mixdog 1.1.2 → 1.2.0

package/src/runtime/agent/orchestrator/tools/builtin/read-tool/batch-publication.mjs

@@ -0,0 +1,137 @@
+/**
+ * Keep coalesced child observations private until the caller's exact windows
+ * have been restored. A fresh child may outlive the batch's original cache
+ * generation; retain that child's lease, never renew the whole batch.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { canPublishReadCache, runReadCachePublication } from '../cache-layers.mjs';
+import { fileVersion, sameFileVersion } from '../file-version.mjs';
+import { mergeReadRanges } from '../read-ranges.mjs';
+
+// Streamed reads have numbered rows but no total-line footer. Prefer the
+// rows themselves so smart-elided gaps never become delivered evidence.
+export function renderedBatchReadRanges(body) {
+  if (typeof body !== 'string') return [];
+  const rows = [...body.matchAll(/^(\d+)[\t│→]/gm)]
+    .map((match) => Number(match[1]))
+    .filter((line) => Number.isSafeInteger(line) && line > 0)
+    .map((line) => ({ startLine: line, endLine: line }));
+  if (rows.length) return mergeReadRanges(rows);
+  const footer = /\[lines\s+(\d+)-(\d+)\s+of\s+\d+/.exec(body);
+  return footer ? mergeReadRanges([{ startLine: Number(footer[1]), endLine: Number(footer[2]) }]) : [];
+}
+
+function hasRenderedLines(body) {
+  return renderedBatchReadRanges(body).length > 0;
+}
+
+export async function runBatchReadSnapshotPublication(executeChildBuiltinTool, helpers, run) {
+  const tasks = [];
+  const records = [];
+  const corrections = new Map();
+  let closed = false;
+
+  function capture(task, fullPath, st, scope, meta) {
+    if (closed) return;
+    const identity = fileVersion(st);
+    const record = {
+      fullPath,
+      scope: scope ?? null,
+      identity,
+      ranges: mergeReadRanges(meta?.ranges),
+      isCurrent: () => false,
+      publish: () => {},
+      release: () => {},
+      done: Promise.resolve(),
+    };
+    task.records.push(record);
+    records.push(record);
+    // Acquiring a new lease must not rehabilitate an already stale producer.
+    if (!identity || !canPublishReadCache(fullPath)) return;
+    const decision = Promise.withResolvers();
+    record.publish = (replacement = meta) => decision.resolve(replacement);
+    record.release = () => decision.resolve(null);
+    record.done = runReadCachePublication(fullPath, async () => {
+      record.isCurrent = AsyncLocalStorage.bind(() => canPublishReadCache(fullPath));
+      const selected = await decision.promise;
+      if (selected) helpers._recordReadSnapshot(fullPath, identity, scope, selected);
+    });
+  }
+
+  const executeChild = async (name, args, workDir, options = {}) => {
+    if (name !== 'read' || (args.mode && args.mode !== 'full')) {
+      return executeChildBuiltinTool(name, args, workDir, options);
+    }
+    const task = {
+      entry: args,
+      fullPath: helpers.resolveAgainstCwd(args.path, workDir),
+      records: [],
+      body: null,
+    };
+    tasks.push(task);
+    task.body = await executeChildBuiltinTool(name, args, workDir, {
+      ...options,
+      _readSnapshotRecorder: (...snapshot) => capture(task, ...snapshot),
+    });
+    return task.body;
+  };
+  const snapshotHelpers = {
+    ...helpers,
+    _filterReadSnapshotRanges: (entry, fullPath, scope, ranges) => {
+      const task = tasks.find((task) => task.entry === entry);
+      const observation = task?.records.findLast(
+        (record) => record.fullPath === fullPath && record.scope === (scope ?? null)
+      );
+      // A numbered row may end halfway through its content at the byte cap.
+      // Only this slot's producer can certify complete lines; another read of
+      // the same path must not authorize hashing this slot's partial text.
+      return mergeReadRanges(ranges.flatMap((range) => (observation?.ranges ?? []).map((complete) => ({
+        startLine: Math.max(range.startLine, complete.startLine),
+        endLine: Math.min(range.endLine, complete.endLine),
+      }))));
+    },
+    _recordReadSnapshot: (fullPath, _st, scope, meta) => {
+      corrections.set(fullPath, { scope: scope ?? null, meta });
+    },
+  };
+
+  try {
+    const result = await run(executeChild, snapshotHelpers);
+    // reject_partial refuses the entire payload: staged bodies were not
+    // delivered, so none of their snapshots may become session evidence.
+    if (result?.isError === true || (typeof result === 'string' && helpers.classifyResultKind(result) === 'error')) {
+      return result;
+    }
+    for (const [fullPath, correction] of corrections) {
+      const delivered = tasks.filter((task) => task.fullPath === fullPath && hasRenderedLines(task.body));
+      const observations = delivered.map((task) => task.records.findLast(
+        (record) => record.fullPath === fullPath && record.scope === correction.scope
+      ));
+      // Never combine different versions or bless stale/missing observations.
+      // The eventual recorder rechecks the retained lease after all awaits.
+      if (observations.length && observations.every((record) =>
+        record?.isCurrent() && sameFileVersion(record.identity, observations[0].identity)
+      )) {
+        observations[0].publish(correction.meta);
+      }
+    }
+    // Rich media/binary results have no line slices. Preserve their original
+    // evidence, still under the producer's lease rather than the batch's.
+    for (const task of tasks) {
+      if (hasRenderedLines(task.body) || task.body?.isError === true ||
+          (typeof task.body === 'string' && helpers.classifyResultKind(task.body) === 'error')) continue;
+      for (const record of task.records) {
+        if (!corrections.has(record.fullPath)) record.publish();
+      }
+    }
+    for (const record of records) record.release();
+    await Promise.all(records.map((record) => record.done));
+    return result;
+  } finally {
+    // Promise.all in the dispatcher may reject while other children remain
+    // active. Late captures then become no-ops and cannot leak a held lease.
+    closed = true;
+    for (const record of records) record.release();
+    await Promise.allSettled(records.map((record) => record.done));
+  }
+}

