mixdog 1.2.5 → 1.3.0

package/src/runtime/agent/orchestrator/tools/graph-manifest.json

@@ -1,30 +1,30 @@
 {
-  "version": "0.1.32",
+  "version": "0.1.33",
   "_comment": "Synced from immutable graph-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.32/mixdog-graph-darwin-arm64",
-      "sha256": "e4efda42c8fac65f4ba7da894ad0679cbb541069470633ccf5e9752c9fac680e"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-darwin-arm64",
+      "sha256": "8637d61493eddca3eee80620a64e737f12eead44ea899ad19a18966a3843ff3a"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.32/mixdog-graph-darwin-x64",
-      "sha256": "9b6cc73185a0b3a59a1279727fc92b8674fc0f7b7519b28a5e75f26926802de8"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-darwin-x64",
+      "sha256": "49ce311687c3df7e7080ecb7694219c9b51bbbb272864aa43d2102a8baa83550"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.32/mixdog-graph-linux-arm64",
-      "sha256": "373522940be2e261bf7f4de3ad226d1e68d73ef1efe95307525b2f867322e722"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-linux-arm64",
+      "sha256": "2e2a4ea6dccc5b33f583040b0ee6e8d47f93a1e879eb17343acd0b2f9838696f"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.32/mixdog-graph-linux-x64",
-      "sha256": "ae8dce99b93c31f5e9f5c5f510dafdc035896fb7faf1e04b5fb603e182a21525"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-linux-x64",
+      "sha256": "2cd1caa7f39e183d6fb6f7764f49e9a0643863d137c2bfb5f40bb7ac616c8d73"
     },
     "win32-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.32/mixdog-graph-win32-arm64.exe",
-      "sha256": "077012187e7a48c6cea8b7e5cdcfd567e518239078a247a6062c32562a76658c"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-win32-arm64.exe",
+      "sha256": "592dfa7e95e1e91424c7467e74f35d09758de502be403b7d229444b435600392"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.32/mixdog-graph-win32-x64.exe",
-      "sha256": "9a449f632ea6f5c6f08feb158a6bbf7f829a3d7731e36821d1dbc042ab69bf48"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-win32-x64.exe",
+      "sha256": "0ed17859a39f0160421865f3a3486ce53957b836ee164d606434519b85b90830"
     }
   }
 }

package/src/runtime/agent/orchestrator/tools/lib/owned-shell-trees.mjs

@@ -27,14 +27,14 @@ export function unregisterOwnedShellTree(jobId, entry) {
   if (ownedTrees.get(key) === entry) ownedTrees.delete(key);
 }
 
-/** Cancel every shell tree of one owner session. Synchronous (the native
- *  cancel's own result) when every snapshot is already complete; otherwise a
- *  promise that sends the cancel once the snapshots land or the bound passes. */
-export function cancelOwnedShellTrees(ownerSessionId) {
-  const owner = String(ownerSessionId || '').trim();
+/** Prepare the kill of every registered tree — of one owner, or of all when
+ *  `ownerSessionId` is null (runtime shutdown) — and unregister them. Returns
+ *  the snapshots still pending (empty when all were complete). */
+export function prepareOwnedShellTreeKills(ownerSessionId = null) {
+  const owner = ownerSessionId == null ? null : String(ownerSessionId).trim();
   const pending = [];
   for (const [jobId, entry] of [...ownedTrees]) {
-    if (String(entry.ownerSessionId || '') !== owner) continue;
+    if (owner !== null && String(entry.ownerSessionId || '') !== owner) continue;
     let ready;
     try {
       ready = entry.prepareKill();
@@ -44,6 +44,15 @@ export function cancelOwnedShellTrees(ownerSessionId) {
     if (ready !== true) pending.push(Promise.resolve(ready).catch(() => false));
     unregisterOwnedShellTree(jobId, entry);
   }
+  return pending;
+}
+
+/** Cancel every shell tree of one owner session. Synchronous (the native
+ *  cancel's own result) when every snapshot is already complete; otherwise a
+ *  promise that sends the cancel once the snapshots land or the bound passes. */
+export function cancelOwnedShellTrees(ownerSessionId) {
+  const owner = String(ownerSessionId || '').trim();
+  const pending = prepareOwnedShellTreeKills(owner);
   if (pending.length === 0) return cancelNativeTasks({ ownerSessionId: owner });
   let result = null;
   const send = () => {

package/src/runtime/agent/orchestrator/tools/lib/shell-descendants.mjs

@@ -32,6 +32,9 @@ export const TERMINATION_RECHECK_MS = 5_000;
 // read is not abandoned — a snapshot that lands later is still absorbed.
 export const PROCESS_TABLE_READ_BOUND_MS = 2_000;
 
