mixdog 0.9.95 → 0.9.97

package/src/runtime/agent/orchestrator/tools/builtin/read-tool.mjs

@@ -1,4 +1,4 @@
-import { readFileSync } from 'fs';
+import { readFile } from 'fs/promises';
 import { executeSingleReadTool } from './read-single-tool.mjs';
 import { imageMimeForPath, readImageAsContent } from './read-image.mjs';
 import { readEntryCoalescedDiskWindow } from './read-batch.mjs';
@@ -6,6 +6,8 @@ import { readPathStringGuardError } from './read-open.mjs';
 import { parseReadLineNumberArg } from './read-args.mjs';
 import { assertPathsReachable } from './fs-reachability.mjs';
 import { coerceReadFamilyPathArg } from './path-utils.mjs';
+import { readIoAdmission } from '../../../../shared/tool-workload-gates.mjs';
+import { currentToolExecutionOwner } from '../../../../shared/tool-execution-owner.mjs';
 
 function hasLineCoordinate(path) {
     return typeof path === 'string' && /(?:#L\d+|:\d+(?:-\d+)?(?::|$))/i.test(path);
@@ -24,20 +26,11 @@ function _stripLineCoordForReach(s) {
         .replace(/:\d+(?:-\d+)?(?::.*)?$/, '');
 }
 
-// Batch fan-out cap: array/object read shapes read only the first N entries
-// (the >N slice below truncates the rest with a `_batchCapNote`). The
-// reachability preflight must honour the SAME cap so a path that will be
-// capped away is never stat-probed and can never reject the batch via a guard.
-const READ_BATCH_PATH_CAP = 10;
-
 function _collectReachCandidates(p) {
     const out = [];
     const push = (s) => { if (typeof s === 'string' && s) out.push(s); };
     if (typeof p === 'string') push(p);
-    // Only the first READ_BATCH_PATH_CAP entries survive the fan-out cap, so
-    // preflight only the paths that will actually be read. Capped-away paths
-    // (incl. UNC/device) must NOT be probed or allowed to fail the batch.
-    else if (Array.isArray(p)) for (const e of p.slice(0, READ_BATCH_PATH_CAP)) push((e && typeof e === 'object') ? (e.path ?? e.file_path) : e);
+    else if (Array.isArray(p)) for (const e of p) push((e && typeof e === 'object') ? (e.path ?? e.file_path) : e);
     return out;
 }
 
@@ -59,15 +52,14 @@ function _guardedReadError(p, helpers) {
 }
 
 // Reachability preflight for EVERY read shape (scalar / array / reads[]). MUST
-// run before any sync FS — including path normalization and the image
-// stat/read. A dead mount would otherwise freeze the event loop, defeating even
-// the 630s dispatch ceiling.
+// run before any filesystem access. Besides bounding a dead mount, its Stats
+// objects seed the real read so the common path does not immediately re-stat.
 async function _readReachPreflight(rawPath, workDir, helpers) {
     const {
         normalizeInputPath, resolveAgainstCwd,
     } = helpers;
     // A guarded path (UNC/SMB, Windows device, ADS, /dev/* block) must be
-    // REJECTED here, not skipped: skipping would let the later sync guard/open
+    // REJECTED here, not skipped: skipping would let the later guard/open
     // path touch it and trigger NTLM/raw-device access or hang. Reject up front
     // with the same message the inline guards emit.
     // normalizeInputPath FIRST (FS-pure) so we stat the same path the real read
@@ -80,7 +72,7 @@ async function _readReachPreflight(rawPath, workDir, helpers) {
         const stripped = _stripLineCoordForReach(normalizeInputPath(raw));
         const full = resolveAgainstCwd(stripped, workDir);
         const guardMsg = _guardedReadError(stripped, helpers) || _guardedReadError(full, helpers);
-        if (guardMsg) return guardMsg;
+        if (guardMsg) return { error: guardMsg, statsByPath: null };
         // Dedup by resolved path so a batch repeating the same file (or the
         // same union window) issues one stat probe, not one per entry —
         // bounding the preflight's FS work to the distinct target set.
@@ -88,9 +80,17 @@ async function _readReachPreflight(rawPath, workDir, helpers) {
         seenFull.add(full);
         candidates.push(full);
     }
-    if (candidates.length === 0) return null;
-    try { await assertPathsReachable(candidates); return null; }
-    catch (e) { return `Error: ${e?.message || e}`; }
+    if (candidates.length === 0) return { error: null, statsByPath: new Map() };
+    try {
+        const stats = await assertPathsReachable(candidates);
+        const statsByPath = new Map();
+        for (let i = 0; i < candidates.length; i++) {
+            if (stats[i]) statsByPath.set(candidates[i], stats[i]);
+        }
+        return { error: null, statsByPath };
+    } catch (e) {
+        return { error: `Error: ${e?.message || e}`, statsByPath: null };
+    }
 }
 
