mixdog 0.9.95 → 0.9.96

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -140,8 +140,8 @@ export function killShellJob(jobId) {
 // wrapper publishing the done marker. Evidence order:
 //   1. exit file — the wrapper writes exit BEFORE done, so a kill in that
 //      window still left the real exit code; recover it instead of guessing.
-//   2. guardian receipt — the child-guardian records why it force-killed the
-//      tree (host memory floor / orphaned parent) before killing.
+//   2. guardian receipt — the child-guardian records an orphaned parent before
+//      cleaning up the owned tree.
 //   3. otherwise — honest unknown: terminal 'failed' with exitCode null and
 //      an explicit "exit status unknown" error; spilled output is preserved
 //      and the completion notification carries its tail.
@@ -165,12 +165,7 @@ function finalizeMarkerlessShellJob(detail) {
         } catch { /* no guardian receipt */ }
         detail.status = 'failed';
         detail.exitCode = 137;
-        if (receipt?.reason === 'host-memory-floor') {
-            const freeMb = Math.round(Number(receipt.freeBytes || 0) / (1024 * 1024));
-            const floorMb = Math.round(Number(receipt.minFreeMemoryBytes || 0) / (1024 * 1024));
-            detail.killedByGuardian = true;
-            detail.error = `killed by child guardian: host free memory ${freeMb} MB fell below the ${floorMb} MB floor — job tree force-killed to protect the host; retry with lower concurrency or after memory recovers`;
-        } else if (receipt?.reason === 'parent-exit') {
+        if (receipt?.reason === 'parent-exit') {
             detail.killedByGuardian = true;
             detail.error = 'killed by child guardian: owning runtime process exited (session cleanup)';
         } else {

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -66,10 +66,40 @@ function firstExistingPathFromPath(commandName, excludeRe = null) {
         .find((candidate) => !excludeRe || !excludeRe.test(candidate)) || null;
 }
 
+// Well-known pwsh (PowerShell 7+) install roots, probed on the filesystem when
+// PATH does not carry pwsh.exe. A long-lived daemon frequently inherits an env
+// without the PowerShell 7 directory, which silently downgraded every command
+// to Windows PowerShell 5.1 — the shell that lacks `&&` and drives the bashism
+// preflight blocks. Newest major first, then the Store alias.
+function pwshFromKnownWindowsRoots() {
+    const env = process.env;
+    const bases = [env.ProgramW6432, env.ProgramFiles, env['ProgramFiles(x86)'], 'C:\\Program Files', 'C:\\Program Files (x86)']
+        .filter(Boolean)
+        .map((base) => join(base, 'PowerShell'));
+    const versions = ['7', '7-preview', '8', '9'];
+    for (const base of bases) {
+        for (const version of versions) {
+            const candidate = join(base, version, 'pwsh.exe');
+            if (existsSync(candidate)) return candidate;
+        }
+    }
+    if (env.LOCALAPPDATA) {
+        const storeAlias = join(env.LOCALAPPDATA, 'Microsoft', 'WindowsApps', 'pwsh.exe');
+        if (existsSync(storeAlias)) return storeAlias;
+    }
+    return null;
+}
+
 function resolveWindowsPowerShell() {
+    // Priority: pwsh on PATH → pwsh in a known install root → bundled 5.1 →
+    // any powershell.exe on PATH. PowerShell 7 is preferred wherever it exists
+    // because 5.1 rejects `&&` chains and several modern operators.
     const pwsh = firstExistingPathFromPath('pwsh.exe');
     if (pwsh) return shellSpec(pwsh, 'powershell');
 
+    const installed = pwshFromKnownWindowsRoots();
+    if (installed) return shellSpec(installed, 'powershell');
+
     const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
     const bundled = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
     if (existsSync(bundled)) return shellSpec(bundled, 'powershell');

