mixdog 1.2.2 → 1.2.3

package/src/runtime/agent/orchestrator/session/store-summary-archived-agent.mjs

@@ -7,13 +7,17 @@
  * `label`, `agent`, `provider`, `model`, `effort`, `fast`, `finished`) and the
  * "\n\nResult:\n" marker are the wire format the notification writer emits;
  * they are matched verbatim.
+ *
+ * Only the parent(s) named by metadata are read — never the sessions
+ * directory: every vanished id reaches this path (deleted Lead records too),
+ * and a synchronous scan of every session file froze the daemon loop.
  */
-import { readFileSync, readdirSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { probePath, PROBE_PRESENT } from './store/fs-probe.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from './lifecycle-scan.mjs';
 import { dataDir } from './store-summary-locations.mjs';
-import { cleanValue, desktopSession, positiveNumber } from './store-summary-fields.mjs';
+import { listStoredAgentWorkerLinks } from './store-agent-worker-rows.mjs';
+import { cleanValue, desktopSession, isStoredSessionId, positiveNumber } from './store-summary-fields.mjs';
 
 function archivedAgentNotification(content, sessionId) {
   const text = typeof content === 'string' ? content : '';
@@ -52,23 +56,38 @@ function archivedAgentNotification(content, sessionId) {
   };
 }
 
+/** Parent session ids metadata names for `sessionId`: its agent-workers.json
+ *  link and its summary-catalog row (`catalogRow(id)`, optional). */
+function parentSessionIds(sessionId, catalogRow) {
+  const parents = new Set();
+  for (const link of listStoredAgentWorkerLinks()) {
+    if (link.sessionId !== sessionId) continue;
+    parents.add(link.parentSessionId);
+    parents.add(link.ownerSessionId);
+  }
+  const row = typeof catalogRow === 'function' ? catalogRow(sessionId) : null;
+  if (row) {
+    parents.add(cleanValue(row.parentSessionId));
+    parents.add(cleanValue(row.ownerSessionId));
+  }
+  parents.delete(sessionId);
+  return [...parents].filter(isStoredSessionId);
+}
+
 /** Legacy recovery for child transcripts already unlinked by terminal reaping.
- * The parent owns one canonical body-carrying completion notification, so scan
- * only files containing the exact child id and project the newest valid body. */
-export function readArchivedAgentResult(sessionId) {
+ * The parent owns one canonical body-carrying completion notification: read
+ * only the parent(s) metadata links the child to, asynchronously, and project
+ * the newest valid body. An id with no parent link (a deleted Lead record)
+ * resolves to null without touching any session file. */
+export async function readArchivedAgentResult(sessionId, { catalogRow } = {}) {
+  const parents = parentSessionIds(sessionId, catalogRow);
+  if (parents.length === 0) return null;
   const dir = join(dataDir(), 'sessions');
-  if (probePath(dir).state !== PROBE_PRESENT) return null;
-  let files;
-  try {
-    files = readdirSync(dir).filter((file) => file.endsWith('.json'));
-  } catch {
-    return null;
-  }
   let best = null;
-  for (const file of files) {
+  for (const parentId of parents) {
     let raw;
     try {
-      raw = readFileSync(join(dir, file), 'utf8');
+      raw = await readFile(join(dir, `${parentId}.json`), 'utf8');
     } catch {
       continue;
     }

package/src/runtime/agent/orchestrator/session/store-summary-catalog.mjs

@@ -24,8 +24,10 @@ import {
   inheritedFromSessionId,
   isStoredSessionId,
   positiveNumber,
+  realTurnCount,
   workspaceSummary,
 } from './store-summary-fields.mjs';
+import { isRealTurnMessage } from './compact/user-message-kind.mjs';
 import { byActivityThenId } from './catalog-db/schema.mjs';
 import {
   sessionStampOf,
@@ -182,6 +184,7 @@ export function normalizedRow(row, heartbeatAt = 0) {
     permission: row.permission || null,
     toolPermission: row.toolPermission || null,
     messageCount: Math.max(0, Math.floor(Number(row.messageCount) || 0)),
+    realTurnCount: realTurnCount(row),
     title: cleanText(row.title, 100),
     preview: cleanText(row.preview),
     generation: typeof row.generation === 'number' ? row.generation : 0,
@@ -240,6 +243,7 @@ function rowFromSession(session, heartbeatAt = 0) {
     {
       ...session,
       messageCount: messages.filter((message) => message?.role === 'user' || message?.role === 'assistant').length,
+      realTurnCount: messages.filter(isRealTurnMessage).length,
       preview,
     },
     heartbeatAt

