mixdog 1.4.1 → 1.4.2

package/src/runtime/agent/orchestrator/session/store-transcript-worker.mjs

@@ -8,8 +8,10 @@
  * loop each read stretched to seconds. This worker runs exactly that pipeline
  * (stat → read → stat, digest, readTopLevelLifecycleRecord →
  * projectStoredTranscript with no turn checkpoint) and hands back the
- * digest and the same projection value; only the finished window crosses
- * back.
+ * digest and one slice of the session's display history: the history itself
+ * is built once per content and kept here with its base, and only the window
+ * or page a request names (`slice`: `{ limit, skip }`) crosses back, with its
+ * serialized size measured here.
  *
  * Inside the worker, one projection base (recovery, prepared session and
  * whole-transcript context gauge) per session content is shared by every
@@ -60,8 +62,14 @@ function clientFor(sessionId) {
  * the full file stamp the bytes provably came from, or null. Rejects when the
  * worker cannot answer; callers then run the pipeline on their own thread.
  */
-export function projectStoredTranscriptOffThread({ sessionId, recordPath, itemLimit, known = null }) {
-  return clientFor(sessionId)({ sessionId, recordPath, itemLimit, known });
+export function projectStoredTranscriptOffThread({
+  sessionId,
+  recordPath,
+  known = null,
+  fingerprint = '',
+  slice = null,
+}) {
+  return clientFor(sessionId)({ sessionId, recordPath, known, fingerprint, slice });
 }
 
 /** Whether the projection worker of `sessionId` is attached (a request now
@@ -321,15 +329,108 @@ async function buildBase(sessionId, text, previousMessages, timing) {
 
 const baseBuilds = createBaseBuilds({ build: buildBase });
 