package/src/runtime/agent/orchestrator/tools/code-graph/build.mjs

@@ -146,9 +146,9 @@ export async function _runDiskCodeGraphFastPath({
   signal = null,
   loadDiskEntry,
   consumeDirty = () => {},
-  // Long-lived build slot: 'build' lane so a cold graph build never blocks
-  // short rg spawns behind the win32 cap=1 default lane.
-  acquireSlot = (signal) => acquireChildSpawnSlot(signal, 'build'),
+  // Long-lived code-graph lane so a cold graph build never blocks short rg
+  // processes in the independent search lane.
+  acquireSlot = (signal) => acquireChildSpawnSlot(signal, 'code-graph'),
   validateDiskHit = _validateDiskCodeGraphHit,
   spawnWorker,
   maxFiles = CODE_GRAPH_MAX_FILES,
@@ -344,7 +344,7 @@ export async function buildCodeGraphAsync(cwd, signal = null, {
   }
   // Non-competing prewarm: the signature-validation manifest also needs a
   // child-spawn slot, so warmers skip before either it or a Worker can queue.
-  if (bestEffort && !childSpawnHasSpareCapacity()) return null;
+  if (bestEffort && !childSpawnHasSpareCapacity('code-graph')) return null;
   const _genAtStart = _getCodeGraphGen(graphCwd);
   const promise = (async () => {
     // Loading the compact disk manifest/one candidate entry is synchronous but
@@ -422,7 +422,7 @@ export function _spawnCodeGraphWorker(
       if (val instanceof Error) reject(val);
       else resolve(val);
     };
-    (preAcquiredRelease ? Promise.resolve(preAcquiredRelease) : acquireChildSpawnSlot(signal || null, 'build')).then((release) => {
+    (preAcquiredRelease ? Promise.resolve(preAcquiredRelease) : acquireChildSpawnSlot(signal || null, 'code-graph')).then((release) => {
       _releaseSlot = release;
       if (settled) { release(); _releaseSlot = null; return; }
       if (signal?.aborted) { settle(new Error('aborted')); return; }

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch.mjs

@@ -51,7 +51,8 @@ import {
 
 const CODE_GRAPH_BATCHABLE_MODES = new Set(['symbol', 'find_symbol', 'symbol_search', 'callers', 'callees', 'references']);
 const CODE_GRAPH_FILE_BATCHABLE_MODES = new Set(['imports', 'dependents', 'related', 'impact', 'symbols', 'overview']);
-const CODE_GRAPH_SYMBOL_BATCH_CAP = 20;
+const CODE_GRAPH_MAX_BATCH_SYMBOLS = 20;
+const CODE_GRAPH_FILE_BATCH_CAP = 20;
 
 function _collectGraphSymbolList(args) {
   const split = (s) => String(s || '').split(/[,\s]+/).map((t) => t.trim()).filter(Boolean);
@@ -60,18 +61,21 @@ function _collectGraphSymbolList(args) {
     ...(typeof args?.symbols === 'string' ? split(args.symbols) : []),
     ...(typeof args?.symbol === 'string' ? split(args.symbol) : []),
   ])];
-  if (list.length <= CODE_GRAPH_SYMBOL_BATCH_CAP) return list;
-  const capped = list.slice(0, CODE_GRAPH_SYMBOL_BATCH_CAP);
-  capped._omitted = list.slice(CODE_GRAPH_SYMBOL_BATCH_CAP);
-  return capped;
+  return list;
 }
 
-const CODE_GRAPH_FILE_BATCH_CAP = 20;
 const _AGGREGATE_FILE_WILDCARD_RE = /[*?[\]{}]/;
 const ROOT_FEDERATED_MODES = new Set([
   'overview', 'symbol', 'find_symbol', 'symbol_search', 'search',
   'references', 'callers', 'callees', 'symbols', 'prewarm',
 ]);
+// Fan-out cap when federation targets are DISCOVERED (immediate child project
+// roots of a sentinel-free cwd) rather than registered. Bounds the cost of
+// answering a query at a multi-repo parent; registered roots are unaffected.
+const CODE_GRAPH_DISCOVERED_FEDERATION_CAP = (() => {
+  const raw = parseInt(process.env.MIXDOG_CODE_GRAPH_FEDERATION_CAP ?? '', 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : 8;
+})();
 
 export async function _runCodeGraphFederation(roots, runOne, projectArgs) {
   return Promise.all((roots || []).map(async (root) => {
@@ -132,6 +136,25 @@ function _hasAggregateFileArgs(args) {
     || (typeof args?.files === 'string' && args.files.trim());
 }
 
