mixdog 0.9.47 → 0.9.50

package/scripts/verify-release-assets-test.mjs

@@ -0,0 +1,281 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import {
+  GRAPH_PLATFORMS,
+  PATCH_PLATFORMS,
+  validateGraphManifest,
+  validatePatchManifest,
+  validateRuntimeManifest,
+  verifyAssetDownloads,
+  verifyReleaseAssets,
+} from './verify-release-assets.mjs';
+
+const VERSION = '1.2.3';
+const APP_VERSION = '0.9.49';
+const GRAPH_VERSION = '0.1.0';
+const bytes = Buffer.from('local release fixture');
+const sha256 = createHash('sha256').update(bytes).digest('hex');
+
+function patchFixture() {
+  return {
+    version: VERSION,
+    _comment: 'test fixture',
+    assets: Object.fromEntries(Object.entries(PATCH_PLATFORMS).map(([platform, filename]) => [
+      platform,
+      {
+        url: `https://github.com/tribgames/mixdog/releases/download/patch-v${VERSION}/${filename}`,
+        sha256,
+      },
+    ])),
+  };
+}
+
+function runtimeFixture() {
+  return {
+    release_tag: 'runtime-v1.2.3',
+    assets: Object.fromEntries(Object.keys(PATCH_PLATFORMS).map((platform) => [
+      platform,
+      { url: `https://fixtures.invalid/${platform}`, sha256, size: bytes.length },
+    ])),
+  };
+}
+
+function graphFixture() {
+  return {
+    version: GRAPH_VERSION,
+    _comment: 'test fixture',
+    assets: Object.fromEntries(Object.entries(GRAPH_PLATFORMS).map(([platform, filename]) => [
+      platform,
+      {
+        url: `https://github.com/tribgames/mixdog/releases/download/graph-v${GRAPH_VERSION}/${filename}`,
+        sha256,
+      },
+    ])),
+  };
+}
+
+test('accepts independent strict patch, runtime, app, and graph versions', () => {
+  assert.equal(validatePatchManifest(patchFixture(), `[package]\nversion = "${VERSION}"\n`).version, VERSION);
+  assert.equal(validateRuntimeManifest(runtimeFixture()).release_tag, 'runtime-v1.2.3');
+  assert.equal(validateGraphManifest(graphFixture(), { version: APP_VERSION }).version, GRAPH_VERSION);
+});
+
+test('rejects stale Cargo version, partial schema, and wrong patch tag URL', () => {
+  assert.throws(
+    () => validatePatchManifest(patchFixture(), '[package]\nversion = "1.2.2"\n'),
+    /does not match manifest version/,
+  );
+
+  const partial = patchFixture();
+  delete partial.assets['linux-arm64'];
+  assert.throws(
+    () => validatePatchManifest(partial, `[package]\nversion = "${VERSION}"\n`),
+    /keys must be exactly/,
+  );
+
+  const wrongTag = patchFixture();
+  wrongTag.assets['linux-x64'].url = wrongTag.assets['linux-x64'].url.replace('patch-v1.2.3', 'patch-v1.2.2');
+  assert.throws(
+    () => validatePatchManifest(wrongTag, `[package]\nversion = "${VERSION}"\n`),
+    /patch-v1\.2\.3/,
+  );
+
+  const extraPatch = patchFixture();
+  extraPatch.assets['freebsd-x64'] = extraPatch.assets['linux-x64'];
+  assert.throws(
+    () => validatePatchManifest(extraPatch, `[package]\nversion = "${VERSION}"\n`),
+    /keys must be exactly/,
+  );
+
+  const extraRuntime = runtimeFixture();
+  extraRuntime.assets['freebsd-x64'] = extraRuntime.assets['linux-x64'];
+  assert.throws(() => validateRuntimeManifest(extraRuntime), /keys must be exactly/);
+});
+
+test('rejects stale, noncanonical, partial, and malformed graph manifests', () => {
+  const partial = graphFixture();
+  delete partial.assets['darwin-arm64'];
+  assert.throws(() => validateGraphManifest(partial, { version: APP_VERSION }), /keys must be exactly/);
+
+  for (const replacement of [
