mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/tools/lib/shell-run-spawn.mjs

@@ -2,7 +2,12 @@
 // standby fast path, the spawn-burst gate around process creation, and the
 // delayed live foreground record once the command has reached a shell.
 import { acquire as acquireChildSpawnSlot } from '../../../../shared/child-spawn-gate.mjs';
-import { publishForegroundShellRecord, trackForegroundShellJob } from '../builtin/shell-jobs.mjs';
+import {
+  killShellJob,
+  publishForegroundShellRecord,
+  trackForegroundShellJob,
+  waitForShellJob,
+} from '../builtin/shell-jobs.mjs';
 import {
   nativeSpawnFileCaptureReady,
   nativeSpawnSupportsStdinPipe,
@@ -13,6 +18,11 @@ import { _maybeEncodePowerShellCommand } from '../shell-powershell.mjs';
 import { spawnShellWithRetry as _spawnShellWithRetry } from './shell-spawn-retry.mjs';
 import { STANDBY_ARGS, takeWarmShellStandby } from './shell-warm-standby.mjs';
 import { SHELL_OUTPUT_DISK_CAP } from '../shell-exec-output.mjs';
+import { admitWorkspaceActivity, tryAdmitWorkspaceActivity } from '../../../../shared/worktrees/activity-gate.mjs';
+import { worktreeError } from '../../../../shared/worktrees/contract.mjs';
+import { capturePreKill, registerForegroundOwnedTree, treeKillForceSettle } from './shell-run-state.mjs';
+import { releaseAdmissionOnConfirmedTermination } from './shell-run-settle.mjs';
+import { killAfterSnapshot } from './shell-descendants.mjs';
 
