mixdog 1.2.3 → 1.2.5

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-context-expander.mjs

@@ -75,10 +75,11 @@ function parseAnchor(line, { workDir, rgSpawnCwd, grepResolvedPath, searchPath,
       content: String(line).slice(split.markerEnd),
     };
   }
-  const raw = splitGrepLinePrefix(line);
+  // The anchor pass runs rg without context lines: every line is a match.
+  const raw = splitGrepLinePrefix(line, true);
   if (raw?.delimiter !== ':') return null;
-  const normalized = relativeGrepLine(line, workDir, false, outputMode, false);
-  const display = splitGrepLinePrefix(normalized);
+  const normalized = relativeGrepLine(line, workDir, false, outputMode, false, true);
+  const display = splitGrepLinePrefix(normalized, true);
   if (display?.delimiter !== ':') return null;
   return {
     path: display.path,

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-output.mjs

@@ -301,8 +301,9 @@ export function formatGrepOutput({
   includeMatchCount = false,
 }) {
   const lines = headLimit === Infinity ? windowed : windowed.slice(0, headLimit);
+  const matchOnly = outputMode === 'content' && !(beforeN > 0 || afterN > 0 || contextN > 0);
   const normalized = lines.map((line) =>
-    relativeGrepLine(line, workDir, outputMode === 'files_with_matches', outputMode, filenameOmitted)
+    relativeGrepLine(line, workDir, outputMode === 'files_with_matches', outputMode, filenameOmitted, matchOnly)
   );
   const remaining = Math.max(0, totalWindowed - lines.length);
   const shown = lines.length;

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-path-fanout.mjs

@@ -82,23 +82,25 @@ function combinedPathRequest(args, defaultHeadLimit) {
 // order; null when one is a glob, unreachable, or on a share — the legacy
 // fan-out owns those diagnostics.
 async function resolvePathRoots(list, workDir) {
-  const roots = await Promise.all(list.map(async (p) => {
-    const cleaned = normalizeInputPath(p);
-    if (hasGlobMagic(cleaned)) return null;
-    const resolved = resolveSearchScope(cleaned, workDir);
-    if (isUncOrSmbPath(cleaned) || isUncOrSmbPath(resolved)) return null;
-    let st;
-    try {
-      st = await statReachable(resolved);
-    } catch {
-      return null;
-    }
-    return {
-      arg: p,
-      abs: normalizeOutputPath(isAbsolute(resolved) ? await trueCasePath(resolved) : resolved),
-      isDir: st.isDirectory(),
-    };
-  }));
+  const roots = await Promise.all(
+    list.map(async (p) => {
+      const cleaned = normalizeInputPath(p);
+      if (hasGlobMagic(cleaned)) return null;
+      const resolved = resolveSearchScope(cleaned, workDir);
+      if (isUncOrSmbPath(cleaned) || isUncOrSmbPath(resolved)) return null;
+      let st;
+      try {
+        st = await statReachable(resolved);
+      } catch {
+        return null;
+      }
+      return {
+        arg: p,
+        abs: normalizeOutputPath(isAbsolute(resolved) ? await trueCasePath(resolved) : resolved),
+        isDir: st.isDirectory(),
+      };
+    })
+  );
   if (roots.some((root) => !root)) return null;
   // An overlapping operand would scan a file twice and then attribute both
   // copies to each containing section. Keep independent scope semantics.
@@ -123,7 +125,7 @@ function attributeLinesToRoots(lines, roots, wdFwd) {
   for (const line of lines) {
     const norm = line.replace(/\\/g, '/');
     const lineKey = pathKey(norm);
-    const rel = lineKey.startsWith(workDirKey) ? norm.slice(wdFwd.length + 1) : line;
+    const rel = lineKey.startsWith(workDirKey) ? line.slice(wdFwd.length + 1) : line;
     for (let i = 0; i < roots.length; i++) {
       const rootKey = pathKey(roots[i].abs);
       if (lineKey === rootKey || lineKey.startsWith(`${rootKey}/`) || lineKey.startsWith(`${rootKey}:`)) {
@@ -143,7 +145,7 @@ function renderedRootLines(root, windowedLines, wdFwd) {
   const rootPrefix = `${pathKey(rootRel)}:`;
   return windowedLines.map((l) => {
     const lineFwd = l.replace(/\\/g, '/');
-    return pathKey(lineFwd).startsWith(rootPrefix) ? lineFwd.slice(rootRel.length + 1) : l;
+    return pathKey(lineFwd).startsWith(rootPrefix) ? l.slice(rootRel.length + 1) : l;
   });
 }
 
