mixdog 1.1.0 → 1.1.2

package/src/runtime/agent/orchestrator/session/transcript-restore/tool-result-status.mjs

@@ -291,6 +291,29 @@ export function assignUiDiffFromMessage(target, source) {
   return target;
 }
 
+/** Structured side channel a tool result may carry next to its text (the
+ * Computer Use capability refusal): a stable code plus the capability names.
+ * Anything else is dropped so stored history stays small and predictable. */
+export function toolMetaFromMessage(source) {
+  const meta = source?.toolMeta ?? source?.content?.toolMeta;
+  if (!meta || typeof meta !== 'object' || typeof meta.code !== 'string' || !meta.code) return undefined;
+  const missing = Array.isArray(meta.missing)
+    ? meta.missing.filter((name) => typeof name === 'string' && name)
+    : [];
+  return { code: meta.code, missing };
+}
+
+export function toolMetaPatchFromMessage(source) {
+  const value = toolMetaFromMessage(source);
+  return value === undefined ? {} : { toolMeta: value };
+}
+
+export function assignToolMetaFromMessage(target, source) {
+  const value = toolMetaFromMessage(source);
+  if (value !== undefined && target) target.toolMeta = value;
+  return target;
+}
+
 /** Stored/member records only copy a string uiDiff; other types stay omitted. */
 export function stringUiDiffPatch(value) {
   return typeof value === 'string' ? { uiDiff: value } : {};

package/src/runtime/agent/orchestrator/session/turn-effort.mjs

@@ -0,0 +1,18 @@
+/**
+ * The effort the runtime resolved for the turn in flight: the newest message of
+ * the current turn carrying `meta.effortConfiguration.effort` — a step-judged
+ * tool result (step-auto-effort.mjs markStepEffort) or, before any step, the
+ * turn's own user message (prepareTurnEffortConfiguration). Null when the
+ * turn has no recorded value (auto effort off, or a model without it).
+ */
+export function currentTurnEffort(session) {
+  const live = Array.isArray(session?.liveTurnMessages) ? session.liveTurnMessages : session?.messages;
+  if (!Array.isArray(live)) return null;
+  for (let i = live.length - 1; i >= 0; i--) {
+    const message = live[i];
+    const effort = message?.meta?.effortConfiguration?.effort;
+    if (typeof effort === 'string' && effort) return effort;
+    if (message?.role === 'user') return null;
+  }
+  return null;
+}

