mixdog 1.1.2 → 1.2.0

package/src/runtime/agent/orchestrator/session/store-transcript-projection.mjs

@@ -7,11 +7,14 @@
  * Kept apart from the cache/fingerprint policy in store-summary-reader.mjs
  * because this runs exactly once per distinct content and is the only part
  * that lazily enters the heavier reconnect-recovery boundary (dynamic imports
- * preserved verbatim so the cold summary path stays leaf-only).
+ * keep the cold summary path leaf-only).
  */
 import { sessionContextMeasurement, contextMeasurementStats } from '../../../shared/context-measurement.mjs';
 import { nextProjectionStamp } from './store-transcript-cache.mjs';
+import { join } from 'node:path';
 import { cleanValue, desktopSession, positiveNumber } from './store-summary-fields.mjs';
+import { compactionArchiveRange, readCompactionArchivePage } from './compaction-archive.mjs';
+import { dataDir } from './store-summary-locations.mjs';
 
 /** The parse/recovery/projection body of a stored transcript read. Runs once
  *  per distinct content; its result is shared read-only through the cache. */
@@ -90,17 +93,31 @@ export async function projectStoredTranscript(sessionId, doc, options) {
   // tail is identical either way.
   const itemLimit = Number.isFinite(options.itemLimit) ? options.itemLimit : Number.POSITIVE_INFINITY;
   const restored = restoreTranscriptItems(messages, { sessionId, itemLimit: itemLimit + 1 });
-  const transcriptHasOlder = restored.length > itemLimit;
+  let transcriptHasOlder = restored.length > itemLimit;
+  let items = transcriptHasOlder ? restored.slice(-itemLimit) : restored;
+  // A paged window continues past the first stored message into the
+  // display-only compaction archive (newest segment first). A legacy whole
+  // read never receives it.
+  const archiveRange = Number.isFinite(itemLimit) && !transcriptHasOlder ? compactionArchiveRange(session) : null;
+  if (archiveRange) {
+    const archived = await readCompactionArchivePage(join(dataDir(), 'sessions'), sessionId, {
+      ...archiveRange,
+      limit: itemLimit - restored.length,
+    });
+    if (archived.items.length) items = [...archived.items, ...restored];
+    transcriptHasOlder = archived.hasOlder;
+  }
   return {
     sessionId,
     projectionStamp: nextProjectionStamp(),
     ...(options.includeMessages ? { messages } : {}),
-    items: transcriptHasOlder ? restored.slice(-itemLimit) : restored,
+    items,
     transcriptHasOlder,
     provider: session.provider || '',
     model: session.model || '',
     effort: session.effort || '',
     fast: session.fast === true,
+    ...(session.autoEffort === false ? { autoEffort: false } : {}),
     modelParameters: session.modelParameters || {},
     cwd: session.cwd || '',
     desktopSession: desktopSession(session.desktopSession, session.cwd),

package/src/runtime/agent/orchestrator/session/transcript-restore/restore.mjs

@@ -6,6 +6,7 @@
  */
 import { contextMeasurementStats } from '../../../../shared/context-measurement.mjs';
 import { toolResultText } from './tool-result-text.mjs';
+import { restoredUserText } from './user-text.mjs';
 import {
   completionCardFromExecution,
   parseModelVisibleCompletionWrapper,
@@ -48,12 +49,19 @@ function restoredTranscriptMetadata(message) {
   if (completionValue && completionStatus && Number.isFinite(completionElapsedMs)) {
     completion = { status: completionStatus, elapsedMs: Math.max(0, completionElapsedMs) };
     if (typeof completionValue.verb === 'string' && completionValue.verb) completion.verb = completionValue.verb;
+    if (typeof completionValue.checkpointId === 'string' && completionValue.checkpointId) {
+      completion.checkpointId = completionValue.checkpointId;
+    }
   }
   return {
+    // The stable message id lets a live view map a compaction's dropped
+    // messages back to these rows.
+    ...(typeof value.messageId === 'string' && value.messageId ? { messageId: value.messageId } : {}),
     ...(Number.isFinite(Number(value.at)) ? { at: Number(value.at) } : {}),
     ...transcriptRouteMetadataFields(value),
     ...(typeof value.sender === 'string' && value.sender ? { sender: value.sender } : {}),
     ...(typeof value.device === 'string' && value.device ? { device: value.device } : {}),
+    ...(typeof value.checkpointId === 'string' && value.checkpointId ? { checkpointId: value.checkpointId } : {}),
     ...(completion ? { completion } : {}),
   };
 }
@@ -70,15 +78,16 @@ function restoredAssistantTranscriptItems(message, nextId) {
       ...completion,
       ...(completion.status === 'done' ? { finalAssistantId: items[0].id } : {}),
       ...(metadata.at ? { at: metadata.at } : {}),
+      ...(metadata.messageId ? { messageId: metadata.messageId } : {}),
     });
   }
   return items;
 }
 
