mixdog 1.1.0 → 1.1.2

package/src/runtime/agent/orchestrator/tools/builtin/external-tool-adapters.mjs

@@ -16,7 +16,13 @@ import { dirname } from 'node:path';
 import { atomicWrite, symlinkWriteTarget } from './atomic-write.mjs';
 import { fileVersion } from './file-version.mjs';
 import { assertPathsReachable } from './fs-reachability.mjs';
-import { normalizeInputPath, resolveAgainstCwd, normalizeOutputPath, toDisplayPath } from './path-utils.mjs';
+import {
+  normalizeInputPath,
+  resolveAgainstCwd,
+  normalizeOutputPath,
+  toDisplayPath,
+  urlAsPathMessage,
+} from './path-utils.mjs';
 import {
   isUncPath,
   isWindowsDevicePath,
@@ -123,6 +129,8 @@ function guardRealTarget(fullPath) {
 async function resolveTargetPath(args, workDir) {
   const raw = args?.path ?? args?.file_path;
   if (typeof raw !== 'string' || raw.length === 0) return null;
+  const urlMessage = urlAsPathMessage(raw);
+  if (urlMessage) return { error: `Error: ${urlMessage}` };
   const norm = normalizeInputPath(raw);
   const guardErr = guardWritePath(norm);
   if (guardErr) return { error: guardErr };
@@ -474,7 +482,21 @@ function readEditTextForDisplay(fullPath, enc) {
 
 // ── str_replace: the edit target record + the steps that mutate it ──────────
 
-const SAME_STRINGS_ERROR = 'Error: old_string and new_string are exactly the same';
+const SAME_STRINGS_ERROR =
+  'Error: old_string and new_string are exactly the same — no change needed; the file may already contain it, re-read before retrying';
+
+// 1-based line numbers where oldStr occurs in content (first 8), for the
+// non-unique-match error.
+function matchLineHint(content, oldStr) {
+  const lines = [];
+  let total = 0;
+  for (let at = content.indexOf(oldStr); at !== -1; at = content.indexOf(oldStr, at + Math.max(1, oldStr.length))) {
+    total += 1;
+    if (lines.length < 8) lines.push(content.slice(0, at).split('\n').length);
+  }
+  if (!lines.length) return '';
+  return ` at lines ${lines.join(', ')}${total > lines.length ? ', …' : ''}`;
+}
 
 function targetSnapshot(statBefore) {
   return statBefore ? { exists: true, ...fileVersion(statBefore) } : { exists: false };
@@ -635,7 +657,7 @@ async function applyEditInProcess(edit, oldStr, editPlan, replaceAll) {
   if (occurrences > 1 && !replaceAll) {
     const message = `old_string found ${occurrences} times`;
     return (
-      `Error: edit failed (${message}; pass replace_all:true or extend old_string)` +
+      `Error: edit failed (${message}${matchLineHint(content, oldStr)}; pass replace_all:true or extend old_string)` +
       formatEditFailureExcerpt(content, oldStr, message)
     );
   }
@@ -675,7 +697,10 @@ async function applyEditNative(edit, oldStr, newStr, editPlan, replaceAll) {
     const message = err?.message || String(err);
     if (/old_string (?:not found|found \d+ times)/i.test(message)) {
       const latest = readEditTextForDisplay(fullPath, fileEnc) ?? content;
-      return `Error: edit failed (${message})${formatEditFailureExcerpt(latest, oldStr, message)}`;
+      const hinted = /found \d+ times/i.test(message)
+        ? message.replace(/(found \d+ times)/i, `$1${matchLineHint(latest, oldStr)}`)
+        : message;
+      return `Error: edit failed (${hinted})${formatEditFailureExcerpt(latest, oldStr, message)}`;
     }
     throw err;
   }
@@ -709,10 +734,37 @@ async function requiresInProcessEdit(edit, editPlan) {
   );
 }
 
