mixdog 0.9.94 → 0.9.95

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -29,6 +29,7 @@ import {
     shellJobEnforcedPath,
     shellJobGuardianReceiptPath,
     resolveJobOwnerHostPid,
+    resolveJobOwnerSessionId,
     trimShellJobSpill,
     writeShellJobDetail,
     readShellJobDetail,
@@ -563,10 +564,24 @@ export function endShellJobWait(jobId) {
 export function clearShellJobNotifyCtx(jobId) {
     jobNotifyCtxByJobId.delete(jobId);
 }
-export function shutdownShellJobs(reason = 'runtime-close', { sync = false } = {}) {
-    const livePids = [..._liveJobPids];
-    const jobIds = new Set([..._liveJobIdsByPid.values()].filter(Boolean));
-    const watcherJobIds = [...backgroundShellJobWatchers.keys()];
+// scope: reap only the jobs a single session owns (`{ ownerSessionId }`).
+// Omitted => the process-wide sweep, which is correct ONLY on a real process
+// exit: the registries here are process-global, so an unscoped sweep run by
+// one engine's dispose killed other sessions' live jobs (user report).
+// A scope without an owner id matches nothing — never everything.
+export function shutdownShellJobs(reason = 'runtime-close', { sync = false, scope = null } = {}) {
+    const scoped = Boolean(scope);
+    const scopeSessionId = scoped ? String(scope.ownerSessionId || '') : '';
+    if (scoped && !scopeSessionId) return { killed: 0, cancelledJobs: 0, cancelledWatchers: 0 };
+    const ownsJob = (jobId) => {
+        if (!scoped) return true;
+        if (!jobId) return false;
+        try { return String(readShellJobDetail(jobId)?.ownerSessionId || '') === scopeSessionId; }
+        catch { return false; }
+    };
+    const livePids = [..._liveJobPids].filter((pid) => ownsJob(_liveJobIdsByPid.get(pid)));
+    const jobIds = new Set([..._liveJobIdsByPid.values()].filter((jobId) => jobId && ownsJob(jobId)));
+    const watcherJobIds = [...backgroundShellJobWatchers.keys()].filter((jobId) => ownsJob(jobId));
     for (const jobId of watcherJobIds) {
         jobIds.add(jobId);
         try { cancelBackgroundShellJobWatch(jobId); } catch { /* ignore */ }
@@ -576,6 +591,18 @@ export function shutdownShellJobs(reason = 'runtime-close', { sync = false } = {
     for (const jobId of jobIds) {
         try { if (markShellJobCancelledByShutdown(jobId, reason)) marked += 1; } catch { /* ignore */ }
     }
+    if (scoped) {
+        // Per-job teardown only: another session's watchers, safety pollers and
+        // notify contexts must survive this dispose so its completions still fire.
+        for (const jobId of jobIds) {
+            unpersistedTerminalJobs.delete(jobId);
+            backgroundShellJobWatchers.delete(jobId);
+            clearShellTaskSafetyNet(jobId);
+            jobNotifyCtxByJobId.delete(jobId);
+            jobWaitWaiterCountByJobId.delete(jobId);
+        }
+        return { killed: livePids.length, cancelledJobs: marked, cancelledWatchers: watcherJobIds.length };
+    }
     unpersistedTerminalJobs.clear();
     backgroundShellJobWatchers.clear();
     for (const jobId of [...shellTaskSafetyPollers.keys()]) clearShellTaskSafetyNet(jobId);
@@ -780,7 +807,7 @@ export function watchBackgroundShellJob(jobId, notifyCtx) {
 // depends on holds for adopted jobs exactly as it does for staged wrappers.
 // This function only allocates the jobId/paths and writes the initial
 // 'running' detail.
-export function adoptForegroundShellJob({ command, cwd, pid, timeoutMs, mergeStderr, stdoutPath, stderrPath, clientHostPid }) {
+export function adoptForegroundShellJob({ command, cwd, pid, timeoutMs, mergeStderr, stdoutPath, stderrPath, clientHostPid, ownerSessionId }) {
     const jobId = `job_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
     const exitPath = shellJobExitPath(jobId);
     const donePath = shellJobDonePath(jobId);
@@ -805,6 +832,9 @@ export function adoptForegroundShellJob({ command, cwd, pid, timeoutMs, mergeStd
         // dispatching terminal's claude.exe pid (resolveJobOwnerHostPid falls
         // back to the single-client env only when unset).
         ownerHostPid: resolveJobOwnerHostPid(clientHostPid),
+        // Dispatching session (see resolveJobOwnerSessionId): a pane counts
+        // only the jobs its own session started.
+        ownerSessionId: resolveJobOwnerSessionId(ownerSessionId),
         startedAt: new Date().toISOString(),
     };
     writeShellJobDetail(detail);