-async function project({ sessionId, recordPath, itemLimit, known }) {
+// Serialized bytes of the display histories this worker keeps for slicing:
+// one larger than the per-session bound is rebuilt per request instead, and
+// the oldest go once all of them exceed the worker's bound. The worker's idle
+// exit releases every one.
+// Measured: a history is about as large as its record (74 MB record: 75 MB
+// history) and a page of a retained one costs ~0.2 s, a rebuilt one ~1 s. 96
+// MB keeps the largest sessions seen (~78 MB records) smooth; 128 MB holds
+// one of those beside a few ordinary ones.
+export const WORKER_HISTORY_SESSION_MAX_BYTES = 96 * 1024 * 1024;
+export const WORKER_HISTORY_MAX_BYTES = 128 * 1024 * 1024;
+
+/**
+ * The display histories one worker retains (`{ value, rowBytes, bytes }`,
+ * keyed by session, Map order LRU) within `sessionMaxBytes` each and
+ * `maxBytes` together. A history of other content (`owner`, the record
+ * content it was built from, and its sidecar fingerprint) is never served.
+ */
+export function createHistoryRetention({
+  sessionMaxBytes = WORKER_HISTORY_SESSION_MAX_BYTES,
+  maxBytes = WORKER_HISTORY_MAX_BYTES,
+} = {}) {
+  const histories = new Map();
+  let retainedBytes = 0;
+  const drop = (sessionId) => {
+    const entry = histories.get(sessionId);
+    if (!entry) return;
+    histories.delete(sessionId);
+    retainedBytes -= entry.history.bytes;
+  };
+  return {
+    get(sessionId, owner, fingerprint) {
+      const entry = histories.get(sessionId);
+      if (!entry || entry.owner !== owner || entry.fingerprint !== fingerprint) return null;
+      histories.delete(sessionId);
+      histories.set(sessionId, entry);
+      return entry.history;
+    },
+    /** Keeps `history` when it fits; whether it was kept. */
+    retain(sessionId, owner, fingerprint, history) {
+      drop(sessionId);
+      if (history.bytes > sessionMaxBytes) return false;
+      histories.set(sessionId, { owner, fingerprint, history });
+      retainedBytes += history.bytes;
+      while (retainedBytes > maxBytes && histories.size > 1) drop(histories.keys().next().value);
+      return true;
+    },
+    forget: drop,
+    stats: () => ({ histories: histories.size, retainedBytes }),
+  };
+}
+
+const historyRetention = createHistoryRetention();
+/** sessionId -> { owner, fingerprint, promise }: histories being built. */
+const historyBuilds = new Map();
+
+/** The display history of `built` (one base) under sidecar `fingerprint`,
+ *  with each row's serialized bytes: retained, joined while another request
+ *  builds it, or built now. */
+async function displayHistory(sessionId, built, content, fingerprint, projection) {
+  const retained = historyRetention.get(sessionId, content, fingerprint);
+  if (retained) return { history: retained, historyBuilt: false };
+  const pending = historyBuilds.get(sessionId);
+  if (pending && pending.owner === content && pending.fingerprint === fingerprint) {
+    return { history: await pending.promise, historyBuilt: false };
+  }
+  const promise = (async () => {
+    const value = await projection.windowStoredTranscript(sessionId, built.base, {
+      history: true,
+      includeMessages: false,
+    });
+    const rowBytes = new Float64Array(value.items.length);
+    let bytes = 0;
+    for (let index = 0; index < value.items.length; index += 1) {
+      rowBytes[index] = Buffer.byteLength(JSON.stringify(value.items[index] ?? null));
+      bytes += rowBytes[index];
+    }
+    return { value, rowBytes, bytes };
+  })();
+  const record = { owner: content, fingerprint, promise };
+  historyBuilds.set(sessionId, record);
+  try {
+    const history = await promise;
+    if (historyBuilds.get(sessionId) === record) historyRetention.retain(sessionId, content, fingerprint, history);
+    return { history, historyBuilt: true };
+  } finally {
+    if (historyBuilds.get(sessionId) === record) historyBuilds.delete(sessionId);
+  }
+}
+
+async function project({ sessionId, recordPath, known, fingerprint = '', slice = null }) {
   const importStartedAt = performance.now();
-  const [{ statSessionStamp, sameSessionStamp }, { readTextFile, PROBE_PRESENT }, { transcriptTextHash }, projection] =
-    await Promise.all([
-      import('./store/canonical-reader.mjs'),
-      import('./store/fs-probe.mjs'),
-      import('./store-transcript-cache.mjs'),
-      import('./store-transcript-projection.mjs'),
-    ]);
+  const [
+    { statSessionStamp, sameSessionStamp },
+    { readTextFile, PROBE_PRESENT },
+    { transcriptTextHash, historyStampOf },
+    projection,
+  ] = await Promise.all([
+    import('./store/canonical-reader.mjs'),
+    import('./store/fs-probe.mjs'),
+    import('./store-transcript-cache.mjs'),
+    import('./store-transcript-projection.mjs'),
+  ]);
   const timing = { importMs: performance.now() - importStartedAt };
   const observe = () => {
     try {
@@ -374,12 +475,32 @@ async function project({ sessionId, recordPath, itemLimit, known }) {
       const built = await pending;
       if (built === RESTART_READ) continue;
       if (built.unreadable) return { ...digest, unreadable: true };
-      const value = await projection.windowStoredTranscript(sessionId, built.base, {
-        itemLimit,
-        includeMessages: false,
-      });
+      // The whole display history stays here (within its budgets); only the
+      // requested slice crosses back.
+      const { history, historyBuilt } = await displayHistory(
+        sessionId,
+        built,
+        `${digest.textHash}:${digest.textChars}`,
+        fingerprint,
+        projection
+      );
+      const request = slice || {};
+      const historyStamp = historyStampOf(sessionId, digest.textHash, digest.textChars, fingerprint, request.epoch);
+      const proven = Boolean(request.held) && request.baseHistory === historyStamp;
+      const value = projection.storedHistorySlice(
+        history.value,
+        { ...request, proven },
+        {
+          digestOf: request.held && !proven ? await projection.heldRowsDigester() : null,
+          rowBytes: (index) => history.rowBytes[index],
+        }
+      );
+      const { windowStamp } = value;
+      delete value.windowStamp;
+      value.projectionStamp = `${historyStamp}/${windowStamp}`;
+      const bytes = Buffer.byteLength(JSON.stringify(value));
       timing.projectMs = performance.now() - projectStartedAt;
-      return { ...digest, value, lifecycle: built.lifecycle };
+      return { ...digest, value, bytes, historyBuilt, lifecycle: built.lifecycle };
     } finally {
       if (!submitted) baseBuilds.release(ticket);
     }
@@ -388,6 +509,9 @@ async function project({ sessionId, recordPath, itemLimit, known }) {
 
