mixdog 0.9.19 → 0.9.21

package/src/runtime/agent/orchestrator/tools/bash-session.mjs

@@ -159,9 +159,24 @@ function _installParentExitHook() {
         }
     };
     try { process.on('exit', sweep); } catch { /* ignore */ }
-    try { process.on('SIGTERM', sweep); } catch { /* ignore */ }
-    try { process.on('SIGINT', sweep); } catch { /* ignore */ }
-    try { process.on('SIGHUP', sweep); } catch { /* ignore */ }
+    // For terminating signals, sweep children then restore default POSIX
+    // termination. A sweep-only handler swallows the signal and leaves the
+    // process alive, so after sweeping we remove our handler and re-raise the
+    // same signal to the default disposition (exit code 128+signum).
+    for (const sig of ['SIGTERM', 'SIGINT', 'SIGHUP']) {
+        const onSignal = () => {
+            sweep();
+            try { process.removeListener(sig, onSignal); } catch { /* ignore */ }
+            // Only re-raise (restoring default POSIX termination) when we are
+            // the last handler. If other listeners remain — graceful-shutdown
+            // handlers or peer sweep-only handlers — let them own termination;
+            // forcing exit here would preempt their cleanup.
+            try {
+                if (process.listenerCount(sig) === 0) process.kill(process.pid, sig);
+            } catch { /* ignore */ }
+        };
+        try { process.on(sig, onSignal); } catch { /* ignore */ }
+    }
 }
 
 function _startReaper() {
@@ -538,6 +553,11 @@ function _runCommand(entry, command, timeoutMs, abortSignal = null) {
             const partialErr = entry.stderrBuf;
             entry.stdoutBuf = '';
             entry.stderrBuf = '';
+            // Remove the session from the pool immediately: the POSIX kill
+            // escalates SIGTERM->SIGKILL asynchronously, so a still-registered
+            // entry could be reused as a dying shell before it exits.
+            entry.dead = true;
+            for (const [sid, s] of _sessions) { if (s === entry) { _sessions.delete(sid); break; } }
             _killProcessTree(entry.proc);
             cleanup();
             // Return a structured result (not a reject) so the caller

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-paths.mjs

@@ -1,8 +1,41 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'fs';
 import * as fsPromises from 'fs/promises';
-import { join } from 'path';
+import { basename, join } from 'path';
 import { getPluginData } from '../../config.mjs';
 
+// Bounded tail kept for a job's spilled stdout/stderr. A flooding job could
+// otherwise leave a 100MB+ .stdout.log/.stderr.log sitting for up to the 24h
+// stale TTL. Trimming to a few-MB tail preserves the most recent output
+// (where the final error/exit context lives) while capping on-disk growth.
+const SHELL_JOB_SPILL_MAX_BYTES = 4 * 1024 * 1024;
+const SHELL_JOB_SPILL_KEEP_BYTES = 4 * 1024 * 1024;
+
+// Tail-trim a single spill log in place: if it exceeds maxBytes, rewrite it
+// keeping only the last keepBytes. Sync, best-effort, no-op on a missing file.
+// Mirrors rotateBoundedLog in src/lib/mixdog-debug.cjs. Returns true if trimmed.
+export function trimShellJobSpillFile(filePath, maxBytes = SHELL_JOB_SPILL_MAX_BYTES, keepBytes = SHELL_JOB_SPILL_KEEP_BYTES) {
+    try {
+        const st = statSync(filePath);
+        if (st.size <= maxBytes) return false;
+        const buf = readFileSync(filePath);
+        writeFileSync(filePath, buf.subarray(Math.max(0, buf.length - keepBytes)));
+        return true;
+    } catch { return false; }
+}
+
+// Trim a completed job's stdout+stderr spill files to a bounded tail. Called on
+// every terminal transition so a completed flooding job can never leave a
+// 100MB spill behind for the sweep to reclaim a day later. Uses the detail's
+// recorded paths — adopted foreground jobs spill to shell-output/, not the
+// shell-jobs dir — and dedupes when mergeStderr collapses both onto stdoutPath.
+export function trimShellJobSpill(detail) {
+    if (!detail) return;
+    const stdoutPath = detail.stdoutPath || shellJobStdoutPath(detail.jobId);
+    const stderrPath = detail.stderrPath || shellJobStderrPath(detail.jobId);
+    trimShellJobSpillFile(stdoutPath);
+    if (stderrPath && stderrPath !== stdoutPath) trimShellJobSpillFile(stderrPath);
+}
+
 // One-shot sweep of stale shell-job artefacts. Each backgrounded `bash`
 // emits five files (.json/.done/.exit/.stdout.log/.stderr.log); the .done
 // flag is written when the job exits, so a .done file older than
@@ -82,6 +115,79 @@ async function sweepStaleShellJobs(dir) {
         ),
         ...ownerMarkers.map((n) => fsPromises.unlink(join(dir, n)).catch(() => {})),
     ]);
+    // Size enforcement for survivors: a completed flooding job whose .done is
+    // still younger than the stale cutoff isn't expired above, yet its spill
+    // can hold 100MB+ for up to a day. Proof-of-death is the .done marker (NOT
+    // mtime): mtime gating both truncated LIVE-but-quiet jobs whose writer
+    // handle is still open — sparse-regrow corruption — AND waited a full day
+    // to trim completed floods. Gating on doneSet means we only rewrite a file
+    // whose producer has provably exited, which also retries kill-path trims
+    // that failed silently while the killed child still held the redirect
+    // handle on Windows (trimShellJobSpillFile swallows the lock error).
+    await Promise.all(names.map(async (name) => {
+        const isStdout = name.endsWith('.stdout.log');
+        if (!isStdout && !name.endsWith('.stderr.log')) return;
+        const jobId = name.slice(0, -11); // both suffixes are 11 chars
+        if (expiredSet.has(jobId)) return; // already unlinked above
+        if (!doneSet.has(jobId)) return;   // no completion marker → maybe live, never touch
+        const p = join(dir, name);
+        try {
+            const st = await fsPromises.stat(p);
+            if (st.size <= SHELL_JOB_SPILL_MAX_BYTES) return;
+            const buf = await fsPromises.readFile(p);
+            await fsPromises.writeFile(p, buf.subarray(Math.max(0, buf.length - SHELL_JOB_SPILL_KEEP_BYTES)));
+        } catch {}
+    }));
+    sweepStaleShellOutput(dir, names);
+}
+
+// Sibling GC for spill files under $PLUGIN_DATA/shell-output/. TaskOutput
+// (shell-command.mjs) spills foreground stdout/stderr there as <taskId>.stdout
+// /.stderr once past the inline cap; a KEPT foreground spill (child dead at
+// settle) or an adopted job's leftover then sits at up to the 100MB disk cap
+// with no sweep of its own. Proof-of-death required before touching a file
+// (an open writer handle is the only corruption/ENOENT-to-a-reader risk): a
+// file is skipped iff some shell-job with a live pid and no .done references
+// it. pid-reuse false positives err toward NOT touching. Dead files past the
+// stale TTL are removed; oversized dead files are trimmed to a bounded tail.
+async function sweepStaleShellOutput(shellJobsDir, jobNames) {
+    const outDir = join(getPluginData(), 'shell-output');
+    let outNames;
+    try { outNames = await fsPromises.readdir(outDir); } catch { return; }
+    if (outNames.length === 0) return;
+    const doneSet = new Set(jobNames.filter(n => n.endsWith('.done')).map(n => n.slice(0, -5)));
+    const liveSpill = new Set();
+    await Promise.all(jobNames.map(async (name) => {
+        if (!name.endsWith('.json')) return;
+        const jobId = name.slice(0, -5);
+        if (doneSet.has(jobId)) return; // completed → its spill is provably dead
+        try {
+            const detail = JSON.parse(await fsPromises.readFile(join(shellJobsDir, name), 'utf-8'));
+            const pid = Number(detail?.pid);
+            let alive = true; // unknown/invalid pid → conservative: treat as live
+            if (Number.isFinite(pid) && pid > 0) {
+                try { process.kill(pid, 0); alive = true; }   // running (or EPERM)
+                catch (e) { alive = e?.code !== 'ESRCH'; }     // ESRCH → dead
+            }
+            if (!alive) return;
+            for (const key of ['stdoutPath', 'stderrPath']) {
+                const p = detail?.[key];
+                if (typeof p === 'string' && p) liveSpill.add(basename(p));
+            }
+        } catch {}
+    }));
+    const cutoff = Date.now() - SHELL_JOB_STALE_MS;
+    await Promise.all(outNames.map(async (name) => {
+        if (liveSpill.has(name)) return; // referenced by a live producer — never touch
+        const p = join(outDir, name);
+        try {
+            const st = await fsPromises.stat(p);
+            if (st.mtimeMs < cutoff) { await fsPromises.unlink(p).catch(() => {}); return; }
+            if (st.size <= SHELL_JOB_SPILL_MAX_BYTES) return;
+            const buf = await fsPromises.readFile(p);
+            await fsPromises.writeFile(p, buf.subarray(Math.max(0, buf.length - SHELL_JOB_SPILL_KEEP_BYTES)));
+        } catch {}
+    }));
 }
 
 export function getShellJobsDir() {

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-process.mjs

@@ -102,7 +102,19 @@ export function _installShellJobsExitHook() {
     _shellJobsExitHookInstalled = true;
     _ensureProcessListenerHeadroom(['exit', 'SIGTERM', 'SIGINT', 'SIGHUP'], 1);
     try { process.on('exit', _sweepLiveJobsSync); } catch { /* ignore */ }
-    try { process.on('SIGTERM', _sweepLiveJobsSync); } catch { /* ignore */ }
-    try { process.on('SIGINT', _sweepLiveJobsSync); } catch { /* ignore */ }
-    try { process.on('SIGHUP', _sweepLiveJobsSync); } catch { /* ignore */ }
+    // For terminating signals, sweep then restore default POSIX termination
+    // only when we are the last handler. A sweep-only handler swallows the
+    // signal and keeps the process alive; when several such handlers coexist,
+    // each removes itself and the last one to run re-raises so the default
+    // action takes effect without preempting graceful-shutdown listeners.
+    for (const sig of ['SIGTERM', 'SIGINT', 'SIGHUP']) {
+        const onSignal = () => {
+            _sweepLiveJobsSync();
+            try { process.removeListener(sig, onSignal); } catch { /* ignore */ }
+            try {
+                if (process.listenerCount(sig) === 0) process.kill(process.pid, sig);
+            } catch { /* ignore */ }
+        };
+        try { process.on(sig, onSignal); } catch { /* ignore */ }
+    }
 }

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -27,6 +27,7 @@ import {
     shellJobDonePath,
     shellJobEnforcedPath,
     resolveJobOwnerHostPid,
+    trimShellJobSpill,
     writeShellJobDetail,
     readShellJobDetail,
 } from './shell-job-paths.mjs';
@@ -309,6 +310,7 @@ export function killShellJob(jobId) {
     detail.exitCode = 137;
     detail.error = 'killed by user (KillShell)';
     detail.finishedAt = new Date().toISOString();
+    trimShellJobSpill(detail);
     writeShellJobDetail(detail);
     _unregisterLiveJobPid(detail.pid);
     return { ...attachJobInsights(detail), killed: true };
@@ -340,6 +342,9 @@ function refreshShellJob(jobId) {
         detail.status = exitCode === 0 ? 'completed' : 'failed';
         detail.exitCode = exitCode;
         detail.finishedAt = finishedAt;
+        // Job finished: cap its spill to a bounded tail so a flooding
+        // producer can't leave a 100MB stdout/stderr log behind.
+        trimShellJobSpill(detail);
         writeShellJobDetail(detail);
         _unregisterLiveJobPid(detail.pid);
         return detail;
@@ -352,6 +357,7 @@ function refreshShellJob(jobId) {
         detail.exitCode = 124;
         detail.finishedAt = new Date().toISOString();
         detail.error = `timed out after ${timeoutMs} ms`;
+        trimShellJobSpill(detail);
         writeShellJobDetail(detail);
         _unregisterLiveJobPid(detail.pid);
         return detail;
@@ -365,6 +371,7 @@ function refreshShellJob(jobId) {
         detail.exitCode = 137;
         detail.finishedAt = new Date().toISOString();
         detail.error = `output exceeded ${SHELL_JOB_OUTPUT_DISK_CAP} byte cap`;
+        trimShellJobSpill(detail);
         writeShellJobDetail(detail);
         _unregisterLiveJobPid(detail.pid);
         return detail;