+    'https://github.com/tribgames/mixdog/releases/download/v0.7.18/mixdog-graph-linux-x64',
+    'https://github.com/tribgames/mixdog/releases/download/graph-v0.1.1/mixdog-graph-linux-x64',
+    'https://example.com/tribgames/mixdog/releases/download/graph-v0.1.0/mixdog-graph-linux-x64',
+    'https://github.com/tribgames/mixdog/releases/download/graph-v0.1.0/mixdog-graph-wrong',
+  ]) {
+    const noncanonical = graphFixture();
+    noncanonical.assets['linux-x64'].url = replacement;
+    assert.throws(
+      () => validateGraphManifest(noncanonical, { version: APP_VERSION }),
+      /graph asset URL must be/,
+    );
+  }
+
+  const malformedDigest = graphFixture();
+  malformedDigest.assets['win32-x64'].sha256 = 'not-a-digest';
+  assert.throws(
+    () => validateGraphManifest(malformedDigest, { version: APP_VERSION }),
+    /invalid graph asset sha256/,
+  );
+
+  const malformedVersion = graphFixture();
+  malformedVersion.version = '0.1';
+  assert.throws(
+    () => validateGraphManifest(malformedVersion, { version: APP_VERSION }),
+    /not strict MAJOR\.MINOR\.PATCH/,
+  );
+});
+
+test('downloads local fixture responses, retries, and checks sha256 without network', async () => {
+  let calls = 0;
+  await verifyAssetDownloads(
+    { fixture: { url: 'https://fixtures.invalid/asset', sha256, size: bytes.length } },
+    {
+      fetchImpl: async () => {
+        calls += 1;
+        if (calls === 1) throw new Error('fixture transient failure');
+        return new Response(bytes);
+      },
+      retryDelay: async () => {},
+    },
+  );
+  assert.equal(calls, 2);
+
+  calls = 0;
+  await assert.rejects(
+    verifyAssetDownloads(
+      { fixture: { url: 'https://fixtures.invalid/asset', sha256: '0'.repeat(64) } },
+      {
+        fetchImpl: async () => {
+          calls += 1;
+          return new Response(bytes);
+        },
+        retryDelay: async () => {},
+      },
+    ),
+    /verification failed after 3 attempts: sha256 mismatch/,
+  );
+  assert.equal(calls, 3);
+});
+
+test('cancels an undeclared-size patch stream immediately at the absolute ceiling', async () => {
+  let chunksProduced = 0;
+  let cancellations = 0;
+  let aborts = 0;
+  const stream = new ReadableStream(
+    {
+      pull(controller) {
+        chunksProduced += 1;
+        controller.enqueue(Buffer.from('abc'));
+      },
+      cancel() {
+        cancellations += 1;
+      },
+    },
+    { highWaterMark: 0 },
+  );
+
+  await assert.rejects(
+    verifyAssetDownloads(
+      { fixture: { url: 'https://fixtures.invalid/asset', sha256 } },
+      {
+        attempts: 1,
+        maxAssetBytes: 5,
+        fetchImpl: async (_url, { signal }) => {
+          signal.addEventListener('abort', () => { aborts += 1; });
+          return { ok: true, status: 200, body: stream };
+        },
+      },
+    ),
+    /byte ceiling exceeded \(5 bytes\)/,
+  );
+  assert.equal(chunksProduced, 2);
+  assert.equal(cancellations, 1);
+  assert.equal(aborts, 1);
+});
+
+test('cancels immediately when a stream exceeds its declared size below the absolute ceiling', async () => {
+  let chunksProduced = 0;
+  let cancellations = 0;
+  let aborts = 0;
+  const stream = new ReadableStream(
+    {
+      pull(controller) {
+        chunksProduced += 1;
+        controller.enqueue(Buffer.from('abc'));
+      },
+      cancel() {
+        cancellations += 1;
+      },
+    },
+    { highWaterMark: 0 },
+  );
+
+  await assert.rejects(