+// Kill-and-observe rounds of a survivor kill before it reports what is left.
+const KILL_ROUNDS = 3;
+
 /** Resolve `promise`'s value, or `onTimeout` once `ms` elapse first. The
  *  bound's timer is cleared whichever side wins. */
 export function withinBound(promise, ms, onTimeout) {
@@ -169,24 +172,53 @@ export function createProcessTreeTracker({ pid, members = [], exitObserved = fal
   };
 }
 
+/** Terminate every identity the last observation found alive (console hosts
+ *  excepted: they are witnesses, never workers). These are processes of a tree
+ *  that was KILLED — they escaped its process group (setsid, job control, a
+ *  double fork that kept its parent link) or outlived the root on Windows —
+ *  so the kill is not finished while they run. Windows: taskkill /T /F;
+ *  POSIX: SIGTERM, then SIGKILL after a short grace. */
+function sweepLiveIdentities(tracker) {
+  const targets = tracker.live
+    .filter((entry) => entry.token != null && !CONSOLE_HOST.test(entry.name))
+    .map((entry) => entry.pid);
+  return targets.length > 0 ? killProcessTrees(targets) : Promise.resolve();
+}
+
 /** One observation loop: observe now, then every `intervalMs` until the tree
  *  is confirmed gone, then run `onTerminated` once. 'running', 'unknown', a
  *  failed or unanswered (by the next cadence tick) observation and a failing
  *  `onTerminated` all re-check on the same cadence; the first pass that is not
  *  'gone' calls `onUnconfirmed` once. The returned stop() clears the pending
  *  timer; nothing else (listener, timer) outlives the loop. Nothing in it ever
- *  releases on time alone. */
+ *  releases on time alone.
+ *
+ *  `sweep` (a killed tree): a pass that finds captured identities alive
+ *  terminates them and observes again in the same pass, so a cancellation
+ *  ends with the tree gone instead of a held folder over live processes.
+ *
+ *  `ownerClosed`: once the owning session has closed and the root has
+ *  exited, a tree without a complete pre-kill snapshot is observed after
+ *  exit (what is still linked to the root) instead of answering 'unknown'
+ *  forever — no one is left to release it, and the close must end in a
+ *  definitive state. `onSurvivors(pids)` reports the pids a pass that is
+ *  not 'gone' found alive, whenever that set changes, so out-of-process
+ *  readers can tell a live hold from a stale one. */
 export function watchTermination({
   tracker,
   rootExited = () => true,
   onTerminated,
   onUnconfirmed = null,
+  onSurvivors = null,
+  ownerClosed = null,
   releaseRequested = null,
   intervalMs = TERMINATION_RECHECK_MS,
+  sweep = false,
 }) {
   let timer = null;
   let stopped = false;
   let reportedUnconfirmed = false;
+  let survivorKey = null;
   const stop = () => {
     stopped = true;
     if (timer) clearTimeout(timer);
@@ -202,10 +234,22 @@ export function watchTermination({
     if (releaseRequested?.()) state = 'gone';
     else
       try {
+        if (!tracker.complete && rootExited() && ownerClosed?.()) tracker.acceptExitObservation();
         observation = tracker.observe({ rootExited: rootExited() });
         observation.catch(() => {});
         // A pass that has not answered by the next cadence tick is unknown.
         state = await withinBound(observation, intervalMs, 'unknown');
+        if (state === 'running' && sweep && !stopped) {
+          await withinBound(
+            sweepLiveIdentities(tracker).catch(() => {}),
+            intervalMs,
+            null
+          );
+          await observation.catch(() => {});
+          observation = tracker.observe({ rootExited: rootExited() });
+          observation.catch(() => {});
+          state = await withinBound(observation, intervalMs, 'unknown');
+        }
       } catch {
         state = 'unknown';
       }
@@ -218,6 +262,18 @@ export function watchTermination({
         /* presentation only */
       }
     }
+    if (state !== 'gone' && onSurvivors) {
+      const pids = tracker.live.map((entry) => entry.pid);
+      const key = pids.join(',');
+      if (key !== survivorKey) {
+        survivorKey = key;
+        try {
+          onSurvivors(pids);
+        } catch {
+          /* presentation only */
+        }
+      }
+    }
     if (state === 'gone') {
       try {
         await onTerminated();
@@ -365,7 +421,13 @@ export async function killShellDescendants(handle) {
       .map((entry) => entry.pid);
     await killProcessTrees(targets).catch(() => {});
     const tracker = trackerFor(handle);
-    const state = await tracker.observe({ rootExited: true });
+    let state = await tracker.observe({ rootExited: true });
+    // What the first kill missed (a child forked meanwhile, a slow exit) is
+    // found by the re-observation itself and killed in the next round.
+    for (let round = 1; state === 'running' && round < KILL_ROUNDS; round += 1) {
+      await sweepLiveIdentities(tracker).catch(() => {});
+      state = await tracker.observe({ rootExited: true });
+    }
     return { terminated: state === 'gone', survivors: tracker.live.map((entry) => entry.pid) };
   } catch {
     return { terminated: false, survivors: [...handle.watchPids] };

