opencode-dejavu 2.7.0 → 2.27.0

package/src/patterns.ts

@@ -47,6 +47,26 @@ export function scrubSecrets(text: string): string {
   return s
 }
 
+/**
+ * Terminal control characters (PowerShell VT-colored errors, bells, NULs)
+ * carry no signal — persisted they corrupt snippets/corrections with raw
+ * escape sequences (`ESC[31;1m...`) and fragmented identities when the
+ * coloring varies between runs. ANSI sequences first (they end in a letter,
+ * which bare C0 stripping would strand), then all C0 except LF/CR/TAB —
+ * those three carry structure (multi-line commands, indentation).
+ */
+export function stripControl(text: string): string {
+  return text
+    .replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, "")
+    .replace(/\u001b./g, "")
+    .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "")
+}
+
+/** The persistence boundary: control-char strip + secret scrub, in one call. */
+export function sanitizeForStore(text: string): string {
+  return scrubSecrets(stripControl(text))
+}
+
 // --- Normalization -----------------------------------------------------------
 
 /**
@@ -56,12 +76,28 @@ export function scrubSecrets(text: string): string {
  * payload instead: same code = same key, different code = different key.
  * Secrets are scrubbed before hashing so they neither persist nor fragment.
  */
+/**
+ * PowerShell shapes included: call operator + QUOTED exe path
+ * (`& "C:\...\python.exe" -c ...`) and bare interpreter alike. The quoted
+ * path needs the quote in the prefix class and an optional closing quote,
+ * otherwise `-c` never lines up and the payload escapes fingerprinting.
+ * Leading env assignments (`PYTHONPATH=x python -c ...`) are allowed in the
+ * anchor and stay in the prefix — without them the one-liner escaped
+ * fingerprinting entirely. Flag alternatives run LONGEST FIRST: regex
+ * alternatives are ordered, and `-c` matching inside `-command` swallowed
+ * `ommand` into the payload — fragmenting keys across spellings of the same
+ * call. `py` is the Windows Python launcher (`py -3 -c ...`).
+ */
 const INTERPRETER_ONELINER =
-  /(?:^|[|;&(\n]\s*)(?:\S+[\\/])?(python3?|node|bun|deno|perl|ruby|pwsh|powershell)(?:\.exe)?(?:\s+-\w+)*\s+(-c|-e|--eval|-command)\s*/i
+  /(?:^|[|;&(\n]\s*)(?:\w+=\S+\s+)*(?:["']?\S*[\\/])?(python3?|py|node|bun|deno|perl|ruby|pwsh|powershell)(?:\.exe)?["']?(?:\s+-\w+)*\s+(-command|-encodedcommand|--eval|-c|-e)\s*/i
 