package/src/runtime/agent/orchestrator/tools/builtin/snapshot-store.mjs

@@ -14,6 +14,9 @@ const readFilesByScope = new Map(); // scope → Map(fullPath → { mtimeMs, siz
 // apply_patch call may reuse a path correction proven by a read in the live
 // session, but must never inherit a guessed redirect from another process.
 const readRedirectsByScope = new Map(); // scope → Map(requestedPathKey → targetPath)
+export const READ_SNAPSHOT_SCOPE_CACHE_LIMIT = 32;
+export const READ_SNAPSHOT_FILES_PER_SCOPE_LIMIT = 1024;
+export const READ_SNAPSHOT_REDIRECTS_PER_SCOPE_LIMIT = 256;
 
 function snapshotPathKey(fullPath) {
     const value = String(fullPath || '');
@@ -166,6 +169,69 @@ function persistScopeSync(scopeKey, { exitDrain = false } = {}) {
     } catch {}
 }
 
+export function releaseReadSnapshotScope(scope, {
+    deletePersisted = false,
+    persist = !deletePersisted,
+} = {}) {
+    const scopeKey = readScopeKey(scope);
+    if (scopeKey === null) return false;
+    const timer = persistPending.get(scopeKey);
+    if (timer) {
+        try { clearTimeout(timer); } catch {}
+        persistPending.delete(scopeKey);
+    }
+    if (persist && readFilesByScope.has(scopeKey)) {
+        try { persistScopeSync(scopeKey, { exitDrain: true }); } catch {}
+    }
+    const released = readFilesByScope.delete(scopeKey)
+        || readRedirectsByScope.has(scopeKey)
+        || scopeHydrated.has(scopeKey);
+    readRedirectsByScope.delete(scopeKey);
+    scopeHydrated.delete(scopeKey);
+    if (deletePersisted) {
+        const path = snapshotScopeFilePath(scopeKey);
+        try { if (path && existsSync(path)) unlinkSync(path); } catch {}
+    }
+    return released;
+}
+
+function pruneReadSnapshotScopes(protectedScopeKey) {
+    while (readFilesByScope.size > READ_SNAPSHOT_SCOPE_CACHE_LIMIT) {
+        let oldest = readFilesByScope.keys().next().value;
+        if (oldest === protectedScopeKey) {
+            oldest = [...readFilesByScope.keys()].find((key) => key !== protectedScopeKey);
+        }
+        if (oldest === undefined) break;
+        releaseReadSnapshotScope(oldest);
+    }
+}
+
+function dropRedirectsToPath(scopeKey, fullPath) {
+    const redirects = readRedirectsByScope.get(scopeKey);
+    if (!redirects) return;
+    const droppedKey = snapshotPathKey(fullPath);
+    for (const [requestedKey, targetPath] of redirects) {
+        if (requestedKey === droppedKey || snapshotPathKey(targetPath) === droppedKey) {
+            redirects.delete(requestedKey);
+        }
+    }
+    if (redirects.size === 0) readRedirectsByScope.delete(scopeKey);
+}
+
+export function rememberReadSnapshot(fullPath, snapshot, scope, knownReadFiles = null) {
+    const scopeKey = readScopeKey(scope);
+    const readFiles = knownReadFiles || readFilesForScope(scope);
+    readFiles.delete(fullPath);
+    readFiles.set(fullPath, snapshot);
+    while (readFiles.size > READ_SNAPSHOT_FILES_PER_SCOPE_LIMIT) {
+        const oldest = readFiles.keys().next().value;
+        if (oldest === undefined) break;
+        readFiles.delete(oldest);
+        if (scopeKey !== null) dropRedirectsToPath(scopeKey, oldest);
+    }
+    return readFiles;
+}
+
 export function deleteReadSnapshotPathEverywhere(fullPath) {
     for (const [scopeKey, readFiles] of readFilesByScope.entries()) {
         if (readFiles.delete(fullPath)) scheduleScopePersist(scopeKey);
@@ -241,7 +307,13 @@ export function recordReadPathRedirect(requestedFullPath, targetFullPath, scope)
         redirects = new Map();
         readRedirectsByScope.set(scopeKey, redirects);
     }
+    redirects.delete(snapshotPathKey(requested));
     redirects.set(snapshotPathKey(requested), target);
+    while (redirects.size > READ_SNAPSHOT_REDIRECTS_PER_SCOPE_LIMIT) {
+        const oldest = redirects.keys().next().value;
+        if (oldest === undefined) break;
+        redirects.delete(oldest);
+    }
     return true;
 }
 