+    verifyAssetDownloads(
+      { fixture: { url: 'https://fixtures.invalid/asset', sha256, size: 5 } },
+      {
+        attempts: 1,
+        maxAssetBytes: 10,
+        fetchImpl: async (_url, { signal }) => {
+          signal.addEventListener('abort', () => { aborts += 1; });
+          return { ok: true, status: 200, body: stream };
+        },
+      },
+    ),
+    /byte ceiling exceeded \(5 bytes\)/,
+  );
+  assert.equal(chunksProduced, 2);
+  assert.equal(cancellations, 1);
+  assert.equal(aborts, 1);
+});
+
+test('full guard reads deterministic fixtures and downloads every declared asset', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'mixdog-release-assets-'));
+  const patch = patchFixture();
+  const runtime = runtimeFixture();
+  const graph = graphFixture();
+  const expectedUrls = new Set(
+    [...Object.values(patch.assets), ...Object.values(runtime.assets), ...Object.values(graph.assets)]
+      .map(({ url }) => url),
+  );
+  const paths = {
+    patchManifestPath: join(dir, 'patch.json'),
+    cargoPath: join(dir, 'Cargo.toml'),
+    runtimeManifestPath: join(dir, 'runtime.json'),
+    graphManifestPath: join(dir, 'graph.json'),
+    packagePath: join(dir, 'package.json'),
+  };
+  await Promise.all([
+    writeFile(paths.patchManifestPath, JSON.stringify(patch)),
+    writeFile(paths.cargoPath, `[package]\nversion = "${VERSION}"\n`),
+    writeFile(paths.runtimeManifestPath, JSON.stringify(runtime)),
+    writeFile(paths.graphManifestPath, JSON.stringify(graph)),
+    writeFile(paths.packagePath, JSON.stringify({ version: APP_VERSION })),
+  ]);
+  let downloads = 0;
+  const requestedUrls = [];
+  try {
+    await verifyReleaseAssets({
+      ...paths,
+      downloadOptions: {
+        attempts: 1,
+        timeoutMs: 1000,
+        fetchImpl: async (url) => {
+          downloads += 1;
+          requestedUrls.push(url);
+          return new Response(bytes);
+        },
+      },
+    });
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+  assert.equal(downloads, 15);
+  assert.deepEqual(new Set(requestedUrls), expectedUrls);
+});

package/scripts/verify-release-assets.mjs

@@ -0,0 +1,293 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+
+export const PATCH_PLATFORMS = {
+  'darwin-arm64': 'mixdog-patch-darwin-arm64',
+  'darwin-x64': 'mixdog-patch-darwin-x64',
+  'linux-arm64': 'mixdog-patch-linux-arm64',
+  'linux-x64': 'mixdog-patch-linux-x64',
+  'win32-x64': 'mixdog-patch-win32-x64.exe',
+};
+
+export const GRAPH_PLATFORMS = {
+  'darwin-arm64': 'mixdog-graph-darwin-arm64',
+  'darwin-x64': 'mixdog-graph-darwin-x64',
+  'linux-arm64': 'mixdog-graph-linux-arm64',
+  'linux-x64': 'mixdog-graph-linux-x64',
+  'win32-x64': 'mixdog-graph-win32-x64.exe',
+};
+
+const RUNTIME_PLATFORMS = [
+  'linux-x64',
+  'linux-arm64',
+  'darwin-x64',
+  'darwin-arm64',
+  'win32-x64',
+];
+const STRICT_VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const SHA256 = /^[a-f0-9]{64}$/i;
+export const MAX_ASSET_BYTES = 256 * 1024 * 1024;
+export const MAX_DOWNLOAD_TIMEOUT_MS = 300_000;
+const PATCH_MANIFEST_PATH = 'src/runtime/agent/orchestrator/tools/patch-manifest.json';
+const PATCH_CARGO_PATH = 'native/mixdog-patch/Cargo.toml';
+const RUNTIME_MANIFEST_PATH = 'src/runtime/memory/data/runtime-manifest.json';
+const GRAPH_MANIFEST_PATH = 'src/runtime/agent/orchestrator/tools/graph-manifest.json';
+const PACKAGE_PATH = 'package.json';
+