+// Aggregate anchors that ALL resolve to the cwd itself ('.', './', the cwd
+// path) add no scope — they mean "search here". Detected so the call can take
+// the plain-cwd route, which adopts a sentinel-free single tree (a vendored
+// reference checkout) as its own root while still refusing an unbounded or
+// multi-project parent. Without this, `files:"."` turned every reference tree
+// into a hard "not inside a project" refusal.
+function _aggregateAnchorsAreCwd(args, baseCwd) {
+  if (!_hasAggregateFileArgs(args)) return false;
+  const files = _collectGraphFileList(args);
+  if (files.length === 0) return false;
+  return files.every((file) => {
+    const trimmed = String(file || '').trim();
+    if (!trimmed || _AGGREGATE_FILE_WILDCARD_RE.test(trimmed)) return false;
+    try {
+      return pathResolve(isAbsolute(trimmed) ? trimmed : pathResolve(baseCwd, trimmed)) === pathResolve(baseCwd);
+    } catch { return false; }
+  });
+}
+
 // An invalid caller cwd may be recovered for an explicit files aggregate only
 // when every supplied anchor points at the same detectable project. Do not use
 // the batch cap here: an omitted anchor could belong to another project.
@@ -156,9 +179,35 @@ function _resolveAggregateFileProjectRoot(args, baseCwd) {
     const root = isDirectory ? _findDirProjectRoot(abs) : _resolveFileProjectRoot(abs);
     if (!root) return null;
     roots.add(pathResolve(root));
-    if (roots.size > 1) return null;
   }
-  return roots.size === 1 ? [...roots][0] : null;
+  if (roots.size === 0) return null;
+  if (roots.size === 1) return [...roots][0];
+  // Monorepo anchors legitimately resolve to DIFFERENT sentinels: a workspace
+  // package (apps/desktop/package.json) is nearer than the repo root, so one
+  // call spanning `apps/desktop/...` and `src/...` yields two roots even though
+  // both live in exactly one project. When one candidate contains every other,
+  // that outermost root IS the single detectable project — adopt it instead of
+  // refusing. Genuinely unrelated trees share no such candidate and still fail.
+  return _outermostContainingRoot([...roots]);
+}
+
+// The candidate that contains (or equals) every other candidate, else null.
+// Only an EXISTING candidate can win: a bare common ancestor that has no
+// sentinel of its own is never adopted as a project root.
+function _outermostContainingRoot(roots) {
+  for (const candidate of roots) {
+    if (roots.every((root) => _isSameOrInside(root, candidate))) return candidate;
+  }
+  return null;
+}
+
+function _isSameOrInside(child, parent) {
+  try {
+    const rel = pathRelative(pathResolve(parent), pathResolve(child));
+    return rel === '' || (!!rel && !rel.startsWith('..') && !isAbsolute(rel));
+  } catch {
+    return false;
+  }
 }
 