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -183,9 +183,7 @@ function splitListedAbsoluteWindowsPaths(value) {
     .trim()
     .replace(/^\[([\s\S]*)\]$/, '$1')
     .replace(/^[\s,;]+|[\s,;]+$/g, '');
-  const pieces = body
-    .split(/[\s,;]+(?=["']?[A-Za-z]:[\\/])/)
-    .map((piece) => piece.replace(/^(["'])(.*)\1$/, '$2'));
+  const pieces = body.split(/[\s,;]+(?=["']?[A-Za-z]:[\\/])/).map((piece) => piece.replace(/^(["'])(.*)\1$/, '$2'));
   return pieces.every((piece) => /^[A-Za-z]:[\\/]/.test(piece) && !/[A-Za-z]:[\\/]/.test(piece.slice(3)))
     ? pieces
     : null;
@@ -448,7 +446,7 @@ function guardGrep(a) {
     }
     if (hasOwn(a, k) && Array.isArray(a[k])) {
       if (a[k].length === 0 || a[k].length > PUBLIC_PATH_BATCH_LIMIT || !a[k].every(isNonEmptyString)) {
-        return `Error: grep arg "${k}" must contain 1-${PUBLIC_PATH_BATCH_LIMIT} non-empty path strings`;
+        return `Error: grep arg "${k}" must contain 1-${PUBLIC_PATH_BATCH_LIMIT} non-empty path strings (${a[k].length} given, max ${PUBLIC_PATH_BATCH_LIMIT})`;
       }
       continue;
     }
@@ -627,10 +625,12 @@ function normalizePublicReadTargets(a) {
     return 'Error: read arg "file_path" must contain at least 1 target';
   }
   const windowValue = (value, fallback) => (value === undefined ? fallback : value);
+  // limit:0 is rejected by the public schema; read it as "no explicit limit".
+  const limitValue = (value, fallback) => (value === 0 ? fallback : windowValue(value, fallback));
   const validOffset = (value) => Number.isSafeInteger(value) && value >= 1;
   const validLimit = (value) => Number.isInteger(value) && value >= 1 && value <= MAX_INT;
   const defaultOffset = windowValue(a.offset, 1);
-  const defaultLimit = windowValue(a.limit, READ_GUARD_DEFAULT_LIMIT);
+  const defaultLimit = limitValue(a.limit, READ_GUARD_DEFAULT_LIMIT);
   if (!validOffset(defaultOffset) || !validLimit(defaultLimit)) {
     return `Error: read ${READ_WINDOW_RANGE_TEXT}`;
   }
@@ -648,7 +648,7 @@ function normalizePublicReadTargets(a) {
       return `Error: read target ${index + 1} must be a path string or {file_path, offset?, limit?}`;
     }
     const offset = windowValue(record.offset, defaultOffset);
-    const limit = windowValue(record.limit, defaultLimit);
+    const limit = limitValue(record.limit, defaultLimit);
     if (!validOffset(offset) || !validLimit(limit)) {
       return `Error: read target ${index + 1} ${READ_WINDOW_RANGE_TEXT}`;
     }
@@ -784,8 +784,11 @@ function guardShell(a) {
   if (unsupported) {
     return `Error: shell arg "${unsupported}" is unsupported; use only command, timeout_ms, and wait_ms`;
   }
-  if (hasOwn(a, 'wait_ms') && (!Number.isInteger(a.wait_ms) || a.wait_ms < 1000 || a.wait_ms > 120000)) {
-    return `Error: shell arg "wait_ms" must be an integer from 1000 to 120000 (got ${describeType(a.wait_ms)})`;
+  // Over-max is an unambiguous "wait as long as allowed"; clamp like the other
+  // saturating integer args instead of failing the call.
+  if (hasOwn(a, 'wait_ms') && Number.isInteger(a.wait_ms) && a.wait_ms > 120000) a.wait_ms = 120000;
+  if (hasOwn(a, 'wait_ms') && (!Number.isInteger(a.wait_ms) || a.wait_ms < 1000)) {
+    return `Error: shell arg "wait_ms" must be an integer from 15000 to 120000, e.g. wait_ms:30000 (got ${JSON.stringify(a.wait_ms)})`;
   }
   if (!hasOwn(a, 'command')) {
     return 'Error: shell requires "command"';

package/src/runtime/agent/orchestrator/tools/builtin/atomic-write.mjs

@@ -95,16 +95,20 @@ function abortReasonOf(signal) {
 
 // The payload lands in a 'wx' temp file: an existing temp file (random
 // collision or a pre-existing symlink at the temp path) is rejected instead of
-// silently truncated. randomBytes(4) keeps collisions astronomically unlikely,
-// but 'wx' makes the guarantee explicit and protects against symlink-attack
-// scenarios on shared tmp dirs.
+// silently truncated. Failed creation owns nothing: cleanup must leave an
+// existing entry alone, including a symlink at the random temporary path.
 async function writeTempFile(tmp, content, { mode, fsync }) {
   let fh = null;
+  let ownsTemp = false;
   try {
     if (payloadByteLength(content) > STREAMING_THRESHOLD_BYTES) {
       // Streaming path: avoid buffering the entire payload through
       // fh.writeFile (which copies into a single Buffer).
       const ws = createWriteStream(tmp, { flags: 'wx', mode });
+      // Stream construction precedes open; only the open event proves ownership.
+      ws.once('open', () => {
+        ownsTemp = true;
+      });
       let source = content; // assume it's a Readable unless it is bytes/text
       if (Buffer.isBuffer(content)) source = Readable.from([content]);
       else if (typeof content === 'string') source = Readable.from([Buffer.from(content, 'utf-8')]);
@@ -117,6 +121,7 @@ async function writeTempFile(tmp, content, { mode, fsync }) {
       }
     } else {
       fh = await fsPromises.open(tmp, 'wx', mode);
+      ownsTemp = true;
       await fh.writeFile(content);
       if (fsync) await fh.sync();
       await fh.close();
@@ -128,7 +133,7 @@ async function writeTempFile(tmp, content, { mode, fsync }) {
     } catch {
       /* already closed */
     }
-    await unlinkQuietly(tmp);
+    if (ownsTemp) await unlinkQuietly(tmp);
     throw writeErr;
   }
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/bashism-rewrite.mjs

