mixdog 0.9.21 → 0.9.23

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -4,6 +4,7 @@ import { join } from 'path';
 import { tmpdir } from 'os';
 import { randomUUID } from 'crypto';
 import { smartReadTruncate } from '../tools/builtin/read-formatting.mjs';
+import { shutdownStdioChild } from './child-tree.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -182,7 +183,7 @@ export async function executeMcpTool(name, args) {
         mcpLog(`[mcp-client] Tool call failed, attempting reconnect...\n`);
         await new Promise(r => setTimeout(r, 500));
         try {
-            await server.client.close();
+            await _closeServer(server);
         } catch { /* ignore close error */ }
         try {
             await connectServer(serverName, server.cfg);
@@ -241,7 +242,9 @@ async function _callToolWithTimeout(server, toolName, args) {
     }
     const timeout = new Promise((_, rej) => {
         timer = setTimeout(() => {
-            try { server.client.close().catch(() => {}); } catch { /* ignore */ }
+            // Route through the full tree-shutdown path so a timed-out stdio
+            // server never orphans grandchildren. Fire-and-forget.
+            try { _closeServer(server).catch(() => {}); } catch { /* ignore */ }
             const err = new Error(`MCP tool call timed out after ${timeoutMs}ms (server="${server.name}", tool="${toolName}")`);
             err.code = 'EMCPTOOLTIMEOUT';
             err.serverName = server.name;
@@ -338,13 +341,47 @@ export function mcpToolHasField(name, field) {
 export async function disconnectAll() {
     for (const [name, server] of servers) {
         try {
-            await server.client.close();
+            await _closeServer(server);
         }
         catch { /* ignore */ }
         servers.delete(name);
     }
     _invalidateMcpToolFieldMemo();
 }
+/**
+ * Disconnect a single MCP server by name. No-op (returns false) when the
+ * server is not in the live registry; otherwise closes its transport, removes
+ * it, and invalidates the tool-field memo. Lets callers toggle one server
+ * without a full disconnectAll()/reconnect cycle.
+ */
+export async function disconnectMcpServer(name) {
+    const server = servers.get(name);
+    if (!server) return false;
+    try {
+        await _closeServer(server);
+    }
+    catch { /* ignore */ }
+    servers.delete(name);
+    _invalidateMcpToolFieldMemo();
+    return true;
+}
+/**
+ * Close a single server: for stdio transports first shut down the full child
+ * process tree (close stdin -> grace -> tree kill) so wrapper chains such as
+ * uvx/npx/uv never orphan grandchildren, then release the SDK client. The
+ * tree teardown runs before client.close() because the SDK's own close()
+ * only kills the direct child and discards the pid we need to walk the tree.
+ */
+async function _closeServer(server) {
+    const transport = server?.transport;
+    // Live stdio transports expose the spawned ChildProcess on _process.
+    if (transport && transport._process) {
+        try { await shutdownStdioChild(transport); }
+        catch { /* ignore */ }
+    }
+    try { await server.client.close(); }
+    catch { /* ignore */ }
+}
 async function connectServer(name, cfg) {
     const {
         Client,

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -514,7 +514,7 @@ function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesT
             : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: callId, name: 'tool_search', finishReason: 'done' });
         const call = {
             id: callId,
-            name: 'tool_search',
+            name: 'load_tool',
             // Schema is a plain object ({query,select,limit}); an array must
             // never pass through as args.
             arguments: (_tsArgs && typeof _tsArgs === 'object' && !Array.isArray(_tsArgs)) ? _tsArgs : {},

