mixdog 0.9.23 → 0.9.25

package/src/runtime/agent/orchestrator/tools/builtin/shell-analysis.mjs

@@ -1,6 +1,7 @@
 import { statSync } from 'fs';
 import { assertPathReachable, assertPathsReachable } from './fs-reachability.mjs';
 import { isAbsolute, resolve } from 'path';
+import { WRAPPER_NAMES } from '../shell-policy.mjs';
 import {
     cwdRelativePath,
     normalizeInputPath,
@@ -651,3 +652,63 @@ export function foregroundLongCommandHint(command, timeoutMs, args = {}) {
     if (!longTimeout && !watchLike && !longSleep) return '';
     return 'Error: long foreground command detected.';
 }
+
+// Commands that must NOT be promoted to background on a foreground timeout —
+// they run in the foreground and are killed at their deadline instead. Mirrors
+// the reference CLI DISALLOWED_AUTO_BACKGROUND_COMMANDS: `sleep` on posix,
+// `start-sleep`/`sleep` (the PS built-in alias) on PowerShell. A `sleep`/
+// `Start-Sleep` the caller wants to survive must be launched with
+// run_in_background/async explicitly.
+const _DISALLOWED_AUTO_BACKGROUND_POSIX = ['sleep'];
+const _DISALLOWED_AUTO_BACKGROUND_PS = ['start-sleep', 'sleep'];
+
+// Whether one shell segment reaches a disallowed sleep-like command. Strips a
+// leading subshell/paren/brace/`&`, then walks tokens skipping VAR=val and
+// option flags (quotes stripped so `'Start-Sleep'` resolves). A disallowed base
+// name found anywhere reachable blocks promotion. Once a command-runner wrapper
+// (env/sudo/timeout/nice/…, shell-policy.mjs's WRAPPER_NAMES) has been seen we
+// do NOT model that wrapper's flag arity — we keep scanning EVERY later bare
+// token for a hidden `sleep`, so `sudo -u nobody sleep 5` / `setpriv --reuid
+// user sleep` are caught (erring toward NOT promoting). Without a wrapper the
+// first real command token decides the segment.
+function _segmentDisallowed(segment, disallowed) {
+    const stripped = String(segment || '').replace(/^[\s(){}&]+/, '');
+    const tokens = stripped.split(/\s+/).filter(Boolean);
+    let sawWrapper = false;
+    for (let tok of tokens) {
+        tok = tok.replace(/^['"]+|['"]+$/g, '');
+        if (!tok) continue;
+        if (/^[A-Za-z_]\w*=/.test(tok)) continue;            // VAR=val assignment
+        if (tok.startsWith('-')) continue;                    // option flag
+        const stem = tok.toLowerCase().replace(/^.*[\\/]/, '').replace(/\.exe$/, '');
+        if (disallowed.includes(stem)) return true;           // sleep reachable here
+        if (WRAPPER_NAMES.has(stem)) { sawWrapper = true; continue; }
+        if (/^\d+(?:\.\d+)?[smhd]?$/i.test(tok)) continue;    // numeric/duration arg
+        // First real command token. Without a preceding wrapper it IS the base
+        // command and it wasn't disallowed → segment is safe. With a wrapper,
+        // this may be a wrapper value arg (`sudo -u nobody …`); keep scanning
+        // for a hidden sleep instead of stopping here.
+        if (!sawWrapper) return false;
+    }
+    return false;
+}
+
+// Whether a still-running foreground one-shot may be promoted to a background
+// job when it hits its timeout (CC isAutobackgroundingAllowed analogue).
+// Scans EVERY segment of a &&/||/;/|/& chain and, per segment, peels wrappers
+// before reading the base command — so a sleep-like hidden behind a chain
+// (`cd x && sleep 5`) or a runner wrapper (`timeout 5 sleep`, `env sleep`) is
+// still caught. Errs toward NOT promoting: any disallowed base command in any
+// segment blocks promotion. shellType 'powershell' uses the PS disallow list.
+export function isAutobackgroundingAllowed(command, shellType) {
+    const cmd = String(command || '').trim();
+    if (!cmd) return true;
+    const disallowed = shellType === 'powershell'
+        ? _DISALLOWED_AUTO_BACKGROUND_PS
+        : _DISALLOWED_AUTO_BACKGROUND_POSIX;
+    const segments = cmd.split(/(?:&&|\|\||[;\n|&])/);
+    for (const seg of segments) {
+        if (_segmentDisallowed(seg, disallowed)) return false;
+    }
+    return true;
+}

