mixdog 0.9.95 → 0.9.97

package/src/runtime/agent/orchestrator/session/store-summary-reader.mjs

@@ -345,6 +345,8 @@ function normalizedRow(row, heartbeatAt = 0) {
         preview: cleanText(row.preview),
         generation: typeof row.generation === 'number' ? row.generation : 0,
         implicitBashSessionId: row.implicitBashSessionId || null,
+        storageMtimeMs: positiveNumber(row.storageMtimeMs, 0),
+        storageSize: positiveNumber(row.storageSize, 0),
         detachedReason: row.detachedReason || null,
     };
 }
@@ -412,10 +414,15 @@ function sessionHeartbeatMtimes() {
  * Returns `null` when the directory itself is NOT enumerable (unreadable
  * stat / readdir): that is not "no sessions", and the caller must keep the
  * authority it already has (the index rows) instead of publishing an empty
- * catalog. `indexRowsById` carries those rows so a single UNREADABLE session
- * file also retains its last known row instead of vanishing.
+ * catalog. `indexRowsById` carries those rows so unchanged files can reuse the
+ * durable summary and a single UNREADABLE file retains its last known row
+ * instead of vanishing.
  */
-function scanSessionFiles(heartbeatMtimes = sessionHeartbeatMtimes(), indexRowsById = new Map()) {
+function scanSessionFiles(
+    heartbeatMtimes = sessionHeartbeatMtimes(),
+    indexRowsById = new Map(),
+    { indexMtimeMs = 0, forceRead = false } = {},
+) {
     const directory = join(dataDir(), 'sessions');
     const dirProbe = probePath(directory);
     if (dirProbe.state === PROBE_ABSENT) return [];
@@ -426,13 +433,37 @@ function scanSessionFiles(heartbeatMtimes = sessionHeartbeatMtimes(), indexRowsB
     for (const filename of entries) {
         if (!filename.endsWith('.json')) continue;
         const storageId = filename.slice(0, -5);
-        const read = readTextFile(join(directory, filename));
+        const path = join(directory, filename);
+        const retained = indexRowsById.get(storageId);
+        const probe = probePath(path);
+        // Provably gone: the row legitimately disappears with the file.
+        if (probe.state === PROBE_ABSENT) continue;
+        if (probe.state !== PROBE_PRESENT) {
+            if (retained) rows.push(retained);
+            continue;
+        }
+        if (!forceRead && retained) {
+            const exactFingerprint = retained.storageMtimeMs > 0
+                && retained.storageSize > 0
+                && retained.storageMtimeMs === probe.mtimeMs
+                && retained.storageSize === probe.size;
+            // Older v2 rows predate per-file fingerprints. Their global index
+            // timestamp remains a one-release compatibility fallback; every
+            // later save/rebuild stamps the exact (mtimeMs,size) pair.
+            const legacyUnchanged = retained.storageMtimeMs === 0
+                && indexMtimeMs > 0
+                && (probe.mtimeMs || 0) <= indexMtimeMs;
+            if (exactFingerprint || legacyUnchanged) {
+                rows.push(retained);
+                continue;
+            }
+        }
+        const read = readTextFile(path);
         // Provably gone: the row legitimately disappears with the file.
         if (read.state === PROBE_ABSENT) continue;
         if (read.state !== PROBE_PRESENT) {
             // Exists and could not be read (EACCES/EIO): retain the last known
             // row rather than let a transient IO error delete it from view.
-            const retained = indexRowsById.get(storageId);
             if (retained) rows.push(retained);
             continue;
         }
@@ -440,36 +471,16 @@ function scanSessionFiles(heartbeatMtimes = sessionHeartbeatMtimes(), indexRowsB
         // record or a foreign identity is not this file's session.
         const record = readTopLevelLifecycleRecord(read.text);
         if (isLifecycleUnreadable(record) || record.id !== storageId) continue;
-        const row = rowFromSession(record.doc, heartbeatMtimes.get(record.id) || 0);
+        const summary = rowFromSession(record.doc, heartbeatMtimes.get(record.id) || 0);
+        const row = summary
+            ? { ...summary, storageMtimeMs: probe.mtimeMs, storageSize: probe.size }
+            : null;
         if (row) rows.push(row);
     }
     return leadRowsWithAgentHeartbeat(rows).sort((left, right) =>
         (right.lastUsedAt || right.updatedAt || 0) - (left.lastUsedAt || left.updatedAt || 0));
 }
 