 export async function executeReadTool(args, workDir, readStateScope, executeChildBuiltinTool, options = {}, helpers = {}) {
@@ -127,8 +127,8 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
         }
     }
     args.path = coerceReadFamilyPathArg(args.path, workDir);
-    // Reachability preflight up front (all shapes) — before readPathStringGuardError /
-    // image stat, all of which can touch sync FS.
+    // Reachability preflight up front (all shapes) — before
+    // readPathStringGuardError / image stat.
     // options._skipReachPreflight: set only by the batch dispatcher on its
     // child reads (below). The parent batch call already ran this exact
     // preflight over EVERY candidate path in the array (_collectReachCandidates
@@ -137,8 +137,9 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
     // child (readPathStringGuardError / image fast-path) — only the async
     // reachability stat is skipped, never the security guards.
     if (options?._skipReachPreflight !== true) {
-        const _reErr = await _readReachPreflight(args.path, workDir, helpers);
-        if (_reErr) return _reErr;
+        const _preflight = await _readReachPreflight(args.path, workDir, helpers);
+        if (_preflight.error) return _preflight.error;
+        options = { ...options, _preflightStats: _preflight.statsByPath };
     }
     // Image files (png/jpg/jpeg/gif/webp): return an MCP image block so the
     // model can actually SEE the image. native Read does this, but mixdog's
@@ -149,7 +150,7 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
     if (options?.mediaTextOnly !== true && typeof args.path === 'string' && imageMimeForPath(args.path)) {
         const _imgNorm = normalizeInputPath(args.path);
         // W1 H: device-file / UNC / Windows-device / ADS guards must run
-        // BEFORE the image fast-path so statSync/readFileSync of a
+        // BEFORE the image fast-path so stat/readFile of a
         // UNC/device path can't bypass the checks the normal read path
         // enforces (NTLM hash leak, raw-device access, ADS).
         if (typeof isUncPath === 'function' && isUncPath(_imgNorm))
@@ -167,7 +168,11 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
             return `Error: cannot read Windows device path (reserved name or raw-device namespace): ${normalizeOutputPath(_imgFull)}`;
         if (typeof hasUnsafeWin32Component === 'function' && hasUnsafeWin32Component(_imgFull))
             return `Error: cannot read Windows path with trailing dot/space or NTFS ADS suffix (bypasses device guard): ${normalizeOutputPath(_imgFull)}`;
-        const _imgResult = await readImageAsContent(_imgFull, normalizeOutputPath(_imgNorm));
+        const _imgResult = await readImageAsContent(
+            _imgFull,
+            normalizeOutputPath(_imgNorm),
+            options?._preflightStats?.get?.(_imgFull) || null,
+        );
         if (_imgResult) return _imgResult;
     }
     // Unified-read dispatch (v0.6.283+):
@@ -181,14 +186,6 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
     // Single turn can touch many files or swap modes without
     // the agent iterating across multiple tool names.
     if (Array.isArray(args.path) && args.path.length > 0 && args.path[0] && typeof args.path[0] === 'object') {
-        // Cap batch fan-out: never error on an oversized array, just
-        // truncate and note it in the final output (mirrors list-tool.mjs
-        // path[] cap pattern).
-        if (args.path.length > 10) {
-            const _origObjLen = args.path.length;
-            args.path = args.path.slice(0, 10);
-            args._batchCapNote = `... [capped at 10 of ${_origObjLen} paths]`;
-        }
         // Per-file batch: each entry carries its own options.
         // Coalesce same-path entries: multiple chunks for the same
         // file are merged into a single wider read (min offset to max
@@ -244,11 +241,6 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
         args.mode = undefined; args.n = undefined; args.offset = undefined; args.limit = undefined; args.full = undefined;
     }
     if (Array.isArray(args.path)) {
-        if (args.path.length > 10) {
-            const _origStrLen = args.path.length;
-            args.path = args.path.slice(0, 10);
-            if (!args._batchCapNote) args._batchCapNote = `... [capped at 10 of ${_origStrLen} paths]`;
-        }
         // Schema is `path: string | string[]` — array entries are
         // strings only. Top-level mode / n / offset / limit / full
         // apply uniformly to every entry in the batch (the only
@@ -421,7 +413,7 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
                 let rangeHashes = rangeHashesByPath.get(fullPath) || [];
                 if (rangeHashes.length === 0 && mergedRanges.length > 0) {
                     try {
-                        const rawLines = readFileSync(fullPath, 'utf-8').split('\n');
+                        const rawLines = (await readFile(fullPath, 'utf-8')).split('\n');
                         rangeHashes = mergedRanges.map((range) => {
                             const startIdx = Math.max(0, range.startLine - 1);
                             const endIdx = Math.min(rawLines.length, range.endLine);
@@ -630,11 +622,16 @@ export async function executeReadTool(args, workDir, readStateScope, executeChil
     // Mode routing. A window already dropped any conflicting head/tail/summary
     // glance above (so the window is served by executeSingleReadTool); what
     // remains here is a mode-only read, or count/hex which are not text windows.
-    if (args.mode === 'head') return executeChildBuiltinTool('head', { path: args.path, n: args.n }, workDir);
-    if (args.mode === 'tail') return executeChildBuiltinTool('tail', { path: args.path, n: args.n }, workDir);
-    if (args.mode === 'count') return executeChildBuiltinTool('wc', { path: args.path }, workDir);
-    if (args.mode === 'summary') return executeChildBuiltinTool('summary', { path: args.path, n: args.n, limit: args.limit }, workDir);
-    if (args.mode === 'hex') return executeChildBuiltinTool('hex', { path: args.path, n: args.n, offset: args.offset }, workDir);
-    return executeSingleReadTool(args, workDir, readStateScope, options, helpers);
+    const runReadIo = (task) => readIoAdmission.run(
+        options?.callerSessionId || options?.sessionId || currentToolExecutionOwner(),
+        task,
+        { signal: options?.signal || options?.abortSignal || null },
+    );
+    if (args.mode === 'head') return runReadIo(() => executeChildBuiltinTool('head', { path: args.path, n: args.n }, workDir));
+    if (args.mode === 'tail') return runReadIo(() => executeChildBuiltinTool('tail', { path: args.path, n: args.n }, workDir));
+    if (args.mode === 'count') return runReadIo(() => executeChildBuiltinTool('wc', { path: args.path }, workDir));
+    if (args.mode === 'summary') return runReadIo(() => executeChildBuiltinTool('summary', { path: args.path, n: args.n, limit: args.limit }, workDir));
+    if (args.mode === 'hex') return runReadIo(() => executeChildBuiltinTool('hex', { path: args.path, n: args.n, offset: args.offset }, workDir));
+    return runReadIo(() => executeSingleReadTool(args, workDir, readStateScope, options, helpers));
 
