mixdog 0.9.95 → 0.9.96

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -5,7 +5,6 @@
 // only (behavior + argument shapes); usage policy lives in rules/shared/01-tool.md.
 import {
     TOOL_ASYNC_EXECUTION_CONTRACT,
-    TOOL_MANUAL_CONTROL_CONTRACT,
     executionModeSchemaDescription,
 } from '../../../../shared/background-tasks.mjs';
 
@@ -28,7 +27,7 @@ function _shellMaxTimeoutMs() {
 // process lifetime, so this is evaluated once at module load.
 const _shellSyntaxCheat =
     process.platform === 'win32'
-        ? ' PowerShell: grep→Select-String, tail→Get-Content -Tail, head→Get-Content -TotalCount, /c/→C:\\, if && is unsupported use ;, $PID is reserved.'
+        ? ' PowerShell: use ; between commands, /c/→C:\\, and note that $PID is reserved.'
         : '';
 
 export const BUILTIN_TOOLS = [
@@ -36,7 +35,7 @@ export const BUILTIN_TOOLS = [
         name: 'read',
         title: 'Mixdog Read',
         annotations: { title: 'Mixdog Read', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false },
-        description: 'Read file contents. Batch paths/regions as real arrays: path[] or {path,offset,limit}[] regions in one call. Not for directories.',
+        description: 'Read file contents or line ranges; not directories.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -99,12 +98,12 @@ export const BUILTIN_TOOLS = [
         name: 'task',
         title: 'Background Task Control',
         annotations: { title: 'Background Task Control', readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
-        description: `Control a shell async task_id: actions list/status/read/wait/cancel. ${TOOL_MANUAL_CONTROL_CONTRACT} Not sess_* or agent ids.`,
+        description: 'Control a shell background task_id; not session or agent ids.',
         inputSchema: {
             type: 'object',
             properties: {
                 task_id: { type: 'string', description: 'shell async task_id.' },
-                action: { type: 'string', enum: ['list', 'status', 'read', 'wait', 'cancel'], description: 'Defaults to list, or wait when task_id is set; avoid polling loops.' },
+                action: { type: 'string', enum: ['list', 'status', 'read', 'wait', 'cancel'], description: 'Default list; with task_id, default wait.' },
                 timeout_ms: { type: 'number', description: 'Wait timeout ms.' },
             },
             required: [],
@@ -115,7 +114,7 @@ export const BUILTIN_TOOLS = [
         name: 'grep',
         title: 'Mixdog Grep',
         annotations: { title: 'Mixdog Grep', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Content search by literal or regex over file/dir scopes; matches return copy-ready raw source spans.',
+        description: 'Literal/regex search over file/dir scopes; returns source blocks with context.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -156,7 +155,7 @@ export const BUILTIN_TOOLS = [
         name: 'glob',
         title: 'Mixdog Glob',
         annotations: { title: 'Mixdog Glob', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Match exact glob patterns from base directories; batch pattern[]/path[].',
+        description: 'Match glob patterns under base directories.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -185,7 +184,7 @@ export const BUILTIN_TOOLS = [
         name: 'find',
         title: 'Mixdog Find Files',
         annotations: { title: 'Mixdog Find Files', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'Fuzzy lookup for partial paths/names (dot dirs included). Returns matching paths; not file contents.',
+        description: 'Fuzzy partial path/name lookup; returns paths only.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -207,7 +206,7 @@ export const BUILTIN_TOOLS = [
         name: 'list',
         title: 'Mixdog List Directory',
         annotations: { title: 'Mixdog List Directory', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: true },
-        description: 'List directory entries (path + type); batch independent dirs as path[].',
+        description: 'List directory entries (path + type).',
         inputSchema: {
             type: 'object',
             properties: {

package/src/runtime/agent/orchestrator/tools/builtin/cache-layers.mjs

@@ -238,7 +238,7 @@ export function getCachedReadOnlyStat(fullPath, loader = statSync, now = Date.no
     return stat;
 }
 
