mixdog 0.9.34 → 0.9.36

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -22,6 +22,11 @@ import {
     analyzeShellCommandEffects,
     foregroundLongCommandHint,
     isAutobackgroundingAllowed,
+    preflightPowerShellHygiene,
+    shellSplitSegments,
+    shellSplitPipelineSegments,
+    shellTokenize,
+    stripShellProbeWrappers,
 } from './shell-analysis.mjs';
 import {
     cancelBackgroundTask,
@@ -55,6 +60,59 @@ export function _trackedDriftNoteAfter(_scope, _pre) {
     return '';
 }
 
+// Search-style commands and `git diff --exit-code` use exit 1 as a SIGNAL
+// (no match / has diff), not a failure. Benign ONLY when exitCode===1, no
+// signal, stderr blank, AND the command is a SINGLE pipeline (no ;/&&/||, so
+// exit 1's origin is unambiguous — a mixed chain stays Error). Quote/comment
+// aware via the shared shell tokenizers, so quoted/commented `;` `|` `grep`
+// can never masquerade as a connector/command and hide a real failure.
+const _SEARCH_HEADS = new Set(['select-string', 'sls', 'grep', 'egrep', 'fgrep', 'findstr']);
+const _GIT_GLOBAL_VALUE_OPTS = new Set(['-c', '-C', '--git-dir', '--work-tree', '--namespace', '--exec-path', '--config-env']);
+// Command/process/subshell substitution or a backslash/backtick-escaped pipe
+// or connector can make the shared tokenizer mis-split the top level and hide
+// the failing stage. If any such construct is present, refuse benign (Error).
+const _AMBIGUOUS_SYNTAX = /\$\(|\$\{|<\(|>\(|`|\\\s*(?:\||&|;|\n)/;
+function _stripShellComment(text) {
+    let out = '';
+    let quote = null;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (quote) { out += ch; if (ch === quote) quote = null; continue; }
+        if (ch === '\'' || ch === '"') { quote = ch; out += ch; continue; }
+        if (ch === '#' && (i === 0 || /\s/.test(text[i - 1]))) break;
+        out += ch;
+    }
+    return out;
+}
+function _normalizeHead(tok) {
+    return String(tok || '').replace(/\.exe$/i, '').split(/[\\/]/).pop().toLowerCase();
+}
+export function _isBenignSearchExitOne(command, exitCode, signal, stderr) {
+    if (signal || exitCode !== 1) return false;
+    if (stderr && stderr.trim()) return false;
+    const text = _stripShellComment(String(command || ''));
+    if (_AMBIGUOUS_SYNTAX.test(text)) return false; // subshell/subst/escaped pipe → ambiguous
+    const segments = shellSplitSegments(text);
+    if (segments.length !== 1) return false; // ;/&&/|| chain → ambiguous, stay Error
+    const stages = shellSplitPipelineSegments(segments[0]);
+    const last = stages[stages.length - 1] || segments[0];
+    const raw = shellTokenize(last);
+    if (!raw) return false; // unbalanced quotes
+    const tokens = stripShellProbeWrappers(raw);
+    if (!tokens.length) return false;
+    const head = _normalizeHead(tokens[0]);
+    if (_SEARCH_HEADS.has(head)) return true;
+    if (head !== 'git') return false;
+    // `git [global-opts] diff ...` only — exact `diff` subcommand, never
+    // diff-index/diff-files/difftool — with exit-code semantics.
+    let i = 1;
+    while (i < tokens.length && tokens[i].startsWith('-')) {
+        i += (_GIT_GLOBAL_VALUE_OPTS.has(tokens[i]) && !tokens[i].includes('=')) ? 2 : 1;
+    }
+    if (tokens[i] !== 'diff') return false;
+    return tokens.slice(i + 1).some((t) => t === '--exit-code' || t === '--quiet' || t === '--check');
+}
+
 // Combine an existing session abort signal with an externally-supplied
 // AbortSignal (e.g. the MCP/request signal threaded through options.abortSignal).
 // Returns null when neither is present so existing session-only behavior is
@@ -196,6 +254,17 @@ export async function executeBashTool(args, workDir, options = {}) {
     if (wmicRewrite?.error) return `Error: ${wmicRewrite.error}`;
     if (wmicRewrite?.command) command = wmicRewrite.command;
 