 // Restored tool cards: stored assistant messages keep their (compacted)
-// tool_calls and the follow-up role:'tool' results, but resume used to drop
-// both — a reopened session lost every tool marker (user bug). Rebuild one
-// transcript tool item per call and attach its result by tool_call_id.
+// tool_calls and the follow-up role:'tool' results. Rebuild one transcript
+// tool item per call and attach its result by tool_call_id, so a reopened
+// session keeps its tool markers.
 function restoredMessageToolCalls(message) {
   if (Array.isArray(message?.tool_calls)) return message.tool_calls;
   if (Array.isArray(message?.toolCalls)) return message.toolCalls;
@@ -112,7 +121,12 @@ function restoredToolCallItems(message, nextId, pendingByCallId) {
       ...(Number.isFinite(at) ? { at, startedAt: at, completedAt: at } : {}),
     };
     const callId = typeof call?.id === 'string' ? call.id : '';
-    if (callId) pendingByCallId.set(callId, item);
+    // The call id ties the card to its call and result messages (a live view
+    // greys it when a compaction drops them).
+    if (callId) {
+      item.callId = callId;
+      pendingByCallId.set(callId, item);
+    }
     items.push(item);
   }
   return items;
@@ -203,6 +217,9 @@ function buildRestoredAggregateItem(members) {
       ...(loadingTargets.length > 0 ? { loadingTargets } : {}),
     },
     aggregate: true,
+    ...(members.some(({ item }) => item.callId)
+      ? { callIds: members.map(({ item }) => item.callId).filter(Boolean) }
+      : {}),
     categories: Object.fromEntries(header.categories),
     doneCategories: aggregateDoneCategories(calls),
     completedCount: calls.length,
@@ -219,8 +236,8 @@ function buildRestoredAggregateItem(members) {
 
 // Restored transcripts must mirror the live turn's category merging: the live
 // session runtime (turn.mjs) collapses consecutive same-bucket tool calls into one
-// aggregate card, but resume rebuilt one card per call, so a reopened session
-// un-merged every run (user bug). Walk the restored items and merge adjacent
+// aggregate card, so a reopened session must not show them un-merged. Walk the
+// restored items and merge adjacent
 // tool cards whose aggregateBucketForCategory matches; any non-tool item
 // (user/assistant/turndone) is a block boundary, same as the live seal rule.
 // Runs of 1 keep the plain per-call card (its argument summary stays visible).
@@ -279,9 +296,11 @@ function restoredMessageItemUpperBound(message) {
 function restoredNotificationToolItem(parsed, text, message, nextId, errorLabel) {
   const label = parsed.label || 'notification';
   const at = Number(message?.meta?.transcript?.at);
+  const messageId = message?.meta?.transcript?.messageId;
   return {
     kind: 'tool',
     id: nextId(),
+    ...(typeof messageId === 'string' && messageId ? { messageId } : {}),
     name: parsed.name || 'agent',
     args: parsed.args || {
       type: label,
@@ -303,7 +322,7 @@ function restoredUserTranscriptItems(message, nextId) {
   // skill bodies (meta:'skill'), hook/system reminders, and tag-wrapped context
   // blocks must not restore as user bubbles in any client.
   if (message?.meta === 'skill' || message?.meta === 'hook') return [];
-  const text = (typeof message?.content === 'string' ? message.content : toolResultText(message?.content)).trim();
+  const text = restoredUserText(message?.content).trim();
   // Persisted async-completion wrappers ("Async shell task ... finished. Result:
   // > ...") are the only durable record of a background completion — the live
   // Response card is an event-time push that does not survive a transcript
@@ -329,7 +348,8 @@ function restoredUserTranscriptItems(message, nextId) {
   // step, but render it like a live cancel tail (◈ Cancelled) instead of a
   // raw user bubble with bracketed internals.
   if (isTranscriptCancelledStatusText(text)) {
-    return [{ kind: 'turndone', id: nextId(), status: 'cancelled', elapsedMs: 0 }];
+    const { messageId } = restoredTranscriptMetadata(message);
+    return [{ kind: 'turndone', id: nextId(), status: 'cancelled', elapsedMs: 0, ...(messageId ? { messageId } : {}) }];
   }
   const synthetic = parseSyntheticAgentMessage(text);
   if (!synthetic) {