+// Models trained on other CLIs send `old_str`/`new_str`. An alias is honoured
+// only when the canonical key is absent; both present with different values is
+// ambiguous and rejected.
+const STR_REPLACE_ALIASES = [
+  ['old_string', 'old_str'],
+  ['new_string', 'new_str'],
+];
+
+function resolveStrReplaceArgs(args) {
+  const out = {};
+  for (const [canonical, alias] of STR_REPLACE_ALIASES) {
+    const hasCanonical = args?.[canonical] !== undefined;
+    const hasAlias = args?.[alias] !== undefined;
+    if (hasCanonical && hasAlias && args[canonical] !== args[alias]) {
+      return {
+        error: `Error: edit received both ${canonical} and ${alias} with different values; pass only ${canonical}`,
+      };
+    }
+    out[canonical] = hasCanonical ? args[canonical] : args?.[alias];
+  }
+  return out;
+}
+
 async function adaptStrReplace(args, workDir, options) {
-  let oldStr = args?.old_string;
-  let newStr = args?.new_string;
-  if (typeof oldStr !== 'string' || typeof newStr !== 'string') return null;
+  const resolved = resolveStrReplaceArgs(args);
+  if (resolved.error) return resolved.error;
+  let oldStr = resolved.old_string;
+  let newStr = resolved.new_string;
+  if (typeof oldStr !== 'string' || typeof newStr !== 'string') {
+    return `Error: edit requires string old_string and new_string (got keys: ${Object.keys(args).join(', ')})`;
+  }
   if (oldStr === newStr) return SAME_STRINGS_ERROR;
   const replaceAll = args?.replace_all === true || String(args?.replace_all || '').toLowerCase() === 'true';
   const target = await resolveTargetPath(args, workDir);
@@ -729,7 +781,8 @@ async function adaptStrReplace(args, workDir, options) {
   if (read.error) return read.error;
   const edit = { fullPath, workDir, options, ...read };
   if (oldStr.length === 0) {
-    if (edit.content.length > 0) return `Error: cannot create ${fullPath}: file already exists and is not empty`;
+    if (edit.content.length > 0)
+      return `Error: cannot create ${fullPath}: file exists: to replace it entirely pass its current content as old_string (read it first); to change part, pass that part as old_string with the replacement as new_string`;
     const stale = await commitEdit(edit, {
       bytes: encodeEditContent(newStr, edit.fileEnc),
       after: newStr,

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -200,10 +200,16 @@ function unwrapQuotedCommand(command) {
 
 function parseCommand(rawCommand, workDir) {
   const command = unwrapQuotedCommand(rawCommand);
-  if (commandHasShellSyntax(command))
+  if (commandHasShellSyntax(command)) {
+    // commandHasShellSyntax already skips quoted text; the pipe hint follows
+    // only when the rejected command really has an unquoted `|`.
+    const unquoted = command.replace(/"(?:\\.|[^"\\])*"|'[^']*'/g, '');
     throw new Error(
-      'git command must not contain shell operators or substitution; multiple commands belong in the command array'
+      `git command must not contain shell operators or substitution; multiple commands belong in the command array.${
+        unquoted.includes('|') ? ' For | head/tail use output_limit, for | grep use the grep tool' : ''
+      }`
     );
+  }
   const tokens = tokenizeDirectArgv(command);
   if (!tokens?.length || !/(^|[\\/])git(?:\.exe)?$/i.test(tokens[0])) {
     throw new Error('command must begin with git');
@@ -802,6 +808,23 @@ function splitChainedGitCommands(command) {
 // ("status --short") gets it instead of a rejection. Only whole submitted
 // commands are prefixed; a `&&` piece after the first still has to be a full
 // git command, so non-git chain segments stay refused.
+// A JSON-stringified string[] ('["git status","git log"]') for an array param.
+// No git command or change id starts with `[`, so this never reinterprets a
+// call that could have worked.
+function parseStringifiedArray(value) {
+  if (typeof value !== 'string') return value;
+  const text = value.trim();
+  if (!text.startsWith('[') || !text.endsWith(']')) return value;
+  try {
+    const parsed = JSON.parse(text);
+    return Array.isArray(parsed) && parsed.length > 0 && parsed.every((item) => typeof item === 'string')
+      ? parsed
+      : value;
+  } catch {
+    return value;
+  }
+}
+
 function withGitPrefix(command) {
   if (typeof command !== 'string') return command;
   const text = String(unwrapQuotedCommand(command)).trim();
@@ -813,10 +836,12 @@ function withGitPrefix(command) {
 export async function executeGitTool(rawInput, workDir, options = {}) {
   if (!rawInput || typeof rawInput !== 'object' || Array.isArray(rawInput))
     return fail('git requires an arguments object');
+  const rawCommand = parseStringifiedArray(rawInput.command);
   const input = {
     ...rawInput,
-    command: Array.isArray(rawInput.command) ? rawInput.command.map(withGitPrefix) : withGitPrefix(rawInput.command),
+    command: Array.isArray(rawCommand) ? rawCommand.map(withGitPrefix) : withGitPrefix(rawCommand),
   };
+  if (rawInput.change_ids !== undefined) input.change_ids = parseStringifiedArray(rawInput.change_ids);
   if (rawInput.command === undefined) delete input.command;
   const action = input.action ?? 'command';
   if (action === 'stage') {