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -402,6 +402,11 @@ export function startBackgroundShellJob({ command, timeoutMs, workDir, mergeStde
 // watcher never keeps the host process alive.
 const SHELL_JOB_WATCH_POLL_MS = 2000;
 const SHELL_JOB_WATCH_GRACE_MS = 5000;
+// 32-bit timer ceiling: setTimeout delays above 2^31-1 wrap to a tiny value
+// and fire immediately. The resolved timeout is already clamped at parse time
+// (bash-tool.mjs TIMER_MAX_MS), but sites that add grace to it can still exceed
+// the ceiling, so clamp the summed delay here too.
+const TIMER_MAX_MS = 2_147_483_647;
 // Registry of armed background-job watchers keyed by jobId. task wait
 // and `kill` actions already hold the completed outcome, so they cancel the
 // armed watcher here to prevent a double-notify when its next poll fires.
@@ -653,11 +658,16 @@ export function watchBackgroundShellJob(jobId, notifyCtx) {
         } catch { watcher = null; }
         pollTimer = setInterval(() => checkDone('poll'), SHELL_JOB_WATCH_POLL_MS);
         if (typeof pollTimer.unref === 'function') pollTimer.unref();
-        const startedAtMs = Date.parse(readShellJobDetail(jobId)?.startedAt || '') || Date.now();
         const timeoutMs = Number(readShellJobDetail(jobId)?.timeoutMs || 0);
-        const hardStopMs = Math.max(0, (startedAtMs + timeoutMs + SHELL_JOB_WATCH_GRACE_MS) - Date.now());
-        hardStopTimer = setTimeout(() => fire('timeout'), hardStopMs);
-        if (typeof hardStopTimer.unref === 'function') hardStopTimer.unref();
+        // Only arm the hard-stop when a timeout is enforced. timeoutMs<=0 means
+        // unlimited: arming it would fire ~grace ms after arm and mark the job
+        // failed. fs.watch + poll remain the completion paths for such jobs.
+        if (timeoutMs > 0) {
+            const startedAtMs = Date.parse(readShellJobDetail(jobId)?.startedAt || '') || Date.now();
+            const hardStopMs = Math.min(TIMER_MAX_MS, Math.max(0, (startedAtMs + timeoutMs + SHELL_JOB_WATCH_GRACE_MS) - Date.now()));
+            hardStopTimer = setTimeout(() => fire('timeout'), hardStopMs);
+            if (typeof hardStopTimer.unref === 'function') hardStopTimer.unref();
+        }
     } catch (err) {
         cleanup();
         try { process.stderr.write(`[shell-jobs] watchBackgroundShellJob arm failed: jobId=${jobId} err=${err?.message ?? String(err)}\n`); } catch { /* ignore */ }
@@ -755,7 +765,10 @@ function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr
     const stderrPath = shellJobStderrPath(jobId);
     const exitPath = shellJobExitPath(jobId);
     const donePath = shellJobDonePath(jobId);
-    const timeoutSeconds = Math.max(1, Math.ceil(timeoutMs / 1000));
+    // timeoutMs <= 0 means unlimited (async omitted default): no kernel
+    // `timeout` wrapper, no enforced marker — exec the inner shell directly.
+    const enforceTimeout = Number(timeoutMs) > 0;
+    const timeoutSeconds = enforceTimeout ? Math.max(1, Math.ceil(timeoutMs / 1000)) : 0;
     // P2 fix: wrap with POSIX `timeout` so the kernel terminates the process
     // at deadline even if the JS-side timer is interrupted. --preserve-status
     // keeps the user command's exit code on success; on timeout the wrapper
@@ -787,7 +800,11 @@ function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr
     // status for processes that actually exited 0. `rm -- "$0"` removes
     // the staged wrapper .cmd.sh after donePath is published so a host
     // crash before this point still leaves the file for the sweep to GC.
-    const wrapped = `{ if command -v timeout >/dev/null 2>&1; then _to=timeout; elif command -v gtimeout >/dev/null 2>&1; then _to=gtimeout; else _to=; fi; if [ -n "$_to" ]; then touch ${shellQuoteSingle(enforcedPath)}; "$_to" ${timeoutSeconds} ${innerShellQ} ${innerArgsQ} ${userCmdQuoted}; else ${innerShellQ} ${innerArgsQ} ${userCmdQuoted}; fi; rc=$?; printf '%s' "$rc" > ${shellQuoteSingle(exitPath)}; touch ${shellQuoteSingle(donePath)}; rm -- "$0" 2>/dev/null; exit $rc; }`;
+    const _innerRun = `${innerShellQ} ${innerArgsQ} ${userCmdQuoted}`;
+    const _execPart = enforceTimeout
+        ? `if command -v timeout >/dev/null 2>&1; then _to=timeout; elif command -v gtimeout >/dev/null 2>&1; then _to=gtimeout; else _to=; fi; if [ -n "$_to" ]; then touch ${shellQuoteSingle(enforcedPath)}; "$_to" ${timeoutSeconds} ${_innerRun}; else ${_innerRun}; fi`
+        : _innerRun;
+    const wrapped = `{ ${_execPart}; rc=$?; printf '%s' "$rc" > ${shellQuoteSingle(exitPath)}; touch ${shellQuoteSingle(donePath)}; rm -- "$0" 2>/dev/null; exit $rc; }`;
     // Stage the wrapped command to a .sh and let the script open its own
     // output files via `exec > … 2> …`. The parent does NOT pass file
     // descriptors via stdio inheritance (`stdio: 'ignore'` for all three).
@@ -841,8 +858,13 @@ function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr
         startedAt: new Date().toISOString(),
     };
     writeShellJobDetail(detail);
-    const timer = setTimeout(() => { refreshShellJob(jobId); }, timeoutMs + 25);
-    if (typeof timer.unref === 'function') timer.unref();
+    // Deadline cleanup poke only when a timeout is enforced; an unlimited
+    // (timeoutMs<=0) job has no deadline — completion is observed via the
+    // fs.watch/poll watcher and refreshShellJob on task queries.
+    if (enforceTimeout) {
+        const timer = setTimeout(() => { refreshShellJob(jobId); }, Math.min(TIMER_MAX_MS, timeoutMs + 25));
+        if (typeof timer.unref === 'function') timer.unref();
+    }
     return detail;
 }
 