@@ -278,6 +350,32 @@ export function readFilesForScope(scope) {
         readFiles = scopeHydrated.has(key) ? new Map() : loadScopeFromDisk(key);
         scopeHydrated.add(key);
         readFilesByScope.set(key, readFiles);
+        pruneReadSnapshotScopes(key);
+    } else {
+        readFilesByScope.delete(key);
+        readFilesByScope.set(key, readFiles);
     }
     return readFiles;
 }
+
+export function _readSnapshotStoreStatsForTest(scope = null) {
+    const key = readScopeKey(scope);
+    const readFiles = key === null ? null : readFilesByScope.get(key);
+    return {
+        scopeCount: readFilesByScope.size,
+        hydratedScopeCount: scopeHydrated.size,
+        fileCount: readFiles?.size || 0,
+        redirectCount: key === null ? 0 : (readRedirectsByScope.get(key)?.size || 0),
+        pendingPersistCount: persistPending.size,
+    };
+}
+
+export function _resetReadSnapshotStoreForTest() {
+    for (const timer of persistPending.values()) {
+        try { clearTimeout(timer); } catch {}
+    }
+    persistPending.clear();
+    readFilesByScope.clear();
+    readRedirectsByScope.clear();
+    scopeHydrated.clear();
+}

package/src/runtime/agent/orchestrator/tools/builtin.mjs

@@ -443,8 +443,8 @@ function _locatorBudgetFooter(toolName, args, keptLines, capBytes) {
     const target = targets[targetIndex] || targets[0] || '';
     const remaining = targets.length - targetIndex - 1;
     const capKb = Math.round((Number(capBytes) > 0 ? Number(capBytes) : LOCATOR_OUTPUT_MAX_BYTES) / 1024);
-    // Factual continuation only — no retry imperatives (Claude Code/Codex
-    // markers state what was cut, never instruct another call).
+    // Factual continuation only — no retry imperatives: the marker states
+    // what was cut, never instructs another call.
     const nextTarget = remaining > 0 ? `; ${remaining} target(s) not shown, next=${JSON.stringify(targets[targetIndex + 1])}` : '';
     if (toolName === 'find') {
         return `... [find output capped at ${capKb} KB; remaining matches for query=${JSON.stringify(target)} omitted${nextTarget}]`;

package/src/runtime/agent/orchestrator/tools/code-graph/build.mjs

@@ -299,7 +299,9 @@ export function prewarmCodeGraphSymbols(cwd, symbols, { language = null } = {})
 
 export function prewarmCodeGraphIfProject(cwd) {
   if (!cwd) return false;
-  const root = _findDirProjectRoot(cwd);
+  // Implicit walk (nobody asked for this build): never adopt a home/temp
+  // sentinel and prewarm the entire user profile in the background.
+  const root = _findDirProjectRoot(cwd, { stopAtUserBoundary: true });
   if (!root) return false;
   prewarmCodeGraph(root);
   return true;