 // Foreground visibility threshold. Every shell readout (CLI statusline,
 // desktop island) scans the on-disk job records, so a foreground command is
@@ -148,7 +158,7 @@ async function gatedSpawn({
  * the moment the command reached it. Throws on spawn failure; the caller
  * turns that into the spawn-failed result.
  */
-export async function spawnShellChild({
+async function spawnAdmittedShellChild({
   run,
   shell,
   shellArg,
@@ -163,6 +173,9 @@ export async function spawnShellChild({
   clientHostPid,
 }) {
   const { useDirectArgv, spawnCommand, argv } = shapeArgv({ directArgv, shellArg, shellArgs, command, execScript });
+  // Set before any child exists: a startup that fails after the child is
+  // created still publishes a visible record and an owned termination hold.
+  run.foregroundRecordInput = { command, cwd, ownerSessionId, clientHostPid };
   const onChildError = (err) => {
     run.spawnError = run.spawnError || err;
     run.failurePhase = 'tool';
@@ -209,10 +222,22 @@ export async function spawnShellChild({
       clientHostPid,
     }));
   run.child = spawned.child;
+  registerForegroundOwnedTree(run, ownerSessionId);
+  const parentAdmission = run.workspaceAdmission;
+  const childAdmission = tryAdmitWorkspaceActivity(ownerSessionId || run.foregroundRecordId, cwd || process.cwd(), {
+    pid: Number(run.child.pid) || process.pid,
+    kind: 'command',
+  });
+  if (!childAdmission) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command workspace changed during spawn.');
+  run.workspaceAdmission = () => {
+    childAdmission();
+    parentAdmission();
+  };
   spawned.attachErrorHandler(onChildError);
   // Feed the script only after the error handler is attached; server
   // messages cannot be processed before this synchronous block yields.
   // Single atomic write+EOF, as for the standby.
+  abortSignal?.throwIfAborted();
   if (standby) standby.feed(spawnCommand, cwd);
   else if (stdinScript !== null) spawned.child.writeStdin(stdinScript, { close: true });
   // The command has now reached a shell. This is the start moment every
@@ -224,15 +249,56 @@ export async function spawnShellChild({
     run.foregroundRecordTimer = null;
     if (run.settled || run.autoBackgrounded || !run.child?.pid) return;
     run.foregroundRecordPublished = true;
-    publishForegroundShellRecord({
-      jobId: run.foregroundRecordId,
-      command,
-      cwd,
-      pid: run.child.pid,
-      startedAtMs: run.commandStartedAtMs,
-      ownerSessionId,
-      clientHostPid,
-    });
+    try {
+      publishForegroundShellRecord({
+        ...run.foregroundRecordInput,
+        jobId: run.foregroundRecordId,
+        pid: run.child.pid,
+        startedAtMs: run.commandStartedAtMs,
+      });
+    } catch (error) {
+      run.spawnError = error;
+      run.failureReason = 'workspace publication failed';
+      treeKillForceSettle(run, 'workspace-publication-failed');
+    }
   }, FOREGROUND_RECORD_DELAY_MS);
   run.foregroundRecordTimer.unref?.();
 }
+
+/** Admission precedes both native process creation and feeding a warm shell. */
+export async function spawnShellChild(input) {
+  input.run.workspaceAdmission = await admitWorkspaceActivity(
+    input.ownerSessionId || input.run.foregroundRecordId,
+    input.cwd || process.cwd(),
+    input.abortSignal,
+    { kind: 'command' }
+  );
+  try {
+    input.abortSignal?.throwIfAborted();
+    return await spawnAdmittedShellChild(input);
+  } catch (error) {
+    if (!input.run.child) {
+      input.run.workspaceAdmission();
+      input.run.workspaceAdmission = null;
+    } else {
+      try {
+        // Identities first: the kill may break the parent chain.
+        // Bounded: the kill is sent even if the snapshot hangs or fails.
+        await killAfterSnapshot(capturePreKill(input.run), () => killShellJob(input.run.foregroundRecordId));
+        const detail = await waitForShellJob(input.run.foregroundRecordId);
+        if (!detail || !['completed', 'failed', 'cancelled'].includes(detail.nativeStatus)) {
+          throw new Error('The child termination could not be confirmed; workspace admission is retained.');
+        }
+        input.run.workspaceAdmission?.();
+        input.run.workspaceAdmission = null;
+      } catch (cleanupError) {
+        input.run.killUnconfirmed = true;
+        // No settle will ever run for this run; the reservation is released
+        // only once the child has exited and its descendants are gone.
+        releaseAdmissionOnConfirmedTermination(input.run);
+        throw new AggregateError([error, cleanupError], 'Shell startup failed and workspace cleanup remains blocked.');
+      }
+    }
+    throw error;
+  }
+}

package/src/runtime/agent/orchestrator/tools/lib/shell-run-state.mjs

@@ -4,8 +4,37 @@
 // tree-kill. The spawn, settle and auto-background phases live in their own
 // modules and read/write this one record.
 import { randomUUID } from 'node:crypto';
-import { retireForegroundShellRecord } from '../builtin/shell-jobs.mjs';
+import { publishForegroundShellRecord, retireForegroundShellRecord } from '../builtin/shell-jobs.mjs';
 import { ShellTextDecoder, TaskOutput, treeKill } from '../shell-exec-output.mjs';
+import { createProcessTreeTracker, killAfterSnapshot } from './shell-descendants.mjs';
+import { registerOwnedShellTree } from './owned-shell-trees.mjs';
+
+/** One pre-kill identity read of the run's tree (every kill path shares it):
+ *  resolves true once the capture is complete, false when it failed. */
+export function capturePreKill(run) {
+  run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: run.child.pid });
+  const rootExited = run.child.exitCode != null || run.child.signalCode != null;
+  return run.terminationTracker.capture({ rootExited }).catch(() => false);
+}
+
+/** Session close cancels every tree its session owns. For a foreground run
+ *  that cancel must snapshot the identities first, exactly like the run's own
+ *  kill, and mark the run owner-cancelled so its settle completes on confirmed
+ *  termination instead of on the root's exit. */
+export function registerForegroundOwnedTree(run, ownerSessionId) {
+  if (!ownerSessionId) return;
+  run.ownedTree = {
+    ownerSessionId,
+    prepareKill: () => {
+      if (run.settled || run.autoBackgrounded || !run.child?.pid) return true;
+      run.killed = true;
+      run.ownerCancelled = true;
+      run.killCause = run.killCause || 'session-close';
+      return run.terminationTracker?.complete === true || capturePreKill(run);
+    },
+  };
+  registerOwnedShellTree(run.foregroundRecordId, run.ownedTree);
+}
 
