mixdog 1.2.1 → 1.2.3

package/src/runtime/agent/orchestrator/tools/builtin/lib/shell-job-records.mjs

@@ -12,10 +12,18 @@
  * The owner marker disappears when the job settles and a `.done` marker keeps
  * the terminal JSON out of live counters. Terminal metadata remains available
  * for a bounded manual-recovery window.
+ *
+ * Ordering: a promoted job keeps its foreground id, so the foreground marker's
+ * retire and the promoted job's publish address the same files. Every publish,
+ * complete and retire for one jobId therefore runs on a per-job chain, strictly
+ * in call order and never overlapping. A record is written atomically (temp
+ * file + rename) and always before its owner marker, so a reader never sees a
+ * partial `.json`, and a marker never exists without its `.json`.
  */
 import { access, mkdir, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { writeJsonAtomicAsync } from '../../../../../shared/atomic-file.mjs';
 import { isPidAlive } from '../../../../../shared/pid-liveness.mjs';
 import { displayShellCommand } from '../../../../../shared/shell-display.mjs';
 
@@ -24,12 +32,27 @@ import { displayShellCommand } from '../../../../../shared/shell-display.mjs';
 const ORPHAN_GRACE_MS = 60 * 60 * 1000;
 const COMPLETED_SHELL_JOB_TTL_MS = 30 * 60 * 1000;
 
-const publishing = new Map();
+const chains = new Map();
 const paths = new Map();
 const records = new Map();
-const retired = new Set();
+// jobId -> token of the live terminal record. Every publish/retire clears it and
+// every completion replaces it, so a TTL timer armed for an older incarnation
+// can tell its files are no longer the ones it was armed for.
+const incarnations = new Map();
+let incarnationSeq = 0;
 let sweepStarted = false;
 
+/** Run `operation` after every earlier operation for `jobId` has finished. */
+function enqueue(jobId, operation) {
+  const run = (chains.get(jobId) || Promise.resolve()).then(operation);
+  const tail = run.catch(() => {});
+  chains.set(jobId, tail);
+  void tail.then(() => {
+    if (chains.get(jobId) === tail) chains.delete(jobId);
+  });
+  return run;
+}
+
 function dataDir() {
   return process.env.MIXDOG_DATA_DIR || join(process.env.MIXDOG_HOME || join(homedir(), '.mixdog'), 'data');
 }
@@ -140,9 +163,8 @@ export function publishShellJobRecord(
   const dir = jobsDir();
   const jsonPath = join(dir, `${jobId}.json`);
   const ownerPath = join(dir, `${jobId}.owner-${ownerPid}`);
-  retired.delete(jobId);
   paths.set(jobId, [jsonPath, ownerPath]);
-  const work = (async () => {
+  void enqueue(jobId, async () => {
     try {
       await mkdir(dir, { recursive: true });
       if (!sweepStarted) {
@@ -172,18 +194,13 @@ export function publishShellJobRecord(
         ...(foreground ? { foreground: true } : {}),
       };
       records.set(jobId, record);
-      await writeFile(jsonPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+      incarnations.delete(jobId);
+      // The record lands whole before the marker that advertises it.
+      await writeJsonAtomicAsync(jsonPath, record, { fsync: false });
       await writeFile(ownerPath, '', 'utf8');
     } catch {
       /* the record is presentation only; never fail a job for it */
     }
-    // A job that settled while the write was in flight must not leave a
-    // record behind.
-    if (retired.has(jobId)) await removePaths([jsonPath, ownerPath]);
-  })();
-  publishing.set(jobId, work);
-  void work.finally(() => {
-    if (publishing.get(jobId) === work) publishing.delete(jobId);
   });
 }
 