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch.mjs

@@ -2,7 +2,8 @@
 // resolveSymbolReadSpan, executeCodeGraphTool (entry with cwd re-rooting +
 // batch fan-out + abort race), isCodeGraphTool. Extracted verbatim from
 // code-graph.mjs.
-import { resolve as pathResolve, isAbsolute, relative as pathRelative } from 'node:path';
+import { resolve as pathResolve, isAbsolute, relative as pathRelative, basename as pathBasename } from 'node:path';
+import { homedir as osHomedir } from 'node:os';
 import { readFileSync, existsSync, statSync } from 'node:fs';
 import { normalizeInputPath, toDisplayPath } from '../builtin.mjs';
 import { findFileByBasename } from '../builtin/path-diagnostics.mjs';
@@ -20,6 +21,7 @@ import {
   _PROJECT_ROOT_SENTINELS,
   _resolveFileProjectRoot,
   _findDirProjectRoot,
+  _childProjectRoots,
   _stripEmptyArgs,
 } from './project-root.mjs';
 import { buildCodeGraphAsync, prewarmCodeGraph, prewarmCodeGraphSymbols } from './build.mjs';
@@ -625,7 +627,11 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
   const fileArg = (args && typeof args.file === 'string' && args.file.trim()) ? args.file.trim() : '';
   const hasAggregateFileArgs = _hasAggregateFileArgs(args);
   let effectiveCwd = baseCwd;
-  const baseProjectRoot = _findDirProjectRoot(baseCwd);
+  // An explicit `cwd` argument is a deliberate target: honour whatever root it
+  // resolves to. A session cwd is a guess, so its ancestor walk stops at the
+  // home/temp boundary instead of adopting a stray sentinel found there.
+  const explicitCwdArg = !!(args && typeof args.cwd === 'string' && args.cwd.trim());
+  const baseProjectRoot = _findDirProjectRoot(baseCwd, { stopAtUserBoundary: !explicitCwdArg });
   const filesystemRootCwd = !baseProjectRoot && _isFilesystemRootPath(baseCwd);
   const aggregateFilesAtBase = _collectGraphFileList(args, { cap: false });
   const rawModeAtBase = String(args?.mode || '').trim();
@@ -635,8 +641,24 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
   const parentDotFederation = !baseProjectRoot
     && !filesystemRootCwd
     && exactDotFederation;
-  if (filesystemRootCwd || parentDotFederation) {
-    const trustedRoots = collectTrustedCodeGraphRoots(baseCwd);
+  // Trusted graph targets living UNDER a sentinel-free cwd. Self is filtered
+  // out: federating a directory into itself would recurse forever.
+  const trustedRootsAtBase = baseProjectRoot
+    ? []
+    : collectTrustedCodeGraphRoots(baseCwd)
+      .filter((root) => pathResolve(root) !== pathResolve(baseCwd));
+  // A sentinel-free cwd (multi-repo parent, vendored reference tree) is still
+  // routable when trusted project roots live under it — federate over those
+  // instead of refusing the call outright.
+  const sentinelFreeFederation = !baseProjectRoot
+    && !filesystemRootCwd
+    && !parentDotFederation
