mixdog 0.9.95 → 0.9.96

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -5,13 +5,19 @@
 // pass), and unrecoverable errors throw. Behavior identical to the inline
 // try/catch it replaced.
 import { appendAgentTrace } from '../agent-trace.mjs';
-import { classifyError, isContextOverflowError } from '../providers/retry-classifier.mjs';
+import {
+    classifyError,
+    isContextOverflowError,
+    isNonTerminalStreamClose,
+    jitterDelayMs,
+} from '../providers/retry-classifier.mjs';
 import { setTimeout as sleepMs } from 'timers/promises';
 import { readStreamOutcome } from '../providers/lib/stream-outcome.mjs';
 import { resolveWorkerCompactPolicy } from './loop/compact-policy.mjs';
 import { agentContextOverflowError } from './loop/context-overflow.mjs';
 import { estimateMessagesTokensSafe } from './loop/compact-debug.mjs';
 import { isOutputLimitStopReason } from './loop/termination.mjs';
+import { isVisibleStreamProgress } from '../../../shared/stream-progress.mjs';
 
 function normalizedIncompleteUsage(raw) {
     if (!raw || typeof raw !== 'object') return undefined;
@@ -45,9 +51,35 @@ function normalizedIncompleteUsage(raw) {
 // the identical request is side-effect-free, so wait out the blip and retry
 // the send at the loop level. Two attempts, 5s/15s — combined with the
 // provider envelope this covers ~50s outages before failing honestly.
-const TRANSPORT_RETRY_BACKOFF_MS = Object.freeze([5_000, 15_000]);
+// Env-overridable (comma-separated ms) so tests can drive the ladder without
+// real waits and an operator can widen the window for a flaky uplink; the
+// LENGTH of the list is the retry budget, exactly like codex's
+// stream_max_retries + backoff table.
+const TRANSPORT_RETRY_BACKOFF_MS = Object.freeze((() => {
+    const raw = process.env.MIXDOG_TRANSPORT_RETRY_BACKOFF_MS;
+    if (typeof raw === 'string' && raw.trim()) {
+        const parsed = raw.split(',')
+            .map((value) => Number(value.trim()))
+            .filter((value) => Number.isFinite(value) && value >= 0);
+        if (parsed.length) return parsed;
+    }
+    // Three steps (~50s of outage) instead of two: the provider envelope
+    // already covers short blips, so this ladder exists for the long ones.
+    // codex allows 5 stream reconnects and cc 10 request retries.
+    return [5_000, 15_000, 30_000];
+})());
 export const TRANSPORT_RETRY_MAX = TRANSPORT_RETRY_BACKOFF_MS.length;
 