@@ -876,7 +898,10 @@ function startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr
         `$exitPath = ${psSingleQuote(exitPath)}`,
         `$donePath = ${psSingleQuote(donePath)}`,
         `$mergeStderr = ${mergeLiteral}`,
-        `$timeoutMs = ${Math.max(1, Math.floor(timeoutMs || 0))}`,
+        // 0 (or negative) = unlimited: the wrapper's `if ($timeoutMs -gt 0 ...`
+        // guard falls through to a plain WaitForExit() with no deadline. Do NOT
+        // floor to 1 — that would enforce a 1ms timeout on unlimited jobs.
+        `$timeoutMs = ${Math.max(0, Math.floor(timeoutMs || 0))}`,
         '$code = 1',
         'try {',
         // -ExecutionPolicy Bypass: unlike -EncodedCommand, -File is subject to
@@ -986,21 +1011,23 @@ function startBackgroundPowerShellJob({ command, timeoutMs, workDir, mergeStderr
         pid: childPid,
         mergeStderr,
         timeoutMs,
-        timeoutSeconds: Math.max(1, Math.ceil(timeoutMs / 1000)),
+        timeoutSeconds: Number(timeoutMs) > 0 ? Math.max(1, Math.ceil(timeoutMs / 1000)) : 0,
         stdoutPath,
         stderrPath: mergeStderr ? stdoutPath : rawStderrPath,
         exitPath,
         donePath,
-        // The PS wrapper enforces timeoutMs unconditionally in-wrapper
-        // (WaitForExit($timeoutMs) → Stop-Process → 124), so the deadline
-        // invariant always holds for PowerShell jobs.
-        timeoutEnforced: true,
+        // The PS wrapper enforces the deadline (WaitForExit($timeoutMs) →
+        // Stop-Process → 124) only when timeoutMs>0; an unlimited job waits
+        // with no deadline, so don't falsely claim enforcement.
+        timeoutEnforced: Number(timeoutMs) > 0,
         // Per-terminal session stamp (see resolveJobOwnerHostPid).
         ownerHostPid: resolveJobOwnerHostPid(clientHostPid),
         startedAt: new Date().toISOString(),
     };
     writeShellJobDetail(detail);
-    const timer = setTimeout(() => { refreshShellJob(jobId); }, timeoutMs + 25);
-    if (typeof timer.unref === 'function') timer.unref();
+    if (Number(timeoutMs) > 0) {
+        const timer = setTimeout(() => { refreshShellJob(jobId); }, Math.min(TIMER_MAX_MS, timeoutMs + 25));
+        if (typeof timer.unref === 'function') timer.unref();
+    }
     return detail;
 }