 }

package/src/runtime/agent/orchestrator/tools/builtin/rg-runner.mjs

@@ -7,7 +7,7 @@ import { createRequire } from 'node:module';
 import os from 'node:os';
 import {
     acquire as acquireChildSpawnSlot,
-    hasSpareCapacity as hasRgSpareCapacity,
+    snapshot as childSpawnSnapshot,
 } from '../../../../shared/child-spawn-gate.mjs';
 
 const execFileAsync = promisify(execFile);
@@ -38,7 +38,7 @@ const execFileAsync = promisify(execFile);
 // This does not queue or limit calls; it only prevents per-process
 // oversubscription. Env override remains available for operator tuning.
 let _rgDefaultThreadCap = null;
-export function _rgThreadCap(_spareCapacity = false) {
+export function _rgThreadCap(activeSearches = 1) {
     const override = Number(process.env.MIXDOG_RG_THREADS);
     if (Number.isFinite(override) && override >= 1) return Math.floor(override);
     if (_rgDefaultThreadCap === null) {
@@ -47,7 +47,12 @@ export function _rgThreadCap(_spareCapacity = false) {
         _rgDefaultThreadCap = cpus || 4;
     }
     const cpus = _rgDefaultThreadCap;
-    return Math.max(2, Math.min(4, Math.ceil(cpus / 4)));
+    const perProcessMax = Math.max(2, Math.min(4, Math.ceil(cpus / 4)));
+    const active = typeof activeSearches === 'boolean'
+        ? 1
+        : Math.max(1, Math.floor(Number(activeSearches) || 1));
+    const aggregateBudget = Math.max(perProcessMax, cpus - 1);
+    return Math.max(1, Math.min(perProcessMax, Math.floor(aggregateBudget / active)));
 }
 