-function sessionFilesAreNewerThan(indexPath) {
-    const directory = join(dataDir(), 'sessions');
-    if (probePath(directory).state !== PROBE_PRESENT) return false;
-    const indexProbe = probePath(indexPath);
-    // Only a PROVABLY absent index makes the files newer by definition. An
-    // index that exists but cannot be stat'ed (EACCES/EIO) is still the
-    // authority we failed to consult — claiming "files are newer" there would
-    // replace the whole catalog on the strength of an IO error.
-    if (indexProbe.state === PROBE_ABSENT) return true;
-    if (indexProbe.state !== PROBE_PRESENT) return false;
-    const indexMtime = indexProbe.mtimeMs || 0;
-    let entries;
-    try { entries = readdirSync(directory); } catch { return false; }
-    for (const filename of entries) {
-        if (!filename.endsWith('.json')) continue;
-        // Absent (raced unlink) and unreadable both prove nothing about
-        // freshness: only an observed newer mtime does.
-        const probe = probePath(join(directory, filename));
-        if (probe.state === PROBE_PRESENT && (probe.mtimeMs || 0) > indexMtime) return true;
-    }
-    return false;
-}
-
 export function listStoredSessionSummaries(options = {}) {
     const heartbeatMtimes = sessionHeartbeatMtimes();
     const indexPath = join(dataDir(), 'session-summaries.json');
@@ -478,6 +489,7 @@ export function listStoredSessionSummaries(options = {}) {
     // an individual session file cannot be read.
     const indexRowsById = new Map();
     let indexRows = null;
+    let indexMtimeMs = 0;
     const indexRead = readTextFile(indexPath);
     if (indexRead.state === PROBE_PRESENT) {
         try {
@@ -490,25 +502,42 @@ export function listStoredSessionSummaries(options = {}) {
                 indexRows = leadRowsWithAgentHeartbeat(normalizedRows)
                     .sort((left, right) =>
                         (right.lastUsedAt || right.updatedAt || 0) - (left.lastUsedAt || left.updatedAt || 0));
+                const indexProbe = probePath(indexPath);
+                if (indexProbe.state === PROBE_PRESENT) indexMtimeMs = indexProbe.mtimeMs || 0;
             }
         } catch { /* malformed sidecar: the files below are the authority */ }
     }
     // An index that EXISTS but is unreadable (EACCES/EIO) is neither missing
     // nor empty: the scan below still runs, and when IT cannot enumerate
     // either, the catalog reports nothing rather than inventing an empty truth.
-    const scan = () => scanSessionFiles(heartbeatMtimes, indexRowsById);
-    if (options.refreshFromStorage === true) return scan() ?? indexRows ?? [];
+    const scan = (forceRead = false) => scanSessionFiles(
+        heartbeatMtimes,
+        indexRowsById,
+        { indexMtimeMs, forceRead },
+    );
+    if (options.refreshFromStorage === true) return scan(true) ?? indexRows ?? [];
     if (indexRows) {
-        // A crashed/non-blocking sidecar writer can leave a valid but old,
-        // non-empty index indefinitely. Detect only newer session JSONs
-        // (heartbeat churn does not count), then recover read-only from the
-        // authoritative files without trying to rewrite the stuck index.
-        if (options.rebuildIfMissing !== false && sessionFilesAreNewerThan(indexPath)) {
-            return scan() ?? indexRows;
-        }
-        if (indexRows.length > 0 || options.rebuildIfMissing === false) return indexRows;
+        if (options.rebuildIfMissing === false) return indexRows;
+        // Enumerate identities to detect deletions, stat known files, and parse
+        // only rows newer than the index. Cold-start cost therefore scales with
+        // changed transcripts rather than total transcript bytes.
+        return scan(false) ?? indexRows;
     }
-    return options.rebuildIfMissing === false ? [] : (scan() ?? indexRows ?? []);
+    // Missing/malformed index is the sole cold path that must rebuild every
+    // summary from canonical session bytes.
+    return options.rebuildIfMissing === false ? [] : (scan(true) ?? indexRows ?? []);
+}
+
+/** Exact, fail-closed existence check for a durable session address.
+ * Summary indexes and desktop metadata are presentation caches; neither may
+ * make a missing sessions/<id>.json record addressable again. */
+export function storedSessionExists(id) {
+    const sessionId = String(id || '').trim();
+    if (!/^[A-Za-z0-9_-]+$/.test(sessionId)) return false;
+    const read = readTextFile(join(dataDir(), 'sessions', `${sessionId}.json`));
+    if (read.state !== PROBE_PRESENT) return false;
+    const record = readTopLevelLifecycleRecord(read.text);
+    return !isLifecycleUnreadable(record) && record.id === sessionId;
 }
 