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch.mjs

@@ -180,13 +180,61 @@ async function codeGraph(args, cwd, signal = null, options = {}) {
   }
 
   if (mode === 'dependents') {
-    if (!rel) throw new Error('code_graph dependents: "file" is required');
-    if (!node) return _appendSameBasenameHint(`Error: code_graph dependents: file not found in graph: ${normFile || '(missing file)'}`, normFile, graph);
+    let depRel = rel;
+    let depNorm = normFile;
+    let subNote = null;
+    // (1) Symbol inference runs ONLY when no `file` arg was supplied at all —
+    // an explicit file (even a directory that yields no rel) is never overridden.
+    if (!depRel && !normFile) {
+      const symCandidates = [
+        ...(Array.isArray(args?.symbols) ? args.symbols : []),
+        args?.symbol,
+      ].map((s) => String(s || '').trim()).filter(Boolean);
+      const KNOWN_SRC_EXT = /\.(mjs|cjs|js|jsx|mts|cts|ts|tsx|json|py|go|rb|rs|java|kt|c|h|cc|cpp|hpp|cs|php|swift|scala|sh)$/i;
+      // (2) Symbol lookup FIRST — dotted names (e.g. obj.method) resolve here
+      // before any path classification.
+      for (const s of symCandidates) {
+        const hits = _findSymbolHits(graph, s, {});
+        const usable = hits.filter((h) => graph.nodes.get(h.rel));
+        const pool = usable.length ? usable : hits;
+        if (!pool.length) continue;
+        // (3) Deterministic pick: defining hit, else first by sorted rel.
+        const sorted = [...pool].sort((a, b) => String(a.rel).localeCompare(String(b.rel)));
+        const primary = sorted.find((h) => h.declarationLike) || sorted[0];
+        depRel = primary.rel; depNorm = primary.rel;
+        subNote = `# note: dependents resolved from symbol '${s}' → ${primary.rel}`;
+        const others = [...new Set(sorted.map((h) => h.rel))].filter((r) => r !== primary.rel);
+        if (others.length) subNote += `\n# note: '${s}' also defined in: ${others.join(', ')}`;
+        break;
+      }
+      // Path-classification only when the value has a slash or a known source
+      // extension — never for plain dotted symbol names.
+      if (!depRel) {
+        const pathLike = symCandidates.find((s) => /[\\/]/.test(s) || KNOWN_SRC_EXT.test(s));
+        if (pathLike) {
+          const pAbs = isAbsolute(pathLike) ? pathResolve(pathLike) : pathResolve(cwd, pathLike);
+          const pRel = _graphRel(pAbs, cwd);
+          if (graph.nodes.get(pRel)) {
+            depRel = pRel; depNorm = pathLike;
+            subNote = `# note: treated symbol '${pathLike}' as file`;
+          }
+        }
+      }
+      // (4) Nothing resolved → actionable hint naming the attempted values,
+      // with a distinct message when no symbol was supplied at all.
+      if (!depRel) {
+        throw new Error(symCandidates.length
+          ? `code_graph dependents: dependents needs file:<path>; got symbol only (tried: ${symCandidates.join(', ')})`
+          : 'code_graph dependents: "file" is required (no file or symbol supplied)');
+      }
+    }
+    const depFileNode = depRel ? graph.nodes.get(depRel) : null;
+    if (!depFileNode) return _appendSameBasenameHint(`Error: code_graph dependents: file not found in graph: ${depNorm || '(missing file)'}`, depNorm, graph);
     const GRAPH_LIST_CAP = 200;
-    const depsAll = [...(graph.reverse.get(rel) || [])].sort();
+    const depsAll = [...(graph.reverse.get(depRel) || [])].sort();
     if (!depsAll.length) return '(no dependents)';
     const deps = depsAll.slice(0, GRAPH_LIST_CAP);
-    const basename = rel.split('/').pop();
+    const basename = depRel.split('/').pop();
     const stem = basename.replace(/\.[^/.]+$/, '');
     const enriched = deps.map((dep) => {
       const depNode = graph.nodes.get(dep);
@@ -203,7 +251,8 @@ async function codeGraph(args, cwd, signal = null, options = {}) {
       }
       return dep;
     });
-    const out = enriched.join('\n');
+    const body = enriched.join('\n');
+    const out = subNote ? `${subNote}\n${body}` : body;
     return depsAll.length > deps.length
       ? `${out}\n[truncated — showing first ${GRAPH_LIST_CAP} of ${depsAll.length} dependents]`
       : out;