@@ -0,0 +1,245 @@
+// Pre-execution rewrite of bash-isms that ALWAYS fail in Windows PowerShell, so
+// the first attempt succeeds instead of costing a failed call and a retry.
+// Same placement and reporting as the wmic rewrite: the caller swaps in
+// `command` and prints `note` above the output.
+//
+// What is rewritten (only outside quotes, here-strings and comments):
+//   <cmd> <<'EOF'\n…\nEOF   → @'\n…\n'@ | <cmd>        (python/python3/py/node only)
+//   2>/dev/null  >/dev/null  &>/dev/null  → 2>$null  >$null  *>$null
+//   </dev/null                                  → removed (the shell's stdin is already at EOF)
+// `| head`/`| tail`/`| wc` are deliberately NOT rewritten: any wrapper that
+// could fall back to a cmdlet changes the streaming semantics of an existing
+// `head`. They only get the failure hint (result-format.mjs).
+//
+// Anything not exactly one of these forms (`<<-`, `cat <<EOF > file`, an
+// expanding unquoted heredoc body, unbalanced quotes, ...) makes the whole
+// command pass through untouched.
+
+const PYTHON_STAGE = /^(?:python3?|py)(?:\.exe)?(?:\s+-[uBsSEIOqbd]+)*(?:\s+-)?$/i;
+const NODE_STAGE = /^node(?:\.exe)?(?:\s+--[\w-]+(?:=[\w.-]+)?)*(?:\s+-)?$/i;
+
+const HEREDOC_OPENER = /^<<-?[ \t]*(?:'([A-Za-z_]\w*)'|"([A-Za-z_]\w*)"|([A-Za-z_]\w*))/;
+
+/** Marks each character 1 when it is live PowerShell code and 0 when it sits in a
+ *  string, here-string, comment or after a backtick. null when the text cannot be
+ *  tokenised with confidence (unterminated string, `$(` inside a double quote). */
+function codeMask(text) {
+  const mask = new Uint8Array(text.length);
+  // Bash heredoc bodies start on the line after their `<<DELIM` opener and are
+  // opaque text (quotes inside them must not be tokenised).
+  const pending = [];
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === '`') {
+      i += 2;
+      continue;
+    }
+    if (ch === '<' && text[i + 1] === '<') {
+      mask[i] = mask[i + 1] = 1;
+      const opener = HEREDOC_OPENER.exec(text.slice(i));
+      if (opener) pending.push(opener[1] || opener[2] || opener[3]);
+      i += 2;
+      continue;
+    }
+    if (ch === '\n' && pending.length) {
+      mask[i++] = 1;
+      for (const delimiter of pending.splice(0)) {
+        for (;;) {
+          if (i >= text.length) return null;
+          const nl = text.indexOf('\n', i);
+          const stop = nl < 0 ? text.length : nl;
+          const isTerminator = text.slice(i, stop).replace(/\r$/, '') === delimiter;
+          i = nl < 0 ? text.length : nl + 1;
+          if (isTerminator) break;
+        }
+      }
+      continue;
+    }
+    if (ch === '<' && text[i + 1] === '#') {
+      const end = text.indexOf('#>', i + 2);
+      if (end < 0) return null;
+      i = end + 2;
+      continue;
+    }
+    if (ch === '#' && (i === 0 || /[\s;({|]/.test(text[i - 1]))) {
+      const end = text.indexOf('\n', i);
+      i = end < 0 ? text.length : end;
+      continue;
+    }
+    if (ch === '@' && (text[i + 1] === "'" || text[i + 1] === '"')) {
+      const quote = text[i + 1];
+      const open = /^[ \t]*\r?\n/.exec(text.slice(i + 2));
+      if (open) {