package/src/runtime/agent/orchestrator/tools/lib/shell-run-background/promote-job.mjs

@@ -60,6 +60,14 @@ export async function promoteWithRetry(
  */
 export function killAfterFailedPromotion(run, reason, promotionFailure) {
   run.autoBackgrounded = false;
+  // The command finished while it was being promoted (the spawn server
+  // releases a foreground task's record at its exit, so the promotion found
+  // none): report that completion. Killing the exited root would have no
+  // pre-kill snapshot and hold the workspace as unconfirmed for good.
+  if (run.child.exitCode != null || run.child.signalCode != null) {
+    if (run.promotionClose) void run.settle(...run.promotionClose);
+    return;
+  }
   if (reason === 'timeout') {
     run.timedOut = true;
     treeKillForceSettle(run, 'timeout');
@@ -75,8 +83,8 @@ export function killAfterFailedPromotion(run, reason, promotionFailure) {
 }
 
 /**
- * The promoted job leaves foreground admission: its lease is RELEASED, which
- * also restores the parent's high-load share. A long-lived server must never
+ * The promoted job leaves foreground admission: its lease is RELEASED. A
+ * long-lived server must never
  * hold a foreground slot for its whole life; background jobs are not counted
  * against any cap (session/runtime close stops them via shutdownShellJobs).
  */

package/src/runtime/agent/orchestrator/tools/lib/shell-run-background/promotion-results.mjs

@@ -13,7 +13,18 @@ import {
 } from '../shell-run-state.mjs';
 
 const BACKGROUND_GUIDANCE =
-  'Completion arrives automatically; call task wait (not task read polling) when the result is due.';
+  'Its result is delivered automatically when it finishes; use task wait only if you need it now.';
+
+function backgroundVerb(reason, secs) {
+  if (reason === 'timeout') return `moved to background at timeout after ${secs}s`;
+  if (reason === 'input') return `moved to background on new user input after ${secs}s`;
+  if (reason === 'notification') {
+    return `moved to background after ${secs}s because a notification arrived (delivered to you now)`;
+  }
+  if (reason === 'interrupt') return `moved to background on interrupt after ${secs}s`;
+  if (reason === 'background') return 'started in the background';
+  return `moved to background after the ${secs}s hold`;
+}
 
 export function promotedSpillPaths(taskOutput) {
   return {
@@ -89,8 +100,7 @@ export function resolveBackgrounded(run, { jobId, reason, remainingBackgroundTim
   // frame alive and could later kill an unrelated, already-returned job.
   detachAbortHandler(run);
   const secs = Math.max(0, Math.round(elapsedSinceStart(run) / 1000));
-  const verb =
-    reason === 'timeout' ? `moved to background at timeout after ${secs}s` : `auto-backgrounded after ${secs}s`;
+  const verb = backgroundVerb(reason, secs);
   run.resolveResult(
     new ExecResult({
       ...capturedFields(run, capture),