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -17,8 +17,7 @@ import {
   resolveV4AEntryPath,
   parsedEntryResolvedPath,
   isResolvedPathOutsideBase,
-  assertNoDuplicateParsedModifyTargets,
-  mergeDuplicateParsedModifyEntries,
+  splitParsedModifyWaves,
   renderParsedUnifiedPatch,
   rewriteHeaderPaths,
   preValidateNativeBatch,
@@ -190,17 +189,17 @@ async function apply_patch(args, cwd, options = {}) {
   if (!v4aRenameOnly && (!Array.isArray(parsed) || parsed.length === 0)) {
     return 'Error: patch contained no file sections';
   }
+  // Split duplicate modify-target blocks into sequential waves: occurrence i
+  // of a path lands in wave i so each duplicate applies against the prior
+  // wave's on-disk result. Non-duplicate patches yield exactly one wave, so
+  // single-target behavior is unchanged.
+  let parsedWaves = v4aRenameOnly ? [] : [parsed];
   if (!v4aRenameOnly) {
     try {
-      assertNoDuplicateParsedModifyTargets(parsed, basePath);
+      parsedWaves = splitParsedModifyWaves(parsed, basePath);
     } catch (err) {
       return `Error: ${err?.message || String(err)}`;
     }
-    const merged = mergeDuplicateParsedModifyEntries(parsed, basePath);
-    if (merged.changed) {
-      parsed = merged.parsed;
-      normalizedPatchStr = renderParsedUnifiedPatch(parsed);
-    }
   }
 
   if (!v4aRenameOnly) {
@@ -210,18 +209,22 @@ async function apply_patch(args, cwd, options = {}) {
       return `Error: ${err?.message || String(err)}`;
     }
   }
-  let entries = [];
-  let headerRewrites = [];
+  // Pre-validate each wave independently: a wave only ever holds unique
+  // targets, so the native batch's per-file semantics stay intact.
+  const waveDispatch = [];
   if (!v4aRenameOnly) {
     try {
-      ({ entries, headerRewrites } = await preValidateNativeBatch(parsed, basePath));
+      for (const wparsed of parsedWaves) {
+        const { entries, headerRewrites } = await preValidateNativeBatch(wparsed, basePath);
+        waveDispatch.push({ parsed: wparsed, entries, headerRewrites });
+      }
     } catch (err) {
       return `Error: ${err?.message || String(err)}`;
     }
   }
 