package/src/runtime/agent/orchestrator/tools/builtin/read-tool/batch-snapshot.mjs

@@ -6,6 +6,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { rangeTextOf } from '../snapshot-helpers.mjs';
+import { renderedBatchReadRanges } from './batch-publication.mjs';
 
 // Coalesced batch reads fetch the union window from disk; every caller slot
 // must be sliced back to its original request window (_orig*), not the
@@ -32,22 +33,22 @@ export function restoreCallerSlots(results, origEntries, entryMap, options, { sl
 function deliveredRangesByPath(
   orderedResults,
   workDir,
-  { classifyResultKind, resolveAgainstCwd, _rangeHashesFromRenderedReadText }
+  readStateScope,
+  { classifyResultKind, resolveAgainstCwd, _rangeHashesFromRenderedReadText, _filterReadSnapshotRanges }
 ) {
   const exactRangesByPath = new Map();
   const rangeHashesByPath = new Map();
   for (const r of orderedResults) {
     if (r?.mode !== 'full' || classifyResultKind(String(r.body || '')) === 'error') continue;
-    const m = String(r.body || '').match(/\[lines\s+(\d+)-(\d+)\s+of\s+(\d+)/);
-    if (!m) continue;
-    const startLine = Number(m[1]);
-    const endLine = Number(m[2]);
-    if (!Number.isFinite(startLine) || !Number.isFinite(endLine)) continue;
     const fullPath = resolveAgainstCwd(r.path, workDir);
+    const renderedRanges = renderedBatchReadRanges(r.body);
+    const ranges = _filterReadSnapshotRanges
+      ? _filterReadSnapshotRanges(r.readEntry, fullPath, readStateScope, renderedRanges)
+      : renderedRanges;
+    if (ranges.length === 0) continue;
     if (!exactRangesByPath.has(fullPath)) exactRangesByPath.set(fullPath, []);
-    const range = { startLine, endLine };
-    exactRangesByPath.get(fullPath).push(range);
-    const renderedHashes = _rangeHashesFromRenderedReadText(r.body, [range]);
+    exactRangesByPath.get(fullPath).push(...ranges);
+    const renderedHashes = _rangeHashesFromRenderedReadText(r.body, ranges);
     if (renderedHashes.length > 0) {
       if (!rangeHashesByPath.has(fullPath)) rangeHashesByPath.set(fullPath, []);
       rangeHashesByPath.get(fullPath).push(...renderedHashes);
@@ -68,7 +69,7 @@ async function rawRangeHashes(fullPath, mergedRanges, { _hashText }) {
 