package/src/runtime/agent/orchestrator/session/store-summary-fields.mjs

@@ -55,6 +55,14 @@ export function inheritedFromSessionId(value) {
   return id || null;
 }
 
+/** Count of real human turns a session persisted (actual user instructions
+ *  plus compact summaries, which stand for earlier human turns); null for a
+ *  row written before the field existed. */
+export function realTurnCount(value) {
+  const count = value?.realTurnCount;
+  return typeof count === 'number' && Number.isFinite(count) && count >= 0 ? Math.floor(count) : null;
+}
+
 export function importKey(value) {
   const key = typeof value?.importKey === 'string' ? value.importKey : value?.importOrigin?.key;
   return typeof key === 'string' && key.trim() ? key : null;

package/src/runtime/agent/orchestrator/session/store-summary-index.mjs

@@ -23,8 +23,10 @@ import {
   inheritedFromSessionId,
   isStoredSessionId,
   positiveNumber as _positiveNumber,
+  realTurnCount,
   workspaceSummary,
 } from './store-summary-fields.mjs';
+import { isRealTurnMessage } from './compact/user-message-kind.mjs';
 
 export const SESSION_SUMMARY_INDEX_VERSION = 2;
 
@@ -92,6 +94,7 @@ function _sessionMessageProjection(session) {
   const cached = session && typeof session === 'object' ? sessionMessageProjectionMemo.get(session) : null;
   let start = 0;
   let count = 0;
+  let real = 0;
   let preview = '';
   let previewMessage = null;
   const canAppend =
@@ -101,6 +104,7 @@ function _sessionMessageProjection(session) {
   if (canAppend) {
     start = cached.length;
     count = cached.count;
+    real = cached.real;
     preview = cached.preview;
     previewMessage = cached.previewMessage;
     // The first real user message is stable in normal append-only session
@@ -112,6 +116,7 @@ function _sessionMessageProjection(session) {
       else {
         start = 0;
         count = 0;
+        real = 0;
         preview = '';
         previewMessage = null;
       }
@@ -120,6 +125,7 @@ function _sessionMessageProjection(session) {
   for (let index = start; index < messages.length; index += 1) {
     const message = messages[index];
     if (message && (message.role === 'user' || message.role === 'assistant')) count += 1;
+    if (isRealTurnMessage(message)) real += 1;
     if (!preview) {
       const candidate = _previewFromMessage(message);
       if (candidate) {
@@ -133,11 +139,12 @@ function _sessionMessageProjection(session) {
       length: messages.length,
       lastMessage: messages[messages.length - 1] || null,
       count,
+      real,
       preview,
       previewMessage,
     });
   }
-  return { count, preview };
+  return { count, real, preview };
 }
 
 function _desktopSessionSummary(value, cwd = null) {
@@ -199,6 +206,7 @@ export function _sessionSummary(session) {
       : null,
     taskType: session.taskType || null,
     messageCount: messageProjection.count,
+    realTurnCount: messageProjection.real,
     title: _cleanPreview(session.title || '', 100),
     preview: messageProjection.preview,
     generation: typeof session.generation === 'number' ? session.generation : 0,
@@ -253,6 +261,7 @@ function _normalizeSummaryRow(row) {
       : null,
     taskType: row.taskType || null,
     messageCount: Math.max(0, Math.floor(Number(row.messageCount) || 0)),
+    realTurnCount: realTurnCount(row),
     title: _cleanPreview(row.title || '', 100),
     preview: _cleanPreview(row.preview || ''),
     generation: typeof row.generation === 'number' ? row.generation : 0,

package/src/runtime/agent/orchestrator/session/store-summary-reader.mjs

@@ -250,6 +250,14 @@ function storedSessionMetadata(sessionId, session) {
   };
 }
 