@@ -196,11 +213,7 @@ export function completeShellJobRecord(jobId, detail) {
   const donePath = join(dir, `${key}.done`);
   const list = paths.get(key) || [jsonPath];
   const ownerPaths = list.filter((path) => path.includes('.owner-'));
-  const pending = publishing.get(key);
-  const work = (async () => {
-    try {
-      await pending;
-    } catch {}
+  return enqueue(key, async () => {
     await mkdir(dir, { recursive: true });
     let base = records.get(key) || null;
     if (!base) {
@@ -210,19 +223,26 @@ export function completeShellJobRecord(jobId, detail) {
     }
     const record = terminalRecord(base, { ...detail, jobId: key });
     records.set(key, record);
-    await writeFile(jsonPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+    await writeJsonAtomicAsync(jsonPath, record, { fsync: false });
     await writeFile(donePath, '', 'utf8');
     await removePaths(ownerPaths);
     paths.set(key, [jsonPath, donePath]);
+    const incarnation = ++incarnationSeq;
+    incarnations.set(key, incarnation);
     const timer = setTimeout(() => {
-      records.delete(key);
-      paths.delete(key);
-      void removePaths([jsonPath, donePath]);
+      // Expire through the job's queue and only if no publish, retire or newer
+      // completion has replaced the files this timer was armed for.
+      void enqueue(key, async () => {
+        if (incarnations.get(key) !== incarnation) return;
+        incarnations.delete(key);
+        records.delete(key);
+        paths.delete(key);
+        await removePaths([jsonPath, donePath]);
+      });
     }, COMPLETED_SHELL_JOB_TTL_MS);
     timer.unref?.();
     return true;
-  })().catch(() => false);
-  return work;
+  }).catch(() => false);
 }
 
 export async function readShellJobRecord(jobId) {
@@ -266,18 +286,13 @@ export async function listShellJobRecords() {
 export function retireShellJobRecord(jobId) {
   const key = String(jobId || '').trim();
   if (!key) return;
-  retired.add(key);
-  records.delete(key);
   const list = paths.get(key);
   paths.delete(key);
-  const pending = publishing.get(key);
-  void (async () => {
-    try {
-      await pending;
-    } catch {
-      /* the publish path owns its failure */
-    }
+  // Queued behind every earlier publish and ahead of any later one: a promoted
+  // job publishing after this call is written only once this removal is done.
+  void enqueue(key, async () => {
+    records.delete(key);
+    incarnations.delete(key);
     await removePaths(list);
-    retired.delete(key);
-  })();
+  });
 }

package/src/runtime/agent/orchestrator/tools/builtin/runtime-capabilities.mjs

@@ -41,7 +41,29 @@ function _posixStartupShell(candidates = ['/bin/bash', '/usr/bin/bash', '/bin/sh
   return null;
 }
 
-export function describeShellToolsStartupState({
+// Every session composes this line. Probing it means up to names×PATHEXT×PATH
+// stats on Windows (~40ms) or a login-shell spawn on POSIX, both on the event
+// loop, so one answer per PATH/shell is reused for a short window — the same
+// rule as gitExecutablePresent: a session opened after an install still picks
+// the tool up once the window passes.
+const SHELL_TOOLS_STARTUP_TTL_MS = 30_000;
+let _shellToolsStartup = null;
+
+export function describeShellToolsStartupState(options = {}) {
+  if (options._spawnSync) return _probeShellToolsStartupState(options);
+  const { platform = process.platform, names = SHELL_TOOL_STARTUP_NAMES, shellPath = null } = options;
+  const pathValue = options.pathValue ?? (process.env.PATH || '');
+  const key = JSON.stringify([platform, names, shellPath, pathValue]);
+  const now = Date.now();
+  if (_shellToolsStartup?.key === key && now - _shellToolsStartup.at < SHELL_TOOLS_STARTUP_TTL_MS) {
+    return _shellToolsStartup.value;
+  }
+  const value = _probeShellToolsStartupState(options);
+  _shellToolsStartup = { key, at: now, value };
+  return value;
+}
+
+function _probeShellToolsStartupState({
   platform = process.platform,
   names = SHELL_TOOL_STARTUP_NAMES,
   shellPath = null,

