mixdog 1.4.1 → 1.4.3

package/src/runtime/agent/orchestrator/session/store-transcript-worker.mjs

@@ -8,8 +8,10 @@
  * loop each read stretched to seconds. This worker runs exactly that pipeline
  * (stat → read → stat, digest, readTopLevelLifecycleRecord →
  * projectStoredTranscript with no turn checkpoint) and hands back the
- * digest and the same projection value; only the finished window crosses
- * back.
+ * digest and one slice of the session's display history: the history itself
+ * is built once per content and kept here with its base, and only the window
+ * or page a request names (`slice`: `{ limit, skip }`) crosses back, with its
+ * serialized size measured here.
  *
  * Inside the worker, one projection base (recovery, prepared session and
  * whole-transcript context gauge) per session content is shared by every
@@ -60,8 +62,14 @@ function clientFor(sessionId) {
  * the full file stamp the bytes provably came from, or null. Rejects when the
  * worker cannot answer; callers then run the pipeline on their own thread.
  */
-export function projectStoredTranscriptOffThread({ sessionId, recordPath, itemLimit, known = null }) {
-  return clientFor(sessionId)({ sessionId, recordPath, itemLimit, known });
+export function projectStoredTranscriptOffThread({
+  sessionId,
+  recordPath,
+  known = null,
+  fingerprint = '',
+  slice = null,
+}) {
+  return clientFor(sessionId)({ sessionId, recordPath, known, fingerprint, slice });
 }
 
 /** Whether the projection worker of `sessionId` is attached (a request now
@@ -321,15 +329,108 @@ async function buildBase(sessionId, text, previousMessages, timing) {
 
 const baseBuilds = createBaseBuilds({ build: buildBase });
 