package/src/runtime/agent/orchestrator/providers/openai-compat-wire.mjs

@@ -107,7 +107,9 @@ export function toOpenAITools(tools) {
 
 export function toResponsesTools(tools) {
     return tools.map((t) => {
-        if (t?.name === 'tool_search') {
+        // load_tool advertises as the OpenAI-native `tool_search` wire type
+        // (legacy 'tool_search' name still accepted for back-compat).
+        if (t?.name === 'load_tool' || t?.name === 'tool_search') {
             return {
                 type: 'tool_search',
                 execution: 'client',
@@ -193,7 +195,7 @@ export function parseResponsesToolCalls(response, label) {
                 : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: item.call_id || item.id, name: 'tool_search', finishReason });
             out.push({
                 id: item.call_id || item.id,
-                name: 'tool_search',
+                name: 'load_tool',
                 // Schema is a plain object ({query,select,limit}); an array
                 // (parsed JSON or passthrough) must never pass through as args.
                 arguments: (_tsArgs && typeof _tsArgs === 'object' && !Array.isArray(_tsArgs)) ? _tsArgs : {},
@@ -294,7 +296,7 @@ export function toResponsesInputMessage(m, pendingToolMedia = null, customToolCa
         const items = [];
         if (m.content) items.push({ role: 'assistant', content: normalizeContentForOpenAIResponses(m.content, { role: 'assistant' }) });
         for (const tc of m.toolCalls) {
-            if (tc.nativeType === 'tool_search_call' || tc.name === 'tool_search') {
+            if (tc.nativeType === 'tool_search_call' || tc.name === 'load_tool' || tc.name === 'tool_search') {
                 items.push({
                     type: 'tool_search_call',
                     call_id: tc.id,

package/src/runtime/agent/orchestrator/providers/openai-oauth-http-sse.mjs

@@ -451,7 +451,7 @@ export async function sendViaHttpSse({
         }
         const call = {
             id: callId,
-            name: 'tool_search',
+            name: 'load_tool',
             arguments: args,
             nativeType: 'tool_search_call',
         };
@@ -501,7 +501,7 @@ export async function sendViaHttpSse({
                     // mistakes it for a function call by id collision/empty id.
                     if (event.item.id) {
                         pendingCalls.set(event.item.id, {
-                            name: 'tool_search',
+                            name: 'load_tool',
                             callId: event.item.call_id || '',
                             kind: 'tool_search',
                         });

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -444,7 +444,7 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
             // reasoning in `input` triggers "Duplicate item".
             if (m.content) out.push({ role: 'assistant', content: normalizeContentForOpenAIResponses(m.content, { role: 'assistant' }) });
             for (const tc of m.toolCalls) {
-                if (tc.nativeType === 'tool_search_call' || tc.name === 'tool_search') {
+                if (tc.nativeType === 'tool_search_call' || tc.name === 'load_tool' || tc.name === 'tool_search') {
                     out.push({
                         type: 'tool_search_call',
                         call_id: tc.id,
@@ -480,7 +480,7 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
 }
 
 function toOpenAIResponsesTool(t) {
-    if (t?.name === 'tool_search') {
+    if (t?.name === 'load_tool' || t?.name === 'tool_search') {
         return {
             type: 'tool_search',
             execution: 'client',

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -355,7 +355,7 @@ export async function _streamResponse({
         if (!callId || toolCalls.some((call) => call.id === callId)) return;
         const call = {
             id: callId,
-            name: 'tool_search',
+            name: 'load_tool',
             arguments: parseToolSearchArgs(item.arguments),
             nativeType: 'tool_search_call',
         };

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -24,8 +24,9 @@ export function crossTurnSignature(name, args) {
 
 // Tool names that are non-eager (no readOnlyHint) but are NOT edits/progress —
 // they must not reset the escalation ladder's "zero edit" condition. Skill /
-// recall / agent / task / cwd / tool_search are exploration/meta plumbing.
-const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'tool_search']);
+// recall / agent / task / cwd / load_tool are exploration/meta plumbing.
+// (tool_search kept as legacy alias for old transcripts.)
+const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'load_tool', 'tool_search']);
 
 // True when a successfully-executed tool represents real edit/progress. A tool
 // counts as progress only if its def lacks readOnlyHint (not eager) AND it is

package/src/runtime/agent/orchestrator/session/loop/deferred-call-through.mjs

@@ -1,7 +1,7 @@
 // Deferred catalog call-through: inactive catalog tool_use → discovery bookkeeping
 // then normal executeTool routing (runtime errors only; no pre-dispatch schema).
 import { clean } from '../../../../../session-runtime/session-text.mjs';
-import { isReadonlySelectable, selectDeferredTools } from '../../../../../session-runtime/tool-catalog.mjs';
+import { deferredCatalogUnion, isReadonlySelectable, selectDeferredTools } from '../../../../../session-runtime/tool-catalog.mjs';
 