 // Walk rg options once for all thread-argument helpers. Values of these
@@ -94,9 +99,18 @@ function _hasRgThreadArg(argsList) {
 // (`-j`/`--threads`/`-jN`/`--threads=N`, e.g. the EAGAIN `-j 1` retry). Does
 // not mutate; may return the ORIGINAL array unchanged when already
 // thread-pinned (callers must not assume a fresh copy).
-export function _withRgThreads(argsList, spareCapacity = false) {
+export function _withRgThreads(argsList, activeSearches = 1) {
     if (_hasRgThreadArg(argsList)) return argsList;
-    return ['--threads', String(_rgThreadCap(spareCapacity)), ...argsList];
+    return ['--threads', String(_rgThreadCap(activeSearches)), ...argsList];
+}
+
+function activeSearchSpawnCount() {
+    try {
+        const lane = childSpawnSnapshot().lanes.find((entry) => entry.name === 'search');
+        return Math.max(1, Number(lane?.inflight) || 1);
+    } catch {
+        return 1;
+    }
 }
 
 // Build the EAGAIN single-thread retry args. If the caller already pinned a
@@ -409,10 +423,12 @@ function spawnRg(argsList, execOptions) {
     // spawn below, so queue-wait time is excluded from the 20s deadline. No
     // node guardian is started: rg owns its full SIGTERM→grace→force-kill +
     // force-settle teardown, so the 1:1 guardian process was pure overhead.
-    return acquireChildSpawnSlot(gateSignal).then((releaseSlot) => new Promise((resolve, reject) => {
+    return acquireChildSpawnSlot(gateSignal, 'search', {
+        ownerKey: execOptions?.ownerKey || execOptions?.callerSessionId || execOptions?.sessionId,
+    }).then((releaseSlot) => new Promise((resolve, reject) => {
         // Probe after acquisition: this spawn counts toward inflight. The
         // answer is best-effort and only selects the per-process rg cap.
-        const proc = spawn(rgExecutable(), _withRgThreads(argsList, hasRgSpareCapacity()), {
+        const proc = spawn(rgExecutable(), _withRgThreads(argsList, activeSearchSpawnCount()), {
             cwd: execOptions?.cwd,
             env: execOptions?.env || process.env,
             windowsHide: true,
@@ -591,9 +607,11 @@ function spawnRgWindowedLines(argsList, execOptions, opts = {}) {
     // Same gate + thread-cap + no-guardian treatment as spawnRg; queue-wait is
     // excluded from the rg timeout (armed after spawn). releaseSlot is fired
     // once via .finally on every settle path.
-    return acquireChildSpawnSlot(gateSignal).then((releaseSlot) => new Promise((resolve, reject) => {
+    return acquireChildSpawnSlot(gateSignal, 'search', {
+        ownerKey: execOptions?.ownerKey || execOptions?.callerSessionId || execOptions?.sessionId,
+    }).then((releaseSlot) => new Promise((resolve, reject) => {
         // As above, probe only after this spawn has acquired its gate slot.
-        const proc = spawn(rgExecutable(), _withRgThreads(argsList, hasRgSpareCapacity()), {
+        const proc = spawn(rgExecutable(), _withRgThreads(argsList, activeSearchSpawnCount()), {
             cwd: execOptions?.cwd,
             env: execOptions?.env || process.env,
             windowsHide: true,

package/src/runtime/agent/orchestrator/tools/builtin/search-path-diagnostics.mjs

@@ -171,6 +171,13 @@ export async function tryReadFamilyEnoentRedirect({
 
 export function buildNotFoundHint(workDir, missingPath, actionVerb, errCode = 'ENOENT', cache = null) {
     if (!NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return '';
+    // `C:tmpsmp` shape: a Windows path whose separators were eaten by JSON
+    // escaping (`"C:\\tmp\\smp"` written as `"C:\tmp\smp"`). Name the cause —
+    // the sibling/basename hints below can never resolve such a path.
+    const rawMissing = String(missingPath || '');
+    if (/^[A-Za-z]:(?![\\/])[^\\/]/.test(rawMissing.replace(/\\/g, '\\'))) {
+        return ` The path has a drive letter but no separator after it — the backslashes were probably lost in escaping. Re-issue with forward slashes (e.g. "C:/tmp/smp").`;
+    }
     if (resolveUniqueEnoentRedirect(workDir, missingPath, errCode, cache)) return '';
     const elsewhere = cachedFileByBasename(workDir, missingPath, cache);
     if (elsewhere.length) {

package/src/runtime/agent/orchestrator/tools/builtin/search-tool.mjs

@@ -81,7 +81,7 @@ import {
     parseGrepCountLine,
 } from './lib/search-input-helpers.mjs';
 