package/src/runtime/agent/orchestrator/tools/lib/shell-run-settle.mjs

@@ -8,6 +8,8 @@ import { unregisterOwnedShellTree } from './owned-shell-trees.mjs';
 import {
   adoptShellWorkspaceAdmission,
   clearTerminationHold,
+  isShellOwnerSessionClosed,
+  noteShellJobSurvivors,
   registerTerminationHold,
   takeReleaseRequest,
 } from '../builtin/lib/shell-job-records.mjs';
@@ -56,8 +58,12 @@ export function releaseAdmissionOnConfirmedTermination(run, { markNow = true } =
   run.stopTerminationWatch = watchTermination({
     tracker: run.terminationTracker,
     rootExited: () => child.exitCode != null || child.signalCode != null,
+    // A killed run is not over while processes it started still run.
+    sweep: run.killed === true,
     onTerminated: release,
     onUnconfirmed: markNow ? null : () => keepTerminationUnconfirmedRecord(run),
+    onSurvivors: (pids) => void noteShellJobSurvivors(run.foregroundRecordId, pids),
+    ownerClosed: () => isShellOwnerSessionClosed(run.foregroundRecordInput?.ownerSessionId),
     releaseRequested: () => takeReleaseRequest(run.foregroundRecordId),
   });
 }
@@ -162,6 +168,8 @@ export function createSettle(run, releasePromotedCapture) {
     if (run.settled) return;
     if (run.ownedTree) unregisterOwnedShellTree(run.foregroundRecordId, run.ownedTree);
     if (run.autoBackgrounded) {
+      // A failed promotion settles the run with this close instead.
+      run.promotionClose = [exitCode, signal];
       releasePromotedCapture();
       return;
     }

package/src/runtime/agent/orchestrator/tools/lib/shell-run-state.mjs

@@ -30,7 +30,9 @@ export function registerForegroundOwnedTree(run, ownerSessionId) {
       run.killed = true;
       run.ownerCancelled = true;
       run.killCause = run.killCause || 'session-close';
-      return run.terminationTracker?.complete === true || capturePreKill(run);
+      // Always a fresh read: an earlier one predates what the run started
+      // since. Pending, the kill is sent at the snapshot bound regardless.
+      return capturePreKill(run);
     },
   };
   registerOwnedShellTree(run.foregroundRecordId, run.ownedTree);
@@ -102,6 +104,9 @@ export function createShellRun({ abortSignal, resolve, jobId = null }) {
     // `settled`: whichever transition wins first wins for good.
     autoBackgrounded: false,
     autoBackgroundJobId: null,
+    // [exitCode, signal] of a 'close' that arrived while promotion was in
+    // flight; a promotion that then fails settles the run with it.
+    promotionClose: null,
     autoBgTimer: null,
     killUnconfirmed: false,
     child: null,

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -829,7 +829,7 @@ function unifiedUpdateHunks(sourceLines, section, displayPath, { fuzzy, rejectPa
     const loc = resolveV4AHunkPosition(sourceLines, hunk, nextSearchLine, { fuzzy });
     if (loc.skip) continue;
     if (loc.error) {
-      const msg = `${loc.error.replace(/^V4A hunk /, `V4A hunk ${section.path}: `)}`;
+      const msg = `${loc.error.replace(/^V4A hunk /, () => `V4A hunk ${section.path}: `)}`;
       if (rejectPartial) throw new Error(msg);
       if (rejectedHunks) rejectedHunks.push({ file: section.path, hunk, reason: msg });
       continue;

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -288,6 +288,7 @@ async function settleQueuedPromotion(jobId) {
 function queueSaturatedAsTask(run, saturation, spec) {
   const queuedAbort = new AbortController();
   const taskId = run.foregroundRecordId;
+  let promotedJobId = null;
   let task;
   try {
     task = startBackgroundTask({
@@ -301,10 +302,15 @@ function queueSaturatedAsTask(run, saturation, spec) {
       input: { command: spec.command, cwd: spec.cwd },
       meta: { task_id: taskId, stdout: null, stderr: null, cwd: spec.cwd, timeoutMs: spec.backgroundDeadlineMs || 0 },
       resultType: 'shell_task_result',
+      // While the command runs in the foreground, its abort handler snapshots
+      // the tree before it kills. A native kill sent here as well would end
+      // the root first: the snapshot then misses the tree and the workspace
+      // stays held as unconfirmed forever. Only a promoted job is killed here.
       cancel: () => {
         queuedAbort.abort();
+        if (!promotedJobId) return;
         try {
-          killShellJob(taskId);
+          killShellJob(promotedJobId);
         } catch {}
       },
       run: async () => {
@@ -313,11 +319,23 @@ function queueSaturatedAsTask(run, saturation, spec) {
           jobId: taskId,
           abortSignal: queuedAbort.signal,
           admissionWaitMs: 0,
-          // The call already returned: nobody renders live progress.
+          // The call already returned: nobody renders live progress, and no
+          // hold remains for user input to end.
+          wakeSignal: null,
           onProgress: null,
           onOutputTail: null,
         });
-        if (result.backgrounded && result.jobId) return settleQueuedPromotion(result.jobId);
+        if (result.backgrounded && result.jobId) {
+          promotedJobId = result.jobId;
+          // Promotion detached the abort handler: a cancel that landed during
+          // the handoff reaches the promoted job here.
+          if (queuedAbort.signal.aborted) {
+            try {
+              killShellJob(promotedJobId);
+            } catch {}
+          }
+          return settleQueuedPromotion(promotedJobId);
+        }
         const output = [result.stdout, result.stderr].filter(Boolean).join('\n');
         if (result.exitCode !== 0) {
           throw new Error(`exit code ${result.exitCode ?? result.signal ?? 'unknown'}${output ? `\n${output}` : ''}`);
@@ -465,7 +483,27 @@ const promotable = (run, backgroundOnTimeout) =>
   run.child?.exitCode == null &&
   run.child?.signalCode == null;
 
