mixdog 0.9.83 → 0.9.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.83",
+  "version": "0.9.85",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/channel-daemon-stub.mjs

@@ -10,6 +10,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { claimSingletonOwner, releaseSingletonOwner } from '../src/runtime/shared/singleton-owner.mjs';
+import { safeIpcSend } from '../src/runtime/shared/safe-ipc-send.mjs';
 import { createChannelDaemonTransport } from '../src/standalone/channel-daemon-transport.mjs';
 
 function runtimeRoot() {
@@ -69,7 +70,7 @@ async function main() {
     onClientsEmpty: () => { void shutdown('no live clients'); },
   });
   const { port, token } = await transport.start();
-  if (process.send) { try { process.send({ type: 'ready', port, token }); } catch {} }
+  safeIpcSend(process, { type: 'ready', port, token });
   log(`ready port=${port} pid=${process.pid}`);
 }
 

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -230,19 +230,46 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         }
         let totalCount = 0;
         let totalTextLen = 0;
+        let maxQueueWaitMs = 0;
         for (const merged of mergedMessages) {
+            const submissionIds = Array.isArray(merged.ids) ? merged.ids : [];
+            const submittedAt = Number(merged.submittedAt);
+            const injectedAt = Date.now();
+            if (Number.isFinite(submittedAt) && submittedAt > 0) {
+                maxQueueWaitMs = Math.max(maxQueueWaitMs, injectedAt - submittedAt);
+            }
             // Tag steering-origin user messages so provider lowering keeps them
             // distinct from preceding tool results. Keep each queued command as
             // its own user turn, matching Claude Code queued_command attachment
             // semantics instead of collapsing priority/mode buckets together.
-            messages.push({ role: 'user', content: merged.content, meta: { source: 'steering' } });
+            messages.push({
+                role: 'user',
+                content: merged.content,
+                meta: {
+                    source: 'steering',
+                    ...(submissionIds.length ? { submissionIds } : {}),
+                },
+            });
             const text = merged.text || steeringContentText(merged.content);
             totalCount += Number(merged.count) || 1;
             totalTextLen += String(text || '').length;
-            try { opts.onSteerMessage?.(text); } catch {}
+            try {
+                opts.onSteerMessage?.(text, {
+                    ids: submissionIds,
+                    submittedAt: Number.isFinite(submittedAt) && submittedAt > 0 ? submittedAt : undefined,
+                    injectedAt,
+                    stage,
+                    ...(Array.isArray(merged.images) && merged.images.length ? { images: merged.images } : {}),
+                });
+            } catch {}
         }
         if (sessionId) {
-            try { process.stderr.write(`[steer] sess=${sessionId} injected ${stage} user message(s) (merged=${totalCount} len=${totalTextLen})\n`); } catch {}
+            try {
+                process.stderr.write(
+                    `[steer] sess=${sessionId} injected ${stage} user message(s)`
+                    + ` (merged=${totalCount} len=${totalTextLen} waitMs=${Math.max(0, maxQueueWaitMs)})\n`,
+                );
+            } catch {}
         }
         return true;
     };

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -14,21 +14,48 @@ export function steeringContentText(content) {
     return String(content ?? '');
 }
 