+    // PowerShell hygiene preflight (Windows PS-only; POSIX no-op): losslessly
+    // rewrite MSYS `/x/…` drive paths, and hard-block bash-only syntax
+    // (grep|tail|sed|awk pipeline stages, `$PID=` reassignment, `&&` on PS 5.1)
+    // with PowerShell-native hints so the agent retries with valid syntax.
+    const psHygiene = preflightPowerShellHygiene(command, {
+        shellType: resolvedSpec.shellType,
+        shellName: resolvedSpec.shell,
+    });
+    if (psHygiene.block) return psHygiene.block;
+    command = psHygiene.command;
+
     const _execPolicyBlock = checkExecPolicyMessage(command);
     if (_execPolicyBlock) {
         return _execPolicyBlock;
@@ -455,7 +524,8 @@ export async function executeBashTool(args, workDir, options = {}) {
             ? 'SIGTERM'
             : (result.killed ? 'SIGKILL' : (result.signal || null));
         const exitCode = signal ? null : result.exitCode;
-        const isReallyErrored = !!signal || (exitCode !== 0 && exitCode !== null);
+        const benignExitOne = _isBenignSearchExitOne(command, exitCode, signal, stderr);
+        const isReallyErrored = !!signal || (exitCode !== 0 && exitCode !== null && !benignExitOne);
         const _driftNote = '';
         // Distinct timeout marker so callers see "killed by timeout after Nms"
         // vs an external signal (e.g. user Ctrl-C, OOM kill). result.timedOut

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -26,12 +26,20 @@ function _shellMaxTimeoutMs() {
     return Math.max(parsed > 0 ? parsed : 600_000, _shellDefaultTimeoutMs());
 }
 
