mixdog 1.3.5 → 1.4.1

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -83,6 +83,9 @@ const SERVER_OPERATIONS = new Set(['daemon', 'instaweb']);
 // probe into `git rev-parse exited 128` inside a plain directory.
 const REPO_FREE_OPERATIONS = new Set(['version', 'help']);
 
+const GIT_DESCRIPTION_HEAD =
+  'Run Git here, never through shell. An array runs in order and stops on failure; batch read-only commands in one. diff for known changes, status to discover them; history only when needed. git diff or git diff -- <paths> includes untracked files. Set include_stage_ids:true to select changes, then action:stage with diff_id/change_ids. Staging rejects stale or cross-Project diffs and returns per-file staged counts.';
+
 export const GIT_TOOL_DEF = {
   name: 'git',
   title: 'Git',
@@ -94,8 +97,7 @@ export const GIT_TOOL_DEF = {
     openWorldHint: true,
     compressible: true,
   },
-  description:
-    'Run Git here, never through shell. An array (max 10) runs in order and stops on failure; batch read-only commands in one. diff for known changes, status to discover them; history only when needed. git diff or git diff -- <paths> includes untracked files. Set include_stage_ids:true to select changes, then action:stage with diff_id/change_ids. Staging rejects stale or cross-Project diffs and returns per-file staged counts. Worktrees are managed only: action:worktree (Lead only) moves a session into/out of its managed worktree, merges, removes, lists, prunes; git worktree add/remove/list/prune map to managed operations (add -b keeps the session in place; add --detach makes a read-only snapshot worktree, removed when its turn ends; list --porcelain stays raw git; move/lock/unlock/repair are refused). Merge or remove only when the user asks; carry and large-size answers come from the user; force only on explicit request.',
+  description: `${GIT_DESCRIPTION_HEAD} Worktrees are managed only: action:worktree; git worktree add/remove/list/prune map to managed operations (add -b keeps the session in place; add --detach makes a read-only snapshot worktree, removed when its turn ends; list --porcelain stays raw git; move/lock/unlock/repair are refused). Merge or remove only when the user asks.`,
   inputSchema: {
     type: 'object',
     properties: {
@@ -118,14 +120,14 @@ export const GIT_TOOL_DEF = {
         minimum: 1,
         maximum: GIT_OUTPUT_LIMIT_MAX,
         description:
-          'Body line cap, max 1000; staging IDs are not capped. Default 500; git log defaults to 100. A cut ends with [output capped …] naming how to continue.',
+          'Body line cap; staging IDs are not capped. Default 500; git log defaults to 100. A cut ends with [output capped …] naming how to continue.',
       },
       include_stage_ids: {
         type: 'boolean',
         description:
           'Include staging IDs outside the body cap for git diff or git diff -- <paths> only. Default false.',
       },
-      diff_id: { type: 'string', description: 'stage: exact diff_id from git diff with include_stage_ids:true.' },
+      diff_id: { type: 'string', description: 'stage: exact diff_id from git diff.' },
       change_ids: {
         anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1, maxItems: 50 }],
         description: 'stage: exact change ID or IDs to stage, including new files.',
@@ -158,6 +160,29 @@ export const GIT_TOOL_DEF = {
   },
 };
 
+// Only the Lead host runs enter/return/merge/remove/prune (git-worktree-tool.mjs
+// leadHost); an agent keeps `list`, so its schema omits every field the other
+// operations take.
+const LEAD_ONLY_WORKTREE_FIELDS = ['session_id', 'name', 'branch', 'create', 'carry', 'confirm_large', 'force'];
+
+function buildGitAgentToolDef(base) {
+  const properties = { ...base.inputSchema.properties };
+  for (const field of LEAD_ONLY_WORKTREE_FIELDS) delete properties[field];
+  properties.action = {
+    ...properties.action,
+    description: 'Default command. stage uses diff_id/change_ids instead of command. worktree uses worktree_action.',
+  };
+  properties.worktree_action = { type: 'string', enum: ['list'], description: 'list only.' };
+  return {
+    ...base,
+    description: `${GIT_DESCRIPTION_HEAD} Worktrees are Lead-managed: only worktree_action:list and git worktree list work; every other worktree operation is refused.`,
+    inputSchema: { ...base.inputSchema, properties },
+  };
+}
+
+/** The git tool as a delegated agent sees it (see bindAgentOwner). */
+export const GIT_AGENT_TOOL_DEF = buildGitAgentToolDef(GIT_TOOL_DEF);
+
 function cleanText(value) {
   return String(value || '')
     .replace(/\r\n/g, '\n')
@@ -849,7 +874,8 @@ function snapshotContaining(repo) {
   }
   return (
     Object.values(entries).find(
-      (record) => record?.kind === WORKTREE_SNAPSHOT_KIND && typeof record.path === 'string' && isWithin(record.path, repo)
+      (record) =>
+        record?.kind === WORKTREE_SNAPSHOT_KIND && typeof record.path === 'string' && isWithin(record.path, repo)
     ) ?? null
   );
 }