 /** Skill-list plumbing only; mutation/MCP/builtins must use the catalog+mode gate. */
 const INACTIVE_INFRA_BYPASS = new Set(['skills_list', 'skill_view']);
@@ -13,7 +13,10 @@ function isActiveSessionTool(session, name) {
 }
 
 function lookupDeferredCatalogTool(session, name) {
-    const catalog = Array.isArray(session?.deferredToolCatalog) ? session.deferredToolCatalog : [];
+    // Union of the boot-frozen catalog and the late-connected MCP catalog so a
+    // direct call to a tool whose server connected after boot resolves and
+    // auto-loads (selectDeferredTools promotes it onto session.tools).
+    const catalog = deferredCatalogUnion(session);
     const key = clean(name);
     if (!key) return null;
     for (const tool of catalog) {
@@ -66,7 +69,7 @@ export function prepareDeferredToolCallThrough(sessionRef, name, _args) {
     if (resolvedMode === null) {
         if (!isReadonlySelectable(tool)) {
             return denyDeferredCallThrough(
-                `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; use tool_search or load it explicitly.`,
+                `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; load it with load_tool names:["${toolLabel}"].`,
             );
         }
     } else if (resolvedMode === 'readonly' && !isReadonlySelectable(tool)) {

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -81,7 +81,7 @@ export function resolveToolResultAfterHook(originalResult, hookResult) {
 }
 
 export function parseNativeToolSearchPayload(toolName, result) {
-    if (toolName !== 'tool_search' || typeof result !== 'string') return null;
+    if ((toolName !== 'load_tool' && toolName !== 'tool_search') || typeof result !== 'string') return null;
     try {
         const parsed = JSON.parse(result);
         const native = parsed?.nativeToolSearch;

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -74,6 +74,39 @@ function recallMemoryTimeoutMs(session) {
     // misconfigured tiny value can't turn the bound into a busy no-wait.
     return Math.max(250, configured || RECALL_MEMORY_CALL_TIMEOUT_MS);
 }
+// Cold-start allowance (clear/manual path only): a booting memory daemon can
+// miss the tight first bound (waitForPort + first-RPC warmup ~2-10s). On a
+// timeout we retry ONCE with a longer bound before honoring the bail-to-
+// semantic contract, so a rebooting runtime succeeds instead of instantly
+// failing. Non-timeout errors and outer aborts propagate immediately.
+// 15s: memory boot is ~2-4s warm-cache / ~10s worst since the PG fast-start
+// fix; keeping this tight bounds the clear path's worst case (2 memory calls
+// retried + 120s semantic) under the TUI auto-clear watchdog (180s).
+const RECALL_COLD_START_TIMEOUT_MS = 15_000;
+function isTimeoutError(err) {
+    return typeof err?.message === 'string' && err.message.includes('timed out after');
+}
+async function callMemoryColdStart(args, callerCtx, timeoutMs) {
+    try {
+        return await callMemoryBounded(args, callerCtx, timeoutMs);
+    } catch (err) {
+        if (!isTimeoutError(err) || callerCtx?.signal?.aborted) throw err;
+        const coldMs = Math.max(timeoutMs, RECALL_COLD_START_TIMEOUT_MS);
+        if (coldMs <= timeoutMs) throw err;
+        try { process.stderr.write(`[session] recall-fasttrack ${args?.action || 'call'} cold-start retry (${timeoutMs}ms -> ${coldMs}ms)\n`); } catch {}
+        return await callMemoryBounded(args, callerCtx, coldMs);
+    }
+}
+// Semantic-compact timeout scales with transcript size (clear/manual path):
+// default max(30s, ~10s per 25k estimated message tokens) capped at 120s, so a
+// large (~100k-token) transcript no longer dies on a fixed 30s bound.
+// session.compaction.timeoutMs still overrides.
+function semanticCompactTimeoutMs(session, messageTokens) {
+    const override = positiveContextWindow(session?.compaction?.timeoutMs);
+    if (override) return override;
+    const scaled = Math.ceil((messageTokens || 0) / 25_000) * 10_000;
+    return Math.min(120_000, Math.max(30_000, scaled));
+}
 async function callMemoryBounded(args, callerCtx, timeoutMs) {
     const ac = new AbortController();
     const outer = callerCtx?.signal;
@@ -118,7 +151,7 @@ async function runRecallFastTrackForSession(session, messages, opts = {}) {
         || Math.max(500, Math.min(5000, messages.length || 0));
     const memoryTimeoutMs = recallMemoryTimeoutMs(session);
     try {
-        await callMemoryBounded({
+        await callMemoryColdStart({
             action: 'ingest_session',
             sessionId,
             messages,
@@ -140,7 +173,7 @@ async function runRecallFastTrackForSession(session, messages, opts = {}) {
     // digest.
     let recallText = '';
     try {
-        const browsed = await callMemoryBounded({
+        const browsed = await callMemoryColdStart({
             action: 'search',
             sessionId,
             limit: positiveContextWindow(session?.compaction?.recallDigestLimit) || 30,
@@ -298,7 +331,7 @@ export async function runSessionCompaction(session, opts = {}) {
                             signal: opts.signal || null,
                             promptCacheKey: session.promptCacheKey || null,
                             providerCacheKey: session.promptCacheKey || null,
-                            timeoutMs: positiveContextWindow(session.compaction?.timeoutMs) || 30_000,
+                            timeoutMs: semanticCompactTimeoutMs(session, beforeMessageTokens),
                             tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
                             keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
                             preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),
@@ -341,7 +374,7 @@ export async function runSessionCompaction(session, opts = {}) {
                     signal: opts.signal || null,
                     promptCacheKey: session.promptCacheKey || null,
                     providerCacheKey: session.promptCacheKey || null,
-                    timeoutMs: positiveContextWindow(session.compaction?.timeoutMs) || 30_000,
+                    timeoutMs: semanticCompactTimeoutMs(session, beforeMessageTokens),
                     tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
                     keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
                     preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -314,6 +314,11 @@ export function createSession(opts) {
         },
         tools,
         preset: toolPreset,
+        // Persisted so the deferred call-through gate (deferred-call-through.mjs
+        // resolveDeferredSelectMode) can resolve the session's tool mode; without
+        // this every session read `undefined` and write-capable deferred tools
+        // (e.g. MCP) were permanently denied auto-promotion.
+        toolSpec,
         presetName: presetObj?.name || null,
         effort,
         fast,
@@ -459,6 +464,8 @@ export async function resumeSession(sessionId, preset) {
     if (ownerIsAgent) {
         toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, session.toolPermission, session.agent || null);
     }
+    // Keep the persisted tool mode in sync on resume (see createSession note).
+    session.toolSpec = toolSpec;
     session.tools = finalizeSessionToolList(toolsForRouting, {
         schemaAllowedTools: Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null,
         disallowedTools: getHiddenAgent(session.agent || null) ? ['Skill'] : null,