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch/root-resolution.mjs

@@ -136,7 +136,7 @@ export function resolveDirectoryRoot(name, effectiveCwd, { filesystemRootCwd })
       `${_PROJECT_ROOT_SENTINELS.join('/')} at it or any ancestor)` +
       `${childRoots.length > 1 ? ` and holds ${childRoots.length} separate project roots (${listed})` : ''}. ` +
       `${boundaryRoot ? `The nearest sentinel is at '${boundaryRoot}' (home/temp), which is never auto-adopted. ` : ''}` +
-      `Refusing to index an arbitrary tree. Run 'cwd set <repo>', or pass an explicit ` +
+      `Refusing to index an arbitrary tree. Switch Project with the session tool (set-project), or pass an explicit ` +
       `'cwd' (repo root) or a 'file' anchor.`
   );
 }

package/src/runtime/agent/orchestrator/tools/code-graph/search.mjs

@@ -854,6 +854,6 @@ export function _augmentNoHitDiagnostic(result, emptyToken, graph, cwd, symbol)
   }
   return (
     `${emptyToken}\n# '${symbol}' not present in graph rooted at ${cwd} (${n} files indexed${trunc}). ` +
-    `If it should exist, the target is likely outside this cwd — pass an explicit 'cwd' (repo root) or 'file' anchor, or run 'cwd set <repo>'.`
+    `If it should exist, the target is likely outside this cwd — pass an explicit 'cwd' (repo root) or 'file' anchor, or switch Project with the session tool (set-project).`
   );
 }

package/src/runtime/agent/orchestrator/tools/patch/ui-diff.mjs

@@ -1,8 +1,9 @@
 // UI-diff side channel: a committed apply_patch (or edit-tool write) records
 // a turn-review change entry and a per-call diff the desktop/TUI tool cards
 // pick up. Display only — never affects edit semantics.
-import { createTwoFilesPatch } from 'diff';
+import { createLineDiffBudget, lineDiffHunks, unifiedHunksBody } from '../../../../shared/bounded-line-diff.mjs';
 import { boundReviewPatch } from '../../../../shared/review-diff.mjs';
+import { decodeText } from '../../../../shared/turn-changes.mjs';
 import { recordTurnDiffChanges } from '../../../../shared/turn-snapshot.mjs';
 import { pathKey, resolveV4AEntryPath } from './paths.mjs';
 import { patchHeaderPathForResolved } from './read-redirects.mjs';
@@ -38,31 +39,21 @@ function headerPath(value) {
     .replace(/\\/g, '/');
 }
 
-const DIFF_TIMEOUT_MS = 100;
-
-const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
-
 function isOmitted(value) {
   return Boolean(value) && typeof value === 'object' && !(value instanceof Uint8Array) && value.omitted === true;
 }
 
-// Text of one side: '' for an absent file, null when it is not UTF-8 text.
+// Text of one side: '' for an absent file, null when it is binary (not UTF-8
+// or holding a NUL byte) — the same rule as the turn review's tracker diffs.
 function sideText(value) {
-  if (value == null) return '';
-  if (typeof value === 'string') return value;
-  if (value instanceof Uint8Array) {
-    try {
-      return utf8.decode(value);
-    } catch {
-      return null;
-    }
-  }
+  if (value == null || typeof value === 'string' || value instanceof Uint8Array) return decodeText(value);
   return null;
 }
 