-export async function statPathsForMtime(paths, workDir, concurrency = 64, opts = {}) {
+export async function statPathsForMtime(paths, workDir, concurrency = Infinity, opts = {}) {
     const items = Array.isArray(paths) ? paths : [];
     const out = new Array(items.length);
     const now = Date.now();
@@ -302,7 +302,7 @@ export async function statPathsForMtime(paths, workDir, concurrency = 64, opts =
 // lstat variant — does NOT follow symlinks. Use for directory-listing
 // surfaces where a symlink to a 200 GB file should report as a symlink,
 // not as the target's size/mtime.
-export async function lstatPathsForMtime(paths, workDir, concurrency = 64, opts = {}) {
+export async function lstatPathsForMtime(paths, workDir, concurrency = Infinity, opts = {}) {
     const items = Array.isArray(paths) ? paths : [];
     const out = new Array(items.length);
     const inflight = new Map();

package/src/runtime/agent/orchestrator/tools/builtin/device-paths.mjs

@@ -19,8 +19,8 @@ export function isBlockedDevicePath(p) {
 
 // R1: UNC / SMB share paths (\\server\share or //server/share). Reading these
 // causes Windows to auto-authenticate to the remote host, leaking the NTLM
-// hash of the current user to any attacker-controlled SMB target. CC parity:
-// FileReadTool.ts:461 rejects the same prefix before stat. Accepts both
+// hash of the current user to any attacker-controlled SMB target. The prefix
+// is rejected before stat. Accepts both
 // backslash and forward-slash leaders so a normalize that picked either form
 // is caught.
 export function isUncPath(p) {

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-context-expander.mjs

@@ -17,7 +17,6 @@ import {
 } from './search-input-helpers.mjs';
 
 export const GREP_CONTEXT_CHAR_BUDGET_DEFAULT = 10_000;
-const GREP_CONTEXT_READ_CONCURRENCY = 4;
 const GREP_FOCUSED_CONTEXT_RADIUS = 12;
 const GREP_FOCUSED_RAW_BLOCKS = 3;
 // Anchors must stay usable as evidence without a follow-up read: keep the
@@ -229,21 +228,13 @@ async function readAnchorSources(anchors, radius, signal) {
         groups.get(anchor.absolutePath).anchors.push(anchor);
     }
     const entries = [...groups.values()];
-    let next = 0;
-    const worker = async () => {
-        while (next < entries.length) {
-            const entry = entries[next++];
-            try {
-                entry.lines = await readFileWindows(entry, radius, signal);
-            } catch (err) {
-                entry.error = err;
-            }
+    await Promise.all(entries.map(async (entry) => {
+        try {
+            entry.lines = await readFileWindows(entry, radius, signal);
+        } catch (err) {
+            entry.error = err;
         }
-    };
-    await Promise.all(Array.from(
-        { length: Math.min(GREP_CONTEXT_READ_CONCURRENCY, entries.length) },
-        () => worker(),
-    ));
+    }));
     return groups;
 }
 