+// PowerShell-only syntax cheat, injected into the shell tool description when
+// the host default shell is PowerShell (win32). process.platform is fixed for
+// the process lifetime, so this is evaluated once at module load.
+const _shellSyntaxCheat =
+    process.platform === 'win32'
+        ? ' PowerShell: grep→Select-String, tail→Get-Content -Tail, head→Get-Content -TotalCount, /c/→C:\\, && 미지원 시 ; 사용, $PID 예약.'
+        : '';
+
 export const BUILTIN_TOOLS = [
     {
         name: 'read',
         title: 'Mixdog Read',
         annotations: { title: 'Mixdog Read', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false },
-        description: 'Read known file path(s) with optional numeric offset+limit windows. Batch paths/regions as real arrays in one call. Not for directory listing.',
+        description: 'Read verified file path(s). Unknown path → find first. Batch paths/regions as real arrays in one call. Not for directory listing.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -56,7 +64,7 @@ export const BUILTIN_TOOLS = [
                             minItems: 1,
                         },
                     ],
-                    description: 'File path. Batch spans via path[] or {path,offset,limit}[] regions. Pass arrays directly; JSON strings are legacy recovery only.',
+                    description: 'Verified file path. Batch spans via path[] or {path,offset,limit}[] regions. Pass arrays directly; JSON strings are legacy recovery only.',
                 },
                 offset: { type: 'number', minimum: 0, description: 'Numeric lines to skip before reading; 0 starts at line 1. Continue with offset:N.' },
                 limit: { type: 'number', minimum: 1, description: 'Numeric max lines to return after offset.' },
@@ -67,7 +75,7 @@ export const BUILTIN_TOOLS = [
         name: 'shell',
         title: 'Mixdog Shell',
         annotations: { title: 'Mixdog Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: `Run programs or change system state. Set shell: powershell or bash. Not for reading, listing, or searching files. Batch independent commands: ;/&& in one call, or parallel calls in the same turn. ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
+        description: `Run programs or change system state. Set shell: powershell or bash. Not for reading, listing, or searching files. Batch independent commands: ;/&& in one call, or parallel calls in the same turn.${_shellSyntaxCheat} ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
         inputSchema: {
             type: 'object',
             properties: {
@@ -101,7 +109,7 @@ export const BUILTIN_TOOLS = [
         name: 'grep',
         title: 'Mixdog Grep',
         annotations: { title: 'Mixdog Grep', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Exact text/regex in a KNOWN scope. files_with_matches/count for broad anchors, content_with_context for narrow answers.',
+        description: 'Exact text/regex in a verified file/dir scope. Unknown scope → find/glob first. files_with_matches/count for broad anchors, content_with_context for narrow answers.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -117,7 +125,7 @@ export const BUILTIN_TOOLS = [
                         { type: 'string' },
                         { type: 'array', items: { type: 'string' }, minItems: 1 },
                     ],
-                    description: 'Known file or dir. Array = several scopes.',
+                    description: 'Verified file or dir. Array = several scopes.',
                 },
                 glob: {
                     anyOf: [
@@ -140,7 +148,7 @@ export const BUILTIN_TOOLS = [
         name: 'glob',
         title: 'Mixdog Glob',
         annotations: { title: 'Mixdog Glob', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Find files by exact glob. Batch patterns and roots as arrays in one call.',
+        description: 'Find files by exact glob from verified roots. Batch patterns and roots as arrays in one call.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -168,7 +176,7 @@ export const BUILTIN_TOOLS = [
         name: 'find',
         title: 'Mixdog Find Files',
         annotations: { title: 'Mixdog Find Files', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Find files by partial path/name, searching dot-directories (e.g. .git-adjacent, .mixdog) too. The right tool for locating a file at an unknown, possibly machine-wide path — run it from a verified broad root. Returns verified paths. Batch names as query[].',
+        description: 'Find files by partial path/name, including dot-directories. Use for unverified path/name guesses; returns verified paths. Batch query[].',
         inputSchema: {
             type: 'object',
             properties: {
@@ -189,7 +197,7 @@ export const BUILTIN_TOOLS = [
         name: 'list',
         title: 'Mixdog List Directory',
         annotations: { title: 'Mixdog List Directory', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'List known directory entries. Batch dirs as path[].',
+        description: 'List verified directories. Unknown dir → find first. Batch dirs as path[].',
         inputSchema: {
             type: 'object',
             properties: {
@@ -198,7 +206,7 @@ export const BUILTIN_TOOLS = [
                         { type: 'string' },
                         { type: 'array', items: { type: 'string' }, minItems: 1 },
                     ],
-                    description: 'Directory, or path[] to list several directories in one call.',
+                    description: 'Verified directory, or path[] to list several directories in one call.',
                 },
                 head_limit: { type: 'number', description: 'Max entries.' },
                 offset: { type: 'number', description: 'Skip N entries for paging.' },

package/src/runtime/agent/orchestrator/tools/builtin/shell-analysis.mjs

@@ -21,7 +21,7 @@ const SHELL_MUTATION_PATTERN = /(?:^|[;&|\n]\s*)(?:touch|mkdir|mktemp|rm|rmdir|m
 const SHELL_READ_ONLY_SEGMENT_RE = /^(?:cd|pwd|echo|printf|env|printenv|set|unset|export|alias|unalias|type|which|whereis|ls|dir|cat|head|tail|wc|grep|rg|find|git\s+(?:status|diff|show|log|rev-parse|branch|remote|ls-files)|stat|readlink|realpath|basename|dirname|sort|uniq|cut|sed\s+-n|awk|ps|whoami|uname|date|true|false|test|\[)\b/i;
 const SHELL_GLOBAL_MUTATORS = new Set(['npm', 'pnpm', 'yarn', 'bun', 'pip', 'pip3', 'python', 'python3', 'git', 'cargo', 'go', 'make', 'cmake', 'dd']);
 
-function shellSplitSegments(command) {
+export function shellSplitSegments(command) {
     const parts = [];
     let current = '';
     let quote = null;
@@ -65,7 +65,7 @@ function shellSplitSegments(command) {
     return parts;
 }
 
-function shellTokenize(segment) {
+export function shellTokenize(segment) {
     const tokens = [];
     let current = '';
     let quote = null;
@@ -206,7 +206,7 @@ function hasDynamicShellBits(value) {
     return hasShellVariableExpansion(value) || hasShellGlobMeta(value);
 }
 