+        const close = text.indexOf(`\n${quote}@`, i + 2 + open[0].length - 1);
+        if (close < 0) return null;
+        i = close + 3;
+        continue;
+      }
+    }
+    if (ch === "'") {
+      i++;
+      for (;;) {
+        const end = text.indexOf("'", i);
+        if (end < 0) return null;
+        if (text[end + 1] === "'") {
+          i = end + 2;
+          continue;
+        }
+        i = end + 1;
+        break;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      i++;
+      for (;;) {
+        if (i >= text.length) return null;
+        const c = text[i];
+        if (c === '`') {
+          i += 2;
+          continue;
+        }
+        if (c === '$' && text[i + 1] === '(') return null;
+        if (c === '"') {
+          if (text[i + 1] === '"') {
+            i += 2;
+            continue;
+          }
+          i++;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    mask[i++] = 1;
+  }
+  return mask;
+}
+
+// The text with every non-code character replaced by NUL, offsets unchanged, so
+// regexes only ever see live code.
+function codeOnly(text, mask) {
+  let out = '';
+  for (let i = 0; i < text.length; i++) out += mask[i] ? text[i] : '\0';
+  return out;
+}
+
+/** One heredoc → here-string rewrite, or { skip } when the heredoc is not one of
+ *  the exactly-safe shapes. */
+function rewriteOneHeredoc(text, at) {
+  const opener = /^<<(?![<-])[ \t]*(?:'([A-Za-z_]\w*)'|"([A-Za-z_]\w*)"|([A-Za-z_]\w*))/.exec(text.slice(at));
+  if (!opener) return { skip: true };
+  const delimiter = opener[1] || opener[2] || opener[3];
+  const expanding = Boolean(opener[3]);
+  const lineStart = text.lastIndexOf('\n', at - 1) + 1;
+  const lineEnd = text.indexOf('\n', at) < 0 ? text.length : text.indexOf('\n', at);
+  const before = text.slice(lineStart, at);
+  const rest = text.slice(at + opener[0].length, lineEnd).replace(/\r$/, '');
+  if (/['"`$<]/.test(rest) || lineEnd >= text.length) return { skip: true };
+  // The stage is what follows the last live `;` / `&&` on the opener line.
+  const beforeMask = codeMask(before);
+  if (!beforeMask) return { skip: true };
+  let stageFrom = 0;
+  for (let i = 0; i < before.length; i++) {
+    if (!beforeMask[i]) continue;
+    if (before[i] === ';') stageFrom = i + 1;
+    else if (before[i] === '&' && before[i + 1] === '&') stageFrom = ++i + 1;
+    else if (before[i] === '|' || before[i] === '&') return { skip: true };
+  }
+  const stage = before.slice(stageFrom).trim();
+  if (!PYTHON_STAGE.test(stage) && !NODE_STAGE.test(stage)) return { skip: true };
+  // Body: the lines up to the first line that is exactly the delimiter.
+  const bodyStart = lineEnd + 1;
+  let cursor = bodyStart;
+  let termStart = -1;
+  let termEnd = text.length;
+  while (cursor <= text.length) {
+    const nl = text.indexOf('\n', cursor);
+    const lineStop = nl < 0 ? text.length : nl;
+    if (text.slice(cursor, lineStop).replace(/\r$/, '') === delimiter) {
+      termStart = cursor;
+      termEnd = lineStop;
+      break;
+    }
+    if (nl < 0) break;
+    cursor = nl + 1;
+  }
+  if (termStart < 0) return { skip: true };
+  const body = text.slice(bodyStart, termStart).replace(/\r?\n$/, '');