   const _lockPaths = [
-    ...entries.map((entry) => entry.fullPath),
+    ...new Set(waveDispatch.flatMap((wd) => wd.entries.map((entry) => entry.fullPath))),
     ...(v4aRenamePlan?.renameSections || []).flatMap((section) => {
       const src = resolveV4AEntryPath(basePath, section.path);
       const dest = resolveV4AEntryPath(basePath, section.movePath);
@@ -240,56 +243,96 @@ async function apply_patch(args, cwd, options = {}) {
       if (lines.length === 0) return 'Error: patch contained no applicable file sections';
       return wrapPatchMutationOutput(`${lines.join('\n')}\n`, mutationPlan, { backend: 'v4a-rename' });
     }
-    const insideEntries = entries.filter((entry) => !isResolvedPathOutsideBase(entry.fullPath, basePath));
-    const outsideEntries = entries.filter((entry) => isResolvedPathOutsideBase(entry.fullPath, basePath));
-    const parsedInside = (parsed || []).filter(
-      (entry) => !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath),
-    );
-    const backend = outsideEntries.length > 0
-      ? (insideEntries.length > 0 ? 'native+js-patch' : 'js-patch')
-      : 'native-patch';
-    const resultParts = [];
-    if (insideEntries.length > 0) {
-      const nativePatchStr = rewriteHeaderPaths(renderParsedUnifiedPatch(parsedInside), headerRewrites);
-      const nativeResult = await dispatchNativePatch({
-        entries: insideEntries,
-        basePath,
-        nativePatchStr,
-        fuzz,
-        rejectPartial,
-        dryRun,
-        readStateScope,
-        signal: abortSignal,
-        parsed: parsedInside,
-      });
-      if (isPatchErrorText(nativeResult)) {
-        return wrapPatchMutationOutput(nativeResult, mutationPlan, { backend });
+    // Apply one wave (a set of unique targets) via the existing native(+js)
+    // split. Returns { backend, text } on success or { backend, error } so the
+    // caller can decide whether earlier waves already committed to disk.
+    const applyWave = async ({ parsed: wparsed, entries: wentries, headerRewrites: whr }) => {
+      const insideEntries = wentries.filter((entry) => !isResolvedPathOutsideBase(entry.fullPath, basePath));
+      const outsideEntries = wentries.filter((entry) => isResolvedPathOutsideBase(entry.fullPath, basePath));
+      const parsedInside = (wparsed || []).filter(
+        (entry) => !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath),
+      );
+      const backend = outsideEntries.length > 0
+        ? (insideEntries.length > 0 ? 'native+js-patch' : 'js-patch')
+        : 'native-patch';
+      const resultParts = [];
+      if (insideEntries.length > 0) {
+        const nativePatchStr = rewriteHeaderPaths(renderParsedUnifiedPatch(parsedInside), whr);
+        const nativeResult = await dispatchNativePatch({
+          entries: insideEntries,
+          basePath,
+          nativePatchStr,
+          fuzz,
+          rejectPartial,
+          dryRun,
+          readStateScope,
+          signal: abortSignal,
+          parsed: parsedInside,
+        });
+        if (isPatchErrorText(nativeResult)) return { backend, error: nativeResult };
+        resultParts.push(nativeResult);
       }
-      resultParts.push(nativeResult);
-    }
-    if (outsideEntries.length > 0) {
-      // Out-of-base targets are applied via the JS dispatcher (no base-path
-      // confinement); write permission is enforced at the hook layer.
-      const jsResult = await dispatchJsPatchEntries({
-        rows: outsideEntries,
-        parsed,
-        basePath,
-        dryRun,
-        fuzzy,
-        readStateScope,
-      });
-      if (isPatchErrorText(jsResult)) {
-        return wrapPatchMutationOutput(jsResult, mutationPlan, { backend });
+      if (outsideEntries.length > 0) {
+        // Out-of-base targets are applied via the JS dispatcher (no base-path
+        // confinement); write permission is enforced at the hook layer.
+        const jsResult = await dispatchJsPatchEntries({
+          rows: outsideEntries,
+          parsed: wparsed,
+          basePath,
+          dryRun,
+          fuzzy,
+          readStateScope,
+        });
+        if (isPatchErrorText(jsResult)) return { backend, error: jsResult };
+        resultParts.push(jsResult);
+      }
+      return { backend, text: resultParts.join('\n') };
+    };
+
+    // Duplicate-target blocks were split into contiguous sequential groups
+    // (listed order preserved); apply them in order, each against the prior
+    // group's on-disk result.
+    const waveTexts = [];
+    let backend = 'native-patch';
+    // dry_run never writes, so a later group would validate against unchanged
+    // disk and false-fail on any block that depends on an earlier edit. Only
+    // the first group is validated under dry_run; the rest are reported as
+    // unsimulated below (no false failures).
+    const groupCount = (dryRun && waveDispatch.length > 1) ? 1 : waveDispatch.length;
+    for (let w = 0; w < groupCount; w++) {
+      const res = await applyWave(waveDispatch[w]);
+      backend = res.backend;
+      if (res.error) {
+        if (w === 0) return wrapPatchMutationOutput(res.error, mutationPlan, { backend });
+        // A later group failed. rejectPartial makes each group all-or-nothing,
+        // so every block in groups 1..w is fully committed to disk and left in
+        // place. List them all so the caller knows the true on-disk state.
+        const failMsg = res.error.replace(/^Error:\s*/, '');
+        const note = [
+          `Error: apply_patch: a block failed in sequential group ${w + 1}/${waveDispatch.length}; every edit listed below was already applied to disk (writes committed) and left in place:`,
+          waveTexts.join('\n'),
+          '--- failing block ---',
+          failMsg,
+        ].join('\n');
+        return wrapPatchMutationOutput(note, mutationPlan, { backend });
       }
-      resultParts.push(jsResult);
+      waveTexts.push(res.text);
+    }
+
+    let combined = waveTexts.join('\n');
+    if (dryRun && waveDispatch.length > 1) {
+      const skipped = [...new Set(
+        waveDispatch.slice(1).flatMap((wd) => wd.entries.map((e) => e.displayPath)),
+      )];
+      combined += `\n(dry_run: only the first sequential group was validated against disk; blocks depending on earlier edits were not simulated: ${skipped.join(', ')})`;
     }
-    let combined = resultParts.join('\n');
     const renameLines = formatV4ARenameSuccessLines(v4aRenameResults);
     if (renameLines.length > 0 && !isPatchErrorText(combined)) {
       combined = `${renameLines.join('\n')}\n${combined}`;
     }
     if (!isPatchErrorText(combined) && options?.toolCallId) {
-      registerApplyPatchUiDiff(options.toolCallId, rewriteHeaderPaths(normalizedPatchStr, headerRewrites));
+      const allRewrites = waveDispatch.flatMap((wd) => wd.headerRewrites);
+      registerApplyPatchUiDiff(options.toolCallId, rewriteHeaderPaths(normalizedPatchStr, allRewrites));
     }
     if (!isPatchErrorText(combined) && rejectedV4AHunks.length > 0) {
       const tail = [