-function shellSplitPipelineSegments(segment) {
+export function shellSplitPipelineSegments(segment) {
     const parts = [];
     let current = '';
     let quote = null;
@@ -245,7 +245,7 @@ function shellSplitPipelineSegments(segment) {
     return parts;
 }
 
-function stripShellProbeWrappers(tokens) {
+export function stripShellProbeWrappers(tokens) {
     const out = stripShellAssignments(tokens || []);
     let idx = 0;
     while (idx < out.length) {
@@ -468,6 +468,129 @@ function buildLargeShellFileProbeMessage(fullPath, sizeBytes, cmd, cwd) {
     return `large-file shell probe blocked: \`${cmd}\` is targeting \`${display}\` (${kb} KB).`;
 }
 
+// ---------------------------------------------------------------------------
+// PowerShell hygiene preflight (Windows PS host only). Two behaviors:
+//   (1) LOSSLESS auto-substitution: MSYS/Git-Bash `/x/…` absolute paths (x is a
+//       single drive letter) are impossible on Windows, so they are rewritten
+//       to `X:\…` and execution continues.
+//   (2) HARD BLOCK + hint: Unix-only commands used as the first token of any
+//       pipeline stage (grep/egrep/fgrep, tail, head, sed, awk), `$PID`
+//       reassignment, and `&&` on Windows PowerShell 5.1 are rejected with a
+//       PowerShell-native correction hint so the agent retries valid syntax.
+// POSIX shells are a strict no-op.
+// ---------------------------------------------------------------------------
+const MSYS_ABS_PATH_RE = /(^|[\s"'=,(])\/([A-Za-z])\/([^\s"'`|&;<>()]*)/g;
+
+// Replace every character that lives inside a single/double-quoted string with a
+// filler ('\0'), keeping the string length 1:1 so match offsets stay aligned.
+// Quote delimiters are preserved (they never match /x/, &&, or $PID=), and a
+// backtick inside double quotes escapes the next char (PS escape). Callers run
+// the drive-rewrite and bash-ism regexes against the mask so quoted literals /
+// regex patterns are never treated as real path tokens or connectors.
+function maskQuotedRegions(command) {
+    const FILL = '\0';
+    let out = '';
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (escaped) { out += FILL; escaped = false; continue; }
+        if (quote) {
+            if (quote === '"' && ch === '`') { out += FILL; escaped = true; continue; }
+            if (ch === quote) { out += ch; quote = null; continue; }
+            out += FILL;
+            continue;
+        }
+        if (ch === '\'' || ch === '"') { quote = ch; out += ch; continue; }
+        out += ch;
+    }
+    return out;
+}
+
+function rewriteMsysDrivePaths(command) {
+    const src = String(command);
+    const mask = maskQuotedRegions(src);
+    const re = new RegExp(MSYS_ABS_PATH_RE.source, 'g');
+    let changed = false;
+    let out = '';
+    let last = 0;
+    let m;
+    // Matches occur only in unquoted regions (quoted chars are '\0' in `mask`),
+    // so the captured groups hold the real, unmasked path text.
+    while ((m = re.exec(mask)) !== null) {
+        const [full, pre, drive, rest] = m;
+        out += src.slice(last, m.index);
+        out += `${pre}${drive.toUpperCase()}:\\${rest.replace(/\//g, '\\')}`;
+        last = m.index + full.length;
+        changed = true;
+    }
+    out += src.slice(last);
+    return { command: changed ? out : src, changed };
+}
+
+// Unix-only command → PowerShell-native replacement hint. Keyed by the bare
+// first token of a pipeline stage (path prefix stripped), so `Select-String`
+// and other real cmdlets never match, and a filename/arg that merely contains
+// "grep" is ignored (only the command token is judged).
+const POWERSHELL_BASHISM_HINTS = {
+    grep: 'grep → Select-String  (e.g. `Select-String -Pattern foo -Path file`)',
+    egrep: 'egrep → Select-String -Pattern <regex>',
+    fgrep: 'fgrep → Select-String -SimpleMatch',
+    tail: 'tail → Get-Content -Tail N',
+    head: 'head → Get-Content -TotalCount N',
+    sed: 'sed → Select-String / ForEach-Object { $_ -replace \'a\',\'b\' }',
+    awk: 'awk → Select-String / ForEach-Object { ($_ -split \'\\s+\')[N] }',
+};
+
+export function preflightPowerShellHygiene(command, { shellType, shellName } = {}) {
+    const original = String(command || '');
+    if (shellType !== 'powershell' || !original.trim()) {
+        return { command: original, block: null, note: null };
+    }
+    // (1) lossless MSYS `/x/…` → `X:\…` rewrite; execution continues.
+    const { command: rewritten, changed } = rewriteMsysDrivePaths(original);
+    const note = changed
+        ? 'note: rewrote MSYS-style `/x/…` absolute path(s) to Windows `X:\\…`.'
+        : null;
+
+    // (2) hard-block bash-isms. `powershell.exe` (Windows PS 5.1) lacks `&&`;
+    // `pwsh` (PS 7+) supports it, so only legacy PS blocks `&&`.
+    const name = String(shellName || '').toLowerCase();
+    const isLegacyPS = /powershell/.test(name) && !/pwsh/.test(name);
+    const violations = [];
+    // `$PID=` reassignment and `&&` connectors are judged on a quote-masked
+    // copy so quoted literals (`echo "a && b"`, `Write-Output '$PID=1'`) and
+    // regex/search args are never mistaken for real syntax.
+    const masked = maskQuotedRegions(rewritten);
+
+    for (const segment of shellSplitSegments(rewritten)) {
+        for (const stage of shellSplitPipelineSegments(segment)) {
+            const tokens = stripShellProbeWrappers(shellTokenize(stage) || []);
+            if (tokens.length === 0) continue;
+            const first = String(tokens[0] || '').toLowerCase().replace(/^.*[\\/]/, '');
+            if (POWERSHELL_BASHISM_HINTS[first]) {
+                violations.push(`\`${first}\` is a Unix command: ${POWERSHELL_BASHISM_HINTS[first]}`);
+            }
+        }
+    }
+    if (/\$PID\s*=(?!=)/i.test(masked)) {
+        violations.push('`$PID` is a reserved PowerShell automatic variable — do not reassign it (use a different name).');
+    }
+    if (isLegacyPS && /(?:^|[^&])&&(?:[^&]|$)/.test(masked)) {
+        violations.push('`&&` is not supported in Windows PowerShell 5.1 — use `;` to sequence or issue separate calls.');
+    }
+
+    if (violations.length > 0) {
+        const hints = [...new Set(violations)];
+        return {
+            command: rewritten,
+            note,
+            block: `PowerShell preflight blocked this command (bash syntax on a PowerShell host). Fix and retry:\n- ${hints.join('\n- ')}`,
+        };
+    }
+    return { command: rewritten, note, block: null };
+}
+
 export async function preflightShellLargeFileProbe(command, cwd) {
     const text = String(command || '').trim();
     let localCwd = resolve(cwd || process.cwd());