+function assertPlainObject(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+}
+
+function assertExactKeys(value, expected, label) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+    throw new Error(`${label} keys must be exactly: ${wanted.join(', ')}`);
+  }
+}
+
+export function validatePatchManifest(manifest, cargoToml) {
+  assertPlainObject(manifest, 'Patch manifest');
+  assertExactKeys(manifest, ['version', '_comment', 'assets'], 'Patch manifest');
+  if (typeof manifest.version !== 'string' || !STRICT_VERSION.test(manifest.version)) {
+    throw new Error(`Patch manifest version is not strict MAJOR.MINOR.PATCH: ${manifest.version}`);
+  }
+  if (typeof manifest._comment !== 'string' || !manifest._comment) {
+    throw new Error('Patch manifest _comment must be a non-empty string');
+  }
+  assertPlainObject(manifest.assets, 'Patch manifest assets');
+  assertExactKeys(manifest.assets, Object.keys(PATCH_PLATFORMS), 'Patch manifest assets');
+
+  let inPackage = false;
+  let cargoVersion;
+  for (const line of String(cargoToml).split(/\r?\n/)) {
+    const section = line.match(/^\s*\[([^\]]+)\]\s*$/)?.[1];
+    if (section) {
+      inPackage = section === 'package';
+      continue;
+    }
+    if (inPackage) {
+      const version = line.match(/^\s*version\s*=\s*"([^"]+)"\s*$/)?.[1];
+      if (version) {
+        cargoVersion = version;
+        break;
+      }
+    }
+  }
+  if (!cargoVersion) throw new Error('Could not read [package] version from native/mixdog-patch/Cargo.toml');
+  if (cargoVersion !== manifest.version) {
+    throw new Error(`Patch Cargo version ${cargoVersion} does not match manifest version ${manifest.version}`);
+  }
+
+  for (const [platform, filename] of Object.entries(PATCH_PLATFORMS)) {
+    const asset = manifest.assets[platform];
+    assertPlainObject(asset, `Patch asset ${platform}`);
+    assertExactKeys(asset, ['url', 'sha256'], `Patch asset ${platform}`);
+    if (typeof asset.url !== 'string') throw new Error(`${platform}: patch asset URL must be a string`);
+    let url;
+    try {
+      url = new URL(asset.url);
+    } catch {
+      throw new Error(`${platform}: invalid patch asset URL`);
+    }
+    const expectedPath = `/tribgames/mixdog/releases/download/patch-v${manifest.version}/${filename}`;
+    if (
+      url.protocol !== 'https:'
+      || url.hostname !== 'github.com'
+      || url.port
+      || url.username
+      || url.password
+      || url.search
+      || url.hash
+      || url.pathname !== expectedPath
+    ) {
+      throw new Error(`${platform}: patch asset URL must be https://github.com${expectedPath}`);
+    }
+    if (typeof asset.sha256 !== 'string' || !SHA256.test(asset.sha256)) {
+      throw new Error(`${platform}: invalid patch asset sha256`);
+    }
+  }
+  return manifest;
+}
+
+export function validateRuntimeManifest(manifest) {
+  assertPlainObject(manifest, 'Runtime manifest');
+  if (!manifest.release_tag || !manifest.assets || typeof manifest.assets !== 'object') {
+    throw new Error(`${RUNTIME_MANIFEST_PATH} is missing release_tag or assets`);
+  }
+  assertPlainObject(manifest.assets, 'Runtime manifest assets');
+  assertExactKeys(manifest.assets, RUNTIME_PLATFORMS, 'Runtime manifest assets');
+  for (const [platform, asset] of Object.entries(manifest.assets)) {
+    if (typeof asset?.url !== 'string' || new URL(asset.url).protocol !== 'https:') {
+      throw new Error(`${platform}: invalid HTTPS asset URL`);
+    }