package/src/runtime/agent/orchestrator/tools/builtin/git-worktree-tool.mjs

@@ -101,6 +101,8 @@ function worktreeFailureText(code, message, details) {
       return typeof details.path === 'string' && details.path
         ? `This branch is already checked out in ${details.path}.`
         : 'This branch is already checked out in another worktree.';
+    case 'WORKTREE_DEFAULT_BRANCH':
+      return "The repository's default branch can't be opened in a worktree: the project folder could not switch to it while the worktree exists. Check it out in the project folder, or create a new branch for the worktree.";
     case 'WORKTREE_REMOVAL_INCOMPLETE':
       return 'The worktree could not be removed completely because a file is still in use. Close it and remove the worktree again.';
     case 'WORKTREE_PATH_UNSAFE':
@@ -162,6 +164,8 @@ function nextStep(code, details, { raw }) {
       return 'The workspace changed meanwhile; call again (the workspace is read afresh).';
     case 'WORKTREE_BUSY_JOBS':
       return 'Nothing was changed; try again once the session and its workers are idle.';
+    case 'WORKTREE_DEFAULT_BRANCH':
+      return 'Nothing was created. Work on a new branch instead (worktree_action:"enter" with branch and create:true), or ask the user to check the default branch out in the project folder.';
     case 'MERGE_CONFLICT':
       return 'Nothing was merged or forced. Resolve the conflict in the worktree (merge the target branch into it there), or ask the user.';
     case 'WORKTREE_DIRTY':
@@ -316,7 +320,8 @@ async function rawAdd(plan, input, options) {
       throw new Error(`git worktree add: ${value} is not supported for managed worktrees`);
     }
     if (ADD_BARE_FLAGS.has(value)) continue;
-    if (value.startsWith('-')) throw new Error(`git worktree add: option ${value} is not supported for managed worktrees`);
+    if (value.startsWith('-'))
+      throw new Error(`git worktree add: option ${value} is not supported for managed worktrees`);
     positional.push(value);
   }
   const [path, commitish = null] = positional;
@@ -436,8 +441,9 @@ async function rawPrune(plan, options) {
 const WORKTREE_HELP = Object.freeze({
   add: 'git worktree add [-b <branch>] [--detach] <path> [<commit-ish>]: a managed worktree for the branch (the session stays put), or a read-only snapshot for a detached commit.',
   remove: 'git worktree remove [-f] <path>: the managed removal of that worktree.',
-  list: 'git worktree list [-v]: managed worktrees plus the repository\'s other worktrees. --porcelain stays raw git.',
-  prune: 'git worktree prune [-n|--dry-run] [-v]: the managed prune of this repository (clean, merged worktrees no session retains); -n only lists what it would remove.',
+  list: "git worktree list [-v]: managed worktrees plus the repository's other worktrees. --porcelain stays raw git.",
+  prune:
+    'git worktree prune [-n|--dry-run] [-v]: the managed prune of this repository (clean, merged worktrees no session retains); -n only lists what it would remove.',
 });
 
 /** -h/--help before any `--` (the help answers instead of the operation running). */
@@ -450,7 +456,9 @@ function wantsHelp(args) {
 function checkListArgs(args) {
   for (const value of args) {
     if (value === '-v' || value === '--verbose') continue;
-    throw new Error(`git worktree list: ${value.startsWith('-') ? `option ${value} is not supported` : `unexpected argument ${value}`}`);
+    throw new Error(
+      `git worktree list: ${value.startsWith('-') ? `option ${value} is not supported` : `unexpected argument ${value}`}`
+    );
   }
 }
 