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -412,6 +412,11 @@ const TIMER_MAX_MS = 2_147_483_647;
 // and `kill` actions already hold the completed outcome, so they cancel the
 // armed watcher here to prevent a double-notify when its next poll fires.
 const backgroundShellJobWatchers = new Map();
+// Registry-level safety net keyed by jobId. It is intentionally independent of
+// the fs.watch watcher below: if the watcher is cancelled, misses an event, or
+// cannot be armed because the direct notifyFn is unavailable, this poller still
+// reconciles the shell job into the shared background-task row.
+const shellTaskSafetyPollers = new Map();
 // Persistent notify ctx per jobId, set at FIRST arm and surviving cancel — so a
 // re-arm after a task wait timeout can reconstruct the notify wiring without the
 // caller threading the ctx back in. Deleted only in the watcher's cleanup() on
@@ -422,6 +427,93 @@ const jobNotifyCtxByJobId = new Map();
 // consuming the outcome, so the watcher must stay cancelled; the last waiter to
 // leave (count===0) owns the decision to re-arm a still-running job.
 const jobWaitWaiterCountByJobId = new Map();
+const SHELL_TASK_SAFETY_POLL_MS = 5_000;
+function shellJobTaskStatus(status) {
+    if (status === 'completed') return 'completed';
+    if (status === 'cancelled') return 'cancelled';
+    return 'failed';
+}
+function buildShellCompletion(jobId, detail, reason) {
+    const startedAtMs = Date.parse(detail?.startedAt || '');
+    const finishedAtMs = Date.parse(detail?.finishedAt || '') || Date.now();
+    const elapsedMs = Number.isFinite(startedAtMs) ? Math.max(0, finishedAtMs - startedAtMs) : null;
+    const exitCode = (typeof detail?.exitCode === 'number') ? detail.exitCode : null;
+    const status = detail?.status || (reason === 'timeout' ? 'running' : 'unknown');
+    const body = renderShellCompletionEnvelope({
+        jobId,
+        status,
+        exitCode,
+        elapsedMs,
+        command: detail?.command,
+        summary: detail?.summary,
+        stdoutPreview: detail?.stdoutPreview,
+        stderrPreview: detail?.stderrPreview,
+        mergeStderr: detail?.mergeStderr,
+    });
+    const taskStatus = shellJobTaskStatus(status);
+    return {
+        status,
+        taskStatus,
+        exitCode,
+        body,
+        instruction: shellCompletionInstruction({ jobId, status, exitCode }),
+        result: shellJobPublicTaskResult(detail),
+        error: taskStatus === 'failed'
+            ? (detail?.error || (status === 'running' ? 'background shell watcher deadline reached' : null))
+            : null,
+    };
+}
+function clearShellTaskSafetyNet(jobId) {
+    const timer = shellTaskSafetyPollers.get(jobId);
+    if (!timer) return;
+    try { clearInterval(timer); } catch { /* ignore */ }
+    shellTaskSafetyPollers.delete(jobId);
+}
+function armShellTaskSafetyNet(jobId) {
+    if (!jobId || shellTaskSafetyPollers.has(jobId)) return;
+    const tick = () => {
+        try {
+            const task = getBackgroundTask(jobId);
+            if (!task || task.status !== 'running') {
+                clearShellTaskSafetyNet(jobId);
+                return;
+            }
+            const detail = attachJobInsights(refreshShellJob(jobId)) || readShellJobDetail(jobId);
+            if (!detail) {
+                completeBackgroundTask(jobId, {
+                    status: 'failed',
+                    error: 'shell job detail missing during safety reconciliation',
+                    resultType: 'shell_task_result',
+                    terminalReason: 'shell-safety-missing-detail',
+                });
+                clearShellTaskSafetyNet(jobId);
+                return;
+            }
+            if (detail.status === 'running') return;
+            // While a manual `task wait` caller is consuming the result
+            // synchronously, do not send the async completion. The wait path
+            // marks the task terminal with notify:false, and this poller will
+            // stop on its next tick.
+            if ((jobWaitWaiterCountByJobId.get(jobId) || 0) > 0) return;
+            const completion = buildShellCompletion(jobId, detail, 'safety');
+            completeBackgroundTask(jobId, {
+                status: completion.taskStatus,
+                result: completion.result,
+                resultText: completion.body,
+                error: completion.error,
+                resultType: 'shell_task_result',