+    && !fileArg
+    && !hasAggregateFileArgs
+    && ROOT_FEDERATED_MODES.has(rawModeAtBase)
+    && trustedRootsAtBase.length > 0;
+  if (filesystemRootCwd || parentDotFederation || sentinelFreeFederation) {
+    const trustedRoots = trustedRootsAtBase;
     const files = exactDotFederation ? [] : aggregateFilesAtBase;
     const rawMode = rawModeAtBase;
     const canFederate = files.length > 0 || ROOT_FEDERATED_MODES.has(rawMode);
@@ -756,15 +778,34 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
     }
   }
   if (!fileArg && !(args && typeof args.cwd === 'string' && args.cwd.trim())) {
-    const projectRoot = _findDirProjectRoot(effectiveCwd);
-    if (!projectRoot) {
-      throw new Error(
-        `${name}: cwd '${effectiveCwd}' is not inside a project (no `
-        + `${_PROJECT_ROOT_SENTINELS.join('/')} at it or any ancestor). Refusing to `
-        + `index an arbitrary tree. Run 'cwd set <repo>', or pass an explicit `
-        + `'cwd' (repo root) or a 'file' anchor.`);
+    const projectRoot = _findDirProjectRoot(effectiveCwd, { stopAtUserBoundary: true });
+    if (projectRoot) {
+      effectiveCwd = projectRoot;
+    } else {
+      // A sentinel-free SINGLE tree (vendored reference checkout, script
+      // folder) indexes as its own root — the same treatment an explicit
+      // 'cwd' argument already gets. Only genuinely unbounded or ambiguous
+      // targets stay refused: a filesystem root, the home directory, or a
+      // parent holding several separate repositories.
+      const childRoots = _childProjectRoots(effectiveCwd);
+      // Non-null only when the sole sentinel sits at/above the home or temp
+      // boundary — name it, so the refusal reads as a deliberate rule rather
+      // than a missing project.
+      const boundaryRoot = _findDirProjectRoot(effectiveCwd);
+      const unbounded = filesystemRootCwd
+        || _isFilesystemRootPath(effectiveCwd)
+        || pathResolve(effectiveCwd) === pathResolve(osHomedir());
+      if (unbounded || childRoots.length > 1) {
+        const listed = childRoots.slice(0, 5).map((root) => `"${pathBasename(root)}"`).join(', ');
+        throw new Error(
+          `${name}: cwd '${effectiveCwd}' is not inside a project (no `
+          + `${_PROJECT_ROOT_SENTINELS.join('/')} at it or any ancestor)`
+          + `${childRoots.length > 1 ? ` and holds ${childRoots.length} separate project roots (${listed})` : ''}. `
+          + `${boundaryRoot ? `The nearest sentinel is at '${boundaryRoot}' (home/temp), which is never auto-adopted. ` : ''}`
+          + `Refusing to index an arbitrary tree. Run 'cwd set <repo>', or pass an explicit `
+          + `'cwd' (repo root) or a 'file' anchor.`);
+      }
     }
-    effectiveCwd = projectRoot;
   }
   if (signal?.aborted) throw new Error('aborted');
   const _work = (() => {