+/** A record that is gone may be a reaped agent child: its parent is resolved
+ *  from metadata only (worker link, summary-index row), never by a scan. */
+function readVanishedSessionTranscript(sessionId) {
+  return readArchivedAgentResult(sessionId, {
+    catalogRow: (id) => ordinaryCatalog.loadIndex().rowsById.get(id) || null,
+  });
+}
+
 /** The two files a stored transcript projection is built from. */
 function storedTranscriptInputPaths(sessionId) {
   return {
@@ -375,7 +383,7 @@ export async function readStoredSessionTranscript(id, options = {}) {
   // Phase durations of the parse this call ran (absent on a cache hit).
   const timing = {};
   const recordStat = probePath(recordPath);
-  if (recordStat.state === PROBE_ABSENT) return readArchivedAgentResult(sessionId);
+  if (recordStat.state === PROBE_ABSENT) return readVanishedSessionTranscript(sessionId);
   if (recordStat.state !== PROBE_PRESENT) return null;
   const checkpoint = probePath(checkpointPath);
   const archive = probePath(archivePath);
@@ -441,7 +449,7 @@ export async function readStoredSessionTranscript(id, options = {}) {
     produce: (text) => produceStoredTranscript(text, readStamp, produceContext),
   });
   // The record vanished between stat and read: same answer as an absent probe.
-  if (readState === PROBE_ABSENT) return readArchivedAgentResult(sessionId);
+  if (readState === PROBE_ABSENT) return readVanishedSessionTranscript(sessionId);
   if (typeof options.trace === 'function') {
     options.trace({
       sessionId,

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -3,7 +3,7 @@
  * Sessions are saved to disk so CLI and MCP server can share state,
  * and sessions survive server restarts (resume).
  */
-import { writeFileSync } from 'node:fs';
+import { closeSync, fsyncSync, openSync, writeFileSync } from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import { randomBytes } from 'node:crypto';
 import { sessionPath } from './store/paths-heartbeat.mjs';
@@ -354,7 +354,15 @@ function _doSaveSync(payload) {
       attempted = JSON.stringify(disk);
       // The lifecycle these exact bytes carry, recorded with the commit stamp.
       const lifecycle = _lifecycleOfSessionDocument(disk);
-      writeFileSync(tmp, attempted, 'utf-8');
+      // fsync before the rename: without it an OS crash can publish the
+      // renamed file with its data blocks never written (all-NUL record).
+      const fd = openSync(tmp, 'w');
+      try {
+        writeFileSync(fd, attempted, 'utf-8');
+        fsyncSync(fd);
+      } finally {
+        closeSync(fd);
+      }
       if (_shouldDrop(id, opts, attempt)) {
         _discardSaveTmp(tmp);
         if (mayMutate()) _recordSaveDrop(id, epoch);
@@ -636,7 +644,14 @@ async function _doSave(payload) {
     attempted = JSON.stringify(disk);
     // Captured before the await: the lifecycle of exactly these bytes.
     const lifecycle = _lifecycleOfSessionDocument(disk);
-    await fsp.writeFile(tmp, attempted, 'utf-8');
+    // fsync before the rename (see _doSaveSync).
+    const handle = await fsp.open(tmp, 'w');
+    try {
+      await handle.writeFile(attempted, 'utf-8');
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
     // Second check: between the temp write and the rename, closeSession()
     // may have planted a tombstone. Re-check on disk; if a newer tombstone
     // now exists, discard our temp file rather than let rename clobber it.
@@ -706,6 +721,7 @@ export { loadSession } from './store/load-session.mjs';
 // Hard delete + owned-agent enumeration live in store/session-delete.mjs;
 // re-exported here so prior importers of store.mjs stay unchanged.
 export { deleteSession, listOwnedAgentSessionIds } from './store/session-delete.mjs';
+export { fenceSessionWrites } from './store/live-state.mjs';
 