-async function project({ sessionId, recordPath, itemLimit, known }) {
+// Serialized bytes of the display histories this worker keeps for slicing:
+// one larger than the per-session bound is rebuilt per request instead, and
+// the oldest go once all of them exceed the worker's bound. The worker's idle
+// exit releases every one.
+// Measured: a history is about as large as its record (74 MB record: 75 MB
+// history) and a page of a retained one costs ~0.2 s, a rebuilt one ~1 s. 96
+// MB keeps the largest sessions seen (~78 MB records) smooth; 128 MB holds
+// one of those beside a few ordinary ones.
+const WORKER_HISTORY_SESSION_MAX_BYTES = 96 * 1024 * 1024;
+const WORKER_HISTORY_MAX_BYTES = 128 * 1024 * 1024;
+
+/**
+ * The display histories one worker retains (`{ value, rowBytes, bytes }`,
+ * keyed by session, Map order LRU) within `sessionMaxBytes` each and
+ * `maxBytes` together. A history of other content (`owner`, the record
+ * content it was built from, and its sidecar fingerprint) is never served.
+ */
+export function createHistoryRetention({
+  sessionMaxBytes = WORKER_HISTORY_SESSION_MAX_BYTES,
+  maxBytes = WORKER_HISTORY_MAX_BYTES,
+} = {}) {
+  const histories = new Map();
+  let retainedBytes = 0;
+  const drop = (sessionId) => {
+    const entry = histories.get(sessionId);
+    if (!entry) return;
+    histories.delete(sessionId);
+    retainedBytes -= entry.history.bytes;
+  };
+  return {
+    get(sessionId, owner, fingerprint) {
+      const entry = histories.get(sessionId);
+      if (!entry || entry.owner !== owner || entry.fingerprint !== fingerprint) return null;
+      histories.delete(sessionId);
+      histories.set(sessionId, entry);
+      return entry.history;
+    },
+    /** Keeps `history` when it fits; whether it was kept. */
+    retain(sessionId, owner, fingerprint, history) {
+      drop(sessionId);
+      if (history.bytes > sessionMaxBytes) return false;
+      histories.set(sessionId, { owner, fingerprint, history });
+      retainedBytes += history.bytes;
+      while (retainedBytes > maxBytes && histories.size > 1) drop(histories.keys().next().value);
+      return true;
+    },
+    forget: drop,
+    stats: () => ({ histories: histories.size, retainedBytes }),
+  };
+}
+
+const historyRetention = createHistoryRetention();
+/** sessionId -> { owner, fingerprint, promise }: histories being built. */
+const historyBuilds = new Map();
+
+/** The display history of `built` (one base) under sidecar `fingerprint`,
+ *  with each row's serialized bytes: retained, joined while another request
+ *  builds it, or built now. */
+async function displayHistory(sessionId, built, content, fingerprint, projection) {
+  const retained = historyRetention.get(sessionId, content, fingerprint);
+  if (retained) return { history: retained, historyBuilt: false };
+  const pending = historyBuilds.get(sessionId);
+  if (pending && pending.owner === content && pending.fingerprint === fingerprint) {
+    return { history: await pending.promise, historyBuilt: false };
+  }
+  const promise = (async () => {
+    const value = await projection.windowStoredTranscript(sessionId, built.base, {
+      history: true,
+      includeMessages: false,
+    });
+    const rowBytes = new Float64Array(value.items.length);
+    let bytes = 0;
+    for (let index = 0; index < value.items.length; index += 1) {
+      rowBytes[index] = Buffer.byteLength(JSON.stringify(value.items[index] ?? null));
+      bytes += rowBytes[index];
+    }
+    return { value, rowBytes, bytes };
+  })();
+  const record = { owner: content, fingerprint, promise };
+  historyBuilds.set(sessionId, record);
+  try {
+    const history = await promise;
+    if (historyBuilds.get(sessionId) === record) historyRetention.retain(sessionId, content, fingerprint, history);
+    return { history, historyBuilt: true };
+  } finally {
+    if (historyBuilds.get(sessionId) === record) historyBuilds.delete(sessionId);
+  }
+}
+
+async function project({ sessionId, recordPath, known, fingerprint = '', slice = null }) {
   const importStartedAt = performance.now();
-  const [{ statSessionStamp, sameSessionStamp }, { readTextFile, PROBE_PRESENT }, { transcriptTextHash }, projection] =
-    await Promise.all([
-      import('./store/canonical-reader.mjs'),
-      import('./store/fs-probe.mjs'),
-      import('./store-transcript-cache.mjs'),
-      import('./store-transcript-projection.mjs'),
-    ]);
+  const [
+    { statSessionStamp, sameSessionStamp },
+    { readTextFile, PROBE_PRESENT },
+    { transcriptTextHash, historyStampOf },
+    projection,
+  ] = await Promise.all([
+    import('./store/canonical-reader.mjs'),
+    import('./store/fs-probe.mjs'),
+    import('./store-transcript-cache.mjs'),
+    import('./store-transcript-projection.mjs'),
+  ]);
   const timing = { importMs: performance.now() - importStartedAt };
   const observe = () => {
     try {
@@ -374,12 +475,32 @@ async function project({ sessionId, recordPath, itemLimit, known }) {
       const built = await pending;
       if (built === RESTART_READ) continue;
       if (built.unreadable) return { ...digest, unreadable: true };
-      const value = await projection.windowStoredTranscript(sessionId, built.base, {
-        itemLimit,
-        includeMessages: false,
-      });
+      // The whole display history stays here (within its budgets); only the
+      // requested slice crosses back.
+      const { history, historyBuilt } = await displayHistory(
+        sessionId,
+        built,
+        `${digest.textHash}:${digest.textChars}`,
+        fingerprint,
+        projection
+      );
+      const request = slice || {};
+      const historyStamp = historyStampOf(sessionId, digest.textHash, digest.textChars, fingerprint, request.epoch);
+      const proven = Boolean(request.held) && request.baseHistory === historyStamp;
+      const value = projection.storedHistorySlice(
+        history.value,
+        { ...request, proven },
+        {
+          digestOf: request.held && !proven ? await projection.heldRowsDigester() : null,
+          rowBytes: (index) => history.rowBytes[index],
+        }
+      );
+      const { windowStamp } = value;
+      delete value.windowStamp;
+      value.projectionStamp = `${historyStamp}/${windowStamp}`;
+      const bytes = Buffer.byteLength(JSON.stringify(value));
       timing.projectMs = performance.now() - projectStartedAt;
-      return { ...digest, value, lifecycle: built.lifecycle };
+      return { ...digest, value, bytes, historyBuilt, lifecycle: built.lifecycle };
     } finally {
       if (!submitted) baseBuilds.release(ticket);
     }
@@ -388,6 +509,9 @@ async function project({ sessionId, recordPath, itemLimit, known }) {
 