package/src/runtime/agent/orchestrator/tools/code-graph/project-root.mjs

@@ -1,12 +1,31 @@
 // Project-root sentinel resolution + empty-arg stripping. Extracted verbatim
 // from code-graph.mjs. Used by the dispatcher to re-root file/dir queries.
 import { resolve as pathResolve, dirname, join } from 'node:path';
-import { existsSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
 
 // P1: project-root sentinels. A directory containing any of these (or with one
 // at an ancestor) is treated as a real project we may index.
 export const _PROJECT_ROOT_SENTINELS = ['package.json', '.git', 'Cargo.toml', 'go.mod', 'pyproject.toml', 'setup.py', 'pom.xml', 'build.gradle', 'build.gradle.kts', 'build.sbt', 'Package.swift'];
 
+// Directories an IMPLICIT ancestor walk must never cross. A stray npm
+// `package.json` in the home directory (or in the temp root) would otherwise
+// promote "index this folder" into "index the whole user profile" — observed
+// as a 20s graph-binary timeout on a `%TEMP%` path. Explicit targets (a `cwd`
+// argument, `cwd set`, a registered project) are unaffected: only the walk
+// that guesses a root for the caller stops here.
+function _userBoundaryDirs() {
+  const dirs = [];
+  try { dirs.push(homedir()); } catch { /* no home — nothing to guard */ }
+  try { dirs.push(tmpdir()); } catch { /* no temp — nothing to guard */ }
+  return dirs.filter(Boolean);
+}
+
+function _dirKey(dir) {
+  const resolved = pathResolve(dir);
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
 // P1: resolve a file to its nearest project root (sentinel ancestor).
 // Returns null when no root found; caller throws rather than falling back.
 export function _resolveFileProjectRoot(file) {
@@ -22,16 +41,42 @@ export function _resolveFileProjectRoot(file) {
 
 // P1: nearest project root for a DIRECTORY (the dir itself or any ancestor).
 // Returns null when the dir sits in no project.
-export function _findDirProjectRoot(dir) {
+// `stopAtUserBoundary` marks the walk as implicit: it then returns null at the
+// home/temp boundary instead of adopting whatever sentinel happens to sit
+// there. `boundaries` is injectable so the boundary rule stays testable.
+export function _findDirProjectRoot(dir, { stopAtUserBoundary = false, boundaries = null } = {}) {
   if (!dir) return null;
+  const stops = stopAtUserBoundary
+    ? new Set((boundaries || _userBoundaryDirs()).map(_dirKey))
+    : null;
   let d = pathResolve(dir);
   while (d && d !== dirname(d)) {
+    if (stops && stops.has(_dirKey(d))) return null;
     if (_PROJECT_ROOT_SENTINELS.some((s) => existsSync(join(d, s)))) return d;
     d = dirname(d);
   }
   return null;
 }
 
+// Immediate child directories that are themselves project roots. Separates a
+// sentinel-free SINGLE tree (a vendored reference checkout — indexable as its
+// own root) from a multi-repo PARENT (ambiguous — indexing it would walk
+// unrelated trees). Capped: the caller only needs "none/one" vs "many".
+export function _childProjectRoots(dir, { cap = 32 } = {}) {
+  if (!dir) return [];
+  let entries;
+  try { entries = readdirSync(pathResolve(dir), { withFileTypes: true }); }
+  catch { return []; }
+  const roots = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+    const child = join(pathResolve(dir), entry.name);
+    if (_PROJECT_ROOT_SENTINELS.some((s) => existsSync(join(child, s)))) roots.push(child);
+    if (roots.length >= cap) break;
+  }
+  return roots;
+}
+
 // MCP clients sometimes inject empty-string defaults for optional schema
 // fields (e.g. `file: ""`). Strip empty/null optional path-like fields before
 // dispatch so a literal "" doesn't trip the "file not found in graph" path.

package/src/runtime/agent/orchestrator/tools/code-graph/trusted-roots.mjs

@@ -56,7 +56,9 @@ export function collectTrustedCodeGraphRoots(filesystemRoot, {
   ],
   cached = listCachedCodeGraphRoots,
   directory = isDirectory,
-  projectRoot = _findDirProjectRoot,
+  // Selected paths are promoted to their nearest project root — but a home or
+  // temp sentinel must not widen a selected subfolder into the whole profile.
+  projectRoot = (dir) => _findDirProjectRoot(dir, { stopAtUserBoundary: true }),
 } = {}) {
   const root = resolve(filesystemRoot);
   const rows = [