+// codex jitters every backoff by 0.9–1.1 so parallel workers that lose the
+// same uplink do not resume in lockstep; our provider layers already jitter
+// (10% WS / 20% shared), this brings the loop ladder in line.
+const TRANSPORT_RETRY_JITTER_RATIO = 0.1;
+
+function transportRetryWaitMs(attemptIndex) {
+    const base = TRANSPORT_RETRY_BACKOFF_MS[attemptIndex];
+    return jitterDelayMs(base, TRANSPORT_RETRY_JITTER_RATIO);
+}
+
 export async function sendWithRecovery(ctx) {
     const {
         provider, messages, model, sendTools, tools, opts,
@@ -56,7 +88,8 @@ export async function sendWithRecovery(ctx) {
     } = ctx;
     let response;
     // Bench-only turn timing (MIXDOG_TURN_TIMING=1): one stderr line per
-    // provider request — TTFT (first stream delta) and total stream time.
+    // provider request — TTFT (first visible model progress) and total stream
+    // time. Transport/header and response-created acknowledgements do not count.
     // Inert unless the env flag is set; used to profile harness vs model
     // latency in Terminal-Bench runs.
     const turnT0 = process.env.MIXDOG_TURN_TIMING === '1' ? Date.now() : 0;
@@ -67,7 +100,7 @@ export async function sendWithRecovery(ctx) {
         timedOpts = {
             ...(opts || {}),
             onStreamDelta: (kind) => {
-                if (!turnFirstDelta) turnFirstDelta = Date.now();
+                if (!turnFirstDelta && isVisibleStreamProgress(kind)) turnFirstDelta = Date.now();
                 if (prevDelta) prevDelta(kind);
             },
         };
@@ -92,6 +125,22 @@ export async function sendWithRecovery(ctx) {
     // overflow-retry branch intentionally clears opts.onToolCall, and that
     // clear must survive the restore.
     const relayWitness = { textEmitted: false, toolCallsDispatched: 0 };
+    // Caller-visible reconnect progress for LOOP-level replays, mirroring the
+    // transports' own emitReconnectProgress (openai-oauth-ws). Without it the
+    // 5s/15s wait rendered as a frozen turn with no explanation, while codex
+    // surfaces "Reconnecting... n/max" through notify_stream_error and cc
+    // yields a SystemAPIErrorMessage for the same situation.
+    const emitLoopReconnectProgress = (attempt, waitMs, classifier) => {
+        try {
+            opts?.onStageChange?.('reconnecting', {
+                attempt,
+                max: TRANSPORT_RETRY_MAX,
+                classifier: classifier || null,
+                waitMs,
+                message: `Reconnecting... ${attempt}/${TRANSPORT_RETRY_MAX}`,
+            });
+        } catch { /* progress reporting must never break recovery */ }
+    };
     const prevOnTextDelta = typeof opts?.onTextDelta === 'function' ? opts.onTextDelta : null;
     const prevOnToolCall = typeof opts?.onToolCall === 'function' ? opts.onToolCall : null;
     const witnessedOnTextDelta = prevOnTextDelta
@@ -116,7 +165,15 @@ export async function sendWithRecovery(ctx) {
     }
     try {
         try {
-            response = await provider.send(messages, model, sendTools.length ? sendTools : undefined, timedOpts);
+            const admittedOpts = timedOpts?.admissionOwner
+                ? timedOpts
+                : { ...(timedOpts || {}), admissionOwner: sessionId };
+            response = await provider.send(
+                messages,
+                model,
+                sendTools.length ? sendTools : undefined,
+                admittedOpts,
+            );
             logTurnTiming('ok');
         } catch (sendErr) {
             logTurnTiming(`err:${sendErr?.code || sendErr?.name || 'unknown'}`);
@@ -220,7 +277,7 @@ export async function sendWithRecovery(ctx) {
                     transportRetriesUsed < TRANSPORT_RETRY_MAX
                     && await retractExposedTextForReplay()
                 ) {
-                    const waitMs = TRANSPORT_RETRY_BACKOFF_MS[transportRetriesUsed];
+                    const waitMs = transportRetryWaitMs(transportRetriesUsed);
                     try {
                         process.stderr.write(
                             `[loop] exposed-text stall retracted (sess=${sessionId || 'unknown'} `
@@ -238,6 +295,11 @@ export async function sendWithRecovery(ctx) {
                             partialContentLen: sendErr.partialContent.length,
                         });
                     } catch { /* best-effort */ }
+                    emitLoopReconnectProgress(
+                        transportRetriesUsed + 1,
+                        waitMs,
+                        outcome.stallObserved ? 'stream_stalled' : 'stream_closed',
+                    );
                     await sleepMs(waitMs, undefined, signal ? { signal } : undefined);
                     return { action: 'retry_transport' };
                 }
@@ -332,12 +394,23 @@ export async function sendWithRecovery(ctx) {
                 && (
                     (outcome.replaySafe === true && classifyError(sendErr) === 'transient')
                     || (
-                        (classifyError(sendErr) === 'transient' || outcome.stallObserved === true)
+                        // classifyError reports 'permanent' the moment anything
+                        // was exposed, so an exposed disconnect could never
+                        // reach the retraction path: name the transport
+                        // symptoms directly (stall OR non-terminal close).
+                        (classifyError(sendErr) === 'transient'
+                            || outcome.stallObserved === true
+                            // Same inversion for the truncated-stream class
+                            // (anthropic message_start-without-message_stop,
+                            // gemini/compat EOF): classifyError calls it
+                            // 'transient' only while nothing was exposed.
+                            || outcome.truncatedStream === true
+                            || isNonTerminalStreamClose(sendErr))
                         && await retractExposedTextForReplay()
                     )
                 )
             ) {
-                const waitMs = TRANSPORT_RETRY_BACKOFF_MS[transportRetriesUsed];
+                const waitMs = transportRetryWaitMs(transportRetriesUsed);
                 try {
                     process.stderr.write(
                         `[loop] transient send failure with no observed output (sess=${sessionId || 'unknown'} `
@@ -356,6 +429,11 @@ export async function sendWithRecovery(ctx) {
                         status: sendErr?.status ?? null,
                     });
                 } catch { /* best-effort */ }
+                emitLoopReconnectProgress(
+                    transportRetriesUsed + 1,
+                    waitMs,
+                    sendErr?.retryClassifier || sendErr?.midstreamClassifier || sendErr?.code || null,
+                );
                 await sleepMs(waitMs, undefined, signal ? { signal } : undefined);
                 return { action: 'retry_transport' };
             } else