+function steeringEntryMetadata(entry) {
+    if (!entry || typeof entry !== 'object') return {};
+    const sourceIds = Array.isArray(entry.ids)
+        ? entry.ids
+        : (entry.id !== undefined && entry.id !== null ? [entry.id] : []);
+    const ids = [...new Set(sourceIds.filter((id) => id !== undefined && id !== null))];
+    const submittedAt = Number(entry.submittedAt);
+    return {
+        ...(ids.length ? { ids } : {}),
+        ...(Number.isFinite(submittedAt) && submittedAt > 0 ? { submittedAt } : {}),
+        ...(Array.isArray(entry.images) && entry.images.length ? { images: entry.images } : {}),
+    };
+}
+
 function normalizeSteeringEntry(entry) {
     if (typeof entry === 'string') {
         const text = entry.trim();
         return text ? { content: text, text } : null;
     }
     if (!entry || typeof entry !== 'object') return null;
+    const metadata = steeringEntryMetadata(entry);
     const content = Object.prototype.hasOwnProperty.call(entry, 'content') ? entry.content : entry;
     const text = typeof entry.text === 'string' ? entry.text.trim() : steeringContentText(content).trim();
-    if (Array.isArray(content)) return content.length > 0 ? { content, text } : null;
+    if (Array.isArray(content)) return content.length > 0 ? { content, text, ...metadata } : null;
     if (typeof content === 'string') {
         const value = content.trim();
-        return value ? { content: value, text: text || value } : null;
+        return value ? { content: value, text: text || value, ...metadata } : null;
     }
     const fallback = steeringContentText(content).trim();
-    return fallback ? { content: fallback, text: text || fallback } : null;
+    return fallback ? { content: fallback, text: text || fallback, ...metadata } : null;
+}
+
+function mergeSteeringMetadata(entries) {
+    const ids = [...new Set(entries.flatMap((entry) => Array.isArray(entry.ids) ? entry.ids : []))];
+    const submittedTimes = entries.map((entry) => Number(entry.submittedAt))
+        .filter((value) => Number.isFinite(value) && value > 0);
+    const images = entries.flatMap((entry) => Array.isArray(entry.images) ? entry.images : []);
+    return {
+        ...(ids.length ? { ids } : {}),
+        ...(submittedTimes.length ? { submittedAt: Math.min(...submittedTimes) } : {}),
+        ...(images.length ? { images } : {}),
+    };
 }
 
 export function mergeSteeringEntries(entries) {
@@ -36,6 +63,7 @@ export function mergeSteeringEntries(entries) {
         .map(normalizeSteeringEntry)
         .filter(Boolean);
     if (normalized.length === 0) return null;
+    const metadata = mergeSteeringMetadata(normalized);
     const displayText = normalized.map((entry) => entry.text || steeringContentText(entry.content))
         .filter((text) => String(text || '').trim())
         .join('\n');
@@ -44,6 +72,7 @@ export function mergeSteeringEntries(entries) {
             content: normalized.map((entry) => entry.content).filter(Boolean).join('\n'),
             text: displayText,
             count: normalized.length,
+            ...metadata,
         };
     }
     const parts = [];
@@ -59,5 +88,10 @@ export function mergeSteeringEntries(entries) {
         parts.push({ type: 'text', text: '\n' });
     }
     while (parts.length && parts[parts.length - 1]?.type === 'text' && parts[parts.length - 1]?.text === '\n') parts.pop();
-    return { content: parts, text: displayText || steeringContentText(parts), count: normalized.length };
+    return {
+        content: parts,
+        text: displayText || steeringContentText(parts),
+        count: normalized.length,
+        ...metadata,
+    };
 }