 if (!isMainThread && workerData?.kind === WORKER_KIND) {
   serveWorkerRequests((payload) => {
-    return payload?.forget ? baseBuilds.forget(payload.forget) : project(payload);
+    if (!payload?.forget) return project(payload);
+    historyRetention.forget(payload.forget);
+    historyBuilds.delete(payload.forget);
+    return baseBuilds.forget(payload.forget);
   });
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/completed-result.mjs

@@ -25,6 +25,9 @@ import {
  *  when the last observed survivor exits, `cancel` terminates them. */
 function trackSurvivingDescendants(handle, { command, cwd, options, startedAtMs } = {}) {
   if (!handle?.taskId) return null;
+  // Once cancelled, every observation pass terminates survivors that ignored
+  // the first kill, so a retry is not needed to finish the job.
+  let cancelled = false;
   try {
     const task = startBackgroundTask({
       taskId: handle.taskId,
@@ -36,10 +39,10 @@ function trackSurvivingDescendants(handle, { command, cwd, options, startedAtMs
       meta: { task_id: handle.taskId, stdout: null, stderr: null, cwd, timeoutMs: 0 },
       resultType: 'shell_task_result',
       run: async () => {
-        await waitForShellDescendants(handle);
+        await waitForShellDescendants(handle, { sweep: () => cancelled });
         // The folder reservation the finished command handed to its
         // survivors ends with the last of them.
-        releaseShellJobWorkspace(handle.taskId);
+        await releaseShellJobWorkspace(handle.taskId);
         return {
           task_id: handle.taskId,
           status: 'completed',
@@ -48,6 +51,7 @@ function trackSurvivingDescendants(handle, { command, cwd, options, startedAtMs
       },
       // The kill's own re-observation is what `task cancel` reports.
       cancel: () => {
+        cancelled = true;
         task.cancelOutcome = killShellDescendants(handle);
       },
     });

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -9,11 +9,12 @@ import { withBuiltinPathLocks } from './path-locks.mjs';
 import { withAdvisoryLocks } from './advisory-lock.mjs';
 import { gitRepoLockKey, withGitWorktreeWriteLock } from './git-repo-rw-lock.mjs';
 import { invalidateBuiltinResultCache } from './cache-layers.mjs';
-import { tryAdmitWorkspaceActivity } from '../../../../shared/worktrees/activity-gate.mjs';
+import { tryAdmitWorkspaceActivityAsync } from '../../../../shared/worktrees/activity-gate.mjs';
 import { WORKTREE_SNAPSHOT_KIND } from '../../../../shared/worktrees/contract.mjs';
 import { isWithin } from '../../../../shared/worktrees/paths.mjs';
 import { readRegistrySync } from '../../../../shared/worktrees/registry.mjs';
 import { runAbortable } from '../../../../shared/abort-race.mjs';
+import { startGit } from '../../../../shared/git-launch.mjs';
 import { sleep } from '../../../../shared/sleep.mjs';
 import { capMarker } from '../../../../shared/tool-output-marker.mjs';
 import { drainCodeGraphCache } from '../code-graph-state.mjs';
@@ -437,7 +438,24 @@ function parseCommand(rawCommand, workDir) {
   return { command: String(command), cwd, globalArgs, operation, args };
 }
 