package/src/runtime/agent/orchestrator/session/store-summary-reader.mjs

@@ -511,6 +511,18 @@ export function listStoredSessionSummaries(options = {}) {
     return options.rebuildIfMissing === false ? [] : (scan() ?? indexRows ?? []);
 }
 
+/** Exact, fail-closed existence check for a durable session address.
+ * Summary indexes and desktop metadata are presentation caches; neither may
+ * make a missing sessions/<id>.json record addressable again. */
+export function storedSessionExists(id) {
+    const sessionId = String(id || '').trim();
+    if (!/^[A-Za-z0-9_-]+$/.test(sessionId)) return false;
+    const read = readTextFile(join(dataDir(), 'sessions', `${sessionId}.json`));
+    if (read.state !== PROBE_PRESENT) return false;
+    const record = readTopLevelLifecycleRecord(read.text);
+    return !isLifecycleUnreadable(record) && record.id === sessionId;
+}
+
 /** Read exactly one persisted session for a visible desktop pane. This never
  * enumerates siblings. Normal reads stay independent of runtime ownership;
  * interrupted turns conditionally use the same durable reconnect recovery as

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -24,7 +24,7 @@ import {
 import { isInvalidToolArgsMarker, formatInvalidToolArgsResult } from '../providers/openai-compat-stream.mjs';
 import {
     _stripMcpPrefix, _isReadTool, _isMutationTool, _isScopedCacheableTool,
-    _isShellTool, _isOrderedGateSkippable, _intraTurnSig,
+    _isShellTool, _intraTurnSig,
 } from './loop/tool-classify.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
@@ -103,12 +103,6 @@ export async function processToolBatch(ctx) {
             if (message?.toolCallId) _batchToolResultByCallId.set(message.toolCallId, message);
             else _batchToolResultsWithoutId.push(message);
         };
-        // Ordered-mutation batch gate. Each apply_patch is an eager-dispatch
-        // barrier: side effects overlap within the current segment, but no
-        // later segment starts before the loop crosses the patch in model
-        // order. A failed patch prevents every unstarted later side effect;
-        // known read-only calls may still complete for diagnostics.
-        let _orderedMutationFailed = null;
         for (let callIndex = 0; callIndex < calls.length; callIndex += 1) {
             const call = calls[callIndex];
             if (isBuiltinTool(call.name)) {
@@ -202,22 +196,6 @@ export async function processToolBatch(ctx) {
                     continue;
                 }
             }
-            // Ordered-mutation skip: an earlier apply_patch in THIS batch failed,
-            // so this later side-effect call is skipped rather than executed.
-            // Restore a later patch's full body first so it can be re-issued.
-            // `skipped` is deliberate: the call never started, so it is neither
-            // a tool failure nor a cancellation. The earlier patch remains the
-            // structural failure that drives retry/stop-hook behavior.
-            if (_orderedMutationFailed && _isOrderedGateSkippable(call.name) && !pending.has(call.id)) {
-                if (call?.id) restoreToolCallBodyForId(assistantTurnMsg, calls, call.id);
-                _stageToolResultMessage({
-                    role: 'tool',
-                    content: `[prerequisite-failed] an earlier apply_patch in this same tool batch (call index ${_orderedMutationFailed.index + 1}) failed, so this later \`${call.name}\` was skipped without starting. Re-issue it after resolving the patch failure.`,
-                    toolCallId: call.id,
-                    toolKind: 'skipped',
-                });
-                continue;
-            }
             if (sessionId) markSessionToolCall(sessionId, call.name, resolveToolSelfDeadlineMs(call.name, call.arguments));
             let result;
             let toolStartedAt;
@@ -279,8 +257,8 @@ export async function processToolBatch(ctx) {
                     _executeOk = true;
                 } else {
                 // Fallback for providers that don't stream tool calls early:
-                // start the whole remaining batch in parallel (full-parallel
-                // policy; only apply_patch stays in this serial body).
+                // start the whole remaining batch in parallel, including
+                // apply_patch and shell.
                 if (isParallelDispatchable(call.name)) {
                     startEagerRun(calls, callIndex, _duplicateCallIds);
                 }
@@ -512,14 +490,6 @@ export async function processToolBatch(ctx) {
             }
             if (_isMutationTool(call.name)) {
                 epoch.mutation += 1;
-                // Record the first failed ordered mutation in this batch so any
-                // later side effect is skipped by the gate at the top of the
-                // loop. Keyed on exec outcome (not post-processing): a mutation
-                // whose write succeeded but post-processing threw still landed
-                // on disk, so it must NOT block subsequent ordered patches.
-                if ((!_executeOk || _resultKind === 'error') && !_orderedMutationFailed) {
-                    _orderedMutationFailed = { index: callIndex, callId: call.id, name: call.name };
-                }
             }
             // Bash always clears scoped cache UNCONDITIONALLY — a mutating bash
             // that throws or fails partway can still leave stale find_symbol / grep entries.