-function armDeadlines(run, { timeoutMs, autoBackgroundMs, backgroundOnTimeout, abortSignal }, fireAutoBackground) {
+// New user input or a queued task notification during the hold moves a
+// still-running command to the background at once (never a kill): the call
+// returns to the agent loop, which delivers it at the next boundary.
+function armInputWake(run, wakeSignal, fireAutoBackground) {
+  if (!wakeSignal) return;
+  const onWake = () => {
+    const reason = wakeSignal.reason === 'notification' ? 'notification' : 'input';
+    if (promotable(run, true)) fireAutoBackground({ reason });
+  };
+  if (wakeSignal.aborted) {
+    onWake();
+    return;
+  }
+  wakeSignal.addEventListener('abort', onWake, { once: true });
+}
+
+function armDeadlines(
+  run,
+  { timeoutMs, autoBackgroundMs, autoBackgroundReason, backgroundOnTimeout, abortSignal },
+  fireAutoBackground
+) {
   if (timeoutMs > 0) {
     run.timer = setTimeout(() => {
       // Promote-on-timeout: if the caller allows backgrounding and the child
@@ -490,7 +528,7 @@ function armDeadlines(run, { timeoutMs, autoBackgroundMs, backgroundOnTimeout, a
     (timeoutMs <= 0 || autoBackgroundMs < timeoutMs)
   ) {
     run.autoBgTimer = setTimeout(() => {
-      fireAutoBackground();
+      fireAutoBackground({ reason: autoBackgroundReason || 'threshold' });
     }, autoBackgroundMs);
     if (run.autoBgTimer.unref) run.autoBgTimer.unref();
   }
@@ -525,7 +563,11 @@ export function execShellCommand(options) {
     cwd,
     timeoutMs,
     abortSignal,
+    // Aborted when new user input should end the hold (task-wait-control).
+    wakeSignal = null,
     autoBackgroundMs,
+    // 'background' for an explicit background start; the hold otherwise.
+    autoBackgroundReason = 'threshold',
     onProgress,
     onOutputTail,
     clientHostPid,
@@ -547,60 +589,67 @@ export function execShellCommand(options) {
     // The user approved this call's elevation 'ask' decision (runtime-set).
     elevationApproved = false,
   } = options;
-  return new Promise(async (resolve) => {
+  return new Promise((resolve) => {
     const run = createShellRun({ abortSignal, resolve, jobId });
-    // An async executor's throw is NOT routed to this Promise — it becomes an
-    // unhandled rejection of the executor's own promise while the awaiting
-    // caller hangs forever. Every path below therefore has to settle the run
-    // itself, including the unexpected one.
-    try {
-      const spawned = await admitAndSpawn(
-        run,
-        {
-          admission,
-          shell,
-          shellArg,
-          shellArgs,
+    // A throw inside this async body is NOT routed to the Promise — it becomes
+    // an unhandled rejection while the awaiting caller hangs forever. Every
+    // path below therefore has to settle the run itself, including the
+    // unexpected one.
+    void (async () => {
+      try {
+        const spawned = await admitAndSpawn(
+          run,
+          {
+            admission,
+            shell,
+            shellArg,
+            shellArgs,
+            command,
+            env,
+            cwd,
+            abortSignal,
+            directArgv,
+            execScript,
+            elevationApproved,
+            ownerSessionId,
+            clientHostPid,
+          },
+          {
+            admissionWaitMs,
+            onSaturated: (err) => backgroundOnTimeout && queueSaturatedAsTask(run, err, options),
+          }
+        );
+        if (!spawned) return;
+
+        // Pre-aborted signal: kill immediately if the abort already fired
+        // before spawn returned (synchronous reentry from a parent abort), so
+        // the child doesn't run for the full timeoutMs window.
+        if (abortSignal?.aborted) {
+          treeKillForceSettle(run, 'cancellation');
+        }
+        attachOutputCapture(run);
+        const releasePromotedCapture = createPromotedCaptureRelease(run);
+        run.settle = createSettle(run, releasePromotedCapture);
+        attachChildExit(run, releasePromotedCapture);
+        const fireAutoBackground = createAutoBackground({
+          run,
           command,
-          env,
           cwd,
-          abortSignal,
-          directArgv,
-          execScript,
-          elevationApproved,
-          ownerSessionId,
           clientHostPid,
-        },
-        {
-          admissionWaitMs,
-          onSaturated: (err) => backgroundOnTimeout && queueSaturatedAsTask(run, err, options),
-        }
-      );
-      if (!spawned) return;
-
-      // Pre-aborted signal: kill immediately if the abort already fired
-      // before spawn returned (synchronous reentry from a parent abort), so
-      // the child doesn't run for the full timeoutMs window.
-      if (abortSignal?.aborted) {
-        treeKillForceSettle(run, 'cancellation');
+          ownerSessionId,
+          promotedTimeoutMs,
+          backgroundDeadlineMs,
+        });
+        armDeadlines(
+          run,
+          { timeoutMs, autoBackgroundMs, autoBackgroundReason, backgroundOnTimeout, abortSignal },
+          fireAutoBackground
+        );
+        armInputWake(run, wakeSignal, fireAutoBackground);
+        armProgressTimers(run, { onProgress, onOutputTail });
+      } catch (err) {
+        settleSetupFailure(run, err);
       }
-      attachOutputCapture(run);
-      const releasePromotedCapture = createPromotedCaptureRelease(run);
-      run.settle = createSettle(run, releasePromotedCapture);
-      attachChildExit(run, releasePromotedCapture);
-      const fireAutoBackground = createAutoBackground({
-        run,
-        command,
-        cwd,
-        clientHostPid,
-        ownerSessionId,
-        promotedTimeoutMs,
-        backgroundDeadlineMs,
-      });
-      armDeadlines(run, { timeoutMs, autoBackgroundMs, backgroundOnTimeout, abortSignal }, fireAutoBackground);
-      armProgressTimers(run, { onProgress, onOutputTail });
-    } catch (err) {
-      settleSetupFailure(run, err);
-    }
+    })();
   });
 }