-async function runProcess(program, argv, { cwd, signal, maxBytes = MAX_CAPTURE_BYTES, optionalLocks = true } = {}) {
+function gitToolEnvironment(optionalLocks) {
+  return {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: '0',
+    GIT_PAGER: 'cat',
+    GIT_EDITOR: 'true',
+    GIT_SEQUENCE_EDITOR: 'true',
+    LC_ALL: 'C',
+    // Reads run beside writes without a lock (git-repo-rw-lock.mjs).
+    // With optional locks off `git status` never takes index.lock to
+    // write back a refreshed index, so it cannot fail a concurrent
+    // write on that lock. (`git diff` ignores the setting and may still
+    // refresh the index briefly; the write retry absorbs that.)
+    ...(optionalLocks ? {} : { GIT_OPTIONAL_LOCKS: '0' }),
+  };
+}
+
+async function runProcess(program, argv, { cwd, signal, maxBytes = MAX_CAPTURE_BYTES, env } = {}) {
   let child;
   try {
     await ensureNativeSpawnServer();
@@ -446,20 +464,7 @@ async function runProcess(program, argv, { cwd, signal, maxBytes = MAX_CAPTURE_B
       argv,
       spawnOptions: {
         cwd,
-        env: {
-          ...process.env,
-          GIT_TERMINAL_PROMPT: '0',
-          GIT_PAGER: 'cat',
-          GIT_EDITOR: 'true',
-          GIT_SEQUENCE_EDITOR: 'true',
-          LC_ALL: 'C',
-          // Reads run beside writes without a lock (git-repo-rw-lock.mjs).
-          // With optional locks off `git status` never takes index.lock to
-          // write back a refreshed index, so it cannot fail a concurrent
-          // write on that lock. (`git diff` ignores the setting and may still
-          // refresh the index briefly; the write retry absorbs that.)
-          ...(optionalLocks ? {} : { GIT_OPTIONAL_LOCKS: '0' }),
-        },
+        env,
         outputLimit: maxBytes,
         // Bytes as git wrote them, decoded once by the caller: a multibyte
         // character split across two pipe reads must not become U+FFFD.
@@ -573,11 +578,11 @@ function commandFailure(plan, result, limit = GIT_OUTPUT_LINES_DEFAULT) {
 }
 
 function runGit(plan, argv, options = {}) {
-  return runProcess('git', [...plan.globalArgs, ...argv], {
-    cwd: plan.cwd,
-    signal: options.signal,
-    optionalLocks: !options.readOnly,
-  });
+  return startGit(
+    gitToolEnvironment(!options.readOnly),
+    (command, env) => runProcess(command, [...plan.globalArgs, ...argv], { cwd: plan.cwd, signal: options.signal, env }),
+    (result) => result.error
+  );
 }
 
 // Another process (an editor, a terminal, an IDE) holding one of git's lock
@@ -585,6 +590,10 @@ function runGit(plan, argv, options = {}) {
 // config.lock. Commands take that lock before changing anything, so a brief
 // retry with backoff turns the collision into a short wait; a command that had
 // already done part of its work reports its own state on the retry.
+// Git reports lock contention only as text: lockfile.c's "Unable to create
+// '<path>.lock': File exists" (and config.c's "could not lock config file"),
+// stable English because runProcess pins LC_ALL=C. The delays are a bounded
+// backoff (3.1 s in all), a policy choice rather than anything git reports.
 const GIT_LOCK_CONTENTION_RE =
   /Unable to create '[^'\n]*\.lock': File exists|could not lock config file [^\n]*: File exists/;
 const GIT_LOCK_RETRY_DELAYS_MS = [100, 200, 400, 800, 1600];
@@ -884,12 +893,13 @@ function snapshotContaining(repo) {
 // lease it holds (activity-gate, the same as a background shell's) keeps the
 // snapshot from being removed in any process until it ends, and a snapshot
 // whose removal is under way refuses it. Returns the release.
-function admitSnapshotCommand(repo, sessionId) {
+async function admitSnapshotCommand(repo, sessionId) {
   const snapshot = snapshotContaining(repo);
   if (!snapshot) return () => {};
-  const leave = tryAdmitWorkspaceActivity(sessionId || 'git-tool', repo, { kind: 'command' });
+  const leave = await tryAdmitWorkspaceActivityAsync(sessionId || 'git-tool', repo, { kind: 'command' });
   if (!leave) throw new Error(`the snapshot worktree ${snapshot.path} is being removed; nothing ran`);
-  return leave;
+  // Fails only when workspace admission stopped (reported there), which keeps the snapshot held.
+  return () => leave().catch(() => {});
 }
 