@@ -466,7 +474,8 @@ export async function executeRawWorktree(plan, input, options = {}) {
   if (sub === 'list' && plan.args.includes('--porcelain')) return null;
   try {
     if (sub === 'list') checkListArgs(plan.args.slice(1));
-    if (sub === 'list') return { text: okJson({ mapped: plan.command, ...(await listRows(options, plan.cwd)) }), failed: false };
+    if (sub === 'list')
+      return { text: okJson({ mapped: plan.command, ...(await listRows(options, plan.cwd)) }), failed: false };
     if (sub === 'add') return { text: await rawAdd(plan, input, options), failed: false };
     if (sub === 'remove') return { text: await rawRemove(plan, options), failed: false };
     if (sub === 'prune') return { text: await rawPrune(plan, options), failed: false };
@@ -479,7 +488,9 @@ export async function executeRawWorktree(plan, input, options = {}) {
       };
     }
     return {
-      text: fail(`git worktree ${sub || '(no subcommand)'} is not supported; use add, remove, list, prune or action:"worktree"`),
+      text: fail(
+        `git worktree ${sub || '(no subcommand)'} is not supported; use add, remove, list, prune or action:"worktree"`
+      ),
       failed: true,
     };
   } catch (error) {
@@ -529,7 +540,8 @@ export async function executeWorktreeAction(input, workDir, options = {}) {
   if (problem) return fail(problem);
   const action = input.worktree_action;
   try {
-    if (action === 'list') return okJson({ worktree_action: action, ...(await listRows(options, resolve(workDir || process.cwd()))) });
+    if (action === 'list')
+      return okJson({ worktree_action: action, ...(await listRows(options, resolve(workDir || process.cwd()))) });
     const host = leadHost(options, `git worktree_action ${action}`);
     const sessionId = input.session_id?.trim() || null;
     const request = {
@@ -545,7 +557,9 @@ export async function executeWorktreeAction(input, workDir, options = {}) {
           }
         : {}),
       ...(action === 'remove' ? { force: input.force === true } : {}),
-      ...(action === 'prune' ? { repoCommonDir: (await repositoryAt(resolve(workDir || process.cwd())))?.repoCommonDir ?? null } : {}),
+      ...(action === 'prune'
+        ? { repoCommonDir: (await repositoryAt(resolve(workDir || process.cwd())))?.repoCommonDir ?? null }
+        : {}),
       txId: txIdOf(options, action),
     };
     const result = await runOn(host, request, options);

package/src/runtime/agent/orchestrator/tools/builtin/lib/scoped-search-flight.mjs

@@ -8,11 +8,15 @@ import {
 // A shared scan's outcome belongs to every subscriber, not only the caller
 // whose computation won admission. Persisted cache hits contain safe text.
 export async function runScopedSearchInFlight(key, compute, options, outcome) {
-  const settled = await runResultCacheInFlight(key, async ({ signal }) => {
-    const scopedCacheOutcome = createScopedCacheOutcome();
-    const result = await compute({ signal, scopedCacheOutcome });
-    return { result, scopedCacheOutcome };
-  }, options);
+  const settled = await runResultCacheInFlight(
+    key,
+    async ({ signal }) => {
+      const scopedCacheOutcome = createScopedCacheOutcome();
+      const result = await compute({ signal, scopedCacheOutcome });
+      return { result, scopedCacheOutcome };
+    },
+    options
+  );
   if (typeof settled === 'string') return settled;
   if (settled.scopedCacheOutcome.complete === false) markScopedCacheIncomplete(outcome);
   if (settled.scopedCacheOutcome.cacheSafe === false) markScopedCacheUnsafe(outcome);