 /** Read exactly one persisted session for a visible desktop pane. This never
@@ -555,7 +584,7 @@ export async function readStoredSessionTranscript(id, options = {}) {
         restoreTranscriptItems,
         sessionContextSnapshotProjection,
     } = await import(
-        '../../../../tui/engine/session-api-ext.mjs'
+        '../../../../tui/session/session-api-ext.mjs'
     );
     let preparedContextProjection = null;
     try {
@@ -712,7 +741,7 @@ export async function createStoredSessionLiveViewer(id, options = {}) {
         clearStreamingTail: () => commit({ streamingTail: null }),
     };
     const { createLiveShare, liveSharePipePath } = await import(
-        '../../../../tui/engine/live-share.mjs'
+        '../../../../tui/session/live-share.mjs'
     );
     const share = createLiveShare({
         ownerSessionId: () => '',

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -24,7 +24,7 @@ import {
 import { isInvalidToolArgsMarker, formatInvalidToolArgsResult } from '../providers/openai-compat-stream.mjs';
 import {
     _stripMcpPrefix, _isReadTool, _isMutationTool, _isScopedCacheableTool,
-    _isShellTool, _isOrderedGateSkippable, _intraTurnSig,
+    _isShellTool, _intraTurnSig,
 } from './loop/tool-classify.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
@@ -103,12 +103,6 @@ export async function processToolBatch(ctx) {
             if (message?.toolCallId) _batchToolResultByCallId.set(message.toolCallId, message);
             else _batchToolResultsWithoutId.push(message);
         };
-        // Ordered-mutation batch gate. Each apply_patch is an eager-dispatch
-        // barrier: side effects overlap within the current segment, but no
-        // later segment starts before the loop crosses the patch in model
-        // order. A failed patch prevents every unstarted later side effect;
-        // known read-only calls may still complete for diagnostics.
-        let _orderedMutationFailed = null;
         for (let callIndex = 0; callIndex < calls.length; callIndex += 1) {
             const call = calls[callIndex];
             if (isBuiltinTool(call.name)) {
@@ -202,22 +196,6 @@ export async function processToolBatch(ctx) {
                     continue;
                 }
             }
-            // Ordered-mutation skip: an earlier apply_patch in THIS batch failed,
-            // so this later side-effect call is skipped rather than executed.
-            // Restore a later patch's full body first so it can be re-issued.
-            // `skipped` is deliberate: the call never started, so it is neither
-            // a tool failure nor a cancellation. The earlier patch remains the
-            // structural failure that drives retry/stop-hook behavior.
-            if (_orderedMutationFailed && _isOrderedGateSkippable(call.name) && !pending.has(call.id)) {
-                if (call?.id) restoreToolCallBodyForId(assistantTurnMsg, calls, call.id);
-                _stageToolResultMessage({
-                    role: 'tool',
-                    content: `[prerequisite-failed] an earlier apply_patch in this same tool batch (call index ${_orderedMutationFailed.index + 1}) failed, so this later \`${call.name}\` was skipped without starting. Re-issue it after resolving the patch failure.`,
-                    toolCallId: call.id,
-                    toolKind: 'skipped',
-                });
-                continue;
-            }
             if (sessionId) markSessionToolCall(sessionId, call.name, resolveToolSelfDeadlineMs(call.name, call.arguments));
             let result;
             let toolStartedAt;
@@ -279,8 +257,9 @@ export async function processToolBatch(ctx) {
                     _executeOk = true;
                 } else {
                 // Fallback for providers that don't stream tool calls early:
-                // start the whole remaining batch in parallel (full-parallel
-                // policy; only apply_patch stays in this serial body).
+                // dispatch the whole remaining batch. The eager dispatcher
+                // keeps independent calls parallel while making shell wait
+                // for earlier apply_patch calls.
                 if (isParallelDispatchable(call.name)) {
                     startEagerRun(calls, callIndex, _duplicateCallIds);
                 }
@@ -512,14 +491,6 @@ export async function processToolBatch(ctx) {
             }
             if (_isMutationTool(call.name)) {
                 epoch.mutation += 1;
-                // Record the first failed ordered mutation in this batch so any
-                // later side effect is skipped by the gate at the top of the
-                // loop. Keyed on exec outcome (not post-processing): a mutation
-                // whose write succeeded but post-processing threw still landed
-                // on disk, so it must NOT block subsequent ordered patches.
-                if ((!_executeOk || _resultKind === 'error') && !_orderedMutationFailed) {
-                    _orderedMutationFailed = { index: callIndex, callId: call.id, name: call.name };
-                }
             }
             // Bash always clears scoped cache UNCONDITIONALLY — a mutating bash
             // that throws or fails partway can still leave stale find_symbol / grep entries.