package/src/runtime/agent/orchestrator/tools/builtin/list-tool.mjs

@@ -88,16 +88,12 @@ export async function executeListTool(args, workDir, options = {}) {
     args.path = coerceReadFamilyPathArg(args.path, workDir);
     if (Array.isArray(args.path)) {
         const list = [...new Set(args.path.map((p) => (typeof p === 'string' ? p.trim() : '')).filter((p) => p.length > 0))];
-        const capped = list.length > 10;
-        const targets = capped ? list.slice(0, 10) : list;
+        const targets = list;
         if (targets.length > 1) {
-            // Bounded parallel fan-out: each target is an independent listing
+            // Full parallel fan-out: each target is an independent listing
             // (own guard/cache/reachability), so run them concurrently instead
             // of serially. Bodies land in a fixed-index array so the emitted
-            // section order still matches the caller's `path[]` order — only the
-            // wall-clock cost changes. Concurrency is capped so a 10-path batch
-            // cannot exhaust the child-spawn / FS-handle budget.
-            const LIST_FANOUT_CONCURRENCY = 4;
+            // section order still matches the caller's `path[]` order.
             // Collapse semantic-duplicate targets: two spellings that resolve to
             // the same directory (e.g. `foo` and `./foo`) are stat'd/walked ONCE.
             // Each caller label keeps its own `# list <p>` section reusing the
@@ -116,24 +112,14 @@ export async function executeListTool(args, workDir, options = {}) {
                 if (!repByKey.has(k)) { repByKey.set(k, targets[i]); uniqueKeys.push(k); }
             }
             const bodyByKey = new Map();
-            let cursor = 0;
-            const runWorker = async () => {
-                for (;;) {
-                    const i = cursor++;
-                    if (i >= uniqueKeys.length) return;
-                    const k = uniqueKeys[i];
-                    try {
-                        bodyByKey.set(k, await executeListTool({ ...args, path: repByKey.get(k) }, workDir, options));
-                    } catch (err) {
-                        bodyByKey.set(k, `Error: ${normalizeErrorMessage(err instanceof Error ? err.message : String(err))}`);
-                    }
+            await Promise.all(uniqueKeys.map(async (k) => {
+                try {
+                    bodyByKey.set(k, await executeListTool({ ...args, path: repByKey.get(k) }, workDir, options));
+                } catch (err) {
+                    bodyByKey.set(k, `Error: ${normalizeErrorMessage(err instanceof Error ? err.message : String(err))}`);
                 }
-            };
-            await Promise.all(
-                Array.from({ length: Math.min(LIST_FANOUT_CONCURRENCY, uniqueKeys.length) }, runWorker),
-            );
+            }));
             const sections = targets.map((p, i) => `# list ${p}\n${bodyByKey.get(keyByIndex[i])}`);
-            if (capped) sections.push(`... [capped at 10 of ${list.length} paths]`);
             return sections.join('\n\n');
         }
         args.path = targets[0];
@@ -582,8 +568,7 @@ async function getTargetedFindEnumeration({
 export async function executeFuzzyFindTool(args, workDir, options = {}) {
     if (Array.isArray(args.query)) {
         const list = [...new Set(args.query.map((q) => (typeof q === 'string' ? q.trim() : '')).filter((q) => q.length > 0))];
-        const capped = list.length > 5;
-        const targets = capped ? list.slice(0, 5) : list;
+        const targets = list;
         if (targets.length > 1) {
             // head_limit is one call-level result budget, not a multiplier per
             // query. Split it deterministically in caller order; if it cannot
@@ -601,7 +586,6 @@ export async function executeFuzzyFindTool(args, workDir, options = {}) {
                     + `retry query=${JSON.stringify(omittedByHeadLimit)}]`,
                 );
             }
-            if (capped) notes.push(`... [capped at 5 of ${list.length} queries]`);
             const sectionHeaders = activeTargets.map((query) => `# find ${query}\n`);
             const separatorBytes = Math.max(0, activeTargets.length + notes.length - 1) * 2;
             const fixedBytes = sectionHeaders.reduce(

package/src/runtime/agent/orchestrator/tools/builtin/read-image.mjs

@@ -6,7 +6,7 @@ import {
   resizeImageBuffer,
 } from './read-image-resize.mjs';
 
-// Image extensions native Read renders as image blocks (FileReadTool.ts).
+// Image extensions that Read renders as image blocks.
 const IMAGE_MIME = {
   '.png': 'image/png',
   '.jpg': 'image/jpeg',

package/src/runtime/agent/orchestrator/tools/builtin/read-single-tool.mjs

@@ -112,7 +112,7 @@ export async function executeSingleReadTool(args, workDir, readStateScope, optio
     // R1: UNC / SMB share reject (\\server\share, //server/share). Reading
     // these on Windows auto-authenticates to the remote host and leaks the
     // NTLM hash of the current user to any attacker-controlled SMB target.
-    // CC parity: FileReadTool.ts:461 rejects the same prefix before stat.
+    // The prefix is rejected before stat.
     // Must run before resolveAgainstCwd so a relative path can't be coerced
     // into a UNC share by the cwd resolution.
     if (typeof isUncPath === 'function' && isUncPath(filePath))
@@ -142,7 +142,7 @@ export async function executeSingleReadTool(args, workDir, readStateScope, optio
         return `Error: cannot read Windows device path (reserved name or raw-device namespace): ${normalizeOutputPath(fullPath)}`;
     if (typeof hasUnsafeWin32Component === 'function' && hasUnsafeWin32Component(fullPath))
         return `Error: cannot read Windows path with trailing dot/space or NTFS ADS suffix (bypasses device guard): ${normalizeOutputPath(fullPath)}`;
-    // Pre-read size cap (Anthropic FileReadTool/limits.ts pattern):
+    // Pre-read size cap:
     // throw a small error response when the file is too big rather
     // than truncating to 25K tokens of content. Throw is decisively
     // more token-efficient (Anthropic #21841 reverted truncation).
@@ -712,7 +712,7 @@ export async function executeSingleReadTool(args, workDir, readStateScope, optio
                 out = appendReadContextAdvisory(out, { filePath, lineCount, bytes: st.size });
             }
         }
-        // CC parity: empty file gets a system-reminder instead of
+        // An empty file gets a system-reminder instead of
         // a bare `1│` line. The reminder makes the empty-state
         // explicit so the agent doesn't assume content was elided.
         if (content.length === 0) {