package/src/runtime/agent/orchestrator/tools/builtin/read-single-stream.mjs

@@ -53,7 +53,13 @@ export async function streamRangeResult(ctx, { source, fileHandle, prefixBuffer
       res.firstEmitted && res.lastEmitted ? [{ startLine: res.firstEmitted, endLine: res.lastEmitted }] : [];
     const snapshotMeta = { source, ranges, rangeHashes: _rangeHashesFromRenderedReadText(res.text, ranges) };
     if (!res.readSnapshotStat) return res.text;
-    return await commitStreamResult({ ...ctx, st: res.readSnapshotStat }, res.text, snapshotMeta, res.prefixHash, helpers);
+    return await commitStreamResult(
+      { ...ctx, st: res.readSnapshotStat },
+      res.text,
+      snapshotMeta,
+      res.prefixHash,
+      helpers
+    );
   } catch (err) {
     return `Error: ${normalizeErrorMessage(err instanceof Error ? err.message : String(err))}`;
   }

package/src/runtime/agent/orchestrator/tools/builtin/read-streaming.mjs

@@ -137,9 +137,12 @@ async function readRangeFromHandle(fh, fullPath, offset, limit, stHint, hooks) {
   }
   if (!stop) lines.finishTail();
   let readSnapshotStat = null;
-  if (!(await publishReadRangeIndex(rangeIndex, fh, null, checkDeadline, (version) => {
-    readSnapshotStat = version;
-  }))) checkDeadline();
+  if (
+    !(await publishReadRangeIndex(rangeIndex, fh, null, checkDeadline, (version) => {
+      readSnapshotStat = version;
+    }))
+  )
+    checkDeadline();
 
   ioTraceDone('read_range_stream', traceStart, {
     pathHash: hashText(fullPath).slice(0, 12),

package/src/runtime/agent/orchestrator/tools/builtin/read-tool/batch-dispatch.mjs

@@ -41,7 +41,7 @@ async function estimateTaskBytes(entry, workDir) {
   const st = await stat(resolvePath(workDir || '.', String(entry?.path || ''))).catch(() => null);
   if (!st?.isFile()) return Infinity;
   const lines = Math.max(1, st.size / AVG_LINE_BYTES);
-  let need = st.size + st.size / MIN_LINE_BYTES * LINE_PREFIX_BYTES;
+  let need = st.size + (st.size / MIN_LINE_BYTES) * LINE_PREFIX_BYTES;
   // A coalesced entry reads its whole union window, not only its own slot.
   const limit = Number(readEntryCoalescedDiskWindow(entry)?.limit ?? entry?.limit);
   if (Number.isFinite(limit) && limit > 0) need *= Math.min(1, limit / lines);

package/src/runtime/agent/orchestrator/tools/builtin/read-tool/batch-publication.mjs

@@ -85,10 +85,14 @@ export async function runBatchReadSnapshotPublication(executeChildBuiltinTool, h
       // A numbered row may end halfway through its content at the byte cap.
       // Only this slot's producer can certify complete lines; another read of
       // the same path must not authorize hashing this slot's partial text.
-      return mergeReadRanges(ranges.flatMap((range) => (observation?.ranges ?? []).map((complete) => ({
-        startLine: Math.max(range.startLine, complete.startLine),
-        endLine: Math.min(range.endLine, complete.endLine),
-      }))));
+      return mergeReadRanges(
+        ranges.flatMap((range) =>
+          (observation?.ranges ?? []).map((complete) => ({
+            startLine: Math.max(range.startLine, complete.startLine),
+            endLine: Math.min(range.endLine, complete.endLine),
+          }))
+        )
+      );
     },
     _recordReadSnapshot: (fullPath, _st, scope, meta) => {
       corrections.set(fullPath, { scope: scope ?? null, meta });
@@ -104,22 +108,29 @@ export async function runBatchReadSnapshotPublication(executeChildBuiltinTool, h
     }
     for (const [fullPath, correction] of corrections) {
       const delivered = tasks.filter((task) => task.fullPath === fullPath && hasRenderedLines(task.body));
-      const observations = delivered.map((task) => task.records.findLast(
-        (record) => record.fullPath === fullPath && record.scope === correction.scope
-      ));
+      const observations = delivered.map((task) =>
+        task.records.findLast((record) => record.fullPath === fullPath && record.scope === correction.scope)
+      );
       // Never combine different versions or bless stale/missing observations.
       // The eventual recorder rechecks the retained lease after all awaits.
-      if (observations.length && observations.every((record) =>
-        record?.isCurrent() && sameFileVersion(record.identity, observations[0].identity)
-      )) {
+      if (
+        observations.length &&
+        observations.every(
+          (record) => record?.isCurrent() && sameFileVersion(record.identity, observations[0].identity)
+        )
+      ) {
         observations[0].publish(correction.meta);
       }
     }
     // Rich media/binary results have no line slices. Preserve their original
     // evidence, still under the producer's lease rather than the batch's.
     for (const task of tasks) {
-      if (hasRenderedLines(task.body) || task.body?.isError === true ||
-          (typeof task.body === 'string' && helpers.classifyResultKind(task.body) === 'error')) continue;
+      if (
+        hasRenderedLines(task.body) ||
+        task.body?.isError === true ||
+        (typeof task.body === 'string' && helpers.classifyResultKind(task.body) === 'error')
+      )
+        continue;
       for (const record of task.records) {
         if (!corrections.has(record.fullPath)) record.publish();
       }