 // Listing / summaries live in store/listing.mjs and the stale sweep in
 // store/sweep/stale-sweep.mjs; re-exported here so importers keep one

package/src/runtime/agent/orchestrator/session/tool-batch/execute-call.mjs

@@ -208,6 +208,7 @@ function invocationOptions(batch, call, exec) {
     iteration: batch.iterations,
     localSearchTelemetry: exec.localSearchTelemetry || {},
     resultTelemetry: exec.resultTelemetry,
+    ...(call.wireCall ? { bridgeWireCall: call.wireCall } : {}),
   };
 }
 

package/src/runtime/agent/orchestrator/session/tool-batch/finalize.mjs

@@ -319,7 +319,7 @@ function stagePostProcessingFailure(batch, completed, postErr, postprocessStarte
   if (sessionRef?._scopedCacheOutcomeByCallId instanceof Map && call?.id) {
     sessionRef._scopedCacheOutcomeByCallId.delete(call.id);
   }
-  if (call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.calls, call.id);
+  if (call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.wireCalls, call.id);
   const message = `Error: tool result post-processing failed for "${call.name}": ${postErr instanceof Error ? postErr.message : String(postErr)}`;
   traceAgentToolFailure({
     sessionId: batch.sessionId,

package/src/runtime/agent/orchestrator/session/tool-batch/record-outcome.mjs

@@ -46,7 +46,7 @@ export async function recordCallOutcome(batch, call, exec, sigs, ctSig) {
   // otherwise hide behind a `[mixdog compacted …]` placeholder). Restored
   // immediately so an abort or post-processing throw cannot leave it
   // compacted; early-skipped calls stay compacted.
-  if (executed && failed && call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.calls, call.id);
+  if (executed && failed && call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.wireCalls, call.id);
   if (sessionId && _stripMcpPrefix(call.name) === 'apply_patch') {
     if (exec.executeOk && exec.resultKind === 'normal') invalidateAfterPatch(sessionId, call, cwd);
     // Mutation tools invalidate even on returned-error/partial-fail — the

package/src/runtime/agent/orchestrator/session/tool-batch/state.mjs

@@ -4,11 +4,17 @@
 // live here so processToolBatch can hand them back.
 import { executeTool } from '../loop/tool-exec.mjs';
 import { planToolBatch } from './plan.mjs';
+import { bridgeClassificationTools, resolveExecutionToolCalls } from '../loop/tool-call-resolution.mjs';
 
 export function createBatchState(ctx) {
-  const { calls, tools, assistantTurnMsg, sessionRef } = ctx;
+  const { assistantTurnMsg, sessionRef } = ctx;
+  // Bridged call_tool requests run as their targets from here on; the wire
+  // calls stay authoritative for the transcript and failed-argument restore.
+  const calls = resolveExecutionToolCalls(ctx.calls, sessionRef);
+  const tools = bridgeClassificationTools(ctx.tools, calls);
   return {
     calls,
+    wireCalls: ctx.calls,
     messages: ctx.messages,
     tools,
     cwd: ctx.cwd,

package/src/runtime/agent/orchestrator/session/tool-result-offload.mjs

@@ -19,8 +19,10 @@ import { getPluginData } from '../config.mjs';
 import { countSplitLines, normalizeOutputPath } from '../tools/builtin/path-utils.mjs';
 import { classifyResultKind } from './result-classification.mjs';
 import { registerSessionPurgeHook } from './store.mjs';
+import { SETUP_OUTPUT_MAX_BYTES } from '../../../shared/tool-output-limit.mjs';
 