 function hashInterpreterPayload(command: string): string {
   const match = INTERPRETER_ONELINER.exec(command)
   if (!match) return command
+  // PowerShell here-string payloads (`@"..."@` / `@'...'@`) — the wrapper
+  // markers are part of the payload and hash with it. Previously the `@`
+  // markers survived normalization and the quoted body collapsed to <str>,
+  // leaving raw code tokens leaking into signatures when quotes unbalanced.
   const payload = command.slice(match.index + match[0].length)
   if (payload.trim() === "") return command
   // Already fingerprinted (re-normalization) — keep the existing token so
@@ -75,7 +111,40 @@ function hashInterpreterPayload(command: string): string {
   // Trim before hashing: trailing whitespace (e.g. a stripped override marker)
   // is not part of the code's identity.
   const fingerprint = createHash("sha1").update(scrubSecrets(payload.trim())).digest("hex").slice(0, 8)
-  return `${command.slice(0, match.index + match[0].length)}<code:${fingerprint}>`
+  // Long PowerShell flags converge to -c: `-command`/`-encodedcommand` are
+  // spellings of the same one-liner call — one identity, not three families.
+  const prefix = command.slice(0, match.index + match[0].length).replace(/-(?:command|encodedcommand)(\s*)$/i, "-c$1")
+  return `${prefix}<code:${fingerprint}>`
+}
+
+/**
+ * Windows wrapper verb: `cmd /c "real command"` — the payload IS the call.
+ * Unwrapped, the payload normalizes with its own identity and its real verb
+ * stays visible to the diagnostic policy; left wrapped, `/c` becomes `<path>`
+ * and the payload becomes `<str>`, so `cmd <path> <str>` matched every cmd
+ * invocation on the machine. Recursion terminates: the payload is strictly
+ * shorter than the wrapper command.
+ */
+const CMD_WRAPPER = /^cmd(?:\.exe)?\s+(?:\/s\s+)?\/(c|k)\s+/i
+
+/**
+ * Raw payload of a `cmd /c|/k` wrapper, one wrapper-quote layer removed —
+ * null when the command is not wrapped. Shared by normalization (unwrap),
+ * segment expansion (inner chains) and override-marker visibility.
+ */
+export function cmdWrapperPayload(command: string): string | null {
+  const match = CMD_WRAPPER.exec(command)
+  if (!match) return null
+  let payload = command.slice(match[0].length).trim()
+  if ((payload.startsWith('"') && payload.endsWith('"') && payload.length >= 2) || (payload.startsWith("'") && payload.endsWith("'") && payload.length >= 2)) {
+    payload = payload.slice(1, -1).trim()
+  }
+  return payload === "" ? null : payload
+}
+
+function unwrapCmdWrapper(command: string): string {
+  const payload = cmdWrapperPayload(command)
+  return payload === null ? command : normalizeCommand(payload)
 }
 
 /**
@@ -84,10 +153,14 @@ function hashInterpreterPayload(command: string): string {
  * away so that "same failure, different instance" collapses into one pattern.
  */
 export function normalizeCommand(command: string): string {
+  // Terminal control characters (PowerShell VT colors) carry no identity and
+  // fragmented signatures when coloring varied between runs — strip first.
+  let s = stripControl(command)
   // CRLF/CR commands (Windows pastes, agent multi-line) normalize to LF —
   // otherwise the same command fragments across line-ending styles.
-  let s = command.replace(/\r\n?/g, "\n")
+  s = s.replace(/\r\n?/g, "\n")
   s = s.replace(COMMENT_LINE, "$1").toLowerCase()
+  s = unwrapCmdWrapper(s)
   s = hashInterpreterPayload(s)
   // Quoted spans come out FIRST: they are data, and removing them before the
   // path rules keeps normalization idempotent — a <str> replacement inserts
@@ -124,7 +197,7 @@ const PARAM_RULES: [RegExp, string][] = [
 ]
 
 export function parameterizeError(text: string): string {
-  let s = text.toLowerCase()
+  let s = stripControl(text).toLowerCase()
   for (const [rule, token] of PARAM_RULES) {
     s = s.replace(rule, token)
   }
@@ -142,14 +215,36 @@ export function parameterizeError(text: string): string {
 const DIAGNOSTIC_VERBS: RegExp[] = [
   /(^|[\s|;&:])(grep|rg|findstr|select-string)\b/i,
   /\bgit grep\b/i,
+  // Read-only git inspectors are diagnostics like `git grep`: their exit 1 is
+  // usually a downstream filter finding nothing (`git show … | Select-String`),
+  // not a mistake. Real git errors exit >= 2 and still count.
+  /\bgit\s+(show|log|status|ls-tree|ls-files|blame|diff)\b/i,
   /(^|[\s|;&:])diff\b/i,
   /\b(pytest|jest|vitest|mocha|cucumbertest)\b/i,
+  // npm/yarn/pnpm test / typecheck / lint scripts are iteration work — their
+  // exit 1 is "tests failed / types wrong / lint found issues", not an
+  // infrastructure error. The second rule covers flags between the package
+  // manager and the verb (e.g. `pnpm --filter <pkg> typecheck`).
+  /\b(npm|pnpm|yarn) (run )?(test|typecheck|lint)\b/i,
+  /\b(npm|pnpm|yarn)\b[^\n;|&]*\b(typecheck|lint)\b/i,
+  // `npm run check:*` / `verify:*` scripts are iteration work like test/lint —
+  // their exit 1 is "found issues", not an infrastructure error.
+  /\b(npm|pnpm|yarn|bun) (run )?(check|verify)\b/i,
   /\bplaywright test\b/i,
   /\bflutter (test|analyze)\b/i,
   /\bdart (analyze|format|fix)\b/i,
+  // Iteration runners: `dart run <script>`, `go run|build`, `cargo run|build`
+  // fail repeatedly WHILE the agent fixes the code — the failures are the
+  // work itself. Blocking them produced arms races (dozens of overrides in
+  // production data); they remind but never block, and their exit 1 is the
+  // intended "still broken" outcome of iteration.
+  /\bdart run\b/i,
+  /\bgo (run|build|test|vet)\b/i,
+  /\bcargo (run|build|test|clippy)\b/i,
   /\bgradlew\b[^\n;|&]*(test|compilejava|compiletestjava)/i,
   /\b(eslint|prettier --check)\b/i,
   /\btsc\b/i,
+  /\bmypy\b/i,
   /\bcurl\b/i,
   /\bls\b/i,
 ]
@@ -162,40 +257,323 @@ export function isDiagnosticSignature(signature: string): boolean {
   return isDiagnosticText(signature)
 }
 