package/src/runtime/agent/orchestrator/tools/builtin/read-tool/batch-snapshot.mjs

@@ -69,7 +69,12 @@ async function rawRangeHashes(fullPath, mergedRanges, { _hashText }) {
 
 export async function recordSlicedBatchSnapshots(orderedResults, workDir, readStateScope, helpers) {
   const { _mergeReadRanges, _recordReadSnapshot } = helpers;
-  const { exactRangesByPath, rangeHashesByPath } = deliveredRangesByPath(orderedResults, workDir, readStateScope, helpers);
+  const { exactRangesByPath, rangeHashesByPath } = deliveredRangesByPath(
+    orderedResults,
+    workDir,
+    readStateScope,
+    helpers
+  );
   for (const [fullPath, ranges] of exactRangesByPath) {
     const mergedRanges = _mergeReadRanges(ranges);
     let rangeHashes = rangeHashesByPath.get(fullPath) || [];

package/src/runtime/agent/orchestrator/tools/builtin/read-tool.mjs

@@ -112,14 +112,7 @@ export async function executeReadTool(args, ...rest) {
   return `${out}\n[skipped ${skipped.length} more file(s) over the per-call limit: ${skipped.join(', ')} — read them in another call]`;
 }
 
-async function executeReadToolBody(
-  args,
-  workDir,
-  readStateScope,
-  executeChildBuiltinTool,
-  options = {},
-  helpers = {}
-) {
+async function executeReadToolBody(args, workDir, readStateScope, executeChildBuiltinTool, options = {}, helpers = {}) {
   const { normalizeInputPath, normaliseReadLineWindowArgs } = helpers;
   applyFilePathAlias(args);
   args.path = coerceReadFamilyPathArg(args.path);

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -17,6 +17,10 @@ export function setConfiguredShell(value = '') {
   _resolvedShellByKind.clear();
 }
 
+export function getConfiguredShell() {
+  return _configuredShell || '';
+}
+
 function shellTypeFor(shell) {
   const stem = basename(String(shell || ''))
     .toLowerCase()
@@ -49,7 +53,9 @@ function allExistingPathsFromPath(commandName) {
   let cwd = '';
   try {
     cwd = process.cwd();
-  } catch {}
+  } catch {
+    // the working directory may have been removed; search PATH entries only
+  }
   const entries = [cwd, ...rawPath.split(delimiter)]
     .map((entry) => entry.trim().replace(/^"(.*)"$/, '$1'))
     .filter(Boolean);

package/src/runtime/agent/orchestrator/tools/code-graph/dispatch/federation.mjs

@@ -129,7 +129,9 @@ function federateRoots(name, args, plan, signal, options, execute) {
   }
   const runOne = async (root, nextArgs) =>
     execute(name, nextArgs, root, signal, { ...options, excludedProjectRoots: excludedRootsFor(root, roots) });
-  const work = _runCodeGraphFederation(roots, runOne, projectArgs, options.scopedCacheOutcome).then((sections) => sections.join('\n\n'));
+  const work = _runCodeGraphFederation(roots, runOne, projectArgs, options.scopedCacheOutcome).then((sections) =>
+    sections.join('\n\n')
+  );
   return raceAbort(work, signal);
 }
 