package/src/runtime/agent/orchestrator/tools/builtin/read-tool.mjs

@@ -24,20 +24,11 @@ function _stripLineCoordForReach(s) {
         .replace(/:\d+(?:-\d+)?(?::.*)?$/, '');
 }
 
-// Batch fan-out cap: array/object read shapes read only the first N entries
-// (the >N slice below truncates the rest with a `_batchCapNote`). The
-// reachability preflight must honour the SAME cap so a path that will be
-// capped away is never stat-probed and can never reject the batch via a guard.
-const READ_BATCH_PATH_CAP = 10;
-
 function _collectReachCandidates(p) {
     const out = [];
     const push = (s) => { if (typeof s === 'string' && s) out.push(s); };
     if (typeof p === 'string') push(p);
-    // Only the first READ_BATCH_PATH_CAP entries survive the fan-out cap, so
-    // preflight only the paths that will actually be read. Capped-away paths
-    // (incl. UNC/device) must NOT be probed or allowed to fail the batch.
-    else if (Array.isArray(p)) for (const e of p.slice(0, READ_BATCH_PATH_CAP)) push((e && typeof e === 'object') ? (e.path ?? e.file_path) : e);
+    else if (Array.isArray(p)) for (const e of p) push((e && typeof e === 'object') ? (e.path ?? e.file_path) : e);
     return out;
 }
 
@@ -181,14 +172,6 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
     // Single turn can touch many files or swap modes without
     // the agent iterating across multiple tool names.
     if (Array.isArray(args.path) && args.path.length > 0 && args.path[0] && typeof args.path[0] === 'object') {
-        // Cap batch fan-out: never error on an oversized array, just
-        // truncate and note it in the final output (mirrors list-tool.mjs
-        // path[] cap pattern).
-        if (args.path.length > 10) {
-            const _origObjLen = args.path.length;
-            args.path = args.path.slice(0, 10);
-            args._batchCapNote = `... [capped at 10 of ${_origObjLen} paths]`;
-        }
         // Per-file batch: each entry carries its own options.
         // Coalesce same-path entries: multiple chunks for the same
         // file are merged into a single wider read (min offset to max
@@ -244,11 +227,6 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
         args.mode = undefined; args.n = undefined; args.offset = undefined; args.limit = undefined; args.full = undefined;
     }
     if (Array.isArray(args.path)) {
-        if (args.path.length > 10) {
-            const _origStrLen = args.path.length;
-            args.path = args.path.slice(0, 10);
-            if (!args._batchCapNote) args._batchCapNote = `... [capped at 10 of ${_origStrLen} paths]`;
-        }
         // Schema is `path: string | string[]` — array entries are
         // strings only. Top-level mode / n / offset / limit / full
         // apply uniformly to every entry in the batch (the only

package/src/runtime/agent/orchestrator/tools/builtin/rg-runner.mjs

@@ -7,7 +7,7 @@ import { createRequire } from 'node:module';
 import os from 'node:os';
 import {
     acquire as acquireChildSpawnSlot,
-    hasSpareCapacity as hasRgSpareCapacity,
+    snapshot as childSpawnSnapshot,
 } from '../../../../shared/child-spawn-gate.mjs';
 
 const execFileAsync = promisify(execFile);
@@ -38,7 +38,7 @@ const execFileAsync = promisify(execFile);
 // This does not queue or limit calls; it only prevents per-process
 // oversubscription. Env override remains available for operator tuning.
 let _rgDefaultThreadCap = null;
-export function _rgThreadCap(_spareCapacity = false) {
+export function _rgThreadCap(activeSearches = 1) {
     const override = Number(process.env.MIXDOG_RG_THREADS);
     if (Number.isFinite(override) && override >= 1) return Math.floor(override);
     if (_rgDefaultThreadCap === null) {
@@ -47,7 +47,12 @@ export function _rgThreadCap(_spareCapacity = false) {
         _rgDefaultThreadCap = cpus || 4;
     }
     const cpus = _rgDefaultThreadCap;
-    return Math.max(2, Math.min(4, Math.ceil(cpus / 4)));
+    const perProcessMax = Math.max(2, Math.min(4, Math.ceil(cpus / 4)));
+    const active = typeof activeSearches === 'boolean'
+        ? 1
+        : Math.max(1, Math.floor(Number(activeSearches) || 1));
+    const aggregateBudget = Math.max(perProcessMax, cpus - 1);
+    return Math.max(1, Math.min(perProcessMax, Math.floor(aggregateBudget / active)));
 }
 