package/src/runtime/agent/orchestrator/tools/env-scrub.mjs

@@ -105,8 +105,7 @@ export function scrubProviderSecrets(env) {
 // a dev-tree test run inside such a shell would resolve defaults/agents.json
 // and friends from the INSTALLED app instead of the repo under test (plain
 // node can't even read asar paths → ENOENT). Internal worker spawns that need
-// the root re-set it explicitly and are unaffected: only shell spawn sites
-// call this.
+// the root re-set it explicitly and are unaffected.
 export function scrubRuntimeRootVars(env) {
     if (!env || typeof env !== 'object') return env;
     delete env.MIXDOG_ROOT;
@@ -118,5 +117,13 @@ export function scrubRuntimeRootVars(env) {
     // env, so shells must not see it. A command that needs NODE_ENV sets it
     // explicitly.
     delete env.NODE_ENV;
+    // Daemon IDENTITY leak: user-facing children must not inherit host/worker
+    // ownership or the daemon's terminal-lead PID. Internal daemon/worker
+    // spawns set every identity value explicitly after this boundary.
+    delete env.MIXDOG_ENGINE_DAEMON_HOST;
+    delete env.MIXDOG_CHANNEL_DAEMON;
+    delete env.MIXDOG_WORKER_MODE;
+    delete env.MIXDOG_DAEMON_SPAWNED_FOR;
+    delete env.MIXDOG_SUPERVISOR_PID;
     return env;
 }

package/src/runtime/agent/orchestrator/tools/patch/dispatch.mjs

@@ -24,7 +24,7 @@ import {
   countHunkChanges,
 } from './paths.mjs';
 import {
-  getNativePatchServer,
+  runServerApply,
   scheduleNativePatchIdleClose,
   nativePatchTraceEnabled,
   patchTraceEnabled,
@@ -99,7 +99,7 @@ export async function dispatchNativePatch({ entries, basePath, nativePatchStr, f
   const nativeStart = performance.now();
   let stats;
   try {
-    stats = await getNativePatchServer().apply(basePath, nativePatchStr, { fuzz, rejectPartial, dryRun, signal });
+    stats = await runServerApply(basePath, nativePatchStr, { fuzz, rejectPartial, dryRun, signal });
   } catch (err) {
     scheduleNativePatchIdleClose();
     const msg = err?.message || String(err);

package/src/runtime/agent/orchestrator/tools/patch/matcher.mjs

@@ -65,7 +65,7 @@ export function collectUnifiedNewLines(hunk) {
 }
 
 // Guard a replacement plan before it is applied in DESCENDING order (the
-// Codex `apply_replacements` shape). The plan must already be sorted
+// `apply_replacements` shape). The plan must already be sorted
 // ascending by `start`. Descending application is only content-safe when the
 // replaced ranges are disjoint; the single well-defined exception is several
 // zero-length insertions at one index, which descending application emits in

package/src/runtime/agent/orchestrator/tools/patch/native-server.mjs

@@ -129,6 +129,11 @@ function decodeNativeFailures(hexPayload) {
   return out;
 }
 
+// Error code for a request refused/failed because the server child is gone.
+// Nothing was written when it is thrown from the pre-flight, so one respawned
+// retry is safe.
+export const NATIVE_PATCH_TRANSPORT_DEAD = 'ENATIVEPATCHDEAD';
+
 class NativePatchServer {
   constructor(binPath) {
     this.binPath = binPath;
@@ -141,6 +146,7 @@ class NativePatchServer {
     this.lines = [];
     this.waiters = [];
     this.exited = false;
+    this.transportError = null;
     this.child.stderr.setEncoding('utf8');
     this.child.stderr.on('data', (chunk) => { this.stderr += chunk; });
     this.rl = createInterface({ input: this.child.stdout });
@@ -149,6 +155,12 @@ class NativePatchServer {
       if (waiter) waiter.resolve(line);
       else this.lines.push(line);
     });
+    // A child that died mid-request turns every pending `stdin.write()` into an
+    // UNHANDLED 'error' event (EPIPE) that takes the whole host process down —
+    // a release validate job was lost exactly that way. Absorb it here: mark
+    // the transport dead and reject the waiters so callers see an ordinary
+    // rejection (and respawn) instead of a crash.
+    this.child.stdin.on('error', (err) => { this.failTransport(err); });
     this.child.on('exit', (code, signal) => {
       this.exited = true;
       const err = new Error(`native patch server exited code=${code} signal=${signal} stderr=${this.stderr}`);
@@ -157,6 +169,29 @@ class NativePatchServer {
     });
   }
 