package/src/runtime/agent/orchestrator/session/tool-result-offload.mjs

@@ -52,11 +52,10 @@ function maybeSweepStaleOffloadDirs() {
     void sweepStaleOffloadDirs();
 }
 
-// Per-tool persistence limits mirror reference per-tool maxResultSizeChars
-// rather than a single global value: Grep persists at 20k (CC GrepTool), Glob
-// and list/find_* at the 50k system default (CC DEFAULT_MAX_RESULT_SIZE_CHARS;
-// tighter than CC Glob's 100k by design), and shell/bash_session/task at 30k
-// (CC BASH_MAX_OUTPUT_LENGTH default). Read/head/tail/diff stay inline
+// Per-tool persistence limits are per-tool maxResultSizeChars values rather
+// than a single global value: grep persists at 20k, glob and list/find_* at
+// the 50k system default (deliberately tighter than the common 100k), and
+// shell/bash_session/task at 30k. Read/head/tail/diff stay inline
 // (Infinity) — they are self-bound by FileRead semantics and the upstream
 // READ_MAX_SIZE_BYTES cap, so persisting to a sidecar to be re-read would be
 // circular. These values keep context-rich IO tools from turning into "read

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -3,7 +3,7 @@ import { getHiddenAgent } from './internal-agents.mjs';
 const SECOND_MS = 1000;
 const MIN_PROVIDER_TIMEOUT_MS = 30_000;
 
-const STALL_TICK_MS = 15_000;
+export const STALL_TICK_MS = 15_000;
 const DEFAULT_STALL_WARN_S = 300;
 const DEFAULT_STALL_ABORT_S = 600;
 // First-byte (no-stream-delta) abort for the agent stall watchdog. A wedged

package/src/runtime/agent/orchestrator/tools/bash-session.mjs

@@ -65,7 +65,7 @@ const MAX_TIMEOUT_MS = Math.max(_envMaxTimeout > 0 ? _envMaxTimeout : 600_000, D
 // JS setTimeout / PS WaitForExit(ms) are 32-bit: a delay above 2^31-1 wraps and
 // fires immediately. Hard ceiling (~24.8 days) for an uncapped explicit timeout.
 const TIMER_MAX_MS = 2_147_483_647;
-const IDLE_TIMEOUT_MS = 5 * 60_000;
+const IDLE_TIMEOUT_MS = 2 * 60_000;
 const MAX_SESSIONS = 10;
 const STDERR_DRAIN_MS = 25;
 const STDERR_DRAIN_MAX_MS = 250;
@@ -364,7 +364,6 @@ function _spawnSession(id, initialCwd = process.cwd(), resourceLease = null) {
         childPid: proc.pid,
         childGroupPid: proc.pid,
         label: 'bash-session',
-        protectHostMemory: true,
     });
     proc.stdout.setEncoding('utf-8');
     proc.stderr.setEncoding('utf-8');
@@ -446,6 +445,7 @@ async function _getOrCreate(sessionId, initialCwd = process.cwd(), opts = {}) {
             signal: opts.signal || null,
             label: `persistent:${id}`,
             dependency: 'detached',
+            ownerKey: opts.sessionId || id,
         });
         try {
             entry = _sessions.get(id);