 // Walk rg options once for all thread-argument helpers. Values of these
@@ -94,9 +99,18 @@ function _hasRgThreadArg(argsList) {
 // (`-j`/`--threads`/`-jN`/`--threads=N`, e.g. the EAGAIN `-j 1` retry). Does
 // not mutate; may return the ORIGINAL array unchanged when already
 // thread-pinned (callers must not assume a fresh copy).
-export function _withRgThreads(argsList, spareCapacity = false) {
+export function _withRgThreads(argsList, activeSearches = 1) {
     if (_hasRgThreadArg(argsList)) return argsList;
-    return ['--threads', String(_rgThreadCap(spareCapacity)), ...argsList];
+    return ['--threads', String(_rgThreadCap(activeSearches)), ...argsList];
+}
+
+function activeSearchSpawnCount() {
+    try {
+        const lane = childSpawnSnapshot().lanes.find((entry) => entry.name === 'search');
+        return Math.max(1, Number(lane?.inflight) || 1);
+    } catch {
+        return 1;
+    }
 }
 
 // Build the EAGAIN single-thread retry args. If the caller already pinned a
@@ -409,10 +423,10 @@ function spawnRg(argsList, execOptions) {
     // spawn below, so queue-wait time is excluded from the 20s deadline. No
     // node guardian is started: rg owns its full SIGTERM→grace→force-kill +
     // force-settle teardown, so the 1:1 guardian process was pure overhead.
-    return acquireChildSpawnSlot(gateSignal).then((releaseSlot) => new Promise((resolve, reject) => {
+    return acquireChildSpawnSlot(gateSignal, 'search').then((releaseSlot) => new Promise((resolve, reject) => {
         // Probe after acquisition: this spawn counts toward inflight. The
         // answer is best-effort and only selects the per-process rg cap.
-        const proc = spawn(rgExecutable(), _withRgThreads(argsList, hasRgSpareCapacity()), {
+        const proc = spawn(rgExecutable(), _withRgThreads(argsList, activeSearchSpawnCount()), {
             cwd: execOptions?.cwd,
             env: execOptions?.env || process.env,
             windowsHide: true,
@@ -591,9 +605,9 @@ function spawnRgWindowedLines(argsList, execOptions, opts = {}) {
     // Same gate + thread-cap + no-guardian treatment as spawnRg; queue-wait is
     // excluded from the rg timeout (armed after spawn). releaseSlot is fired
     // once via .finally on every settle path.
-    return acquireChildSpawnSlot(gateSignal).then((releaseSlot) => new Promise((resolve, reject) => {
+    return acquireChildSpawnSlot(gateSignal, 'search').then((releaseSlot) => new Promise((resolve, reject) => {
         // As above, probe only after this spawn has acquired its gate slot.
-        const proc = spawn(rgExecutable(), _withRgThreads(argsList, hasRgSpareCapacity()), {
+        const proc = spawn(rgExecutable(), _withRgThreads(argsList, activeSearchSpawnCount()), {
             cwd: execOptions?.cwd,
             env: execOptions?.env || process.env,
             windowsHide: true,

package/src/runtime/agent/orchestrator/tools/builtin/search-path-diagnostics.mjs

@@ -171,6 +171,13 @@ export async function tryReadFamilyEnoentRedirect({
 
 export function buildNotFoundHint(workDir, missingPath, actionVerb, errCode = 'ENOENT', cache = null) {
     if (!NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return '';
+    // `C:tmpsmp` shape: a Windows path whose separators were eaten by JSON
+    // escaping (`"C:\\tmp\\smp"` written as `"C:\tmp\smp"`). Name the cause —
+    // the sibling/basename hints below can never resolve such a path.
+    const rawMissing = String(missingPath || '');
+    if (/^[A-Za-z]:(?![\\/])[^\\/]/.test(rawMissing.replace(/\\/g, '\\'))) {
+        return ` The path has a drive letter but no separator after it — the backslashes were probably lost in escaping. Re-issue with forward slashes (e.g. "C:/tmp/smp").`;
+    }
     if (resolveUniqueEnoentRedirect(workDir, missingPath, errCode, cache)) return '';
     const elsewhere = cachedFileByBasename(workDir, missingPath, cache);
     if (elsewhere.length) {