 if (!isMainThread && workerData?.kind === WORKER_KIND) {
   serveWorkerRequests((payload) => {
-    return payload?.forget ? baseBuilds.forget(payload.forget) : project(payload);
+    if (!payload?.forget) return project(payload);
+    historyRetention.forget(payload.forget);
+    historyBuilds.delete(payload.forget);
+    return baseBuilds.forget(payload.forget);
   });
 }

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -31,6 +31,7 @@ export {
   _removeSessionSummary,
 } from './store-summary-index.mjs';
 import { _sessionForDisk, _ensureLifecycleFields } from './store/serialize.mjs';
+import { captureTranscriptSnapshot, recordLandedTranscript } from './store/transcript-durability.mjs';
 import {
   _cacheSessionSummary,
   _rollbackCachedSessionSummary,
@@ -337,6 +338,7 @@ function _doSaveSync(payload) {
     // rebuilt from them, never re-read from the later mutable live session.
     let attempted = null;
     try {
+      const transcript = captureTranscriptSnapshot(session);
       const disk = _sessionForDisk(session);
       attempted = JSON.stringify(disk);
       // The lifecycle these exact bytes carry, recorded with the commit stamp.
@@ -382,6 +384,7 @@ function _doSaveSync(payload) {
         _recordOwnSessionCommit(target, scratch, lifecycle);
         _publishLandedWriteEpoch(opts, epoch);
         _untrackSaveTmp(tmp);
+        recordLandedTranscript(session, transcript, epoch);
         if (mayMutate()) {
           if (publishSummary) _queueSessionSummaryUpsert(session, summaryVersion);
           _clearSaveStateIfCurrent(id, epoch);
@@ -627,6 +630,7 @@ async function _doSave(payload) {
   // payload, never the live session as it looks at settlement time.
   let attempted = null;
   try {
+    const transcript = captureTranscriptSnapshot(session);
     const disk = _sessionForDisk(session);
     attempted = JSON.stringify(disk);
     // Captured before the await: the lifecycle of exactly these bytes.
@@ -671,6 +675,7 @@ async function _doSave(payload) {
       _recordOwnSessionCommit(target, scratch, lifecycle);
       _publishLandedWriteEpoch(opts, epoch);
       _untrackSaveTmp(tmp);
+      recordLandedTranscript(session, transcript, epoch);
       if (mayMutate()) {
         _queueSessionSummaryUpsert(session, summaryVersion);
         _clearSaveStateIfCurrent(id, epoch);

package/src/runtime/agent/orchestrator/session/synthetic-user-envelope.mjs

@@ -45,6 +45,11 @@ const RUNTIME_CONTROL_SOURCES = new Set([
   'task-notification',
 ]);
 const ENVELOPE_OPEN_RE = new RegExp(`^\\s*<${SYNTHETIC_USER_ENVELOPE_TAG}\\b`, 'i');
+// The stored crash marker reads like a user cancel ("Request interrupted ..."),
+// and models answered it with "stopped as you asked" and dropped the work.
+// On the wire it names the restart and asks to resume.
+const PROCESS_RESTART_MARKER = '[Request interrupted by process restart]';
+const PROCESS_RESTART_WIRE_TEXT = '[mixdog-runtime] The app restarted mid-turn. Continue from where you left off.';
 