 // One file's change, from the call's own before and after states: absent
 // (null), bytes or text, or an omitted marker when the bytes were not kept.
-function renderCallChange({ displayPath, newDisplayPath, before, after }) {
+// `budget` is the call's line-diff budget.
+function renderCallChange({ displayPath, newDisplayPath, before, after }, budget) {
   const oldName = headerPath(displayPath) || 'unknown file';
   const newName = headerPath(newDisplayPath) || oldName;
   const oldHeader = before == null ? '/dev/null' : `a/${oldName}`;
@@ -82,23 +73,46 @@ function renderCallChange({ displayPath, newDisplayPath, before, after }) {
     return oldName === newName ? '' : `${head}similarity index 100%\nrename from ${oldName}\nrename to ${newName}\n`;
   }
   const rename = oldName === newName ? '' : `rename from ${oldName}\nrename to ${newName}\n`;
-  try {
-    const generated = createTwoFilesPatch(oldHeader, newHeader, oldText, newText, '', '', {
-      context: 3,
-      timeout: DIFF_TIMEOUT_MS,
-    });
-    const start = generated.search(/^--- /m);
-    if (start >= 0) return `${head}${rename}${generated.slice(start).replace(/\n*$/, '\n')}`;
-  } catch {
-    // A pathological diff timing out must not stall tool completion.
+  const { hunks } = lineDiffHunks(oldText, newText, budget, [before ?? null, after ?? null]);
+  return `${head}${rename}${unifiedHunksBody(oldHeader, newHeader, hunks)}`;
+}
+
+// Added/deleted lines of one rendered change, counted in its hunks only.
+function hunkLineCounts(patch) {
+  let additions = 0;
+  let deletions = 0;
+  let inHunk = false;
+  for (const line of patch.split('\n')) {
+    if (line.startsWith('@@')) inHunk = true;
+    else if (inHunk && line.startsWith('+')) additions += 1;
+    else if (inHunk && line.startsWith('-')) deletions += 1;
   }
-  return `${head}${rename}Binary files ${oldHeader} and ${newHeader} differ\n`;
+  return { additions, deletions };
+}
+
+// Each change with the line counts of its own unbounded diff (the turn review
+// sums them per file), plus the call's whole diff, within the call's budget.
+export function measureCallChanges(changes, budget = createLineDiffBudget()) {
+  const patches = (changes || []).map((change) => renderCallChange(change, budget));
+  return {
+    diff: patches.join(''),
+    changes: (changes || []).map((change, index) => ({ ...change, ...hunkLineCounts(patches[index]) })),
+  };
 }
 
 // A call's card shows the change that call made — its own before against its
 // own after — never the turn's running total for the same files.
 export function callUiDiff(changes) {
-  return (changes || []).map(renderCallChange).join('');
+  return measureCallChanges(changes).diff;
+}
+
+// Fold the call's measured changes into the turn review and publish its card
+// diff. Both share one line-diff budget: the call is one operation.
+function recordCallChanges(callId, sessionId, changes) {
+  const budget = createLineDiffBudget();
+  const measured = measureCallChanges(changes, budget);
+  recordTurnDiffChanges(sessionId, measured.changes, budget);
+  registerApplyPatchUiDiff(callId, measured.diff);
 }
 
 // Edit-tool UI diff: a successful single-file str-replace edit records the
@@ -108,21 +122,42 @@ export function callUiDiff(changes) {
 export function registerEditToolUiDiff({ callId, sessionId, basePath, fullPath, before, after }) {
   if (!callId || !sessionId || typeof fullPath !== 'string') return;
   try {
-    const changes = [
-      {
-        path: fullPath,
-        displayPath: patchHeaderPathForResolved(basePath || '', fullPath),
-        before: before ?? null,
-        after: after ?? null,
-      },
-    ];
-    recordTurnDiffChanges(sessionId, changes);
-    registerApplyPatchUiDiff(callId, callUiDiff(changes));
+    recordCallChanges(callId, sessionId, [toolFileChange(basePath, { fullPath, before, after })]);
   } catch {
     // best-effort display channel
   }
 }
 
+function toolFileChange(basePath, { fullPath, before, after }) {
+  return {
+    path: fullPath,
+    displayPath: patchHeaderPathForResolved(basePath || '', fullPath),
+    before: before ?? null,
+    after: after ?? null,
+  };
+}
+
+// Writes of a tool without a per-call card (tidy, office): each change
+// `{ fullPath, before, after }` (null = absent, bytes, or an omitted marker)
+// joins the turn review with its own line counts, like an edit-tool write.
+// Side channel only — never affects the tool result.
+export function recordToolFileChanges({ sessionId, basePath, changes }) {
+  if (!sessionId || !changes?.length) return;
+  try {
+    const budget = createLineDiffBudget();
+    recordTurnDiffChanges(
+      sessionId,
+      measureCallChanges(
+        changes.map((change) => toolFileChange(basePath, change)),
+        budget
+      ).changes,
+      budget
+    );
+  } catch {
+    // best-effort review channel
+  }
+}
+
 // Review content of one snapshot: null when absent, the bytes when captured,
 // and an explicit omitted marker (never empty bytes) when they were not.
 function snapshotContent(snapshot) {
@@ -184,8 +219,7 @@ export function registerCommittedPatchUiDiff({
         after: snapshotContent(after),
       });
     }
-    recordTurnDiffChanges(sessionId, changes);
-    registerApplyPatchUiDiff(callId, callUiDiff(changes));
+    recordCallChanges(callId, sessionId, changes);
   } catch {
     // Review collection is a side channel and must never affect committed
     // apply_patch success/failure semantics.