 export async function recordSlicedBatchSnapshots(orderedResults, workDir, readStateScope, helpers) {
   const { _mergeReadRanges, _recordReadSnapshot } = helpers;
-  const { exactRangesByPath, rangeHashesByPath } = deliveredRangesByPath(orderedResults, workDir, helpers);
+  const { exactRangesByPath, rangeHashesByPath } = deliveredRangesByPath(orderedResults, workDir, readStateScope, helpers);
   for (const [fullPath, ranges] of exactRangesByPath) {
     const mergedRanges = _mergeReadRanges(ranges);
     let rangeHashes = rangeHashesByPath.get(fullPath) || [];

package/src/runtime/agent/orchestrator/tools/builtin/read-tool.mjs

@@ -18,6 +18,8 @@ import { normalizeObjectBatchArgs, batchEntriesFromArgs, primaryReadIndexes } fr
 import { dispatchBatchReads } from './read-tool/batch-dispatch.mjs';
 import { restoreCallerSlots, recordSlicedBatchSnapshots } from './read-tool/batch-snapshot.mjs';
 import { renderBatchResults } from './read-tool/batch-render.mjs';
+import { runBatchReadSnapshotPublication } from './read-tool/batch-publication.mjs';
+import { runReadCachePublication } from './cache-layers.mjs';
 
 function hasLineCoordinate(path) {
   return typeof path === 'string' && /(?:#L\d+|:\d+(?:-\d+)?(?::|$))/i.test(path);
@@ -54,17 +56,25 @@ async function executeBatchRead(args, workDir, readStateScope, executeChildBuilt
   const origEntries = Array.isArray(args._readsOrigEntries) ? args._readsOrigEntries : null;
   const entryMap = Array.isArray(args._readsEntryToDeduped) ? args._readsEntryToDeduped : null;
   const readIndexFor = primaryReadIndexes(entries, overrides, (p) => helpers.resolveAgainstCwd(p, workDir));
-  const results = await dispatchBatchReads({
-    entries,
-    readIndexFor,
-    workDir,
-    options,
-    helpers,
-    executeChildBuiltinTool,
-  });
-  const orderedResults = origEntries ? restoreCallerSlots(results, origEntries, entryMap, options, helpers) : results;
-  if (origEntries) await recordSlicedBatchSnapshots(orderedResults, workDir, readStateScope, helpers);
-  return renderBatchResults(orderedResults, args, helpers);
+  const run = async (executeChild = executeChildBuiltinTool, snapshotHelpers = helpers) => {
+    const results = await dispatchBatchReads({
+      entries,
+      readIndexFor,
+      workDir,
+      options,
+      helpers,
+      executeChildBuiltinTool: executeChild,
+    });
+    const orderedResults = origEntries ? restoreCallerSlots(results, origEntries, entryMap, options, helpers) : results;
+    if (origEntries) await recordSlicedBatchSnapshots(orderedResults, workDir, readStateScope, snapshotHelpers);
+    return renderBatchResults(orderedResults, args, helpers);
+  };
+  if (!origEntries) return run();
+  // Keep the original batch lease for glance/media paths outside the scalar
+  // pipeline. Sliced evidence uses the producing child's retained lease, so
+  // a hash rejection never requires renewing this potentially stale parent.
+  const paths = entries.filter((entry) => entry?.path).map((entry) => helpers.resolveAgainstCwd(entry.path, workDir));
+  return runReadCachePublication(paths, () => runBatchReadSnapshotPublication(executeChildBuiltinTool, helpers, run));
 }
 
 // Glance modes served by their own child tool: the tool name and the args it

package/src/runtime/agent/orchestrator/tools/builtin/runtime-capabilities.mjs

@@ -102,7 +102,7 @@ function findRepositoryRoot(startDirectory, { maxDepth = 64 } = {}) {
     const marker = pathJoin(current, '.git');
     try {
       const stats = statSync(marker);
-      return { root: current, gitDirectory: stats.isDirectory() ? marker : null };
+      return { root: current, gitDirectory: stats.isDirectory() ? marker : _linkedGitDirectory(marker, current) };
     } catch {}
     const parent = pathDirname(current);
     if (parent === current) break;
@@ -111,6 +111,17 @@ function findRepositoryRoot(startDirectory, { maxDepth = 64 } = {}) {
   return null;
 }
 
