mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -259,6 +259,56 @@ export const PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS = resolveTimeoutMs(
   { minMs: 10_000, maxMs: Math.max(10_000, STALL_ABORT_MS - STALL_TICK_MS) }
 );
 
+/**
+ * The longest a provider's own first-byte handling may legitimately run
+ * before it gives up, over every attempt it permits: `windowMs(n)` is the wait
+ * of attempt n, applied to the response headers and again to the first chunk,
+ * and `backoffMs[n]` the sleep before attempt n (index 0 unused, the last
+ * value repeats). `transportMs` covers the header stage only; `semanticMs`
+ * covers headers plus first chunk. The agent watchdog's first-response
+ * deadlines sit above these, so the provider's timeout and retry decide first.
+ */
+export function providerFirstResponseBudget({ attempts, windowMs, backoffMs = [] }) {
+  let transportMs = 0;
+  let semanticMs = 0;
+  for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
+    const backoff = attempt > 0 ? (backoffMs[Math.min(attempt, backoffMs.length - 1)] ?? 0) : 0;
+    const window = windowMs(attempt);
+    transportMs += backoff + window;
+    semanticMs += backoff + 2 * window;
+  }
+  return { transportMs, semanticMs };
+}
+
+/**
+ * A provider's first-byte policy `{ timeoutMs, maxMs, retries }`: `timeoutMs`
+ * is the first attempt's window (headers, and again the first chunk); each
+ * first-byte timeout doubles the next window up to `maxMs`, and `retries` caps
+ * how many of those timeouts are retried. `retries: null` leaves first-byte
+ * timeouts to the provider's ordinary ladder, every attempt on `timeoutMs`.
+ * Returns the window of an attempt after `timeouts` first-byte timeouts.
+ */
+export function firstByteWindowMs(policy, timeouts = 0) {
+  if (policy.retries == null) return policy.timeoutMs;
+  return Math.min(policy.timeoutMs * 2 ** timeouts, Math.max(policy.timeoutMs, policy.maxMs));
+}
+
+/**
+ * providerFirstResponseBudget for a first-byte policy over a ladder of
+ * `attempts` sends. Connection drops and 5xx responses share that ladder with
+ * first-byte timeouts, and such a failure can land just before the timeout, so
+ * every attempt is budgeted a full window. A window only grows with the
+ * timeouts before it and at most `retries` timeouts are retried, so the worst
+ * case has the timeouts first, then later attempts at the widest window.
+ */
+export function firstBytePolicyBudget(policy, { attempts, backoffMs }) {
+  return providerFirstResponseBudget({
+    attempts,
+    windowMs: (attempt) => firstByteWindowMs(policy, Math.min(attempt, policy.retries ?? 0)),
+    backoffMs,
+  });
+}
+
 // First retry has a small floor (250ms) instead of 0ms: an immediate reissue on
 // a transient 5xx burst lets parallel workers thundering-herd the backend in
 // lockstep (jitter alone can't decluster a 0ms base). Subsequent steps keep the

package/src/runtime/agent/orchestrator/tools/bash-policy-scan.mjs

@@ -68,6 +68,12 @@ export function buildBashPolicyScanTargets(command) {
   return out;
 }
 
-export function checkExecPolicyMessage(command) {
-  return formatExecPolicyBlockMessage(evaluateExecPolicyFromTargets(buildBashPolicyScanTargets(command)));
+export function evaluateExecPolicy(command) {
+  return evaluateExecPolicyFromTargets(buildBashPolicyScanTargets(command));
+}
+
+// `elevationApproved` is runtime-supplied: the user approved this call's
+// 'ask' (elevation) decision. It never lifts a deny.
+export function checkExecPolicyMessage(command, { elevationApproved = false } = {}) {
+  return formatExecPolicyBlockMessage(evaluateExecPolicy(command), { elevationApproved });
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/command-preflight.mjs