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -307,6 +307,40 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         let _turnOutgoing = null;
         const _turnInterruption = createTurnInterruptionTracker();
         const _sessionStartMetaInjectedBeforeTurn = preSession.sessionStartMetaInjected === true;
+        let _interruptionSnapshot = null;
+        const _prepareCloseSnapshot = (abortReason) => {
+            if (_interruptionSnapshot) return _interruptionSnapshot;
+            if (!activeSession) return null;
+            activeSession.liveTurnMessages = null;
+            _turnInterruption.restoreTombstonedText();
+            const finalized = _turnInterruption.finalize({
+                turnOutgoing: _turnOutgoing || activeSession.messages,
+                currentUserContent: cancelledUserTurnContent,
+                abortReason,
+            });
+            activeSession.messages = finalized.messages;
+            if (!finalized.responsePreserved) {
+                if (finalized.userTurnPreserved) {
+                    // A non-user detach keeps the provisional prompt but makes
+                    // the opaque provider continuation unsafe to reuse.
+                    activeSession.providerState = undefined;
+                } else {
+                    activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
+                }
+            } else {
+                activeSession.providerState = undefined;
+            }
+            activeSession.updatedAt = Date.now();
+            activeSession.lastUsedAt = Date.now();
+            runtime.session = activeSession;
+            _interruptionSnapshot = finalized;
+            return finalized;
+        };
+        // closeSession is synchronous and generation-first by design. Expose a
+        // turn-local hook so it can canonicalize the in-flight transcript
+        // before bumpSessionGeneration()/markSessionClosed() writes the disk
+        // snapshot and invalidates the ordinary cancellation cleanup save.
+        runtime.prepareCloseSnapshot = _prepareCloseSnapshot;
         try {
             const session = activeSession;
             const provider = getProvider(session.provider);
@@ -672,6 +706,12 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     process.stderr.write(`[session] empty-final persisted sessionId=${sessionId} stopReason=${_emptyStop ?? 'unknown'} iterations=${result?.iterations ?? 0} toolCallsTotal=${result?.toolCallsTotal ?? 0} outTokens=${_emptyUsage?.outputTokens ?? 0} hasThinking=${_thinkingStr} blockTypes=${_blockTypesStr}\n`);
                 } catch {}
             }
+            // The terminal assistant message is now canonical. A close racing
+            // any later await should persist this committed session as-is,
+            // never re-finalize the pre-terminal outgoing array.
+            if (runtime.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                runtime.prepareCloseSnapshot = null;
+            }
             session.updatedAt = Date.now();
             session.lastUsedAt = Date.now();
             applyAskTerminalUsageTotals(session, result, {
@@ -840,34 +880,15 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 const currentRuntime = _getRuntimeEntry(sessionId);
                 if (!currentRuntime?.closed) {
                     if (activeSession) {
-                        const finalized = _turnInterruption.finalize({
-                            turnOutgoing: _turnOutgoing || activeSession.messages,
-                            currentUserContent: cancelledUserTurnContent,
-                            abortReason: err.reason,
-                        });
-                        activeSession.messages = finalized.messages;
+                        const finalized = _prepareCloseSnapshot(err.reason);
+                        if (currentRuntime?.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                            currentRuntime.prepareCloseSnapshot = null;
+                        }
                         if (!finalized.responsePreserved) {
                             releasePendingMessages(sessionId, _turnPendingEntries);
-                            if (finalized.userTurnPreserved) {
-                                // Non-user abort (app quit / engine dispose /
-                                // watchdog): the just-sent user turn stays in
-                                // history, so the session-start meta it carries
-                                // remains consumed, and the opaque provider
-                                // continuation no longer matches — force full
-                                // transcript replay on the next send.
-                                activeSession.providerState = undefined;
-                            } else {
-                                activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
-                            }
                         } else {
                             recordPendingMessageDelivery(activeSession, _turnPendingEntries);
-                            // The opaque provider continuation now points at a
-                            // request that ended mid-turn. Force full transcript
-                            // replay on the next send instead of reusing it.
-                            activeSession.providerState = undefined;
                         }
-                        activeSession.updatedAt = Date.now();
-                        activeSession.lastUsedAt = Date.now();
                         try {
                             const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
                             if (finalized.responsePreserved) {
@@ -887,6 +908,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 // can render it as "cancelled" rather than a red failure.
                 throw err;
             }
+            if (runtime.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                runtime.prepareCloseSnapshot = null;
+            }
             // A reset acknowledgement removes the live partial before the
             // non-streaming request starts. If that restart fails, restore the
             // tombstone and persist the one exposed partial as interruption
@@ -895,17 +919,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 || err?.liveTextEmitted === true
                 || err?.unsafeToRetry === true;
             if (preserveProviderPartial && activeSession && _turnInterruption.hasResponseStarted()) {
-                const finalized = _turnInterruption.finalize({
-                    turnOutgoing: _turnOutgoing || activeSession.messages,
-                    currentUserContent: cancelledUserTurnContent,
-                    abortReason: 'provider-error',
-                });
-                activeSession.messages = finalized.messages;
+                const finalized = _prepareCloseSnapshot('provider-error');
                 if (finalized.responsePreserved) recordPendingMessageDelivery(activeSession, _turnPendingEntries);
                 else releasePendingMessages(sessionId, _turnPendingEntries);
-                activeSession.providerState = undefined;
-                activeSession.updatedAt = Date.now();
-                activeSession.lastUsedAt = Date.now();
                 try {
                     const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
                     if (finalized.responsePreserved) {