+    if (typeof asset.sha256 !== 'string' || !SHA256.test(asset.sha256)) {
+      throw new Error(`${platform}: invalid sha256`);
+    }
+    if (!Number.isSafeInteger(asset.size) || asset.size <= 0 || asset.size > MAX_ASSET_BYTES) {
+      throw new Error(`${platform}: invalid size`);
+    }
+  }
+  return manifest;
+}
+
+export function validateGraphManifest(manifest, packageJson) {
+  assertPlainObject(manifest, 'Graph manifest');
+  assertExactKeys(manifest, ['version', '_comment', 'assets'], 'Graph manifest');
+  if (typeof manifest.version !== 'string' || !STRICT_VERSION.test(manifest.version)) {
+    throw new Error(`Graph manifest version is not strict MAJOR.MINOR.PATCH: ${manifest.version}`);
+  }
+  if (typeof manifest._comment !== 'string' || !manifest._comment) {
+    throw new Error('Graph manifest _comment must be a non-empty string');
+  }
+  assertPlainObject(packageJson, 'package.json');
+  if (typeof packageJson.version !== 'string' || !STRICT_VERSION.test(packageJson.version)) {
+    throw new Error(`package.json version is not strict MAJOR.MINOR.PATCH: ${packageJson.version}`);
+  }
+  assertPlainObject(manifest.assets, 'Graph manifest assets');
+  assertExactKeys(manifest.assets, Object.keys(GRAPH_PLATFORMS), 'Graph manifest assets');
+
+  for (const [platform, filename] of Object.entries(GRAPH_PLATFORMS)) {
+    const asset = manifest.assets[platform];
+    assertPlainObject(asset, `Graph asset ${platform}`);
+    assertExactKeys(asset, ['url', 'sha256'], `Graph asset ${platform}`);
+    if (typeof asset.url !== 'string') throw new Error(`${platform}: graph asset URL must be a string`);
+    let url;
+    try {
+      url = new URL(asset.url);
+    } catch {
+      throw new Error(`${platform}: invalid graph asset URL`);
+    }
+    const expectedPath = `/tribgames/mixdog/releases/download/graph-v${manifest.version}/${filename}`;
+    if (
+      url.protocol !== 'https:'
+      || url.hostname !== 'github.com'
+      || url.port
+      || url.username
+      || url.password
+      || url.search
+      || url.hash
+      || url.pathname !== expectedPath
+    ) {
+      throw new Error(`${platform}: graph asset URL must be https://github.com${expectedPath}`);
+    }
+    if (typeof asset.sha256 !== 'string' || !SHA256.test(asset.sha256)) {
+      throw new Error(`${platform}: invalid graph asset sha256`);
+    }
+  }
+  return manifest;
+}
+
+async function downloadAndVerify(label, asset, fetchImpl, timeoutMs, maxAssetBytes) {
+  console.log(`Downloading and verifying ${label}`);
+  const controller = new AbortController();
+  const response = await fetchImpl(asset.url, {
+    redirect: 'follow',
+    headers: { 'User-Agent': 'mixdog-release-asset-guard' },
+    signal: AbortSignal.any([controller.signal, AbortSignal.timeout(timeoutMs)]),
+  });
+  if (!response.ok || !response.body) {
+    await response.body?.cancel();
+    throw new Error(`download failed with HTTP ${response.status}`);
+  }
+  const hash = createHash('sha256');
+  let downloaded = 0;
+  const byteCeiling = Math.min(asset.size ?? Number.POSITIVE_INFINITY, maxAssetBytes);
+  const reader = response.body.getReader();
+  try {
+    while (true) {
+      const { done, value: chunk } = await reader.read();
+      if (done) break;
+      if (downloaded + chunk.byteLength > byteCeiling) {
+        const error = new Error(`byte ceiling exceeded (${byteCeiling} bytes)`);
+        controller.abort(error);
+        await reader.cancel(error).catch(() => {});