@@ -8,11 +8,11 @@ import { formatShellToolFailure } from './result-format.mjs';
 // Policy + shell-specific rewrites before any shell dispatch. Returns either
 // `{ failure }` (a formatted tool failure) or the command to run with the
 // resolved shell spec and the wmic rewrite (if any).
-export function prepareShellCommand(args) {
+export function prepareShellCommand(args, { elevationApproved = false } = {}) {
   // Run hard-block policy before any shell dispatch.
   const rawCmd = String(args && args.command != null ? args.command : '');
   if (rawCmd) {
-    const policyBlock = checkExecPolicyMessage(rawCmd);
+    const policyBlock = checkExecPolicyMessage(rawCmd, { elevationApproved });
     if (policyBlock) return { failure: formatShellToolFailure(policyBlock) };
   }
   let command = args.command;
@@ -52,7 +52,7 @@ export function prepareShellCommand(args) {
       : null;
   if (bashismRewrite) command = bashismRewrite.command;
 
-  const execPolicyBlock = checkExecPolicyMessage(command);
+  const execPolicyBlock = checkExecPolicyMessage(command, { elevationApproved });
   if (execPolicyBlock) return { failure: formatShellToolFailure(execPolicyBlock) };
   return { command, analysisCommand, resolvedSpec, wmicRewrite, bashismRewrite };
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/completed-result.mjs

@@ -1,5 +1,6 @@
 import { renderBackgroundTask, startBackgroundTask } from '../../../../../shared/background-tasks.mjs';
 import { killShellDescendants, waitForShellDescendants } from '../../lib/shell-descendants.mjs';
+import { releaseShellJobWorkspace } from '../lib/shell-job-records.mjs';
 import { consumeFilterTeeCapture } from '../shell-analysis.mjs';
 import { compactShellOutputLosslessly, renderShellOutputBody } from '../shell-lossless-compact.mjs';
 import { removeTransportFileNow } from './transport-artifacts.mjs';
@@ -33,7 +34,10 @@ function trackSurvivingDescendants(handle, { command, cwd, options, startedAtMs
       meta: { task_id: handle.taskId, stdout: null, stderr: null, cwd, timeoutMs: 0 },
       resultType: 'shell_task_result',
       run: async () => {
-        await waitForShellDescendants(handle, { pollMs: 1_000 });
+        await waitForShellDescendants(handle);
+        // The folder reservation the finished command handed to its
+        // survivors ends with the last of them.
+        releaseShellJobWorkspace(handle.taskId);
         return {
           task_id: handle.taskId,
           status: 'completed',

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/inline-hoist.mjs

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join as pathJoin } from 'node:path';
@@ -23,12 +24,15 @@ export function hoistInlineScript(command, shellType) {
     planLongShellScriptFileTransport(command, transport);
   if (!hoist) return { command, hoistPath: null };
   try {
-    const file = pathJoin(tmpdir(), `mixdog-inline-${process.pid}-${Date.now().toString(36)}${hoist.extension}`);
+    // One file per command: parallel calls start within the same millisecond,
+    // and a shared name let a later script overwrite an earlier one before it
+    // ran. The exclusive flag refuses any name that already exists.
+    const file = pathJoin(tmpdir(), `mixdog-inline-${process.pid}-${randomUUID()}${hoist.extension}`);
     // Windows PowerShell 5.1 interprets UTF-8 without BOM as the active ANSI
     // codepage. Preserve non-ASCII command text when the transport changes a
     // long command into a .ps1 file.
     const fileBody = hoist.extension === '.ps1' ? `\uFEFF${hoist.body}` : hoist.body;
-    writeFileSync(file, fileBody, 'utf8');
+    writeFileSync(file, fileBody, { encoding: 'utf8', flag: 'wx' });
     return { command: hoist.replace(file.replace(/\\/g, '/')), hoistPath: file };
   } catch {
     return { command, hoistPath: null };