 // Aggregate recovery resolves relative anchors against the caller's original
@@ -624,6 +673,11 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
     args = { ...args };
     delete args.file;
   }
+  if (symbolMode && _aggregateAnchorsAreCwd(args, baseCwd)) {
+    args = { ...args };
+    delete args.files;
+    delete args.file;
+  }
   const fileArg = (args && typeof args.file === 'string' && args.file.trim()) ? args.file.trim() : '';
   const hasAggregateFileArgs = _hasAggregateFileArgs(args);
   let effectiveCwd = baseCwd;
@@ -647,6 +701,20 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
     ? []
     : collectTrustedCodeGraphRoots(baseCwd)
       .filter((root) => pathResolve(root) !== pathResolve(baseCwd));
+  // Trust registration is a ROUTING PREFERENCE, not an admission gate. A
+  // sentinel-free cwd whose children are obvious project roots (a refs/ folder
+  // of checkouts, a multi-repo parent) is answerable: federate over those
+  // children instead of refusing the call. Cost stays bounded by the existing
+  // per-project graph timeout and the federation fan-out cap — the same way the
+  // reference CLIs bound a wide search (time/output caps, never a scope
+  // refusal). Registered roots keep priority; discovered children only fill in
+  // when registration yields nothing.
+  const federationRootsAtBase = trustedRootsAtBase.length
+    ? trustedRootsAtBase
+    : (baseProjectRoot
+      ? []
+      : _childProjectRoots(baseCwd, { cap: CODE_GRAPH_DISCOVERED_FEDERATION_CAP })
+        .filter((root) => pathResolve(root) !== pathResolve(baseCwd)));
   // A sentinel-free cwd (multi-repo parent, vendored reference tree) is still
   // routable when trusted project roots live under it — federate over those
   // instead of refusing the call outright.
@@ -656,9 +724,12 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
     && !fileArg
     && !hasAggregateFileArgs
     && ROOT_FEDERATED_MODES.has(rawModeAtBase)
-    && trustedRootsAtBase.length > 0;
+    && federationRootsAtBase.length > 0;
   if (filesystemRootCwd || parentDotFederation || sentinelFreeFederation) {
-    const trustedRoots = trustedRootsAtBase;
+    // A filesystem root stays on the REGISTERED set only: fanning out over
+    // every project directory on a whole drive is a different cost class than
+    // fanning out over one folder's children.
+    const trustedRoots = filesystemRootCwd ? trustedRootsAtBase : federationRootsAtBase;
     const files = exactDotFederation ? [] : aggregateFilesAtBase;
     const rawMode = rawModeAtBase;
     const canFederate = files.length > 0 || ROOT_FEDERATED_MODES.has(rawMode);
@@ -818,7 +889,8 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
           ? findSymbolTool(_stripEmptyArgs(a), effectiveCwd, signal, options)
           : codeGraph(a, effectiveCwd, signal, options));
         if (CODE_GRAPH_BATCHABLE_MODES.has(batchMode)) {
-          const symbolList = _collectGraphSymbolList(args);
+          const collectedSymbols = _collectGraphSymbolList(args);
+          const symbolList = collectedSymbols.slice(0, CODE_GRAPH_MAX_BATCH_SYMBOLS);
           if (symbolList.length > 1) {
             return (async () => {
               // Concurrent fan-out: the underlying graph build is single-flight
@@ -831,10 +903,10 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
                 catch (e) { body = `Error: ${e?.message || String(e)}`; }
                 return `# ${batchMode} ${sym}\n${body}`;
               }));
-              if (symbolList._omitted?.length) {
+              if (collectedSymbols.length > symbolList.length) {
                 sections.push(
-                  `Note: symbol list capped at ${CODE_GRAPH_SYMBOL_BATCH_CAP}; `
-                  + `retry symbols=${JSON.stringify(symbolList._omitted)}.`,
+                  `[arg-guard] notice: symbol list capped at ${CODE_GRAPH_MAX_BATCH_SYMBOLS} `
+                    + `(${collectedSymbols.length - symbolList.length} omitted)`,
                 );
               }
               return sections.join('\n\n');
@@ -847,8 +919,8 @@ async function executeCodeGraphToolRaw(name, args, cwd, signal = null, options =
         if (CODE_GRAPH_FILE_BATCHABLE_MODES.has(batchMode)) {
           const fileList = _collectGraphFileList(args);
           if (fileList.length > 1) {
-            const capped = fileList._capped;
             return (async () => {
+              const capped = fileList._capped;
               const sections = await Promise.all(fileList.map(async (f) => {
                 let body;
                 try { body = await dispatchOne({ ...args, file: f, files: undefined }); }

package/src/runtime/agent/orchestrator/tools/code-graph/search.mjs

@@ -269,21 +269,12 @@ export async function _prewarmReferenceSourceText(graph, symbol, language) {
   }
   if (uncached.length === 0) return candidateNodes;
   const { readFile } = await import('fs/promises');
-  const concurrency = 64;
-  let next = 0;
-  async function worker() {
-    while (true) {
-      const index = next++;
-      if (index >= uncached.length) return;
-      const node = uncached[index];
-      try {
-        const text = await readFile(node.abs, 'utf8');
-        graph._sourceTextCache?.set(node.rel, { fingerprint: node.fingerprint || '', text });
-      } catch { /* skip unreadable file */ }
-    }
-  }
-  const workerCount = Math.min(Math.max(1, concurrency), uncached.length);
-  await Promise.all(Array.from({ length: workerCount }, () => worker()));
+  await Promise.all(uncached.map(async (node) => {
+    try {
+      const text = await readFile(node.abs, 'utf8');
+      graph._sourceTextCache?.set(node.rel, { fingerprint: node.fingerprint || '', text });
+    } catch { /* skip unreadable file */ }
+  }));
   return candidateNodes;
 }
 