 function messageText(message) {
   if (typeof message?.content === 'string') return message.content;
@@ -128,7 +133,8 @@ export function projectSyntheticUserEnvelopes(messages) {
   const projected = messages.map((message) => {
     const kind = classifySyntheticUserMessage(message);
     if (!kind) return message;
-    const content = envelopeContent(message.content, kind);
+    const source = messageText(message).trim() === PROCESS_RESTART_MARKER ? PROCESS_RESTART_WIRE_TEXT : message.content;
+    const content = envelopeContent(source, kind);
     if (content === message.content) return message;
     changed = true;
     stats.wrapped += 1;

package/src/runtime/agent/orchestrator/session/tail-reminder-rules.mjs

@@ -119,7 +119,15 @@ export function matchTailReminder(context, rules = TAIL_REMINDER_RULES) {
 }
 
 /** `messages` plus the tail reminder for this request (a copy; the input is untouched). */
-export function withTailReminder(messages, { session, provider, model }, language = _buildLeadLanguage()) {
+// The session's own response language (as its prompt and settings notices
+// carry it, session/manager/prompt-settings.mjs); a session without one (an
+// agent, an older record) reads the config.
+export function withTailReminder(
+  messages,
+  { session, provider, model },
+  // null is a recorded "no language", not a missing record.
+  language = session?.responseLanguage !== undefined ? session.responseLanguage : _buildLeadLanguage()
+) {
   const text = matchTailReminder({
     provider: session?.provider || provider?.name || '',
     model,

package/src/runtime/agent/orchestrator/session/transcript-restore/agent-envelope.mjs

@@ -260,7 +260,7 @@ export function isStatusOnlyAgentCompletionNotification(text) {
   return !(hasAgentResponseResultText(result) || hasAgentResponseResultText(text));
 }
 
-export function hasAgentResponseResultText(text) {
+function hasAgentResponseResultText(text) {
   const value = String(text || '').trim();
   if (!value) return false;
   const notification = parseTaskNotification(value);

package/src/runtime/agent/orchestrator/session/transcript-restore/restore.mjs

@@ -685,7 +685,9 @@ export function restoreTranscriptItems(messages, { sessionId = 'session', itemLi
 export function sessionContextSnapshotProjection(session, contextStatus) {
   if (!contextStatus) return {};
   return {
-    stats: contextMeasurementStats(contextStatus),
+    // The composer's usage readout reads the session totals from the same
+    // stats a live runtime publishes; a cold open has no runtime to add them.
+    stats: { ...contextMeasurementStats(contextStatus), usageReadout: contextStatus.usage?.usageReadout ?? null },
     contextWindow: Math.max(0, Number(session?.contextWindow || contextStatus.effectiveContextWindow || 0)),
     rawContextWindow: Math.max(0, Number(session?.rawContextWindow || contextStatus.rawContextWindow || 0)),
     effectiveContextWindowPercent: Number(

package/src/runtime/agent/orchestrator/session/transcript-restore/user-text.mjs

@@ -99,7 +99,7 @@ function feedbackDisplay(body) {
   return lines.join('\n');
 }
 
-export function withVisualizeFeedbackDisplay(text) {
+function withVisualizeFeedbackDisplay(text) {
   const value = String(text ?? '');
   if (!value.includes(FEEDBACK_OPEN)) return value;
   return value.replace(FEEDBACK_BLOCK, (_block, body) => feedbackDisplay(body));
@@ -121,7 +121,7 @@ const PASTED_LINES = /· (\d+) lines?$/;
 const PASTED_TEXT_MAX_BYTES = 1024 * 1024;
 /** Blob bytes one transcript load may read to count the lines of pastes
  *  whose stored name does not carry the count (pastes stored before it did). */
-export const PASTED_LINE_READ_BUDGET_BYTES = 4 * 1024 * 1024;
+const PASTED_LINE_READ_BUDGET_BYTES = 4 * 1024 * 1024;
 
 /** A stored plain-text prompt part's text within the load's byte budget, else ''. */
 function offloadedPromptText(part, budget) {

