mixdog 0.9.22 → 0.9.24

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -27,11 +27,12 @@ function shellTypeFor(shell) {
 
 function shellSpec(shell, shellType = shellTypeFor(shell)) {
     if (shellType === 'powershell') {
-        // `-WindowStyle Hidden` is a Windows-only switch. PowerShell Core
-        // (pwsh) on macOS/Linux rejects it, so only append it on win32.
-        const psArgs = ['-NoLogo', '-NoProfile', '-NonInteractive'];
-        if (process.platform === 'win32') psArgs.push('-WindowStyle', 'Hidden');
-        psArgs.push('-Command');
+        // Deliberately NO `-WindowStyle Hidden` here: every spawn site passes
+        // windowsHide:true (CREATE_NO_WINDOW), which suppresses the console at
+        // the OS level without leaving a token on the command line. The CLI
+        // switch is redundant AND matches Defender's node→hidden-PowerShell
+        // dropper signature (Trojan:Win32/PowhidSubExec false positive).
+        const psArgs = ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command'];
         return {
             shell,
             shellArg: '-Command',

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch.mjs

@@ -180,13 +180,61 @@ async function codeGraph(args, cwd, signal = null, options = {}) {
   }
 
   if (mode === 'dependents') {
-    if (!rel) throw new Error('code_graph dependents: "file" is required');
-    if (!node) return _appendSameBasenameHint(`Error: code_graph dependents: file not found in graph: ${normFile || '(missing file)'}`, normFile, graph);
+    let depRel = rel;
+    let depNorm = normFile;
+    let subNote = null;
+    // (1) Symbol inference runs ONLY when no `file` arg was supplied at all —
+    // an explicit file (even a directory that yields no rel) is never overridden.
+    if (!depRel && !normFile) {
+      const symCandidates = [
+        ...(Array.isArray(args?.symbols) ? args.symbols : []),
+        args?.symbol,
+      ].map((s) => String(s || '').trim()).filter(Boolean);
+      const KNOWN_SRC_EXT = /\.(mjs|cjs|js|jsx|mts|cts|ts|tsx|json|py|go|rb|rs|java|kt|c|h|cc|cpp|hpp|cs|php|swift|scala|sh)$/i;
+      // (2) Symbol lookup FIRST — dotted names (e.g. obj.method) resolve here
+      // before any path classification.
+      for (const s of symCandidates) {
+        const hits = _findSymbolHits(graph, s, {});
+        const usable = hits.filter((h) => graph.nodes.get(h.rel));
+        const pool = usable.length ? usable : hits;
+        if (!pool.length) continue;
+        // (3) Deterministic pick: defining hit, else first by sorted rel.
+        const sorted = [...pool].sort((a, b) => String(a.rel).localeCompare(String(b.rel)));
+        const primary = sorted.find((h) => h.declarationLike) || sorted[0];
+        depRel = primary.rel; depNorm = primary.rel;
+        subNote = `# note: dependents resolved from symbol '${s}' → ${primary.rel}`;
+        const others = [...new Set(sorted.map((h) => h.rel))].filter((r) => r !== primary.rel);
+        if (others.length) subNote += `\n# note: '${s}' also defined in: ${others.join(', ')}`;
+        break;
+      }
+      // Path-classification only when the value has a slash or a known source
+      // extension — never for plain dotted symbol names.
+      if (!depRel) {
+        const pathLike = symCandidates.find((s) => /[\\/]/.test(s) || KNOWN_SRC_EXT.test(s));
+        if (pathLike) {
+          const pAbs = isAbsolute(pathLike) ? pathResolve(pathLike) : pathResolve(cwd, pathLike);
+          const pRel = _graphRel(pAbs, cwd);
+          if (graph.nodes.get(pRel)) {
+            depRel = pRel; depNorm = pathLike;
+            subNote = `# note: treated symbol '${pathLike}' as file`;
+          }
+        }
+      }
+      // (4) Nothing resolved → actionable hint naming the attempted values,
+      // with a distinct message when no symbol was supplied at all.
+      if (!depRel) {
+        throw new Error(symCandidates.length
+          ? `code_graph dependents: dependents needs file:<path>; got symbol only (tried: ${symCandidates.join(', ')})`
+          : 'code_graph dependents: "file" is required (no file or symbol supplied)');
+      }
+    }
+    const depFileNode = depRel ? graph.nodes.get(depRel) : null;
+    if (!depFileNode) return _appendSameBasenameHint(`Error: code_graph dependents: file not found in graph: ${depNorm || '(missing file)'}`, depNorm, graph);
     const GRAPH_LIST_CAP = 200;
-    const depsAll = [...(graph.reverse.get(rel) || [])].sort();
+    const depsAll = [...(graph.reverse.get(depRel) || [])].sort();
     if (!depsAll.length) return '(no dependents)';
     const deps = depsAll.slice(0, GRAPH_LIST_CAP);
-    const basename = rel.split('/').pop();
+    const basename = depRel.split('/').pop();
     const stem = basename.replace(/\.[^/.]+$/, '');
     const enriched = deps.map((dep) => {
       const depNode = graph.nodes.get(dep);
@@ -203,7 +251,8 @@ async function codeGraph(args, cwd, signal = null, options = {}) {
       }
       return dep;
     });
-    const out = enriched.join('\n');
+    const body = enriched.join('\n');
+    const out = subNote ? `${subNote}\n${body}` : body;
     return depsAll.length > deps.length
       ? `${out}\n[truncated — showing first ${GRAPH_LIST_CAP} of ${depsAll.length} dependents]`
       : out;