package/src/runtime/agent/orchestrator/tools/patch/paths.mjs

@@ -88,42 +88,60 @@ function parsedEntryTargetKey(entry, basePath) {
   return process.platform === 'win32' ? fullPath.toLowerCase() : fullPath;
 }
 
-export function mergeDuplicateParsedModifyEntries(parsed, basePath) {
-  const out = [];
-  const byTarget = new Map();
-  let changed = false;
-  for (const entry of parsed || []) {
-    const key = parsedEntryTargetKey(entry, basePath);
-    if (!key) {
-      out.push(entry);
-      continue;
-    }
-    const existing = byTarget.get(key);
-    if (!existing) {
-      byTarget.set(key, entry);
-      out.push(entry);
-      continue;
+// Group parsed entries into sequential application "waves". When a file is
+// listed as a modify target N times, occurrence i is placed in wave i, so
+// each duplicate block applies against the on-disk result of the previous
+// one — the native engine re-reads the file per apply() call, giving true
+// sequential semantics ("block 2 against block 1's output"). Unique and
+// non-modify entries always land in wave 0.
+//
+// Genuinely unsupported same-path combos (a create/delete mixed with any
+// other block for that path) cannot be sequenced and throw with guidance to
+// merge hunks into one block or send separate apply_patch calls.
+export function splitParsedModifyWaves(parsed, basePath) {
+  const entries = Array.isArray(parsed) ? parsed : [];
+  const kindsByPath = new Map();
+  for (const entry of entries) {
+    const kind = classifyEntry(entry);
+    const headerName = kind === 'create' ? entry.newFileName : entry.oldFileName;
+    if (!headerName || DEV_NULL.test(headerName)) continue;
+    const full = resolveEntryPath(basePath, headerName);
+    const key = process.platform === 'win32' ? full.toLowerCase() : full;
+    const rec = kindsByPath.get(key) || { kinds: [], headerName };
+    rec.kinds.push(kind);
+    kindsByPath.set(key, rec);
+  }
+  for (const { kinds, headerName } of kindsByPath.values()) {
+    if (kinds.length > 1 && kinds.some((k) => k !== 'modify')) {
+      const display = normalizeOutputPath(stripDiffPrefix(headerName));
+      throw new Error(
+        `apply_patch: unsupported duplicate target ${display} — a create/delete block cannot `
+        + 'be combined with other blocks for the same path. Merge the hunks into one block or '
+        + 'send separate apply_patch calls.',
+      );
     }
-    existing.hunks.push(...(entry.hunks || []));
-    changed = true;
   }
-  return { parsed: out, changed };
-}
-
-
-export function assertNoDuplicateParsedModifyTargets(parsed, basePath) {
-  const seenPaths = new Set();
-  for (const entry of parsed || []) {
-    if (classifyEntry(entry) !== 'modify') continue;
+  // Split into contiguous sequential groups that PRESERVE the patch's block
+  // listing order: accumulate blocks until a target path would repeat within
+  // the current group, then start a new group beginning with that block.
+  // Every group holds unique targets (the native batch stays valid) and
+  // groups apply in listed order, so the effective apply order — and thus the
+  // set of committed blocks at any failure point — equals the on-wire order.
+  const groups = [];
+  let current = [];
+  let currentKeys = new Set();
+  for (const entry of entries) {
     const key = parsedEntryTargetKey(entry, basePath);
-    if (!key) continue;
-    if (seenPaths.has(key)) {
-      const headerName = entry.oldFileName || entry.newFileName;
-      const display = normalizeOutputPath(stripDiffPrefix(headerName));
-      throw new Error(`apply_patch: duplicate target ${display} — patch lists the same path twice.`);
+    if (key && currentKeys.has(key)) {
+      groups.push(current);
+      current = [];
+      currentKeys = new Set();
     }
-    seenPaths.add(key);
+    current.push(entry);
+    if (key) currentKeys.add(key);
   }
+  if (current.length > 0) groups.push(current);
+  return groups;
 }
 