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -45,17 +45,20 @@ const _lastSaveError = new Map(); // id -> { message, at }
 // starving the model of the image mid-conversation. Returns the same object
 // reference when nothing changed (no-image sessions pay only a shallow scan).
 function _sessionForDisk(session) {
-    // Strip the in-flight live-turn alias (askSession sets session.liveTurnMessages
-    // for the turn duration so contextStatus() can estimate live context growth).
-    // It is a transient duplicate of the working transcript and must never be
-    // serialized: mid-turn saves (persistIterationMetrics) would otherwise bloat
-    // the session file and persist a non-canonical message array.
-    const hasLiveTurn = session && typeof session === 'object'
-        && Object.prototype.hasOwnProperty.call(session, 'liveTurnMessages');
+    // Strip transient in-flight aliases askSession sets for the turn duration:
+    //  - liveTurnMessages: live working transcript (so contextStatus() can
+    //    estimate live context growth) — a duplicate of the working transcript
+    //    that must never be serialized (mid-turn saves would bloat the file and
+    //    persist a non-canonical message array).
+    //  - toolApprovalHook: the askOpts.onToolApproval callback wired for the
+    //    turn — a function that must never be serialized.
+    const hasTransient = session && typeof session === 'object'
+        && (Object.prototype.hasOwnProperty.call(session, 'liveTurnMessages')
+            || Object.prototype.hasOwnProperty.call(session, 'toolApprovalHook'));
     const messages = Array.isArray(session?.messages) ? session.messages : null;
     if (!messages || messages.length === 0) {
-        if (!hasLiveTurn) return session;
-        const { liveTurnMessages: _drop, ...rest } = session;
+        if (!hasTransient) return session;
+        const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
         return rest;
     }
     let changed = false;
@@ -66,11 +69,11 @@ function _sessionForDisk(session) {
         return m;
     });
     if (!changed) {
-        if (!hasLiveTurn) return session;
-        const { liveTurnMessages: _drop, ...rest } = session;
+        if (!hasTransient) return session;
+        const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
         return rest;
     }
-    const { liveTurnMessages: _drop, ...rest } = session;
+    const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
     return { ...rest, messages: out };
 }
 