package/src/runtime/agent/orchestrator/session/manager/idle-cleanup.mjs

@@ -2,7 +2,7 @@
 // Periodic idle-session + tombstone sweep extracted verbatim from manager.mjs.
 // Drives sweepStaleSessions on an unref'd interval; closeSession is imported
 // from session-close.mjs (one-way dependency, no cycle).
-import { sweepStaleSessions, evictIdleLiveSessions } from '../store.mjs';
+import { sweepStaleSessions, sweepStaleSessionsCooperative, evictIdleLiveSessions } from '../store.mjs';
 import { sweepOrphanedPendingMessages } from './pending-messages.mjs';
 import {
     _getRuntimeEntry,
@@ -23,6 +23,7 @@ const CLEANUP_SLOW_LOG_MS = nonNegativeIntEnv('MIXDOG_SESSION_CLEANUP_SLOW_LOG_M
 const TOMBSTONE_MAX_AGE_MS = 60 * 60 * 1000; // 1h
 let _cleanupTimer = null;
 let _cleanupInitialTimer = null;
+let _cleanupRun = null;
 
 // A session is "live" when it still owns a non-closed runtime entry. Passed to
 // the retention cap so the active/current and any in-flight session is never
@@ -65,10 +66,10 @@ const _sweepLog = (line) => {
     if (process.env.MIXDOG_DEBUG_SESSION_LOG) process.stderr.write(line);
 };
 
-function sweepIdleSessions({ includeTombstones = true, sweepIdle = true } = {}) {
+async function sweepIdleSessions({ includeTombstones = true, sweepIdle = true } = {}) {
     const startedAt = Date.now();
     try {
-        const result = sweepStaleSessions({
+        const result = await sweepStaleSessionsCooperative({
             sweepIdle,
             tombstoneMaxAgeMs: includeTombstones ? TOMBSTONE_MAX_AGE_MS : 0,
             isSessionLive: _isSessionLive,
@@ -144,33 +145,43 @@ export function sweepTombstones() {
 }
 
 export function _runCleanupCycle() {
-    // Drain every settled runtime entry on each pass, not just the one or two
-    // sessions whose on-disk idle TTL happened to expire in this interval.
-    _sweepTerminalSessionRuntimes();
-    sweepOrphanedPendingMessages();
-    sweepIdleSessions({ includeTombstones: true });
-    // Reclaim same-process session snapshots whose state is durable on disk
-    // (memory-leak guard: _liveSessions used to grow for process lifetime).
-    try { evictIdleLiveSessions({ isSessionLive: _isSessionLive }); } catch { /* best-effort */ }
+    if (_cleanupRun) return _cleanupRun;
+    const run = (async () => {
+        // Drain every settled runtime entry on each pass, not just the one or two
+        // sessions whose on-disk idle TTL happened to expire in this interval.
+        _sweepTerminalSessionRuntimes();
+        sweepOrphanedPendingMessages();
+        await sweepIdleSessions({ includeTombstones: true });
+        // Reclaim same-process session snapshots whose state is durable on disk
+        // (memory-leak guard: _liveSessions used to grow for process lifetime).
+        try { evictIdleLiveSessions({ isSessionLive: _isSessionLive }); } catch { /* best-effort */ }
+    })().catch((error) => {
+        try { process.stderr.write(`[agent-session] cleanup cycle failed: ${error?.message || error}\n`); } catch {}
+    });
+    const tracked = run.finally(() => {
+        if (_cleanupRun === tracked) _cleanupRun = null;
+    });
+    _cleanupRun = tracked;
+    return tracked;
 }
 
 function _startCleanupInterval() {
     if (_cleanupTimer) return;
     if (CLEANUP_INTERVAL_MS <= 0) return;
-    _cleanupTimer = setInterval(_runCleanupCycle, CLEANUP_INTERVAL_MS);
+    _cleanupTimer = setInterval(() => { void _runCleanupCycle(); }, CLEANUP_INTERVAL_MS);
     if (_cleanupTimer.unref) _cleanupTimer.unref(); // don't block process exit
 }
 
 export function startIdleCleanup() {
     if (_cleanupTimer || _cleanupInitialTimer) return;
     if (CLEANUP_INITIAL_DELAY_MS <= 0) {
-        _runCleanupCycle();
+        void _runCleanupCycle();
         _startCleanupInterval();
         return;
     }
     _cleanupInitialTimer = setTimeout(() => {
         _cleanupInitialTimer = null;
-        _runCleanupCycle();
+        void _runCleanupCycle();
         _startCleanupInterval();
     }, CLEANUP_INITIAL_DELAY_MS);
     if (_cleanupInitialTimer.unref) _cleanupInitialTimer.unref();