 function invalidateAfterGitMutation() {
@@ -1057,14 +1067,14 @@ async function executeSingleGitTool(input, workDir, options = {}) {
   // under it, and a snapshot being removed refuses it.
   let leaveSnapshot;
   try {
-    leaveSnapshot = admitSnapshotCommand(repo, options.sessionId);
+    leaveSnapshot = await admitSnapshotCommand(repo, options.sessionId);
   } catch (error) {
     return rejected(error.message);
   }
   try {
     return await runInRepository(input, plan, { repo, lockKey, limit, signal, workDir });
   } finally {
-    leaveSnapshot();
+    await leaveSnapshot();
   }
 }
 

package/src/runtime/agent/orchestrator/tools/builtin/git-worktree-tool.mjs

@@ -334,11 +334,9 @@ async function rawAdd(plan, input, options) {
   const txId = txIdOf(options, plan.command);
   const mapped = { mapped: plan.command, requestedPath: resolve(plan.cwd, path) };
   // A detached checkout, or a commit-ish that names no local branch: a snapshot.
-  const snapshotCommit = detach
-    ? (commitish ?? 'HEAD')
-    : !branch && commitish && !(await localBranchExists(plan.cwd, commitish))
-      ? commitish
-      : null;
+  let snapshotCommit = null;
+  if (detach) snapshotCommit = commitish ?? 'HEAD';
+  else if (!branch && commitish && !(await localBranchExists(plan.cwd, commitish))) snapshotCommit = commitish;
   if (snapshotCommit) {
     const commit = await commitIn(plan.cwd, snapshotCommit);
     if (!commit) throw new Error(`git worktree add: ${snapshotCommit} is not a commit`);

package/src/runtime/agent/orchestrator/tools/builtin/lib/shell-job-records.mjs

@@ -27,24 +27,40 @@ import { join } from 'node:path';
 import { holdsNoData, writeJsonAtomicAsync } from '../../../../../shared/atomic-file.mjs';
 import { isPidAlive } from '../../../../../shared/pid-liveness.mjs';
 import { displayShellCommand } from '../../../../../shared/shell-display.mjs';
-import { tryAdmitWorkspaceActivity } from '../../../../../shared/worktrees/activity-gate.mjs';
+import { tryAdmitWorkspaceActivityAsync } from '../../../../../shared/worktrees/activity-gate.mjs';
 import { worktreeError } from '../../../../../shared/worktrees/contract.mjs';
 import { workspaceSees } from '../../../../../shared/worktrees/workspace-visibility.mjs';
 
 const workspaceLeases = new Map();
 