@@ -305,13 +308,26 @@ export function saveSessionAsync(session, opts) {
     setLiveSession(session);
     const reqId = ++_saveWorkerReqId;
     const safeOpts = opts || null;
+    // The Worker `postMessage` below structured-clones the whole session on the
+    // main thread. `session.liveTurnMessages` (live working transcript) and
+    // `session.toolApprovalHook` (askOpts.onToolApproval callback) are transient
+    // in-flight aliases askSession sets for the turn duration; both carry
+    // non-cloneable values (a function, and raw messages that can hold functions),
+    // which makes structuredClone throw "could not be cloned" for every mid-turn
+    // iteration save. The worker strips both via _sessionForDisk anyway, so drop
+    // them from the cloned payload here WITHOUT mutating the live session object.
+    const clonePayload = (session && typeof session === 'object'
+        && (Object.prototype.hasOwnProperty.call(session, 'liveTurnMessages')
+            || Object.prototype.hasOwnProperty.call(session, 'toolApprovalHook')))
+        ? (() => { const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session; return rest; })()
+        : session;
     return new Promise((resolve, reject) => {
         // Persist {session, opts} so drainSessionStore can sync-flush
         // outstanding writes if process exit interrupts the worker queue.
-        _saveWorkerPending.set(reqId, { resolve, reject, session, opts: safeOpts });
+        _saveWorkerPending.set(reqId, { resolve, reject, session: clonePayload, opts: safeOpts });
         try {
             const w = _getOrSpawnWorker();
-            w.postMessage({ session, opts: safeOpts, reqId });
+            w.postMessage({ session: clonePayload, opts: safeOpts, reqId });
             // Ref AFTER successful postMessage so a queue/throw failure path
             // does not leave the worker held alive with no pending message.
             // Paired with the unref in the message handler when count hits 0.

package/src/runtime/agent/orchestrator/tools/bash-session.mjs

@@ -40,7 +40,7 @@ import { spawn } from 'node:child_process';
 import * as nodeUtil from 'node:util';
 import { existsSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
-import { invalidateBuiltinResultCache, analyzeShellCommandEffects, preflightShellLargeFileProbe } from './builtin.mjs';
+import { invalidateBuiltinResultCache, analyzeShellCommandEffects } from './builtin.mjs';
 import { markCodeGraphDirtyPaths, drainCodeGraphCache } from './code-graph-state.mjs';
 import { maybeRewriteWmicProcessCommand } from './shell-policy.mjs';
 import { _maybeEncodePowerShellCommand } from './shell-command.mjs';
@@ -51,13 +51,15 @@ import { startChildGuardian } from '../../../shared/child-guardian.mjs';
 
 globalThis.__mixdogBashSessionRuntimeLoaded = true;
 