-/** OpenCode normalizes non-zero exits to 1 in metadata, so discriminate by command shape. */
+/** Pipeline formatters shape output but are never the failing producer WHEN
+ * they are a pipe tail: PowerShell cmdlets don't set `$LASTEXITCODE` (it stays
+ * with the producing native command), and unix head/tail/column/uniq tails exit
+ * 0 on piped input. So piping a diagnostic into one (`tsc | Select-Object -Last
+ * 5`, `vitest | head -5`) must not break the diagnostic's exit-1 immunity.
+ * Position matters: a formatter standing alone or as the TERMINAL producer of a
+ * sequence (`npm test && tail -5 missing.log`) IS the failing producer — its
+ * exit must still count. isIntendedNonzero only grants the transparency to
+ * segments splitChainTagged marks as pipe tails. */
+const PIPE_FORMATTERS =
+  /^\s*(select-object|sort-object|format-table|format-list|format-wide|format-custom|out-string|out-host|out-null|tee-object|foreach-object|where-object|measure-object|group-object|convertto-json|convertfrom-json|head|tail|column|uniq|tee)\b/i
+/** Navigation changes directory, never the outcome — `cd X && <diagnostic>`
+ * must not lose the diagnostic's exit-1 immunity to the `cd` segment. */
+const NAVIGATION_VERBS = /^\s*(cd|set-location|pushd|popd)\b/i
+/** Pure environment assignments (`$env:CI="true"`, `FOO=bar`) and sleeps only
+ * prepare the session — they are never the failing producer, so they are
+ * transparent to exit-1 immunity and chain attribution like navigation. */
+const ENV_ASSIGNMENT_SEGMENT = /^\s*(?:\$env:)?[a-z_][a-z0-9_]*\s*=\s*(?:"[^"]*"|'[^']*'|\S+)\s*$/i
+const INERT_VERBS = /^\s*start-sleep\b/i
+
+/** Flatten subshell parens to `;` segment separators, but ONLY outside `{}`
+ * script blocks and quotes. `(deploy && grep)` must split (a diagnostic inside
+ * parens must not blanket-immunize a non-diagnostic verb), but method-call
+ * parens inside a PowerShell script block (`ForEach-Object { $_.trim() }`) are
+ * part of that segment and must NOT split it. */
+function flattenSubshellParens(command: string): string {
+  let result = ""
+  let quote: string | null = null
+  let braceDepth = 0
+  for (let i = 0; i < command.length; i++) {
+    const ch = command.charAt(i)
+    if (quote !== null) {
+      result += ch
+      if (ch === quote) quote = null
+      continue
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch
+      result += ch
+      continue
+    }
+    if (ch === "{") {
+      braceDepth += 1
+      result += ch
+      continue
+    }
+    if (ch === "}") {
+      braceDepth = Math.max(0, braceDepth - 1)
+      result += ch
+      continue
+    }
+    if ((ch === "(" || ch === ")") && braceDepth === 0) {
+      result += ";"
+      continue
+    }
+    result += ch
+  }
+  return result
+}
+
+/** Like splitChain but tags each segment with whether it immediately follows a
+ * pipe (`|`). Formatter transparency is position-dependent (pipe tail only), so
+ * the immunity check needs this. `||` is a sequence (OR) separator, not a pipe:
+ * the segment after it is a producer, NOT a pipe tail. */
+function splitChainTagged(command: string): Array<{ text: string; pipeTail: boolean }> {
+  const segments: Array<{ text: string; pipeTail: boolean }> = []
+  let current = ""
+  let quote: string | null = null
+  let depth = 0
+  let pipeTail = false
+  const flush = (): void => {
+    const trimmed = current.trim()
+    if (trimmed !== "") segments.push({ text: trimmed, pipeTail })
+    current = ""
+  }
+  let i = 0
+  while (i < command.length) {
+    const ch = command.charAt(i)
+    const next = command.charAt(i + 1)
+    if (quote !== null) {
+      current += ch
+      if (ch === quote) quote = null
+      i += 1
+      continue
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch
+      current += ch
+      i += 1
+      continue
+    }
+    if (ch === "(") {
+      depth += 1
+      current += ch
+      i += 1