+                instruction: completion.instruction,
+                terminalReason: 'shell-safety-reconcile',
+            });
+            clearShellTaskSafetyNet(jobId);
+        } catch (err) {
+            try { process.stderr.write(`[shell-jobs] shell task safety poll failed: jobId=${jobId} err=${err?.message ?? String(err)}\n`); } catch { /* ignore */ }
+        }
+    };
+    const timer = setInterval(tick, SHELL_TASK_SAFETY_POLL_MS);
+    if (typeof timer.unref === 'function') timer.unref();
+    shellTaskSafetyPollers.set(jobId, timer);
+}
 function markShellJobCancelledByShutdown(jobId, reason = 'shutdown') {
     const detail = readShellJobDetail(jobId);
     if (!detail || detail.status !== 'running') return false;
@@ -470,6 +562,7 @@ export function shutdownShellJobs(reason = 'runtime-close', { sync = false } = {
         try { if (markShellJobCancelledByShutdown(jobId, reason)) marked += 1; } catch { /* ignore */ }
     }
     backgroundShellJobWatchers.clear();
+    for (const jobId of [...shellTaskSafetyPollers.keys()]) clearShellTaskSafetyNet(jobId);
     jobNotifyCtxByJobId.clear();
     jobWaitWaiterCountByJobId.clear();
     return { killed: livePids.length, cancelledJobs: marked, cancelledWatchers: watcherJobIds.length };
@@ -488,6 +581,7 @@ export function cancelBackgroundShellJobWatch(jobId) {
 // notifyCtx may be omitted on RE-ARM — it then falls back to the persistent
 // ctx captured at first arm (jobNotifyCtxByJobId).
 export function watchBackgroundShellJob(jobId, notifyCtx) {
+    armShellTaskSafetyNet(jobId);
     const ctx = (notifyCtx && typeof notifyCtx.notifyFn === 'function')
         ? normalizeToolNotifyContext(notifyCtx)
         : (jobId ? jobNotifyCtxByJobId.get(jobId) : null);
@@ -539,42 +633,25 @@ export function watchBackgroundShellJob(jobId, notifyCtx) {
         try {
             const detail = attachJobInsights(refreshShellJob(jobId)) || readShellJobDetail(jobId);
             if (!detail) return;
-            const startedAtMs = Date.parse(detail.startedAt || '');
-            const finishedAtMs = Date.parse(detail.finishedAt || '') || Date.now();
-            const elapsedMs = Number.isFinite(startedAtMs) ? Math.max(0, finishedAtMs - startedAtMs) : null;
-            const exitCode = (typeof detail.exitCode === 'number') ? detail.exitCode : null;
-            const status = detail.status || (reason === 'timeout' ? 'running' : 'unknown');
-            const body = renderShellCompletionEnvelope({
-                jobId,
-                status,
-                exitCode,
-                elapsedMs,
-                command: detail.command,
-                summary: detail.summary,
-                stdoutPreview: detail.stdoutPreview,
-                stderrPreview: detail.stderrPreview,
-                mergeStderr: detail.mergeStderr,
-            });
-            const taskStatus = status === 'completed'
-                ? 'completed'
-                : (status === 'cancelled' ? 'cancelled' : 'failed');
-            const instruction = shellCompletionInstruction({ jobId, status, exitCode });
+            const completion = buildShellCompletion(jobId, detail, reason);
             const completedTask = completeBackgroundTask(jobId, {
-                status: taskStatus,
-                result: shellJobPublicTaskResult(detail),
-                resultText: body,
-                error: taskStatus === 'failed' ? (detail.error || (status === 'running' ? 'background shell watcher deadline reached' : null)) : null,
+                status: completion.taskStatus,
+                result: completion.result,
+                resultText: completion.body,
+                error: completion.error,
                 resultType: 'shell_task_result',
-                instruction,
+                instruction: completion.instruction,
+                terminalReason: `shell-watcher-${reason || 'done'}`,
             });
+            clearShellTaskSafetyNet(jobId);
             if (completedTask) return;
             notifyToolCompletion({
                 surface: 'shell',
                 id: jobId,
-                status: taskStatus,
-                text: body,
+                status: completion.taskStatus,
+                text: completion.body,
                 resultType: 'shell_task_result',
-                instruction,
+                instruction: completion.instruction,
                 context: ctx,
                 logPrefix: 'shell-jobs',
             });