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -37,10 +37,17 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     // resuming. Only truly-empty scratch sessions should still tombstone.
     const tombstone = opts.tombstone !== false;
     if (!id) return false;
+    const entry = _getRuntimeEntry(id);
+    // askSession owns the interruption tracker that can merge committed
+    // iterations, the current partial response, and observed tool results into
+    // one canonical transcript. Finalize that in-memory snapshot synchronously
+    // BEFORE the lifecycle generation changes; once generation is bumped, the
+    // normal cancellation cleanup save is intentionally rejected as stale.
+    try { entry?.prepareCloseSnapshot?.(reason); } catch { /* best-effort */ }
     _stopToolActivityHeartbeat(id);
     // Prefer in-memory runtime session — allBashSessionIds may not be persisted
     // yet for shells opened in the current turn (BL-bash-disk-sync).
-    const inMemory = _getRuntimeEntry(id)?.session;
+    const inMemory = entry?.session;
     const persisted = inMemory || loadSession(id);
     const bashSessionId = persisted?.implicitBashSessionId || null;
     // Collect all persistent bash shells created during this session.
@@ -63,7 +70,6 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     //    it back (BL: burned-session late-save clobber).
     const newGen = tombstone ? markSessionClosed(id, reason) : bumpSessionGeneration(id, reason);
     // 2. Mark runtime as closed so post-await validation in askSession fires.
-    const entry = _getRuntimeEntry(id);
     if (entry) {
         entry.closed = true;
         entry.closedReason = reason;

package/src/runtime/agent/orchestrator/session/store/listing.mjs

@@ -244,7 +244,7 @@ export function getStoredSessionsRaw() {
  * Background sweep: delete session files idle longer than ttlMs.
  * Returns { cleaned, remaining, details } for logging.
  */
-export function sweepStaleSessions(ttlMs, options = {}) {
+function* sweepStaleSessionSteps(ttlMs, options = {}) {
     if (ttlMs && typeof ttlMs === 'object') {
         options = ttlMs;
         ttlMs = options.ttlMs;
@@ -302,6 +302,9 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     let openPruned = 0;
     const openPrunedDetails = [];
     for (const row of summaries) {
+        // Cooperative callers pause between records so large stores never hold
+        // an interactive host's event loop for the full directory scan.
+        yield undefined;
         try {
             if (!row?.id) continue;
             const jsonPath = sessionPath(row.id);
@@ -593,6 +596,7 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     // session mid-create whose .json write has not landed yet.
     try {
         for (const h of readdirSync(dir).filter(f => f.endsWith('.hb') || f.endsWith('.own'))) {
+            yield undefined;
             if (existsSync(join(dir, h.replace(/\.(hb|own)$/, '.json')))) continue;
             let hbMtime = 0;
             try { hbMtime = statSync(join(dir, h)).mtimeMs; } catch { continue; }
@@ -613,3 +617,36 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     }
     return { cleaned, remaining, details, tombstonesCleaned, tombstoneDetails, tombstoneErrors, openPruned, openPrunedDetails };
 }
+
+/** Synchronous compatibility surface for explicit maintenance commands/tests. */
+export function sweepStaleSessions(ttlMs, options = {}) {
+    const steps = sweepStaleSessionSteps(ttlMs, options);
+    let next = steps.next();
+    while (!next.done) next = steps.next();
+    return next.value;
+}
+
+/**
+ * Interactive-host sweep: preserve the exact synchronous lifecycle decisions
+ * while yielding between records. A single large session remains atomic, but a
+ * directory worth of reads/parses can no longer become one multi-second task.
+ */
+export async function sweepStaleSessionsCooperative(ttlMs, options = {}) {
+    const cooperativeOptions = ttlMs && typeof ttlMs === 'object' ? ttlMs : options;
+    const configuredSliceMs = Number(cooperativeOptions?.cooperativeSliceMs);
+    const sliceMs = Number.isFinite(configuredSliceMs)
+        ? Math.min(50, Math.max(0, configuredSliceMs))
+        : 8;
+    const steps = sweepStaleSessionSteps(ttlMs, options);
+    let next = steps.next();
+    while (!next.done) {
+        const sliceStartedAt = performance.now();
+        do {
+            next = steps.next();
+        } while (!next.done && performance.now() - sliceStartedAt < sliceMs);
+        if (!next.done) {
+            await new Promise((resolve) => setImmediate(resolve));
+        }
+    }
+    return next.value;
+}