package/src/runtime/agent/orchestrator/tools/progress-message.mjs

@@ -105,8 +105,25 @@ export function formatToolStartProgress(name, args = {}) {
     // ── host_input / cwd ─────────────────────────────────────────────
     case 'inject_input':
       return 'injecting input';
-    case 'cwd':
+    case 'cwd': // legacy: old transcripts
       return a.action === 'set' ? 'setting cwd' : 'resolving cwd';
+    case 'session':
+      switch (a.action) {
+        case 'set-project':
+          return 'setting project';
+        case 'rename':
+          return 'renaming session';
+        case 'compact':
+          return 'scheduling compaction';
+        case 'fork':
+          return 'forking into a new session';
+        case 'favorite':
+          return a.value === false ? 'unfavoriting session' : 'favoriting session';
+        case 'archive':
+          return a.value === false ? 'unarchiving session' : 'archiving session';
+        default:
+          return 'checking session';
+      }
 
     default:
       return `running ${name}`;

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -27,9 +27,9 @@ export {
 } from './shell-powershell.mjs';
 export { stripAnsi, ExecResult } from './shell-exec-output.mjs';
 
-async function _execPolicyBlockMessage(command) {
+async function _execPolicyBlockMessage(command, elevationApproved = false) {
   const { checkExecPolicyMessage } = await import('./bash-policy-scan.mjs');
-  return checkExecPolicyMessage(command);
+  return checkExecPolicyMessage(command, { elevationApproved });
 }
 
 // Admission-wait ceiling. Without it a saturated shell lane (all leases held
@@ -233,7 +233,7 @@ const failedResult = (run, stderr, failureReason) =>
 // Admission lease, policy preflight, then the spawn. Resolves the run with a
 // tool-phase failure and returns false when the command never reaches a shell.
 async function admitAndSpawn(run, params, { admissionWaitMs, onSaturated }) {
-  const { admission, command, ownerSessionId, abortSignal } = params;
+  const { admission, command, ownerSessionId, abortSignal, elevationApproved } = params;
   try {
     run.resourceLease = await acquireShellLeaseBounded(admission, {
       abortSignal,
@@ -241,7 +241,7 @@ async function admitAndSpawn(run, params, { admissionWaitMs, onSaturated }) {
       label: `[task_id: ${run.foregroundRecordId}] ${String(command || '').slice(0, 120)}`,
       ownerKey: ownerSessionId,
     });
-    const policyErr = await _execPolicyBlockMessage(command);
+    const policyErr = await _execPolicyBlockMessage(command, elevationApproved === true);
     if (policyErr) {
       await releaseResourceLease(run);
       run.resolveResult(failedResult(run, policyErr, 'preflight failed'));
@@ -544,6 +544,8 @@ export function execShellCommand(options) {
     // hands the script to the shell out-of-band — see the POSIX env+eval path in
     // bash-tool.mjs, which keeps the command body out of the child's argv.
     execScript = null,
+    // The user approved this call's elevation 'ask' decision (runtime-set).
+    elevationApproved = false,
   } = options;
   return new Promise(async (resolve) => {
     const run = createShellRun({ abortSignal, resolve, jobId });
@@ -565,6 +567,7 @@ export function execShellCommand(options) {
           abortSignal,
           directArgv,
           execScript,
+          elevationApproved,
           ownerSessionId,
           clientHostPid,
         },

package/src/runtime/agent/orchestrator/tools/shell-exec-policy.mjs

@@ -2,7 +2,7 @@ import { extractHeredocBodies, extractShellCInner, stripQuotedAndHeredoc } from
 import { extractPowerShellCommandInner } from './shell-powershell.mjs';
 import { decodePowerShellEncodedCommand, isBlockedCommand, WRAPPER_NAMES } from './shell-policy.mjs';
 
-/** @typedef {'allow'|'deny'} ExecPolicyDecision */
+/** @typedef {'allow'|'ask'|'deny'} ExecPolicyDecision */
 
 const EXEC_POLICY_DENY_PATTERNS = [
   /\b(curl|wget|fetch|Invoke-WebRequest|iwr)\b[^\n|&;]*\|[^\n|&;]*\b(sh|bash|zsh|dash|pwsh|powershell)(?:\.exe)?\b/i,
@@ -16,9 +16,28 @@ const EXEC_POLICY_DENY_PATTERNS = [
   // lookahead instead of the previous bare `iex\s+`.
   /\|\s*iex\b/i,
   /\biex\s+[$("'@]/i,
-  /\bStart-Process\b[^\n]*\s-Verb\s+RunAs\b/i,
 ];
 
+// Elevated launch: `Start-Process` (or its aliases `saps` / `start`) with
+// `-Verb RunAs`. Not a hard deny — the user is asked (parity with Claude Code's
+// "Command requests elevated privileges"). `-Verb` may be abbreviated to any
+// prefix (`-v`, `-ve`, `-ver`) and take its value after a space or a colon.
+// `Start-Process` matches anywhere (as the former deny rule did); the short
+// aliases only at a command position so `npm start -v RunAs` stays allowed.
+const ELEVATION_ASK_PATTERN =
+  /(?:\bStart-Process\b|(?:^|[;&|({=\n])\s*(?:&\s*)?(?:saps|start)(?![\w-]))[^\n]*?\s-v(?:e(?:rb?)?)?(?:\s*:\s*|\s+)RunAs\b/i;
+const ELEVATION_ASK_REASON = 'Command requests elevated privileges';
+
+// PowerShell spellings of the same token that the quote-stripping pass would
+// otherwise hide or split: backtick line continuation, backtick-escaped
+// letters (`-V`erb`), and a quoted `-Verb` value (`-Verb:'RunAs'`).
+function _normalizeElevationSyntax(text) {
+  return String(text || '')
+    .replace(/`\r?\n/g, ' ')
+    .replace(/`([A-Za-z])/g, '$1')
+    .replace(/(\s-v\w*(?:\s*:\s*|\s+))(['"])\s*RunAs\s*\2/gi, '$1RunAs');
+}
+
 // Verbs with no non-destructive invocation. `dd` is deliberately ABSENT: the
 // disk-destroying form (`of=/dev/<disk>`) is hard-blocked at every command
 // position by shell-policy, while `dd if=/dev/zero of=file` is the ordinary
@@ -39,12 +58,44 @@ const EXEC_POLICY_DENY_COMMANDS = new Set([
   'parted',
 ]);
 
-const _POLICY_RANK = { allow: 0, deny: 1 };
+const _POLICY_RANK = { allow: 0, ask: 1, deny: 2 };
 