package/src/runtime/agent/orchestrator/tools/code-graph-tool-defs.mjs

@@ -3,12 +3,12 @@ export const CODE_GRAPH_TOOL_DEFS = [
     name: 'code_graph',
     title: 'Code Graph',
     annotations: { title: 'Code Graph', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false, compressibleLossless: true },
-    description: 'Repo-local code structure/flow lookup (not web): symbols/references/calls/deps. Batch targets as symbols[]/files[] in one call.',
+    description: 'Repo-local code structure/flow lookup (not web): symbols/references/calls/deps. Known symbols or verified files only. Batch symbols[]/files[].',
     inputSchema: {
       type: 'object',
       properties: {
         mode: { type: 'string', enum: ['overview', 'imports', 'dependents', 'related', 'impact', 'symbols', 'find_symbol', 'symbol_search', 'search', 'references', 'callers'], description: 'Repo-local graph operation.' },
-        files: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Source file(s); array fans out per file. `file` alias too.' },
+        files: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Verified source file(s); array fans out per file. `file` alias too.' },
         symbols: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Identifier(s)/keyword(s); array batches in one call. `symbol` alias too. Required for callers/callees/references/find_symbol/symbol_search.' },
         symbol: { type: 'string', description: 'Singular alias for symbols.' },
         file: { type: 'string', description: 'Singular alias for files.' },