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -757,5 +757,6 @@ export {
     listStoredSessionSummaries,
     getStoredSessionsRaw,
     sweepStaleSessions,
+    sweepStaleSessionsCooperative,
 } from './store/listing.mjs';
 export { _savePending };

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -1,15 +1,14 @@
-import { spawnSync } from 'child_process';
 import { existsSync } from 'fs';
-import { basename, dirname, join } from 'path';
+import { basename, delimiter, dirname, join } from 'path';
 
 let _resolvedShell = null;
 let _configuredShell = null;
 // Per-kind cache for resolveShellFor(). 'default' aliases resolveShell()'s
-// singleton; 'bash'/'powershell' get their own memoized slots. ONLY a
-// successful (non-null) resolution is cached — a resolution MISS is
-// deliberately not memoized so the next call re-probes (Git Bash / pwsh may
-// be installed mid-session, and PATH can change for a long-lived host).
+// singleton; 'bash'/'powershell' get their own memoized slots. Misses receive
+// a short TTL so a missing optional shell cannot rescan PATH for every tool
+// call while a long-lived host can still discover a later installation.
 const _resolvedShellByKind = new Map();
+const SHELL_RESOLUTION_MISS_TTL_MS = 30_000;
 
 export function setConfiguredShell(value = '') {
     const next = String(value || '').trim();
@@ -43,30 +42,39 @@ function shellSpec(shell, shellType = shellTypeFor(shell)) {
     return { shell, shellArg: '-c', shellArgs: ['-c'], shellType };
 }
 
-function firstExistingPathFromWhere(commandName) {
-    try {
-        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-            timeout: 1000,
-        });
-        if (r.status !== 0 || !r.stdout) return null;
-        const lines = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).filter(Boolean);
-        return lines.find(p => existsSync(p)) || null;
-    } catch {
-        return null;
+function allExistingPathsFromPath(commandName) {
+    const rawPath = String(process.env.PATH || '');
+    let cwd = '';
+    try { cwd = process.cwd(); } catch {}
+    const entries = [cwd, ...rawPath.split(delimiter)]
+        .map((entry) => entry.trim().replace(/^"(.*)"$/, '$1'))
+        .filter(Boolean);
+    const seen = new Set();
+    const matches = [];
+    for (const entry of entries) {
+        const candidate = join(entry, commandName);
+        const key = process.platform === 'win32' ? candidate.toLowerCase() : candidate;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        if (existsSync(candidate)) matches.push(candidate);
     }
+    return matches;
+}
+
+function firstExistingPathFromPath(commandName, excludeRe = null) {
+    return allExistingPathsFromPath(commandName)
+        .find((candidate) => !excludeRe || !excludeRe.test(candidate)) || null;
 }
 
 function resolveWindowsPowerShell() {
-    const pwsh = firstExistingPathFromWhere('pwsh.exe');
+    const pwsh = firstExistingPathFromPath('pwsh.exe');
     if (pwsh) return shellSpec(pwsh, 'powershell');
 
     const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
     const bundled = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
     if (existsSync(bundled)) return shellSpec(bundled, 'powershell');
 
-    const powershell = firstExistingPathFromWhere('powershell.exe');
+    const powershell = firstExistingPathFromPath('powershell.exe');
     if (powershell) return shellSpec(powershell, 'powershell');
 
     return shellSpec('powershell.exe', 'powershell');
@@ -109,12 +117,12 @@ function _isWindows() {
 //     not Git-for-Windows bash).
 // Returns a posix shellSpec, or null when Git Bash is genuinely not installed.
 function resolveWindowsGitBash() {
-    for (const git of allExistingPathsFromWhere('git.exe')) {
+    for (const git of allExistingPathsFromPath('git.exe')) {
         const bash = probeGitBashFromGitExe(git);
         if (bash) return shellSpec(bash, 'posix');
     }
     // Fallback: a bare `bash.exe` on PATH, but never the System32 WSL launcher.
-    const bash = firstExistingPathFromWhereExcluding('bash.exe', /\\system32\\/i);
+    const bash = firstExistingPathFromPath('bash.exe', /\\system32\\/i);
     if (bash) return shellSpec(bash, 'posix');
     // Final fallback: probe well-known Git-for-Windows install roots on the
     // filesystem directly. PATH-independent and spawn-free, so it still resolves
@@ -164,36 +172,6 @@ function probeGitBashFromGitExe(gitExe) {
     return null;
 }
 