package/src/runtime/agent/orchestrator/tools/code-graph-tool-defs.mjs

@@ -3,13 +3,13 @@ export const CODE_GRAPH_TOOL_DEFS = [
     name: 'code_graph',
     title: 'Code Graph',
     annotations: { title: 'Code Graph', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false, compressibleLossless: true },
-    description: 'Repo code structure/flow over source files. File modes take files[]; symbol modes take symbols[] — exact identifiers via find_symbol/references/callers/callees, keywords via symbol_search/search. Unsupported target arrays are omitted, never mixed.',
+    description: 'Source-file structure, symbol relations, and flow. File modes take files[]; symbol modes take symbols[] — exact identifiers via find_symbol/references/callers/callees, keywords via symbol_search/search (symbol-index terms). Unsupported target arrays are omitted, never mixed.',
     inputSchema: {
       type: 'object',
       properties: {
         mode: { type: 'string', enum: ['overview', 'imports', 'dependents', 'related', 'impact', 'symbols', 'find_symbol', 'symbol_search', 'search', 'references', 'callers', 'callees'], description: 'File modes={overview,imports,dependents,related,impact}; symbols with files[]=file outline; the rest are symbol modes.' },
         files: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Source file path(s); supported targets only.' },
-        symbols: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Exact identifiers or keywords; batch multiple in one symbols[].' },
+        symbols: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Exact identifiers or keywords; keywords are symbol-index terms; batch multiple in one symbols[].' },
         body: { type: 'boolean', description: 'Include body.' },
         limit: { type: 'number', minimum: 1, description: 'Max results.' },
         depth: { type: 'number', minimum: 1, maximum: 5, description: 'Caller depth.' },

package/src/runtime/agent/orchestrator/tools/lib/pwsh-standby-pool.mjs

@@ -26,18 +26,51 @@
 import { spawn } from 'node:child_process';
 import { basename } from 'node:path';
 import { createHash, randomBytes } from 'node:crypto';
+import { availableParallelism, freemem } from 'node:os';
 import { killProcessTree, windowsPidHasDescendants } from '../builtin/shell-job-process.mjs';
 
+const MB = 1024 * 1024;
+
+export function _resolvePwshPoolTarget({
+    env = process.env,
+    platform = process.platform,
+    parallelism = null,
+    freeMemoryBytes = null,
+} = {}) {
+    const configured = env?.MIXDOG_PWSH_STANDBY_POOL;
+    if (configured != null && configured !== '') {
+        const n = Math.floor(Number(configured));
+        if (Number.isFinite(n) && n >= 0) return Math.min(8, n);
+    }
+    if (platform !== 'win32') return 0;
+    // Tools now execute in the machine-global backend daemon. Keep client/test
+    // processes at zero by default, but let that ONE host maintain a short-lived
+    // warm burst sized to the machine instead of making every shell call pay the
+    // ~300ms pwsh startup cost.
+    if (env?.MIXDOG_ENGINE_DAEMON_HOST !== '1' && env?.MIXDOG_CHANNEL_DAEMON !== '1') return 0;
+    let cores = Number(parallelism);
+    if (!Number.isFinite(cores) || cores < 1) {
+        try { cores = availableParallelism(); } catch { cores = 1; }
+    }
+    let free = freeMemoryBytes == null ? Number.NaN : Number(freeMemoryBytes);
+    if (!Number.isFinite(free) || free < 0) {
+        try { free = freemem(); } catch { free = 0; }
+    }
+    const cpuTarget = Math.max(1, Math.min(4, Math.floor(cores) - 1 || 1));
+    if (free < 768 * MB) return 0;
+    if (free < 1536 * MB) return Math.min(1, cpuTarget);
+    if (free < 3072 * MB) return Math.min(2, cpuTarget);
+    return cpuTarget;
+}
+
 function _poolTarget() {
-    const n = Math.floor(Number(process.env.MIXDOG_PWSH_STANDBY_POOL));
-    if (Number.isFinite(n) && n >= 0) return Math.min(8, n);
-    return 2;
+    return _resolvePwshPoolTarget();
 }
 const POOL_TARGET = _poolTarget();
-// Only standbys older than this are handed out: a younger one is still paying
-// pwsh startup, so adopting it would just relocate the cold cost. Callers get
-// null (classic spawn) while the pool warms.
-const STANDBY_READY_AGE_MS = 400;
+const _envIdleMs = Math.floor(Number(process.env.MIXDOG_PWSH_STANDBY_IDLE_MS));
+const STANDBY_IDLE_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0
+    ? _envIdleMs
+    : 60_000;
 const EXPECTED_ARGS = Object.freeze(['-NoLogo', '-NoProfile', '-NonInteractive', '-Command']);
 