+  // `'@` at a line start would end the here-string early; an unquoted heredoc
+  // body is only literal when bash would expand nothing in it.
+  if (/^'@/m.test(body)) return { skip: true };
+  if (expanding && /[$`]|\\[\\$`\n]|\\$/.test(body)) return { skip: true };
+  const prefix = before.slice(0, stageFrom);
+  const replacement = `${prefix}${prefix && !/\s$/.test(prefix) ? ' ' : ''}@'\n${body}\n'@ | ${stage}${rest ? ` ${rest.trim()}` : ''}`;
+  return {
+    text: text.slice(0, lineStart) + replacement + text.slice(termEnd),
+    note: `[rewritten: "${stage} <<${opener[1] || opener[2] ? `'${delimiter}'` : delimiter}" → "@'…'@ | ${stage}"]`,
+  };
+}
+
+function rewriteHeredocs(text, notes) {
+  let current = text;
+  for (let guard = 0; guard < 20; guard++) {
+    const mask = codeMask(current);
+    if (!mask) return null;
+    let at = -1;
+    for (let i = current.indexOf('<<'); i >= 0; i = current.indexOf('<<', i + 1)) {
+      if (mask[i]) {
+        at = i;
+        break;
+      }
+    }
+    if (at < 0) return current;
+    const done = rewriteOneHeredoc(current, at);
+    if (done.skip) return null;
+    notes.push(done.note);
+    current = done.text;
+  }
+  return null;
+}
+
+const DEVNULL_REDIRECT = /(>>?)[ \t]*\/dev\/null(?![\w/.\\-])/g;
+const DEVNULL_STDIN = /[ \t]*(?<!<)<[ \t]*\/dev\/null(?![\w/.\\-])/g;
+
+// All edits are computed on the code-only view and applied back to front.
+function collectEdits(text, mask, notes) {
+  const code = codeOnly(text, mask);
+  const edits = [];
+  for (const m of code.matchAll(DEVNULL_REDIRECT)) {
+    // `&>` (both streams) and a 1>/2> stream prefix belong to the redirection.
+    const before = code[m.index - 1];
+    const prefixed = before === '&' || ((before === '1' || before === '2') && !/\w/.test(code[m.index - 2] ?? ''));
+    const start = prefixed ? m.index - 1 : m.index;
+    let streamPrefix = '';
+    if (prefixed) streamPrefix = before === '&' ? '*' : before;
+    const next = `${streamPrefix}${m[1]}$null`;
+    edits.push({ start, end: m.index + m[0].length, text: next });
+    notes.push(`[rewritten: "${text.slice(start, m.index + m[0].length)}" → "${next}"]`);
+  }
+  for (const m of code.matchAll(DEVNULL_STDIN)) {
+    edits.push({ start: m.index, end: m.index + m[0].length, text: '' });
+    notes.push('[rewritten: "</dev/null" → "" (stdin is already at EOF)]');
+  }
+  return edits.sort((a, b) => b.start - a.start);
+}
+
+/** `{ command, note }` when something was rewritten, else null. Callers gate on
+ *  Windows + a PowerShell shell; nothing here inspects the platform. */
+export function rewritePowerShellBashisms(command) {
+  const original = typeof command === 'string' ? command : '';
+  if (!original.includes('/dev/null') && !original.includes('<<')) return null;
+  const notes = [];
+  const text = rewriteHeredocs(original, notes);
+  if (text === null) return null;
+  const mask = codeMask(text);
+  if (!mask) return null;
+  let out = text;
+  for (const edit of collectEdits(text, mask, notes)) {
+    out = out.slice(0, edit.start) + edit.text + out.slice(edit.end);
+  }
+  if (out === original) return null;
+  return { command: out, note: [...new Set(notes)].join('\n') };
+}