@@ -151,13 +153,13 @@ async function combinedPathBody(request, root, linesFor, { workDir, wdFwd, optio
   const { pattern, outMode, headLimit, offset, contextN, autoContext, caseInsensitive } = request;
   if (outMode === 'content' && (autoContext || contextN > 0)) {
     const ctx = await expandGrepAnchorContextOutput({
-      allLines: linesFor,
+      allLines: renderedRootLines(root, linesFor, wdFwd),
       workDir,
       rgSpawnCwd: wdFwd,
       grepResolvedPath: root.abs,
       searchPath: root.arg,
       outputMode: outMode,
-      filenameOmitted: false,
+      filenameOmitted: !root.isDir,
       headLimit,
       offset,
       totalKnown: true,
@@ -229,29 +231,31 @@ async function runCombinedPathFanout({ args, list, workDir, options, callContext
 
 // One rg invocation over every root's files at once.
 async function combinedPathRgArgs(args, request, roots, workDir) {
-  const perRoot = await Promise.all(roots.map(async (root) => {
-    const scope = await resolveGrepScope({ ...args, path: root.arg }, workDir);
-    if (scope.result !== undefined) return null;
-    return buildGrepRgArgs({
-      patterns: [request.pattern],
-      includeNoise: args.include_noise === true,
-      text: args.text === true,
-      searchPath: isAbsolute(scope.searchPath) ? root.abs : scope.searchPath,
-      // Match buildGrepScope: an explicit file operand wins over its glob.
-      globPatterns: root.isDir ? scope.normalizedGlobPatterns : [],
-      outputMode: request.outMode,
-      caseInsensitive: request.caseInsensitive,
-      showLineNumbers: true,
-      beforeN: null,
-      afterN: null,
-      contextN: null,
-      multilineMode: false,
-      fileType: '',
-      onlyMatching: false,
-      pcre2: false,
-      withFilename: true,
-    }).slice(0, -1);
-  }));
+  const perRoot = await Promise.all(
+    roots.map(async (root) => {
+      const scope = await resolveGrepScope({ ...args, path: root.arg }, workDir);
+      if (scope.result !== undefined) return null;
+      return buildGrepRgArgs({
+        patterns: [request.pattern],
+        includeNoise: args.include_noise === true,
+        text: args.text === true,
+        searchPath: isAbsolute(scope.searchPath) ? root.abs : scope.searchPath,
+        // Match buildGrepScope: an explicit file operand wins over its glob.
+        globPatterns: root.isDir ? scope.normalizedGlobPatterns : [],
+        outputMode: request.outMode,
+        caseInsensitive: request.caseInsensitive,
+        showLineNumbers: true,
+        beforeN: null,
+        afterN: null,
+        contextN: null,
+        multilineMode: false,
+        fileType: '',
+        onlyMatching: false,
+        pcre2: false,
+        withFilename: true,
+      }).slice(0, -1);
+    })
+  );
   if (perRoot.some((argv) => !argv)) return null;
   const first = JSON.stringify(perRoot[0]);
   // Native filters are rooted at each operand. Only identical normalized

package/src/runtime/agent/orchestrator/tools/builtin/lib/search-input-helpers.mjs

@@ -3,12 +3,19 @@ import { canonicalizeGlobSlashes } from '../path-utils.mjs';
 import { relativePathPrefix } from '../search-path-diagnostics.mjs';
 import { normalizeGrepLine, splitGrepCountPrefix, splitGrepLinePrefix } from '../grep-formatting.mjs';
 