package/src/runtime/agent/orchestrator/tools/builtin/path-utils.mjs

@@ -1,6 +1,7 @@
 import { homedir } from 'node:os';
-import { isAbsolute, relative, resolve } from 'node:path';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { realpath } from 'node:fs/promises';
+import { existsSync, realpathSync } from 'node:fs';
 import { isWSL } from '../../../../shared/wsl.mjs';
 
 // Restore the on-disk casing of a path (win32 only). rg relativizes candidate
@@ -48,6 +49,13 @@ function windowsPathToPosixPath(winPath) {
   return winPath;
 }
 
+// http(s):// URLs are not file paths; the generic path guards would reject
+// them with a misleading ADS/trailing-dot message. Returns an error message or null.
+export function urlAsPathMessage(p) {
+  if (typeof p !== 'string' || !/^\s*https?:\/\//i.test(p)) return null;
+  return 'this is a URL; use web_fetch';
+}
+
 export function normalizeInputPath(p) {
   if (typeof p !== 'string') return p;
   // Trim leading/trailing whitespace — LLMs intermittently emit paths with
@@ -68,6 +76,10 @@ export function normalizeInputPath(p) {
     const looksUnc = out.startsWith('//');
     if (looksPosixDrive || looksCygdrive || looksWsl || looksUnc) {
       out = posixPathToWindowsPath(out);
+    } else if (/^\/[a-zA-Z]:[\\/]/.test(out)) {
+      // `/C:/x/y` or `/C:\x\y`: a stray leading slash before a drive letter.
+      // Left as-is, the guard reads `C:` as a component carrying an NTFS ADS colon.
+      out = `${out[1]}:\\${out.slice(4).replace(/\//g, '\\')}`;
     }
   } else if (isWSL()) {
     // Reverse direction: a Windows-style drive path from the host maps to
@@ -323,6 +335,66 @@ function compactReadRangeTuple(value) {
   };
 }
 