-// CC parity (GrepTool.ts): a single glob string may pack multiple filters
+// A single glob string may pack multiple filters
 // separated by whitespace or commas, e.g. "*.ts,*.tsx" or "*.ts *.tsx". Split
 // each into its own --glob. Brace patterns ("*.{ts,tsx}") are left intact so
 // their internal commas are not torn apart.
@@ -127,19 +127,16 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
     args = normalizeGrepArgs(args);
     args.path = coerceReadFamilyPathArg(args.path, workDir);
     const callContextCharBudget = _grepContextCharBudget(options);
-    // Fan-out guard: batch multiple string paths with bounded concurrency,
-    // mirroring code_graph files[] batching. Recursive calls pass a single
-    // string path, so recursion bottoms out after one level. Results are
-    // assembled below in input order, regardless of completion order.
+    // Batch multiple string paths concurrently. Recursive calls pass a single
+    // string path, so recursion bottoms out after one level. Results retain
+    // input order even though every path starts immediately.
     if (Array.isArray(args.path)) {
-        const GREP_PATH_CAP = 10;
-        const GREP_PATH_CONCURRENCY = 4;
         const seen = new Set();
         const list = args.path
             .map(p => typeof p === 'string' ? p.trim() : '')
             .filter(p => p && !seen.has(p) && seen.add(p));
         if (list.length > 1) {
-            const capped = list.slice(0, GREP_PATH_CAP);
+            const capped = list;
             // Combined single-spawn path[] fan-out (mirrors the pattern[]
             // combined path below): ONE rg run with every path as a positional
             // operand, then normalized-prefix attribution rebuilds the
@@ -151,7 +148,6 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
             // per-path ENOENT/UNC diagnostics). MIXDOG_GREP_PATH_COMBINED=0
             // disables.
             combinedPaths: if (process.env.MIXDOG_GREP_PATH_COMBINED !== '0'
-                && list.length <= GREP_PATH_CAP
                 && !args.glob
                 && !args.type
                 && args.multiline !== true
@@ -340,38 +336,20 @@ export async function executeGrepTool(args, workDir, executeChildBuiltinTool, re
             const configuredOutputCap = Number(options?.toolOutputMaxBytes) > 0
                 ? Math.trunc(Number(options.toolOutputMaxBytes))
                 : Math.trunc(Number(process.env.MIXDOG_TOOL_OUTPUT_MAX_BYTES));
-            const bodies = new Array(capped.length);
-            let next = 0;
-            const runWorker = async () => {
-                while (next < capped.length) {
-                    const index = next++;
-                    const p = capped[index];
-                    try {
-                        bodies[index] = await executeGrepTool(
-                            { ...args, path: p },
-                            workDir,
-                            executeChildBuiltinTool,
-                            readStateScope,
-                            nestedOptions,
-                        );
-                    } catch (err) {
-                        bodies[index] = `Error: ${err && err.message ? err.message : err}`;
-                    }
+            const bodies = await Promise.all(capped.map(async (p) => {
+                try {
+                    return await executeGrepTool(
+                        { ...args, path: p },
+                        workDir,
+                        executeChildBuiltinTool,
+                        readStateScope,
+                        nestedOptions,
+                    );
+                } catch (err) {
+                    return `Error: ${err && err.message ? err.message : err}`;
                 }
-            };
-            await Promise.all(
-                Array.from(
-                    { length: Math.min(GREP_PATH_CONCURRENCY, capped.length) },
-                    () => runWorker(),
-                ),
-            );
+            }));
             const parts = capped.map((p, index) => `# grep ${p}\n${bodies[index]}`);
-            if (list.length > GREP_PATH_CAP) {
-                parts.push(`[capped at ${GREP_PATH_CAP} of ${list.length} paths]`);
-                // Omitted paths mean the returned result cannot cover the whole
-                // requested path set — never let it be cached as complete.
-                if (options?.scopedCacheOutcome) markScopedCacheIncomplete(options.scopedCacheOutcome);
-            }
             const output = parts.join('\n\n');
             if (configuredOutputCap > 0
                 && Buffer.byteLength(output, 'utf8') > configuredOutputCap

package/src/runtime/agent/orchestrator/tools/builtin/shell-analysis.mjs

@@ -560,6 +560,10 @@ export function preflightPowerShellHygiene(command, { shellType, shellName } = {
     const name = String(shellName || '').toLowerCase();
     const isLegacyPS = /powershell/.test(name) && !/pwsh/.test(name);
     const violations = [];
+    // Violation kinds drive the bash auto-rescue: a command blocked ONLY for
+    // bash syntax can be run in bash unchanged, while a PowerShell-specific
+    // violation ($PID reassignment) must stay a hard block.
+    const kinds = [];
     // `$PID=` reassignment and `&&` connectors are judged on a quote-masked
     // copy so quoted literals (`echo "a && b"`, `Write-Output '$PID=1'`) and
     // regex/search args are never mistaken for real syntax.
@@ -572,14 +576,17 @@ export function preflightPowerShellHygiene(command, { shellType, shellName } = {
             const first = String(tokens[0] || '').toLowerCase().replace(/^.*[\\/]/, '');
             if (POWERSHELL_BASHISM_HINTS[first]) {
                 violations.push(`\`${first}\` is a Unix command: ${POWERSHELL_BASHISM_HINTS[first]}`);
+                kinds.push('bashism');
             }
         }
     }
     if (/\$PID\s*=(?!=)/i.test(masked)) {
         violations.push('`$PID` is a reserved PowerShell automatic variable — do not reassign it (use a different name).');
+        kinds.push('powershell-only');
     }
     if (isLegacyPS && /(?:^|[^&])&&(?:[^&]|$)/.test(masked)) {
         violations.push('`&&` is not supported in Windows PowerShell 5.1 — use `;` to sequence or issue separate calls.');
+        kinds.push('bashism');
     }
 
     if (violations.length > 0) {
@@ -587,12 +594,78 @@ export function preflightPowerShellHygiene(command, { shellType, shellName } = {
         return {
             command: rewritten,
             note,
+            // The MSYS path rewrite is a PowerShell-targeted normalisation, so
+            // a bash rescue must re-run the ORIGINAL text.
+            original,
+            bashOnly: kinds.length > 0 && kinds.every((kind) => kind === 'bashism'),
             block: `PowerShell preflight blocked this command (bash syntax on a PowerShell host). Fix and retry:\n- ${hints.join('\n- ')}`,
         };
     }
     return { command: rewritten, note, block: null };
 }
 
+// PowerShell-only constructs. Used to decide whether a command the PowerShell
+// preflight blocked for bash syntax can simply be RUN in bash: only a command
+// with zero PowerShell-specific syntax qualifies, so a mixed script (bash
+// pipes plus `$env:`/cmdlets/`2>$null`) stays a hard block instead of being
+// silently rerouted into a shell that would mangle it. Deliberately
+// over-inclusive — a false positive only declines the rescue.
+const POWERSHELL_ONLY_SYNTAX = [
+    /\$(?:null|true|false|env:|_\b|args\b|host\b|profile\b|pwd\b|psversiontable\b|psscriptroot\b|lastexitcode\b|erroractionpreference\b)/i,
+    /\$[A-Za-z_]\w*\s*=/,
+    /\b(?:get|set|new|remove|select|where|foreach|invoke|out|write|start|stop|test|measure|sort|join|split|convert|import|export|add|copy|move|rename|resolve|compare|clear|push|pop)-[A-Za-z]+\b/i,
+    /\[[A-Za-z_][\w.]*\]::/,
+    /(?:^|\s)-(?:eq|ne|gt|lt|ge|le|match|notmatch|like|notlike|contains|replace|not|and|or|is|as|ErrorAction|Recurse|Force|Encoding|TotalCount|Tail|Pattern|Path|LiteralPath)\b/,
+    /2>\s*\$/,
+    /\|\s*[%?]\s*\{/,
+    /@['"][\s\S]*?['"]@/,
+    /`\s*$/m,
+];
+export function hasPowerShellOnlySyntax(command) {
+    const text = String(command || '');
+    if (!text.trim()) return false;
+    return POWERSHELL_ONLY_SYNTAX.some((pattern) => pattern.test(text));
+}
+
+// ── Inline-script hoisting ──────────────────────────────────────────────────
+// `node -e "<body>"` / `python -c "<body>"` hand the script through the host
+// shell's quoting layer, where nested quotes and escapes are the measured top
+// cause of inline-script failures. When the body is quote-LITERAL (the shell
+// would pass it through byte for byte) the same run is expressible as a file
+// invocation, which has no quoting layer at all — so the failure cannot occur.
+//
+// The transform is refused whenever file semantics would differ from `-e`:
+//   - a body with $, backtick or a backslash escape (the shell WOULD rewrite it);
+//   - anything resolved relative to the script (relative require/import,
+//     import.meta, __dirname/__filename);
+//   - a body that reads process.argv[1] (undefined under -e, a path in a file).
+const INLINE_SCRIPT_RE = /\b(node(?:\.exe)?|python3?|py)((?:\s+--?[\w-]+(?:=[^\s"']+)?)*)\s+(-e|--eval|-c)\s+"((?:[^"\\]|\\.)*)"/;
+const INLINE_UNSAFE_BODY = /[$`\\]/;
+const INLINE_FILE_RELATIVE = /(?:require|import)\s*\(\s*['"]\.{1,2}\/|from\s+['"]\.{1,2}\/|import\.meta|__dirname|__filename|argv\s*\[\s*1\s*\]/;
+
+export function planInlineScriptHoist(command) {
+    const text = String(command || '');
+    if (!text.trim()) return null;
+    const match = text.match(INLINE_SCRIPT_RE);
+    if (!match) return null;
+    const [whole, exe, rawFlags, , body] = match;
+    if (INLINE_UNSAFE_BODY.test(body)) return null;
+    if (INLINE_FILE_RELATIVE.test(body)) return null;
+    const flags = String(rawFlags || '');
+    const isNode = /^node/i.test(exe);
+    const esm = /--input-type=module/.test(flags);
+    const extension = isNode ? (esm ? '.mjs' : '.cjs') : '.py';
+    // `--input-type` only describes an inline body; the extension carries the
+    // module kind for a file, so the flag is dropped with the body.
+    const keptFlags = flags.replace(/\s+--input-type=\w+/g, '');
+    return {
+        exe,
+        extension,
+        body,
+        replace: (filePath) => text.replace(whole, `${exe}${keptFlags} "${filePath}"`),
+    };
+}
+
 export async function preflightShellLargeFileProbe(command, cwd) {
     const text = String(command || '').trim();
     let localCwd = resolve(cwd || process.cwd());