-// Default 600 s (10 min), max 1800 s. Aligned with the one-shot bash tool's
-// 600 s default (builtin/bash-tool.mjs); the persistent shell carries
-// longer-running pipelines (build/test/install) than one-shot calls, so a
-// 120 s default left those workflows timing out at 2 min. Per-call `timeout`
-// still overrides, capped at MAX_TIMEOUT_MS.
-const DEFAULT_TIMEOUT_MS = 600_000;
-const MAX_TIMEOUT_MS = 1_800_000;
+// Claude Code parity (refs/claude-code src/utils/timeouts.ts): default 120 s
+// (2 min), max 600 s (10 min), BASH_DEFAULT_TIMEOUT_MS / BASH_MAX_TIMEOUT_MS
+// env overrides (max floored at default). Matches the one-shot bash tool
+// (builtin/bash-tool.mjs); per-call `timeout` still overrides, capped at
+// MAX_TIMEOUT_MS.
+const _envDefaultTimeout = parseInt(process.env.BASH_DEFAULT_TIMEOUT_MS ?? '', 10);
+const DEFAULT_TIMEOUT_MS = _envDefaultTimeout > 0 ? _envDefaultTimeout : 120_000;
+const _envMaxTimeout = parseInt(process.env.BASH_MAX_TIMEOUT_MS ?? '', 10);
+const MAX_TIMEOUT_MS = Math.max(_envMaxTimeout > 0 ? _envMaxTimeout : 600_000, DEFAULT_TIMEOUT_MS);
 const IDLE_TIMEOUT_MS = 5 * 60_000;
 const MAX_SESSIONS = 10;
 const STDERR_DRAIN_MS = 25;
@@ -643,8 +645,6 @@ async function bash_session(args, cwd = process.cwd(), opts = {}) {
         }
         return requestedCwd;
     })();
-    const largeProbe = await preflightShellLargeFileProbe(command, baseCwd);
-    if (largeProbe) return `Error: ${largeProbe.message}`;
     const rawTimeout = typeof args?.timeout === 'number' ? args.timeout : DEFAULT_TIMEOUT_MS;
     const timeoutMs = rawTimeout;
     const effectiveTimeout = Math.min(Math.max(timeoutMs, 1), wmicRewrite?.timeoutMs || MAX_TIMEOUT_MS);

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -21,7 +21,6 @@ import {
 import {
     analyzeShellCommandEffects,
     foregroundLongCommandHint,
-    preflightShellLargeFileProbe,
 } from './shell-analysis.mjs';
 import {
     cancelBackgroundTask,
@@ -201,8 +200,6 @@ export async function executeBashTool(args, workDir, options = {}) {
         return _execPolicyBlock;
     }
 
-    const largeProbe = await preflightShellLargeFileProbe(command, bashWorkDir);
-    if (largeProbe) return `Error: ${largeProbe.message}`;
     let shellEffects;
     try {
         shellEffects = await analyzeShellCommandEffects(command, bashWorkDir);
@@ -211,9 +208,14 @@ export async function executeBashTool(args, workDir, options = {}) {
     }
     // Keep foreground commands on a long tool-owned timeout. The MCP dispatch
     // layer must not add a shorter fallback ceiling when timeout is omitted.
-    const DEFAULT_BASH_TIMEOUT_MS = 600_000;
-    const DEFAULT_BACKGROUND_BASH_TIMEOUT_MS = 600_000;
-    const MAX_BASH_TIMEOUT_MS = 1_800_000;
+    // Claude Code parity (refs/claude-code src/utils/timeouts.ts): default
+    // 120 s (2 min), max 600 s (10 min); BASH_DEFAULT_TIMEOUT_MS /
+    // BASH_MAX_TIMEOUT_MS env overrides, max floored at default.
+    const _envDefaultTimeout = parseInt(process.env.BASH_DEFAULT_TIMEOUT_MS ?? '', 10);
+    const DEFAULT_BASH_TIMEOUT_MS = _envDefaultTimeout > 0 ? _envDefaultTimeout : 120_000;
+    const DEFAULT_BACKGROUND_BASH_TIMEOUT_MS = DEFAULT_BASH_TIMEOUT_MS;
+    const _envMaxTimeout = parseInt(process.env.BASH_MAX_TIMEOUT_MS ?? '', 10);
+    const MAX_BASH_TIMEOUT_MS = Math.max(_envMaxTimeout > 0 ? _envMaxTimeout : 600_000, DEFAULT_BASH_TIMEOUT_MS);
     const defaultTimeoutMs = runInBackground
         ? DEFAULT_BACKGROUND_BASH_TIMEOUT_MS
         : DEFAULT_BASH_TIMEOUT_MS;

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -12,6 +12,19 @@ import {
     executionModeSchemaDescription,
 } from '../../../../shared/background-tasks.mjs';
 