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/command-preflight.mjs

@@ -2,6 +2,7 @@ import { maybeRewriteWmicProcessCommand } from '../../shell-policy.mjs';
 import { checkExecPolicyMessage } from '../../bash-policy-scan.mjs';
 import { preflightPowerShellHygiene } from '../shell-analysis.mjs';
 import { resolveShellFor } from '../shell-runtime.mjs';
+import { rewritePowerShellBashisms } from './bashism-rewrite.mjs';
 import { formatShellToolFailure } from './result-format.mjs';
 
 // Policy + shell-specific rewrites before any shell dispatch. Returns either
@@ -40,7 +41,18 @@ export function prepareShellCommand(args) {
   if (psHygiene.block) return { failure: formatShellToolFailure(psHygiene.block) };
   command = psHygiene.command;
 
+  // Bash-isms that always fail in Windows PowerShell (heredoc to a script
+  // interpreter, /dev/null redirections, `| head/tail -N`, `| wc -l`) are
+  // rewritten before the first run; same shell gate and reporting as wmic.
+  // Effects and result analysis keep reading the command as the caller wrote it.
+  const analysisCommand = command;
+  const bashismRewrite =
+    process.platform === 'win32' && resolvedSpec.shellType === 'powershell' && !wmicRewrite?.command
+      ? rewritePowerShellBashisms(command)
+      : null;
+  if (bashismRewrite) command = bashismRewrite.command;
+
   const execPolicyBlock = checkExecPolicyMessage(command);
   if (execPolicyBlock) return { failure: formatShellToolFailure(execPolicyBlock) };
-  return { command, resolvedSpec, wmicRewrite };
+  return { command, analysisCommand, resolvedSpec, wmicRewrite, bashismRewrite };
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/completed-result.mjs

@@ -10,6 +10,7 @@ import {
   SURVIVING_DESCENDANTS_WARNING,
   _composeShellFailure,
   _finalizeShellResult,
+  _powershellBashismHint,
   _placeDestructiveWarningsAfterStatus,
   _prependDestructiveWarning,
   _shellFailureStatus,
@@ -152,11 +153,12 @@ export function renderCompletedResult({
     losslessCompaction
   )}${rescueNote}`;
   if (outcome.statusMarker) {
+    const bashismHint = commandExitedNonzero || isReallyErrored ? _powershellBashismHint(analysisCommand, stderr) : '';
     const failure = _composeShellFailure(
       `${outcome.statusMarker}${outcome.outcomeNote}`,
       isReallyErrored ? 'Error: ' : '',
       warningBlock,
-      payload
+      bashismHint ? `${payload}\n${bashismHint}` : payload
     );
     return _finalizeShellResult(completedExit, _placeDestructiveWarningsAfterStatus(command, failure));
   }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/invocation-plan.mjs

@@ -2,12 +2,12 @@ import { wrapCommandWithSnapshot } from '../../shell-snapshot.mjs';
 import { buildPowerShellFilterTeePlan } from '../shell-analysis.mjs';
 import { normalizeErrorMessage } from '../path-diagnostics.mjs';
 import { planDirectExeSpawn } from '../shell-direct-exe.mjs';
+import { POWERSHELL_UTF8_PREFIX } from '../../../../../shared/shell-display.mjs';
 import { buildShellSpawnEnv } from './spawn-env.mjs';
 import { formatShellToolFailure } from './result-format.mjs';
 
 function prefixPowerShellUtf8(command) {
-  const prefix =
-    '[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $OutputEncoding=[System.Text.Encoding]::UTF8;';
+  const prefix = POWERSHELL_UTF8_PREFIX;
   const text = String(command || '');
   return text.trimStart().startsWith(prefix) ? text : `${prefix}\n${text}`;
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/result-format.mjs

@@ -114,6 +114,55 @@ export function _exitClassDiagnostic(exitCode) {
   return '';
 }
 