+        throw error;
+      }
+      hash.update(chunk);
+      downloaded += chunk.byteLength;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const digest = hash.digest('hex');
+  if (asset.size !== undefined && downloaded !== asset.size) {
+    throw new Error(`size mismatch (manifest ${asset.size}, downloaded ${downloaded})`);
+  }
+  if (digest.toLowerCase() !== asset.sha256.toLowerCase()) {
+    throw new Error(`sha256 mismatch (manifest ${asset.sha256}, downloaded ${digest})`);
+  }
+}
+
+export async function verifyAssetDownloads(
+  assets,
+  {
+    fetchImpl = globalThis.fetch,
+    attempts = 3,
+    timeoutMs = 300_000,
+    maxAssetBytes = MAX_ASSET_BYTES,
+    retryDelay = (attempt) => (
+    new Promise((resolve) => setTimeout(resolve, attempt === 1 ? 2_000 : 6_000))
+    ),
+  } = {},
+) {
+  if (!Number.isSafeInteger(attempts) || attempts < 1 || attempts > 5) {
+    throw new Error(`Download attempts must be between 1 and 5, got ${attempts}`);
+  }
+  if (!Number.isSafeInteger(maxAssetBytes) || maxAssetBytes < 1 || maxAssetBytes > MAX_ASSET_BYTES) {
+    throw new Error(`Asset byte ceiling must be between 1 and ${MAX_ASSET_BYTES}, got ${maxAssetBytes}`);
+  }
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_DOWNLOAD_TIMEOUT_MS) {
+    throw new Error(`Download timeout must be between 1 and ${MAX_DOWNLOAD_TIMEOUT_MS}, got ${timeoutMs}`);
+  }
+  for (const [label, asset] of Object.entries(assets)) {
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+      try {
+        await downloadAndVerify(label, asset, fetchImpl, timeoutMs, maxAssetBytes);
+        lastError = undefined;
+        break;
+      } catch (error) {
+        lastError = error;
+        console.warn(`${label}: attempt ${attempt}/${attempts} failed: ${error.message}`);
+        if (attempt < attempts) await retryDelay(attempt);
+      }
+    }
+    if (lastError) {
+      throw new Error(`${label}: verification failed after ${attempts} attempts: ${lastError.message}`);
+    }
+  }
+}
+
+export async function verifyReleaseAssets({
+  patchManifestPath = PATCH_MANIFEST_PATH,
+  cargoPath = PATCH_CARGO_PATH,
+  runtimeManifestPath = RUNTIME_MANIFEST_PATH,
+  graphManifestPath = GRAPH_MANIFEST_PATH,
+  packagePath = PACKAGE_PATH,
+  downloadOptions,
+} = {}) {
+  const [patchSource, cargoToml, runtimeSource, graphSource, packageSource] = await Promise.all([
+    readFile(patchManifestPath, 'utf8'),
+    readFile(cargoPath, 'utf8'),
+    readFile(runtimeManifestPath, 'utf8'),
+    readFile(graphManifestPath, 'utf8'),
+    readFile(packagePath, 'utf8'),
+  ]);
+  const patchManifest = validatePatchManifest(JSON.parse(patchSource), cargoToml);
+  const runtimeManifest = validateRuntimeManifest(JSON.parse(runtimeSource));
+  const graphManifest = validateGraphManifest(JSON.parse(graphSource), JSON.parse(packageSource));
+  await verifyAssetDownloads(patchManifest.assets, downloadOptions);
+  console.log(`Verified all bundled patch assets for patch-v${patchManifest.version}.`);
+  await verifyAssetDownloads(runtimeManifest.assets, downloadOptions);
+  console.log(`Verified all bundled runtime assets for ${runtimeManifest.release_tag}.`);
+  await verifyAssetDownloads(graphManifest.assets, downloadOptions);
+  console.log(`Verified all bundled graph assets for graph-v${graphManifest.version}.`);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await verifyReleaseAssets();
+}

package/scripts/windows-hide-spawn-options-test.mjs