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -17,8 +17,7 @@ import {
   resolveV4AEntryPath,
   parsedEntryResolvedPath,
   isResolvedPathOutsideBase,
-  assertNoDuplicateParsedModifyTargets,
-  mergeDuplicateParsedModifyEntries,
+  splitParsedModifyWaves,
   renderParsedUnifiedPatch,
   rewriteHeaderPaths,
   preValidateNativeBatch,
@@ -190,17 +189,17 @@ async function apply_patch(args, cwd, options = {}) {
   if (!v4aRenameOnly && (!Array.isArray(parsed) || parsed.length === 0)) {
     return 'Error: patch contained no file sections';
   }
+  // Split duplicate modify-target blocks into sequential waves: occurrence i
+  // of a path lands in wave i so each duplicate applies against the prior
+  // wave's on-disk result. Non-duplicate patches yield exactly one wave, so
+  // single-target behavior is unchanged.
+  let parsedWaves = v4aRenameOnly ? [] : [parsed];
   if (!v4aRenameOnly) {
     try {
-      assertNoDuplicateParsedModifyTargets(parsed, basePath);
+      parsedWaves = splitParsedModifyWaves(parsed, basePath);
     } catch (err) {
       return `Error: ${err?.message || String(err)}`;
     }
-    const merged = mergeDuplicateParsedModifyEntries(parsed, basePath);
-    if (merged.changed) {
-      parsed = merged.parsed;
-      normalizedPatchStr = renderParsedUnifiedPatch(parsed);
-    }
   }
 
   if (!v4aRenameOnly) {
@@ -210,18 +209,22 @@ async function apply_patch(args, cwd, options = {}) {
       return `Error: ${err?.message || String(err)}`;
     }
   }
-  let entries = [];
-  let headerRewrites = [];
+  // Pre-validate each wave independently: a wave only ever holds unique
+  // targets, so the native batch's per-file semantics stay intact.
+  const waveDispatch = [];
   if (!v4aRenameOnly) {
     try {
-      ({ entries, headerRewrites } = await preValidateNativeBatch(parsed, basePath));
+      for (const wparsed of parsedWaves) {
+        const { entries, headerRewrites } = await preValidateNativeBatch(wparsed, basePath);
+        waveDispatch.push({ parsed: wparsed, entries, headerRewrites });
+      }
     } catch (err) {
       return `Error: ${err?.message || String(err)}`;
     }
   }
 