+      continue
+    }
+    if (ch === ")") {
+      depth = Math.max(0, depth - 1)
+      current += ch
+      i += 1
+      continue
+    }
+    if (depth === 0) {
+      if (ch === ";" || ch === "\n" || ch === "\r") {
+        flush()
+        pipeTail = false
+        i += 1
+        continue
+      }
+      if (ch === "&" && next === "&") {
+        flush()
+        pipeTail = false
+        i += 2
+        continue
+      }
+      if (ch === "|") {
+        flush()
+        if (next === "|") {
+          // `||` is a sequence (OR) separator — next segment is a producer.
+          pipeTail = false
+          i += 2
+        } else if (next === "&") {
+          // `|&` is bash's pipe-stdout-and-stderr — still a pipe, next is a tail.
+          pipeTail = true
+          i += 2
+        } else {
+          pipeTail = true
+          i += 1
+        }
+        continue
+      }
+    }
+    current += ch
+    i += 1
+  }
+  flush()
+  return segments
+}
+
+/**
+ * OpenCode normalizes non-zero exits to 1 in metadata, so discriminate by
+ * command shape. Exit-1 immunity requires EVERY producer segment to be
+ * diagnostic: in `deploy --broken && grep done log.txt` the exit is deploy's
+ * failure — granting immunity because grep appears later would hide it.
+ * Two segment kinds are transparent because they cannot be the failing
+ * producer: navigation (`cd`) — but ONLY when the segment is pure navigation,
+ * so `cd <path> npx vitest run` (no separator) keeps the diagnostic instead of
+ * being dropped wholesale — and pipe formatters, but the latter ONLY as a pipe
+ * tail. A formatter standing alone or as the terminal producer of a sequence
+ * (`npm test && tail -5 missing.log`) IS the producer, so its failure still
+ * counts. A real non-diagnostic command still breaks immunity — `npm install |
+ * select-object` still counts (npm install is not a diagnostic).
+ * Subshell paren groups are flattened to segment separators (`;`), NOT spaces,
+ * and only OUTSIDE `{}` script blocks: `(deploy && grep)` splits so a
+ * diagnostic nested in parens can't blanket-immunize a non-diagnostic verb,
+ * while method-call parens inside a script block (`ForEach-Object { $_.trim()
+ * }`) stay part of their segment and don't split it.
+ */
 export function isIntendedNonzero(command: string, exitCode: number): boolean {
-  return exitCode === 1 && isDiagnosticText(command)
+  if (exitCode !== 1) return false
+  let sawProducer = false
+  for (const { text, pipeTail } of splitChainTagged(flattenSubshellParens(command))) {
+    // Navigation is transparent only when it is PURE navigation. A segment that
+    // pairs a navigation verb with a diagnostic and no separator between them
+    // (`cd <path> npx vitest run ...`) must keep that diagnostic — dropping the
+    // whole segment as navigation would hide the command and break immunity.
+    if (NAVIGATION_VERBS.test(text) && !isDiagnosticText(text)) continue
+    // Session prep that cannot be the failing producer: a pure `$env:X=...` /
+    // `FOO=bar` assignment, and start-sleep.
+    if (ENV_ASSIGNMENT_SEGMENT.test(text)) continue
+    if (INERT_VERBS.test(text)) continue
+    if (pipeTail && PIPE_FORMATTERS.test(text)) continue
+    if (!isDiagnosticText(text)) return false
+    sawProducer = true
+  }
+  return sawProducer
+}
+
+/**
+ * Count of non-transparent producer segments in a command chain — the segments
+ * that could plausibly be the failing producer (everything except pure
+ * navigation, pure env assignments, inert verbs, and pipe-tail formatters).
+ * Chain attribution is only defensible when exactly ONE such producer exists;
+ * with several, the exit code does not say which one failed, so attributing
+ * the failure to any single known segment fabricates evidence (a diagnostic
+ * segment's gate inflated by a non-diagnostic producer's failure).
+ */
+export function nonTransparentProducers(command: string): number {