package/src/runtime/agent/orchestrator/session/transcript-restore/user-text.mjs

@@ -0,0 +1,140 @@
+/**
+ * The text a restored user bubble shows for a stored prompt, matching what the
+ * live bubble showed for it:
+ * - An image part is drawn by the `[Image: …]` metadata line the composer put
+ *   before it; the part itself adds no raw `[image: image/png]` marker (a bare
+ *   one gets a metadata line of its own, which renders as an image chip).
+ * - A desktop `<visualize_feedback>` block (the agent-facing pin/choice
+ *   record) is shown as the lines the live bubble showed: `📌 N · label —
+ *   note` per pin, one `☑ group: label, …` line for the picks and one
+ *   `🎚 id: value (was old), …` line for tweaks (drawn with an icon). Intake
+ *   moves a long block into the attachment store; it is read back from there.
+ */
+import { isAttachmentReference, readAttachmentTextWithin } from '../../../../attachments/store.mjs';
+import { toolResultText } from './tool-result-text.mjs';
+
+const IMAGE_METADATA_LINE = /\[Image(?::| source:) [^\]\r\n]+\]\s*$/;
+const FEEDBACK_OPEN = '<visualize_feedback>';
+const FEEDBACK_BLOCK = /<visualize_feedback>\n([\s\S]*?)\n?<\/visualize_feedback>/g;
+// Feedback blocks are bounded (20 pins, trimmed HTML); a larger blob is a long
+// prompt or paste, which restores as before without being read. The cap holds
+// on the blob itself: the reference's claimed sizeBytes is not trusted.
+const FEEDBACK_MAX_BYTES = 128 * 1024;
+const QUOTED = '("(?:[^"\\\\]|\\\\.)*")';
+const CHOICE_LINE = new RegExp(
+  `· group: (?:${QUOTED}|\\(none\\)) → choice: ${QUOTED}(?: \\(${QUOTED}\\))?$`
+);
+
+function unquote(value) {
+  if (!value) return '';
+  try {
+    return String(JSON.parse(value));
+  } catch {
+    return '';
+  }
+}
+
+/** The live bubble's lines for one feedback block body. */
+function feedbackDisplay(body) {
+  const pins = [];
+  const choices = [];
+  let pin = null;
+  let note = false;
+  let inChoices = false;
+  const tweakSets = [];
+  let tweaks = null;
+  for (const line of body.split('\n')) {
+    if (line.startsWith('tweaks (')) {
+      pin = null;
+      inChoices = false;
+      tweaks = null;
+      tweakSets.push([]);
+      tweaks = tweakSets.at(-1);
+      continue;
+    }
+    if (tweaks) {
+      const change = /^    (.+?) \([^)]*\): (.*) \(was (.*)\)$/.exec(line);
+      if (change) tweaks.push(`${change[1]}: ${change[2]} (was ${change[3]})`);
+      else if (line.startsWith('  - tab: ')) {
+        tweaks = [];
+        tweakSets.push(tweaks);
+      } else tweaks = null;
+      if (tweaks) continue;
+    }
+    const head = /^pin (\d+) · (.*)$/.exec(line);
+    if (head) {
+      pin = { n: head[1], label: head[2], note: '' };
+      pins.push(pin);
+      note = false;
+      inChoices = false;
+      continue;
+    }
+    if (line === 'choices:') {
+      pin = null;
+      inChoices = true;
+      continue;
+    }
+    if (pin && line.startsWith('  note: ')) {
+      pin.note = line.slice(8);
+      note = true;
+      continue;
+    }
+    if (pin && note && line.startsWith('    ')) {
+      pin.note += `\n${line.slice(4)}`;
+      continue;
+    }
+    note = false;
+    const choice = inChoices ? CHOICE_LINE.exec(line) : null;
+    if (choice) {
+      choices.push({ group: unquote(choice[1]), choice: unquote(choice[2]), label: unquote(choice[3]) });
+    }
+  }
+  const lines = pins.map((entry) => `📌 ${entry.n} · ${entry.label} — ${entry.note.replace(/\s+/g, ' ')}`);
+  if (choices.length) {
+    lines.push(
+      `☑ ${choices.map((entry) => (entry.group ? `${entry.group}: ` : '') + (entry.label || entry.choice)).join(', ')}`
+    );
+  }
+  const changed = tweakSets.filter((set) => set.length).map((set) => set.join(', '));
+  if (changed.length) lines.push(`🎚 ${changed.join('; ')}`);
+  return lines.join('\n');
+}
+
+export function withVisualizeFeedbackDisplay(text) {
+  const value = String(text ?? '');
+  if (!value.includes(FEEDBACK_OPEN)) return value;
+  return value.replace(FEEDBACK_BLOCK, (_block, body) => feedbackDisplay(body));
+}
+
+/** A stored text reference's body when it is a feedback block, else ''. */
+function referencedFeedbackText(part) {
+  if (part?.type !== 'text' || part.textKind) return '';
+  try {
+    const text = readAttachmentTextWithin(part, FEEDBACK_MAX_BYTES);
+    return text?.startsWith(FEEDBACK_OPEN) ? text : '';
+  } catch {
+    // A blob gone from the store restores as it always did: without its text.
+    return '';
+  }
+}
+
+export function restoredUserText(content) {
+  if (!Array.isArray(content)) {
+    return withVisualizeFeedbackDisplay(typeof content === 'string' ? content : toolResultText(content));
+  }
+  const texts = [];
+  let previous = '';
+  for (const part of content) {
+    let text;
+    if (part?.type === 'image' || part?.type === 'input_image') {
+      text = IMAGE_METADATA_LINE.test(previous) ? '' : `[Image: ${part.mimeType || part.mediaType || 'image'}]`;
+    } else if (isAttachmentReference(part)) {
+      text = referencedFeedbackText(part);
+    } else {
+      text = toolResultText([part]);
+    }
+    previous = text;
+    if (text) texts.push(text);
+  }
+  return withVisualizeFeedbackDisplay(texts.join('\n'));
+}

