mixdog 1.4.2 → 1.4.3

package/src/runtime/agent/orchestrator/session/transcript-restore/agent-envelope.mjs

@@ -260,7 +260,7 @@ export function isStatusOnlyAgentCompletionNotification(text) {
   return !(hasAgentResponseResultText(result) || hasAgentResponseResultText(text));
 }
 
-export function hasAgentResponseResultText(text) {
+function hasAgentResponseResultText(text) {
   const value = String(text || '').trim();
   if (!value) return false;
   const notification = parseTaskNotification(value);

package/src/runtime/agent/orchestrator/session/transcript-restore/restore.mjs

@@ -685,7 +685,9 @@ export function restoreTranscriptItems(messages, { sessionId = 'session', itemLi
 export function sessionContextSnapshotProjection(session, contextStatus) {
   if (!contextStatus) return {};
   return {
-    stats: contextMeasurementStats(contextStatus),
+    // The composer's usage readout reads the session totals from the same
+    // stats a live runtime publishes; a cold open has no runtime to add them.
+    stats: { ...contextMeasurementStats(contextStatus), usageReadout: contextStatus.usage?.usageReadout ?? null },
     contextWindow: Math.max(0, Number(session?.contextWindow || contextStatus.effectiveContextWindow || 0)),
     rawContextWindow: Math.max(0, Number(session?.rawContextWindow || contextStatus.rawContextWindow || 0)),
     effectiveContextWindowPercent: Number(

package/src/runtime/agent/orchestrator/session/transcript-restore/user-text.mjs

@@ -99,7 +99,7 @@ function feedbackDisplay(body) {
   return lines.join('\n');
 }
 
-export function withVisualizeFeedbackDisplay(text) {
+function withVisualizeFeedbackDisplay(text) {
   const value = String(text ?? '');
   if (!value.includes(FEEDBACK_OPEN)) return value;
   return value.replace(FEEDBACK_BLOCK, (_block, body) => feedbackDisplay(body));
@@ -121,7 +121,7 @@ const PASTED_LINES = /· (\d+) lines?$/;
 const PASTED_TEXT_MAX_BYTES = 1024 * 1024;
 /** Blob bytes one transcript load may read to count the lines of pastes
  *  whose stored name does not carry the count (pastes stored before it did). */
-export const PASTED_LINE_READ_BUDGET_BYTES = 4 * 1024 * 1024;
+const PASTED_LINE_READ_BUDGET_BYTES = 4 * 1024 * 1024;
 
 /** A stored plain-text prompt part's text within the load's byte budget, else ''. */
 function offloadedPromptText(part, budget) {

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -137,11 +137,9 @@ export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs('MIXDOG_PROVIDER_SS
 // silent-window token rate a steady ~92 tok/s, i.e. live generation, not a
 // wedge). So a "semantic-silent" stream is NOT necessarily dead.
 //
-// 2026-08-03 v3 postmortem: this window used to be DERIVED from the agent
-// stall budget (warn − tick ≈ 285s). A harness that tightened STALL_TIMEOUT_S
-// to 300s silently collapsed it to 135s, which deterministically beheaded
-// live long-thinking turns (regex-chess / circuit-fibsqrt: ttft ~1.5s, then
-// killed at exactly 135s of silent thinking, 4 attempts ≈ 552s per turn).
+// Deriving this window from the agent stall budget (warn − tick ≈ 285s) would
+// let a harness that tightens STALL_TIMEOUT_S to 300s collapse it to 135s,
+// which deterministically beheads live long-thinking turns.
 // Reference behavior: abort only after a 300s single-gap silence, and fall
 // back to non-streaming instead of killing the turn. The default is
 // therefore a FIXED 300s, decoupled from the warn math. The only remaining

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/backgrounded-result.mjs

@@ -1,4 +1,5 @@
 import { registerBackgroundTask, renderBackgroundTask } from '../../../../../shared/background-tasks.mjs';
+import { stampShellJobCycle } from '../../../../../shared/background-wait.mjs';
 import { killShellJob, watchBackgroundShellJob } from '../shell-jobs.mjs';
 import { renderBackgroundPartialOutput } from '../shell-output.mjs';
 import { readShellTaskOutput } from '../lib/shell-task-output.mjs';
@@ -65,7 +66,9 @@ export function renderBackgroundedResult({
 }) {
   let task = null;
   if (result.jobId) {
-    task = registerPromotedTask({ result, command, cwd, options, startedAtMs });
+    // The owner's user cycle at start decides whether it is waited on
+    // (background-wait.mjs), however the job reached the background.
+    task = stampShellJobCycle(registerPromotedTask({ result, command, cwd, options, startedAtMs }));
     try {
       watchBackgroundShellJob(result.jobId, {
         notifyFn: typeof options?.notifyFn === 'function' ? options.notifyFn : null,