+const _PS_UNIX_EQUIVALENTS = {
+  head: 'Select-Object -First N',
+  tail: 'Select-Object -Last N',
+  wc: 'Measure-Object -Line',
+  grep: 'Select-String (or the grep tool)',
+  sed: 'the edit tool',
+  awk: 'ForEach-Object / the edit tool',
+  pgrep: 'Get-Process -Name <name>',
+};
+
+// One-line PowerShell equivalent for a failed command whose stderr is the
+// shell's own "bash-ism" error. Only ever appended to an already failed run.
+// Detection is locale-independent: the command text plus the error record's
+// structural markers, never the localized message prose. PowerShell keeps these
+// in English under any UI language: the `ParserError:` header or the
+// `RedirectionNotSupported`/`MissingFileSpecification` ids for parse failures,
+// and for a missing command either `ObjectNotFound: (name:String)` (detailed
+// view) or a `name:` header followed by the quoted `'name'` (concise view).
+function _missingCommandNames(err) {
+  const names = /\bCommandNotFoundException\b/.test(err)
+    ? [...err.matchAll(/\bObjectNotFound: \(([\w.-]+):String\)/g)].map((m) => m[1])
+    : [];
+  for (const m of err.matchAll(/^([\w.-]+): ?\r?\n?((?:.*\r?\n){0,4})/gm)) {
+    if (m[2].includes(`'${m[1]}'`)) names.push(m[1]);
+  }
+  return names;
+}
+
+export function _powershellBashismHint(command, stderr) {
+  if (process.platform !== 'win32') return '';
+  const err = String(stderr || '');
+  const cmd = String(command || '');
+  const parserRejected = /^ParserError:|\b(?:RedirectionNotSupported|MissingFileSpecification)\b/m.test(err);
+  if (/<\s*\/dev\/null/.test(cmd) && parserRejected) {
+    return 'hint: PowerShell has no `<` redirection; drop </dev/null.';
+  }
+  if (/<<-?\s*['"]?\w+/.test(cmd) && parserRejected) {
+    return "hint: PowerShell has no heredoc; use @'\\n…\\n'@ | python - (or node -).";
+  }
+  if (/2>\s*\/dev\/null/.test(cmd) && /dev\\null/i.test(err)) return 'hint: use 2>$null in PowerShell.';
+  for (const name of _missingCommandNames(err)) {
+    const key = name.toLowerCase();
+    if (Object.hasOwn(_PS_UNIX_EQUIVALENTS, key) && new RegExp(`(^|[\\s|;&(])${key}(\\s|$)`).test(cmd)) {
+      return `hint: no \`${key}\` in PowerShell; use ${_PS_UNIX_EQUIVALENTS[key]}.`;
+    }
+  }
+  return '';
+}
+
 export function _composeShellFailure(statusMarker, errorPrefix, warningBlock, payload) {
   return `${errorPrefix}${statusMarker}${warningBlock ? `\n${warningBlock}` : ''}\n\n${payload}`;
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -63,10 +63,10 @@ export async function executeBashTool(args, workDir, options = {}) {
   const bashWorkDir = workDir;
   const prepared = prepareShellCommand(args);
   if (prepared.failure) return prepared.failure;
-  const { resolvedSpec, wmicRewrite } = prepared;
+  const { resolvedSpec, wmicRewrite, bashismRewrite } = prepared;
   // Effects are analyzed on the command as the caller meant it, before the
   // hoist turns it into a file run.
-  const analysisCommand = prepared.command;
+  const analysisCommand = prepared.analysisCommand;
   const hoisted = hoistInlineScript(prepared.command, resolvedSpec.shellType);
   const command = hoisted.command;
 
@@ -138,7 +138,7 @@ export async function executeBashTool(args, workDir, options = {}) {
       ...rendering,
       analysisCommand,
       timeout: deadlines.timeout,
-      rewriteNote: wmicRewrite?.note || '',
+      rewriteNote: [wmicRewrite?.note, bashismRewrite?.note].filter(Boolean).join('\n'),
     });
   } finally {
     combinedAbort?.cleanup?.();