+// A linked worktree's `.git` file names its own git directory (`gitdir: …`),
+// which holds that worktree's HEAD.
+function _linkedGitDirectory(markerFile, root) {
+  try {
+    const target = /^gitdir:\s*(.+)$/m.exec(readFileSync(markerFile, 'utf8'))?.[1]?.trim();
+    return target ? pathResolveAbsolute(root, target) : null;
+  } catch {
+    return null;
+  }
+}
+
 function _headBranch(gitDirectory) {
   if (!gitDirectory) return null;
   try {

package/src/runtime/agent/orchestrator/tools/builtin/task-tool.mjs

@@ -180,7 +180,10 @@ async function waitForShellTask(task, taskId, args, options) {
   return interruptedByUser;
 }
 
-async function cancelShellTask(task, taskId, options) {
+// Outcome of a shell cancel: `outcome` is 'cancelled' only when the process is
+// confirmed gone (or never had one), 'unconfirmed' when the kill was delivered
+// but the exit could not be confirmed, 'not-found' for an unknown task.
+async function cancelShellTaskOutcome(task, taskId, options) {
   // A tracked task with no native job is still cancellable: the
   // registry's own cancel hook owns it (descendants that outlived
   // their shell). Remember that it WAS live so the outcome is
@@ -196,11 +199,14 @@ async function cancelShellTask(task, taskId, options) {
     if (confirmed && confirmed.status === 'running') {
       // Watcher and notify context stay armed: the eventual exit
       // must still reach the owner.
-      return [
-        'status: cancel-unconfirmed',
-        `task_id: ${taskId}`,
-        'the cancellation was delivered but the process has not exited yet. It stays tracked and its completion is still delivered; re-run task cancel or task read to check again.',
-      ].join('\n');
+      return {
+        outcome: 'unconfirmed',
+        text: [
+          'status: cancel-unconfirmed',
+          `task_id: ${taskId}`,
+          'the cancellation was delivered but the process has not exited yet. It stays tracked and its completion is still delivered; re-run task cancel or task read to check again.',
+        ].join('\n'),
+      };
     }
     if (!confirmed) {
       // No terminal event and no observable task: absence of
@@ -209,19 +215,56 @@ async function cancelShellTask(task, taskId, options) {
       cancelBackgroundShellJobWatch(taskId);
       clearShellJobNotifyCtx(taskId);
       cancelBackgroundTask(taskId, 'cancelled by task control; termination unconfirmed');
-      return [
-        'status: cancel-unconfirmed',
-        `task_id: ${taskId}`,
-        'the cancellation was delivered but this task is no longer observable, so its termination could not be confirmed. Verify the process directly if it must be gone.',
-      ].join('\n');
+      return {
+        outcome: 'unconfirmed',
+        text: [
+          'status: cancel-unconfirmed',
+          `task_id: ${taskId}`,
+          'the cancellation was delivered but this task is no longer observable, so its termination could not be confirmed. Verify the process directly if it must be gone.',
+        ].join('\n'),
+      };
     }
   }
   cancelBackgroundShellJobWatch(taskId);
   clearShellJobNotifyCtx(taskId);
   cancelBackgroundTask(taskId, 'cancelled by task control');
   return job || wasRunning
-    ? renderTaskCancelSuccess(taskId, getBackgroundTask(taskId, { context: options }) || task)
-    : buildJobNotFoundMessage(taskId);
+    ? {
+        outcome: 'cancelled',
+        text: renderTaskCancelSuccess(taskId, getBackgroundTask(taskId, { context: options }) || task),
+      }
+    : { outcome: 'not-found', text: buildJobNotFoundMessage(taskId) };
+}
+
+async function cancelShellTask(task, taskId, options) {
+  return (await cancelShellTaskOutcome(task, taskId, options)).text;
+}
+
+/**
+ * Stop one BACKGROUND shell job of the caller's session (desktop stop button).
+ * The same cancel the `task` tool runs, with a structured answer: `stopped` is
+ * true only when the job was actually cancelled. Only promoted/async jobs hold
+ * a background task, so a foreground command can never match; the session
+ * scope is the caller's, so another session's job reads as unknown.
+ */
+export async function stopBackgroundShellJob(taskId, options = {}) {
+  const id = typeof taskId === 'string' ? taskId.trim() : '';
+  if (!id) return { stopped: false, error: 'task_id is required' };
+  const task = getBackgroundTask(id, { context: options });
+  if (!task || task.surface !== 'shell') return { stopped: false, error: `task not found: ${id}` };
+  const job = peekShellJob(id);
+  const status = job ? job.status : task.status;
+  if (status !== 'running') return { stopped: false, error: `task already ${status}: ${id}` };
+  try {
+    const { outcome, text } = await cancelShellTaskOutcome(task, id, options);
+    if (outcome === 'cancelled') return { stopped: true };
+    return {
+      stopped: false,
+      error: outcome === 'unconfirmed' ? `cancellation not confirmed: ${id}` : text.replace(/^Error:\s*/, ''),
+    };
+  } catch (error) {
+    return { stopped: false, error: error instanceof Error ? error.message : String(error) };
+  }
 }
 