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/misuse-guard.mjs

@@ -5,13 +5,16 @@
 //      to background + task wait);
 //   2. a plain leading `cd <dir>` moves into the `cwd` argument;
 //   3. a shell file read (cat/Get-Content/grep/ls …) gets a pointer to the
-//      read / grep / list tools — a note now, a rejection when the mode flips.
+//      read / grep / list tools — a note now, a rejection when the mode flips;
+//   4. a command mentioning `git … worktree add` is rejected (worktrees go
+//      through the git tool; a textual check, so mentions as data are too).
 import { shellSplitPipelineSegments, shellSplitSegments, shellTokenize } from '../shell-analysis.mjs';
 import { resolveShellFor } from '../shell-runtime.mjs';
 import { formatShellToolFailure } from './result-format.mjs';
+import { addsUnmanagedWorktree } from './worktree-add-guard.mjs';
 
 /** `warn` runs the read with a note; `reject` returns the block without running. */
-export const SHELL_FILE_READ_MODE = 'warn';
+const SHELL_FILE_READ_MODE = 'warn';
 export const SHELL_FILE_READ_NOTE = 'Note: use the read / grep / list tools for files instead of the shell.';
 const SHELL_FILE_READ_BLOCK =
   'Blocked: use read / grep / list for files instead of the shell (read takes offset/limit for a window of a large file).';
@@ -194,6 +197,20 @@ function detectShellFileRead(command, shellType) {
   return operands.length >= minOperands ? { tool, command: name } : null;
 }
 
+// ── 4. unmanaged worktrees ───────────────────────────────────────────────────
+
+// A worktree added from the shell is invisible to the managed cleanup and
+// outlives the session that made it, so `git … worktree add` never runs here.
+// The check is textual (worktree-add-guard.mjs): a command that only mentions
+// the phrase is refused too, so the message says how to go on either way.
+const SHELL_WORKTREE_ADD_BLOCK =
+  'Blocked: this shell command mentions `git … worktree add`, which does not run from the shell; ' +
+  'Mixdog manages worktrees so they are cleaned up. To create one, use the git tool: command ' +
+  '"git worktree add --detach <path> [<commit>]" makes a read-only snapshot (removed when the turn ends; ' +
+  'delegated workers too), and the Lead uses "git worktree add -b <branch> <path>" or action:"worktree" for a ' +
+  'branch worktree. The check is textual: to search for that text use the grep tool, and keep the phrase out ' +
+  'of shell commands (echo, commit messages, heredocs).';
+
 // ── the guard ────────────────────────────────────────────────────────────────
 
 /** The syntax family of the shell a call asks for (`args.shell`, as foreign adapters set it), else the default shell's. */
@@ -209,7 +226,7 @@ function recordFileRead(telemetry, entry) {
 }
 
 /**
- * Apply the three guards to a shell call.
+ * Apply the four guards to a shell call.
  * @returns {{ failure: string } | { args: object, notes: string[] }} the
  *   rejection, or the call to run (a leading `cd` moved into `cwd`) with the
  *   lines to add to its result.
@@ -230,6 +247,7 @@ export function guardShellCall(
     const sleepFailure = leadingSleepFailure(guarded.command, shellType);
     if (sleepFailure) return { failure: sleepFailure };
   }
+  if (addsUnmanagedWorktree(guarded.command)) return { failure: formatShellToolFailure(SHELL_WORKTREE_ADD_BLOCK) };
   const read = detectShellFileRead(guarded.command, shellType);
   if (read) {
     recordFileRead(telemetry, { mode: fileReadMode, tool: read.tool, command: read.command, agent, sessionId });

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/result-format.mjs

@@ -75,7 +75,7 @@ export function _finalizeShellResult(completedExit, text) {
 
 export function _shellFailureStatus(result, timeout) {
   // Prefer the signal reported by the process. `killed` is only a fallback
-  // for platforms (notably taskkill on Windows) that close without one.
+  // for platforms (notably a Windows tree kill) that close without one.
   const signal = result.signal || (result.killed ? 'SIGKILL' : null);
   const exitCode = signal ? null : result.exitCode;
   const shellToolFailed = result.failurePhase === 'tool' || !!result.outputCaptureError;