-function allExistingPathsFromWhere(commandName) {
-    try {
-        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-            timeout: 1000,
-        });
-        if (r.status !== 0 || !r.stdout) return [];
-        return r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim())
-            .filter(Boolean).filter(p => existsSync(p));
-    } catch {
-        return [];
-    }
-}
-
-function firstExistingPathFromWhereExcluding(commandName, excludeRe) {
-    try {
-        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-            timeout: 1000,
-        });
-        if (r.status !== 0 || !r.stdout) return null;
-        const lines = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).filter(Boolean);
-        return lines.find(p => existsSync(p) && !excludeRe.test(p)) || null;
-    } catch {
-        return null;
-    }
-}
-
 // Kind-aware shell resolution. kind:
 //
 // Resolve a real bash on macOS/Linux. When 'bash' is explicitly requested we
@@ -204,13 +182,8 @@ function resolvePosixBash() {
     for (const p of ['/bin/bash', '/usr/bin/bash', '/usr/local/bin/bash', '/opt/homebrew/bin/bash']) {
         if (existsSync(p)) return shellSpec(p, 'posix');
     }
-    try {
-        const r = spawnSync('which', ['bash'], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 1000 });
-        if (r.status === 0 && r.stdout) {
-            const p = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).find(Boolean);
-            if (p && existsSync(p)) return shellSpec(p, 'posix');
-        }
-    } catch { /* fall through to /bin/sh */ }
+    const fromPath = firstExistingPathFromPath('bash');
+    if (fromPath) return shellSpec(fromPath, 'posix');
     return shellSpec('/bin/sh', 'posix');
 }
 
@@ -220,12 +193,15 @@ function resolvePosixBash() {
 //                 binary (/bin/bash, /usr/bin/bash, or `bash` on PATH), falling back to
 //                 /bin/sh only when no bash exists (dash/ash distros break on bash syntax).
 //  'powershell' → on Windows, resolveShell(); elsewhere pwsh if present, else null.
-// Each kind is memoized independently, but ONLY on success: a resolution miss
-// (null) is not cached, so the caller's clear-error path is re-probed on the
-// next call rather than pinned for the life of the process.
+// Each kind is memoized independently. Successes remain stable for the process;
+// misses expire quickly so installs/PATH changes remain discoverable.
 export function resolveShellFor(kind = 'default') {
     if (kind == null || kind === 'default') return resolveShell();
-    if (_resolvedShellByKind.has(kind)) return _resolvedShellByKind.get(kind);
+    const cached = _resolvedShellByKind.get(kind);
+    if (cached) {
+        if (cached.spec || cached.expiresAt > Date.now()) return cached.spec;
+        _resolvedShellByKind.delete(kind);
+    }
 
     let spec = null;
     if (kind === 'bash') {
@@ -234,21 +210,16 @@ export function resolveShellFor(kind = 'default') {
         if (_isWindows()) {
             spec = resolveShell();
         } else {
-            const pwsh = (() => {
-                try {
-                    const r = spawnSync('which', ['pwsh'], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 1000 });
-                    if (r.status !== 0 || !r.stdout) return null;
-                    const p = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).find(Boolean);
-                    return p && existsSync(p) ? p : null;
-                } catch { return null; }
-            })();
+            const pwsh = firstExistingPathFromPath('pwsh');
             spec = pwsh ? shellSpec(pwsh, 'powershell') : null;
         }
     } else {
         spec = resolveShell();
     }
 
-    // Cache positively only — see the _resolvedShellByKind / doc comments above.
-    if (spec) _resolvedShellByKind.set(kind, spec);
+    _resolvedShellByKind.set(kind, {
+        spec,
+        expiresAt: spec ? Number.POSITIVE_INFINITY : Date.now() + SHELL_RESOLUTION_MISS_TTL_MS,
+    });
     return spec;
 }