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -137,11 +137,9 @@ export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs('MIXDOG_PROVIDER_SS
 // silent-window token rate a steady ~92 tok/s, i.e. live generation, not a
 // wedge). So a "semantic-silent" stream is NOT necessarily dead.
 //
-// 2026-08-03 v3 postmortem: this window used to be DERIVED from the agent
-// stall budget (warn − tick ≈ 285s). A harness that tightened STALL_TIMEOUT_S
-// to 300s silently collapsed it to 135s, which deterministically beheaded
-// live long-thinking turns (regex-chess / circuit-fibsqrt: ttft ~1.5s, then
-// killed at exactly 135s of silent thinking, 4 attempts ≈ 552s per turn).
+// Deriving this window from the agent stall budget (warn − tick ≈ 285s) would
+// let a harness that tightens STALL_TIMEOUT_S to 300s collapse it to 135s,
+// which deterministically beheads live long-thinking turns.
 // Reference behavior: abort only after a 300s single-gap silence, and fall
 // back to non-streaming instead of killing the turn. The default is
 // therefore a FIXED 300s, decoupled from the warn math. The only remaining

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/backgrounded-result.mjs

@@ -1,4 +1,5 @@
 import { registerBackgroundTask, renderBackgroundTask } from '../../../../../shared/background-tasks.mjs';
+import { stampShellJobCycle } from '../../../../../shared/background-wait.mjs';
 import { killShellJob, watchBackgroundShellJob } from '../shell-jobs.mjs';
 import { renderBackgroundPartialOutput } from '../shell-output.mjs';
 import { readShellTaskOutput } from '../lib/shell-task-output.mjs';
@@ -65,7 +66,9 @@ export function renderBackgroundedResult({
 }) {
   let task = null;
   if (result.jobId) {
-    task = registerPromotedTask({ result, command, cwd, options, startedAtMs });
+    // The owner's user cycle at start decides whether it is waited on
+    // (background-wait.mjs), however the job reached the background.
+    task = stampShellJobCycle(registerPromotedTask({ result, command, cwd, options, startedAtMs }));
     try {
       watchBackgroundShellJob(result.jobId, {
         notifyFn: typeof options?.notifyFn === 'function' ? options.notifyFn : null,

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/completed-result.mjs

@@ -25,6 +25,9 @@ import {
  *  when the last observed survivor exits, `cancel` terminates them. */
 function trackSurvivingDescendants(handle, { command, cwd, options, startedAtMs } = {}) {
   if (!handle?.taskId) return null;
+  // Once cancelled, every observation pass terminates survivors that ignored
+  // the first kill, so a retry is not needed to finish the job.
+  let cancelled = false;
   try {
     const task = startBackgroundTask({
       taskId: handle.taskId,
@@ -36,10 +39,10 @@ function trackSurvivingDescendants(handle, { command, cwd, options, startedAtMs
       meta: { task_id: handle.taskId, stdout: null, stderr: null, cwd, timeoutMs: 0 },
       resultType: 'shell_task_result',
       run: async () => {
-        await waitForShellDescendants(handle);
+        await waitForShellDescendants(handle, { sweep: () => cancelled });
         // The folder reservation the finished command handed to its
         // survivors ends with the last of them.
-        releaseShellJobWorkspace(handle.taskId);
+        await releaseShellJobWorkspace(handle.taskId);
         return {
           task_id: handle.taskId,
           status: 'completed',
@@ -48,6 +51,7 @@ function trackSurvivingDescendants(handle, { command, cwd, options, startedAtMs
       },
       // The kill's own re-observation is what `task cancel` reports.
       cancel: () => {
+        cancelled = true;
         task.cancelOutcome = killShellDescendants(handle);
       },
     });

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/misuse-guard.mjs

@@ -5,13 +5,16 @@
 //      to background + task wait);
 //   2. a plain leading `cd <dir>` moves into the `cwd` argument;
 //   3. a shell file read (cat/Get-Content/grep/ls …) gets a pointer to the
-//      read / grep / list tools — a note now, a rejection when the mode flips.
+//      read / grep / list tools — a note now, a rejection when the mode flips;
+//   4. a command mentioning `git … worktree add` is rejected (worktrees go
+//      through the git tool; a textual check, so mentions as data are too).
 import { shellSplitPipelineSegments, shellSplitSegments, shellTokenize } from '../shell-analysis.mjs';
 import { resolveShellFor } from '../shell-runtime.mjs';
 import { formatShellToolFailure } from './result-format.mjs';
+import { addsUnmanagedWorktree } from './worktree-add-guard.mjs';
 
