, force: true });
+}
+
 function runtimePaths(verDir) {
   return {
     pgBinDir: join(verDir, 'bin'),
@@ -370,9 +406,11 @@ function gcRuntimeDir(runtimeDir, keepVer) {
           continue;
         }
         const dir = join(runtimeDir, name);
-        const lockPath = stagingLockPath(dir);
-        // Never wipe a staging dir guarded by a LIVE lock — that is a sibling
-        // process mid-extract/swap.
+        // A download (staging-{tag}.tar.gz) is guarded by its staging dir's lock.
+        const guardName = name.endsWith('.tar.gz') ? name.slice(0, -'.tar.gz'.length) : name;
+        const lockPath = stagingLockPath(join(runtimeDir, guardName));
+        // Never wipe a staging dir or download guarded by a LIVE lock — that is
+        // a sibling process mid-download/extract/swap.
         if (_stagingLockIsLive(lockPath)) continue;
         try {
           rmSync(dir, { recursive: true, force: true });
@@ -382,8 +420,10 @@ function gcRuntimeDir(runtimeDir, keepVer) {
           if (existsSync(lockPath)) unlinkSync(lockPath);
         } catch {}
       } else if (name.startsWith('runtime-') && name !== `runtime-${keepVer}`) {
+        const path = join(runtimeDir, name);
         try {
-          rmSync(join(runtimeDir, name), { recursive: true, force: true });
+          if (statSync(path).isDirectory()) discardRuntimeDir(runtimeDir, path);
+          else rmSync(path, { force: true });
         } catch {}
       }
     }
@@ -451,11 +491,36 @@ function selectRuntimeAsset(manifest, pkey) {
 /** Fast path: the active-version pointer names this version and the extracted
  *  tree carries the expected sha256. Returns the reusable dir, else null. */
 function cachedRuntimeDir(runtimeBaseDir, version, sha256) {
-  if (readActiveVersion(runtimeBaseDir) !== version) return null;
-  const verDir = runtimeVerDir(runtimeBaseDir, version);
-  if (!existsSync(join(verDir, '.version-sha256'))) return null;
-  const stored = readFileSync(join(verDir, '.version-sha256'), 'utf8').trim();
-  return stored === sha256 ? verDir : null;
+  const key = readActiveVersion(runtimeBaseDir);
+  if (key !== version && key !== runtimeInstallKey(version, sha256)) return null;
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
+  return readRuntimeStamp(verDir) === sha256 ? verDir : null;
+}
+
+// The asset digest stamped into a complete runtime tree, '' when absent.
+function readRuntimeStamp(verDir) {
+  try {
+    return readFileSync(join(verDir, '.version-sha256'), 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+// Publish an extracted, stamped staging tree as runtime-{key} and point
+// active-version at it. A sibling that raced this install may already have
+// published the same asset: that tree is kept (it may be running) and this
+// copy dropped. Any other runtime-{key} tree is an interrupted install of this
+// asset; it is moved aside whole, and an in-use one fails the publish intact.
+function publishRuntimeDir(runtimeBaseDir, stagingDir, key, sha256) {
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
+  if (readRuntimeStamp(verDir) === sha256) {
+    rmSync(stagingDir, { recursive: true, force: true });
+  } else {
+    if (existsSync(verDir)) discardRuntimeDir(runtimeBaseDir, verDir);
+    renameWithRetrySync(stagingDir, verDir);
+  }
+  writeFileAtomicSync(activeVersionPath(runtimeBaseDir), key, { fsyncDir: true });
+  return verDir;
 }
 
 /**
@@ -476,10 +541,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
   // process fail to obtain the lock for its own staging dir).
   const stagingTag = `${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
   const stagingDir = join(runtimeBaseDir, `staging-${stagingTag}`);
-  const tarPath = join(runtimeBaseDir, `runtime-${pkey}-${stagingTag}.tar.gz`);
+  // Named after the staging dir so the same live lock guards it from GC.
+  const tarPath = `${stagingDir}.tar.gz`;
 
-  const verDir = runtimeVerDir(runtimeBaseDir, version);
-  const avPath = activeVersionPath(runtimeBaseDir);
+  const key = runtimeInstallKey(version, sha256);
+  const verDir = runtimeVerDir(runtimeBaseDir, key);
 
   // Cross-process lock: hold the staging lockfile (O_EXCL) for the WHOLE
   // download → extract → swap lifetime. GC in any concurrently-booting sibling
@@ -527,16 +593,11 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
     normalizeBinExecBit(stagingDir);
 
     // Atomic swap:
-    // 1. Rename staging → runtime-{ver}
+    // 1. Rename staging → runtime-{key} (or reuse a sibling's identical publish)
     // 2. Write active-version.tmp → rename to active-version
     // Stale dirs cleaned up by GC after.
     try {
-      // If a prior runtime-{ver} dir exists (interrupted earlier run), remove it.
-      if (existsSync(verDir)) {
-        rmSync(verDir, { recursive: true, force: true });
-      }
-      renameWithRetrySync(stagingDir, verDir);
-      writeFileAtomicSync(avPath, version, { fsyncDir: true });
+      publishRuntimeDir(runtimeBaseDir, stagingDir, key, sha256);
     } catch (swapErr) {
       __mixdogMemoryLog(`[runtime-fetcher] atomic swap failed: ${swapErr.message}\n`);
       // Attempt to leave things in a recoverable state: if verDir landed but
@@ -544,10 +605,10 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
       throw swapErr;
     }
 
-    // GC: remove stale runtime-* dirs (anything that isn't runtime-{version}).
+    // GC: remove stale runtime-* dirs (anything that isn't runtime-{key}).
     // Still under the lock so the just-swapped staging lockfile reap below sees
     // a consistent view.
-    gcRuntimeDir(runtimeBaseDir, version);
+    gcRuntimeDir(runtimeBaseDir, key);
   } finally {
     releaseStagingLock(stagingLock);
   }
@@ -556,6 +617,16 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
   return verDir;
 }
 
+export const _runtimeLayoutInternals = {
+  acquireStagingLock,
+  cachedRuntimeDir,
+  discardRuntimeDir,
+  gcRuntimeDir,
+  publishRuntimeDir,
+  releaseStagingLock,
+  runtimeInstallKey,
+};
+
 export async function ensureRuntime(dataDir) {
   const key = resolve(dataDir);
   if (runtimeCache.has(key)) return runtimeCache.get(key);