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -849,7 +849,40 @@ const GUARDS = {
 // key instead of failing the call on a field the caller never set.
 function dropUndefinedArgs(args) {
     for (const key of Object.keys(args)) {
-        if (args[key] === undefined) delete args[key];
+        // `null` gets the same treatment: it is the only way JSON can express
+        // "this optional field was not set", and failing the whole call on it
+        // was measured as a recurring, fully recoverable tool error.
+        if (args[key] === undefined || args[key] === null) delete args[key];
+    }
+}
+
+// string | string[] arguments arrive nested ([["a","b"]] from a batching
+// wrapper), padded with null/empty entries, or empty. The intent is
+// unambiguous, so flatten one level, drop the blanks, and remove a key that
+// ends up empty (the tool then uses its default scope) instead of rejecting
+// the call.
+const STRING_LIST_ARG_KEYS = [
+    'path', 'paths', 'root', 'file', 'files',
+    'pattern', 'patterns', 'query', 'regex', 'needle',
+    'glob', 'file_pattern', 'include', 'type', 'symbols',
+];
+function normalizeStringListArgs(args) {
+    for (const key of STRING_LIST_ARG_KEYS) {
+        if (!hasOwn(args, key) || !Array.isArray(args[key])) continue;
+        const source = args[key];
+        // Flatten ONE nesting level and drop blank entries; every other entry
+        // type is left untouched so the per-tool guards still see (and coerce
+        // or reject) it — `read`'s {path,offset,limit}[] regions must survive
+        // this pass verbatim.
+        const flat = [];
+        for (const entry of source.flat(1)) {
+            if (entry === null || entry === undefined) continue;
+            if (typeof entry === 'string' && entry.trim().length === 0) continue;
+            flat.push(entry);
+        }
+        if (flat.length === source.length && flat.every((entry, idx) => entry === source[idx])) continue;
+        if (flat.length === 0) delete args[key];
+        else args[key] = flat;
     }
 }
 
@@ -863,6 +896,7 @@ export function validateBuiltinArgs(toolName, args) {
         return `Error: ${toolName} arguments must be an object (got ${describeType(args)})`;
     }
     dropUndefinedArgs(args);
+    normalizeStringListArgs(args);
     if (toolName === 'grep') applyGrepContextLeadPolicy(args);
     try {
         return guard(args) || null;

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -1,4 +1,9 @@
 import { getAbortSignalForSession } from '../../session/abort-lookup.mjs';
+import { unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join as pathJoin } from 'node:path';
+import { isLegitimateShellExit } from '../../session/result-classification.mjs';
+import { makeToolEnvelope } from '../../session/tool-envelope.mjs';
 import { acquireShellLeaseBounded, execShellCommand, stripAnsi } from '../shell-command.mjs';
 import { wrapCommandWithSnapshot } from '../shell-snapshot.mjs';
 import { getDestructiveCommandWarning } from '../destructive-warning.mjs';
@@ -27,7 +32,9 @@ import {
     detectLongForegroundReason,
     extractShellApplyPatchInvocation,
     foregroundLongCommandHint,
+    hasPowerShellOnlySyntax,
     isAutobackgroundingAllowed,
+    planInlineScriptHoist,
     preflightPowerShellHygiene,
     shellSplitSegments,
     shellSplitPipelineSegments,
@@ -89,10 +96,12 @@ export function _trackedDriftNoteAfter(_scope, _pre) {
 