 const TOOL_RESULT_OFFLOAD_THRESHOLD_CHARS = 50_000;
+const TOOL_RESULT_SETUP_THRESHOLD_CHARS = SETUP_OUTPUT_MAX_BYTES;
 const TOOL_RESULT_PREVIEW_CHARS = 512;
 const TOOL_RESULT_SHELL_THRESHOLD_CHARS = 30_000;
 const TOOL_RESULT_SEARCH_THRESHOLD_CHARS = 50_000;
@@ -61,6 +63,7 @@ const INLINE_THRESHOLD_BY_TOOL = new Map([
   ['bash_session', TOOL_RESULT_SHELL_THRESHOLD_CHARS],
   ['terminal', TOOL_RESULT_SHELL_THRESHOLD_CHARS],
   ['task', TOOL_RESULT_SHELL_THRESHOLD_CHARS],
+  ['setup', TOOL_RESULT_SETUP_THRESHOLD_CHARS],
 ]);
 
 function getOffloadThreshold(toolName) {
@@ -554,6 +557,7 @@ export const _internals = {
   TOOL_RESULT_SHELL_THRESHOLD_CHARS,
   TOOL_RESULT_SEARCH_THRESHOLD_CHARS,
   TOOL_RESULT_GREP_THRESHOLD_CHARS,
+  TOOL_RESULT_SETUP_THRESHOLD_CHARS,
   getOffloadThreshold,
   TOOL_RESULT_PREVIEW_CHARS,
   TOOL_RESULT_MESSAGE_MAX_CHARS,

package/src/runtime/agent/orchestrator/session/tool-schema-rejection.mjs

@@ -0,0 +1,77 @@
+// A provider 400 that names one tool's input schema (Anthropic
+// `tools.3.custom.input_schema`, OpenAI `Invalid schema for function 'x'` /
+// `tools[3].parameters`, Gemini `function_declarations[3]`): which tool of the
+// request it is, so the session can drop it instead of failing every turn.
+import { providerToolExclusionReason } from './loop/provider-tool-exclusions.mjs';
+import { providerNativeToolPrefixCount } from '../runtime-core/provider-request-tools.mjs';
+
+const MAX_REASON_CHARS = 240;
+
+const text = (value) => (typeof value === 'string' ? value : '');
+
+// Provider-structured places a rejection names its field, best evidence first:
+// OpenAI `param` (also nested under `error`), Anthropic / OpenAI `error.message`,
+// Google `details[].fieldViolations[].field`, then a JSON body, then the
+// error's own message.
+function evidence(error) {
+  const nested = [error?.error, error?.providerError, error?.response?.data?.error, error?.response?.data];
+  const violations = [error?.details, error?.error?.details, error?.errorDetails]
+    .flatMap((details) => (Array.isArray(details) ? details : []))
+    .flatMap((detail) => (Array.isArray(detail?.fieldViolations) ? detail.fieldViolations : []))
+    .flatMap((violation) => [text(violation?.field), text(violation?.description)]);
+  const bodies = [error?.body, error?.responseBody].map((body) => {
+    if (typeof body !== 'string') return [];
+    try {
+      const parsed = JSON.parse(body);
+      return [text(parsed?.error?.param), text(parsed?.error?.message), text(parsed?.message)];
+    } catch {
+      return [body];
+    }
+  });
+  return [
+    error?.param,
+    ...nested.map((entry) => entry?.param),
+    ...nested.map((entry) => entry?.message),
+    ...violations,
+    ...bodies.flat(),
+    error?.message,
+    error?.cause?.message,
+  ].filter((entry) => typeof entry === 'string' && entry);
+}
+
+// One piece of evidence -> which tool: a wire index (`byIndex`, with the
+// OpenAI Responses hosted-tool offset when `shifted`) or a function name.
+function target(entry) {
+  let match = /\btools\.(\d+)\.(?:custom\.)?input_schema/.exec(entry);
+  if (match) return { index: Number(match[1]) };
+  match = /\btools(?:\[(\d+)\]|\.(\d+))\.(?:function\.)?parameters/.exec(entry);
+  if (match) return { index: Number(match[1] ?? match[2]), shifted: true };
+  match = /\b(?:function_declarations|functionDeclarations)(?:\[(\d+)\]|\.(\d+))/.exec(entry);
+  if (match) return { index: Number(match[1] ?? match[2]) };
+  match = /Invalid schema for function ['"`]([^'"`]+)['"`]/.exec(entry);
+  if (match) return { name: match[1] };
+  return null;
+}
+
+/** `{ name, pointer, reason }` of the tool a schema 400 points at, or null (any
+ *  other error, or a tool that is not part of the request's own tools). */
+export function rejectedToolSchema(error, { sendTools, sessionRef, opts }) {
+  if ((error?.httpStatus ?? error?.status ?? error?.statusCode) !== 400) return null;
+  const tools = Array.isArray(sendTools) ? sendTools : [];
+  const nativeCount = providerNativeToolPrefixCount(tools);
+  // The wire list: the request's tools minus those the wire left out.
+  const wire = tools.filter((tool) => !providerToolExclusionReason(sessionRef, tool?.name));
+  const hosted = sessionRef?.wireRoute?.wire !== 'chat' && Array.isArray(opts?.nativeTools) ? opts.nativeTools.length : 0;
+  const entries = evidence(error);
+  let name = '';
+  for (const entry of entries) {
+    const found = target(entry);
+    if (!found) continue;
+    const tool = found.name ? wire.find((t) => t?.name === found.name) : wire[found.index - (found.shifted ? hosted : 0)];
+    name = typeof tool?.name === 'string' ? tool.name : '';
+    if (name) break;
+  }
+  if (!name || tools.findIndex((t) => t?.name === name) < nativeCount) return null;
+  const detail = entries.join(' ').replace(/\s+/g, ' ').trim().slice(0, MAX_REASON_CHARS);
+  return { name, pointer: '/', reason: `the provider rejected it with HTTP 400: ${detail}` };
+}