+const JOINED_PATH_KEYS = { read: ['path', 'file_path'], grep: ['path', 'root'], glob: ['path', 'root'] };
+const JOINED_PATH_LIMIT = 10;
+
+// One string that joins several paths with commas/whitespace. A string that
+// is itself an existing path is left alone (so `C:\Program Files\x` works);
+// otherwise, when EVERY piece exists, it becomes a path array. Anything else
+// is left for the normal not-found error (which carries the array hint).
+// A split never widens scope: every piece must resolve strictly INSIDE the
+// session working directory (the project root). `.`, `..`, the directory
+// itself, its ancestors and anything outside it keep the string unsplit and
+// return the array hint instead.
+// Residual ambiguity (accepted): a missing filename that contains spaces or
+// commas, whose pieces all happen to exist as separate in-project paths, is
+// read as those pieces rather than reported missing.
+// Returns an error message when the split is refused or exceeds the batch
+// limit, else null.
+export function splitJoinedPathScopes(toolName, args, workDir) {
+  const keys = JOINED_PATH_KEYS[toolName];
+  if (!keys || !args || typeof args !== 'object' || Array.isArray(args)) return null;
+  const exists = (p) => {
+    try {
+      return existsSync(resolveAgainstCwd(normalizeInputPath(p), workDir));
+    } catch {
+      return false;
+    }
+  };
+  // Containment is judged on REAL targets: a symlink/junction inside the
+  // directory that points outside it is outside.
+  const realOrNull = (p) => {
+    try {
+      return realpathSync.native(p);
+    } catch {
+      return null;
+    }
+  };
+  const realRoot = realOrNull(resolve(workDir));
+  const strictlyInside = (p) => {
+    const piece = normalizeInputPath(p);
+    if (piece === '.' || piece === '..' || !realRoot) return false;
+    const target = realOrNull(resolveAgainstCwd(piece, workDir));
+    if (!target) return false;
+    const rel = relative(realRoot, target);
+    return Boolean(rel) && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+  };
+  for (const key of keys) {
+    const value = args[key];
+    if (typeof value !== 'string' || !/[\s,]/.test(value.trim()) || exists(value)) continue;
+    const pieces = value.split(/[\s,]+/).filter(Boolean);
+    if (pieces.length < 2 || !pieces.every(exists)) continue;
+    if (!pieces.every(strictlyInside)) {
+      return `Error: ${toolName} arg "${key}" joins several paths in one string, and one is ".", "..", a parent of the working directory or outside it, so it is not split automatically. To pass several paths, send an array (path[]), not a comma- or space-joined string.`;
+    }
+    if (pieces.length > JOINED_PATH_LIMIT) {
+      return `Error: ${toolName} arg "${key}" joins ${pieces.length} paths in one string (${pieces.length} given, max ${JOINED_PATH_LIMIT}); split or pass the parent directory.`;
+    }
+    args[key] = pieces;
+  }
+  return null;
+}
+
 export function coerceReadFamilyPathArg(path) {
   // A path string names exactly one operand. Filesystem contents must not
   // change its meaning into a batch, repaired JSON, or another filename.

package/src/runtime/agent/orchestrator/tools/builtin/read-single-guards.mjs

@@ -6,7 +6,7 @@
  * none of them opens a body.
  */
 import * as fsPromises from 'node:fs/promises';
-import { buildNotFoundHint, finalizeReadFamilyEnoentTail } from './search-path-diagnostics.mjs';
+import { appendNotFoundCwdNote, buildNotFoundHint, finalizeReadFamilyEnoentTail } from './search-path-diagnostics.mjs';
 
 const GUARD_REASON = {
   // R1: UNC / SMB share (\\server\share, //server/share). Reading these on
@@ -152,7 +152,7 @@ export function readNotFoundResponse(err, { fullPath, filePath, workDir }, helpe
   const { findSimilarFile, normalizeErrorMessage, normalizeOutputPath } = helpers;
   const similar = findSimilarFile(fullPath);
   let hint = similar
-    ? ` Did you mean "${normalizeOutputPath(similar)}"?`
+    ? appendNotFoundCwdNote(` Did you mean "${normalizeOutputPath(similar)}"?`, workDir, err?.code)
     : buildNotFoundHint(workDir, fullPath, 'Read', err?.code);
   hint = finalizeReadFamilyEnoentTail(hint, filePath, err?.code);
   const safeMsg = normalizeErrorMessage(err instanceof Error ? err.message : String(err), workDir);