 export async function executeTaskTool(args, options = {}) {

package/src/runtime/agent/orchestrator/tools/code-graph/disk-cache.mjs

@@ -573,6 +573,64 @@ export function listCachedCodeGraphRoots() {
   }
 }
 
+// Remove one root (exact canonical match) from the disk cache: its resident
+// entry, its staged call-site sidecar, its manifest row and its <hash>.json /
+// <hash>.calls.json files. The resident drop is synchronous and happens first,
+// so a flush already scheduled for other roots can no longer write this one
+// back; the manifest is edited under the same cross-process lock the persist
+// path takes, so a concurrent writer merges the result instead of restoring
+// the row. Never creates the cache directory. Returns { removed, kept }; kept
+// are cache files that matched but could not be deleted.
+export function forgetDiskCodeGraphRoot(root) {
+  const key = _canonicalGraphCwd(root);
+  const removed = [];
+  const kept = [];
+  if (_diskCodeGraphCache.has(key)) removed.push(`resident:${key}`);
+  _dropDiskEntry(key);
+  if (_pendingCallsSidecars.delete(key)) removed.push(`pending-calls-sidecar:${key}`);
+  const dir = _codeGraphDiskDir();
+  if (!existsSync(dir)) return { removed, kept };
+  withFileLockSync(
+    join(dir, '.persist.lock'),
+    () => {
+      const manifest = _readPreservedManifest(dir);
+      const hashes = new Set([_hashCwd(key)]);
+      let changed = false;
+      for (const [cwd, meta] of Object.entries(manifest)) {
+        let same = false;
+        try {
+          same = _canonicalGraphCwd(cwd) === key;
+        } catch {
+          /* a malformed key is not this root */
+        }
+        if (!same) continue;
+        if (_isCodeGraphCacheHash(meta?.hash)) hashes.add(meta.hash);
+        delete manifest[cwd];
+        changed = true;
+        removed.push(`manifest:${cwd}`);
+      }
+      for (const hash of hashes) {
+        for (const file of [join(dir, `${hash}.json`), callsSidecarPath(dir, hash)]) {
+          if (!existsSync(file)) continue;
+          try {
+            unlinkSync(file);
+            removed.push(file);
+          } catch {
+            kept.push(file);
+          }
+        }
+      }
+      if (changed) writeJsonAtomicSync(join(dir, 'manifest.json'), manifest, { compact: true, lock: false });
+      if (_diskManifest) {
+        delete _diskManifest[key];
+        if (changed) _diskManifest = manifest;
+      }
+    },
+    { timeoutMs: 10_000 }
+  );
+  return { removed, kept };
+}
+
 // ── call-site sidecar ───────────────────────────────────────────────────────
 // Resolve the sidecar file of a canonical cwd. The manifest hash wins when the
 // entry is known (it is what the persist loop wrote); otherwise the hash is

package/src/runtime/agent/orchestrator/tools/code-graph/trusted-roots.mjs

@@ -1,6 +1,6 @@
 import { statSync } from 'node:fs';
 import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
-import { listProjects } from '../../../../shared/projects.mjs';
+import { listProjects, removeProject } from '../../../../shared/projects.mjs';
 import { explicitSessionCwd, readLastSessionCwd } from '../../../../shared/user-cwd.mjs';
 import { canonicalGraphPath } from '../code-graph-state.mjs';
 import { listCachedCodeGraphRoots } from './disk-cache.mjs';
@@ -85,6 +85,30 @@ export function collectTrustedCodeGraphRoots(
   return [...found.values()].sort((a, b) => a.localeCompare(b));
 }
 