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+
+const root = fileURLToPath(new URL('..', import.meta.url));
+
+function source(relativePath) {
+  return readFileSync(join(root, relativePath), 'utf8');
+}
+
+test('Windows-sensitive Node re-execs keep their windows hidden', () => {
+  const cli = source('src/cli.mjs');
+  const jitRebuild = source('src/tui/dev/jit-rebuild.mjs');
+
+  assert.match(cli, /spawnSync\(process\.execPath, \[fileURLToPath\(import\.meta\.url\), \.\.\.argv\], \{\r?\n\s*stdio: 'inherit',\r?\n\s*env: \{ \.\.\.process\.env, MIXDOG_SWAP_REEXEC: '1' \},\r?\n\s*windowsHide: true,\r?\n\s*\}\)/);
+  assert.match(jitRebuild, /spawnSync\(process\.execPath, \[script\], \{\r?\n\s*stdio: process\.env\.MIXDOG_TUI_DEV_VERBOSE \? 'inherit' : 'ignore',\r?\n\s*windowsHide: true,\r?\n\s*\}\)/);
+});

package/src/cli.mjs

@@ -35,6 +35,7 @@ async function main() {
       const r = spawnSync(process.execPath, [fileURLToPath(import.meta.url), ...argv], {
         stdio: 'inherit',
         env: { ...process.env, MIXDOG_SWAP_REEXEC: '1' },
+        windowsHide: true,
       });
       if (!r.error) return Number.isInteger(r.status) ? r.status : 0;
     } catch { /* fall through to in-place run */ }

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -245,15 +245,26 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
 }
 
 function classifyToolFailure(resultText, toolName) {
-    const text = String(resultText ?? '').toLowerCase();
-    if (/\[shell-tool-failed\]/i.test(String(resultText ?? ''))) return 'tool-call/failure';
-    if (/\[shell-run-failed\]/i.test(String(resultText ?? ''))) {
-        if (/timeout|timed out|aborted|interrupted/.test(text)) return 'timeout/abort';
+    const raw = String(resultText ?? '');
+    const text = raw.toLowerCase();
+    // Shell renderers put the machine-readable status on the leading line.
+    // Only inspect that marker: command text and stderr frequently contain
+    // words such as "timeout" or "aborted" and must not rewrite a real exit
+    // code into a runtime failure category.
+    const leading = raw.split(/\r?\n/)
+        .map((line) => line.trim())
+        .find((line) => line && !line.startsWith('⚠️ '))
+        ?.replace(/^Error:\s*/i, '') || '';
+    if (/^\[shell-tool-failed\](?:\s|$)/i.test(leading)) return 'tool-call/failure';
+    if (/^\[shell-run-failed\](?:\s|$)/i.test(leading)) {
+        if (/\[timeout:|cause:\s*(?:timeout|cancellation)\b/i.test(leading)) return 'timeout/abort';
+        if (/cause:\s*(?:output-limit|output-capture-error|background-adoption-failed)\b/i.test(leading)) return 'runtime/failure';
+        if (/\[signal:\s*[^\]]+/i.test(leading)) return 'process/signal';
         return 'command-exit';
     }
     if (/requires either|invalid arguments|unknown parameter|must be|schema|expected|required|old_string is .*>=/.test(text)) return 'schema/args';
     if (/not in allow-list|not allowed/.test(text)) return 'permission';
-    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(String(resultText ?? ''))) return 'command-exit';
+    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(raw)) return 'command-exit';
     if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/enoent';
     if (/timed out|timeout|interrupted|aborted/.test(text)) return 'timeout/abort';
     if (/hunk rejected|patch failed|context mismatch|expected first old\/context|context not found/.test(text)) return 'patch/context';