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -61,7 +61,9 @@ export async function executeBashTool(args, workDir, options = {}) {
   // Every call starts from the current Project root. A command-local `cd`
   // never creates a second session cwd authority beside the dedicated cwd tool.
   const bashWorkDir = workDir;
-  const prepared = prepareShellCommand(args);
+  // Approval comes from the runtime's options, never from model-supplied args.
+  const elevationApproved = options?.elevationApproved === true;
+  const prepared = prepareShellCommand(args, { elevationApproved });
   if (prepared.failure) return prepared.failure;
   const { resolvedSpec, wmicRewrite, bashismRewrite } = prepared;
   // Effects are analyzed on the command as the caller meant it, before the
@@ -97,6 +99,7 @@ export async function executeBashTool(args, workDir, options = {}) {
       command: invocation.wrappedCommand,
       execScript: invocation.execScript,
       directArgv: invocation.directArgv,
+      elevationApproved,
       env: invocation.spawnEnv,
       cwd: bashWorkDir,
       timeoutMs: deadlines.timeout,

package/src/runtime/agent/orchestrator/tools/builtin/external-tool-adapters.mjs

@@ -12,9 +12,16 @@
 // adapter expects — the caller (builtin.mjs default: case) falls back to
 // the existing EXTERNAL_TOOL_REDIRECTS guidance message in that case.
 import { readFileSync, mkdirSync, existsSync, lstatSync, realpathSync, statSync } from 'node:fs';
-import { dirname } from 'node:path';
+import { dirname, relative, resolve } from 'node:path';
 import { atomicWrite, symlinkWriteTarget } from './atomic-write.mjs';
-import { fileVersion } from './file-version.mjs';
+import { fileVersion, sameFileVersion } from './file-version.mjs';
+import { withBuiltinPathLocks } from './path-locks.mjs';
+import { withAdvisoryLocks } from './advisory-lock.mjs';
+import { canonicalCachePath } from './read-range-index.mjs';
+import { readSourceWindows } from './read-source-windows.mjs';
+import { isReadLineClipped } from './read-formatting.mjs';
+import { readSourceWindow } from '../../../../shared/read-row-numbers.mjs';
+import { cursorNativeCall, releaseCursorNativeCall } from '../../providers/cursor-native-context.mjs';
 import { assertPathsReachable } from './fs-reachability.mjs';
 import {
   normalizeInputPath,
@@ -30,13 +37,14 @@ import {
   isBlockedDevicePath,
   isSpecialFileStat,
 } from './device-paths.mjs';
-import { recordReadSnapshot } from './read-snapshot-runtime.mjs';
+import { recordReadSnapshot, getReadSnapshot } from './read-snapshot-runtime.mjs';
 import { executeBashTool } from './bash-tool.mjs';
 import { nativeEditSessionSatisfiesContract, runServerEdit } from '../patch/native-server.mjs';
 import { decodeValidUtf8OrNull, detectPatchTargetCodec, nearestPatchLineMatch } from '../patch/matcher.mjs';
 import { hashText } from './hash-utils.mjs';
-import { invalidateBuiltinResultCache } from './cache-layers.mjs';
+import { invalidateBuiltinResultCache, rawContentCacheGet } from './cache-layers.mjs';
 import { markCodeGraphDirtyPaths } from '../code-graph-state.mjs';
+import { reviewFileContent } from '../../../../shared/bounded-file-read.mjs';
 
 const STR_REPLACE_NAMES = new Set(['edit', 'strreplace', 'str_replace', 'str_replace_editor', 'search_replace']);
 const WRITE_NAMES = new Set(['write', 'create_file', 'createfile']);
@@ -189,26 +197,27 @@ function recordEditSnapshot(fullPath, options, contentHash = null, preMutationSt
 // UI diff parity with apply_patch: register the before/after pair on the
 // shared per-call side channel so tool cards render edit results with the
 // same diff markup. Lazy import breaks the orchestrator→builtin→adapters
-// module cycle; failures never affect the edit result.
-async function recordEditUiDiff(options, workDir, fullPath, before, after, encoding) {
+// module cycle; failures never affect the edit result. `sides()` yields the
+// file's `{ before, after }` content (null = absent).
+async function recordToolUiDiff(options, workDir, fullPath, sides) {
   const callId = options?.toolCallId;
   const sessionId = options?.sessionId || options?.readStateScope;
   if (!callId || !sessionId) return;
   try {
     const { registerEditToolUiDiff } = await import('../patch/orchestrator.mjs');
-    registerEditToolUiDiff({
-      callId,
-      sessionId,
-      basePath: workDir,
-      fullPath,
-      before: before === null ? null : encodeEditContent(before, encoding),
-      after: after === null ? null : encodeEditContent(after, encoding),
-    });
+    registerEditToolUiDiff({ callId, sessionId, basePath: workDir, fullPath, ...sides() });
   } catch {
     /* best-effort display channel */
   }
 }
 