+  let count = 0
+  for (const { text, pipeTail } of splitChainTagged(flattenSubshellParens(command))) {
+    if (NAVIGATION_VERBS.test(text) && !isDiagnosticText(text)) continue
+    if (ENV_ASSIGNMENT_SEGMENT.test(text)) continue
+    if (INERT_VERBS.test(text)) continue
+    if (pipeTail && PIPE_FORMATTERS.test(text)) continue
+    count += 1
+  }
+  return count
+}
+
+// --- Residual identity (over-generic shape guard) ----------------------------
+
+/** Placeholder tokens carry no identity — except `<code:...>`: the
+ * fingerprint IS the identity of a one-liner payload. */
+const PLACEHOLDER_TOKEN = /^<(?:str|path|n|hash|uuid|sha|md5|ip|url|email|date)>$/
+
+/** Shell plumbing: redirections and here-string/call-operator debris. */
+const OPERATOR_TOKENS = new Set(["&", "@", ">", "<", ">&", ">>", "2>&1", "2>"])
+
+/** Tokens that pass code/module to an interpreter — structure, not identity.
+ * `-m`/`--module` included: the NEXT token is the program, exactly like -c —
+ * `python -m <str>` (quoted module) must not gain identity from the flag. */
+const CODE_PASSING_FLAGS = new Set(["-c", "-e", "--eval", "-command", "-encodedcommand", "-m", "--module"])
+
+/** Bare flag tokens (`-x`, `--foo`) are switches, not call identity — after a
+ * wrapper head, a flag-only remainder matches an entire command family
+ * (`cmd <path> <str> -f`), which must not enforce. */
+const FLAG_TOKEN = /^--?[a-z]/i
+
+/** Shell builtins that only position the session: a chain headed by one
+ * (`cd <path> && python <path>`) must not borrow identity from the builtin —
+ * the whole chain may be parameterized away. */
+const NO_IDENTITY_HEADS = new Set(["cd", "pushd", "popd", "set-location", "exit"])
+
+/** Pipe-stage cmdlets that only post-process output: a segment made of
+ * plumbing (`... | select-object -last <n>`) contributes no identity. */
+const PLUMBING_HEADS = new Set([
+  "select-object",
+  "select-string",
+  "out-string",
+  "out-file",
+  "out-null",
+  "foreach-object",
+  "where-object",
+  "sort-object",
+  "measure-object",
+  "tee-object",
+  "write-host",
+  "write-output",
+  "more",
+])
+
+/** Wrappers whose bare name is not a call identity: their ARGUMENTS are the
+ * call. If the arguments were all parameterized away, the signature matches
+ * an entire command family — enforcing it would punish unrelated calls. */
+const WRAPPER_BASENAMES = new Set(["cmd", "py", "node", "python", "python3", "bun", "deno", "perl", "ruby", "pwsh", "powershell"])
+
+function baseName(token: string): string {
+  const bare = token.replace(/^["']+|["']+$/g, "")
+  const parts = bare.split(/[\\/]/)
+  const last = parts[parts.length - 1] ?? bare
+  return last.toLowerCase().replace(/\.exe$/, "")
+}
+
+function segmentHasIdentity(segment: string): boolean {
+  const tokens = segment.split(/\s+/).filter((t) => t !== "")
+  let head = ""
+  let headIdx = -1
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i] ?? ""
+    if (PLACEHOLDER_TOKEN.test(token) || OPERATOR_TOKENS.has(token) || CODE_PASSING_FLAGS.has(token)) continue
+    head = token
+    headIdx = i
+    break
+  }
+  if (head === "") return false
+  if (head.startsWith("<code:")) return true
+  if (PLUMBING_HEADS.has(head)) return false
+  if (NO_IDENTITY_HEADS.has(head)) return false
+  if (!WRAPPER_BASENAMES.has(baseName(head))) return true
+  // Wrapper/interpreter head: identity must come from a surviving argument
+  // (a literal path/script, or a <code:...> fingerprint). Flags are switches,
+  // not identity — a flag-only remainder is an over-generic command family.
+  for (let i = headIdx + 1; i < tokens.length; i++) {
+    const token = tokens[i] ?? ""
+    if (token.startsWith("<code:")) return true
+    if (PLACEHOLDER_TOKEN.test(token) || CODE_PASSING_FLAGS.has(token) || OPERATOR_TOKENS.has(token) || FLAG_TOKEN.test(token)) continue
+    return true
+  }
+  return false
 }
 