package/src/runtime/agent/orchestrator/tools/bash-policy-scan.mjs

@@ -68,6 +68,12 @@ export function buildBashPolicyScanTargets(command) {
   return out;
 }
 
-export function checkExecPolicyMessage(command) {
-  return formatExecPolicyBlockMessage(evaluateExecPolicyFromTargets(buildBashPolicyScanTargets(command)));
+export function evaluateExecPolicy(command) {
+  return evaluateExecPolicyFromTargets(buildBashPolicyScanTargets(command));
+}
+
+// `elevationApproved` is runtime-supplied: the user approved this call's
+// 'ask' (elevation) decision. It never lifts a deny.
+export function checkExecPolicyMessage(command, { elevationApproved = false } = {}) {
+  return formatExecPolicyBlockMessage(evaluateExecPolicy(command), { elevationApproved });
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/command-preflight.mjs

@@ -8,11 +8,11 @@ import { formatShellToolFailure } from './result-format.mjs';
 // Policy + shell-specific rewrites before any shell dispatch. Returns either
 // `{ failure }` (a formatted tool failure) or the command to run with the
 // resolved shell spec and the wmic rewrite (if any).
-export function prepareShellCommand(args) {
+export function prepareShellCommand(args, { elevationApproved = false } = {}) {
   // Run hard-block policy before any shell dispatch.
   const rawCmd = String(args && args.command != null ? args.command : '');
   if (rawCmd) {
-    const policyBlock = checkExecPolicyMessage(rawCmd);
+    const policyBlock = checkExecPolicyMessage(rawCmd, { elevationApproved });
     if (policyBlock) return { failure: formatShellToolFailure(policyBlock) };
   }
   let command = args.command;
@@ -52,7 +52,7 @@ export function prepareShellCommand(args) {
       : null;
   if (bashismRewrite) command = bashismRewrite.command;
 
-  const execPolicyBlock = checkExecPolicyMessage(command);
+  const execPolicyBlock = checkExecPolicyMessage(command, { elevationApproved });
   if (execPolicyBlock) return { failure: formatShellToolFailure(execPolicyBlock) };
   return { command, analysisCommand, resolvedSpec, wmicRewrite, bashismRewrite };
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -61,7 +61,9 @@ export async function executeBashTool(args, workDir, options = {}) {
   // Every call starts from the current Project root. A command-local `cd`
   // never creates a second session cwd authority beside the dedicated cwd tool.
   const bashWorkDir = workDir;
-  const prepared = prepareShellCommand(args);
+  // Approval comes from the runtime's options, never from model-supplied args.
+  const elevationApproved = options?.elevationApproved === true;
+  const prepared = prepareShellCommand(args, { elevationApproved });
   if (prepared.failure) return prepared.failure;
   const { resolvedSpec, wmicRewrite, bashismRewrite } = prepared;
   // Effects are analyzed on the command as the caller meant it, before the
@@ -97,6 +99,7 @@ export async function executeBashTool(args, workDir, options = {}) {
       command: invocation.wrappedCommand,
       execScript: invocation.execScript,
       directArgv: invocation.directArgv,
+      elevationApproved,
       env: invocation.spawnEnv,
       cwd: bashWorkDir,
       timeoutMs: deadlines.timeout,