package/src/runtime/agent/orchestrator/tools/builtin/read-tool.mjs

@@ -8,7 +8,7 @@
  */
 import { executeSingleReadTool } from './read-single-tool.mjs';
 import { readPathStringGuardError } from './read-open.mjs';
-import { coerceReadFamilyPathArg } from './path-utils.mjs';
+import { coerceReadFamilyPathArg, urlAsPathMessage } from './path-utils.mjs';
 import { readIoAdmission } from '../../../../shared/tool-workload-gates.mjs';
 import { currentToolExecutionOwner } from '../../../../shared/tool-execution-owner.mjs';
 import { readReachPreflight } from './read-tool/reach-preflight.mjs';
@@ -113,6 +113,8 @@ async function executeReadToolBody(
   const { normalizeInputPath, normaliseReadLineWindowArgs } = helpers;
   applyFilePathAlias(args);
   args.path = coerceReadFamilyPathArg(args.path);
+  const urlMessage = urlAsPathMessage(args.path);
+  if (urlMessage) return `Error: ${urlMessage}`;
   // Reachability preflight up front (all shapes) — before
   // readPathStringGuardError / image stat.
   // options._skipReachPreflight: set only by the batch dispatcher on its

package/src/runtime/agent/orchestrator/tools/builtin/search-grep-tool.mjs

@@ -7,7 +7,12 @@ import {
   normalizeOutputPath,
   trueCasePath,
 } from './path-utils.mjs';
-import { _suggestIndexedPaths, buildNotFoundHint, finalizeReadFamilyEnoentTail } from './search-path-diagnostics.mjs';
+import {
+  _suggestIndexedPaths,
+  appendNotFoundCwdNote,
+  buildNotFoundHintBody,
+  finalizeReadFamilyEnoentTail,
+} from './search-path-diagnostics.mjs';
 import { buildGrepCacheKey, buildGrepRgArgs } from './search-builders.mjs';
 import { runRg, runRgWindowedLines } from './native-search-runner.mjs';
 import { markScopedCacheIncomplete, markScopedCacheUnsafe } from '../../session/cache/scoped-cache-outcome.mjs';
@@ -133,9 +138,15 @@ async function runCachedGrepSearch(request) {
 
   return await runScopedSearchInFlight(
     cacheKey,
-    ({ signal, scopedCacheOutcome }) => runGrepSearch({
-      ...request, cacheKey, options: { ...options, scopedCacheOutcome },
-    }, signal),
+    ({ signal, scopedCacheOutcome }) =>
+      runGrepSearch(
+        {
+          ...request,
+          cacheKey,
+          options: { ...options, scopedCacheOutcome },
+        },
+        signal
+      ),
     { signal: options?.signal || options?.abortSignal || null, scopes: [grepResolvedPath] },
     options?.scopedCacheOutcome
   );
@@ -200,9 +211,9 @@ async function runGrepSearch(request, sharedSignal) {
 
 async function grepMissingPathResult({ workDir, grepResolvedPath, searchPath, executeChildBuiltinTool }, err) {
   const msg = `Error: path does not exist: ${normalizeOutputPath(grepResolvedPath)} (${err?.code || 'ENOENT'})`;
-  let hint = buildNotFoundHint(workDir, grepResolvedPath, 'Search', err?.code, {});
+  let hint = buildNotFoundHintBody(workDir, grepResolvedPath, 'Search', err?.code, {});
   if (!hint) hint = await _suggestIndexedPaths(grepResolvedPath, executeChildBuiltinTool, workDir);
-  return msg + finalizeReadFamilyEnoentTail(hint, searchPath, err?.code);
+  return msg + finalizeReadFamilyEnoentTail(appendNotFoundCwdNote(hint, workDir, err?.code), searchPath, err?.code);
 }
 