 function headerRelFromBase(basePath, absNorm) {

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -526,10 +526,19 @@ function readRawBufForV4AConversion(fullPath) {
   return buf;
 }
 
+// win32 filesystems are case-insensitive, so `Foo` and `foo` are the same
+// file: the V4A source-line cache MUST key on this normalized form at every
+// get/set, otherwise a mixed-case duplicate section refreshed under one
+// casing is missed under another and converts against stale/original lines.
+export function v4aLinesCacheKey(fullPath) {
+  return process.platform === 'win32' ? String(fullPath).toLowerCase() : String(fullPath);
+}
+
 function v4aConversionSourceLines(fullPath, linesCache) {
-  if (linesCache.has(fullPath)) return linesCache.get(fullPath);
+  const cacheKey = v4aLinesCacheKey(fullPath);
+  if (linesCache.has(cacheKey)) return linesCache.get(cacheKey);
   const lines = splitTextLinesForPatch(readRawBufForV4AConversion(fullPath).toString('utf-8'));
-  linesCache.set(fullPath, lines);
+  linesCache.set(cacheKey, lines);
   return lines;
 }
 
@@ -552,6 +561,20 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
   const fuzzy = options.fuzzy !== false;
   const out = [];
   const v4aLinesCache = new Map();
+  // Paths that appear as update targets more than once: their duplicate
+  // sections must be converted against the PRIOR section's result so the
+  // emitted unified hunks line up for sequential (wave) application. We
+  // refresh v4aLinesCache after each such section below.
+  const dupUpdatePaths = new Set();
+  {
+    const seenUpd = new Set();
+    for (const s of sections || []) {
+      if (!s || s.kind === 'add' || s.kind === 'delete' || typeof s.path !== 'string' || !s.path) continue;
+      const fp = resolveV4AEntryPath(basePath, s.path);
+      const key = v4aLinesCacheKey(fp);
+      if (seenUpd.has(key)) dupUpdatePaths.add(key); else seenUpd.add(key);
+    }
+  }
   for (const section of sections) {
     const displayPath = section.path.replace(/\\/g, '/');
     if (section.kind === 'add') {
@@ -646,6 +669,16 @@ export async function convertV4ASectionsToUnifiedPatch(sections, basePath, optio
       out.push(`+++ b/${displayPath}`);
       for (const line of sectionHunks) out.push(line);
     }
+    // If this path is edited again later, the next section must resolve
+    // against this section's applied result, not the original file — apply
+    // these hunks to the cached lines so duplicate V4A blocks convert to a
+    // sequentially-appliable unified patch. Best-effort: on any mismatch we
+    // keep the original cache and let native wave application surface it.
+    if (dupUpdatePaths.has(v4aLinesCacheKey(fullPath))) {
+      try {
+        v4aLinesCache.set(v4aLinesCacheKey(fullPath), applyV4AHunksToLines(sourceLines, section.hunks, { fuzzy }));
+      } catch { /* leave original cached lines */ }
+    }
   }
   return out.join('\n') + '\n';
 }