 // Marker-loop bootstrap: the standby serves MANY commands over its lifetime.
@@ -132,6 +165,7 @@ function _standbyBootScript(nonce) {
 }
 
 const _idle = [];
+const _taken = new Set();
 let _envSig = null;
 let _exitHookInstalled = false;
 
@@ -144,6 +178,10 @@ function _envSignature(env) {
 }
 
 function _killEntry(entry) {
+    if (entry.idleTimer) {
+        clearTimeout(entry.idleTimer);
+        entry.idleTimer = null;
+    }
     try { entry.child.kill(); } catch { /* already down */ }
 }
 
@@ -152,6 +190,19 @@ function _discardIdle(entry) {
     if (i !== -1) _idle.splice(i, 1);
 }
 
+function _armIdleExpiry(entry) {
+    if (entry.idleTimer) clearTimeout(entry.idleTimer);
+    entry.idleTimer = null;
+    if (STANDBY_IDLE_MS <= 0) return;
+    entry.idleTimer = setTimeout(() => {
+        entry.idleTimer = null;
+        if (entry.taken) return;
+        _discardIdle(entry);
+        _killEntry(entry);
+    }, STANDBY_IDLE_MS);
+    entry.idleTimer.unref?.();
+}
+
 function _installExitHook() {
     if (_exitHookInstalled) return;
     _exitHookInstalled = true;
@@ -173,7 +224,7 @@ function _spawnStandby(shell, env, sig) {
             detached: false,
         });
     } catch { return; }
-    const entry = { child, sig, nonce, spawnedAt: Date.now(), taken: false, consumed: false };
+    const entry = { child, sig, nonce, taken: false, consumed: false, idleTimer: null };
     child.on('error', () => { if (!entry.taken) { _discardIdle(entry); _killEntry(entry); } });
     child.on('exit', () => { if (!entry.taken) _discardIdle(entry); });
     // A dead standby's pending stdin write must never crash the daemon.
@@ -187,10 +238,25 @@ function _spawnStandby(shell, env, sig) {
         child.stderr?.unref?.();
     } catch { /* best-effort */ }
     _idle.push(entry);
+    _armIdleExpiry(entry);
+}
+
+function _poolSizeForSignature(sig) {
+    let count = _idle.reduce((total, entry) => total + (entry.sig === sig ? 1 : 0), 0);
+    for (const entry of _taken) {
+        if (entry.sig === sig) count += 1;
+    }
+    return count;
 }
 
 function _topUp(shell, env, sig) {
-    while (_idle.length < POOL_TARGET) _spawnStandby(shell, env, sig);
+    while (_poolSizeForSignature(sig) < POOL_TARGET) _spawnStandby(shell, env, sig);
+}
+
+function _releaseTaken(entry) {
+    if (!_taken.delete(entry)) return false;
+    entry.taken = false;
+    return true;
 }
 
 /**
@@ -215,11 +281,9 @@ export function takePwshStandby({ shell, shellArgs, env }) {
         _envSig = sig;
     }
     _topUp(shell, env, sig);
-    const now = Date.now();
     let entry = null;
     for (let i = 0; i < _idle.length; i += 1) {
         const cand = _idle[i];
-        if (now - cand.spawnedAt < STANDBY_READY_AGE_MS) continue;
         if (cand.child.exitCode !== null || cand.child.signalCode !== null) continue;
         if (!cand.child.stdin || cand.child.stdin.destroyed) continue;
         _idle.splice(i, 1);
@@ -229,6 +293,11 @@ export function takePwshStandby({ shell, shellArgs, env }) {
     if (!entry) return null;
     entry.taken = true;
     entry.consumed = false;
+    _taken.add(entry);
+    if (entry.idleTimer) {
+        clearTimeout(entry.idleTimer);
+        entry.idleTimer = null;
+    }
     try {
         entry.child.ref();
         entry.child.stdin?.ref?.();
@@ -271,6 +340,7 @@ export function takePwshStandby({ shell, shellArgs, env }) {
         // job's close-wired exit file then records the REAL command exit.
         endStdin() {
             entry.consumed = true;
+            _releaseTaken(entry);
             try { entry.child.stdin.end(); } catch { /* already gone */ }
         },
         // Post-command recycle: return the standby to the pool ONLY when the
@@ -281,6 +351,7 @@ export function takePwshStandby({ shell, shellArgs, env }) {
         async recycle() {
             if (entry.consumed) return false;
             entry.consumed = true;
+            _releaseTaken(entry);
             const c = entry.child;
             const alive = () => c.exitCode === null && c.signalCode === null;
             let dirty = true;
@@ -309,9 +380,7 @@ export function takePwshStandby({ shell, shellArgs, env }) {
                     process.stderr.write(`[pwsh-standby] recycle drained ${_staleBytes}B stale output (pid=${c.pid}) — late flush escaped the previous command's capture\n`);
                 } catch { /* diagnostics only */ }
             }
-            entry.taken = false;
             entry.consumed = false;
-            entry.spawnedAt = Date.now() - STANDBY_READY_AGE_MS;
             try {
                 c.unref();
                 c.stdin?.unref?.();
@@ -319,6 +388,7 @@ export function takePwshStandby({ shell, shellArgs, env }) {
                 c.stderr?.unref?.();
             } catch { /* best-effort */ }
             _idle.push(entry);
+            _armIdleExpiry(entry);
             return true;
         },
     };