+  // Idempotent death record: the stdin error and the child exit usually both
+  // fire for the same death, and only the first one owns the reason.
+  failTransport(cause) {
+    this.exited = true;
+    if (!this.transportError) {
+      const err = cause instanceof Error ? cause : new Error(String(cause || 'native patch transport closed'));
+      err.code = NATIVE_PATCH_TRANSPORT_DEAD;
+      this.transportError = err;
+    }
+    for (const waiter of this.waiters.splice(0)) waiter.reject(this.transportError);
+    try { this.rl.close(); } catch {}
+  }
+
+  // Pre-flight for every request: refuse BEFORE a single byte is written, so
+  // the caller may respawn and retry without any risk of double-applying.
+  assertAlive(action) {
+    if (!this.exited && !this.transportError) return;
+    const reason = this.transportError?.message || this.stderr || 'exited';
+    const err = new Error(`native patch server is not running (${action}): ${reason}`);
+    err.code = NATIVE_PATCH_TRANSPORT_DEAD;
+    throw err;
+  }
+
   abort(signal) {
     const err = new Error(signal?.reason?.message || signal?.reason || 'native patch aborted');
     err.name = 'AbortError';
@@ -188,6 +223,7 @@ class NativePatchServer {
 
   async ping() {
     this.ref();
+    this.assertAlive('ping');
     const linePromise = this.nextLine();
     this.child.stdin.write('PING\n');
     const line = await linePromise;
@@ -198,6 +234,7 @@ class NativePatchServer {
 
   async apply(basePath, patchText, { fuzz = 2, rejectPartial = true, dryRun = false, signal = null } = {}) {
     this.ref();
+    this.assertAlive('apply');
     if (signal?.aborted) {
       const err = new Error(signal.reason?.message || signal.reason || 'native patch aborted');
       err.name = 'AbortError';
@@ -294,6 +331,7 @@ class NativePatchServer {
   // matched tier.
   async edit(fullPath, oldBuf, newBuf, { replaceAll = false, dryRun = false, signal = null } = {}) {
     this.ref();
+    this.assertAlive('edit');
     if (signal?.aborted) {
       const err = new Error(signal.reason?.message || signal.reason || 'native edit aborted');
       err.name = 'AbortError';
@@ -384,8 +422,25 @@ function getNativeEditServer() {
 // NativePatchServer transport but runs on a DEDICATED instance so edit and
 // patch requests never interleave their stdin framing on one stdout stream.
 export async function runServerEdit({ fullPath, oldBuf, newBuf, replaceAll = false, dryRun = false, signal = null }) {
-  const server = getNativeEditServer();
-  return server.edit(fullPath, oldBuf, newBuf, { replaceAll, dryRun, signal });
+  try {
+    return await getNativeEditServer().edit(fullPath, oldBuf, newBuf, { replaceAll, dryRun, signal });
+  } catch (err) {
+    if (err?.code !== NATIVE_PATCH_TRANSPORT_DEAD) throw err;
+    // The dead instance was refused before any byte went out; the getter
+    // respawns because the previous one is marked exited.
+    return getNativeEditServer().edit(fullPath, oldBuf, newBuf, { replaceAll, dryRun, signal });
+  }
+}
+
+// Same one-shot respawn for APPLY: an idle-watchdog exit or an external kill
+// between requests must cost a respawn, not the request.
+export async function runServerApply(basePath, patchText, options = {}) {
+  try {
+    return await getNativePatchServer().apply(basePath, patchText, options);
+  } catch (err) {
+    if (err?.code !== NATIVE_PATCH_TRANSPORT_DEAD) throw err;
+    return getNativePatchServer().apply(basePath, patchText, options);
+  }
 }
 
 export function scheduleNativePatchPrewarm() {