 /** `warn` runs the read with a note; `reject` returns the block without running. */
-export const SHELL_FILE_READ_MODE = 'warn';
+const SHELL_FILE_READ_MODE = 'warn';
 export const SHELL_FILE_READ_NOTE = 'Note: use the read / grep / list tools for files instead of the shell.';
 const SHELL_FILE_READ_BLOCK =
   'Blocked: use read / grep / list for files instead of the shell (read takes offset/limit for a window of a large file).';
@@ -194,6 +197,20 @@ function detectShellFileRead(command, shellType) {
   return operands.length >= minOperands ? { tool, command: name } : null;
 }
 
+// ── 4. unmanaged worktrees ───────────────────────────────────────────────────
+
+// A worktree added from the shell is invisible to the managed cleanup and
+// outlives the session that made it, so `git … worktree add` never runs here.
+// The check is textual (worktree-add-guard.mjs): a command that only mentions
+// the phrase is refused too, so the message says how to go on either way.
+const SHELL_WORKTREE_ADD_BLOCK =
+  'Blocked: this shell command mentions `git … worktree add`, which does not run from the shell; ' +
+  'Mixdog manages worktrees so they are cleaned up. To create one, use the git tool: command ' +
+  '"git worktree add --detach <path> [<commit>]" makes a read-only snapshot (removed when the turn ends; ' +
+  'delegated workers too), and the Lead uses "git worktree add -b <branch> <path>" or action:"worktree" for a ' +
+  'branch worktree. The check is textual: to search for that text use the grep tool, and keep the phrase out ' +
+  'of shell commands (echo, commit messages, heredocs).';
+
 // ── the guard ────────────────────────────────────────────────────────────────
 
 /** The syntax family of the shell a call asks for (`args.shell`, as foreign adapters set it), else the default shell's. */
@@ -209,7 +226,7 @@ function recordFileRead(telemetry, entry) {
 }
 
 /**
- * Apply the three guards to a shell call.
+ * Apply the four guards to a shell call.
  * @returns {{ failure: string } | { args: object, notes: string[] }} the
  *   rejection, or the call to run (a leading `cd` moved into `cwd`) with the
  *   lines to add to its result.
@@ -230,6 +247,7 @@ export function guardShellCall(
     const sleepFailure = leadingSleepFailure(guarded.command, shellType);
     if (sleepFailure) return { failure: sleepFailure };
   }
+  if (addsUnmanagedWorktree(guarded.command)) return { failure: formatShellToolFailure(SHELL_WORKTREE_ADD_BLOCK) };
   const read = detectShellFileRead(guarded.command, shellType);
   if (read) {
     recordFileRead(telemetry, { mode: fileReadMode, tool: read.tool, command: read.command, agent, sessionId });

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/result-format.mjs

@@ -75,7 +75,7 @@ export function _finalizeShellResult(completedExit, text) {
 
 export function _shellFailureStatus(result, timeout) {
   // Prefer the signal reported by the process. `killed` is only a fallback
-  // for platforms (notably taskkill on Windows) that close without one.
+  // for platforms (notably a Windows tree kill) that close without one.
   const signal = result.signal || (result.killed ? 'SIGKILL' : null);
   const exitCode = signal ? null : result.exitCode;
   const shellToolFailed = result.failurePhase === 'tool' || !!result.outputCaptureError;