 // Treekill + exit confirmation. treeKill alone leaves settle() pending on
 // 'close'/'exit'; on Windows a taskkill miss or a grandchild holding stdio
@@ -85,6 +114,12 @@ export function createShellRun({ abortSignal, resolve, jobId = null }) {
     foregroundRecordId: jobId || `job_${Date.now()}_${randomUUID().slice(0, 6)}`,
     foregroundRecordTimer: null,
     foregroundRecordPublished: false,
+    // Command/cwd/owner the live record is published with.
+    foregroundRecordInput: null,
+    // Process identities captured before a kill, and the stop() of the
+    // observation loop that holds the workspace until they are gone.
+    terminationTracker: null,
+    stopTerminationWatch: null,
   };
 }
 
@@ -149,6 +184,49 @@ export function clearForegroundRecord(run) {
 // Runtime of the COMMAND (see startMs).
 export const elapsedSinceStart = (run) => Math.max(0, Date.now() - (run.commandStartedAtMs || run.startMs));
 
+/** The command's result is reported, but its processes are not confirmed
+ *  gone: the live record stays — now marked unconfirmed — until the
+ *  termination watch retires it. */
+export function keepTerminationUnconfirmedRecord(run) {
+  if (run.foregroundRecordTimer) {
+    clearTimeout(run.foregroundRecordTimer);
+    run.foregroundRecordTimer = null;
+  }
+  if (!run.foregroundRecordInput || !run.child?.pid) return;
+  try {
+    publishForegroundShellRecord({
+      ...run.foregroundRecordInput,
+      jobId: run.foregroundRecordId,
+      pid: run.child.pid,
+      startedAtMs: run.commandStartedAtMs,
+      terminationUnconfirmed: true,
+    });
+    run.foregroundRecordPublished = true;
+  } catch {
+    /* the record is presentation; the workspace admission stays held */
+  }
+}
+
+// Record the tree's identities while the root is still alive, THEN kill: once
+// an intermediate dies its children's parent links dangle and a snapshot taken
+// afterwards can no longer find them.
+// The kill waits for the snapshot at most PROCESS_TABLE_READ_BOUND_MS and is
+// sent whether the snapshot succeeded, failed or is still pending (a late
+// snapshot is still absorbed; a missing one leaves the outcome unknown, so the
+// workspace stays held under the observation loop). The confirmation deadline
+// starts once the kill is actually issued.
+function snapshotThenKill(run, afterKill) {
+  if (!run.child?.pid) {
+    treeKill(run.child);
+    afterKill();
+    return;
+  }
+  void killAfterSnapshot(capturePreKill(run), () => {
+    treeKill(run.child);
+    afterKill();
+  });
+}
+
 export function treeKillForceSettle(run, cause) {
   run.killed = true;
   run.killCause = run.killCause || cause || 'runtime-guard';
@@ -161,8 +239,7 @@ export function treeKillForceSettle(run, cause) {
       if (run.child?.exitCode != null || run.child?.signalCode != null) return;
       attempts += 1;
       if (attempts < KILL_CONFIRM_ATTEMPTS) {
-        treeKill(run.child);
-        armConfirmation();
+        snapshotThenKill(run, armConfirmation);
         return;
       }
       run.partialOutput = true;
@@ -172,6 +249,5 @@ export function treeKillForceSettle(run, cause) {
     }, KILL_CONFIRM_INTERVAL_MS);
     if (deadline.unref) deadline.unref();
   };
-  treeKill(run.child);
-  armConfirmation();
+  snapshotThenKill(run, armConfirmation);
 }