package/src/runtime/agent/orchestrator/tools/code-graph-tool-defs.mjs

@@ -26,7 +26,7 @@ export const CODE_GRAPH_TOOL_DEFS = [
       compressibleLossless: true,
     },
     description:
-      'Code structure and relations from the parsed graph, no text matching. symbols → file outline rows `[export ]kind name (Lstart-end) signature`; find_symbol returns declaration/body; references adds usages (body opt-in); callers/callees return locations; dependents/impact → importers and blast radius. Exact identifiers: find_symbol/references/callers/callees; keywords: symbol_search/search; literal text and regex belong to grep. Prefer it over read/grep for declarations and relations; every row’s location is a read window. symbols already outlines a file: never pair it with overview for one need.',
+      'Code structure and relations from the parsed graph, no text matching. symbols → file outline rows `[export ]kind name (Lstart-end) signature`; find_symbol returns declaration/body; references adds usages; callers/callees return locations; dependents/impact → importers and blast radius. Exact identifiers: find_symbol/references/callers/callees; keywords: symbol_search/search; literal text and regex belong to grep. Prefer it over read/grep for declarations and relations. symbols already outlines a file: never pair it with overview for one need.',
     inputSchema: {
       type: 'object',
       properties: {

package/src/runtime/agent/orchestrator/tools/graph-manifest.json

@@ -1,30 +1,30 @@
 {
-  "version": "0.1.33",
+  "version": "0.1.34",
   "_comment": "Synced from immutable graph-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-darwin-arm64",
-      "sha256": "8637d61493eddca3eee80620a64e737f12eead44ea899ad19a18966a3843ff3a"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-darwin-arm64",
+      "sha256": "5bcf8c79135224d2e77eec70a57debd06d462bab01418ce1a6c1656a858eedad"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-darwin-x64",
-      "sha256": "49ce311687c3df7e7080ecb7694219c9b51bbbb272864aa43d2102a8baa83550"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-darwin-x64",
+      "sha256": "2845ea2afa2802841589bd74c8785670cfe8c6b58b2ad5b258ac928afccbaa94"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-linux-arm64",
-      "sha256": "2e2a4ea6dccc5b33f583040b0ee6e8d47f93a1e879eb17343acd0b2f9838696f"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-linux-arm64",
+      "sha256": "0364bc1c3741683fbdb45ed755f2baabb50a0556e2354c13a05f3d816bc1c461"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-linux-x64",
-      "sha256": "2cd1caa7f39e183d6fb6f7764f49e9a0643863d137c2bfb5f40bb7ac616c8d73"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-linux-x64",
+      "sha256": "4f9091b2c5a89631efade89aae17e5411dda8bfec99e15ff64948906f9fa20d0"
     },
     "win32-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-win32-arm64.exe",
-      "sha256": "592dfa7e95e1e91424c7467e74f35d09758de502be403b7d229444b435600392"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-win32-arm64.exe",
+      "sha256": "03abef6f09b095b86c5cc32c6bead3f5d82f77961220c31221ab0b3f60974110"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.33/mixdog-graph-win32-x64.exe",
-      "sha256": "0ed17859a39f0160421865f3a3486ce53957b836ee164d606434519b85b90830"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.34/mixdog-graph-win32-x64.exe",
+      "sha256": "650cffe82ccbe9898e7ac8fc9b025c92098a810ad3ca95276c0bb8c19a328993"
     }
   }
 }

package/src/runtime/agent/orchestrator/tools/lib/isolated-test-env.mjs

@@ -1,9 +1,10 @@
-import { mkdirSync, mkdtempSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { mkdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { makeTempDirSync } from '../../../../../../scripts/lib/scoped-temp.mjs';
 
 // Import before runtime modules: several paths are captured at module load.
-export const fixtureRoot = mkdtempSync(join(tmpdir(), 'mixdog-shell-fixture-'));
+// Removed when the importing test process exits.
+export const fixtureRoot = makeTempDirSync('shell-fixture');
 for (const name of [
   'HOME',
   'USERPROFILE',

package/src/runtime/agent/orchestrator/tools/lib/shell-warm-standby.mjs

@@ -55,8 +55,13 @@ function _disabled() {
   return process.env.MIXDOG_SHELL_WARM_STANDBY === '0';
 }
 
