mixdog 1.2.3 → 1.2.4

package/src/runtime/agent/orchestrator/tools/lib/shell-run-spawn.mjs

@@ -2,7 +2,12 @@
 // standby fast path, the spawn-burst gate around process creation, and the
 // delayed live foreground record once the command has reached a shell.
 import { acquire as acquireChildSpawnSlot } from '../../../../shared/child-spawn-gate.mjs';
-import { publishForegroundShellRecord, trackForegroundShellJob } from '../builtin/shell-jobs.mjs';
+import {
+  killShellJob,
+  publishForegroundShellRecord,
+  trackForegroundShellJob,
+  waitForShellJob,
+} from '../builtin/shell-jobs.mjs';
 import {
   nativeSpawnFileCaptureReady,
   nativeSpawnSupportsStdinPipe,
@@ -13,6 +18,11 @@ import { _maybeEncodePowerShellCommand } from '../shell-powershell.mjs';
 import { spawnShellWithRetry as _spawnShellWithRetry } from './shell-spawn-retry.mjs';
 import { STANDBY_ARGS, takeWarmShellStandby } from './shell-warm-standby.mjs';
 import { SHELL_OUTPUT_DISK_CAP } from '../shell-exec-output.mjs';
+import { admitWorkspaceActivity, tryAdmitWorkspaceActivity } from '../../../../shared/worktrees/activity-gate.mjs';
+import { worktreeError } from '../../../../shared/worktrees/contract.mjs';
+import { capturePreKill, registerForegroundOwnedTree, treeKillForceSettle } from './shell-run-state.mjs';
+import { releaseAdmissionOnConfirmedTermination } from './shell-run-settle.mjs';
+import { killAfterSnapshot } from './shell-descendants.mjs';
 