+async function recordEditUiDiff(options, workDir, fullPath, before, after, encoding) {
+  await recordToolUiDiff(options, workDir, fullPath, () => ({
+    before: before === null ? null : encodeEditContent(before, encoding),
+    after: after === null ? null : encodeEditContent(after, encoding),
+  }));
+}
+
 // The 0-based line the failure excerpt centres on, or -1: the engine's
 // "nearest match" hint, else the exact old_string, else its longest tokens,
 // else the fuzzy line scorer.
@@ -513,13 +522,14 @@ function readEditTarget(fullPath) {
   let statBefore = {};
   let content;
   let fileEnc;
+  let rawBuf;
   try {
     try {
       statBefore = { ...fileVersion(statSync(fullPath)) };
     } catch {
       /* readFileSync below surfaces the real error */
     }
-    const rawBuf = readFileSync(fullPath);
+    rawBuf = readFileSync(fullPath);
     fileEnc = detectPatchTargetCodec(rawBuf);
     content = fileEnc.certain ? decodeEditBuffer(rawBuf, fileEnc) : null;
   } catch (err) {
@@ -534,7 +544,7 @@ function readEditTarget(fullPath) {
         ' Convert the encoding first.',
     };
   }
-  return { content, fileEnc, statBefore };
+  return { content, fileEnc, statBefore, rawBuf };
 }
 
 /**
@@ -757,7 +767,7 @@ function resolveStrReplaceArgs(args) {
   return out;
 }
 
-async function adaptStrReplace(args, workDir, options) {
+async function adaptStrReplace(args, workDir, options, resolvedTarget = null) {
   const resolved = resolveStrReplaceArgs(args);
   if (resolved.error) return resolved.error;
   let oldStr = resolved.old_string;
@@ -767,7 +777,16 @@ async function adaptStrReplace(args, workDir, options) {
   }
   if (oldStr === newStr) return SAME_STRINGS_ERROR;
   const replaceAll = args?.replace_all === true || String(args?.replace_all || '').toLowerCase() === 'true';
-  const target = await resolveTargetPath(args, workDir);
+  if (!resolvedTarget) {
+    return withEditTargetLock(
+      args,
+      workDir,
+      options,
+      (target) => adaptStrReplace(args, workDir, options, target),
+      oldStr.length === 0
+    );
+  }
+  const target = resolvedTarget || (await resolveTargetPath(args, workDir));
   if (!target) return null;
   if (target.error) return target.error;
   const fullPath = target.full;
@@ -820,14 +839,18 @@ async function adaptStrReplace(args, workDir, options) {
   return applyEditNative(edit, oldStr, newStr, editPlan, replaceAll);
 }
 
-async function adaptWrite(args, workDir, options) {
+async function adaptWrite(args, workDir, options, resolvedTarget = null) {
   const contents = args?.contents ?? args?.content ?? args?.file_text;
   if (typeof contents !== 'string') return null;
-  const target = await resolveTargetPath(args, workDir);
+  if (!resolvedTarget) {
+    return withEditTargetLock(args, workDir, options, (target) => adaptWrite(args, workDir, options, target));
+  }
+  const target = resolvedTarget || (await resolveTargetPath(args, workDir));
   if (!target) return null;
   if (target.error) return target.error;
   const fullPath = target.full;
   const existed = existsSync(fullPath);
+  const before = existed ? reviewFileContent(fullPath) : null;
   try {
     mkdirSync(dirname(fullPath), { recursive: true });
   } catch {
@@ -835,6 +858,7 @@ async function adaptWrite(args, workDir, options) {
   }
   await atomicWrite(fullPath, contents, { sessionId: editScope(options) });
   invalidateAfterWrite(fullPath);
+  await recordToolUiDiff(options, workDir, fullPath, () => ({ before, after: contents }));
   return `${existed ? 'Updated' : 'Created'} ${fullPath} (${Buffer.byteLength(contents, 'utf8')} bytes)`;
 }
 
@@ -845,6 +869,180 @@ async function adaptBash(key, args, workDir, options) {
   return executeBashTool(shellArgs, workDir, options);
 }
 
+async function withEditTargetLock(args, workDir, options, run, allowCreate = true) {
+  if (options?.signal?.aborted) throw options.signal.reason || new Error('Edit cancelled');
+  const target = await resolveTargetPath(args, workDir);
+  if (!target || target.error) return target?.error ?? null;
+  if (!allowCreate && !existsSync(target.full)) {
+    return `Error: cannot read ${target.full} (target is missing or inaccessible)`;
+  }
+  const resolveReal = () => {
+    const nearest = realpathNearestExisting(target.full);
+    return nearest ? resolve(nearest.real, relative(nearest.probe, target.full)) : null;
+  };
+  const real = resolveReal();
+  if (!real) return 'Error: cannot resolve edit target for locking';
+  return withBuiltinPathLocks([target.full, real], () =>
+    withAdvisoryLocks([real], async () => {
+      if (options?.signal?.aborted) throw options.signal.reason || new Error('Edit cancelled');
+      if (resolveReal() !== real) return 'Error: edit target changed while acquiring its lock';
+      return run(target);
+    })
+  );
+}
+
+const NATIVE_SNAPSHOT_MAX_BYTES = 1024 * 1024;
+
+// Structured truncation report for a returned read window, taken from the raw
+// source lines of that window with the read display's own clip predicate. A
+// window that cannot be verified is reported clipped (fail closed).
+async function nativeReadWindowReport(fullPath, source) {
+  if (source.startLine == null || source.endLine < source.startLine) return { lineClipped: false };
+  try {
+    const rows = await readSourceWindows(fullPath, [{ start: source.startLine, end: source.endLine }]);
+    return { lineClipped: [...rows.values()].some((row) => isReadLineClipped(row)) };
+  } catch {
+    return { lineClipped: true };
+  }
+}
+
+/** Clip report of an ordinary read result, for a Cursor read the daemon runs
+ * for a remote/proxied provider: `{ lineClipped: true }`, or null when the
+ * result is no source window or none of its lines were clipped. */
+export async function remoteReadWindowReport(args, workDir, result) {
+  const source = readSourceWindow(typeof result === 'string' ? result : '');
+  if (!source) return null;
+  const target = await resolveTargetPath(args, workDir);
+  const report = !target || target.error ? { lineClipped: true } : await nativeReadWindowReport(target.full, source);
+  return report.lineClipped ? report : null;
+}
+
+async function captureNativeRead(context, args, workDir, options, result) {
+  const pending = context.pending;
+  delete pending.nativeSnapshot;
+  delete pending.nativeReadReply;
+  delete pending.nativeReadWindow;
+  const target = await resolveTargetPath(args, workDir);
+  if (!target || target.error) return;
+  let stat;
+  try {
+    stat = statSync(target.full);
+  } catch (error) {
+    if (error.code === 'ENOENT') pending.nativeReadReply = { fileNotFound: { path: pending.native.args.path } };
+    return;
+  }
+  const source = readSourceWindow(typeof result === 'string' ? result : '');
+  if (source) pending.nativeReadWindow = await nativeReadWindowReport(target.full, source);
+  if (
+    !source ||
+    source.truncated ||
+    source.startLine !== 1 ||
+    args.offset ||
+    args.limit ||
+    stat.size > NATIVE_SNAPSHOT_MAX_BYTES ||
+    !stat.isFile()
+  )
+    return;
+  const observed = getReadSnapshot(target.full, options?.readStateScope ?? options?.sessionId ?? null);
+  if (!observed?.bodyDelivered || !sameFileVersion(observed, stat)) return;
+  const cached = rawContentCacheGet(target.full, stat);
+  if (!cached) return;
+  const bytes = Buffer.from(cached);
+  const text = bytes.toString('utf8');
+  if (text.includes('\0') || !Buffer.from(text, 'utf8').equals(bytes)) return;
+  const displayed = text
+    .replace(/^\uFEFF/, '')
+    .replace(/\r\n/g, '\n')
+    .replace(/\n$/, '');
+  if (displayed !== source.content) return;
+  const realPath = canonicalCachePath(realpathSync(target.full));
+  if (!sameFileVersion(stat, statSync(target.full))) return;
+  pending.nativeSnapshot = {
+    bytes,
+    text,
+    version: fileVersion(stat),
+    realPath,
+    path: canonicalCachePath(target.full),
+    delivered: false,
+  };
+  pending.nativeReadReply = {
+    success: {
+      path: pending.native.args.path,
+      content: text,
+      totalLines: source.totalLines,
+      fileSize: bytes.length,
+      truncated: false,
+      rangeApplied: false,
+    },
+  };
+}
+
+async function replaceNativeSnapshot(context, args, workDir, options) {
+  return withEditTargetLock(args, workDir, options, async (target) => {
+    const parent = context.pending.native.args.toolCallId;
+    if (typeof parent !== 'string' || parent.length === 0) {
+      return adaptStrReplace(args, workDir, options, target);
+    }
+    const path = canonicalCachePath(target.full);
+    const reads = [...context.executions.values()].filter(
+      (entry) =>
+        entry.native?.resultType === 'readResult' &&
+        entry.native.args.toolCallId === parent &&
+        entry.nativeSnapshot?.path === path
+    );
+    // Creating a missing/empty file retains the normal create-only contract.
+    if (reads.length === 0) return adaptStrReplace(args, workDir, options, target);
+    if (reads.length !== 1 || !reads[0].nativeSnapshot.delivered) {
+      return 'Error: native edit has no unambiguous, delivered full-file snapshot; use MCP edit with explicit old_string';
+    }
+    const snapshot = reads[0].nativeSnapshot;
+    const read = readEditTarget(target.full);
+    if (read.error) return read.error;
+    if (
+      canonicalCachePath(realpathSync(target.full)) !== snapshot.realPath ||
+      !sameFileVersion(snapshot.version, read.statBefore) ||
+      !read.rawBuf.equals(snapshot.bytes)
+    ) {
+      return 'Error: native edit target changed since its read; no replacement was written';
+    }
+    let after = args.new_string;
+    if (typeof after !== 'string') return 'Error: native replacement requires text';
+    if (read.fileEnc.bomLen && after.startsWith('\uFEFF')) after = after.slice(1);
+    const lineEndings = new Set(read.content.match(/\r\n|\r|\n/g) || []);
+    if (lineEndings.size > 1) {
+      return 'Error: native full-file replacement cannot preserve mixed line endings; use MCP edit with explicit old_string';
+    }
+    if (lineEndings.size === 1) after = convertTextEol(after, lineEndings.values().next().value);
+    const edit = { fullPath: target.full, workDir, options, ...read };
+    const bytes = encodeEditContent(after, read.fileEnc);
+    const stale = await commitEdit(edit, {
+      bytes,
+      after,
+      staleMessage: STALE_DURING_EDIT,
+    });
+    if (!stale) context.pending.nativeWrittenBytes = bytes.length;
+    return stale ?? `Updated ${editDisplayPath(edit)} (conditional native replacement)`;
+  });
+}
+
+// Called only after normal runtime permission checks. The capability is tied to
+// the streamed execution, not to a flag supplied in model arguments.
+export async function executeCursorNativeBuiltin(name, args, workDir, options, execute) {
+  const context = cursorNativeCall(options.sessionId, options.toolCallId, name, args);
+  if (!context) return execute(name, args, workDir, options);
+  if (name === 'read') {
+    const result = await execute(name, args, workDir, { ...options, suppressReadUnchangedStub: true });
+    await captureNativeRead(context, args, workDir, options, result);
+    return result;
+  }
+  releaseCursorNativeCall(context.pending);
+  try {
+    return await replaceNativeSnapshot(context, args, workDir, options);
+  } catch (error) {
+    return `Error: native edit failed (${error?.message || error})`;
+  }
+}
+
 export async function tryExecuteExternalToolAdapter(name, args, workDir, options) {
   if (typeof name !== 'string' || !name) return null;
   if (!args || typeof args !== 'object' || Array.isArray(args)) return null;