package/src/runtime/agent/orchestrator/tools/builtin/search-tool.mjs

@@ -81,7 +81,7 @@ import {
     parseGrepCountLine,
 } from './lib/search-input-helpers.mjs';
 
-// CC parity (GrepTool.ts): a single glob string may pack multiple filters
+// A single glob string may pack multiple filters
 // separated by whitespace or commas, e.g. "*.ts,*.tsx" or "*.ts *.tsx". Split
 // each into its own --glob. Brace patterns ("*.{ts,tsx}") are left intact so
 // their internal commas are not torn apart.
@@ -127,19 +127,16 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
     args = normalizeGrepArgs(args);
     args.path = coerceReadFamilyPathArg(args.path, workDir);
     const callContextCharBudget = _grepContextCharBudget(options);
-    // Fan-out guard: batch multiple string paths with bounded concurrency,
-    // mirroring code_graph files[] batching. Recursive calls pass a single
-    // string path, so recursion bottoms out after one level. Results are
-    // assembled below in input order, regardless of completion order.
+    // Batch multiple string paths concurrently. Recursive calls pass a single
+    // string path, so recursion bottoms out after one level. Results retain
+    // input order even though every path starts immediately.
     if (Array.isArray(args.path)) {
-        const GREP_PATH_CAP = 10;
-        const GREP_PATH_CONCURRENCY = 4;
         const seen = new Set();
         const list = args.path
             .map(p => typeof p === 'string' ? p.trim() : '')
             .filter(p => p && !seen.has(p) && seen.add(p));
         if (list.length > 1) {
-            const capped = list.slice(0, GREP_PATH_CAP);
+            const capped = list;
             // Combined single-spawn path[] fan-out (mirrors the pattern[]
             // combined path below): ONE rg run with every path as a positional
             // operand, then normalized-prefix attribution rebuilds the
@@ -151,7 +148,6 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
             // per-path ENOENT/UNC diagnostics). MIXDOG_GREP_PATH_COMBINED=0
             // disables.
             combinedPaths: if (process.env.MIXDOG_GREP_PATH_COMBINED !== '0'
-                && list.length <= GREP_PATH_CAP
                 && !args.glob
                 && !args.type
                 && args.multiline !== true
@@ -340,38 +336,20 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
             const configuredOutputCap = Number(options?.toolOutputMaxBytes) > 0
                 ? Math.trunc(Number(options.toolOutputMaxBytes))
                 : Math.trunc(Number(process.env.MIXDOG_TOOL_OUTPUT_MAX_BYTES));
-            const bodies = new Array(capped.length);
-            let next = 0;
-            const runWorker = async () => {
-                while (next < capped.length) {
-                    const index = next++;
-                    const p = capped[index];
-                    try {
-                        bodies[index] = await executeGrepTool(
-                            { ...args, path: p },
-                            workDir,
-                            executeChildBuiltinTool,
-                            readStateScope,
-                            nestedOptions,
-                        );
-                    } catch (err) {
-                        bodies[index] = `Error: ${err && err.message ? err.message : err}`;
-                    }
+            const bodies = await Promise.all(capped.map(async (p) => {
+                try {
+                    return await executeGrepTool(
+                        { ...args, path: p },
+                        workDir,
+                        executeChildBuiltinTool,
+                        readStateScope,
+                        nestedOptions,
+                    );
+                } catch (err) {
+                    return `Error: ${err && err.message ? err.message : err}`;
                 }
-            };
-            await Promise.all(
-                Array.from(
-                    { length: Math.min(GREP_PATH_CONCURRENCY, capped.length) },
-                    () => runWorker(),
-                ),
-            );
+            }));
             const parts = capped.map((p, index) => `# grep ${p}\n${bodies[index]}`);
-            if (list.length > GREP_PATH_CAP) {
-                parts.push(`[capped at ${GREP_PATH_CAP} of ${list.length} paths]`);
-                // Omitted paths mean the returned result cannot cover the whole
-                // requested path set — never let it be cached as complete.
-                if (options?.scopedCacheOutcome) markScopedCacheIncomplete(options.scopedCacheOutcome);
-            }
             const output = parts.join('\n\n');
             if (configuredOutputCap > 0
                 && Buffer.byteLength(output, 'utf8') > configuredOutputCap