 /**
- * A code flag whose payload was entirely parameterized away (`-c <str>`)
- * carries no identity — blocking that shape blocks the whole command family.
- * New one-liners get <code:...> fingerprints in normalizeCommand; this guard
- * keeps legacy pre-fingerprint gates (and lookalikes) from ever blocking.
+ * A signature keeps residual identity when at least one chain segment names
+ * a concrete call. Signatures whose substance was entirely parameterized —
+ * `cmd <path> <str>`, `node <str> <n> >& <n>`, `& <str> -c @ <str> @`,
+ * chains starting with an unknown `<str>` head — match whole command
+ * families: they may be measured (watching) but never enforced. This
+ * generalizes the legacy bare-one-liner guard: ANY future normalization gap
+ * degrades to watching instead of blocking arbitrary calls.
  */
-const GENERIC_ONELINER_SHAPE = /(^|\s)(-c|-e|--eval|-command)\s+(?:@\s+)?<str>(?:\s+@)?\s*$/i
+export function hasResidualIdentity(signature: string): boolean {
+  const body = signature.startsWith("bash:") ? signature.slice("bash:".length) : signature
+  return body.split(/\s*(?:\|\||&&|[|;&])\s*|\n+/).some((segment) => segmentHasIdentity(segment))
+}
 