package/src/runtime/agent/orchestrator/tools/patch/ui-diff.mjs

@@ -1,8 +1,9 @@
 // UI-diff side channel: a committed apply_patch (or edit-tool write) records
 // a turn-review change entry and a per-call diff the desktop/TUI tool cards
 // pick up. Display only — never affects edit semantics.
-import { createTwoFilesPatch } from 'diff';
+import { createLineDiffBudget, lineDiffHunks, unifiedHunksBody } from '../../../../shared/bounded-line-diff.mjs';
 import { boundReviewPatch } from '../../../../shared/review-diff.mjs';
+import { decodeText } from '../../../../shared/turn-changes.mjs';
 import { recordTurnDiffChanges } from '../../../../shared/turn-snapshot.mjs';
 import { pathKey, resolveV4AEntryPath } from './paths.mjs';
 import { patchHeaderPathForResolved } from './read-redirects.mjs';
@@ -38,31 +39,21 @@ function headerPath(value) {
     .replace(/\\/g, '/');
 }
 
-const DIFF_TIMEOUT_MS = 100;
-
-const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
-
 function isOmitted(value) {
   return Boolean(value) && typeof value === 'object' && !(value instanceof Uint8Array) && value.omitted === true;
 }
 
-// Text of one side: '' for an absent file, null when it is not UTF-8 text.
+// Text of one side: '' for an absent file, null when it is binary (not UTF-8
+// or holding a NUL byte) — the same rule as the turn review's tracker diffs.
 function sideText(value) {
-  if (value == null) return '';
-  if (typeof value === 'string') return value;
-  if (value instanceof Uint8Array) {
-    try {
-      return utf8.decode(value);
-    } catch {
-      return null;
-    }
-  }
+  if (value == null || typeof value === 'string' || value instanceof Uint8Array) return decodeText(value);
   return null;
 }
 
 // One file's change, from the call's own before and after states: absent
 // (null), bytes or text, or an omitted marker when the bytes were not kept.
-function renderCallChange({ displayPath, newDisplayPath, before, after }) {
+// `budget` is the call's line-diff budget.
+function renderCallChange({ displayPath, newDisplayPath, before, after }, budget) {
   const oldName = headerPath(displayPath) || 'unknown file';
   const newName = headerPath(newDisplayPath) || oldName;
   const oldHeader = before == null ? '/dev/null' : `a/${oldName}`;
@@ -82,23 +73,46 @@ function renderCallChange({ displayPath, newDisplayPath, before, after }) {
     return oldName === newName ? '' : `${head}similarity index 100%\nrename from ${oldName}\nrename to ${newName}\n`;
   }
   const rename = oldName === newName ? '' : `rename from ${oldName}\nrename to ${newName}\n`;
-  try {
-    const generated = createTwoFilesPatch(oldHeader, newHeader, oldText, newText, '', '', {
-      context: 3,
-      timeout: DIFF_TIMEOUT_MS,
-    });
-    const start = generated.search(/^--- /m);
-    if (start >= 0) return `${head}${rename}${generated.slice(start).replace(/\n*$/, '\n')}`;
-  } catch {
-    // A pathological diff timing out must not stall tool completion.
+  const { hunks } = lineDiffHunks(oldText, newText, budget, [before ?? null, after ?? null]);
+  return `${head}${rename}${unifiedHunksBody(oldHeader, newHeader, hunks)}`;
+}
+
+// Added/deleted lines of one rendered change, counted in its hunks only.
+function hunkLineCounts(patch) {
+  let additions = 0;
+  let deletions = 0;
+  let inHunk = false;
+  for (const line of patch.split('\n')) {
+    if (line.startsWith('@@')) inHunk = true;
+    else if (inHunk && line.startsWith('+')) additions += 1;
+    else if (inHunk && line.startsWith('-')) deletions += 1;
   }
-  return `${head}${rename}Binary files ${oldHeader} and ${newHeader} differ\n`;
+  return { additions, deletions };
+}
+
+// Each change with the line counts of its own unbounded diff (the turn review
+// sums them per file), plus the call's whole diff, within the call's budget.
+export function measureCallChanges(changes, budget = createLineDiffBudget()) {
+  const patches = (changes || []).map((change) => renderCallChange(change, budget));
+  return {
+    diff: patches.join(''),
+    changes: (changes || []).map((change, index) => ({ ...change, ...hunkLineCounts(patches[index]) })),
+  };
 }
 