 // Search-style commands and `git diff --exit-code` use exit 1 as a SIGNAL
 // (no match / has diff), not a failure. Benign ONLY when exitCode===1, no
-// signal, stderr blank, AND the command is a SINGLE pipeline (no ;/&&/||, so
-// exit 1's origin is unambiguous — a mixed chain stays Error). Quote/comment
-// aware via the shared shell tokenizers, so quoted/commented `;` `|` `grep`
-// can never masquerade as a connector/command and hide a real failure.
+// signal, stderr blank, AND the exit status provably comes from a search-style
+// stage: the LAST segment of a `;`/`&&` chain (its status IS the chain's) whose
+// last pipeline stage is a search head. `||` chains stay ambiguous (either
+// branch can supply the status) and stay Error. Quote/comment aware via the
+// shared shell tokenizers, so quoted/commented `;` `|` `grep` can never
+// masquerade as a connector/command and hide a real failure.
 const _SEARCH_HEADS = new Set(['select-string', 'sls', 'grep', 'egrep', 'fgrep', 'findstr']);
 const _GIT_GLOBAL_VALUE_OPTS = new Set(['-c', '-C', '--git-dir', '--work-tree', '--namespace', '--exec-path', '--config-env']);
 // Command/process/subshell substitution or a backslash/backtick-escaped pipe
@@ -120,9 +129,11 @@ export function _isBenignSearchExitOne(command, exitCode, signal, stderr) {
     const text = _stripShellComment(String(command || ''));
     if (_AMBIGUOUS_SYNTAX.test(text)) return false; // subshell/subst/escaped pipe → ambiguous
     const segments = shellSplitSegments(text);
-    if (segments.length !== 1) return false; // ;/&&/|| chain → ambiguous, stay Error
-    const stages = shellSplitPipelineSegments(segments[0]);
-    const last = stages[stages.length - 1] || segments[0];
+    if (segments.length === 0) return false;
+    if (segments.length > 1 && /\|\|/.test(text)) return false; // || → which branch exited 1?
+    const lastSegment = segments[segments.length - 1];
+    const stages = shellSplitPipelineSegments(lastSegment);
+    const last = stages[stages.length - 1] || lastSegment;
     const raw = shellTokenize(last);
     if (!raw) return false; // unbalanced quotes
     const tokens = stripShellProbeWrappers(raw);
@@ -208,6 +219,14 @@ export function formatShellToolFailure(message) {
     return `Error: [shell-tool-failed] ${text}`;
 }
 
+// A legitimate non-zero exit keeps its `[exit code: N]` marker but must not be
+// CLASSIFIED as a failure downstream — the marker alone would read as an error
+// to classifyResultKind. The explicit-success envelope is the documented
+// channel for output that looks like an error and is not one.
+function _finalizeShellResult(legitExit, text) {
+    return legitExit ? makeToolEnvelope(text, [], { explicitSuccess: true }) : text;
+}
+
 export function _shellFailureStatus(result, timeout) {
     // Prefer the signal reported by the process. `killed` is only a fallback
     // for platforms (notably taskkill on Windows) that close without one.
@@ -324,7 +343,7 @@ export async function executeBashTool(args, workDir, options = {}) {
     // null spec means it is genuinely not installed — surface a clear error with
     // NO silent fallback to the other shell.
     const shellKind = args.shell === 'bash' || args.shell === 'powershell' ? args.shell : 'default';
-    const resolvedSpec = resolveShellFor(shellKind);
+    let resolvedSpec = resolveShellFor(shellKind);
     if (!resolvedSpec) {
         if (shellKind === 'bash') {
             return formatShellToolFailure("Git Bash not found — install Git for Windows or omit shell:'bash'.");
@@ -351,13 +370,52 @@ export async function executeBashTool(args, workDir, options = {}) {
         shellType: resolvedSpec.shellType,
         shellName: resolvedSpec.shell,
     });
-    if (psHygiene.block) return formatShellToolFailure(psHygiene.block);
-    command = psHygiene.command;
+    let shellRescueNote = '';
+    if (psHygiene.block) {
+        // Auto-rescue: the block fired ONLY because the command is written in
+        // bash (unix filter heads, `&&`) and it carries no PowerShell-only
+        // construct — running it in Git Bash is exactly what the caller meant,
+        // byte-for-byte. A mixed command ($env:, cmdlets, `2>$null`) or a
+        // PowerShell-specific violation stays a hard block, and an explicit
+        // shell:'powershell' is never overridden.
+        const bashSpec = psHygiene.bashOnly
+            && shellKind === 'default'
+            && !hasPowerShellOnlySyntax(psHygiene.original ?? command)
+            ? resolveShellFor('bash')
+            : null;
+        if (!bashSpec) return formatShellToolFailure(psHygiene.block);
+        // The MSYS rewrite targets PowerShell; bash gets the original text.
+        command = psHygiene.original ?? command;
+        resolvedSpec = bashSpec;
+        shellRescueNote = "note: bash-only syntax on a PowerShell host — ran it in Git Bash (pass shell:'bash' to make that explicit).";
+    } else {
+        command = psHygiene.command;
+    }
 