   const _lockPaths = [
-    ...entries.map((entry) => entry.fullPath),
+    ...new Set(waveDispatch.flatMap((wd) => wd.entries.map((entry) => entry.fullPath))),
     ...(v4aRenamePlan?.renameSections || []).flatMap((section) => {
       const src = resolveV4AEntryPath(basePath, section.path);
       const dest = resolveV4AEntryPath(basePath, section.movePath);
@@ -240,56 +243,96 @@ async function apply_patch(args, cwd, options = {}) {
       if (lines.length === 0) return 'Error: patch contained no applicable file sections';
       return wrapPatchMutationOutput(`${lines.join('\n')}\n`, mutationPlan, { backend: 'v4a-rename' });
     }
-    const insideEntries = entries.filter((entry) => !isResolvedPathOutsideBase(entry.fullPath, basePath));
-    const outsideEntries = entries.filter((entry) => isResolvedPathOutsideBase(entry.fullPath, basePath));
-    const parsedInside = (parsed || []).filter(
-      (entry) => !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath),
-    );
-    const backend = outsideEntries.length > 0
-      ? (insideEntries.length > 0 ? 'native+js-patch' : 'js-patch')
-      : 'native-patch';
-    const resultParts = [];
-    if (insideEntries.length > 0) {
-      const nativePatchStr = rewriteHeaderPaths(renderParsedUnifiedPatch(parsedInside), headerRewrites);
-      const nativeResult = await dispatchNativePatch({
-        entries: insideEntries,
-        basePath,
-        nativePatchStr,
-        fuzz,
-        rejectPartial,
-        dryRun,
-        readStateScope,
-        signal: abortSignal,
-        parsed: parsedInside,
-      });
-      if (isPatchErrorText(nativeResult)) {
-        return wrapPatchMutationOutput(nativeResult, mutationPlan, { backend });
+    // Apply one wave (a set of unique targets) via the existing native(+js)
+    // split. Returns { backend, text } on success or { backend, error } so the
+    // caller can decide whether earlier waves already committed to disk.
+    const applyWave = async ({ parsed: wparsed, entries: wentries, headerRewrites: whr }) => {
+      const insideEntries = wentries.filter((entry) => !isResolvedPathOutsideBase(entry.fullPath, basePath));
+      const outsideEntries = wentries.filter((entry) => isResolvedPathOutsideBase(entry.fullPath, basePath));
+      const parsedInside = (wparsed || []).filter(
+        (entry) => !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath),
+      );
+      const backend = outsideEntries.length > 0
+        ? (insideEntries.length > 0 ? 'native+js-patch' : 'js-patch')
+        : 'native-patch';
+      const resultParts = [];
+      if (insideEntries.length > 0) {
+        const nativePatchStr = rewriteHeaderPaths(renderParsedUnifiedPatch(parsedInside), whr);
+        const nativeResult = await dispatchNativePatch({
+          entries: insideEntries,
+          basePath,
+          nativePatchStr,
+          fuzz,
+          rejectPartial,
+          dryRun,
+          readStateScope,
+          signal: abortSignal,
+          parsed: parsedInside,
+        });
+        if (isPatchErrorText(nativeResult)) return { backend, error: nativeResult };
+        resultParts.push(nativeResult);
       }
-      resultParts.push(nativeResult);
-    }
-    if (outsideEntries.length > 0) {
-      // Out-of-base targets are applied via the JS dispatcher (no base-path
-      // confinement); write permission is enforced at the hook layer.
-      const jsResult = await dispatchJsPatchEntries({
-        rows: outsideEntries,
-        parsed,
-        basePath,
-        dryRun,
-        fuzzy,
-        readStateScope,
-      });
-      if (isPatchErrorText(jsResult)) {
-        return wrapPatchMutationOutput(jsResult, mutationPlan, { backend });
+      if (outsideEntries.length > 0) {
+        // Out-of-base targets are applied via the JS dispatcher (no base-path
+        // confinement); write permission is enforced at the hook layer.
+        const jsResult = await dispatchJsPatchEntries({
+          rows: outsideEntries,
+          parsed: wparsed,
+          basePath,
+          dryRun,
+          fuzzy,
+          readStateScope,
+        });
+        if (isPatchErrorText(jsResult)) return { backend, error: jsResult };
+        resultParts.push(jsResult);
+      }
+      return { backend, text: resultParts.join('\n') };
+    };
+
+    // Duplicate-target blocks were split into contiguous sequential groups
+    // (listed order preserved); apply them in order, each against the prior
+    // group's on-disk result.
+    const waveTexts = [];
+    let backend = 'native-patch';
+    // dry_run never writes, so a later group would validate against unchanged
+    // disk and false-fail on any block that depends on an earlier edit. Only
+    // the first group is validated under dry_run; the rest are reported as
+    // unsimulated below (no false failures).
+    const groupCount = (dryRun && waveDispatch.length > 1) ? 1 : waveDispatch.length;
+    for (let w = 0; w < groupCount; w++) {
+      const res = await applyWave(waveDispatch[w]);
+      backend = res.backend;
+      if (res.error) {
+        if (w === 0) return wrapPatchMutationOutput(res.error, mutationPlan, { backend });
+        // A later group failed. rejectPartial makes each group all-or-nothing,
+        // so every block in groups 1..w is fully committed to disk and left in
+        // place. List them all so the caller knows the true on-disk state.
+        const failMsg = res.error.replace(/^Error:\s*/, '');
+        const note = [
+          `Error: apply_patch: a block failed in sequential group ${w + 1}/${waveDispatch.length}; every edit listed below was already applied to disk (writes committed) and left in place:`,
+          waveTexts.join('\n'),
+          '--- failing block ---',
+          failMsg,
+        ].join('\n');
+        return wrapPatchMutationOutput(note, mutationPlan, { backend });
       }
-      resultParts.push(jsResult);
+      waveTexts.push(res.text);
+    }
+
+    let combined = waveTexts.join('\n');
+    if (dryRun && waveDispatch.length > 1) {
+      const skipped = [...new Set(
+        waveDispatch.slice(1).flatMap((wd) => wd.entries.map((e) => e.displayPath)),
+      )];
+      combined += `\n(dry_run: only the first sequential group was validated against disk; blocks depending on earlier edits were not simulated: ${skipped.join(', ')})`;
     }
-    let combined = resultParts.join('\n');
     const renameLines = formatV4ARenameSuccessLines(v4aRenameResults);
     if (renameLines.length > 0 && !isPatchErrorText(combined)) {
       combined = `${renameLines.join('\n')}\n${combined}`;
     }
     if (!isPatchErrorText(combined) && options?.toolCallId) {
-      registerApplyPatchUiDiff(options.toolCallId, rewriteHeaderPaths(normalizedPatchStr, headerRewrites));
+      const allRewrites = waveDispatch.flatMap((wd) => wd.headerRewrites);
+      registerApplyPatchUiDiff(options.toolCallId, rewriteHeaderPaths(normalizedPatchStr, allRewrites));
     }
     if (!isPatchErrorText(combined) && rejectedV4AHunks.length > 0) {
       const tail = [

package/src/runtime/agent/orchestrator/tools/patch/paths.mjs

@@ -88,42 +88,60 @@ function parsedEntryTargetKey(entry, basePath) {
   return process.platform === 'win32' ? fullPath.toLowerCase() : fullPath;
 }
 
-export function mergeDuplicateParsedModifyEntries(parsed, basePath) {
-  const out = [];
-  const byTarget = new Map();
-  let changed = false;
-  for (const entry of parsed || []) {
-    const key = parsedEntryTargetKey(entry, basePath);
-    if (!key) {
-      out.push(entry);
-      continue;
-    }
-    const existing = byTarget.get(key);
-    if (!existing) {
-      byTarget.set(key, entry);
-      out.push(entry);
-      continue;
+// Group parsed entries into sequential application "waves". When a file is
+// listed as a modify target N times, occurrence i is placed in wave i, so
+// each duplicate block applies against the on-disk result of the previous
+// one — the native engine re-reads the file per apply() call, giving true
+// sequential semantics ("block 2 against block 1's output"). Unique and
+// non-modify entries always land in wave 0.
+//
+// Genuinely unsupported same-path combos (a create/delete mixed with any
+// other block for that path) cannot be sequenced and throw with guidance to
+// merge hunks into one block or send separate apply_patch calls.
+export function splitParsedModifyWaves(parsed, basePath) {
+  const entries = Array.isArray(parsed) ? parsed : [];
+  const kindsByPath = new Map();
+  for (const entry of entries) {
+    const kind = classifyEntry(entry);
+    const headerName = kind === 'create' ? entry.newFileName : entry.oldFileName;
+    if (!headerName || DEV_NULL.test(headerName)) continue;
+    const full = resolveEntryPath(basePath, headerName);
+    const key = process.platform === 'win32' ? full.toLowerCase() : full;
+    const rec = kindsByPath.get(key) || { kinds: [], headerName };
+    rec.kinds.push(kind);
+    kindsByPath.set(key, rec);
+  }
+  for (const { kinds, headerName } of kindsByPath.values()) {
+    if (kinds.length > 1 && kinds.some((k) => k !== 'modify')) {
+      const display = normalizeOutputPath(stripDiffPrefix(headerName));
+      throw new Error(
+        `apply_patch: unsupported duplicate target ${display} — a create/delete block cannot `
+        + 'be combined with other blocks for the same path. Merge the hunks into one block or '
+        + 'send separate apply_patch calls.',
+      );
     }
-    existing.hunks.push(...(entry.hunks || []));
-    changed = true;
   }
-  return { parsed: out, changed };
-}
-
-
-export function assertNoDuplicateParsedModifyTargets(parsed, basePath) {
-  const seenPaths = new Set();
-  for (const entry of parsed || []) {
-    if (classifyEntry(entry) !== 'modify') continue;
+  // Split into contiguous sequential groups that PRESERVE the patch's block
+  // listing order: accumulate blocks until a target path would repeat within
+  // the current group, then start a new group beginning with that block.
+  // Every group holds unique targets (the native batch stays valid) and
+  // groups apply in listed order, so the effective apply order — and thus the
+  // set of committed blocks at any failure point — equals the on-wire order.
+  const groups = [];
+  let current = [];
+  let currentKeys = new Set();
+  for (const entry of entries) {
     const key = parsedEntryTargetKey(entry, basePath);
-    if (!key) continue;
-    if (seenPaths.has(key)) {
-      const headerName = entry.oldFileName || entry.newFileName;
-      const display = normalizeOutputPath(stripDiffPrefix(headerName));
-      throw new Error(`apply_patch: duplicate target ${display} — patch lists the same path twice.`);
+    if (key && currentKeys.has(key)) {
+      groups.push(current);
+      current = [];
+      currentKeys = new Set();
     }
-    seenPaths.add(key);
+    current.push(entry);
+    if (key) currentKeys.add(key);
   }
+  if (current.length > 0) groups.push(current);
+  return groups;
 }
 
 function headerRelFromBase(basePath, absNorm) {

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -526,10 +526,19 @@ function readRawBufForV4AConversion(fullPath) {
   return buf;
 }
 
+// win32 filesystems are case-insensitive, so `Foo` and `foo` are the same
+// file: the V4A source-line cache MUST key on this normalized form at every
+// get/set, otherwise a mixed-case duplicate section refreshed under one
+// casing is missed under another and converts against stale/original lines.
+export function v4aLinesCacheKey(fullPath) {
+  return process.platform === 'win32' ? String(fullPath).toLowerCase() : String(fullPath);
+}
+
 function v4aConversionSourceLines(fullPath, linesCache) {
-  if (linesCache.has(fullPath)) return linesCache.get(fullPath);
+  const cacheKey = v4aLinesCacheKey(fullPath);
+  if (linesCache.has(cacheKey)) return linesCache.get(cacheKey);
   const lines = splitTextLinesForPatch(readRawBufForV4AConversion(fullPath).toString('utf-8'));
-  linesCache.set(fullPath, lines);
+  linesCache.set(cacheKey, lines);
   return lines;
 }
 
@@ -552,6 +561,20 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
   const fuzzy = options.fuzzy !== false;
   const out = [];
   const v4aLinesCache = new Map();
+  // Paths that appear as update targets more than once: their duplicate
+  // sections must be converted against the PRIOR section's result so the
+  // emitted unified hunks line up for sequential (wave) application. We
+  // refresh v4aLinesCache after each such section below.
+  const dupUpdatePaths = new Set();
+  {
+    const seenUpd = new Set();
+    for (const s of sections || []) {
+      if (!s || s.kind === 'add' || s.kind === 'delete' || typeof s.path !== 'string' || !s.path) continue;
+      const fp = resolveV4AEntryPath(basePath, s.path);
+      const key = v4aLinesCacheKey(fp);
+      if (seenUpd.has(key)) dupUpdatePaths.add(key); else seenUpd.add(key);
+    }
+  }
   for (const section of sections) {
     const displayPath = section.path.replace(/\\/g, '/');
     if (section.kind === 'add') {
@@ -646,6 +669,16 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
       out.push(`+++ b/${displayPath}`);
       for (const line of sectionHunks) out.push(line);
     }
+    // If this path is edited again later, the next section must resolve
+    // against this section's applied result, not the original file — apply
+    // these hunks to the cached lines so duplicate V4A blocks convert to a
+    // sequentially-appliable unified patch. Best-effort: on any mismatch we
+    // keep the original cache and let native wave application surface it.
+    if (dupUpdatePaths.has(v4aLinesCacheKey(fullPath))) {
+      try {
+        v4aLinesCache.set(v4aLinesCacheKey(fullPath), applyV4AHunksToLines(sourceLines, section.hunks, { fuzzy }));
+      } catch { /* leave original cached lines */ }
+    }
   }
   return out.join('\n') + '\n';
 }