package/src/runtime/agent/orchestrator/tools/patch/matcher.mjs

@@ -334,7 +334,10 @@ function rustTrim(s) {
   return s.replace(RUST_TRIM_RE, '');
 }
 export function normalizeTypographic(s) {
-  return rustTrim(String(s ?? ''))
+  // NFC first: a decomposed sequence (Hangul jamo, or "e" + combining acute
+  // from a file authored on another platform) is visually identical to its
+  // composed form but byte-different, which failed an otherwise exact context.
+  return rustTrim(String(s ?? '').normalize('NFC'))
     .replace(/[\u2010\u2011\u2012\u2013\u2014\u2015\u2212]/g, '-')
     .replace(/[\u2018\u2019\u201A\u201B]/g, "'")
     .replace(/[\u201C\u201D\u201E\u201F]/g, '"')
@@ -405,6 +408,41 @@ export function longestCommonSubstringLen(a, b, cap = 4000) {
   return best;
 }
 
+// Total character drift tolerated per context line by the edit-distance tier.
+// Deliberately tiny: 3 context lines buy exactly 1 character of slack, so the
+// tier rescues a typo, never a genuinely different block.
+export const EDIT_DISTANCE_ALLOWANCE_PER_LINE = 0.34;
+
+// Levenshtein distance with an early exit: returns the exact distance while it
+// stays within `max`, otherwise `max + 1` as soon as that is certain. The
+// length pre-check and the per-row minimum keep a whole-file scan cheap.
+export function boundedEditDistance(a, b, max) {
+  const s = String(a ?? '');
+  const t = String(b ?? '');
+  if (s === t) return 0;
+  if (!(max > 0)) return 1;
+  if (Math.abs(s.length - t.length) > max) return max + 1;
+  const n = s.length;
+  const m = t.length;
+  let prev = new Int32Array(m + 1);
+  let curr = new Int32Array(m + 1);
+  for (let j = 0; j <= m; j++) prev[j] = j;
+  for (let i = 1; i <= n; i++) {
+    curr[0] = i;
+    let rowMin = curr[0];
+    const ci = s.charCodeAt(i - 1);
+    for (let j = 1; j <= m; j++) {
+      const cost = ci === t.charCodeAt(j - 1) ? 0 : 1;
+      const value = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+      curr[j] = value;
+      if (value < rowMin) rowMin = value;
+    }
+    if (rowMin > max) return max + 1;
+    const tmp = prev; prev = curr; curr = tmp;
+  }
+  return prev[m] > max ? max + 1 : prev[m];
+}
+
 export function findLineSequence(lines, needle, fromLine, preferredLine = 0, options = {}) {
   if (!Array.isArray(needle) || needle.length === 0) return Math.max(0, preferredLine || fromLine || 0);
   const eof = options?.eof === true;

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -703,7 +703,7 @@ export function appendPostPatchExcerpts(outputText, patchStr, requestedFormat, b
   }
 }
 