+// Per-session scratch variables: they differ between sessions by design, so
+// they stay out of the reuse signature and are set in the hand-off prelude.
+const SCRATCH_ENV_KEYS = Object.freeze(['TEMP', 'TMP', 'TMPDIR']);
+
 function envSignature(env) {
   const entries = Object.entries(env || {})
+    .filter(([key]) => !SCRATCH_ENV_KEYS.includes(key))
     .map(([key, value]) => `${key}=${value}`)
     .sort()
     .join('\n');
@@ -67,8 +72,16 @@ function _slotAlive(slot) {
   return Boolean(slot?.native?.child && slot.native.child.exitCode == null && !slot.native.child.killed);
 }
 
-function psQuote(value) {
-  return String(value).replace(/'/g, "''");
+// A PowerShell expression yielding `value` for any text. PowerShell quoting has
+// no safe form for typographic apostrophes and the like, so the value travels
+// as UTF-8 Base64 and is decoded inside the expression.
+function psStringExpr(value) {
+  return `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('${Buffer.from(String(value), 'utf8').toString('base64')}'))`;
+}
+
+/** The parked standby slot, for tests. */
+export function _parkedShellStandbyForTest() {
+  return _slot;
 }
 
 /** Pre-spawn the next standby (fire-and-forget; a live one is kept). */
@@ -164,9 +177,18 @@ export function takeWarmShellStandby({ shell, env }) {
     // cwd prelude: the standby was spawned in the daemon cwd. Set-Location
     // fixes $PWD and native-child working dirs; Environment.CurrentDirectory
     // fixes .NET relative-path APIs.
-    const prelude = workDir
-      ? `Set-Location -LiteralPath '${psQuote(workDir)}'; [System.Environment]::CurrentDirectory = '${psQuote(workDir)}'; `
+    const cwdPrelude = workDir
+      ? `$__mixdogCwd = ${psStringExpr(workDir)}; Set-Location -LiteralPath $__mixdogCwd; [System.Environment]::CurrentDirectory = $__mixdogCwd; `
       : '';
+    // Scratch prelude: the standby was spawned for whichever session parked
+    // it. Set (or clear, when the request has none) the requested values
+    // before the command runs, so no other session's scratch path survives.
+    const scratchPrelude = SCRATCH_ENV_KEYS.map((key) =>
+      typeof env?.[key] === 'string'
+        ? `$env:${key} = ${psStringExpr(env[key])}; `
+        : `Remove-Item -LiteralPath 'Env:${key}' -ErrorAction SilentlyContinue; `
+    ).join('');
+    const prelude = scratchPrelude + cwdPrelude;
     // Single atomic write+EOF: a separate close message can race ahead
     // of the server's async write thread and feed an empty script.
     slot.native.child.writeStdin(prelude + String(commandText ?? ''), { close: true });