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-paths.mjs

@@ -213,7 +213,7 @@ export function shellJobDonePath(jobId) { return join(getShellJobsDir(), `${jobI
 // enforces unconditionally and records detail.timeoutEnforced:true.
 export function shellJobEnforcedPath(jobId) { return join(getShellJobsDir(), `${jobId}.enforced`); }
 // Guardian kill receipt: written by the detached child-guardian immediately
-// before it force-kills the job tree (host memory floor / orphaned parent).
+// before it cleans up a job tree whose owning parent exited.
 // Its existence lets refreshShellJob attribute a marker-less death to the
 // guardian instead of reporting an unexplained unknown exit.
 export function shellJobGuardianReceiptPath(jobId) { return join(getShellJobsDir(), `${jobId}.guardian`); }

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-spawn.mjs

@@ -272,7 +272,6 @@ export async function _startBackgroundShellJobImpl({
         childPid: child.pid,
         childGroupPid: child.pid,
         label: 'shell-job',
-        protectHostMemory: true,
         receiptPath: shellJobGuardianReceiptPath(jobId),
     });
     _installShellJobsExitHook();
@@ -523,7 +522,6 @@ async function startBackgroundPowerShellJob({
         childPid,
         childGroupPid: childPid,
         label: 'shell-job-powershell',
-        protectHostMemory: true,
         receiptPath: shellJobGuardianReceiptPath(jobId),
     });
     _installShellJobsExitHook();

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -140,8 +140,8 @@ export function killShellJob(jobId) {
 // wrapper publishing the done marker. Evidence order:
 //   1. exit file — the wrapper writes exit BEFORE done, so a kill in that
 //      window still left the real exit code; recover it instead of guessing.
-//   2. guardian receipt — the child-guardian records why it force-killed the
-//      tree (host memory floor / orphaned parent) before killing.
+//   2. guardian receipt — the child-guardian records an orphaned parent before
+//      cleaning up the owned tree.
 //   3. otherwise — honest unknown: terminal 'failed' with exitCode null and
 //      an explicit "exit status unknown" error; spilled output is preserved
 //      and the completion notification carries its tail.
@@ -165,12 +165,7 @@ function finalizeMarkerlessShellJob(detail) {
         } catch { /* no guardian receipt */ }
         detail.status = 'failed';
         detail.exitCode = 137;
-        if (receipt?.reason === 'host-memory-floor') {
-            const freeMb = Math.round(Number(receipt.freeBytes || 0) / (1024 * 1024));
-            const floorMb = Math.round(Number(receipt.minFreeMemoryBytes || 0) / (1024 * 1024));
-            detail.killedByGuardian = true;
-            detail.error = `killed by child guardian: host free memory ${freeMb} MB fell below the ${floorMb} MB floor — job tree force-killed to protect the host; retry with lower concurrency or after memory recovers`;
-        } else if (receipt?.reason === 'parent-exit') {
+        if (receipt?.reason === 'parent-exit') {
             detail.killedByGuardian = true;
             detail.error = 'killed by child guardian: owning runtime process exited (session cleanup)';
         } else {