 /**
  * Blocking policy: only bash commands that are NOT diagnostics may ever
  * become enforced gates. File probes and diagnostic queries are measured
  * (watching) but never interrupt the agent — the data showed blocking them
- * punishes normal work.
+ * punishes normal work. Signatures without residual identity never enforce
+ * at any tier — they are too broad to interrupt anything.
  */
 export function canBlock(tool: string, signature: string): boolean {
   if (tool !== "bash") return false
-  if (isDiagnosticSignature(signature)) return false
-  return !GENERIC_ONELINER_SHAPE.test(signature)
+  if (!hasResidualIdentity(signature)) return false
+  return !isDiagnosticSignature(signature)
 }
 
 /**
  * Remind-only policy: diagnostic bash commands still surface a REMINDER when
  * they recur (the old behavior gave them zero signal), but they NEVER block —
  * blocking a test/lint the agent is iterating on punishes normal work.
- * Generic one-liner shapes stay unenforced: they are too broad to remind on.
  */
 export function canRemind(tool: string, signature: string): boolean {
   if (tool !== "bash") return false
-  if (GENERIC_ONELINER_SHAPE.test(signature)) return false
+  if (!hasResidualIdentity(signature)) return false
   return isDiagnosticSignature(signature)
 }
 
@@ -277,7 +655,8 @@ export function splitChain(command: string): string[] {
       }
       if (ch === "|") {
         flush()
-        i += next === "|" ? 2 : 1
+        // `||` (OR) and `|&` (bash pipe stdout+stderr) are 2-char; bare `|` is 1.
+        i += next === "|" || next === "&" ? 2 : 1
         continue
       }
     }
@@ -288,10 +667,28 @@ export function splitChain(command: string): string[] {
   return segments
 }
 
-/** Per-segment signatures for a bash command (bypass protection for chains). */
+/**
+ * Per-segment signatures for a bash command (bypass protection for chains).
+ * cmd wrappers expand recursively: quote-aware splitChain keeps
+ * `cmd /c "a && gated"` as ONE segment, so the inner chain must unfold here —
+ * a gate on the inner command must fire through the wrapper. Depth-bounded:
+ * nested wrappers are pathological.
+ */
 export function bashSegmentSignatures(command: string): string[] {
   const clean = command.replace(OVERRIDE_MARKER, "")
-  return splitChain(clean).map((segment) => `bash:${normalizeCommand(segment)}`)
+  const signatures: string[] = []
+  const expand = (text: string, depth: number): void => {
+    for (const segment of splitChain(text)) {
+      const payload = depth < 3 ? cmdWrapperPayload(segment) : null
+      if (payload === null) {
+        signatures.push(`bash:${normalizeCommand(segment)}`)
+      } else {
+        expand(payload, depth + 1)
+      }
+    }
+  }
+  expand(clean, 0)
+  return signatures
 }
 
 /** Normalize a file path: keep basename + extension, drop directories. */
@@ -373,12 +770,25 @@ const CODE_FINGERPRINTS = /<code:[0-9a-f]+>/g
  * DISJOINT flag sets are different operations and must never fuzzy-merge
  * ("train --lr <n>" vs "train --epochs <n>"). A subset IS allowed — extra
  * switches on the same operation ("gradlew test --no-daemon") still belong to
- * the same gate, otherwise enforcement fragments across harmless variants. */
+ * the same gate, otherwise enforcement fragments across harmless variants.
+ * Cached: the flood path calls fuzzySimilar per gate under the gates lock and
+ * would otherwise re-split/sort the SAME incoming signature on every pair. */
+const FLAG_TOKEN_CACHE_CAP = 512
+const flagTokenCache = new Map<string, string[]>()
 function flagTokens(signature: string): string[] {
-  return signature
+  const cached = flagTokenCache.get(signature)
+  if (cached !== undefined) return cached
+  const tokens = signature
     .split(/\s+/)
     .filter((token) => token.startsWith("-"))
     .sort()
+  if (flagTokenCache.size >= FLAG_TOKEN_CACHE_CAP) {
+    // Evict an arbitrary (oldest-inserted) entry to bound memory.
+    const oldest = flagTokenCache.keys().next().value
+    if (oldest !== undefined) flagTokenCache.delete(oldest)
+  }
+  flagTokenCache.set(signature, tokens)
+  return tokens
 }
 