package/src/runtime/agent/orchestrator/session/tool-result-offload.mjs

@@ -52,11 +52,10 @@ function maybeSweepStaleOffloadDirs() {
     void sweepStaleOffloadDirs();
 }
 
-// Per-tool persistence limits mirror reference per-tool maxResultSizeChars
-// rather than a single global value: Grep persists at 20k (CC GrepTool), Glob
-// and list/find_* at the 50k system default (CC DEFAULT_MAX_RESULT_SIZE_CHARS;
-// tighter than CC Glob's 100k by design), and shell/bash_session/task at 30k
-// (CC BASH_MAX_OUTPUT_LENGTH default). Read/head/tail/diff stay inline
+// Per-tool persistence limits are per-tool maxResultSizeChars values rather
+// than a single global value: grep persists at 20k, glob and list/find_* at
+// the 50k system default (deliberately tighter than the common 100k), and
+// shell/bash_session/task at 30k. Read/head/tail/diff stay inline
 // (Infinity) — they are self-bound by FileRead semantics and the upstream
 // READ_MAX_SIZE_BYTES cap, so persisting to a sidecar to be re-read would be
 // circular. These values keep context-rich IO tools from turning into "read

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -3,7 +3,7 @@ import { getHiddenAgent } from './internal-agents.mjs';
 const SECOND_MS = 1000;
 const MIN_PROVIDER_TIMEOUT_MS = 30_000;
 
-const STALL_TICK_MS = 15_000;
+export const STALL_TICK_MS = 15_000;
 const DEFAULT_STALL_WARN_S = 300;
 const DEFAULT_STALL_ABORT_S = 600;
 // First-byte (no-stream-delta) abort for the agent stall watchdog. A wedged

package/src/runtime/agent/orchestrator/tools/bash-session.mjs

@@ -65,7 +65,7 @@ const MAX_TIMEOUT_MS = Math.max(_envMaxTimeout > 0 ? _envMaxTimeout : 600_000, D
 // JS setTimeout / PS WaitForExit(ms) are 32-bit: a delay above 2^31-1 wraps and
 // fires immediately. Hard ceiling (~24.8 days) for an uncapped explicit timeout.
 const TIMER_MAX_MS = 2_147_483_647;
-const IDLE_TIMEOUT_MS = 5 * 60_000;
+const IDLE_TIMEOUT_MS = 2 * 60_000;
 const MAX_SESSIONS = 10;
 const STDERR_DRAIN_MS = 25;
 const STDERR_DRAIN_MAX_MS = 250;
@@ -364,7 +364,6 @@ function _spawnSession(id, initialCwd = process.cwd(), resourceLease = null) {
         childPid: proc.pid,
         childGroupPid: proc.pid,
         label: 'bash-session',
-        protectHostMemory: true,
     });
     proc.stdout.setEncoding('utf-8');
     proc.stderr.setEncoding('utf-8');
@@ -446,6 +445,7 @@ async function _getOrCreate(sessionId, initialCwd = process.cwd(), opts = {}) {
             signal: opts.signal || null,
             label: `persistent:${id}`,
             dependency: 'detached',
+            ownerKey: opts.sessionId || id,
         });
         try {
             entry = _sessions.get(id);