+// Shell timeout envelope surfaced in the tool schema. Mirrors Claude Code:
+// default 120 s / max 600 s, BASH_DEFAULT_TIMEOUT_MS / BASH_MAX_TIMEOUT_MS
+// env overrides, max floored at default. Keep in sync with
+// builtin/bash-tool.mjs and bash-session.mjs.
+function _shellDefaultTimeoutMs() {
+    const parsed = parseInt(process.env.BASH_DEFAULT_TIMEOUT_MS ?? '', 10);
+    return parsed > 0 ? parsed : 120_000;
+}
+function _shellMaxTimeoutMs() {
+    const parsed = parseInt(process.env.BASH_MAX_TIMEOUT_MS ?? '', 10);
+    return Math.max(parsed > 0 ? parsed : 600_000, _shellDefaultTimeoutMs());
+}
+
 export const BUILTIN_TOOLS = [
     {
         name: 'read',
@@ -59,7 +72,7 @@ export const BUILTIN_TOOLS = [
             properties: {
                 command: { type: 'string', description: 'Command.' },
                 cwd: { type: 'string', description: 'Working directory. Persists across shell calls in a session — omit to reuse the previous command\'s directory (e.g. after cd); pass an absolute path to change it.' },
-                timeout: { type: 'number', description: 'Timeout ms.' },
+                timeout: { type: 'number', description: `Timeout ms. Default ${_shellDefaultTimeoutMs()} (${_shellDefaultTimeoutMs() / 60000} min); long-running commands may raise it up to ${_shellMaxTimeoutMs()} (${_shellMaxTimeoutMs() / 60000} min).` },
                 merge_stderr: { type: 'boolean', description: 'Merge stderr.' },
                 mode: { type: 'string', enum: ['sync', 'async'], description: executionModeSchemaDescription('sync') },
                 shell: { type: 'string', enum: ['bash', 'powershell'], description: 'Force shell. Windows defaults to PowerShell; bash = Git Bash/POSIX.' },

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-paths.mjs

@@ -109,7 +109,7 @@ async function sweepStaleShellJobs(dir) {
     });
     await Promise.all([
         ...expired.flatMap((jobId) =>
-            ['.json', '.done', '.exit', '.enforced', '.exit.cmd.sh', '.exit.cmd.ps1', '.stdout.log', '.stderr.log'].map((ext) =>
+            ['.json', '.done', '.exit', '.enforced', '.exit.cmd.sh', '.exit.cmd.ps1', '.exit.user.ps1', '.stdout.log', '.stderr.log'].map((ext) =>
                 fsPromises.unlink(join(dir, jobId + ext)).catch(() => {}),
             ),
         ),

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -86,10 +86,6 @@ function psSingleQuote(s) {
     return `'${String(s).replace(/'/g, "''")}'`;
 }
 
-function powerShellEncodedCommand(command) {
-    return Buffer.from(String(command || ''), 'utf16le').toString('base64');
-}
-
 function isPowerShellShell(shell, shellType) {
     if (shellType === 'powershell') return true;
     const stem = basename(String(shell || '')).toLowerCase().replace(/\.exe$/, '');
@@ -857,14 +853,24 @@ function startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr
     const exitPath = shellJobExitPath(jobId);
     const donePath = shellJobDonePath(jobId);
     const wrappedTempPath = `${exitPath}.cmd.ps1`;
-    const encodedCommand = powerShellEncodedCommand(command);
+    // Stage the USER command as its own .ps1 and run it via `-File` instead of
+    // `-EncodedCommand <base64>`: the base64 token landed on the grandchild's
+    // visible command line, which is a prime Defender obfuscation signature
+    // (same family as the PowhidSubExec false positive). A file path on the
+    // command line carries no such signature, and the payload stays opaque to
+    // outer-shell quoting exactly as base64 did. UTF-8 BOM so Windows
+    // PowerShell 5.1 doesn't misread non-ASCII as ANSI.
+    // Trailer mirrors -Command/-EncodedCommand exit semantics (-File alone
+    // does NOT propagate the last native command's exit code).
+    const innerTempPath = `${exitPath}.user.ps1`;
+    const innerScript = `\ufeff${command}\nif ($null -ne $LASTEXITCODE) { exit $LASTEXITCODE }\n`;
     const mergeLiteral = mergeStderr ? '$true' : '$false';
     const wrapper = [
         "$ErrorActionPreference = 'Continue'",
         '[Console]::OutputEncoding=[System.Text.Encoding]::UTF8',
         '$OutputEncoding=[System.Text.Encoding]::UTF8',
         '$exe = (Get-Process -Id $PID).Path',
-        `$encoded = ${psSingleQuote(encodedCommand)}`,
+        `$innerPath = ${psSingleQuote(innerTempPath)}`,
         `$stdoutPath = ${psSingleQuote(stdoutPath)}`,
         `$stderrPath = ${psSingleQuote(rawStderrPath)}`,
         `$exitPath = ${psSingleQuote(exitPath)}`,
@@ -873,7 +879,10 @@ function startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr
         `$timeoutMs = ${Math.max(1, Math.floor(timeoutMs || 0))}`,
         '$code = 1',
         'try {',
-        "    $argList = @('-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', $encoded)",
+        // -ExecutionPolicy Bypass: unlike -EncodedCommand, -File is subject to
+        // the execution policy on Windows PowerShell; pwsh on macOS/Linux
+        // accepts the parameter as a no-op, so it is safe unconditionally.
+        "    $argList = @('-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', $innerPath)",
         // -WindowStyle is a Windows-only Start-Process parameter; pwsh on
         // macOS/Linux throws "not supported on this platform". Add it only on win32.
         '    $spArgs = @{ FilePath = $exe; ArgumentList = $argList; RedirectStandardOutput = $stdoutPath; RedirectStandardError = $stderrPath; PassThru = $true }',
@@ -912,23 +921,27 @@ function startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr
         '}',
         'try { Set-Content -LiteralPath $exitPath -Value ([string]$code) -NoNewline -Encoding ascii } catch {}',
         'try { Set-Content -LiteralPath $donePath -Value "" -NoNewline -Encoding ascii } catch {}',
+        'try { Remove-Item -LiteralPath $innerPath -Force -ErrorAction SilentlyContinue } catch {}',
         'try { Remove-Item -LiteralPath $PSCommandPath -Force -ErrorAction SilentlyContinue } catch {}',
         'exit $code',
         '',
     ].join('\n');
     try {
         writeFileSync(wrappedTempPath, wrapper, 'utf-8');
+        writeFileSync(innerTempPath, innerScript, 'utf-8');
     } catch (e) {
         return { jobId, kind: 'bash', status: 'failed', error: `failed to stage PowerShell background task: ${e?.message || e}` };
     }
 