 // EVERY command position, not just the first: a deny-listed verb after `&&`,
 // `;`, `|` or a newline is still an execution request, and reading only
 // segment 0 let `true && shutdown /s` through. Callers pass quote-stripped
 // text, so prose inside a string ("graceful shutdown") never reaches here.
+const _ELEVATION_WRAPPERS = new Set(['sudo', 'doas', 'pkexec', 'gsudo']);
+const _bareName = (token) =>
+  token
+    .replace(/^.*[\\/]/, '')
+    .toLowerCase()
+    .replace(/\.(exe|cmd|bat|com)$/i, '');
+
+// Returns the first privilege-escalation wrapper (sudo, doas, pkexec, gsudo,
+// with or without path/extension) found at any command position, else null.
+function _elevationWrapperAtPositions(command) {
+  for (const seg of String(command || '').split(/[;&|\n]+/)) {
+    const tokens = seg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length) {
+      const t = tokens[i];
+      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+        i++;
+        continue;
+      }
+      const base = _bareName(t);
+      if (_ELEVATION_WRAPPERS.has(base)) return base;
+      if (WRAPPER_NAMES.has(base)) {
+        i++;
+        while (i < tokens.length && (/^[-+]/.test(tokens[i]) || /^\d+[smhd]?$/.test(tokens[i]))) i++;
+        continue;
+      }
+      break;
+    }
+  }
+  return null;
+}
+
 function _commandNamesAtPositions(command) {
   const names = [];
   for (const seg of String(command || '').split(/[;&|\n]+/)) {
@@ -56,7 +107,7 @@ function _commandNamesAtPositions(command) {
         i++;
         continue;
       }
-      if (WRAPPER_NAMES.has(t.toLowerCase())) {
+      if (WRAPPER_NAMES.has(_bareName(t))) {
         i++;
         while (i < tokens.length && (/^[-+]/.test(tokens[i]) || /^\d+[smhd]?$/.test(tokens[i]))) i++;
         continue;
@@ -74,14 +125,15 @@ function classifyExecPolicy(command) {
   if (!text.trim()) return { decision: 'allow', reason: '' };
   // Scan executable syntax, not quoted log/search text. Recursively preserve
   // actual shell, PowerShell, heredoc, and encoded-command payload coverage.
-  const executableTargets = [
-    stripQuotedAndHeredoc(text),
-    ...extractShellCInner(text).map(stripQuotedAndHeredoc),
-    ...extractPowerShellCommandInner(text).map(stripQuotedAndHeredoc),
-    ...extractHeredocBodies(text).map(stripQuotedAndHeredoc),
+  const rawTargets = [
+    text,
+    ...extractShellCInner(text),
+    ...extractPowerShellCommandInner(text),
+    ...extractHeredocBodies(text),
   ];
   const decodedPowerShell = decodePowerShellEncodedCommand(text);
-  if (decodedPowerShell) executableTargets.push(stripQuotedAndHeredoc(decodedPowerShell));
+  if (decodedPowerShell) rawTargets.push(decodedPowerShell);
+  const executableTargets = rawTargets.map(stripQuotedAndHeredoc);
   if (executableTargets.some((target) => isBlockedCommand(target))) {
     return {
       decision: 'deny',
@@ -115,6 +167,24 @@ function classifyExecPolicy(command) {
       };
     }
   }
+  // Elevation asks only after every deny rule above has had its say.
+  for (const target of rawTargets) {
+    const hit = ELEVATION_ASK_PATTERN.exec(stripQuotedAndHeredoc(_normalizeElevationSyntax(target)));
+    if (hit) {
+      return {
+        decision: 'ask',
+        reason: ELEVATION_ASK_REASON,
+        rule: 'elevation',
+        match: hit[0].trim().slice(0, 80),
+      };
+    }
+  }
+  for (const target of executableTargets) {
+    const wrapper = _elevationWrapperAtPositions(target);
+    if (wrapper) {
+      return { decision: 'ask', reason: ELEVATION_ASK_REASON, rule: 'elevation', match: wrapper };
+    }
+  }
   // Destructive-but-legitimate commands are NOT judged here. The caller
   // computes that non-blocking warning once (getDedupedDestructiveWarnings)
   // and prepends it to the result; deriving it again per scan target only
@@ -140,9 +210,15 @@ export function evaluateExecPolicyFromTargets(targets) {
   return worst;
 }
 
-/** Pre-spawn block message — deny is the only decision this scan produces. */
-export function formatExecPolicyBlockMessage(policyResult) {
+/** Pre-spawn block message. An 'ask' decision blocks unless the runtime
+ *  already obtained the user's approval for this call (`elevationApproved`). */
+export function formatExecPolicyBlockMessage(policyResult, { elevationApproved = false } = {}) {
   const r = policyResult || { decision: 'allow' };
+  if (r.decision === 'ask') {
+    if (elevationApproved === true) return null;
+    const rule = r.rule ? ` [rule ${r.rule}${r.match ? `: "${r.match}"` : ''}]` : '';
+    return `Error: command requires user approval for elevation — ${r.reason || ELEVATION_ASK_REASON}${rule}; no approval was granted for this call`;
+  }
   if (r.decision === 'deny') {
     const rule = r.rule ? ` [rule ${r.rule}${r.match ? `: "${r.match}"` : ''}]` : '';
     const alt = r.alternative ? `; instead: ${r.alternative}` : '';

package/src/runtime/agent/orchestrator/tools/shell-policy.mjs

@@ -17,6 +17,8 @@ export const WRAPPER_NAMES = new Set([
   'env',
   'sudo',
   'doas',
+  'pkexec',
+  'gsudo',
   'nice',
   'stdbuf',
   'chronic',