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -849,7 +849,40 @@ const GUARDS = {
 // key instead of failing the call on a field the caller never set.
 function dropUndefinedArgs(args) {
     for (const key of Object.keys(args)) {
-        if (args[key] === undefined) delete args[key];
+        // `null` gets the same treatment: it is the only way JSON can express
+        // "this optional field was not set", and failing the whole call on it
+        // was measured as a recurring, fully recoverable tool error.
+        if (args[key] === undefined || args[key] === null) delete args[key];
+    }
+}
+
+// string | string[] arguments arrive nested ([["a","b"]] from a batching
+// wrapper), padded with null/empty entries, or empty. The intent is
+// unambiguous, so flatten one level, drop the blanks, and remove a key that
+// ends up empty (the tool then uses its default scope) instead of rejecting
+// the call.
+const STRING_LIST_ARG_KEYS = [
+    'path', 'paths', 'root', 'file', 'files',
+    'pattern', 'patterns', 'query', 'regex', 'needle',
+    'glob', 'file_pattern', 'include', 'type', 'symbols',
+];
+function normalizeStringListArgs(args) {
+    for (const key of STRING_LIST_ARG_KEYS) {
+        if (!hasOwn(args, key) || !Array.isArray(args[key])) continue;
+        const source = args[key];
+        // Flatten ONE nesting level and drop blank entries; every other entry
+        // type is left untouched so the per-tool guards still see (and coerce
+        // or reject) it — `read`'s {path,offset,limit}[] regions must survive
+        // this pass verbatim.
+        const flat = [];
+        for (const entry of source.flat(1)) {
+            if (entry === null || entry === undefined) continue;
+            if (typeof entry === 'string' && entry.trim().length === 0) continue;
+            flat.push(entry);
+        }
+        if (flat.length === source.length && flat.every((entry, idx) => entry === source[idx])) continue;
+        if (flat.length === 0) delete args[key];
+        else args[key] = flat;
     }
 }
 
@@ -863,6 +896,7 @@ export function validateBuiltinArgs(toolName, args) {
         return `Error: ${toolName} arguments must be an object (got ${describeType(args)})`;
     }
     dropUndefinedArgs(args);
+    normalizeStringListArgs(args);
     if (toolName === 'grep') applyGrepContextLeadPolicy(args);
     try {
         return guard(args) || null;

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -1,4 +1,9 @@
 import { getAbortSignalForSession } from '../../session/abort-lookup.mjs';
+import { unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join as pathJoin } from 'node:path';
+import { isLegitimateShellExit } from '../../session/result-classification.mjs';
+import { makeToolEnvelope } from '../../session/tool-envelope.mjs';
 import { acquireShellLeaseBounded, execShellCommand, stripAnsi } from '../shell-command.mjs';
 import { wrapCommandWithSnapshot } from '../shell-snapshot.mjs';
 import { getDestructiveCommandWarning } from '../destructive-warning.mjs';
@@ -27,7 +32,9 @@ import {
     detectLongForegroundReason,
     extractShellApplyPatchInvocation,
     foregroundLongCommandHint,
+    hasPowerShellOnlySyntax,
     isAutobackgroundingAllowed,
+    planInlineScriptHoist,
     preflightPowerShellHygiene,
     shellSplitSegments,
     shellSplitPipelineSegments,
@@ -89,10 +96,12 @@ export function _trackedDriftNoteAfter(_scope, _pre) {
 
 // Search-style commands and `git diff --exit-code` use exit 1 as a SIGNAL
 // (no match / has diff), not a failure. Benign ONLY when exitCode===1, no
-// signal, stderr blank, AND the command is a SINGLE pipeline (no ;/&&/||, so
-// exit 1's origin is unambiguous — a mixed chain stays Error). Quote/comment
-// aware via the shared shell tokenizers, so quoted/commented `;` `|` `grep`
-// can never masquerade as a connector/command and hide a real failure.
+// signal, stderr blank, AND the exit status provably comes from a search-style
+// stage: the LAST segment of a `;`/`&&` chain (its status IS the chain's) whose
+// last pipeline stage is a search head. `||` chains stay ambiguous (either
+// branch can supply the status) and stay Error. Quote/comment aware via the
+// shared shell tokenizers, so quoted/commented `;` `|` `grep` can never
+// masquerade as a connector/command and hide a real failure.
 const _SEARCH_HEADS = new Set(['select-string', 'sls', 'grep', 'egrep', 'fgrep', 'findstr']);
 const _GIT_GLOBAL_VALUE_OPTS = new Set(['-c', '-C', '--git-dir', '--work-tree', '--namespace', '--exec-path', '--config-env']);
 // Command/process/subshell substitution or a backslash/backtick-escaped pipe
@@ -120,9 +129,11 @@ export function _isBenignSearchExitOne(command, exitCode, signal, stderr) {
     const text = _stripShellComment(String(command || ''));
     if (_AMBIGUOUS_SYNTAX.test(text)) return false; // subshell/subst/escaped pipe → ambiguous
     const segments = shellSplitSegments(text);
-    if (segments.length !== 1) return false; // ;/&&/|| chain → ambiguous, stay Error
-    const stages = shellSplitPipelineSegments(segments[0]);
-    const last = stages[stages.length - 1] || segments[0];
+    if (segments.length === 0) return false;
+    if (segments.length > 1 && /\|\|/.test(text)) return false; // || → which branch exited 1?
+    const lastSegment = segments[segments.length - 1];
+    const stages = shellSplitPipelineSegments(lastSegment);
+    const last = stages[stages.length - 1] || lastSegment;
     const raw = shellTokenize(last);
     if (!raw) return false; // unbalanced quotes
     const tokens = stripShellProbeWrappers(raw);
@@ -208,6 +219,14 @@ export function formatShellToolFailure(message) {
     return `Error: [shell-tool-failed] ${text}`;
 }
 