 // A call's card shows the change that call made — its own before against its
 // own after — never the turn's running total for the same files.
 export function callUiDiff(changes) {
-  return (changes || []).map(renderCallChange).join('');
+  return measureCallChanges(changes).diff;
+}
+
+// Fold the call's measured changes into the turn review and publish its card
+// diff. Both share one line-diff budget: the call is one operation.
+function recordCallChanges(callId, sessionId, changes) {
+  const budget = createLineDiffBudget();
+  const measured = measureCallChanges(changes, budget);
+  recordTurnDiffChanges(sessionId, measured.changes, budget);
+  registerApplyPatchUiDiff(callId, measured.diff);
 }
 
 // Edit-tool UI diff: a successful single-file str-replace edit records the
@@ -108,21 +122,42 @@ export function callUiDiff(changes) {
 export function registerEditToolUiDiff({ callId, sessionId, basePath, fullPath, before, after }) {
   if (!callId || !sessionId || typeof fullPath !== 'string') return;
   try {
-    const changes = [
-      {
-        path: fullPath,
-        displayPath: patchHeaderPathForResolved(basePath || '', fullPath),
-        before: before ?? null,
-        after: after ?? null,
-      },
-    ];
-    recordTurnDiffChanges(sessionId, changes);
-    registerApplyPatchUiDiff(callId, callUiDiff(changes));
+    recordCallChanges(callId, sessionId, [toolFileChange(basePath, { fullPath, before, after })]);
   } catch {
     // best-effort display channel
   }
 }
 
+function toolFileChange(basePath, { fullPath, before, after }) {
+  return {
+    path: fullPath,
+    displayPath: patchHeaderPathForResolved(basePath || '', fullPath),
+    before: before ?? null,
+    after: after ?? null,
+  };
+}
+
+// Writes of a tool without a per-call card (tidy, office): each change
+// `{ fullPath, before, after }` (null = absent, bytes, or an omitted marker)
+// joins the turn review with its own line counts, like an edit-tool write.
+// Side channel only — never affects the tool result.
+export function recordToolFileChanges({ sessionId, basePath, changes }) {
+  if (!sessionId || !changes?.length) return;
+  try {
+    const budget = createLineDiffBudget();
+    recordTurnDiffChanges(
+      sessionId,
+      measureCallChanges(
+        changes.map((change) => toolFileChange(basePath, change)),
+        budget
+      ).changes,
+      budget
+    );
+  } catch {
+    // best-effort review channel
+  }
+}
+
 // Review content of one snapshot: null when absent, the bytes when captured,
 // and an explicit omitted marker (never empty bytes) when they were not.
 function snapshotContent(snapshot) {
@@ -184,8 +219,7 @@ export function registerCommittedPatchUiDiff({
         after: snapshotContent(after),
       });
     }
-    recordTurnDiffChanges(sessionId, changes);
-    registerApplyPatchUiDiff(callId, callUiDiff(changes));
+    recordCallChanges(callId, sessionId, changes);
   } catch {
     // Review collection is a side channel and must never affect committed
     // apply_patch success/failure semantics.