package/src/runtime/agent/orchestrator/tools/builtin/cache-layers.mjs

@@ -5,10 +5,15 @@ import { isAbsolute, sep } from 'node:path';
 import { canonicalCachePath, deleteReadRangeIndexForPath } from './read-range-index.mjs';
 import { resolveAgainstCwd } from './path-utils.mjs';
 import { fileVersion, sameFileVersion } from './file-version.mjs';
+import { canCacheReadFile } from './read-cache-policy.mjs';
 
 const RESULT_CACHE = new Map(); // key → { ts, value, paths, scopes, readSnapshotMeta, contentPrefixHash, bytes }
 const RESULT_CACHE_INFLIGHT = new Map(); // key → { promise, controller, subscribers, settled }
 const RESULT_CACHE_COMPUTE = new AsyncLocalStorage();
+const READ_CACHE_PUBLICATION = new AsyncLocalStorage();
+// Only active reads retain a slot. Invalidating an inactive path creates
+// no history, and the final reader releases its path in a finally block.
+const ACTIVE_READ_CACHE_PATHS = new Map();
 const RESULT_CACHE_TTL_MS = 30_000;
 const RESULT_CACHE_MAX_ENTRIES = 200;
 // A byte budget from the bytes env var, else the megabytes one, else the
@@ -72,6 +77,37 @@ function cachePathsOverlap(a, b) {
   return a.startsWith(b.endsWith(sep) ? b : `${b}${sep}`) || b.startsWith(a.endsWith(sep) ? a : `${a}${sep}`);
 }
 
+export async function runReadCachePublication(fullPaths, read) {
+  const paths = normalizeCacheMetaPaths(Array.isArray(fullPaths) ? fullPaths : [fullPaths]);
+  const leases = paths.map((path) => {
+    let slot = ACTIVE_READ_CACHE_PATHS.get(path);
+    if (!slot) {
+      slot = { generation: 0, references: 0 };
+      ACTIVE_READ_CACHE_PATHS.set(path, slot);
+    }
+    slot.references++;
+    return { path, slot, generation: slot.generation, released: false };
+  });
+  try {
+    return await READ_CACHE_PUBLICATION.run(leases, read);
+  } finally {
+    for (const lease of leases) {
+      lease.released = true;
+      if (--lease.slot.references === 0) ACTIVE_READ_CACHE_PATHS.delete(lease.path);
+    }
+  }
+}
+
+export function canPublishReadCache(targets = null) {
+  const leases = READ_CACHE_PUBLICATION.getStore();
+  if (!leases) return true;
+  const paths = normalizeCacheMetaPaths(Array.isArray(targets) ? targets : [targets]);
+  return leases.every((lease) => {
+    if (paths.length && !paths.some((path) => cachePathsOverlap(path, lease.path))) return true;
+    return !lease.released && lease.generation === lease.slot.generation;
+  });
+}
+
 function cacheEntryOverlapsPaths(entry, affectedPaths) {
   const entryPaths = Array.isArray(entry?.paths) ? entry.paths : [];
   const entryScopes = Array.isArray(entry?.scopes) ? entry.scopes : [];
@@ -107,6 +143,11 @@ export function cacheSet(key, value, meta = {}) {
   // A detached/aborted computation must never repopulate a newer cache.
   const computation = RESULT_CACHE_COMPUTE.getStore();
   if (computation?.invalidated || computation?.controller?.signal?.aborted) return;
+  const publicationPaths = [
+    ...(Array.isArray(meta.paths) ? meta.paths : []),
+    ...(Array.isArray(meta.scopes) ? meta.scopes : []),
+  ];
+  if (!canPublishReadCache(publicationPaths)) return;
   // Replace-in-place: clear old entry's byte accounting before write.
   if (RESULT_CACHE.has(key)) resultCacheDelete(key);
   const bytes = estimateResultBytes(value);
@@ -239,7 +280,7 @@ export async function runRawContentInFlight(fullPath, loader = fsPromises.readFi
   // Buffered reads provide their observed version: a later read must not
   // join older bytes merely because a watcher has not fired yet. Preserve
   // the unversioned helper contract for callers that supply no stat.
-  if (stat !== undefined && !version) return await loader(fullPath);
+  if (stat !== undefined && (!version || !canCacheReadFile(version))) return await loader(fullPath);
   const key = version ? JSON.stringify([path, version]) : path;
   return await runPathInFlight(RAW_CONTENT_INFLIGHT, key, path, () => loader(fullPath));
 }
@@ -260,6 +301,10 @@ function rawContentCacheDelete(key) {
 export function rawContentCacheGet(fullPath, stat, now = Date.now()) {
   if (!fullPath || !stat) return null;
   const key = canonicalCachePath(fullPath);
+  if (!canCacheReadFile(stat)) {
+    rawContentCacheDelete(key);
+    return null;
+  }
   const entry = RAW_CONTENT_CACHE.get(key);
   if (!entry) return null;
   if (now - entry.ts > RAW_CONTENT_CACHE_TTL_MS) {
@@ -276,9 +321,10 @@ export function rawContentCacheGet(fullPath, stat, now = Date.now()) {
 }
 
 export function rawContentCacheSet(fullPath, stat, rawBuf, now = Date.now()) {
+  if (!canPublishReadCache(fullPath)) return;
   if (!fullPath || !Buffer.isBuffer(rawBuf)) return;
   const version = fileVersion(stat);
-  if (!version || rawBuf.length !== version.size || rawBuf.length > RAW_CONTENT_CACHE_MAX_BYTES) return;
+  if (!version || !canCacheReadFile(version) || rawBuf.length !== version.size || rawBuf.length > RAW_CONTENT_CACHE_MAX_BYTES) return;
   const key = canonicalCachePath(fullPath);
   rawContentCacheDelete(key);
   RAW_CONTENT_CACHE.set(key, {
@@ -450,6 +496,7 @@ function runExtraInvalidationListeners(affectedPaths = null) {
 }
 
 function cacheInvalidateAll() {
+  for (const slot of ACTIVE_READ_CACHE_PATHS.values()) slot.generation++;
   for (const entry of RESULT_CACHE_INFLIGHT.values()) {
     entry.invalidated = true;
   }
@@ -470,6 +517,9 @@ function cacheInvalidatePaths(paths) {
     cacheInvalidateAll();
     return;
   }
+  for (const [path, slot] of ACTIVE_READ_CACHE_PATHS) {
+    if (affectedPaths.some((affected) => cachePathsOverlap(path, affected))) slot.generation++;
+  }
   for (const inFlight of [RAW_CONTENT_INFLIGHT, READ_ONLY_STAT_INFLIGHT]) {
     for (const [key, entry] of inFlight) {
       if (affectedPaths.some((affected) => cachePathsOverlap(entry.path, affected))) inFlight.delete(key);

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -6,7 +6,7 @@ import { tokenizeDirectArgv } from './shell-direct-exe.mjs';
 import { GIT_DIFF_EXIT_SIGNAL_FLAGS } from './bash-tool/benign-exit.mjs';
 import { withBuiltinPathLocks } from './path-locks.mjs';
 import { withAdvisoryLocks } from './advisory-lock.mjs';
-import { withGitRepoReadLock, withGitRepoWriteLock } from './git-repo-rw-lock.mjs';
+import { gitRepoLockKey, withGitRepoReadLock, withGitRepoWriteLock } from './git-repo-rw-lock.mjs';
 import { invalidateBuiltinResultCache } from './cache-layers.mjs';
 import { drainCodeGraphCache } from '../code-graph-state.mjs';
 import { ensureNativeSpawnServer, tryNativeSpawn } from '../lib/native-spawn-client.mjs';
@@ -460,22 +460,22 @@ function nearestGitDir(startDir) {
 
 function cachedRepoRoot(key, plan) {
   if (!key) return null;
-  const root = repoRootCache.get(key);
-  if (!root) return null;
+  const hit = repoRootCache.get(key);
+  if (!hit) return null;
   const nearest = nearestGitDir(plan.cwd);
-  if (!nearest || resolve(nearest) !== resolve(root)) {
+  if (!nearest || resolve(nearest) !== resolve(hit.root)) {
     repoRootCache.delete(key);
     return null;
   }
   repoRootCache.delete(key);
-  repoRootCache.set(key, root);
-  return root;
+  repoRootCache.set(key, hit);
+  return hit;
 }
 
-function rememberRepoRoot(key, root) {
-  if (!key || !root) return;
+function rememberRepoRoot(key, hit) {
+  if (!key || !hit?.root) return;
   repoRootCache.delete(key);
-  repoRootCache.set(key, root);
+  repoRootCache.set(key, hit);
   while (repoRootCache.size > REPO_ROOT_CACHE_MAX) {
     const oldest = repoRootCache.keys().next().value;
     if (oldest === undefined) break;
@@ -483,15 +483,22 @@ function rememberRepoRoot(key, root) {
   }
 }
 
+// `lockKey` is the repository's canonical common git dir: the main checkout
+// and its linked worktrees share one object store and ref namespace, so their
+// git calls serialize on one repository lock (managed worktree mutations take
+// the same key).
 async function resolveRepo(plan, signal) {
   const key = repoRootCacheKey(plan);
   const hit = cachedRepoRoot(key, plan);
-  if (hit) return { root: hit, probe: null };
-  const result = await runGit(plan, ['rev-parse', '--show-toplevel'], { signal });
+  if (hit) return { root: hit.root, lockKey: hit.lockKey, probe: null };
+  const result = await runGit(plan, ['rev-parse', '--show-toplevel', '--path-format=absolute', '--git-common-dir'], {
+    signal,
+  });
   if (succeeded(result)) {
-    const root = cleanText(result.stdout);
-    rememberRepoRoot(key, root);
-    return { root, probe: result };
+    const [root, commonDir] = cleanText(result.stdout).split('\n');
+    const resolved = { root, lockKey: gitRepoLockKey(commonDir || root) };
+    rememberRepoRoot(key, resolved);
+    return { ...resolved, probe: result };
   }
   // A bare repository (mirror clone, server-side repo) has no work tree, so
   // `--show-toplevel` refuses; that is still a repository. Answering
@@ -499,12 +506,13 @@ async function resolveRepo(plan, signal) {
   // to inspect objects it already had.
   if (/must be run in a work tree/i.test(String(result.stderr || ''))) {
     const bare = await runGit(plan, ['rev-parse', '--absolute-git-dir'], { signal });
-    if (!succeeded(bare)) return { root: null, probe: bare };
+    if (!succeeded(bare)) return { root: null, lockKey: null, probe: bare };
     const root = cleanText(bare.stdout);
-    rememberRepoRoot(key, root);
-    return { root, probe: bare };
+    const resolved = { root, lockKey: gitRepoLockKey(root) };
+    rememberRepoRoot(key, resolved);
+    return { ...resolved, probe: bare };
   }
-  return { root: null, probe: result };
+  return { root: null, lockKey: null, probe: result };
 }
 
 function localizeConfigPlan(plan) {
@@ -650,8 +658,9 @@ async function executeGitStage(input, workDir, options = {}) {
   const limit = outputLimit(input?.output_limit, 50);
   const signal = abortSignalOf(options);
   const repo = snapshot.repo;
+  const { lockKey } = await resolveRepo({ ...snapshot.plan, cwd: repo }, signal);
   return withGitRepoWriteLock(
-    repo,
+    lockKey || repo,
     () =>
       withGitMutationLocks(repo, async () => {
         const current = await runStageableDiff(snapshot.plan, snapshot.argv, repo, signal);
@@ -722,7 +731,7 @@ async function executeSingleGitTool(input, workDir, options = {}) {
   // ("git rev-parse exited 128") for a `git status` in a plain directory hid
   // git's own "fatal: not a git repository" line behind a command the model
   // never issued — and re-ran the probe just to build that message.
-  const { root: repo, probe } = await resolveRepo(plan, signal);
+  const { root: repo, lockKey, probe } = await resolveRepo(plan, signal);
   if (!repo) {
     const missing = probe ?? (await runGit(plan, ['rev-parse', '--show-toplevel'], { signal }));
     return commandResult(plan, missing, limit);
@@ -732,7 +741,7 @@ async function executeSingleGitTool(input, workDir, options = {}) {
   if (stageableRequest) prepared.argv.splice(1, 0, '--no-textconv', '--src-prefix=a/', '--dst-prefix=b/');
   if (isReadOnly(plan)) {
     return withGitRepoReadLock(
-      repo,
+      lockKey,
       async () => {
         const result = stageableRequest
           ? await runStageableDiff(plan, prepared.argv, repo, signal)
@@ -754,7 +763,7 @@ async function executeSingleGitTool(input, workDir, options = {}) {
     );
   }
   return withGitRepoWriteLock(
-    repo,
+    lockKey,
     () =>
       withGitMutationLocks(repo, async () => {
         const result = await runGit(plan, prepared.argv, { signal });
@@ -896,4 +905,5 @@ export const _gitCommandInternals = {
   localizeConfigPlan,
   parseCommand,
   prepare,
+  resolveRepo,
 };

package/src/runtime/agent/orchestrator/tools/builtin/git-repo-rw-lock.mjs

@@ -1,10 +1,17 @@
-import { resolve } from 'node:path';
+import { pathKey } from '../../../../shared/worktrees/paths.mjs';
 
 const states = new Map();
 
+// Callers key by the canonical `git rev-parse --git-common-dir`, so the main
+// checkout and every linked worktree of one repository share one lock. The key
+// is the real path (8.3 names, symlinked parents) and case-insensitive on
+// Windows, so two spellings of one directory never hold separate locks.
+export function gitRepoLockKey(repo) {
+  return pathKey(String(repo || '.'));
+}
+
 function keyFor(repo) {
-  const key = resolve(String(repo || '.'));
-  return process.platform === 'win32' ? key.toLowerCase() : key;
+  return gitRepoLockKey(repo);
 }
 
 function stateFor(key) {

package/src/runtime/agent/orchestrator/tools/builtin/read-cache-policy.mjs

@@ -0,0 +1,8 @@
+// The bounded cache validator can certify the whole file only within this
+// byte budget. Larger reads must not reuse metadata-only or prefix-only
+// content/line-position evidence: equal stats can hide edits past the prefix.
+export const READ_PREFIX_HASH_BYTES = 65536;
+
+export function canCacheReadFile(stat) {
+  return Number.isFinite(stat?.size) && stat.size >= 0 && stat.size <= READ_PREFIX_HASH_BYTES;
+}