     const shellStem = basename(String(shell || '')).toLowerCase().replace(/\.exe$/, '');
-    // `-WindowStyle Hidden` is a Windows-only CLI switch; pwsh on macOS/Linux
-    // rejects it. `-ExecutionPolicy` likewise only applies to Windows
-    // PowerShell. Build args per-platform so cross-OS pwsh background tasks run.
+    // No `-WindowStyle Hidden` CLI switch: windowsHide:true on the spawn below
+    // already gives CREATE_NO_WINDOW, and the visible command-line token trips
+    // Defender's hidden-PowerShell dropper signature (PowhidSubExec). The
+    // in-wrapper Start-Process WindowStyle=Hidden (above) stays — it lives in
+    // the staged .ps1, not on the command line, and is still needed there.
+    // `-ExecutionPolicy` only applies to Windows PowerShell; build per-platform.
     const isWin = process.platform === 'win32';
     const wrapperArgs = ['-NoLogo', '-NoProfile', '-NonInteractive'];
-    if (isWin) wrapperArgs.push('-WindowStyle', 'Hidden');
     if (isWin && shellStem === 'powershell') wrapperArgs.push('-ExecutionPolicy', 'Bypass');
     wrapperArgs.push('-File', wrappedTempPath);
     // Spawn the staged wrapper directly. detached MUST be false on Windows:

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -27,11 +27,12 @@ function shellTypeFor(shell) {
 
 function shellSpec(shell, shellType = shellTypeFor(shell)) {
     if (shellType === 'powershell') {
-        // `-WindowStyle Hidden` is a Windows-only switch. PowerShell Core
-        // (pwsh) on macOS/Linux rejects it, so only append it on win32.
-        const psArgs = ['-NoLogo', '-NoProfile', '-NonInteractive'];
-        if (process.platform === 'win32') psArgs.push('-WindowStyle', 'Hidden');
-        psArgs.push('-Command');
+        // Deliberately NO `-WindowStyle Hidden` here: every spawn site passes
+        // windowsHide:true (CREATE_NO_WINDOW), which suppresses the console at
+        // the OS level without leaving a token on the command line. The CLI
+        // switch is redundant AND matches Defender's node→hidden-PowerShell
+        // dropper signature (Trojan:Win32/PowhidSubExec false positive).
+        const psArgs = ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command'];
         return {
             shell,
             shellArg: '-Command',