+// A legitimate non-zero exit keeps its `[exit code: N]` marker but must not be
+// CLASSIFIED as a failure downstream — the marker alone would read as an error
+// to classifyResultKind. The explicit-success envelope is the documented
+// channel for output that looks like an error and is not one.
+function _finalizeShellResult(legitExit, text) {
+    return legitExit ? makeToolEnvelope(text, [], { explicitSuccess: true }) : text;
+}
+
 export function _shellFailureStatus(result, timeout) {
     // Prefer the signal reported by the process. `killed` is only a fallback
     // for platforms (notably taskkill on Windows) that close without one.
@@ -324,7 +343,7 @@ export async function executeBashTool(args, workDir, options = {}) {
     // null spec means it is genuinely not installed — surface a clear error with
     // NO silent fallback to the other shell.
     const shellKind = args.shell === 'bash' || args.shell === 'powershell' ? args.shell : 'default';
-    const resolvedSpec = resolveShellFor(shellKind);
+    let resolvedSpec = resolveShellFor(shellKind);
     if (!resolvedSpec) {
         if (shellKind === 'bash') {
             return formatShellToolFailure("Git Bash not found — install Git for Windows or omit shell:'bash'.");
@@ -351,13 +370,52 @@ export async function executeBashTool(args, workDir, options = {}) {
         shellType: resolvedSpec.shellType,
         shellName: resolvedSpec.shell,
     });
-    if (psHygiene.block) return formatShellToolFailure(psHygiene.block);
-    command = psHygiene.command;
+    let shellRescueNote = '';
+    if (psHygiene.block) {
+        // Auto-rescue: the block fired ONLY because the command is written in
+        // bash (unix filter heads, `&&`) and it carries no PowerShell-only
+        // construct — running it in Git Bash is exactly what the caller meant,
+        // byte-for-byte. A mixed command ($env:, cmdlets, `2>$null`) or a
+        // PowerShell-specific violation stays a hard block, and an explicit
+        // shell:'powershell' is never overridden.
+        const bashSpec = psHygiene.bashOnly
+            && shellKind === 'default'
+            && !hasPowerShellOnlySyntax(psHygiene.original ?? command)
+            ? resolveShellFor('bash')
+            : null;
+        if (!bashSpec) return formatShellToolFailure(psHygiene.block);
+        // The MSYS rewrite targets PowerShell; bash gets the original text.
+        command = psHygiene.original ?? command;
+        resolvedSpec = bashSpec;
+        shellRescueNote = "note: bash-only syntax on a PowerShell host — ran it in Git Bash (pass shell:'bash' to make that explicit).";
+    } else {
+        command = psHygiene.command;
+    }
 
     const _execPolicyBlock = checkExecPolicyMessage(command);
     if (_execPolicyBlock) {
         return formatShellToolFailure(_execPolicyBlock);
     }
+    // Inline-script hoisting (sync runs only — a background job would outlive
+    // the temp file). The body is written verbatim and the invocation becomes a
+    // file run, so the host shell never has to carry the script through its
+    // quoting layer. planInlineScriptHoist refuses every case where file
+    // semantics would differ, so this is a transport change only.
+    let _inlineHoistPath = null;
+    if (!runInBackground && args.persistent !== true) {
+        const hoist = planInlineScriptHoist(command);
+        if (hoist) {
+            try {
+                const file = pathJoin(
+                    tmpdir(),
+                    `mixdog-inline-${process.pid}-${Date.now().toString(36)}${hoist.extension}`,
+                );
+                writeFileSync(file, hoist.body, 'utf8');
+                _inlineHoistPath = file;
+                command = hoist.replace(file.replace(/\\/g, '/'));
+            } catch { _inlineHoistPath = null; }
+        }
+    }
 