     const _execPolicyBlock = checkExecPolicyMessage(command);
     if (_execPolicyBlock) {
         return formatShellToolFailure(_execPolicyBlock);
     }
+    // Inline-script hoisting (sync runs only — a background job would outlive
+    // the temp file). The body is written verbatim and the invocation becomes a
+    // file run, so the host shell never has to carry the script through its
+    // quoting layer. planInlineScriptHoist refuses every case where file
+    // semantics would differ, so this is a transport change only.
+    let _inlineHoistPath = null;
+    if (!runInBackground && args.persistent !== true) {
+        const hoist = planInlineScriptHoist(command);
+        if (hoist) {
+            try {
+                const file = pathJoin(
+                    tmpdir(),
+                    `mixdog-inline-${process.pid}-${Date.now().toString(36)}${hoist.extension}`,
+                );
+                writeFileSync(file, hoist.body, 'utf8');
+                _inlineHoistPath = file;
+                command = hoist.replace(file.replace(/\\/g, '/'));
+            } catch { _inlineHoistPath = null; }
+        }
+    }
 
     // Sleep-chain auto-promotion: a leading `sleep N && …` / `Start-Sleep N; …`
     // used to be DENIED preflight (CC detectBlockedSleepPattern parity).
@@ -456,11 +514,30 @@ export async function executeBashTool(args, workDir, options = {}) {
     // the value stays a soft hint clamped below `timeout` so the hard ceiling
     // remains a separate, later bound. Never applies to run_in_background
     // (already detached) or persistent sessions (handled far above).
-    const _autoBgEnvMs = Number(process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS);
-    const DEFAULT_AUTO_BACKGROUND_MS = Number.isFinite(_autoBgEnvMs) && _autoBgEnvMs > 0
+    // Promotion threshold (Codex `yield_time_ms` / CC startBackgrounding
+    // analogue). Previously 0 = OFF, so every long command held the turn open
+    // to the full foreground timeout and, at the cap, produced a wasted wait.
+    // 30 s keeps ordinary builds/tests inline (measured shell p90 ~ 18 s) while
+    // detaching the long tail (measured: 111 calls/day above 30 s, 30 of them
+    // burning the entire 120 s cap) as a tracked job with partial output.
+    // MIXDOG_SHELL_AUTO_BACKGROUND_MS overrides; an explicit 0 disables.
+    const _autoBgEnvRaw = process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS;
+    const _autoBgEnvMs = Number(_autoBgEnvRaw);
+    const DEFAULT_AUTO_BACKGROUND_MS = (_autoBgEnvRaw != null && String(_autoBgEnvRaw).trim() !== ''
+      && Number.isFinite(_autoBgEnvMs) && _autoBgEnvMs >= 0)
       ? Math.floor(_autoBgEnvMs)
-      : 0;
-    const autoBackgroundMs = (runInBackground || DEFAULT_AUTO_BACKGROUND_MS <= 0)
+      : 30_000;
+    // Gate on backgroundOnTimeout rather than just `runInBackground`: it already
+    // encodes "promotion is available for this command" (not detached, background
+    // tasks enabled, command shape allows it), so the soft threshold can never
+    // promote something the hard timeout would refuse to.
+    // An EXPLICIT caller timeout is a deliberate "I intend to wait this long"
+    // (a long build/test/install), so the soft threshold never overrides it —
+    // the call stays inline until its own deadline, where backgroundOnTimeout
+    // still promotes instead of killing. Auto-promotion therefore only applies
+    // to the OMITTED-timeout default, which is exactly the case where nobody
+    // declared how long the command should be allowed to hold the turn.
+    const autoBackgroundMs = (!backgroundOnTimeout || hasExplicitTimeout || DEFAULT_AUTO_BACKGROUND_MS <= 0)
       ? 0
       : Math.min(DEFAULT_AUTO_BACKGROUND_MS, timeout);
 