package/src/runtime/agent/orchestrator/tools/builtin/shell-analysis.mjs

@@ -560,6 +560,10 @@ export function preflightPowerShellHygiene(command, { shellType, shellName } = {
     const name = String(shellName || '').toLowerCase();
     const isLegacyPS = /powershell/.test(name) && !/pwsh/.test(name);
     const violations = [];
+    // Violation kinds drive the bash auto-rescue: a command blocked ONLY for
+    // bash syntax can be run in bash unchanged, while a PowerShell-specific
+    // violation ($PID reassignment) must stay a hard block.
+    const kinds = [];
     // `$PID=` reassignment and `&&` connectors are judged on a quote-masked
     // copy so quoted literals (`echo "a && b"`, `Write-Output '$PID=1'`) and
     // regex/search args are never mistaken for real syntax.
@@ -572,14 +576,17 @@ export function preflightPowerShellHygiene(command, { shellType, shellName } = {
             const first = String(tokens[0] || '').toLowerCase().replace(/^.*[\\/]/, '');
             if (POWERSHELL_BASHISM_HINTS[first]) {
                 violations.push(`\`${first}\` is a Unix command: ${POWERSHELL_BASHISM_HINTS[first]}`);
+                kinds.push('bashism');
             }
         }
     }
     if (/\$PID\s*=(?!=)/i.test(masked)) {
         violations.push('`$PID` is a reserved PowerShell automatic variable — do not reassign it (use a different name).');
+        kinds.push('powershell-only');
     }
     if (isLegacyPS && /(?:^|[^&])&&(?:[^&]|$)/.test(masked)) {
         violations.push('`&&` is not supported in Windows PowerShell 5.1 — use `;` to sequence or issue separate calls.');
+        kinds.push('bashism');
     }
 
     if (violations.length > 0) {
@@ -587,12 +594,78 @@ export function preflightPowerShellHygiene(command, { shellType, shellName } = {
         return {
             command: rewritten,
             note,
+            // The MSYS path rewrite is a PowerShell-targeted normalisation, so
+            // a bash rescue must re-run the ORIGINAL text.
+            original,
+            bashOnly: kinds.length > 0 && kinds.every((kind) => kind === 'bashism'),
             block: `PowerShell preflight blocked this command (bash syntax on a PowerShell host). Fix and retry:\n- ${hints.join('\n- ')}`,
         };
     }
     return { command: rewritten, note, block: null };
 }
 