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -30,7 +30,7 @@ export const TASK_WAIT_TIMEOUT_MIN_MS = 10_000;
 export const TASK_WAIT_TIMEOUT_MAX_MS = 600_000;
 const _shellSyntaxCheat =
   process.platform === 'win32'
-    ? ' PowerShell: ; between independent commands, if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } between dependent ones; single-quote inline scripts (no nested double quotes); a literal here-string for multiline input; /c/→C:\\; $PID is reserved.'
+    ? " PowerShell: ; between independent commands, if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } between dependent ones; no heredoc, </dev/null or | head/tail/wc (Select-Object -First/-Last); multiline python/node via @'…'@ | python - (node -); 2>$null; /c/→C:\\; $PID is reserved."
     : ' Bash: chain dependent commands with &&; multiline input via a quoted heredoc delimiter, not extra quoting/escape layers.';
 // Process-stable switch used to describe foreground-only execution accurately.
 const _shellBackgroundDisabled = envFlag('MIXDOG_SHELL_DISABLE_BACKGROUND_TASKS');
@@ -146,7 +146,7 @@ export const BUILTIN_TOOLS = [
       openWorldHint: true,
       compressible: true,
     },
-    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 15s foreground window (not a timeout; wait_ms extends it up to 120s for one call, e.g. a test suite), unfinished work continues under task_id; use task wait, not read polling. If no execution slot frees within the admission wait, the command is queued as a background task with a task_id.'}`,
+    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 15s foreground window (not a timeout; wait_ms extends it up to 120s for one call, e.g. a test suite), unfinished work continues under task_id; use task wait, not read polling. If no execution slot frees within the admission wait, the command is queued as a background task with a task_id. Dev servers/watchers: pass timeout_ms or stop them with task cancel when done.'}`,
     inputSchema: {
       type: 'object',
       properties: {
@@ -232,8 +232,7 @@ export const BUILTIN_TOOLS = [
       properties: {
         pattern: {
           anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, maxItems: 10 }],
-          description:
-            'Ripgrep regex(es); escape literal metacharacters. Invalid regex is reported, never reinterpreted.',
+          description: 'Ripgrep regex(es); escape literal metacharacters.',
         },
         path: {
           anyOf: [
@@ -241,7 +240,7 @@ export const BUILTIN_TOOLS = [
             { type: 'array', minItems: 1, maxItems: PUBLIC_PATH_BATCH_LIMIT, items: { type: 'string' } },
           ],
           description:
-            'Plain file/directory scopes; omit for Project root. Every pattern searches every path; pattern/path pairs need separate calls. Missing scopes are reported, never widened.',
+            'Plain file/directory scopes; omit for Project root. Every pattern searches every path; pattern/path pairs need separate calls.',
         },
         glob: {
           type: 'string',
@@ -331,7 +330,7 @@ export const BUILTIN_TOOLS = [
       compressible: true,
     },
     description:
-      'Fuzzy filename/directory path lookup; returns paths only. Only when the target path is unknown and cannot be directly resolved but a fragment is known; general discovery: glob. Never send an empty query.',
+      'Fuzzy filename/directory path lookup; returns paths only. Only when the target path is unknown and cannot be directly resolved but a fragment is known; general discovery: glob.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -370,7 +369,10 @@ export const BUILTIN_TOOLS = [
           description: 'Known directory; defaults to the current Project.',
         },
         hidden: { type: 'boolean', description: 'Include dotfiles.' },
-        meta: { type: 'boolean', description: 'Per-entry size bytes, UTC mtime, octal mode; text files also get a line count.' },
+        meta: {
+          type: 'boolean',
+          description: 'Per-entry size bytes, UTC mtime, octal mode; text files also get a line count.',
+        },
         limit: {
           type: 'integer',
           minimum: 0,