-const APPLY_PATCH_SCHEMA_KEYS = new Set(['patch', 'format', 'base_path', 'dry_run', 'reject_partial', 'fuzzy', 'sequence', 'mode']);
+const APPLY_PATCH_SCHEMA_KEYS = new Set(['patch', 'format', 'base_path', 'root', 'dry_run', 'reject_partial', 'fuzzy', 'sequence', 'mode']);
 function salvageShatteredV4APatchArgs(args) {
   if (!args || typeof args !== 'object') return args;
   const rawPatch = typeof args.patch === 'string' ? args.patch : '';
@@ -755,6 +755,27 @@ async function apply_patch(args, cwd, options = {}) {
   } catch (err) {
     return `Error: ${err?.message || String(err)}`;
   }
+  // Write-root gate: a patch may only touch paths inside a DECLARED root —
+  // the session directory by default, or `root`/`base_path` when the caller
+  // names one. Anything outside is refused before a single byte is written, so
+  // a mis-scoped working directory can never silently rewrite another tree.
+  // Editing outside stays possible, but only as a deliberate act: name the
+  // root that contains those targets in the same call.
+  const writeRoot = resolveBasePath(cwd, args?.root ?? args?.base_path ?? null);
+  const outsideTargets = [];
+  for (const rel of patchTargetPaths(patchStr, basePath)) {
+    const abs = isAbsolute(rel) ? pathResolve(rel) : pathResolve(basePath, rel);
+    if (isResolvedPathOutsideBase(abs, writeRoot)) outsideTargets.push(normalizeOutputPath(abs));
+  }
+  if (outsideTargets.length > 0) {
+    const shown = [...new Set(outsideTargets)];
+    const head = shown.slice(0, 3).join(', ');
+    const more = shown.length > 3 ? ` (+${shown.length - 3} more)` : '';
+    throw new Error(
+      `apply_patch: ${shown.length} target(s) fall outside the write root ${normalizeOutputPath(writeRoot)}: ${head}${more}. `
+      + 'Check the paths first; if they are intended, re-issue the same patch with root set to the directory that contains them.',
+    );
+  }
   const rejectPartial = args?.reject_partial !== false;
   const dryRun = args?.dry_run === true;
   const fuzzy = args?.fuzzy !== false;
@@ -1051,6 +1072,13 @@ function patchTargetPaths(patchStr, basePath) {
     const rel = m[1].trim();
     if (rel) out.push(rel);
   }
+  // A rename WRITES its destination, so the destination is a target too — the
+  // write-root gate and the replay snapshot both need it.
+  const mre = /^\*\*\* Move to:\s*(.+)$/gm;
+  while ((m = mre.exec(String(patchStr || '')))) {
+    const rel = m[1].trim();
+    if (rel) out.push(rel);
+  }
   const ure = /^\+\+\+ (?:b\/)?(.+)$/gm;
   while ((m = ure.exec(String(patchStr || '')))) {
     const rel = m[1].trim();

package/src/runtime/agent/orchestrator/tools/patch/parsing.mjs

@@ -283,6 +283,15 @@ export function parseV4APatch(patchStr) {
     if (rawLine.startsWith('@@')) {
       const anchor = normaliseV4AAnchor(rawLine.slice(2));
       if (currentHunk && currentHunk.lines.length > 0) finishHunk();
+      // Consecutive `@@` lines narrow ONE hunk's position (`@@ class Foo`
+      // then `@@   def bar`): append to the open hunk's anchor chain instead
+      // of replacing the hunk, which dropped every anchor but the last and
+      // let the edit resolve against the wrong occurrence.
+      if (currentHunk && currentHunk.lines.length === 0) {
+        if (anchor) currentHunk.anchors.push(anchor);
+        pendingAnchors = [];
+        continue;
+      }
       pendingAnchors.push(anchor);
       currentHunk = { anchors: pendingAnchors.slice(), lines: [] };
       pendingAnchors = [];
@@ -374,6 +383,13 @@ function parseUnifiedAsV4APatch(patchStr, { label, resolveAnchor }) {
     if (rawLine.startsWith('@@')) {
       const anchor = resolveAnchor(rawLine);
       if (currentHunk && currentHunk.lines.length > 0) finishHunk();
+      // Anchor chain (see the V4A parser above): consecutive `@@` lines refine
+      // one hunk's position and must all be kept.
+      if (currentHunk && currentHunk.lines.length === 0) {
+        if (anchor) currentHunk.anchors.push(anchor);
+        pendingAnchors = [];
+        continue;
+      }
       pendingAnchors.push(anchor);
       currentHunk = { anchors: pendingAnchors.slice(), lines: [] };
       pendingAnchors = [];