package/src/runtime/agent/orchestrator/tools/builtin/external-tool-adapters.mjs

@@ -37,6 +37,7 @@ import { decodeValidUtf8OrNull, detectPatchTargetCodec, nearestPatchLineMatch }
 import { hashText } from './hash-utils.mjs';
 import { invalidateBuiltinResultCache } from './cache-layers.mjs';
 import { markCodeGraphDirtyPaths } from '../code-graph-state.mjs';
+import { reviewFileContent } from '../../../../shared/bounded-file-read.mjs';
 
 const STR_REPLACE_NAMES = new Set(['edit', 'strreplace', 'str_replace', 'str_replace_editor', 'search_replace']);
 const WRITE_NAMES = new Set(['write', 'create_file', 'createfile']);
@@ -189,26 +190,27 @@ function recordEditSnapshot(fullPath, options, contentHash = null, preMutationSt
 // UI diff parity with apply_patch: register the before/after pair on the
 // shared per-call side channel so tool cards render edit results with the
 // same diff markup. Lazy import breaks the orchestrator→builtin→adapters
-// module cycle; failures never affect the edit result.
-async function recordEditUiDiff(options, workDir, fullPath, before, after, encoding) {
+// module cycle; failures never affect the edit result. `sides()` yields the
+// file's `{ before, after }` content (null = absent).
+async function recordToolUiDiff(options, workDir, fullPath, sides) {
   const callId = options?.toolCallId;
   const sessionId = options?.sessionId || options?.readStateScope;
   if (!callId || !sessionId) return;
   try {
     const { registerEditToolUiDiff } = await import('../patch/orchestrator.mjs');
-    registerEditToolUiDiff({
-      callId,
-      sessionId,
-      basePath: workDir,
-      fullPath,
-      before: before === null ? null : encodeEditContent(before, encoding),
-      after: after === null ? null : encodeEditContent(after, encoding),
-    });
+    registerEditToolUiDiff({ callId, sessionId, basePath: workDir, fullPath, ...sides() });
   } catch {
     /* best-effort display channel */
   }
 }
 
+async function recordEditUiDiff(options, workDir, fullPath, before, after, encoding) {
+  await recordToolUiDiff(options, workDir, fullPath, () => ({
+    before: before === null ? null : encodeEditContent(before, encoding),
+    after: after === null ? null : encodeEditContent(after, encoding),
+  }));
+}
+
 // The 0-based line the failure excerpt centres on, or -1: the engine's
 // "nearest match" hint, else the exact old_string, else its longest tokens,
 // else the fuzzy line scorer.
@@ -828,6 +830,7 @@ async function adaptWrite(args, workDir, options) {
   if (target.error) return target.error;
   const fullPath = target.full;
   const existed = existsSync(fullPath);
+  const before = existed ? reviewFileContent(fullPath) : null;
   try {
     mkdirSync(dirname(fullPath), { recursive: true });
   } catch {
@@ -835,6 +838,7 @@ async function adaptWrite(args, workDir, options) {
   }
   await atomicWrite(fullPath, contents, { sessionId: editScope(options) });
   invalidateAfterWrite(fullPath);
+  await recordToolUiDiff(options, workDir, fullPath, () => ({ before, after: contents }));
   return `${existed ? 'Updated' : 'Created'} ${fullPath} (${Buffer.byteLength(contents, 'utf8')} bytes)`;
 }