@@ -507,6 +584,7 @@ export async function executeBashTool(args, workDir, options = {}) {
                     abortSignal: combinedAsyncAbort.signal,
                     label: String(command).replace(/\s+/g, ' ').slice(0, 120),
                     dependency: 'detached',
+                    ownerKey: options?.callerSessionId || options?.sessionId || null,
                 });
                 if (combinedAsyncAbort.signal?.aborted) {
                     throw combinedAsyncAbort.signal.reason || new Error('shell background task cancelled before spawn');
@@ -704,7 +782,17 @@ export async function executeBashTool(args, workDir, options = {}) {
         const failureStatus = _shellFailureStatus(result, timeout);
         const { signal, exitCode, shellToolFailed } = failureStatus;
         const benignExitOne = _isBenignSearchExitOne(command, exitCode, signal, stderr);
-        const shellRunFailed = !shellToolFailed && (!!signal || (exitCode !== 0 && exitCode !== null && !benignExitOne));
+        // Legitimate non-zero exit: the command printed its result and ended
+        // with 1 without writing a single byte to stderr (probes, reports,
+        // `git diff --exit-code`-shaped checks). It keeps its `[exit code: 1]`
+        // marker so the caller sees the code, but it is NOT framed as a tool
+        // error and NOT classified as a failure — measured as the dominant
+        // shape among non-zero exits.
+        const legitExit = !shellToolFailed
+            && !benignExitOne
+            && isLegitimateShellExit({ exitCode, signal, stdout, stderr });
+        const shellRunFailed = !shellToolFailed
+            && (!!signal || (exitCode !== 0 && exitCode !== null && !benignExitOne && !legitExit));
         const isReallyErrored = shellToolFailed || shellRunFailed;
         // Filter-swallow rescue: the tee file is ALWAYS consumed (deleted)
         // here; its tail is attached only when the run failed with an empty
@@ -729,8 +817,16 @@ export async function executeBashTool(args, workDir, options = {}) {
         const statusDetail = failureStatus.statusDetail;
         const statusMarker = shellToolFailed
             ? `[shell-tool-failed] ${statusDetail}`
-            : (shellRunFailed ? `[shell-run-failed] ${statusDetail}` : '');
+            : (shellRunFailed ? `[shell-run-failed] ${statusDetail}` : (legitExit ? statusDetail : ''));
         const errorPrefix = isReallyErrored ? 'Error: ' : '';
+        // Three outcomes, three labels: a TOOL error (`[shell-tool-failed]`),
+        // a command that RAN AND FAILED (`Error: [shell-run-failed]`), and a
+        // command that RAN TO COMPLETION and merely ended non-zero. The last
+        // one keeps its exit code but says so in words, so neither the model
+        // nor the failure log treats a finished report as a failure.
+        const completionNote = legitExit
+            ? '\n[completed: the command finished and wrote nothing to stderr; the exit code is its own report, not a tool failure]'
+            : '';
         if (mergeStderr) {
             // Post-exit concatenation. True chunk-level interleaving would
             // require shell-level `2>&1` redirection (bash) or `*>&1`
@@ -740,7 +836,7 @@ export async function executeBashTool(args, workDir, options = {}) {
             // cross-stream interleaving. Acceptable for most diagnostic
             // outputs; flag in shell-command if exact interleaving is required.
             const merged = stdout + stderr;
-            if (statusMarker) return _prependDestructiveWarning(command, errorPrefix + smartMiddleTruncate(`${statusMarker}\n\n${merged || '(no output)'}`) + _rescueNote + _driftNote);
+            if (statusMarker) return _finalizeShellResult(legitExit, _prependDestructiveWarning(command, errorPrefix + smartMiddleTruncate(`${statusMarker}${completionNote}\n\n${merged || '(no output)'}`) + _rescueNote + _driftNote));
             return _prependDestructiveWarning(command, smartMiddleTruncate(merged || '(no output)') + _driftNote);
         }
         const truncatedStdout = smartMiddleTruncate(stdout);
@@ -761,13 +857,17 @@ export async function executeBashTool(args, workDir, options = {}) {
         }
         const warningBlock = [
             wmicRewrite?.note || '',
+            shellRescueNote,
         ].filter(Boolean).join('\n');
         const payload = `${body}${stderrBlock}${spillBlock}${_rescueNote}${_driftNote}`;
-        if (statusMarker) return _prependDestructiveWarning(command, _composeShellFailure(statusMarker, errorPrefix, warningBlock, payload));
+        if (statusMarker) return _finalizeShellResult(legitExit, _prependDestructiveWarning(command, _composeShellFailure(`${statusMarker}${completionNote}`, errorPrefix, warningBlock, payload)));
         return _prependDestructiveWarning(command, warningBlock ? `${warningBlock}\n${payload}` : payload);
     }
     finally {
         combinedBashAbort?.cleanup?.();
+        if (_inlineHoistPath) {
+            try { unlinkSync(_inlineHoistPath); } catch { /* best-effort cleanup */ }
+        }
         if (shellEffects.mutationMode === 'paths') {
             invalidateBuiltinResultCache(shellEffects.paths);
             markCodeGraphDirtyPaths(shellEffects.paths);