 // Per-call search scope on top of the resolved request: the stat, the

package/src/runtime/agent/orchestrator/tools/builtin/search-path-diagnostics.mjs

@@ -152,10 +152,10 @@ function nearestExistingParentRel(workDir, missingPath) {
 function spaceJoinedPathHint(requestedPath) {
   if (typeof requestedPath !== 'string') return '';
   const trimmed = requestedPath.trim();
-  if (!/\s/.test(trimmed)) return '';
-  const segments = trimmed.split(/\s+/).filter(Boolean);
+  if (!/[\s,]/.test(trimmed)) return '';
+  const segments = trimmed.split(/[\s,]+/).filter(Boolean);
   if (segments.length < 2) return '';
-  return ' Pass multiple scopes as path[] array (not a space-joined string).';
+  return ' To pass several paths, send an array (path[]), not a comma- or space-joined string.';
 }
 
 function appendEnoentFindNudge(text = '') {
@@ -167,16 +167,34 @@ function appendEnoentFindNudge(text = '') {
 
 export function finalizeReadFamilyEnoentTail(hint, requestedPath, errCode = 'ENOENT') {
   if (!NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return String(hint || '');
-  return appendEnoentFindNudge(String(hint || '') + spaceJoinedPathHint(requestedPath));
+  const multiPathHint = spaceJoinedPathHint(requestedPath);
+  // A multi-path-looking input is not a basename to locate; the array hint wins.
+  if (multiPathHint) return String(hint || '') + multiPathHint;
+  return appendEnoentFindNudge(String(hint || ''));
+}
+
+// The base the missing relative path was resolved against (a `cd` in an earlier
+// shell call never moves it), appended to every not-found hint, empty or not.
+export function appendNotFoundCwdNote(hint, workDir, errCode = 'ENOENT') {
+  if (!workDir || !NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return hint;
+  return `${hint} (relative paths resolve from ${normalizeOutputPath(workDir)})`;
 }
 
 export function buildNotFoundHint(workDir, missingPath, actionVerb, errCode = 'ENOENT', cache = null) {
+  return appendNotFoundCwdNote(
+    buildNotFoundHintBody(workDir, missingPath, actionVerb, errCode, cache),
+    workDir,
+    errCode
+  );
+}
+
+export function buildNotFoundHintBody(workDir, missingPath, actionVerb, errCode = 'ENOENT', cache = null) {
   if (!NOT_FOUND_CODES.has(String(errCode || 'ENOENT'))) return '';
   // `C:tmpsmp` shape: a Windows path whose separators were eaten by JSON
   // escaping (`"C:\\tmp\\smp"` written as `"C:\tmp\smp"`). Name the cause —
   // the sibling/basename hints below can never resolve such a path.
   const rawMissing = String(missingPath || '');
-  if (/^[A-Za-z]:(?![\\/])[^\\/]/.test(rawMissing.replace(/\\/g, '\\'))) {
+  if (/^[A-Za-z]:(?![\\/])[^\\/]/.test(rawMissing)) {
     return ` The path has a drive letter but no separator after it — the backslashes were probably lost in escaping. Re-issue with forward slashes (e.g. "C:/tmp/smp").`;
   }
   if (missingPathIsOutsideProject(workDir, missingPath)) {

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -45,10 +45,11 @@ export function buildJobNotFoundMessage(jobId) {
   return `Error: task not found: ${jobId}`;
 }
 
+// Running promoted jobs, for the runtime-wide read-only counts `task list`
+// shows; each leaves when its native task settles (trackShellJobRecord).
+const promotedJobIds = new Set();
 const backgroundShellJobWatchers = new Map();
 const jobNotifyCtxByJobId = new Map();
-const shellJobResourceLeases = new Map();
-const shellJobResourceLeaseSubscriptions = new Map();
 
 function demoteBackgroundShellPriority(pid) {
   if (process.env.MIXDOG_BG_PRIORITY === '0') return;
@@ -72,27 +73,13 @@ function trackShellJobRecord(task, options) {
     try {
       unsubscribe?.();
     } catch {}
+    promotedJobIds.delete(jobId);
     void completeShellJobRecord(jobId, normalizeShellJobDetail(detail));
   };
   unsubscribe = subscribeNativeTask(jobId, settle);
   settle(getNativeTask(jobId) || task);
 }
 