     // Sleep-chain auto-promotion: a leading `sleep N && …` / `Start-Sleep N; …`
     // used to be DENIED preflight (CC detectBlockedSleepPattern parity).
@@ -448,19 +506,24 @@ export async function executeBashTool(args, workDir, options = {}) {
         { backgroundTasksDisabled: _bgTasksDisabled },
     );
     if (longForegroundHint) return formatShellToolFailure(longForegroundHint);
-    // Auto-background threshold. Reference-CLI parity: sync commands run to
-    // their timeout without any default auto-promotion, so the default is 0
-    // (disabled) for ALL callers. It is an explicit opt-in only: set
-    // MIXDOG_SHELL_AUTO_BACKGROUND_MS (positive ms) to re-enable detaching a
-    // still-running foreground one-shot into a tracked shell-job. When enabled,
-    // the value stays a soft hint clamped below `timeout` so the hard ceiling
-    // remains a separate, later bound. Never applies to run_in_background
-    // (already detached) or persistent sessions (handled far above).
-    const _autoBgEnvMs = Number(process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS);
-    const DEFAULT_AUTO_BACKGROUND_MS = Number.isFinite(_autoBgEnvMs) && _autoBgEnvMs > 0
+    // Main-agent blocking budget. A timeout is the command's total deadline,
+    // not permission to hold the conversation open for that whole duration:
+    // after 15 s a still-running command becomes a tracked background task and
+    // completion is pushed to the owner. Explicit timeouts keep their remaining
+    // deadline after promotion. Never applies to run_in_background (already
+    // detached), persistent sessions, or commands barred from backgrounding.
+    // MIXDOG_SHELL_AUTO_BACKGROUND_MS overrides; an explicit 0 disables.
+    const _autoBgEnvRaw = process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS;
+    const _autoBgEnvMs = Number(_autoBgEnvRaw);
+    const DEFAULT_AUTO_BACKGROUND_MS = (_autoBgEnvRaw != null && String(_autoBgEnvRaw).trim() !== ''
+      && Number.isFinite(_autoBgEnvMs) && _autoBgEnvMs >= 0)
       ? Math.floor(_autoBgEnvMs)
-      : 0;
-    const autoBackgroundMs = (runInBackground || DEFAULT_AUTO_BACKGROUND_MS <= 0)
+      : 15_000;
+    // Gate on backgroundOnTimeout rather than just `runInBackground`: it already
+    // encodes "promotion is available for this command" (not detached, background
+    // tasks enabled, command shape allows it), so the soft threshold can never
+    // promote something the hard timeout would refuse to.
+    const autoBackgroundMs = (!backgroundOnTimeout || DEFAULT_AUTO_BACKGROUND_MS <= 0)
       ? 0
       : Math.min(DEFAULT_AUTO_BACKGROUND_MS, timeout);
 