-export function relativeGrepLine(line, workDir, pathOnly = false, outputMode = 'content', filenameOmitted = false) {
-  const normalized = normalizeGrepLine(line, pathOnly, outputMode, filenameOmitted);
+export function relativeGrepLine(
+  line,
+  workDir,
+  pathOnly = false,
+  outputMode = 'content',
+  filenameOmitted = false,
+  matchOnly = false
+) {
+  const normalized = normalizeGrepLine(line, pathOnly, outputMode, filenameOmitted, matchOnly);
   if (!workDir) return normalized;
   if (pathOnly) return relativePathPrefix(normalized, workDir);
   if (filenameOmitted) return normalized;
-  const split = splitGrepLinePrefix(normalized);
+  const split = splitGrepLinePrefix(normalized, matchOnly);
   if (split) {
     return relativePathPrefix(normalized.slice(0, split.pathEnd), workDir) + normalized.slice(split.pathEnd);
   }

package/src/runtime/agent/orchestrator/tools/builtin/lib/shell-job-records.mjs

@@ -21,11 +21,31 @@
  * partial `.json`, and a marker never exists without its `.json`.
  */
 import { access, mkdir, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { unlinkSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { writeJsonAtomicAsync } from '../../../../../shared/atomic-file.mjs';
 import { isPidAlive } from '../../../../../shared/pid-liveness.mjs';
 import { displayShellCommand } from '../../../../../shared/shell-display.mjs';
+import { tryAdmitWorkspaceActivity } from '../../../../../shared/worktrees/activity-gate.mjs';
+import { worktreeError } from '../../../../../shared/worktrees/contract.mjs';
+import { workspaceSees } from '../../../../../shared/worktrees/workspace-visibility.mjs';
+
+const workspaceLeases = new Map();
+
+/** Transfer a foreground reader to a surviving-descendant task without a lease gap. */
+export function adoptShellWorkspaceAdmission(jobId, leave) {
+  const prior = workspaceLeases.get(jobId);
+  workspaceLeases.set(
+    jobId,
+    prior
+      ? () => {
+          prior();
+          leave();
+        }
+      : leave
+  );
+}
 
 // A record whose owner process is gone is garbage. Age alone never deletes a
 // live owner's job, so an unlimited long-running shell keeps its record.
@@ -155,10 +175,26 @@ async function sweepOrphanRecords(dir) {
 /** Publish the record for a job that has just started or been promoted. */
 export function publishShellJobRecord(
   task,
-  { ownerSessionId = null, clientHostPid = null, startedAtMs = 0, foreground = false } = {}
+  {
+    ownerSessionId = null,
+    clientHostPid = null,
+    startedAtMs = 0,
+    foreground = false,
+    terminationUnconfirmed = false,
+  } = {}
 ) {
   const jobId = String(task?.jobId || '').trim();
   if (!jobId) return;
+  if (task?.cwd) {
+    const leave = tryAdmitWorkspaceActivity(ownerSessionId || jobId, task.cwd, {
+      pid: Number(task.pid) || process.pid,
+      kind: 'command',
+    });
+    if (!leave) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command folder is being managed.');
+    // A descendant handoff can reuse the job id with a different live pid.
+    // Acquire its reader before releasing any predecessor's admission.
+    adoptShellWorkspaceAdmission(jobId, leave);
+  }
   const ownerPid = Number(clientHostPid ?? task?.clientHostPid) || process.pid;
   const dir = jobsDir();
   const jsonPath = join(dir, `${jobId}.json`);
@@ -192,6 +228,12 @@ export function publishShellJobRecord(
         // removed on settle. Restart recovery skips them: there is no
         // task id to report and no waiter to notify.
         ...(foreground ? { foreground: true } : {}),
+        // A killed command whose processes are not confirmed gone: its
+        // result is reported, but the readouts keep listing it.
+        ...(terminationUnconfirmed ? { terminationUnconfirmed: true } : {}),
+        // Its owner session closed: any session that sees the folder lists
+        // (and may release) it.
+        ...(closedOwnerSessions.has(String(ownerSessionId || '')) ? { ownerSessionClosed: true } : {}),
       };
       records.set(jobId, record);
       incarnations.delete(jobId);
@@ -205,26 +247,146 @@ export function publishShellJobRecord(
 }
 
 /** Preserve a bounded terminal snapshot for manual recovery after restart. */
+// jobId -> { ownerSessionId, release } for every job whose result is reported
+// but whose processes are not confirmed gone. The hold is dropped by the
+// termination watch on confirmation, or by an explicit user force-release —
+// never by a timer.
+const terminationHolds = new Map();
+// Owner sessions that closed in this runtime: their holds have no owner left
+// to release them, so any session that sees the workspace may.
+const closedOwnerSessions = new Set();
+
+export function registerTerminationHold(jobId, { ownerSessionId = null, cwd = null, release }) {
+  const key = String(jobId || '').trim();
+  if (key && typeof release === 'function') terminationHolds.set(key, { ownerSessionId, cwd, release });
+}
+
+export function clearTerminationHold(jobId) {
+  terminationHolds.delete(String(jobId || '').trim());
+}
+
+/** The owner session closed: its live records are flagged so every surface
+ *  can list them for the sessions that see their folder. */
+export function noteShellOwnerSessionClosed(sessionId) {
+  const id = String(sessionId || '').trim();
+  if (!id) return;
+  closedOwnerSessions.add(id);
+  for (const [jobId, record] of records) {
+    if (record?.ownerSessionId === id) void patchRunningShellJobRecord(jobId, { ownerSessionClosed: true });
+  }
+}
+
+const releaseRequestPath = (key) => join(jobsDir(), `${key}.release-requested`);
+
+async function requestRemoteRelease(key, caller) {
+  const id = validJobId(key);
+  const record = id ? JSON.parse(await readFile(join(jobsDir(), `${id}.json`), 'utf8')) : null;
+  if (record?.status !== 'running' || record.terminationUnconfirmed !== true) throw new Error('not held');
+  const hold = { ownerSessionId: record.ownerSessionId || null, cwd: record.cwd };
+  if (!mayRelease(hold, { ...caller, ownerClosed: record.ownerSessionClosed === true })) {
+    throw new Error('not permitted');
+  }
+  await writeFile(releaseRequestPath(id), '', 'utf8');
+  return { released: true, deferred: true };
+}
+
+/** Consume a cross-process release request for `jobId`; true when one existed. */
+export function takeReleaseRequest(jobId) {
+  const key = validJobId(jobId);
+  if (!key) return false;
+  try {
+    unlinkSync(releaseRequestPath(key));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function mayRelease(hold, { callerSessionId, callerCwd, ownerClosed = closedOwnerSessions.has(hold.ownerSessionId) }) {
+  if (!hold.ownerSessionId || hold.ownerSessionId === callerSessionId) return true;
+  return ownerClosed && workspaceSees(hold.cwd, callerCwd);
+}
+
+/** Explicit user action ("Release anyway"): drop the workspace hold of a job
+ *  whose termination is unconfirmed. The surface asks for confirmation first.
+ *  The owning session may release it; once that session has closed, any
+ *  session whose workspace (`callerCwd`) sees the hold's folder may. */
+export async function forceReleaseTerminationHold(jobId, { callerSessionId = null, callerCwd = null } = {}) {
+  const key = String(jobId || '').trim();
+  const refused = { released: false, error: `no unconfirmed termination hold: ${key}` };
+  const hold = terminationHolds.get(key);
+  // The hold lives in another runtime process (a desktop pane's session shard):
+  // its own observation loop honours the request at its next pass.
+  if (!hold) return requestRemoteRelease(key, { callerSessionId, callerCwd }).catch(() => refused);
+  if (!mayRelease(hold, { callerSessionId, callerCwd })) return refused;
+  try {
+    await hold.release();
+  } catch (error) {
+    return { released: false, error: error instanceof Error ? error.message : String(error) };
+  }
+  if (terminationHolds.get(key) === hold) terminationHolds.delete(key);
+  return { released: true };
+}
+
+/** Release the workspace admission adopted under `jobId` without a record of
+ *  its own (survivors a finished foreground command left behind), once they
+ *  are confirmed gone. */
+export function releaseShellJobWorkspace(jobId) {
+  const key = String(jobId || '').trim();
+  const leave = workspaceLeases.get(key);
+  if (!leave) return;
+  leave();
+  if (workspaceLeases.get(key) === leave) workspaceLeases.delete(key);
+}
+
+/** Flag a still-open job record as "termination unconfirmed" for the readouts. */
+export function markShellJobTerminationUnconfirmed(jobId) {
+  return patchRunningShellJobRecord(jobId, { terminationUnconfirmed: true });
+}
+
+function patchRunningShellJobRecord(jobId, patch) {
+  const key = validJobId(jobId);
+  if (!key) return Promise.resolve(false);
+  const jsonPath = join(jobsDir(), `${key}.json`);
+  return enqueue(key, async () => {
+    const record = records.get(key);
+    if (record?.status !== 'running') return false;
+    const next = { ...record, ...patch };
+    records.set(key, next);
+    await writeJsonAtomicAsync(jsonPath, next, { fsync: false });
+    return true;
+  }).catch(() => false);
+}
+
 export function completeShellJobRecord(jobId, detail) {
   const key = validJobId(jobId);
   if (!key) return Promise.resolve(false);
+  const leaveWorkspace = workspaceLeases.get(key);
   const dir = jobsDir();
   const jsonPath = join(dir, `${key}.json`);
   const donePath = join(dir, `${key}.done`);
   const list = paths.get(key) || [jsonPath];
   const ownerPaths = list.filter((path) => path.includes('.owner-'));
   return enqueue(key, async () => {
-    await mkdir(dir, { recursive: true });
-    let base = records.get(key) || null;
-    if (!base) {
-      try {
-        base = JSON.parse(await readFile(jsonPath, 'utf8'));
-      } catch {}
+    try {
+      await mkdir(dir, { recursive: true });
+      let base = records.get(key) || null;
+      if (!base) {
+        try {
+          base = JSON.parse(await readFile(jsonPath, 'utf8'));
+        } catch {}
+      }
+      const record = terminalRecord(base, { ...detail, jobId: key });
+      records.set(key, record);
+      await writeJsonAtomicAsync(jsonPath, record, { fsync: false });
+      await writeFile(donePath, '', 'utf8');
+    } finally {
+      // Callers complete a record only once its processes are confirmed gone
+      // (or explicitly released): the workspace admission follows that, not
+      // the record write, so a failed write cannot strand it with no handle.
+      leaveWorkspace?.();
+      if (workspaceLeases.get(key) === leaveWorkspace) workspaceLeases.delete(key);
     }
-    const record = terminalRecord(base, { ...detail, jobId: key });
-    records.set(key, record);
-    await writeJsonAtomicAsync(jsonPath, record, { fsync: false });
-    await writeFile(donePath, '', 'utf8');
     await removePaths(ownerPaths);
     paths.set(key, [jsonPath, donePath]);
     const incarnation = ++incarnationSeq;
@@ -245,33 +407,51 @@ export function completeShellJobRecord(jobId, detail) {
   }).catch(() => false);
 }
 
-export async function readShellJobRecord(jobId) {
+/** Test support: settles once every record write queued so far for `jobId`
+ *  has finished, so a test waits on the write itself, not on elapsed turns. */
+export function _shellJobRecordWritesSettledForTest(jobId) {
+  return chains.get(String(jobId || '').trim()) || Promise.resolve();
+}
+
+export async function readShellJobRecord(jobId, { strict = false } = {}) {
   const key = validJobId(jobId);
   if (!key) return null;
   const dir = jobsDir();
   const jsonPath = join(dir, `${key}.json`);
   try {
     const record = JSON.parse(await readFile(jsonPath, 'utf8'));
+    if (
+      strict &&
+      (!record ||
+        !['running', 'completed', 'failed', 'cancelled'].includes(record.status) ||
+        (record.status === 'running' && !record.cwd))
+    )
+      throw new Error(`Cannot inspect shell job ${key}.`);
     const done = await access(join(dir, `${key}.done`)).then(
       () => true,
-      () => false
+      (error) => {
+        if (strict && error?.code !== 'ENOENT') throw error;
+        return false;
+      }
     );
     return { ...record, recovered: true, terminal: done || record?.status !== 'running' };
-  } catch {
+  } catch (error) {
+    if (strict && error?.code !== 'ENOENT') throw error;
     return null;
   }
 }
 
-export async function listShellJobRecords() {
+export async function listShellJobRecords({ strict = false } = {}) {
   const dir = jobsDir();
   let names;
   try {
     names = await readdir(dir);
-  } catch {
+  } catch (error) {
+    if (strict && error?.code !== 'ENOENT') throw error;
     return [];
   }
   const rows = await Promise.all(
-    names.filter((name) => name.endsWith('.json')).map((name) => readShellJobRecord(name.slice(0, -5)))
+    names.filter((name) => name.endsWith('.json')).map((name) => readShellJobRecord(name.slice(0, -5), { strict }))
   );
   const cutoff = Date.now() - COMPLETED_SHELL_JOB_TTL_MS;
   return rows.filter((record) => {
@@ -286,6 +466,8 @@ export async function listShellJobRecords() {
 export function retireShellJobRecord(jobId) {
   const key = String(jobId || '').trim();
   if (!key) return;
+  const leaveWorkspace = workspaceLeases.get(key);
+  workspaceLeases.delete(key);
   const list = paths.get(key);
   paths.delete(key);
   // Queued behind every earlier publish and ahead of any later one: a promoted
@@ -294,5 +476,6 @@ export function retireShellJobRecord(jobId) {
     records.delete(key);
     incarnations.delete(key);
     await removePaths(list);
+    leaveWorkspace?.();
   });
 }

package/src/runtime/agent/orchestrator/tools/builtin/lib/shell-task-output.mjs

@@ -2,9 +2,10 @@ import { closeSync, fstatSync, openSync, readSync } from 'node:fs';
 import { stripAnsi } from '../../shell-exec-output.mjs';
 import { FileEncodingSniffer, ShellStreamDecoder, alignedOffset, oemTextEncoding } from '../../shell-codepage.mjs';
 
-const PAGE_BYTES = 8 * 1024;
-const COMPLETION_BYTES = 12 * 1024;
+import { TOOL_OUTPUT_PAGE_BYTES, TOOL_OUTPUT_TAIL_BYTES } from '../../../../../shared/tool-output-budget.mjs';
 const cursors = new WeakMap();
+const ESC = '\x1b';
+const PENDING_ANSI_INTRODUCER = new RegExp(`${ESC}(?:\\[[0-?]*[ -/]*|\\](?:(?!${ESC}\\\\)[^\x07\x9c])*)?$`);
 
 function newCursor() {
   return {
@@ -36,7 +37,7 @@ function visibleText(cursor, text) {
   const value = cursor.ansi + text;
   // Retain only the introducer of an unfinished CSI/OSC, not its potentially
   // unbounded payload. It will be stripped with the following chunk.
-  const pending = /\x1b(?:\[[0-?]*[ -/]*|\](?:(?!\x1b\\)[^\x07\x9c])*)?$/.exec(value);
+  const pending = PENDING_ANSI_INTRODUCER.exec(value);
   cursor.ansi = '';
   if (!pending) return stripAnsi(value);
   const sequence = pending[0];
@@ -53,7 +54,7 @@ function visibleText(cursor, text) {
 export function readShellTaskOutput(task, result = {}, { output = 'new' } = {}) {
   const replay = output === 'tail';
   const terminal = task.status !== 'running';
-  const limit = terminal || replay ? COMPLETION_BYTES : PAGE_BYTES;
+  const limit = terminal || replay ? TOOL_OUTPUT_TAIL_BYTES : TOOL_OUTPUT_PAGE_BYTES;
   let streams = replay ? new Map() : cursors.get(task);
   if (!streams) {
     streams = new Map();

package/src/runtime/agent/orchestrator/tools/builtin/read-formatting.mjs

@@ -79,10 +79,15 @@ export function parseLineLimitArg(value, defaultValue) {
   return Math.max(1, Math.trunc(n));
 }
 
+/** Whether the read display clips this source line. */
+export function isReadLineClipped(line, { truncateLongLine = true } = {}) {
+  return truncateLongLine && String(line ?? '').length > READ_MAX_RENDERED_LINE_CHARS;
+}
+
 export function truncateReadLineText(line, { truncateLongLine = true } = {}) {
   let text = String(line ?? '');
   const originalLength = text.length;
-  if (truncateLongLine && text.length > READ_MAX_RENDERED_LINE_CHARS) {
+  if (isReadLineClipped(text, { truncateLongLine })) {
     const cps = [...text];
     const head = cps.slice(0, 1_500).join('');
     const tail = cps.slice(-300).join('');

package/src/runtime/agent/orchestrator/tools/builtin/shell-analysis.mjs

@@ -3,6 +3,7 @@ import { assertPathReachable, assertPathsReachable } from './fs-reachability.mjs
 import { isAbsolute, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { randomUUID } from 'node:crypto';
+import { isBuiltin } from 'node:module';
 import { cwdRelativePath, normalizeInputPath, normalizeOutputPath, resolveAgainstCwd } from './path-utils.mjs';
 
 // Hard-block patterns live exclusively in ../shell-policy.mjs (BLOCKED_PATTERNS /
@@ -661,6 +662,24 @@ const LONG_INLINE_SCRIPT_RE =
   /\b(node(?:\.exe)?|python3?|py)((?:\s+--?[\w-]+(?:=[^\s"']+)?)*)\s+(-e|--eval|-c)\s+(?:"((?:[^"\\]|\\.)*)"|'((?:[^']|'')*)')/i;
 const POWERSHELL_FILE_SEMANTIC_RE = /\$(?:PSScriptRoot|PSCommandPath|MyInvocation)\b|^\s*(?:param\s*\(|#requires\b)/im;
 
+// `node -e` resolves a package name from the working directory; a hoisted file
+// resolves it from the temp directory it lives in, where no node_modules is.
+// Any package specifier (not a Node builtin), require.resolve, or a specifier
+// that is not a string literal therefore keeps the -e form.
+const NODE_SPECIFIER_RE = /(?:\brequire\s*\(\s*|\bimport\s*\(\s*|\bfrom\s+|\bimport\s+)['"]([^'"]+)['"]/g;
+const NODE_LOADER_CALL_RE = /\b(?:require|import)\s*\(/g;
+const NODE_LITERAL_LOADER_CALL_RE = /\b(?:require|import)\s*\(\s*['"][^'"]+['"]/g;
+function importsPackage(body) {
+  if (/\brequire\s*\.\s*resolve\b/.test(body)) return true;
+  if ((body.match(NODE_LOADER_CALL_RE) || []).length !== (body.match(NODE_LITERAL_LOADER_CALL_RE) || []).length) {
+    return true;
+  }
+  for (const [, specifier] of body.matchAll(NODE_SPECIFIER_RE)) {
+    if (!isBuiltin(specifier)) return true;
+  }
+  return false;
+}
+
 /** File extension a hoisted inline script gets: Python, or the Node module kind the flags declare. */
 function inlineScriptExtension(isNode, esm) {
   if (!isNode) return '.py';
@@ -684,6 +703,7 @@ export function planInlineScriptHoist(command) {
   const [whole, exe, rawFlags, , body] = match;
   if (INLINE_UNSAFE_BODY.test(body)) return null;
   if (INLINE_FILE_RELATIVE.test(body)) return null;
+  if (/^node/i.test(exe) && importsPackage(body)) return null;
   const { extension, keptFlags } = inlineScriptFileShape(exe, rawFlags);
   return {
     exe,