+/**
+ * Calls both releases in order; settles once both did. Never goes unhandled
+ * (an asynchronous release rejects only when workspace admission stopped).
+ */
+export function bothReleased(first, second) {
+  const both = Promise.all([first(), second()]);
+  both.catch(() => {});
+  return both;
+}
+
+/**
+ * A workspace grant requested now, for a release handle needed before it is
+ * answered: the release, whenever called, follows the grant (and releases
+ * nothing if it was refused or failed).
+ */
+export function pendingWorkspaceAdmission(granting) {
+  granting.catch(() => {});
+  return () =>
+    granting.then(
+      (leave) => leave?.(),
+      () => {}
+    );
+}
+
 /** Transfer a foreground reader to a surviving-descendant task without a lease gap. */
 export function adoptShellWorkspaceAdmission(jobId, leave) {
   const prior = workspaceLeases.get(jobId);
-  workspaceLeases.set(
-    jobId,
-    prior
-      ? () => {
-          prior();
-          leave();
-        }
-      : leave
-  );
+  workspaceLeases.set(jobId, prior ? () => bothReleased(prior, leave) : leave);
 }
 
 // A record whose owner process is gone is garbage. Age alone never deletes a
@@ -88,8 +104,13 @@ function validJobId(jobId) {
 
 function terminalRecord(base, detail) {
   const finishedAt = detail?.finishedAt || new Date().toISOString();
+  // A completed record no longer claims an unconfirmed termination: it is
+  // written once the processes are confirmed gone, or explicitly released.
+  // A completed record no longer claims an unconfirmed termination: it is
+  // written once the processes are confirmed gone, or explicitly released.
+  const { terminationUnconfirmed: _held, ...open } = base || {};
   return {
-    ...(base || {}),
+    ...open,
     jobId: String(detail?.jobId || base?.jobId || ''),
     kind: 'bash',
     status: String(detail?.status || 'failed'),
@@ -172,7 +193,14 @@ async function sweepOrphanRecords(dir) {
   }
 }
 
-/** Publish the record for a job that has just started or been promoted. */
+/**
+ * Publish the record for a job that has just started or been promoted. Its
+ * workspace lease (under the job's pid) is requested at the call and adopted
+ * under the job id at once, so a later release of the job — or of a
+ * predecessor's lease — is ordered after it. Resolves once the lease is in
+ * both ledger copies; rejects (and writes no record) when it is refused or
+ * cannot be written. The returned promise never goes unhandled.
+ */
 export function publishShellJobRecord(
   task,
   {
@@ -184,16 +212,20 @@ export function publishShellJobRecord(
   } = {}
 ) {
   const jobId = String(task?.jobId || '').trim();
-  if (!jobId) return;
+  if (!jobId) return Promise.resolve();
+  let admitted = Promise.resolve();
   if (task?.cwd) {
-    const leave = tryAdmitWorkspaceActivity(ownerSessionId || jobId, task.cwd, {
+    const granting = tryAdmitWorkspaceActivityAsync(ownerSessionId || jobId, task.cwd, {
       pid: Number(task.pid) || process.pid,
       kind: 'command',
     });
-    if (!leave) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command folder is being managed.');
+    admitted = granting.then((leave) => {
+      if (!leave) throw worktreeError('WORKTREE_BUSY_JOBS', 'The command folder is being managed.');
+    });
+    admitted.catch(() => {});
     // A descendant handoff can reuse the job id with a different live pid.
-    // Acquire its reader before releasing any predecessor's admission.
-    adoptShellWorkspaceAdmission(jobId, leave);
+    // Its reader is requested before any predecessor's admission is released.
+    adoptShellWorkspaceAdmission(jobId, pendingWorkspaceAdmission(granting));
   }
   const ownerPid = Number(clientHostPid ?? task?.clientHostPid) || process.pid;
   const dir = jobsDir();
@@ -202,6 +234,8 @@ export function publishShellJobRecord(
   paths.set(jobId, [jsonPath, ownerPath]);
   void enqueue(jobId, async () => {
     try {
+      // No record for a job whose workspace lease was not granted.
+      await admitted;
       await mkdir(dir, { recursive: true });
       if (!sweepStarted) {
         sweepStarted = true;
@@ -244,6 +278,7 @@ export function publishShellJobRecord(
       /* the record is presentation only; never fail a job for it */
     }
   });
+  return admitted;
 }
 