+/**
+ * Stop trusting one root as a federation target. Trust is derived from the
+ * Project registry, the session's selected cwd and the cache manifest; the
+ * manifest row goes with forgetDiskCodeGraphRoot() and a selected cwd is
+ * dropped by the directory check once the folder is gone, so the registry is
+ * the only stored source left. Only the exact root is removed (nested Projects
+ * stay). Returns { removed, kept }; kept are registered paths that matched but
+ * could not be unregistered.
+ */
+export function forgetTrustedCodeGraphRoot(
+  root,
+  { registered = () => listProjects().map((entry) => entry.path), unregister = removeProject } = {}
+) {
+  const removed = [];
+  const kept = [];
+  const key = canonicalGraphPath(root);
+  for (const path of registered()) {
+    if (!path || canonicalGraphPath(path) !== key) continue;
+    if (unregister(path)) removed.push(path);
+    else kept.push(path);
+  }
+  return { removed, kept };
+}
+
 export function owningTrustedCodeGraphRoot(file, roots) {
   const matches = (roots || []).filter((root) => _pathIsWithin(root, file));
   matches.sort((a, b) => resolve(b).length - resolve(a).length);

package/src/runtime/agent/orchestrator/tools/patch/ui-diff.mjs

@@ -1,6 +1,7 @@
 // UI-diff side channel: a committed apply_patch (or edit-tool write) records
 // a turn-review change entry and a per-call diff the desktop/TUI tool cards
 // pick up. Display only — never affects edit semantics.
+import { createTwoFilesPatch } from 'diff';
 import { boundReviewPatch } from '../../../../shared/review-diff.mjs';
 import { recordTurnDiffChanges } from '../../../../shared/turn-snapshot.mjs';
 import { pathKey, resolveV4AEntryPath } from './paths.mjs';
@@ -29,6 +30,77 @@ export function takeApplyPatchUiDiff(callId) {
   return value;
 }
 
+// A display path is a plain relative or absolute path; the patch header only
+// needs forward slashes. Its own leading "a/" is part of the name.
+function headerPath(value) {
+  return String(value || '')
+    .trim()
+    .replace(/\\/g, '/');
+}
+
+const DIFF_TIMEOUT_MS = 100;
+
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+
+function isOmitted(value) {
+  return Boolean(value) && typeof value === 'object' && !(value instanceof Uint8Array) && value.omitted === true;
+}
+
+// Text of one side: '' for an absent file, null when it is not UTF-8 text.
+function sideText(value) {
+  if (value == null) return '';
+  if (typeof value === 'string') return value;
+  if (value instanceof Uint8Array) {
+    try {
+      return utf8.decode(value);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+// One file's change, from the call's own before and after states: absent
+// (null), bytes or text, or an omitted marker when the bytes were not kept.
+function renderCallChange({ displayPath, newDisplayPath, before, after }) {
+  const oldName = headerPath(displayPath) || 'unknown file';
+  const newName = headerPath(newDisplayPath) || oldName;
+  const oldHeader = before == null ? '/dev/null' : `a/${oldName}`;
+  const newHeader = after == null ? '/dev/null' : `b/${newName}`;
+  let head = `diff --git a/${oldName} b/${newName}\n`;
+  if (before == null && after != null) head += 'new file mode 100644\n';
+  else if (before != null && after == null) head += 'deleted file mode 100644\n';
+  if (isOmitted(before) || isOmitted(after)) {
+    return `${head}Binary files ${oldHeader} and ${newHeader} differ\n`;
+  }
+  const oldText = sideText(before);
+  const newText = sideText(after);
+  if (oldText === null || newText === null) return `${head}Binary files ${oldHeader} and ${newHeader} differ\n`;
+  if (oldText === newText) {
+    // An empty file created or deleted still changed: git writes the mode line alone.
+    if ((before == null) !== (after == null)) return head;
+    return oldName === newName ? '' : `${head}similarity index 100%\nrename from ${oldName}\nrename to ${newName}\n`;
+  }
+  const rename = oldName === newName ? '' : `rename from ${oldName}\nrename to ${newName}\n`;
+  try {
+    const generated = createTwoFilesPatch(oldHeader, newHeader, oldText, newText, '', '', {
+      context: 3,
+      timeout: DIFF_TIMEOUT_MS,
+    });
+    const start = generated.search(/^--- /m);
+    if (start >= 0) return `${head}${rename}${generated.slice(start).replace(/\n*$/, '\n')}`;
+  } catch {
+    // A pathological diff timing out must not stall tool completion.
+  }
+  return `${head}${rename}Binary files ${oldHeader} and ${newHeader} differ\n`;
+}
+
+// A call's card shows the change that call made — its own before against its
+// own after — never the turn's running total for the same files.
+export function callUiDiff(changes) {
+  return (changes || []).map(renderCallChange).join('');
+}
+
 // Edit-tool UI diff: a successful single-file str-replace edit records the
 // same turn-review change entry and per-call UI diff side channel that a
 // committed apply_patch gets, so desktop/TUI tool cards render both edit
@@ -36,15 +108,16 @@ export function takeApplyPatchUiDiff(callId) {
 export function registerEditToolUiDiff({ callId, sessionId, basePath, fullPath, before, after }) {
   if (!callId || !sessionId || typeof fullPath !== 'string') return;
   try {
-    const turnDiff = recordTurnDiffChanges(sessionId, [
+    const changes = [
       {
         path: fullPath,
         displayPath: patchHeaderPathForResolved(basePath || '', fullPath),
         before: before ?? null,
         after: after ?? null,
       },
-    ]);
-    registerApplyPatchUiDiff(callId, turnDiff);
+    ];
+    recordTurnDiffChanges(sessionId, changes);
+    registerApplyPatchUiDiff(callId, callUiDiff(changes));
   } catch {
     // best-effort display channel
   }
@@ -111,8 +184,8 @@ export function registerCommittedPatchUiDiff({
         after: snapshotContent(after),
       });
     }
-    const turnDiff = recordTurnDiffChanges(sessionId, changes);
-    registerApplyPatchUiDiff(callId, turnDiff);
+    recordTurnDiffChanges(sessionId, changes);
+    registerApplyPatchUiDiff(callId, callUiDiff(changes));
   } catch {
     // Review collection is a side channel and must never affect committed
     // apply_patch success/failure semantics.