package/src/runtime/agent/orchestrator/tools/progress-message.mjs

@@ -105,8 +105,25 @@ export function formatToolStartProgress(name, args = {}) {
     // ── host_input / cwd ─────────────────────────────────────────────
     case 'inject_input':
       return 'injecting input';
-    case 'cwd':
+    case 'cwd': // legacy: old transcripts
       return a.action === 'set' ? 'setting cwd' : 'resolving cwd';
+    case 'session':
+      switch (a.action) {
+        case 'set-project':
+          return 'setting project';
+        case 'rename':
+          return 'renaming session';
+        case 'compact':
+          return 'scheduling compaction';
+        case 'fork':
+          return 'forking into a new session';
+        case 'favorite':
+          return a.value === false ? 'unfavoriting session' : 'favoriting session';
+        case 'archive':
+          return a.value === false ? 'unarchiving session' : 'archiving session';
+        default:
+          return 'checking session';
+      }
 
     default:
       return `running ${name}`;

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -27,9 +27,9 @@ export {
 } from './shell-powershell.mjs';
 export { stripAnsi, ExecResult } from './shell-exec-output.mjs';
 
-async function _execPolicyBlockMessage(command) {
+async function _execPolicyBlockMessage(command, elevationApproved = false) {
   const { checkExecPolicyMessage } = await import('./bash-policy-scan.mjs');
-  return checkExecPolicyMessage(command);
+  return checkExecPolicyMessage(command, { elevationApproved });
 }
 
 // Admission-wait ceiling. Without it a saturated shell lane (all leases held
@@ -233,7 +233,7 @@ const failedResult = (run, stderr, failureReason) =>
 // Admission lease, policy preflight, then the spawn. Resolves the run with a
 // tool-phase failure and returns false when the command never reaches a shell.
 async function admitAndSpawn(run, params, { admissionWaitMs, onSaturated }) {
-  const { admission, command, ownerSessionId, abortSignal } = params;
+  const { admission, command, ownerSessionId, abortSignal, elevationApproved } = params;
   try {
     run.resourceLease = await acquireShellLeaseBounded(admission, {
       abortSignal,
@@ -241,7 +241,7 @@ async function admitAndSpawn(run, params, { admissionWaitMs, onSaturated }) {
       label: `[task_id: ${run.foregroundRecordId}] ${String(command || '').slice(0, 120)}`,
       ownerKey: ownerSessionId,
     });
-    const policyErr = await _execPolicyBlockMessage(command);
+    const policyErr = await _execPolicyBlockMessage(command, elevationApproved === true);
     if (policyErr) {
       await releaseResourceLease(run);
       run.resolveResult(failedResult(run, policyErr, 'preflight failed'));
@@ -544,6 +544,8 @@ export function execShellCommand(options) {
     // hands the script to the shell out-of-band — see the POSIX env+eval path in
     // bash-tool.mjs, which keeps the command body out of the child's argv.
     execScript = null,
+    // The user approved this call's elevation 'ask' decision (runtime-set).
+    elevationApproved = false,
   } = options;
   return new Promise(async (resolve) => {
     const run = createShellRun({ abortSignal, resolve, jobId });
@@ -565,6 +567,7 @@ export function execShellCommand(options) {
           abortSignal,
           directArgv,
           execScript,
+          elevationApproved,
           ownerSessionId,
           clientHostPid,
         },

package/src/runtime/agent/orchestrator/tools/shell-exec-policy.mjs

@@ -2,7 +2,7 @@ import { extractHeredocBodies, extractShellCInner, stripQuotedAndHeredoc } from
 import { extractPowerShellCommandInner } from './shell-powershell.mjs';
 import { decodePowerShellEncodedCommand, isBlockedCommand, WRAPPER_NAMES } from './shell-policy.mjs';
 
-/** @typedef {'allow'|'deny'} ExecPolicyDecision */
+/** @typedef {'allow'|'ask'|'deny'} ExecPolicyDecision */
 
 const EXEC_POLICY_DENY_PATTERNS = [
   /\b(curl|wget|fetch|Invoke-WebRequest|iwr)\b[^\n|&;]*\|[^\n|&;]*\b(sh|bash|zsh|dash|pwsh|powershell)(?:\.exe)?\b/i,
@@ -16,9 +16,28 @@ const EXEC_POLICY_DENY_PATTERNS = [
   // lookahead instead of the previous bare `iex\s+`.
   /\|\s*iex\b/i,
   /\biex\s+[$("'@]/i,
-  /\bStart-Process\b[^\n]*\s-Verb\s+RunAs\b/i,
 ];
 
+// Elevated launch: `Start-Process` (or its aliases `saps` / `start`) with
+// `-Verb RunAs`. Not a hard deny — the user is asked (parity with Claude Code's
+// "Command requests elevated privileges"). `-Verb` may be abbreviated to any
+// prefix (`-v`, `-ve`, `-ver`) and take its value after a space or a colon.
+// `Start-Process` matches anywhere (as the former deny rule did); the short
+// aliases only at a command position so `npm start -v RunAs` stays allowed.
+const ELEVATION_ASK_PATTERN =
+  /(?:\bStart-Process\b|(?:^|[;&|({=\n])\s*(?:&\s*)?(?:saps|start)(?![\w-]))[^\n]*?\s-v(?:e(?:rb?)?)?(?:\s*:\s*|\s+)RunAs\b/i;
+const ELEVATION_ASK_REASON = 'Command requests elevated privileges';
+
+// PowerShell spellings of the same token that the quote-stripping pass would
+// otherwise hide or split: backtick line continuation, backtick-escaped
+// letters (`-V`erb`), and a quoted `-Verb` value (`-Verb:'RunAs'`).
+function _normalizeElevationSyntax(text) {
+  return String(text || '')
+    .replace(/`\r?\n/g, ' ')
+    .replace(/`([A-Za-z])/g, '$1')
+    .replace(/(\s-v\w*(?:\s*:\s*|\s+))(['"])\s*RunAs\s*\2/gi, '$1RunAs');
+}
+
 // Verbs with no non-destructive invocation. `dd` is deliberately ABSENT: the
 // disk-destroying form (`of=/dev/<disk>`) is hard-blocked at every command
 // position by shell-policy, while `dd if=/dev/zero of=file` is the ordinary
@@ -39,12 +58,44 @@ const EXEC_POLICY_DENY_COMMANDS = new Set([
   'parted',
 ]);
 
-const _POLICY_RANK = { allow: 0, deny: 1 };
+const _POLICY_RANK = { allow: 0, ask: 1, deny: 2 };
 
 // EVERY command position, not just the first: a deny-listed verb after `&&`,
 // `;`, `|` or a newline is still an execution request, and reading only
 // segment 0 let `true && shutdown /s` through. Callers pass quote-stripped
 // text, so prose inside a string ("graceful shutdown") never reaches here.
+const _ELEVATION_WRAPPERS = new Set(['sudo', 'doas', 'pkexec', 'gsudo']);
+const _bareName = (token) =>
+  token
+    .replace(/^.*[\\/]/, '')
+    .toLowerCase()
+    .replace(/\.(exe|cmd|bat|com)$/i, '');
+
+// Returns the first privilege-escalation wrapper (sudo, doas, pkexec, gsudo,
+// with or without path/extension) found at any command position, else null.
+function _elevationWrapperAtPositions(command) {
+  for (const seg of String(command || '').split(/[;&|\n]+/)) {
+    const tokens = seg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length) {
+      const t = tokens[i];
+      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+        i++;
+        continue;
+      }
+      const base = _bareName(t);
+      if (_ELEVATION_WRAPPERS.has(base)) return base;
+      if (WRAPPER_NAMES.has(base)) {
+        i++;
+        while (i < tokens.length && (/^[-+]/.test(tokens[i]) || /^\d+[smhd]?$/.test(tokens[i]))) i++;
+        continue;
+      }
+      break;
+    }
+  }
+  return null;
+}
+
 function _commandNamesAtPositions(command) {
   const names = [];
   for (const seg of String(command || '').split(/[;&|\n]+/)) {
@@ -56,7 +107,7 @@ function _commandNamesAtPositions(command) {
         i++;
         continue;
       }
-      if (WRAPPER_NAMES.has(t.toLowerCase())) {
+      if (WRAPPER_NAMES.has(_bareName(t))) {
         i++;
         while (i < tokens.length && (/^[-+]/.test(tokens[i]) || /^\d+[smhd]?$/.test(tokens[i]))) i++;
         continue;
@@ -74,14 +125,15 @@ function classifyExecPolicy(command) {
   if (!text.trim()) return { decision: 'allow', reason: '' };
   // Scan executable syntax, not quoted log/search text. Recursively preserve
   // actual shell, PowerShell, heredoc, and encoded-command payload coverage.
-  const executableTargets = [
-    stripQuotedAndHeredoc(text),
-    ...extractShellCInner(text).map(stripQuotedAndHeredoc),
-    ...extractPowerShellCommandInner(text).map(stripQuotedAndHeredoc),
-    ...extractHeredocBodies(text).map(stripQuotedAndHeredoc),
+  const rawTargets = [
+    text,
+    ...extractShellCInner(text),
+    ...extractPowerShellCommandInner(text),
+    ...extractHeredocBodies(text),
   ];
   const decodedPowerShell = decodePowerShellEncodedCommand(text);
-  if (decodedPowerShell) executableTargets.push(stripQuotedAndHeredoc(decodedPowerShell));
+  if (decodedPowerShell) rawTargets.push(decodedPowerShell);
+  const executableTargets = rawTargets.map(stripQuotedAndHeredoc);
   if (executableTargets.some((target) => isBlockedCommand(target))) {
     return {
       decision: 'deny',
@@ -115,6 +167,24 @@ function classifyExecPolicy(command) {
       };
     }
   }
+  // Elevation asks only after every deny rule above has had its say.
+  for (const target of rawTargets) {
+    const hit = ELEVATION_ASK_PATTERN.exec(stripQuotedAndHeredoc(_normalizeElevationSyntax(target)));
+    if (hit) {
+      return {
+        decision: 'ask',
+        reason: ELEVATION_ASK_REASON,
+        rule: 'elevation',
+        match: hit[0].trim().slice(0, 80),
+      };
+    }
+  }
+  for (const target of executableTargets) {
+    const wrapper = _elevationWrapperAtPositions(target);
+    if (wrapper) {
+      return { decision: 'ask', reason: ELEVATION_ASK_REASON, rule: 'elevation', match: wrapper };
+    }
+  }
   // Destructive-but-legitimate commands are NOT judged here. The caller
   // computes that non-blocking warning once (getDedupedDestructiveWarnings)
   // and prepends it to the result; deriving it again per scan target only
@@ -140,9 +210,15 @@ export function evaluateExecPolicyFromTargets(targets) {
   return worst;
 }
 
-/** Pre-spawn block message — deny is the only decision this scan produces. */
-export function formatExecPolicyBlockMessage(policyResult) {
+/** Pre-spawn block message. An 'ask' decision blocks unless the runtime
+ *  already obtained the user's approval for this call (`elevationApproved`). */
+export function formatExecPolicyBlockMessage(policyResult, { elevationApproved = false } = {}) {
   const r = policyResult || { decision: 'allow' };
+  if (r.decision === 'ask') {
+    if (elevationApproved === true) return null;
+    const rule = r.rule ? ` [rule ${r.rule}${r.match ? `: "${r.match}"` : ''}]` : '';
+    return `Error: command requires user approval for elevation — ${r.reason || ELEVATION_ASK_REASON}${rule}; no approval was granted for this call`;
+  }
   if (r.decision === 'deny') {
     const rule = r.rule ? ` [rule ${r.rule}${r.match ? `: "${r.match}"` : ''}]` : '';
     const alt = r.alternative ? `; instead: ${r.alternative}` : '';

package/src/runtime/agent/orchestrator/tools/shell-policy.mjs

@@ -17,6 +17,8 @@ export const WRAPPER_NAMES = new Set([
   'env',
   'sudo',
   'doas',
+  'pkexec',
+  'gsudo',
   'nice',
   'stdbuf',
   'chronic',