@@ -507,6 +570,7 @@ export async function executeBashTool(args, workDir, options = {}) {
                     abortSignal: combinedAsyncAbort.signal,
                     label: String(command).replace(/\s+/g, ' ').slice(0, 120),
                     dependency: 'detached',
+                    ownerKey: options?.callerSessionId || options?.sessionId || null,
                 });
                 if (combinedAsyncAbort.signal?.aborted) {
                     throw combinedAsyncAbort.signal.reason || new Error('shell background task cancelled before spawn');
@@ -634,6 +698,10 @@ export async function executeBashTool(args, workDir, options = {}) {
             // tracked background job (unlimited) instead of killing it.
             backgroundOnTimeout,
             promotedTimeoutMs,
+            // Soft/interrupt promotion happens before the foreground cap.
+            // Preserve an explicit total deadline by passing it separately;
+            // omitted-timeout promotions retain the existing unlimited job.
+            backgroundDeadlineMs: hasExplicitTimeout ? totalTimeout : 0,
             // Threaded so an auto-backgrounded foreground job is stamped with
             // the dispatching terminal's claude.exe pid (per-terminal scope).
             clientHostPid: options?.clientHostPid,
@@ -704,7 +772,17 @@ export async function executeBashTool(args, workDir, options = {}) {
         const failureStatus = _shellFailureStatus(result, timeout);
         const { signal, exitCode, shellToolFailed } = failureStatus;
         const benignExitOne = _isBenignSearchExitOne(command, exitCode, signal, stderr);
-        const shellRunFailed = !shellToolFailed && (!!signal || (exitCode !== 0 && exitCode !== null && !benignExitOne));
+        // Legitimate non-zero exit: the command printed its result and ended
+        // with 1 without writing a single byte to stderr (probes, reports,
+        // `git diff --exit-code`-shaped checks). It keeps its `[exit code: 1]`
+        // marker so the caller sees the code, but it is NOT framed as a tool
+        // error and NOT classified as a failure — measured as the dominant
+        // shape among non-zero exits.
+        const legitExit = !shellToolFailed
+            && !benignExitOne
+            && isLegitimateShellExit({ exitCode, signal, stdout, stderr });
+        const shellRunFailed = !shellToolFailed
+            && (!!signal || (exitCode !== 0 && exitCode !== null && !benignExitOne && !legitExit));
         const isReallyErrored = shellToolFailed || shellRunFailed;
         // Filter-swallow rescue: the tee file is ALWAYS consumed (deleted)
         // here; its tail is attached only when the run failed with an empty
@@ -729,8 +807,16 @@ export async function executeBashTool(args, workDir, options = {}) {
         const statusDetail = failureStatus.statusDetail;
         const statusMarker = shellToolFailed
             ? `[shell-tool-failed] ${statusDetail}`
-            : (shellRunFailed ? `[shell-run-failed] ${statusDetail}` : '');
+            : (shellRunFailed ? `[shell-run-failed] ${statusDetail}` : (legitExit ? statusDetail : ''));
         const errorPrefix = isReallyErrored ? 'Error: ' : '';
+        // Three outcomes, three labels: a TOOL error (`[shell-tool-failed]`),
+        // a command that RAN AND FAILED (`Error: [shell-run-failed]`), and a
+        // command that RAN TO COMPLETION and merely ended non-zero. The last
+        // one keeps its exit code but says so in words, so neither the model
+        // nor the failure log treats a finished report as a failure.
+        const completionNote = legitExit
+            ? '\n[completed: the command finished and wrote nothing to stderr; the exit code is its own report, not a tool failure]'
+            : '';
         if (mergeStderr) {
             // Post-exit concatenation. True chunk-level interleaving would
             // require shell-level `2>&1` redirection (bash) or `*>&1`
@@ -740,7 +826,7 @@ export async function executeBashTool(args, workDir, options = {}) {
             // cross-stream interleaving. Acceptable for most diagnostic
             // outputs; flag in shell-command if exact interleaving is required.
             const merged = stdout + stderr;
-            if (statusMarker) return _prependDestructiveWarning(command, errorPrefix + smartMiddleTruncate(`${statusMarker}\n\n${merged || '(no output)'}`) + _rescueNote + _driftNote);
+            if (statusMarker) return _finalizeShellResult(legitExit, _prependDestructiveWarning(command, errorPrefix + smartMiddleTruncate(`${statusMarker}${completionNote}\n\n${merged || '(no output)'}`) + _rescueNote + _driftNote));
             return _prependDestructiveWarning(command, smartMiddleTruncate(merged || '(no output)') + _driftNote);
         }
         const truncatedStdout = smartMiddleTruncate(stdout);
@@ -761,13 +847,17 @@ export async function executeBashTool(args, workDir, options = {}) {
         }
         const warningBlock = [
             wmicRewrite?.note || '',
+            shellRescueNote,
         ].filter(Boolean).join('\n');
         const payload = `${body}${stderrBlock}${spillBlock}${_rescueNote}${_driftNote}`;
-        if (statusMarker) return _prependDestructiveWarning(command, _composeShellFailure(statusMarker, errorPrefix, warningBlock, payload));
+        if (statusMarker) return _finalizeShellResult(legitExit, _prependDestructiveWarning(command, _composeShellFailure(`${statusMarker}${completionNote}`, errorPrefix, warningBlock, payload)));
         return _prependDestructiveWarning(command, warningBlock ? `${warningBlock}\n${payload}` : payload);
     }
     finally {
         combinedBashAbort?.cleanup?.();
+        if (_inlineHoistPath) {
+            try { unlinkSync(_inlineHoistPath); } catch { /* best-effort cleanup */ }
+        }
         if (shellEffects.mutationMode === 'paths') {
             invalidateBuiltinResultCache(shellEffects.paths);
             markCodeGraphDirtyPaths(shellEffects.paths);