 /** Preserve a bounded terminal snapshot for manual recovery after restart. */
@@ -335,8 +370,9 @@ export function releaseShellJobWorkspace(jobId) {
   const key = String(jobId || '').trim();
   const leave = workspaceLeases.get(key);
   if (!leave) return;
-  leave();
+  const released = leave();
   if (workspaceLeases.get(key) === leave) workspaceLeases.delete(key);
+  return released;
 }
 
 /** Flag a still-open job record as "termination unconfirmed" for the readouts. */
@@ -390,8 +426,10 @@ export function completeShellJobRecord(jobId, detail) {
       // Callers complete a record only once its processes are confirmed gone
       // (or explicitly released): the workspace admission follows that, not
       // the record write, so a failed write cannot strand it with no handle.
-      leaveWorkspace?.();
+      const released = leaveWorkspace?.();
       if (workspaceLeases.get(key) === leaveWorkspace) workspaceLeases.delete(key);
+      // Fails only when workspace admission stopped (reported there), which keeps the folder held.
+      await Promise.resolve(released).catch(() => {});
     }
     await removePaths(ownerPaths);
     paths.set(key, [jsonPath, donePath]);
@@ -486,6 +524,6 @@ export function retireShellJobRecord(jobId) {
     records.delete(key);
     incarnations.delete(key);
     await removePaths(list);
-    leaveWorkspace?.();
+    await leaveWorkspace?.();
   });
 }

package/src/runtime/agent/orchestrator/tools/builtin/runtime-capabilities.mjs

@@ -1,6 +1,7 @@
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { readdir as readdirAsync } from 'node:fs/promises';
+import { startGitSync } from '../../../../shared/git-launch.mjs';
 import { runGitOffThread } from '../../../../shared/git-runner.mjs';
 import { findPathExecutable } from '../../../../shared/path-executable.mjs';
 import { dirname as pathDirname, join as pathJoin, resolve as pathResolveAbsolute } from 'node:path';
@@ -161,13 +162,15 @@ function _changeStateArgs(root) {
 
 function _probeRepositoryChangeStateSync(root) {
   try {
-    const result = spawnSync('git', _changeStateArgs(root), {
-      encoding: 'utf8',
-      env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' },
-      maxBuffer: 64 * 1024,
-      timeout: 1500,
-      windowsHide: true,
-    });
+    const result = startGitSync({ ...process.env, GIT_OPTIONAL_LOCKS: '0' }, (command, env) =>
+      spawnSync(command, _changeStateArgs(root), {
+        encoding: 'utf8',
+        env,
+        maxBuffer: 64 * 1024,
+        timeout: 1500,
+        windowsHide: true,
+      })
+    );
     const output = String(result.stdout || '').trim();
     if (result.status === 0) return output ? 'changes present' : 'clean';
     if (result.error?.code === 'ENOBUFS' && output) return 'changes present';
@@ -271,14 +274,16 @@ function _checkIgnoreArgs(directory) {
 
 function _probeGitIgnoredEntriesSync(directory, names) {
   try {
-    const result = spawnSync('git', _checkIgnoreArgs(directory), {
-      encoding: 'utf8',
-      input: `${names.join('\0')}\0`,
-      env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' },
-      maxBuffer: 1024 * 1024,
-      timeout: 1500,
-      windowsHide: true,
-    });
+    const result = startGitSync({ ...process.env, GIT_OPTIONAL_LOCKS: '0' }, (command, env) =>
+      spawnSync(command, _checkIgnoreArgs(directory), {
+        encoding: 'utf8',
+        input: `${names.join('\0')}\0`,
+        env,
+        maxBuffer: 1024 * 1024,
+        timeout: 1500,
+        windowsHide: true,
+      })
+    );
     // Exit 1 is "nothing ignored", not a failure.
     if (result.status !== 0 && result.status !== 1) return new Set();
     return new Set(