 // Foreground visibility threshold. Every shell readout (CLI statusline,
 // desktop island) scans the on-disk job records, so a foreground command is
@@ -148,7 +158,7 @@ async function gatedSpawn({
  * the moment the command reached it. Throws on spawn failure; the caller
  * turns that into the spawn-failed result.
  */
-export async function spawnShellChild({
+async function spawnAdmittedShellChild({
   run,
   shell,
   shellArg,
@@ -163,6 +173,9 @@ export async function spawnShellChild({
   clientHostPid,
 }) {
   const { useDirectArgv, spawnCommand, argv } = shapeArgv({ directArgv, shellArg, shellArgs, command, execScript });
+  // Set before any child exists: a startup that fails after the child is
+  // created still publishes a visible record and an owned termination hold.
+  run.foregroundRecordInput = { command, cwd, ownerSessionId, clientHostPid };
   const onChildError = (err) => {
     run.spawnError = run.spawnError || err;
     run.failurePhase = 'tool';
@@ -209,10 +222,22 @@ export async function spawnShellChild({
       clientHostPid,
     }));
   run.child = spawned.child;
+  registerForegroundOwnedTree(run, ownerSessionId);
+  const parentAdmission = run.workspaceAdmission;
+  const childAdmission = tryAdmitWorkspaceActivity(ownerSessionId || run.foregroundRecordId, cwd || process.cwd(), {
+    pid: Number(run.child.pid) || process.pid,
+    kind: 'command',
+  });
+  if (!childAdmission) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command workspace changed during spawn.');
+  run.workspaceAdmission = () => {
+    childAdmission();
+    parentAdmission();
+  };
   spawned.attachErrorHandler(onChildError);
   // Feed the script only after the error handler is attached; server
   // messages cannot be processed before this synchronous block yields.
   // Single atomic write+EOF, as for the standby.
+  abortSignal?.throwIfAborted();
   if (standby) standby.feed(spawnCommand, cwd);
   else if (stdinScript !== null) spawned.child.writeStdin(stdinScript, { close: true });
   // The command has now reached a shell. This is the start moment every
@@ -224,15 +249,56 @@ export async function spawnShellChild({
     run.foregroundRecordTimer = null;
     if (run.settled || run.autoBackgrounded || !run.child?.pid) return;
     run.foregroundRecordPublished = true;
-    publishForegroundShellRecord({
-      jobId: run.foregroundRecordId,
-      command,
-      cwd,
-      pid: run.child.pid,
-      startedAtMs: run.commandStartedAtMs,
-      ownerSessionId,
-      clientHostPid,
-    });
+    try {
+      publishForegroundShellRecord({
+        ...run.foregroundRecordInput,
+        jobId: run.foregroundRecordId,
+        pid: run.child.pid,
+        startedAtMs: run.commandStartedAtMs,
+      });
+    } catch (error) {
+      run.spawnError = error;
+      run.failureReason = 'workspace publication failed';
+      treeKillForceSettle(run, 'workspace-publication-failed');
+    }
   }, FOREGROUND_RECORD_DELAY_MS);
   run.foregroundRecordTimer.unref?.();
 }
+
+/** Admission precedes both native process creation and feeding a warm shell. */
+export async function spawnShellChild(input) {
+  input.run.workspaceAdmission = await admitWorkspaceActivity(
+    input.ownerSessionId || input.run.foregroundRecordId,
+    input.cwd || process.cwd(),
+    input.abortSignal,
+    { kind: 'command' }
+  );
+  try {
+    input.abortSignal?.throwIfAborted();
+    return await spawnAdmittedShellChild(input);
+  } catch (error) {
+    if (!input.run.child) {
+      input.run.workspaceAdmission();
+      input.run.workspaceAdmission = null;
+    } else {
+      try {
+        // Identities first: the kill may break the parent chain.
+        // Bounded: the kill is sent even if the snapshot hangs or fails.
+        await killAfterSnapshot(capturePreKill(input.run), () => killShellJob(input.run.foregroundRecordId));
+        const detail = await waitForShellJob(input.run.foregroundRecordId);
+        if (!detail || !['completed', 'failed', 'cancelled'].includes(detail.nativeStatus)) {
+          throw new Error('The child termination could not be confirmed; workspace admission is retained.');
+        }
+        input.run.workspaceAdmission?.();
+        input.run.workspaceAdmission = null;
+      } catch (cleanupError) {
+        input.run.killUnconfirmed = true;
+        // No settle will ever run for this run; the reservation is released
+        // only once the child has exited and its descendants are gone.
+        releaseAdmissionOnConfirmedTermination(input.run);
+        throw new AggregateError([error, cleanupError], 'Shell startup failed and workspace cleanup remains blocked.');
+      }
+    }
+    throw error;
+  }
+}

package/src/runtime/agent/orchestrator/tools/lib/shell-run-state.mjs

@@ -4,8 +4,37 @@
 // tree-kill. The spawn, settle and auto-background phases live in their own
 // modules and read/write this one record.
 import { randomUUID } from 'node:crypto';
-import { retireForegroundShellRecord } from '../builtin/shell-jobs.mjs';
+import { publishForegroundShellRecord, retireForegroundShellRecord } from '../builtin/shell-jobs.mjs';
 import { ShellTextDecoder, TaskOutput, treeKill } from '../shell-exec-output.mjs';
+import { createProcessTreeTracker, killAfterSnapshot } from './shell-descendants.mjs';
+import { registerOwnedShellTree } from './owned-shell-trees.mjs';
+
+/** One pre-kill identity read of the run's tree (every kill path shares it):
+ *  resolves true once the capture is complete, false when it failed. */
+export function capturePreKill(run) {
+  run.terminationTracker = run.terminationTracker || createProcessTreeTracker({ pid: run.child.pid });
+  const rootExited = run.child.exitCode != null || run.child.signalCode != null;
+  return run.terminationTracker.capture({ rootExited }).catch(() => false);
+}
+
+/** Session close cancels every tree its session owns. For a foreground run
+ *  that cancel must snapshot the identities first, exactly like the run's own
+ *  kill, and mark the run owner-cancelled so its settle completes on confirmed
+ *  termination instead of on the root's exit. */
+export function registerForegroundOwnedTree(run, ownerSessionId) {
+  if (!ownerSessionId) return;
+  run.ownedTree = {
+    ownerSessionId,
+    prepareKill: () => {
+      if (run.settled || run.autoBackgrounded || !run.child?.pid) return true;
+      run.killed = true;
+      run.ownerCancelled = true;
+      run.killCause = run.killCause || 'session-close';
+      return run.terminationTracker?.complete === true || capturePreKill(run);
+    },
+  };
+  registerOwnedShellTree(run.foregroundRecordId, run.ownedTree);
+}
 
 // Treekill + exit confirmation. treeKill alone leaves settle() pending on
 // 'close'/'exit'; on Windows a taskkill miss or a grandchild holding stdio
@@ -85,6 +114,12 @@ export function createShellRun({ abortSignal, resolve, jobId = null }) {
     foregroundRecordId: jobId || `job_${Date.now()}_${randomUUID().slice(0, 6)}`,
     foregroundRecordTimer: null,
     foregroundRecordPublished: false,
+    // Command/cwd/owner the live record is published with.
+    foregroundRecordInput: null,
+    // Process identities captured before a kill, and the stop() of the
+    // observation loop that holds the workspace until they are gone.
+    terminationTracker: null,
+    stopTerminationWatch: null,
   };
 }
 
@@ -149,6 +184,49 @@ export function clearForegroundRecord(run) {
 // Runtime of the COMMAND (see startMs).
 export const elapsedSinceStart = (run) => Math.max(0, Date.now() - (run.commandStartedAtMs || run.startMs));
 
+/** The command's result is reported, but its processes are not confirmed
+ *  gone: the live record stays — now marked unconfirmed — until the
+ *  termination watch retires it. */
+export function keepTerminationUnconfirmedRecord(run) {
+  if (run.foregroundRecordTimer) {
+    clearTimeout(run.foregroundRecordTimer);
+    run.foregroundRecordTimer = null;
+  }
+  if (!run.foregroundRecordInput || !run.child?.pid) return;
+  try {
+    publishForegroundShellRecord({
+      ...run.foregroundRecordInput,
+      jobId: run.foregroundRecordId,
+      pid: run.child.pid,
+      startedAtMs: run.commandStartedAtMs,
+      terminationUnconfirmed: true,
+    });
+    run.foregroundRecordPublished = true;
+  } catch {
+    /* the record is presentation; the workspace admission stays held */
+  }
+}
+
+// Record the tree's identities while the root is still alive, THEN kill: once
+// an intermediate dies its children's parent links dangle and a snapshot taken
+// afterwards can no longer find them.
+// The kill waits for the snapshot at most PROCESS_TABLE_READ_BOUND_MS and is
+// sent whether the snapshot succeeded, failed or is still pending (a late
+// snapshot is still absorbed; a missing one leaves the outcome unknown, so the
+// workspace stays held under the observation loop). The confirmation deadline
+// starts once the kill is actually issued.
+function snapshotThenKill(run, afterKill) {
+  if (!run.child?.pid) {
+    treeKill(run.child);
+    afterKill();
+    return;
+  }
+  void killAfterSnapshot(capturePreKill(run), () => {
+    treeKill(run.child);
+    afterKill();
+  });
+}
+
 export function treeKillForceSettle(run, cause) {
   run.killed = true;
   run.killCause = run.killCause || cause || 'runtime-guard';
@@ -161,8 +239,7 @@ export function treeKillForceSettle(run, cause) {
       if (run.child?.exitCode != null || run.child?.signalCode != null) return;
       attempts += 1;
       if (attempts < KILL_CONFIRM_ATTEMPTS) {
-        treeKill(run.child);
-        armConfirmation();
+        snapshotThenKill(run, armConfirmation);
         return;
       }
       run.partialOutput = true;
@@ -172,6 +249,5 @@ export function treeKillForceSettle(run, cause) {
     }, KILL_CONFIRM_INTERVAL_MS);
     if (deadline.unref) deadline.unref();
   };
-  treeKill(run.child);
-  armConfirmation();
+  snapshotThenKill(run, armConfirmation);
 }

package/src/runtime/attachments/store.d.mts

@@ -1,3 +1,12 @@
 export function readAttachmentBuffer(value: string | { attachmentRef?: string }): Buffer;
 export function isPermanentAttachmentError(error: unknown): boolean;
 export function isAttachmentReference(value: unknown): boolean;
+export interface MessageAttachment {
+  id: string;
+  attachmentRef: string;
+  kind: 'image' | 'file' | 'text';
+  name: string;
+  mimeType: string;
+  size: number;
+}
+export function attachmentsForIntake(prompt: unknown, options?: unknown): MessageAttachment[];

package/src/runtime/attachments/store.mjs

@@ -2,8 +2,8 @@
  * Content-addressed prompt attachment store.
  *
  * Renderer/TUI inputs carry the bytes exactly once to the daemon intake. From
- * that boundary onward queues, checkpoints, session JSON, live-share frames,
- * and desktop snapshots carry only a sha256 reference plus byte-free metadata.
+ * that boundary onward queues, checkpoints, session JSON and desktop
+ * snapshots carry only a sha256 reference plus byte-free metadata.
  * Provider lowering resolves the reference at the last possible boundary.
  */
 import { createHash, randomBytes } from 'node:crypto';
@@ -214,11 +214,13 @@ export function storeInlineDocumentPart(part) {
     if (source?.type !== 'base64' || typeof source.data !== 'string') return null;
     data = source.data;
     const { source: _source, type: _type, mimeType: _mimeType, mediaType: _mediaType, ...rest } = part;
-    const mimeType = String(source.media_type || source.mediaType || part.mimeType || part.mediaType || 'application/pdf')
-      .trim()
-      .toLowerCase() || 'application/pdf';
+    const mimeType =
+      String(source.media_type || source.mediaType || part.mimeType || part.mediaType || 'application/pdf')
+        .trim()
+        .toLowerCase() || 'application/pdf';
     metadata = { ...rest, type: 'file', mimeType };
-    const filename = (typeof part.title === 'string' && part.title) || (typeof part.filename === 'string' && part.filename) || '';
+    const filename =
+      (typeof part.title === 'string' && part.title) || (typeof part.filename === 'string' && part.filename) || '';
     if (filename) metadata.filename = filename;
   } else if (part.type === 'file' && typeof part.data === 'string') {
     const { data: inline, ...rest } = part;
@@ -282,9 +284,7 @@ export function isMissingAttachmentError(error) {
 // never become readable. EBUSY/EPERM/EACCES/EMFILE and friends are transient:
 // callers must let them propagate rather than rewrite history around them.
 export function isPermanentAttachmentError(error) {
-  return (
-    isMissingAttachmentError(error) || error?.code === ATTACHMENT_INVALID || error?.code === ATTACHMENT_INTEGRITY
-  );
+  return isMissingAttachmentError(error) || error?.code === ATTACHMENT_INVALID || error?.code === ATTACHMENT_INTEGRITY;
 }
 
 export function readAttachmentBase64(value) {
@@ -534,6 +534,77 @@ export function materializePromptSubmission(prompt, options = {}) {
   };
 }
 
+const MAX_MESSAGE_ATTACHMENTS = 64;
+
+/**
+ * The user-attachment records of one materialized submission, for the message
+ * metadata (`meta.transcript.attachments`): every image, file and
+ * pasted/attached text that lives in the store, by its content hash. The id IS
+ * the `attachmentRef`; the record repeats it under that key so the store's
+ * mark-and-sweep census (which scans persisted sessions for `"attachmentRef"`)
+ * keeps the blob for as long as the message exists, even after compaction
+ * dropped the content part. Plain long prompt text (no `textKind`) is not an
+ * attachment.
+ */
+export function attachmentsForIntake(prompt, options = {}) {
+  const found = new Map();
+  const add = (ref, info) => {
+    if (!ATTACHMENT_REF_RE.test(String(ref || '')) || found.has(ref) || found.size >= MAX_MESSAGE_ATTACHMENTS) return;
+    found.set(ref, info);
+  };
+  const named = (raw, fallback) => String(raw?.filename || raw?.name || fallback).slice(0, 200);
+  const pastedImages = Object.values(options?.pastedImages || {}).filter((raw) => raw && typeof raw === 'object');
+  const pastedTexts = Object.values(options?.pastedTexts || {}).filter((raw) => raw && typeof raw === 'object');
+  const parts = Array.isArray(prompt) ? prompt : [];
+  for (const part of parts) {
+    if (!isAttachmentReference(part)) continue;
+    const mimeType = String(part.mimeType || part.mediaType || '').slice(0, 100);
+    if (part.type === 'image') {
+      const meta = pastedImages.find((raw) => raw.attachmentRef === part.attachmentRef);
+      add(part.attachmentRef, {
+        kind: 'image',
+        name: named(meta || part, 'image'),
+        mimeType: mimeType || String(meta?.mediaType || 'image/png'),
+        size: attachmentBlobSize(part, part.sizeBytes),
+      });
+    } else if (part.type === 'file') {
+      add(part.attachmentRef, {
+        kind: 'file',
+        name: named(part, 'attachment'),
+        mimeType: mimeType || 'application/octet-stream',
+        size: attachmentBlobSize(part, part.sizeBytes),
+      });
+    } else if (part.type === 'text' && (part.textKind === 'paste' || part.textKind === 'file')) {
+      add(part.attachmentRef, {
+        kind: 'text',
+        name: named(part, part.textKind === 'paste' ? 'pasted-text.txt' : 'attachment.txt'),
+        mimeType: mimeType || 'text/plain',
+        size: attachmentBlobSize(part, part.sizeBytes),
+      });
+    }
+  }
+  // Images the prompt carries only by side table (no matching content part).
+  for (const raw of pastedImages) {
+    if (!isAttachmentReference(raw)) continue;
+    add(raw.attachmentRef, {
+      kind: 'image',
+      name: named(raw, 'image'),
+      mimeType: String(raw.mediaType || 'image/png').slice(0, 100),
+      size: attachmentBlobSize(raw, raw.sizeBytes),
+    });
+  }
+  for (const raw of pastedTexts) {
+    if (!isAttachmentReference(raw)) continue;
+    add(raw.attachmentRef, {
+      kind: 'text',
+      name: named(raw, raw.source === 'file' ? 'attachment.txt' : 'pasted-text.txt'),
+      mimeType: String(raw.mimeType || 'text/plain').slice(0, 100),
+      size: attachmentBlobSize(raw, raw.sizeBytes),
+    });
+  }
+  return [...found].map(([ref, info]) => ({ id: ref, attachmentRef: ref, ...info }));
+}
+
 /**
  * Whether a provider takes a PDF as a native document block. Decided by the
  * provider's wire protocol: each adapter class declares `nativePdf`; a provider

package/src/runtime/browser-bridge/browser-action-contract.d.mts

@@ -1,7 +1,6 @@
 export const BROWSER_ACTIONS: readonly string[];
 export const BROWSER_DEVTOOLS_ACTIONS: readonly string[];
 export const BROWSER_PAGE_ACTIONS: readonly string[];
-export const BROWSER_TOOL_NAMES: readonly string[];
 export function browserToolForAction(action: string): string;
 export const BROWSER_OBSERVATION_ACTIONS: readonly string[];
 export const BROWSER_POSTCONDITION_ACTIONS: readonly string[];

package/src/runtime/browser-bridge/browser-action-contract.mjs

@@ -57,8 +57,6 @@ export const BROWSER_PAGE_ACTIONS = Object.freeze(
 
 const BROWSER_TOOL_NAME = 'browser';
 const BROWSER_DEVTOOLS_TOOL_NAME = 'browser_devtools';
-/** Both tools drive the same bridge, pages, and sign-in. */
-export const BROWSER_TOOL_NAMES = Object.freeze([BROWSER_TOOL_NAME, BROWSER_DEVTOOLS_TOOL_NAME]);
 
 export function browserToolForAction(action) {
   return BROWSER_DEVTOOLS_ACTIONS.includes(action) ? BROWSER_DEVTOOLS_TOOL_NAME : BROWSER_TOOL_NAME;