-function releaseShellJobResourceLease(jobId) {
-  const unsubscribe = shellJobResourceLeaseSubscriptions.get(jobId);
-  shellJobResourceLeaseSubscriptions.delete(jobId);
-  try {
-    unsubscribe?.();
-  } catch {}
-  const lease = shellJobResourceLeases.get(jobId);
-  if (!lease) return false;
-  shellJobResourceLeases.delete(jobId);
-  try {
-    Promise.resolve(lease.release()).catch(() => {});
-  } catch {}
-  return true;
-}
-
 /** Native task status → background-task status. A non-zero exit is a COMMAND
  *  result, not a task failure: the identical run in the foreground reports
  *  `[exit code: N]` and stays a success, so crossing the promotion threshold
@@ -262,24 +249,6 @@ export function killShellJob(jobId) {
   return { ...attachJobInsights(normalizeShellJobDetail(detail)), killed: wasRunning };
 }
 
-export function attachShellJobResourceLease(jobId, lease) {
-  if (!jobId || !lease || typeof lease.release !== 'function') return false;
-  const detail = getNativeTask(jobId);
-  if (detail?.status !== 'running') {
-    try {
-      Promise.resolve(lease.release()).catch(() => {});
-    } catch {}
-    return false;
-  }
-  releaseShellJobResourceLease(jobId);
-  shellJobResourceLeases.set(jobId, lease);
-  const unsubscribe = subscribeNativeTask(jobId, (task) => {
-    if (task?.status !== 'running') releaseShellJobResourceLease(jobId);
-  });
-  shellJobResourceLeaseSubscriptions.set(jobId, unsubscribe);
-  return true;
-}
-
 export function clearShellJobNotifyCtx(jobId) {
   jobNotifyCtxByJobId.delete(jobId);
 }
@@ -319,7 +288,6 @@ export function watchBackgroundShellJob(jobId, notifyCtx) {
     unsubscribe();
     backgroundShellJobWatchers.delete(jobId);
     jobNotifyCtxByJobId.delete(jobId);
-    releaseShellJobResourceLease(jobId);
     const enriched = attachJobInsights(normalizeShellJobDetail(detail));
     const completion = buildShellCompletion(jobId, enriched);
     const completedTask = completeBackgroundTask(jobId, {
@@ -407,10 +375,26 @@ export async function promoteForegroundShellJob({
     native.stdoutPath = stdoutPath || null;
     native.stderrPath = stderrPath || null;
   }
+  // Added before tracking: the record's settlement removes it again.
+  promotedJobIds.add(native.jobId);
   trackShellJobRecord(native, { ownerSessionId, clientHostPid, startedAtMs: started });
   return native;
 }
 