package/src/runtime/agent/orchestrator/tools/patch-tool-defs.mjs

@@ -36,7 +36,7 @@ export const PATCH_TOOL_DEFS = [
     inputSchema: {
       type: 'object',
       properties: {
-        patch: { type: 'string', description: 'Patch text. V4A preferred; include all known edits in listed order.' },
+        patch: { type: 'string', description: 'Patch text. V4A preferred; use one file block per target file with exact current context; include all known edits in listed order.' },
         format: { type: 'string', enum: ['unified', 'v4a'], description: 'Auto-detected.' },
         base_path: { type: 'string', description: 'Repo root.' },
         dry_run: { type: 'boolean', description: 'Default false. true = validate only, no write.' },

package/src/runtime/agent/orchestrator/tools/shell-exec-policy.mjs

@@ -1,6 +1,6 @@
 'use strict';
 
-import { getDestructiveCommandWarning } from './destructive-warning.mjs';
+import { getDestructiveCommandWarning, stripQuotedAndHeredoc } from './destructive-warning.mjs';
 import { isBlockedCommand, WRAPPER_NAMES } from './shell-policy.mjs';
 
 /** @typedef {'allow'|'warn-prompt'|'deny'} ExecPolicyDecision */
@@ -11,7 +11,7 @@ const EXEC_POLICY_DENY_PATTERNS = [
   /\b(?:sh|bash|zsh|dash|pwsh|powershell)(?:\.exe)?\s+<\s*\(/i,
   /\bInvoke-Expression\b/i,
   /\biex\s+/i,
-  /\bStart-Process\b[^\n]*\b-Verb\s+RunAs\b/i,
+  /\bStart-Process\b[^\n]*\s-Verb\s+RunAs\b/i,
 ];
 
 const EXEC_POLICY_DENY_COMMANDS = new Set([
@@ -45,8 +45,12 @@ export function classifyExecPolicy(command) {
   if (isBlockedCommand(text)) {
     return { decision: 'deny', reason: 'destructive or system-destabilising pattern (hard block)' };
   }
+  // Hard-deny only real executable syntax. The policy scanner also sees user
+  // search strings / regex literals (e.g. `-match 'powershell|bash|grep'`), so
+  // high-risk pipe-to-shell / IEX / RunAs patterns must ignore quoted spans.
+  const executableText = stripQuotedAndHeredoc(text);
   for (const pat of EXEC_POLICY_DENY_PATTERNS) {
-    if (pat.test(text)) {
+    if (pat.test(executableText)) {
       return { decision: 'deny', reason: 'high-risk shell invocation (pipe-to-shell, elevated launcher, or remote-exec pattern)' };
     }
   }

package/src/runtime/memory/lib/memory-embed.mjs

@@ -130,7 +130,7 @@ export function isRawEmbeddable(role, content) {
 
 const RAW_EMBED_SQL_EXCLUDE_ROLE_VALUES = [...RAW_EMBED_EXCLUDE_ROLES]
 const RAW_EMBED_SQL_ALWAYS_EXCLUDE_CONTENT_RE =
-  '^\\s*(\\[tool_call\\b|\\[tool_result\\b|\\[mixdog-runtime\\]|The async (shell task|agent task|\\S+ execution|\\S+) .*has finished\\b.*review this result in your next step|background task\\b)'
+  '^\\s*(\\[tool_call(?:\\s|\\]|$)|\\[tool_result(?:\\s|\\]|$)|\\[mixdog-runtime\\]|The async (shell task|agent task|\\S+ execution|\\S+) .*has finished(\\s|$).*review this result in your next step|background task(\\s|$))'
 const RAW_EMBED_SQL_NON_CONVERSATION_EXCLUDE_CONTENT_RE =
   '^\\s*\\[(system|log|offload|debug|trace|info|warn|warning|error|fatal)\\]'