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/worktree-add-guard.mjs

@@ -0,0 +1,77 @@
+// Whether a shell command mentions `git … worktree add`. A worktree added from
+// the shell is invisible to the managed cleanup and outlives the session that
+// made it, so the shell guard refuses it and points to the git tool.
+//
+// Deliberately textual, conservative and linear-time: no shell is parsed. The
+// command is normalized once (escape and quote characters of every shell
+// dropped, whitespace collapsed; a PowerShell -EncodedCommand decoded), then
+// refused when `git` is followed anywhere later by `worktree … add`. Commands
+// that only mention the phrase as data (echo, grep, a heredoc, a commit
+// message) are refused too; the refusal says how to proceed.
+
+const QUOTES = /['"\u2018\u2019\u201a\u201b\u201c\u201d\u201e]/g;
+const GIT_WORD = /\bgit\b/i;
+// `worktree` ending a token that is not an option: `worktree`, `$(worktree`, `alias.wa=worktree`.
+const WORKTREE_TOKEN = /(?:^|[^\w-])worktree$/i;
+const ADD_TOKEN = /^add\b/i;
+// powershell/pwsh -EncodedCommand (any accepted prefix: -e, -ec, -enc, …) and its base64 argument.
+const ENCODED_COMMAND = /(?:^|[\s'"])[-/]e(?:c|n[a-z]*)?\s+['"]?([A-Za-z0-9+/]{4,}={0,2})/gi;
+
+/** The command with every shell's escapes and quotes dropped and whitespace collapsed.
+ *  `joiner` replaces a line continuation: '' as POSIX joins `a\<newline>dd` into one
+ *  word, ' ' where the continuation separates words. */
+function normalize(text, joiner) {
+  return (
+    text
+      .replace(/[\\`]\r?\n/g, joiner)
+      // Hex escapes ($'\x61dd', "\x61dd").
+      .replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)))
+      // The `$` of a POSIX $'…' / $"…" string.
+      .replace(/\$(?=['"])/g, '')
+      // PowerShell backtick and cmd caret escapes.
+      .replace(/[`^]/g, '')
+      .replace(QUOTES, '')
+      .replace(/\s+/g, ' ')
+  );
+}
+
+/** True when some `git` word comes before a `worktree … add` in `text`. One pass
+ *  over the tokens: options (`-…`) between `worktree` and `add` are skipped and
+ *  never start a match, so every token is visited once. */
+function gitThenWorktreeAdd(text) {
+  const tokens = text.split(/[\s,]+/);
+  let gitSeen = false;
+  for (let i = 0; i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (!gitSeen) {
+      gitSeen = GIT_WORD.test(token);
+      continue;
+    }
+    if (token.startsWith('-') || !WORKTREE_TOKEN.test(token)) continue;
+    let next = i + 1;
+    while (next < tokens.length && tokens[next].startsWith('-')) next += 1;
+    if (next < tokens.length && ADD_TOKEN.test(tokens[next])) return true;
+    i = next - 1;
+  }
+  return false;
+}
+
+/** True when `command` would (or might) run `git … worktree add`. */
+export function addsUnmanagedWorktree(command) {
+  const raw = String(command ?? '');
+  const texts = [raw];
+  for (const [, encoded] of raw.matchAll(ENCODED_COMMAND)) {
+    texts.push(Buffer.from(encoded, 'base64').toString('utf16le'));
+  }
+  return texts.some((text) =>
+    ['', ' '].some((joiner) => {
+      const normalized = normalize(text, joiner);
+      // A backslash is a POSIX escape (`a\dd` is `add`) or a Windows path separator
+      // (`C:\Git\cmd\git.exe`): both readings are checked.
+      return (
+        gitThenWorktreeAdd(normalized.replace(/\\(?=[A-Za-z])/g, '')) ||
+        gitThenWorktreeAdd(normalized.replaceAll('\\', '/'))
+      );
+    })
+  );
+}

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -32,7 +32,6 @@ export {
   SURVIVING_DESCENDANTS_WARNING,
   SURVIVING_DESCENDANTS_UNREACHABLE_WARNING,
   _backgroundResultLines,
-  getDedupedDestructiveWarnings,
   _placeDestructiveWarningsAfterStatus,
   formatShellToolFailure,
   _shellFailureStatus,