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -193,9 +193,31 @@ function firstExistingPathFromWhereExcluding(commandName, excludeRe) {
     }
 }
 
+// Kind-aware shell resolution. kind:
+//
+// Resolve a real bash on macOS/Linux. When 'bash' is explicitly requested we
+// must NOT hand back /bin/sh, which on dash/ash distros is not bash and breaks
+// bash-only syntax. Probe common install paths, then `bash` on PATH; only when
+// nothing is found do we fall back to /bin/sh so a shell is still returned.
+function resolvePosixBash() {
+    for (const p of ['/bin/bash', '/usr/bin/bash', '/usr/local/bin/bash', '/opt/homebrew/bin/bash']) {
+        if (existsSync(p)) return shellSpec(p, 'posix');
+    }
+    try {
+        const r = spawnSync('which', ['bash'], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 1000 });
+        if (r.status === 0 && r.stdout) {
+            const p = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).find(Boolean);
+            if (p && existsSync(p)) return shellSpec(p, 'posix');
+        }
+    } catch { /* fall through to /bin/sh */ }
+    return shellSpec('/bin/sh', 'posix');
+}
+
 // Kind-aware shell resolution. kind:
 //  'default'    → identical to resolveShell() (PowerShell on Windows, /bin/sh elsewhere).
-//  'bash'       → on Windows, Git Bash (or null if not installed); elsewhere /bin/sh (POSIX is already bash-compatible).
+//  'bash'       → on Windows, Git Bash (or null if not installed); elsewhere a real bash
+//                 binary (/bin/bash, /usr/bin/bash, or `bash` on PATH), falling back to
+//                 /bin/sh only when no bash exists (dash/ash distros break on bash syntax).
 //  'powershell' → on Windows, resolveShell(); elsewhere pwsh if present, else null.
 // Each kind is memoized independently, but ONLY on success: a resolution miss
 // (null) is not cached, so the caller's clear-error path is re-probed on the
@@ -206,7 +228,7 @@ export function resolveShellFor(kind = 'default') {
 
     let spec = null;
     if (kind === 'bash') {
-        spec = _isWindows() ? resolveWindowsGitBash() : shellSpec('/bin/sh', 'posix');
+        spec = _isWindows() ? resolveWindowsGitBash() : resolvePosixBash();
     } else if (kind === 'powershell') {
         if (_isWindows()) {
             spec = resolveShell();

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -11,7 +11,7 @@ import { withBuiltinPathLocks } from '../builtin.mjs';
 import { withAdvisoryLocks } from '../builtin/advisory-lock.mjs';
 import { wrapMutationRouteOutput } from '../mutation-planner.mjs';
 import { getPluginData } from '../../config.mjs';
-import { prepareInput, isV4APatchInput, hasUnifiedBareV4AHunk, canFallbackCountedUnified, parseV4APatch, isCompactedPlaceholderPatch } from './parsing.mjs';
+import { prepareInput, isV4APatchInput, hasUnifiedBareV4AHunk, canFallbackCountedUnified, parseV4APatch, isCompactedPlaceholderPatch, salvageV4AOpening } from './parsing.mjs';
 import {
   resolveBasePath,
   resolveV4AEntryPath,
@@ -105,7 +105,7 @@ function salvageShatteredV4APatchArgs(args) {
 
 async function apply_patch(args, cwd, options = {}) {
   args = salvageShatteredV4APatchArgs(args);
-  const patchStr = (typeof args?.patch === 'string' ? args.patch : '').replace(/^\uFEFF/, '');
+  const patchStr = salvageV4AOpening((typeof args?.patch === 'string' ? args.patch : '').replace(/^\uFEFF/, ''));
   if (!patchStr.trim()) {
     throw new Error('apply_patch: "patch" is required (unified diff or V4A patch string)');
   }

package/src/runtime/agent/orchestrator/tools/patch/parsing.mjs

@@ -29,6 +29,67 @@ export function isV4APatchInput(patchStr, format) {
     || isApplyPatchEnvelope(patchStr);
 }
 
+// Absorb malformed-but-unambiguous patch openings that models emit instead of
+// a clean "*** Begin Patch\n*** Update File:" header. Every observed shape
+// arrives wrapped in a (possibly decorated) "*** Begin Patch" envelope, so the
+// junk is the first body line before any file header. Normalises them into a
+// form the existing V4A / unified paths already handle. Returns the ORIGINAL
+// string untouched whenever nothing is salvageable — well-formed patches and
+// genuinely ambiguous input both pass through unchanged (the latter then keeps
+// erroring downstream).
+const BEGIN_PATCH_RE = /^\*\*\*\s*Begin Patch\b/i;
+const V4A_FILE_HEADER_RE = /^\*\*\* (?:Update|Add|Delete) File:/;
+const V4A_FILE_HEADER_ANYLINE_RE = /^\*\*\* (?:Update|Add|Delete) File:/m;
+const UNIFIED_BODY_RE = /^(?:---\s|\+\+\+\s|diff --git |Index: )/;
+
+function impliedV4AFilePath(line) {
+  let t = String(line || '').trim();
+  const fileMatch = t.match(/^File:\s*(.+)$/i);
+  if (fileMatch) t = fileMatch[1].trim();
+  // Conservative: a single whitespace-free token that reads like a path — has
+  // a directory separator or a dotted extension. Anything else (prose, an
+  // "@@" anchor, a bare word) is treated as ambiguous and left to error.
+  if (!t || /\s/.test(t)) return null;
+  if (!/^[\w@.~/\\-]+$/.test(t)) return null;
+  if (!(t.includes('/') || t.includes('\\') || /\.\w+$/.test(t))) return null;
+  return normaliseV4APath(t);
+}
+
+export function salvageV4AOpening(patchStr) {
+  const raw = String(patchStr ?? '');
+  const lines = prepareInput(raw).split('\n');
+  let i = 0;
+  while (i < lines.length && lines[i].trim() === '') i++;
+  if (i >= lines.length) return raw;
+  const first = lines[i];
+  if (!BEGIN_PATCH_RE.test(first)) {
+    // No envelope: only absorb leading blank lines ahead of a real V4A header.
+    if (i > 0 && V4A_FILE_HEADER_RE.test(first)) return lines.slice(i).join('\n');
+    return raw;
+  }
+  const needBeginFix = first !== '*** Begin Patch';
+  const out = lines.slice(i);
+  out[0] = '*** Begin Patch';
+  let j = 1;
+  while (j < out.length && out[j].trim() === '') j++;
+  const body = out[j];
+  let changed = i > 0 || needBeginFix;
+  if (body !== undefined && !V4A_FILE_HEADER_RE.test(body) && !/^\*\*\* End Patch/i.test(body)) {
+    if (UNIFIED_BODY_RE.test(body) && !V4A_FILE_HEADER_ANYLINE_RE.test(prepareInput(raw))) {
+      // Unified diff wrapped in a V4A envelope: drop the envelope so it routes
+      // through the unified parser instead of the V4A path. Only when NO real
+      // V4A file headers exist anywhere (a mixed body stays ambiguous).
+      return out.filter((l, idx) => idx !== 0 && !/^\*\*\* End Patch/i.test(l)).join('\n');
+    }
+    const implied = impliedV4AFilePath(body);
+    if (implied) {
+      out.splice(j, 1, `*** Update File: ${implied}`);
+      changed = true;
+    }
+  }
+  return changed ? out.join('\n') : raw;
+}
+
 export function hasUnifiedBareV4AHunk(patchStr) {
   const text = prepareInput(patchStr);
   if (!/^--- /m.test(text) || !/^\+\+\+ /m.test(text)) return false;
@@ -122,14 +183,17 @@ function splitPatchLines(patchStr) {
 // new tool args). Exported so callers (e.g. apply_patch entry) can check
 // this before any format detection / V4A-vs-unified dispatch, so ANY
 // compacted body gets the corrective message regardless of format.
-export const COMPACTED_PLACEHOLDER_RE = /^\s*\[mixdog compacted \w+:/;
-
-// Mid-body scan uses the FULL placeholder shape ("<N> chars, sha…") rather
-// than the loose prefix above: V4A tolerates unprefixed context lines, so a
-// loose prefix match on any non-diff line could false-positive a legit edit
-// whose content mentions the placeholder text. The full shape only occurs in
-// actual compacted output leaked back as patch input.
-const COMPACTED_PLACEHOLDER_LINE_RE = /^\s*\[mixdog compacted \w+: \d+ chars, sha\d*:/;
+//
+// Matches EVERY placeholder variant, not just "<key>: <N> chars, sha256:…":
+// the marker key segment varies ("patch", "old_string", "patch v4a, sha256:…",
+// etc.), so anchor on the "[mixdog compacted …]" bracket span alone.
+export const COMPACTED_PLACEHOLDER_RE = /^\s*\[mixdog compacted\b[^\]\n]*\]/;
+
+// Mid-body scan reuses the same broad bracket shape. It only runs on lines that
+// are NOT unified diff content (+/-/space-prefixed), so a legit edit whose real
+// content mentions the placeholder text still parses; the skip discipline below
+// is what prevents false positives, not a narrower regex.
+const COMPACTED_PLACEHOLDER_LINE_RE = COMPACTED_PLACEHOLDER_RE;
 
 export function isCompactedPlaceholderPatch(patchStr) {
   const str = String(patchStr ?? '');

package/src/runtime/agent/orchestrator/tools/shell-policy-danger-target.mjs

@@ -10,7 +10,11 @@ export function isDangerousDeleteTarget(rawTarget) {
   if (/^\$home(\b|[\\/])/.test(low)) return true;
   if (/^\$env:(userprofile|homepath|home|homedrive|systemroot|windir|programfiles|programdata|systemdrive|allusersprofile|public|appdata|localappdata)\b/.test(low)) return true;
   if (/^%(userprofile|homepath|home|homedrive|systemroot|windir|programfiles|programdata|systemdrive|allusersprofile|public|appdata|localappdata)%/i.test(t)) return true;
-  if (/^\$\{(home|userprofile|homepath|homedrive|systemroot|windir|programfiles|programdata|systemdrive)\}/i.test(t)) return true;
+  // Match ${HOME} and parameter-expansion forms: ${HOME:?}, ${HOME:-x},
+  // ${HOME%/}, ${HOME#x}, ${HOME/a/b}, ${HOME+x}, ${HOME=x}. The lookahead
+  // requires the next char to be the closing brace or an expansion operator so
+  // plain longer names (e.g. ${HOMEBREW}) don't false-match.
+  if (/^\$\{(home|userprofile|homepath|homedrive|systemroot|windir|programfiles|programdata|systemdrive|allusersprofile|public|appdata|localappdata)(?=[}:%#/+\-?=])/i.test(t)) return true;
   if (/^\$\(home\)/i.test(t)) return true;
   if (/^\\\\[^\\]+\\[^\\]+\\\*?$/.test(t) || /^\\\\[^\\]+\\[^\\]*$/.test(t)) return true;
   if (t.startsWith('$') || t.includes('$(') || /^%[^%]*%/.test(t)) return false;