+// PowerShell-only constructs. Used to decide whether a command the PowerShell
+// preflight blocked for bash syntax can simply be RUN in bash: only a command
+// with zero PowerShell-specific syntax qualifies, so a mixed script (bash
+// pipes plus `$env:`/cmdlets/`2>$null`) stays a hard block instead of being
+// silently rerouted into a shell that would mangle it. Deliberately
+// over-inclusive — a false positive only declines the rescue.
+const POWERSHELL_ONLY_SYNTAX = [
+    /\$(?:null|true|false|env:|_\b|args\b|host\b|profile\b|pwd\b|psversiontable\b|psscriptroot\b|lastexitcode\b|erroractionpreference\b)/i,
+    /\$[A-Za-z_]\w*\s*=/,
+    /\b(?:get|set|new|remove|select|where|foreach|invoke|out|write|start|stop|test|measure|sort|join|split|convert|import|export|add|copy|move|rename|resolve|compare|clear|push|pop)-[A-Za-z]+\b/i,
+    /\[[A-Za-z_][\w.]*\]::/,
+    /(?:^|\s)-(?:eq|ne|gt|lt|ge|le|match|notmatch|like|notlike|contains|replace|not|and|or|is|as|ErrorAction|Recurse|Force|Encoding|TotalCount|Tail|Pattern|Path|LiteralPath)\b/,
+    /2>\s*\$/,
+    /\|\s*[%?]\s*\{/,
+    /@['"][\s\S]*?['"]@/,
+    /`\s*$/m,
+];
+export function hasPowerShellOnlySyntax(command) {
+    const text = String(command || '');
+    if (!text.trim()) return false;
+    return POWERSHELL_ONLY_SYNTAX.some((pattern) => pattern.test(text));
+}
+
+// ── Inline-script hoisting ──────────────────────────────────────────────────
+// `node -e "<body>"` / `python -c "<body>"` hand the script through the host
+// shell's quoting layer, where nested quotes and escapes are the measured top
+// cause of inline-script failures. When the body is quote-LITERAL (the shell
+// would pass it through byte for byte) the same run is expressible as a file
+// invocation, which has no quoting layer at all — so the failure cannot occur.
+//
+// The transform is refused whenever file semantics would differ from `-e`:
+//   - a body with $, backtick or a backslash escape (the shell WOULD rewrite it);
+//   - anything resolved relative to the script (relative require/import,
+//     import.meta, __dirname/__filename);
+//   - a body that reads process.argv[1] (undefined under -e, a path in a file).
+const INLINE_SCRIPT_RE = /\b(node(?:\.exe)?|python3?|py)((?:\s+--?[\w-]+(?:=[^\s"']+)?)*)\s+(-e|--eval|-c)\s+"((?:[^"\\]|\\.)*)"/;
+const INLINE_UNSAFE_BODY = /[$`\\]/;
+const INLINE_FILE_RELATIVE = /(?:require|import)\s*\(\s*['"]\.{1,2}\/|from\s+['"]\.{1,2}\/|import\.meta|__dirname|__filename|argv\s*\[\s*1\s*\]/;
+
+export function planInlineScriptHoist(command) {
+    const text = String(command || '');
+    if (!text.trim()) return null;
+    const match = text.match(INLINE_SCRIPT_RE);
+    if (!match) return null;
+    const [whole, exe, rawFlags, , body] = match;
+    if (INLINE_UNSAFE_BODY.test(body)) return null;
+    if (INLINE_FILE_RELATIVE.test(body)) return null;
+    const flags = String(rawFlags || '');
+    const isNode = /^node/i.test(exe);
+    const esm = /--input-type=module/.test(flags);
+    const extension = isNode ? (esm ? '.mjs' : '.cjs') : '.py';
+    // `--input-type` only describes an inline body; the extension carries the
+    // module kind for a file, so the flag is dropped with the body.
+    const keptFlags = flags.replace(/\s+--input-type=\w+/g, '');
+    return {
+        exe,
+        extension,
+        body,
+        replace: (filePath) => text.replace(whole, `${exe}${keptFlags} "${filePath}"`),
+    };
+}
+
 export async function preflightShellLargeFileProbe(command, cwd) {
     const text = String(command || '').trim();
     let localCwd = resolve(cwd || process.cwd());

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-paths.mjs

@@ -213,7 +213,7 @@ export function shellJobDonePath(jobId) { return join(getShellJobsDir(), `${jobI
 // enforces unconditionally and records detail.timeoutEnforced:true.
 export function shellJobEnforcedPath(jobId) { return join(getShellJobsDir(), `${jobId}.enforced`); }
 // Guardian kill receipt: written by the detached child-guardian immediately
-// before it force-kills the job tree (host memory floor / orphaned parent).
+// before it cleans up a job tree whose owning parent exited.
 // Its existence lets refreshShellJob attribute a marker-less death to the
 // guardian instead of reporting an unexplained unknown exit.
 export function shellJobGuardianReceiptPath(jobId) { return join(getShellJobsDir(), `${jobId}.guardian`); }

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-spawn.mjs

@@ -272,7 +272,6 @@ export async function _startBackgroundShellJobImpl({
         childPid: child.pid,
         childGroupPid: child.pid,
         label: 'shell-job',
-        protectHostMemory: true,
         receiptPath: shellJobGuardianReceiptPath(jobId),
     });
     _installShellJobsExitHook();
@@ -523,7 +522,6 @@ async function startBackgroundPowerShellJob({
         childPid,
         childGroupPid: childPid,
         label: 'shell-job-powershell',
-        protectHostMemory: true,
         receiptPath: shellJobGuardianReceiptPath(jobId),
     });
     _installShellJobsExitHook();