+/** Running background shell jobs owned by sessions outside `ownSessionIds`. */
+export function otherSessionBackgroundShellJobCount(ownSessionIds) {
+  let count = 0;
+  for (const jobId of [...promotedJobIds]) {
+    const task = getNativeTask(jobId);
+    if (task?.status !== 'running') {
+      promotedJobIds.delete(jobId);
+      continue;
+    }
+    if (!ownSessionIds.has(String(task.ownerSessionId || ''))) count += 1;
+  }
+  return count;
+}
+
 /** Live record for a command still running in the FOREGROUND. Background jobs
  *  publish through trackShellJobRecord and settle into a terminal record; a
  *  foreground command has no task id and no completion notice, so its record
@@ -518,7 +502,10 @@ export async function shutdownShellJobs(_reason = 'runtime-close', { scope = nul
     jobNotifyCtxByJobId.delete(task.jobId);
   }
   const settled = await Promise.all(jobs.map((task) => waitNativeTask(task.jobId, 1_200).catch(() => null)));
-  for (const task of jobs) releaseShellJobResourceLease(task.jobId);
+  // A process still running after the wait is not forgotten: it keeps being
+  // stopped until its exit is confirmed.
+  const unconfirmed = jobs.filter((_, index) => settled[index]?.status === 'running').map((task) => task.jobId);
+  for (const jobId of unconfirmed) retryShutdownSurvivor(jobId, 1);
   if (scoped) {
     // The owning session is gone: nothing can query its tasks again, so
     // drop ALL of its retained state — not only the ones that happened to
@@ -532,16 +519,79 @@ export async function shutdownShellJobs(_reason = 'runtime-close', { scope = nul
       } catch {}
     }
   }
-  if (!scoped) {
-    for (const jobId of [...shellJobResourceLeases.keys()]) {
-      releaseShellJobResourceLease(jobId);
-    }
-    jobNotifyCtxByJobId.clear();
-  }
+  if (!scoped) jobNotifyCtxByJobId.clear();
   return {
     killed: jobs.length,
     cancelledJobs: jobs.length,
     confirmedJobs: settled.filter((task) => task && task.status !== 'running').length,
+    unconfirmedJobs: unconfirmed,
     cancelledWatchers,
   };
 }
+
+// Shutdown survivors: re-issue the stop every SURVIVOR_RETRY_MS until the
+// native runner confirms the exit, at most SURVIVOR_MAX_ATTEMPTS times, each
+// step logged. A survivor that outlives every attempt stays listed.
+const SURVIVOR_RETRY_MS = 5_000;
+const SURVIVOR_MAX_ATTEMPTS = 10;
+const shutdownSurvivors = new Map();
+
+function logShellJobs(message) {
+  try {
+    process.stderr.write(`[shell-jobs] ${message}\n`);
+  } catch {}
+}
+
+function dropShutdownSurvivor(jobId) {
+  const entry = shutdownSurvivors.get(jobId);
+  if (!entry) return;
+  shutdownSurvivors.delete(jobId);
+  clearTimeout(entry.timer);
+  try {
+    entry.unsubscribe();
+  } catch {}
+}
+
+function retryShutdownSurvivor(jobId, attempts) {
+  let entry = shutdownSurvivors.get(jobId);
+  if (entry) clearTimeout(entry.timer);
+  else {
+    entry = { attempts, timer: null, unsubscribe: () => {} };
+    shutdownSurvivors.set(jobId, entry);
+    // The native terminal event confirms the exit at any time — also after
+    // the last retry — and drops the entry.
+    entry.unsubscribe = subscribeNativeTask(jobId, (task) => {
+      if (task?.status === 'running') return;
+      dropShutdownSurvivor(jobId);
+      logShellJobs(`${jobId} exit confirmed after shutdown`);
+    });
+  }
+  entry.attempts = attempts;
+  logShellJobs(`shutdown could not confirm ${jobId} exited (attempt ${attempts}); retrying`);
+  entry.timer = setTimeout(() => {
+    if (getNativeTask(jobId)?.status !== 'running') {
+      dropShutdownSurvivor(jobId);
+      logShellJobs(`${jobId} exit confirmed after shutdown`);
+      return;
+    }
+    if (attempts >= SURVIVOR_MAX_ATTEMPTS) {
+      entry.timer = null;
+      logShellJobs(`giving up stopping ${jobId} after ${attempts} attempts; it is still running`);
+      return;
+    }
+    try {
+      cancelNativeTask(jobId);
+    } catch {}
+    retryShutdownSurvivor(jobId, attempts + 1);
+  }, SURVIVOR_RETRY_MS);
+  entry.timer.unref?.();
+}
+
+/** Shutdown survivors whose termination is not yet confirmed. */
+export function shellShutdownSurvivors() {
+  // Reconcile against native state: an exit whose event was missed still ends the entry.
+  for (const jobId of [...shutdownSurvivors.keys()]) {
+    if (getNativeTask(jobId)?.status !== 'running') dropShutdownSurvivor(jobId);
+  }
+  return [...shutdownSurvivors].map(([jobId, entry]) => ({ jobId, attempts: entry.attempts }));
+}