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/worktree-add-guard.mjs

@@ -0,0 +1,77 @@
+// Whether a shell command mentions `git … worktree add`. A worktree added from
+// the shell is invisible to the managed cleanup and outlives the session that
+// made it, so the shell guard refuses it and points to the git tool.
+//
+// Deliberately textual, conservative and linear-time: no shell is parsed. The
+// command is normalized once (escape and quote characters of every shell
+// dropped, whitespace collapsed; a PowerShell -EncodedCommand decoded), then
+// refused when `git` is followed anywhere later by `worktree … add`. Commands
+// that only mention the phrase as data (echo, grep, a heredoc, a commit
+// message) are refused too; the refusal says how to proceed.
+
+const QUOTES = /['"\u2018\u2019\u201a\u201b\u201c\u201d\u201e]/g;
+const GIT_WORD = /\bgit\b/i;
+// `worktree` ending a token that is not an option: `worktree`, `$(worktree`, `alias.wa=worktree`.
+const WORKTREE_TOKEN = /(?:^|[^\w-])worktree$/i;
+const ADD_TOKEN = /^add\b/i;
+// powershell/pwsh -EncodedCommand (any accepted prefix: -e, -ec, -enc, …) and its base64 argument.
+const ENCODED_COMMAND = /(?:^|[\s'"])[-/]e(?:c|n[a-z]*)?\s+['"]?([A-Za-z0-9+/]{4,}={0,2})/gi;
+
+/** The command with every shell's escapes and quotes dropped and whitespace collapsed.
+ *  `joiner` replaces a line continuation: '' as POSIX joins `a\<newline>dd` into one
+ *  word, ' ' where the continuation separates words. */
+function normalize(text, joiner) {
+  return (
+    text
+      .replace(/[\\`]\r?\n/g, joiner)
+      // Hex escapes ($'\x61dd', "\x61dd").
+      .replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)))
+      // The `$` of a POSIX $'…' / $"…" string.
+      .replace(/\$(?=['"])/g, '')
+      // PowerShell backtick and cmd caret escapes.
+      .replace(/[`^]/g, '')
+      .replace(QUOTES, '')
+      .replace(/\s+/g, ' ')
+  );
+}
+
+/** True when some `git` word comes before a `worktree … add` in `text`. One pass
+ *  over the tokens: options (`-…`) between `worktree` and `add` are skipped and
+ *  never start a match, so every token is visited once. */
+function gitThenWorktreeAdd(text) {
+  const tokens = text.split(/[\s,]+/);
+  let gitSeen = false;
+  for (let i = 0; i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (!gitSeen) {
+      gitSeen = GIT_WORD.test(token);
+      continue;
+    }
+    if (token.startsWith('-') || !WORKTREE_TOKEN.test(token)) continue;
+    let next = i + 1;
+    while (next < tokens.length && tokens[next].startsWith('-')) next += 1;
+    if (next < tokens.length && ADD_TOKEN.test(tokens[next])) return true;
+    i = next - 1;
+  }
+  return false;
+}
+
+/** True when `command` would (or might) run `git … worktree add`. */
+export function addsUnmanagedWorktree(command) {
+  const raw = String(command ?? '');
+  const texts = [raw];
+  for (const [, encoded] of raw.matchAll(ENCODED_COMMAND)) {
+    texts.push(Buffer.from(encoded, 'base64').toString('utf16le'));
+  }
+  return texts.some((text) =>
+    ['', ' '].some((joiner) => {
+      const normalized = normalize(text, joiner);
+      // A backslash is a POSIX escape (`a\dd` is `add`) or a Windows path separator
+      // (`C:\Git\cmd\git.exe`): both readings are checked.
+      return (
+        gitThenWorktreeAdd(normalized.replace(/\\(?=[A-Za-z])/g, '')) ||
+        gitThenWorktreeAdd(normalized.replaceAll('\\', '/'))
+      );
+    })
+  );
+}

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -32,7 +32,6 @@ export {
   SURVIVING_DESCENDANTS_WARNING,
   SURVIVING_DESCENDANTS_UNREACHABLE_WARNING,
   _backgroundResultLines,
-  getDedupedDestructiveWarnings,
   _placeDestructiveWarningsAfterStatus,
   formatShellToolFailure,
   _shellFailureStatus,

package/src/runtime/agent/orchestrator/tools/builtin/git-command-tool.mjs

@@ -98,7 +98,7 @@ export const GIT_TOOL_DEF = {
     openWorldHint: true,
     compressible: true,
   },
-  description: `${GIT_DESCRIPTION_HEAD} Worktrees are managed only: action:worktree; git worktree add/remove/list/prune map to managed operations (add -b keeps the session in place; add --detach makes a read-only snapshot worktree, removed when its turn ends; list --porcelain stays raw git; move/lock/unlock/repair are refused). Merge or remove only when the user asks.`,
+  description: `${GIT_DESCRIPTION_HEAD} Worktrees are managed only: action:worktree; git worktree add/remove/list/prune map to managed operations (add -b keeps the session in place; add --detach makes a read-only snapshot worktree, removed when its turn ends, and is the one add a delegated worker may run; list --porcelain stays raw git; move/lock/unlock/repair are refused). Merge or remove only when the user asks.`,
   inputSchema: {
     type: 'object',
     properties: {
@@ -144,7 +144,10 @@ export const GIT_TOOL_DEF = {
         description: 'enter/return/merge/remove: another session (it must be idle); default the caller.',
       },
       name: { type: 'string', description: 'enter: the new worktree name (branch <prefix><name>).' },
-      branch: { type: 'string', description: 'enter: use the worktree of this branch instead.' },
+      branch: {
+        type: 'string',
+        description: "enter: use the worktree of this branch instead. remove: this session's worktree of that branch.",
+      },
       create: { type: 'boolean', description: 'enter with branch: create that branch.' },
       carry: {
         type: 'string',
@@ -580,7 +583,8 @@ function commandFailure(plan, result, limit = GIT_OUTPUT_LINES_DEFAULT) {
 function runGit(plan, argv, options = {}) {
   return startGit(
     gitToolEnvironment(!options.readOnly),
-    (command, env) => runProcess(command, [...plan.globalArgs, ...argv], { cwd: plan.cwd, signal: options.signal, env }),
+    (command, env) =>
+      runProcess(command, [...plan.globalArgs, ...argv], { cwd: plan.cwd, signal: options.signal, env }),
     (result) => result.error
   );
 }

package/src/runtime/agent/orchestrator/tools/builtin/git-worktree-tool.mjs

@@ -15,7 +15,9 @@
  *
  * Every operation but `list` belongs to the Lead: the session runtime that
  * hosts the caller registers its host (shared/worktrees/tool-host.mjs); a
- * caller no host claims (a delegated worker) is refused.
+ * caller no host claims (a delegated worker) is refused, except for a
+ * read-only `add --detach` snapshot held by its own session and removed when
+ * its turn settles (shared/worktrees/worker-snapshots.mjs).
  */
 import { basename, resolve } from 'node:path';
 import { isPlainObject } from '../../../../shared/object.mjs';
@@ -23,6 +25,7 @@ import { WORKTREE_REFUSAL_REASONS } from '../../../../shared/worktrees/contract.
 import { firstLine, listWorktrees, runGit } from '../../../../shared/worktrees/git.mjs';
 import { canonicalPath, samePath } from '../../../../shared/worktrees/paths.mjs';
 import { worktreeToolHost } from '../../../../shared/worktrees/tool-host.mjs';
+import { createWorkerSnapshot } from '../../../../shared/worktrees/worker-snapshots.mjs';
 
 export const WORKTREE_TOOL_ACTIONS = Object.freeze(['enter', 'return', 'merge', 'remove', 'list', 'prune']);
 const CARRY_CHOICES = ['leave', 'carry'];
@@ -327,7 +330,12 @@ async function rawAdd(plan, input, options) {
   const [path, commitish = null] = positional;
   if (!path || positional.length > 2) throw new Error('git worktree add requires <path> [<commit-ish>]');
   if (detach && branch) throw new Error('git worktree add: --detach excludes -b/-B');
-  const host = leadHost(options, 'git worktree add');
+  const host = worktreeToolHost(options?.sessionId);
+  if (!host && !detach) {
+    throw new Error(
+      'git worktree add belongs to the Lead session; a delegated worker may only make a read-only snapshot: git worktree add --detach <path> [<commit>]'
+    );
+  }
   const repo = await repositoryAt(plan.cwd);
   if (!repo) throw new Error(`git worktree add: ${plan.cwd} is not a git repository`);
   const confirmLarge = input.confirm_large === true;
@@ -340,11 +348,16 @@ async function rawAdd(plan, input, options) {
   if (snapshotCommit) {
     const commit = await commitIn(plan.cwd, snapshotCommit);
     if (!commit) throw new Error(`git worktree add: ${snapshotCommit} is not a commit`);
-    const entry = await runOn(
-      host,
-      { op: 'snapshot', commit, confirmLarge, txId, repoCommonDir: repo.repoCommonDir },
-      options
-    );
+    // A delegated worker's snapshot is held by its own session and removed when its turn settles.
+    const entry = host
+      ? await runOn(host, { op: 'snapshot', commit, confirmLarge, txId, repoCommonDir: repo.repoCommonDir }, options)
+      : await createWorkerSnapshot({
+          sessionId: options?.sessionId,
+          projectPath: plan.cwd,
+          commit,
+          txId,
+          confirmLarge,
+        });
     return okJson({
       ...mapped,
       snapshot: true,
@@ -512,7 +525,7 @@ function worktreeInputError(input) {
   const misplaced =
     only('session_id', ['enter', 'return', 'merge', 'remove']) ||
     only('name', ['enter']) ||
-    only('branch', ['enter']) ||
+    only('branch', ['enter', 'remove']) ||
     only('create', ['enter']) ||
     only('carry', ['enter']) ||
     only('confirm_large', ['enter']) ||
@@ -529,6 +542,9 @@ function worktreeInputError(input) {
     return 'branch excludes name and carry (the branch names the worktree; changes stay in the project folder)';
   }
   if (input.carry !== undefined && !CARRY_CHOICES.includes(input.carry)) return 'carry must be leave or carry';
+  if (action === 'remove' && input.branch !== undefined && input.session_id !== undefined) {
+    return "branch names one of this session's own worktrees; it excludes session_id";
+  }
   return null;
 }
 
@@ -554,7 +570,9 @@ export async function executeWorktreeAction(input, workDir, options = {}) {
             confirmLarge: input.confirm_large === true,
           }
         : {}),
-      ...(action === 'remove' ? { force: input.force === true } : {}),
+      ...(action === 'remove'
+        ? { force: input.force === true, ...(input.branch?.trim() ? { branch: input.branch.trim() } : {}) }
+        : {}),
       ...(action === 'prune'
         ? { repoCommonDir: (await repositoryAt(resolve(workDir || process.cwd())))?.repoCommonDir ?? null }
         : {}),

package/src/runtime/agent/orchestrator/tools/builtin/lib/search-input-helpers.mjs

@@ -34,7 +34,7 @@ export function uniqueStrings(values) {
   return Array.from(new Set(values.filter((value) => typeof value === 'string' && value)));
 }
 
-export function coerceNonNegInt(value) {
+function coerceNonNegInt(value) {
   if (value === undefined || value === null || value === '') return null;
   const n = Number(value);
   if (!Number.isFinite(n) || n < 0) return NaN;
@@ -49,7 +49,7 @@ export function stringList(value) {
 
 // head_limit shared by the single-path flow and the path[] fan-out:
 // absent → the default cap, 0 → unlimited, otherwise the coerced integer.
-export function resolveHeadLimit(coerced, defaultLimit) {
+function resolveHeadLimit(coerced, defaultLimit) {
   if (coerced === null) return defaultLimit;
   return coerced === 0 ? Infinity : coerced;
 }

package/src/runtime/agent/orchestrator/tools/builtin/read-range-index.mjs

@@ -293,7 +293,7 @@ function requestReadRangeIndexPersist(key, job) {
   })();
 }
 
-export function scheduleReadRangeIndexPersist(index) {
+function scheduleReadRangeIndexPersist(index) {
   if (!READ_RANGE_INDEX_DISK_DIR || !currentReadRangeIndex(index)) return;
   const key = canonicalCachePath(index.fullPath);
   const inflight = READ_RANGE_INDEX_INFLIGHT.get(key);

package/src/runtime/agent/orchestrator/tools/builtin/read-single-fast-paths.mjs

@@ -11,7 +11,6 @@ import { invalidateBuiltinResultCache } from './cache-layers.mjs';
 import { getReadSnapshot } from './read-snapshot-runtime.mjs';
 import { snapshotCoversFullFile, statMatchesSnapshot } from './snapshot-helpers.mjs';
 import { canCacheReadFile, READ_PREFIX_HASH_BYTES } from './read-cache-policy.mjs';
-export { READ_PREFIX_HASH_BYTES } from './read-cache-policy.mjs';
 
 // A mutation snapshot claims the full file because it knows the bytes it
 // wrote; it proves the session holds the body only when bodyDelivered says so.

package/src/runtime/agent/orchestrator/tools/builtin/search-tool.mjs

@@ -1,12 +1,2 @@
-export {
-  _suggestIndexedPaths,
-  basePathDiagnostic,
-  buildNotFoundHint,
-  isUncOrSmbPath,
-  relativePathPrefix,
-  relativeSearchResultPath,
-  resolveSearchScope,
-  uncRefusalMessage,
-} from './search-path-diagnostics.mjs';
 export { executeGrepTool } from './search-grep-tool.mjs';
 export { executeGlobTool } from './search-glob-tool.mjs';

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -209,8 +209,7 @@ async function trackShellJobRecord(task, options) {
     // settle does. A killed one relies on the snapshot taken before the kill.
     const killed = entry.killed || detail.killed || detail.timedOut || String(detail.status) === 'cancelled';
     if (!killed) tracker.acceptExitObservation();
-    const watched =
-      contained && (killed || detail.treeOutcome === 'empty') ? containedJobTracker(jobId) : tracker;
+    const watched = contained && (killed || detail.treeOutcome === 'empty') ? containedJobTracker(jobId) : tracker;
     // The completion notice is already on its way (watchBackgroundShellJob);
     // the record — and with it the workspace admission — completes only once
     // every process is confirmed gone, or the user releases it explicitly.

package/src/runtime/agent/orchestrator/tools/builtin.mjs

@@ -97,30 +97,12 @@ import {
   streamSmartReadSummary as _streamSmartReadSummaryImpl,
 } from './builtin/read-streaming.mjs';
 export {
-  coerceShapeFlex,
   normalizeInputPath,
   normalizeOutputPath,
-  posixPathToWindowsPath,
   resolveAgainstCwd,
-  toDisplayPath,
 } from './builtin/path-utils.mjs';
-export {
-  buildGlobCacheKey,
-  buildGrepCacheKey,
-  buildGrepRgArgs,
-  buildListCacheKey,
-} from './builtin/search-builders.mjs';
-export {
-  analyzeShellCommandEffects,
-  preflightShellLargeFileProbe,
-} from './builtin/shell-analysis.mjs';
-export { BUILTIN_TOOLS } from './builtin/builtin-tools.mjs';
 export { withBuiltinPathLocks } from './builtin/path-locks.mjs';
-export {
-  getCachedReadOnlyStat,
-  invalidateBuiltinResultCache,
-} from './builtin/cache-layers.mjs';
-export { atomicWrite } from './builtin/atomic-write.mjs';
+export { invalidateBuiltinResultCache } from './builtin/cache-layers.mjs';
 // User-cwd persistence hook: writes user-cwd.txt on SessionStart so
 // the MCP server (spawned from cache dir) resolves the correct sandbox root.
 // Helper extracted to src/shared/user-cwd.mjs so server-main.mjs can import
@@ -616,8 +598,3 @@ export function clearReadSnapshotForPath(fullPath, _scope) {
     _deleteReadSnapshotPathEverywhere(fullPath);
   } catch {}
 }
-
-// Re-export from the side-effect-free code-graph definition source so callers that already import other
-// helpers from builtin.mjs (result-compression.mjs) can pick up the tool
-// def list from the same module without a parallel path.
-export { CODE_GRAPH_TOOL_DEFS } from './code-graph-tool-defs.mjs';

package/src/runtime/agent/orchestrator/tools/code-graph/graph-binary/child-kill.mjs

@@ -1,6 +1,7 @@
 // Kill escalation for a spawned native child: SIGTERM first, then after a
-// grace period a forced kill (taskkill /t /f on Windows, SIGKILL elsewhere).
-import { spawn } from 'node:child_process';
+// grace period a forced kill (the shared creation-checked tree kill on
+// Windows, SIGKILL elsewhere).
+import { spawnTreeKill } from '../../../mcp/child-tree.mjs';
 
 const KILL_GRACE_MS = 3000;
 
@@ -14,7 +15,7 @@ export function createChildKiller(proc) {
     if (!pid) return;
     try {
       if (process.platform === 'win32') {
-        spawn('taskkill', ['/pid', String(pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore' });
+        spawnTreeKill([pid], { root: proc });
       } else {
         try {
           proc.kill('SIGKILL');

package/src/runtime/agent/orchestrator/tools/code-graph/graph-binary.mjs

@@ -23,8 +23,7 @@ function _graphBinaryPath() {
   const moduleDir = dirname(fileURLToPath(import.meta.url));
   const binName = process.platform === 'win32' ? 'mixdog-graph.exe' : 'mixdog-graph';
   // Prefer a local cargo build, then a previously fetched/cached prebuilt.
-  // This module is one dir deeper than the legacy code-graph.mjs, so the
-  // relative walk to repo-root native/ needs six `../` hops
+  // The relative walk to repo-root native/ needs six `../` hops
   // (code-graph → tools → orchestrator → agent → runtime → src → root).
   const localBuild = pathResolve(moduleDir, '../../../../../../native/mixdog-graph/target/release', binName);
   if (existsSync(localBuild)) return localBuild;

package/src/runtime/agent/orchestrator/tools/code-graph/modes/calls.mjs

@@ -128,7 +128,7 @@ export async function callers(ctx) {
   const depth = Math.max(1, Math.min(5, Math.floor(Number(args?.depth) || 1)));
   if (depth > 1) {
     // Scope and limit are honoured at every level: a file/directory anchor
-    // and an explicit limit used to be dropped for depth>1.
+    // and an explicit limit apply for depth>1 too.
     return _formatTransitiveCallers(graph, symbol, cwd, {
       language: lang,
       depth,

package/src/runtime/agent/orchestrator/tools/code-graph/modes/symbols.mjs

@@ -132,8 +132,8 @@ export async function symbolSearch(ctx) {
   if (!keywords.length) throw new Error('code_graph symbol_search: "symbol" (or "symbols[]") is required.');
   // Native graph symbols answer without source text at all: nodes without
   // them have no keyword matches to contribute, so nothing is read here.
-  // Honour the file/directory anchor: symbol_search used to scan the whole
-  // graph even when the caller scoped the call.
+  // Honour the file/directory anchor: a scoped symbol_search must not scan
+  // the whole graph.
   if (rel && !node) return fileNotFound('symbol_search', ctx);
   const search = (kw) => _searchSymbolsByKeyword(graph, kw, cwd, { language, limit, fileRel: rel, scopeRelPrefix });
   if (keywords.length === 1) return search(keywords[0]);

package/src/runtime/agent/orchestrator/tools/code-graph/search.mjs

@@ -407,12 +407,11 @@ export function _findSymbolHits(graph, symbol, { language = null } = {}) {
   return _findSymbolHitsOnNodes(graph, cleanSymbol, candidateNodes, { language });
 }
 
-// Declarations come from the native record ONLY. The regex declaration
-// matchers that used to run for files without symbols are gone: they marked
+// Declarations come from the native record ONLY. A regex fallback would mark
 // `declarationLike` on lines the extractor never called a declaration, so the
-// hit ranking (and, through it, the caller/callee anchors) depended on which
-// path produced the hit. A file with no symbols still yields reference hits —
-// it just declares nothing.
+// hit ranking (and, through it, the caller/callee anchors) would depend on
+// which path produced the hit. A file with no symbols still yields reference
+// hits — it just declares nothing.
 function _findSymbolHitsOnNodes(graph, cleanSymbol, candidateNodes, { language = null } = {}) {
   if (!cleanSymbol) return [];
   const escaped = _escapeRegExp(cleanSymbol);

package/src/runtime/agent/orchestrator/tools/code-graph/symbol-index.mjs

@@ -5,10 +5,9 @@
 // Symbols and tokens have NO text fallback. `node.symbols` (record v2:
 // {name, kind, startLine, endLine, startCol, endCol, exported?, sig?, parent?})
 // and `node.tokenSymbols` are the only sources; a node that carries neither
-// contributes nothing to an outline or a candidate set. The cheap regex outline
-// matchers and the JS identifier re-tokenizer that used to stand in for them
-// are gone — they disagreed with the extractor, so an answer's content depended
-// on which of the two produced it.
+// contributes nothing to an outline or a candidate set. A regex outline or JS
+// identifier re-tokenizer would disagree with the extractor, so an answer's
+// content would depend on which of the two produced it.
 import { _langUsesDollarInIdentifiers, _langAllowsBangQuestionSuffix } from './lang-predicates.mjs';
 import { EXTRACTION_SYMBOL_LANGS } from './constants.mjs';
 import { _getSourceTextForNode, _graphRel } from './source-access.mjs';

package/src/runtime/agent/orchestrator/tools/code-graph.mjs

@@ -4,35 +4,17 @@
 // build, search, dispatch).
 //
 // Public surface:
-//   markCodeGraphDirtyPaths, CODE_GRAPH_TOOL_DEFS,
-//   _pruneCodeGraphMemoryCache, _pruneCodeGraphManifestForBudget,
-//   drainCodeGraphCache, prewarmCodeGraph, prewarmCodeGraphSymbols,
-//   prewarmCodeGraphIfProject, buildCodeGraphAsync, _lookupCandidateNodes,
-//   _buildCodeGraph and _postCodeGraphWorkerSuccess (worker-only),
-//   executeCodeGraphTool, isCodeGraphTool.
+//   prewarmCodeGraphIfProject (read through the lazy module namespace in
+//   session-runtime/prewarm), _buildCodeGraph and _postCodeGraphWorkerSuccess
+//   (worker-only), executeCodeGraphTool.
 //
 // NOTE: code-graph-prewarm-worker.mjs imports { _buildCodeGraph } from THIS
 // facade; the facade re-exports it from ./code-graph/build.mjs, and the async
 // build path spawns that worker via a path RELATIVE to build.mjs — so no
 // module dynamically imports its own path.
-export { markCodeGraphDirtyPaths } from './code-graph-state.mjs';
-export { CODE_GRAPH_TOOL_DEFS } from './code-graph-tool-defs.mjs';
-
-export { _pruneCodeGraphMemoryCache } from './code-graph/memory-cache.mjs';
 export {
-  _pruneCodeGraphManifestForBudget,
-  drainCodeGraphCache,
-} from './code-graph/disk-cache.mjs';
-export { _lookupCandidateNodes } from './code-graph/symbol-index.mjs';
-export {
-  prewarmCodeGraph,
-  prewarmCodeGraphSymbols,
   prewarmCodeGraphIfProject,
-  buildCodeGraphAsync,
   _buildCodeGraph,
   _postCodeGraphWorkerSuccess,
 } from './code-graph/build.mjs';
-export {
-  executeCodeGraphTool,
-  isCodeGraphTool,
-} from './code-graph/dispatch.mjs';
+export { executeCodeGraphTool } from './code-graph/dispatch.mjs';

package/src/runtime/agent/orchestrator/tools/lib/shell-descendants.mjs

@@ -242,8 +242,8 @@ export function createContainedTreeTracker({ outcome, cancel }) {
  *  excepted: they are witnesses, never workers). These are processes of a tree
  *  that was KILLED — they escaped its process group (setsid, job control, a
  *  double fork that kept its parent link) or outlived the root on Windows —
- *  so the kill is not finished while they run. Windows: taskkill /T /F;
- *  POSIX: SIGTERM, then SIGKILL after a short grace. */
+ *  so the kill is not finished while they run. Windows: taskkill /F of each
+ *  and its descendants; POSIX: SIGTERM, then SIGKILL after a short grace. */
 export function sweepLiveIdentities(tracker) {
   const targets = tracker.live
     .filter((entry) => entry.token != null && !CONSOLE_HOST.test(entry.name))

package/src/runtime/agent/orchestrator/tools/lib/shell-run-state.mjs

@@ -58,7 +58,7 @@ export function registerForegroundOwnedTree(run, ownerSessionId) {
 }
 
 // Treekill + exit confirmation. treeKill alone leaves settle() pending on
-// 'close'/'exit'; on Windows a taskkill miss or a grandchild holding stdio
+// 'close'/'exit'; on Windows a missed tree kill or a grandchild holding stdio
 // fds keeps the dispatch stalled until the upstream ceiling. Covers every
 // kill path (timeout / pre-aborted / abort / capture-error / size-watchdog)
 // so the hang risk does not live on outside the timeout branch.

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -21,10 +21,6 @@ import { spawnShellChild } from './lib/shell-run-spawn.mjs';
 import { createPromotedCaptureRelease, createSettle } from './lib/shell-run-settle.mjs';
 import { _abortReasonIsInterrupt, createAutoBackground } from './lib/shell-run-background.mjs';
 
-export {
-  _maybeEncodePowerShellCommand,
-  extractPowerShellCommandInner,
-} from './shell-powershell.mjs';
 export { stripAnsi, ExecResult } from './shell-exec-output.mjs';
 
 async function _execPolicyBlockMessage(command, elevationApproved = false) {

package/src/runtime/agent/orchestrator/tools/shell-policy.mjs

@@ -1,5 +1,4 @@
 import { isDangerousDeleteTarget as _isDangerousDeleteTarget } from './shell-policy-danger-target.mjs';
-export { isDangerousDeleteTarget } from './shell-policy-danger-target.mjs';
 // Shell execution security policy — shared constants used by both
 // destructive-warning.mjs (heuristic classifier) and the shell command
 // runner (hard block list).