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -112,7 +112,9 @@ function _abortableDelay(ms, signal) {
       if (onAbort && signal) {
         try {
           signal.removeEventListener('abort', onAbort);
-        } catch {}
+        } catch {
+          // the abort listener may already be gone
+        }
       }
       resolveDelay();
     }, ms);
@@ -173,7 +175,9 @@ async function acquireShellLeaseBounded(
     } catch {
       try {
         ctl.abort();
-      } catch {}
+      } catch {
+        // the controller may already be aborted
+      }
     }
   };
   if (abortSignal) {
@@ -184,7 +188,9 @@ async function acquireShellLeaseBounded(
   const deadline = setTimeout(() => {
     try {
       ctl.abort(_admissionSaturationError(admission, waitMs, ownerKey));
-    } catch {}
+    } catch {
+      // the controller may already be aborted
+    }
   }, waitMs);
   if (deadline.unref) deadline.unref();
   try {
@@ -212,7 +218,9 @@ async function acquireShellLeaseBounded(
     if (abortSignal) {
       try {
         abortSignal.removeEventListener('abort', onAbort);
-      } catch {}
+      } catch {
+        // the abort listener may already be gone
+      }
     }
   }
 }
@@ -238,7 +246,7 @@ async function admitAndSpawn(run, params, { admissionWaitMs, onSaturated }) {
     run.resourceLease = await acquireShellLeaseBounded(admission, {
       abortSignal,
       waitMs: admissionWaitMs,
-      label: `[task_id: ${run.foregroundRecordId}] ${String(command || '').slice(0, 120)}`,
+      label: `[task_id: ${run.foregroundRecordId}] ${String(params.displayCommand ?? command ?? '').slice(0, 120)}`,
       ownerKey: ownerSessionId,
     });
     const policyErr = await _execPolicyBlockMessage(command, elevationApproved === true);
@@ -295,11 +303,11 @@ function queueSaturatedAsTask(run, saturation, spec) {
       taskId,
       surface: 'shell',
       operation: 'shell',
-      label: String(spec.command || '')
+      label: String(spec.displayCommand ?? spec.command ?? '')
         .replace(/\s+/g, ' ')
         .slice(0, 120),
       context: { callerSessionId: spec.ownerSessionId, clientHostPid: spec.clientHostPid },
-      input: { command: spec.command, cwd: spec.cwd },
+      input: { command: spec.displayCommand ?? spec.command, cwd: spec.cwd },
       meta: { task_id: taskId, stdout: null, stderr: null, cwd: spec.cwd, timeoutMs: spec.backgroundDeadlineMs || 0 },
       resultType: 'shell_task_result',
       // While the command runs in the foreground, its abort handler snapshots
@@ -311,7 +319,9 @@ function queueSaturatedAsTask(run, saturation, spec) {
         if (!promotedJobId) return;
         try {
           killShellJob(promotedJobId);
-        } catch {}
+        } catch {
+          // the job may already have exited
+        }
       },
       run: async () => {
         const result = await execShellCommand({
@@ -332,7 +342,9 @@ function queueSaturatedAsTask(run, saturation, spec) {
           if (queuedAbort.signal.aborted) {
             try {
               killShellJob(promotedJobId);
-            } catch {}
+            } catch {
+              // the promoted job may already have exited
+            }
           }
           return settleQueuedPromotion(promotedJobId);
         }
@@ -375,7 +387,9 @@ function settleSetupFailure(run, err) {
   clearForegroundTimers(run);
   try {
     treeKill(run.child);
-  } catch {}
+  } catch {
+    // the child may already have exited
+  }
   void releaseResourceLease(run);
   run.resolveResult(failedResult(run, String(err?.message || err), 'spawn failed'));
 }
@@ -451,7 +465,9 @@ function armProgressTimers(run, { onProgress, onOutputTail }) {
       const secs = Math.round(elapsedSinceStart(run) / 1000);
       try {
         onProgress(`running ${secs}s`);
-      } catch {}
+      } catch {
+        // the progress sink is advisory
+      }
     }, 2000);
     if (run.progressTimer.unref) run.progressTimer.unref();
   }
@@ -549,7 +565,9 @@ function armDeadlines(
     };
     try {
       abortSignal.addEventListener('abort', run.abortHandler, { once: true });
-    } catch {}
+    } catch {
+      // caller cancellation registration is best-effort
+    }
   }
 }
 
@@ -588,6 +606,10 @@ export function execShellCommand(options) {
     // hands the script to the shell out-of-band — see the POSIX env+eval path in
     // bash-tool.mjs, which keeps the command body out of the child's argv.
     execScript = null,
+    // What the agent passed, when `command` carries execution wrappers (the
+    // PowerShell UTF-8 prefix, the filter-tee rewrite). Job labels and
+    // records show this text; only the spawn runs `command`.
+    displayCommand = null,
     // The user approved this call's elevation 'ask' decision (runtime-set).
     elevationApproved = false,
   } = options;
@@ -612,6 +634,7 @@ export function execShellCommand(options) {
             abortSignal,
             directArgv,
             execScript,
+            displayCommand,
             elevationApproved,
             ownerSessionId,
             clientHostPid,
@@ -635,7 +658,7 @@ export function execShellCommand(options) {
         attachChildExit(run, releasePromotedCapture);
         const fireAutoBackground = createAutoBackground({
           run,
-          command,
+          command: displayCommand ?? command,
           cwd,
           clientHostPid,
           ownerSessionId,