package/src/runtime/agent/orchestrator/tools/shell-policy.mjs

@@ -273,6 +273,8 @@ export function isBlockedCommand(command) {
   return decoded !== null && _blockedText(decoded);
 }
 
+const WMIC_PROCESS_COMMAND_RE = /^\s*(?:&\s*)?(?:cmd(?:\.exe)?\s+\/c\s+["']?)?(?:\S*[\\/])?wmic(?:\.exe)?\s+process\b/i;
+
 const WMIC_PROCESS_DEFAULT_FIELDS = Object.freeze([
   'ProcessId',
   'Name',
@@ -336,8 +338,11 @@ export function maybeRewriteWmicProcessCommand(command) {
   // silently drop surrounding `cd`, pipes, `&&`/`;` segments. For composite
   // commands containing wmic, return null so the caller falls back to other
   // policy handling instead of dropping context.
-  if (/[|&;]|\$\(|`/.test(text) && /\bwmic(?:\.exe)?\s+process\b/i.test(text)) return null;
-  if (!/\bwmic(?:\.exe)?\s+process\b/i.test(text)) return null;
+  // Only a command that IS a wmic call is rewritten. The words `wmic process`
+  // inside a search pattern, a commit message or a file being written are text:
+  // replacing that whole command would discard it.
+  if (!WMIC_PROCESS_COMMAND_RE.test(text)) return null;
+  if (/[|&;]|\$\(|`/.test(text)) return null;
   if (!/\bget\b/i.test(text)) {
     return {
       error: