mixdog 0.9.22 → 0.9.24

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -37,7 +37,7 @@ import { startChildGuardian } from '../../../shared/child-guardian.mjs';
 // transition). shell-jobs.mjs imports stripAnsi from this module, so this is
 // a static cycle — safe because neither binding is touched at module-eval
 // time, only when the respective functions actually run.
-import { adoptForegroundShellJob } from './builtin/shell-jobs.mjs';
+import { adoptForegroundShellJob, killShellJob } from './builtin/shell-jobs.mjs';
 import {
   _maybeEncodePowerShellCommand,
   extractPowerShellCommandInner,
@@ -433,6 +433,55 @@ async function _execPolicyBlockMessage(command) {
   return checkExecPolicyMessage(command);
 }
 
+// Count of shell spawns currently in-flight (including those parked in an
+// EPERM backoff). Logged with each failed spawn so a Defender-induced storm
+// is reconstructable: activeSpawnCount > 1 means concurrent spawns were
+// racing the AV scan when the failure hit.
+let _activeShellSpawns = 0;
+
+function _isPowerShellSpawn(shell, shellArg) {
+  return /pwsh|powershell/i.test(String(shell || '')) || shellArg === '-Command';
+}
+
+// Windows Defender intermittently fails node→PowerShell spawns with EPERM
+// while it scans the child image (see shell-runtime.mjs Trojan false-positive
+// note). The failure is at spawn() time — before any stdio/side effect — so a
+// short bounded retry is safe and never re-runs a command that already ran.
+// Retry ONLY on EPERM/win32/powershell; everything else throws on first
+// failure. Backoff 100/300/700ms caps added latency at ~1.1s. Every failed
+// attempt logs one diagnostic line for later reconstruction.
+async function _spawnShellWithRetry({ shell, argv, spawnOptions, shellArg, cwd }) {
+  const _delays = [100, 300, 700];
+  const _isPowerShell = _isPowerShellSpawn(shell, shellArg);
+  _activeShellSpawns++;
+  try {
+    let attempt = 0;
+    for (;;) {
+      try {
+        return spawn(shell, argv, spawnOptions);
+      } catch (err) {
+        try {
+          console.error('[shell-spawn-retry] ' + JSON.stringify({
+            code: (err && err.code) || null,
+            syscall: (err && err.syscall) || null,
+            shell,
+            cwd,
+            activeSpawnCount: _activeShellSpawns,
+          }));
+        } catch { /* logging must never mask the spawn error */ }
+        const _canRetry = err && err.code === 'EPERM'
+          && process.platform === 'win32'
+          && _isPowerShell
+          && attempt < _delays.length;
+        if (!_canRetry) throw err;
+        await new Promise((r) => setTimeout(r, _delays[attempt++]));
+      }
+    }
+  } finally {
+    _activeShellSpawns--;
+  }
+}
+
 export function execShellCommand({
   shell,
   shellArg,
@@ -445,6 +494,7 @@ export function execShellCommand({
   autoBackgroundMs,
   onProgress,
   clientHostPid,
+  backgroundOnTimeout,
 }) {
   return new Promise(async (resolve) => {
     const taskId = `shell_${randomUUID().slice(0, 8)}`;
@@ -516,7 +566,12 @@ export function execShellCommand({
       const argv = Array.isArray(shellArgs) && shellArgs.length > 0
         ? [...shellArgs, _spawnCommand]
         : [shellArg, _spawnCommand];
-      child = spawn(shell, argv, {
+      child = await _spawnShellWithRetry({
+        shell,
+        argv,
+        shellArg,
+        cwd,
+        spawnOptions: {
         env,
         cwd,
         windowsHide: true,
@@ -533,6 +588,7 @@ export function execShellCommand({
         // not unref it after adoption. Windows detached has different console
         // semantics, so it stays off there.
         detached: process.platform !== 'win32',
+        },
       });
       startChildGuardian({
         childPid: child.pid,
@@ -668,16 +724,20 @@ export function execShellCommand({
       if (grace.unref) grace.unref();
     });
 
-    // Auto-background transition (CC ASSISTANT_BLOCKING_BUDGET_MS +
-    // startBackgrounding analogue). Fires once, autoBackgroundMs after spawn,
-    // IFF the child is still running and the run has not already settled /
-    // been killed / timed out. It adopts the child into the shell-jobs
-    // registry while keeping it owned by this CLI process, then resolves the
-    // call immediately with a 'backgrounded' result so the tool stops hanging.
-    // The 600 s timeoutMs upper bound is carried into the adopted job detail
-    // so refreshShellJob still enforces it. Mutually exclusive with settle()
-    // via the autoBackgrounded flag set synchronously at the top before any await.
-    const _autoBackground = async () => {
+    // Auto-background transition (CC startBackgrounding analogue). Two triggers
+    // resolve the call immediately with a 'backgrounded' result while the
+    // child keeps running, adopted into the shell-jobs registry but still
+    // owned by this CLI process:
+    //   1. the optional autoBackgroundMs soft threshold (MIXDOG_SHELL_AUTO_
+    //      BACKGROUND_MS opt-in) — an EARLIER promotion before the timeout, and
+    //   2. the foreground timeout deadline (backgroundOnTimeout) — the default
+    //      promote-on-timeout that replaces the old tree-kill.
+    // Either way the adopted job runs UNLIMITED (timeoutMs 0, matching the
+    // async default): the original foreground timeout no longer bounds it, and
+    // the adopted-job cap poll still enforces the 100 MB output ceiling.
+    // Mutually exclusive with settle() via the autoBackgrounded flag set
+    // synchronously at the top before any await.
+    const _autoBackground = async ({ reason = 'threshold' } = {}) => {
       // Win the race: bail if a terminal transition already happened, and
       // claim the transition synchronously so a concurrently-queued settle()
       // (which checks autoBackgrounded) becomes inert.
@@ -685,16 +745,18 @@ export function execShellCommand({
       if (child.exitCode != null || child.signalCode != null) return;
       autoBackgrounded = true;
       // The foreground capture is over; stop the local watchdogs/timers so
-      // they cannot treeKill the now-adopted child. The 600 s bound lives
-      // on in the adopted job detail (timeoutMs) for refreshShellJob.
+      // they cannot treeKill the now-adopted child. The adopted job runs
+      // unlimited; refreshShellJob only enforces the output cap.
       if (timer) { clearTimeout(timer); timer = null; }
       _clearProgressTimer();
       if (sizeWatchdog) { clearInterval(sizeWatchdog); sizeWatchdog = null; }
       if (autoBgTimer) { clearTimeout(autoBgTimer); autoBgTimer = null; }
-      if (abortSignal && abortHandler) {
-        try { abortSignal.removeEventListener('abort', abortHandler); } catch {}
-        abortHandler = null;
-      }
+      // Keep the abort handler ATTACHED through the promotion window. A user
+      // cancel racing in after promotion starts must still bring the adopted
+      // child down — the handler's treeKill(child) does exactly that (settle()
+      // is inert once autoBackgrounded, but the kill itself still lands, and
+      // refreshShellJob then flags the job failed). We only detach on a real
+      // settle() or on the adoption-failure fallback below.
       // Every subsequent stdout/stderr chunk must hit disk — the call is
       // about to resolve and nobody will drain the in-memory buffers again.
       try { taskOutput.forceSpill(); } catch {}
@@ -711,7 +773,9 @@ export function execShellCommand({
           command,
           cwd,
           pid: child.pid,
-          timeoutMs,
+          // Unlimited: the promoted job is no longer bounded by the foreground
+          // timeout (matches the async omitted-default behavior).
+          timeoutMs: 0,
           mergeStderr: false,
           stdoutPath,
           stderrPath,
@@ -722,6 +786,18 @@ export function execShellCommand({
       } catch {
         job = null;
       }
+      // Adoption failed AFTER the foreground timers/size-watchdog were already
+      // torn down. Do NOT resolve as backgrounded — that would leave the child
+      // running unlimited with no task_id and no watcher. Release the claim and
+      // fall back to the old kill path so the command never outlives a failed
+      // promotion. (The abort handler is still attached, so an in-flight cancel
+      // is honored by the kill path too.)
+      if (!job) {
+        autoBackgrounded = false;
+        if (reason === 'timeout') timedOut = true; else killed = true;
+        _treeKillForceSettle();
+        return;
+      }
       // Wire the lifecycle: on close, write the exit-code file FIRST then
       // touch donePath STRICTLY AFTER — the exact ordering refreshShellJob()
       // gates completion on (donePath visible ⇒ exit file fully flushed).
@@ -732,6 +808,14 @@ export function execShellCommand({
           try { writeFileSync(job.donePath, ''); } catch {}
         });
       }
+      // Adoption committed. If a cancel already fired (before or during the
+      // adoption window), bring the now-adopted child down via its jobId so the
+      // promotion can't outlive a user abort. Idempotent with the still-attached
+      // abort handler's treeKill.
+      if (abortSignal && abortSignal.aborted) {
+        try { killShellJob(job.jobId); } catch {}
+        try { treeKill(child); } catch {}
+      }
       // Snapshot the partial output captured so far for the immediate result.
       let stdout = '';
       let stderr = '';
@@ -740,7 +824,10 @@ export function execShellCommand({
       try { stderr = await taskOutput.getStderr(); }
       catch (err) { taskOutput.writeError = taskOutput.writeError || err; }
       const jobId = job ? job.jobId : null;
-      const secs = Math.round(autoBackgroundMs / 1000);
+      const secs = Math.max(0, Math.round((Date.now() - _startMs) / 1000));
+      const _verb = reason === 'timeout'
+        ? `moved to background at timeout after ${secs}s`
+        : `auto-backgrounded after ${secs}s`;
       resolve(
         new ExecResult({
           stdout,
@@ -759,14 +846,31 @@ export function execShellCommand({
           backgrounded: true,
           jobId,
           backgroundMessage: jobId
-            ? `auto-backgrounded after ${secs}s; still running — completion will be delivered as a background task notification. Use task with task_id:${jobId} only for manual wait/status/read/cancel.`
-            : `auto-backgrounded after ${secs}s; still running`,
+            ? `${_verb}; still running — completion will be delivered as a background task notification. Use task with task_id:${jobId} only for manual wait/status/read/cancel.`
+            : `${_verb}; still running`,
         }),
       );
     };
 
     if (timeoutMs > 0) {
       timer = setTimeout(() => {
+        // Promote-on-timeout: if the caller allows backgrounding and the child
+        // is still running (not a trailing-`&` detach), adopt it as a tracked
+        // background job instead of tree-killing it. Falls through to the old
+        // kill path for disallowed/opted-out commands (backgroundOnTimeout
+        // false) or when a terminal transition already won the race.
+        if (
+          backgroundOnTimeout &&
+          !_isBackground &&
+          !settled &&
+          !autoBackgrounded &&
+          !killed &&
+          child.exitCode == null &&
+          child.signalCode == null
+        ) {
+          _autoBackground({ reason: 'timeout' });
+          return;
+        }
         timedOut = true;
         _treeKillForceSettle();
       }, timeoutMs);

package/src/runtime/channels/lib/crash-log.mjs

@@ -23,8 +23,9 @@ function isChannelsDegraded() { return _channelsDegraded; }
 try {
   process.stderr.on('error', (e) => {
     if (e && (e.code === 'EPIPE' || /EPIPE/.test(String(e.message || '')))) {
+      // Parent stdio pipe loss stops stderr writes only. It is NOT runtime
+      // corruption, so it must not degrade tool dispatch (_channelsDegraded).
       _stderrBroken = true;
-      _channelsDegraded = true;
     }
   });
 } catch {}
@@ -75,7 +76,8 @@ ${err instanceof Error ? err.stack : ""}
     _writeCrashLine(crashLog, msg);
   }
   if (err instanceof Error && err.message.includes("EPIPE")) {
-    _channelsDegraded = true;
+    // EPIPE = a broken pipe (parent stdio/IPC gone), not corrupted runtime
+    // state. Stop writing to the dead pipe but keep serving tool calls.
     _stderrBroken = true;
   }
   crashLogging = false;

package/src/runtime/channels/lib/output-forwarder.mjs

@@ -6,6 +6,7 @@ import {
   formatToolSurface,
   isExplorerSurface,
   isMemorySurface,
+  stripToolPrefix,
 } from "../../shared/tool-surface.mjs";
 import {
   cwdToProjectSlug,
@@ -726,7 +727,7 @@ ${_bt.trim()}` : _bt.trim();
     // The non-set checks are inlined rather than delegated to the imported
     // isHidden, because that helper would re-consult the module-local
     // HIDDEN_TOOLS Set and ignore the OutputForwarder static.
-    if (OutputForwarder.HIDDEN_TOOLS.has(name)) return true;
+    if (OutputForwarder.HIDDEN_TOOLS.has(name) || OutputForwarder.HIDDEN_TOOLS.has(stripToolPrefix(name))) return true;
     if (name === "reply" || name === "fetch") return true;
     return false;
   };