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -66,10 +66,40 @@ function firstExistingPathFromPath(commandName, excludeRe = null) {
         .find((candidate) => !excludeRe || !excludeRe.test(candidate)) || null;
 }
 
+// Well-known pwsh (PowerShell 7+) install roots, probed on the filesystem when
+// PATH does not carry pwsh.exe. A long-lived daemon frequently inherits an env
+// without the PowerShell 7 directory, which silently downgraded every command
+// to Windows PowerShell 5.1 — the shell that lacks `&&` and drives the bashism
+// preflight blocks. Newest major first, then the Store alias.
+function pwshFromKnownWindowsRoots() {
+    const env = process.env;
+    const bases = [env.ProgramW6432, env.ProgramFiles, env['ProgramFiles(x86)'], 'C:\\Program Files', 'C:\\Program Files (x86)']
+        .filter(Boolean)
+        .map((base) => join(base, 'PowerShell'));
+    const versions = ['7', '7-preview', '8', '9'];
+    for (const base of bases) {
+        for (const version of versions) {
+            const candidate = join(base, version, 'pwsh.exe');
+            if (existsSync(candidate)) return candidate;
+        }
+    }
+    if (env.LOCALAPPDATA) {
+        const storeAlias = join(env.LOCALAPPDATA, 'Microsoft', 'WindowsApps', 'pwsh.exe');
+        if (existsSync(storeAlias)) return storeAlias;
+    }
+    return null;
+}
+
 function resolveWindowsPowerShell() {
+    // Priority: pwsh on PATH → pwsh in a known install root → bundled 5.1 →
+    // any powershell.exe on PATH. PowerShell 7 is preferred wherever it exists
+    // because 5.1 rejects `&&` chains and several modern operators.
     const pwsh = firstExistingPathFromPath('pwsh.exe');
     if (pwsh) return shellSpec(pwsh, 'powershell');
 
+    const installed = pwshFromKnownWindowsRoots();
+    if (installed) return shellSpec(installed, 'powershell');
+
     const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
     const bundled = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
     if (existsSync(bundled)) return shellSpec(bundled, 'powershell');

package/src/runtime/agent/orchestrator/tools/code-graph/build.mjs

@@ -146,9 +146,9 @@ export async function _runDiskCodeGraphFastPath({
   signal = null,
   loadDiskEntry,
   consumeDirty = () => {},
-  // Long-lived build slot: 'build' lane so a cold graph build never blocks
-  // short rg spawns behind the win32 cap=1 default lane.
-  acquireSlot = (signal) => acquireChildSpawnSlot(signal, 'build'),
+  // Long-lived code-graph lane so a cold graph build never blocks short rg
+  // processes in the independent search lane.
+  acquireSlot = (signal) => acquireChildSpawnSlot(signal, 'code-graph'),
   validateDiskHit = _validateDiskCodeGraphHit,
   spawnWorker,
   maxFiles = CODE_GRAPH_MAX_FILES,
@@ -344,7 +344,7 @@ export async function buildCodeGraphAsync(cwd, signal = null, {
   }
   // Non-competing prewarm: the signature-validation manifest also needs a
   // child-spawn slot, so warmers skip before either it or a Worker can queue.
-  if (bestEffort && !childSpawnHasSpareCapacity()) return null;
+  if (bestEffort && !childSpawnHasSpareCapacity('code-graph')) return null;
   const _genAtStart = _getCodeGraphGen(graphCwd);
   const promise = (async () => {
     // Loading the compact disk manifest/one candidate entry is synchronous but
@@ -422,7 +422,7 @@ export function _spawnCodeGraphWorker(
       if (val instanceof Error) reject(val);
       else resolve(val);
     };
-    (preAcquiredRelease ? Promise.resolve(preAcquiredRelease) : acquireChildSpawnSlot(signal || null, 'build')).then((release) => {
+    (preAcquiredRelease ? Promise.resolve(preAcquiredRelease) : acquireChildSpawnSlot(signal || null, 'code-graph')).then((release) => {
       _releaseSlot = release;
       if (settled) { release(); _releaseSlot = null; return; }
       if (signal?.aborted) { settle(new Error('aborted')); return; }