package/src/runtime/agent/orchestrator/tools/progress-message.mjs

@@ -75,6 +75,8 @@ export function formatToolStartProgress(name, args = {}) {
     }
     case 'terminal':
       return a.action === 'read' ? `reading terminal${a.tab ? ` ${_t(a.tab)}` : ''}` : 'listing terminals';
+    case 'visualize':
+      return `visualize ${_t(a.action || 'command')}`;
     case 'office':
       return a.path ? `office ${_t(a.action || 'command')} ${_t(a.path)}` : `office ${_t(a.action || 'command')}`;
     case 'media': {

package/src/runtime/attachments/store.mjs

@@ -8,9 +8,13 @@
  */
 import { createHash, randomBytes } from 'node:crypto';
 import {
+  closeSync,
   existsSync,
+  fstatSync,
   mkdirSync,
+  openSync,
   readFileSync,
+  readSync,
   renameSync,
   statSync,
   unlinkSync,
@@ -303,6 +307,40 @@ function readAttachmentText(value) {
   return readAttachmentBuffer(value).toString('utf8');
 }
 
+/**
+ * A referenced blob's UTF-8 text when the blob on disk holds at most
+ * `maxBytes`, else null. The size comes from the opened file, never from the
+ * reference's claimed sizeBytes, and at most `maxBytes + 1` bytes are read, so
+ * a blob that grows between the check and the read is rejected too. Missing,
+ * invalid or tampered blobs throw like readAttachmentBuffer.
+ */
+export function readAttachmentTextWithin(value, maxBytes) {
+  const ref = typeof value === 'string' ? value : value?.attachmentRef;
+  const fd = openSync(attachmentPath(ref), 'r');
+  try {
+    const info = fstatSync(fd);
+    if (!info.isFile() || info.size <= 0) {
+      throw Object.assign(new Error('prompt attachment blob is invalid'), { code: ATTACHMENT_INVALID });
+    }
+    if (info.size > maxBytes) return null;
+    const buffer = Buffer.alloc(info.size + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const read = readSync(fd, buffer, length, buffer.length - length, length);
+      if (read === 0) break;
+      length += read;
+    }
+    if (length > maxBytes) return null;
+    const bytes = buffer.subarray(0, length);
+    if (attachmentRefForBuffer(bytes) !== ref) {
+      throw Object.assign(new Error('prompt attachment integrity check failed'), { code: ATTACHMENT_INTEGRITY });
+    }
+    return bytes.toString('utf8');
+  } finally {
+    closeSync(fd);
+  }
+}
+
 export function attachmentTextForPart(part) {
   if (!isAttachmentReference(part)) return typeof part?.text === 'string' ? part.text : '';
   const text = readAttachmentText(part);