package/src/runtime/agent/orchestrator/tools/builtin/read-range-index.mjs

@@ -1,6 +1,7 @@
 import { mkdir, open, readFile, readdir, stat, unlink } from 'node:fs/promises';
 import { statSync } from 'node:fs';
 import { fileVersion, sameFileVersion } from './file-version.mjs';
+import { canCacheReadFile, READ_PREFIX_HASH_BYTES } from './read-cache-policy.mjs';
 import { hashText as sha256Hex } from './hash-utils.mjs';
 import { join, normalize, resolve } from 'node:path';
 import { getPluginData } from '../../config.mjs';
@@ -83,7 +84,7 @@ function readRangeIndexMatches(row, fullPath, version) {
 // `prefixHash` they persist into the anchor index.
 async function computePrefixHashForIndex(fullPath, st, handle = null, prefixBuffer = null) {
   try {
-    const cap = Math.min(Number(st?.size) || 0, 65536);
+    const cap = Math.min(Number(st?.size) || 0, READ_PREFIX_HASH_BYTES);
     if (cap <= 0) return '';
     if (Buffer.isBuffer(prefixBuffer) && prefixBuffer.length === cap) {
       return sha256Hex(prefixBuffer);
@@ -269,6 +270,8 @@ function freshReadRangeIndex(fullPath, version = null) {
 export async function getReadRangeIndex(fullPath, st, handle = null, prefixBuffer = null) {
   const key = canonicalCachePath(fullPath);
   let slot = READ_RANGE_INDEX_CACHE.get(key);
+  // Reserve ownership before awaiting the real stat even when the hint is
+  // large: a now-small file must not renew a lookup invalidated during IO.
   if (!slot) slot = refreshReadRangeIndexSlot(key, freshReadRangeIndex(fullPath));
   const hint = fileVersion(st);
   const readStat = () => (handle ? handle.stat() : stat(fullPath));
@@ -280,8 +283,18 @@ export async function getReadRangeIndex(fullPath, st, handle = null, prefixBuffe
   } catch {
     return null;
   }
-  if (!version || READ_RANGE_INDEX_CACHE.get(key) !== slot) return null;
+  if (!version) return null;
   version = Object.freeze(version);
+  // Metadata and a bounded prefix cannot certify suffix line positions.
+  // Large scans own only this call's handle identity and byte-zero draft:
+  // never load, hash-validate, or publish cross-read anchors/counts.
+  if (!canCacheReadFile(version)) {
+    if (slot && READ_RANGE_INDEX_CACHE.get(key) === slot) dropReadRangeIndexSlot(key);
+    const draft = freshReadRangeIndex(fullPath, version);
+    READ_RANGE_INDEX_DRAFTS.set(draft, { slot: null, version, fullPath });
+    return draft;
+  }
+  if (READ_RANGE_INDEX_CACHE.get(key) !== slot) return null;
   if (!slot.fileVersion) slot.fileVersion = version;
   if (!sameFileVersion(slot.fileVersion, version)) {
     dropReadRangeIndexSlot(key);
@@ -314,27 +327,33 @@ export async function getReadRangeIndex(fullPath, st, handle = null, prefixBuffe
     anchors: new Map(source.anchors),
     ...(Number.isFinite(source.totalLines) ? { totalLines: source.totalLines } : {}),
   };
-  READ_RANGE_INDEX_DRAFTS.set(draft, { slot, version });
+  READ_RANGE_INDEX_DRAFTS.set(draft, { slot, version, fullPath });
   return draft;
 }
 
-// Successful readers publish once, before closing their handle. A failed,
-// cancelled or detached scan keeps its observation private. Post-stat failures
-// are cache misses, not reasons to retry the operation or relabel its anchors.
-export async function publishReadRangeIndex(index, handle, signal = null, beforePublish = null) {
+// Successful small-file readers publish once, before closing their handle.
+// Large or detached scans remain private, but terminal validation can still
+// certify their producer identity via onValidated. Post-stat failures never
+// authorize relabelling bytes with a later version.
+export async function publishReadRangeIndex(index, handle, signal = null, beforePublish = null, onValidated = null) {
   const owned = READ_RANGE_INDEX_DRAFTS.get(index);
   if (!owned) return false;
   READ_RANGE_INDEX_DRAFTS.delete(index);
-  const { slot, version } = owned;
-  const key = canonicalCachePath(slot.fullPath);
-  if (signal?.aborted || READ_RANGE_INDEX_CACHE.get(key) !== slot) return false;
+  const { slot, version, fullPath } = owned;
+  const key = canonicalCachePath(fullPath);
+  if (signal?.aborted) return false;
+  // Detached cache-only publishers must not wait on validation IO. A streamed
+  // result requesting producer certification still owes its terminal stats.
+  if (slot && READ_RANGE_INDEX_CACHE.get(key) !== slot && !onValidated) return false;
   try {
-    if (!sameFileVersion(version, await handle.stat()) || !sameFileVersion(version, await stat(slot.fullPath)))
+    if (!sameFileVersion(version, await handle.stat()) || !sameFileVersion(version, await stat(fullPath)))
       return false;
   } catch {
     return false;
   }
-  if (signal?.aborted || READ_RANGE_INDEX_CACHE.get(key) !== slot) return false;
+  if (signal?.aborted) return false;
+  onValidated?.(fileVersion(version));
+  if (!slot || READ_RANGE_INDEX_CACHE.get(key) !== slot) return false;
   if (slot.prefixHash && index.prefixHash && slot.prefixHash !== index.prefixHash) return false;
   // The reader's synchronous deadline/cancellation decision belongs after all
   // awaited validation and outside its best-effort stat catch. Once committed,