 function flagSubset(a: string[], b: string[]): boolean {
@@ -404,6 +814,16 @@ export const FUZZY_MAX_LEN = 300
  */
 export function fuzzySimilar(a: string, b: string): boolean {
   if (a === b) return true
+  // Cheapest rejects FIRST: the length band is O(1) with zero allocation and
+  // zero false negatives — it must run before any regex/flag work, because
+  // the flood path calls this per gate under the gates lock.
+  const maxLen = Math.max(a.length, b.length)
+  if (maxLen === 0) return true
+  if (maxLen > FUZZY_MAX_LEN) return false
+  // Triangle inequality: distance >= |lenA - lenB|. If even that floor
+  // exceeds the ratio threshold, no Levenshtein result can pass — an O(1)
+  // pre-filter with zero false negatives that skips most DP computations.
+  if (Math.abs(a.length - b.length) / maxLen > 0.3) return false
   const codesA = a.match(CODE_FINGERPRINTS)
   const codesB = b.match(CODE_FINGERPRINTS)
   if (codesA !== null || codesB !== null) {
@@ -412,13 +832,6 @@ export function fuzzySimilar(a: string, b: string): boolean {
   const flagsA = flagTokens(a)
   const flagsB = flagTokens(b)
   if (!flagSubset(flagsA, flagsB) && !flagSubset(flagsB, flagsA)) return false
-  const maxLen = Math.max(a.length, b.length)
-  if (maxLen === 0) return true
-  if (maxLen > FUZZY_MAX_LEN) return false
-  // Triangle inequality: distance >= |lenA - lenB|. If even that floor
-  // exceeds the ratio threshold, no Levenshtein result can pass — an O(1)
-  // pre-filter with zero false negatives that skips most DP computations.
-  if (Math.abs(a.length - b.length) / maxLen > 0.3) return false
   const distance = levenshtein(a, b)
   return distance >= 3 && distance / maxLen <= 0.3
 }
@@ -437,20 +850,97 @@ export interface FailureDetection {
  * event channel instead.
  */
 const FAILURE_SIGNATURES: RegExp[] = [
-  /exit code:?\s*[1-9]\d*/i,
+  /exit (?:code|status):?\s*[1-9]\d*/i,
   /\berror TS\d+\b/,
   /\bENOENT\b|\bEACCES\b|\bEPERM\b/,
   /command not found/i,
-  /is not recognized as an internal or external command/i,
+  // cmd AND PowerShell wordings of "unknown command" — pwsh phrasing was
+  // uncovered, so head/tail/wc gates stored the "Check the spelling" boilerplate
+  // tail instead of the cause line.
+  /is not recognized as (?:an internal or external command|the name of a cmdlet)/i,
   /\b(SyntaxError|TypeError|ReferenceError|AssertionError)\b/,
   /Tests:\s+\d+\s+failed/i,
-  /\bFAIL\s+\S/,
+  // Runner summaries, language-agnostic. Count-bearing forms require a NON-ZERO
+  // count in EITHER order ("1 failed" / "Failed: 1" / "Failures: 1") so a pass
+  // tally ("0 failed", "Failed: 0") never reads as a failure. Covers pytest/
+  // playwright/vitest/jest ("N failed"), RSpec/Elixir/minitest ("N failure(s)"),
+  // dotnet/Maven/sbt/unittest ("Failed: N", "Failures: N", "failures=N").
+  /\b[1-9]\d*\s+fail(?:ed|ures?)\b/i,
+  /\bfail(?:ed|ures?)\s*[:=]\s*[1-9]\d*\b/i,
+  /no tests? (?:found|matched|run|were executed)/i,
+  // Generic error prefix (Playwright "Error: No tests found", Node, tracebacks).
+  /^error:/i,
+  // Compiler/tool error prefixes that carry a bracket before the colon:
+  // Rust "error[E0308]:" and Maven/SBT "[ERROR] ...".
+  /^\s*error\s*\[/i,
+  /^\s*\[ERROR\]/i,
+  // Go: "--- FAIL: TestName", "FAIL\tpkg", standalone "FAIL" (uppercase; pass is
+  // "ok\tpkg"). \b keeps it off "FAILED"/"FAILURE".
+  /\bFAIL\b/,
+  // Build-level status words that never appear in a pass summary: Maven
+  // "BUILD FAILURE", Gradle "BUILD FAILED" / "FAILURE: Build failed", sbt
+  // "*** 1 TEST FAILED ***", dotnet build "Build FAILED.".
+  /\bBUILD\s+(?:FAILURE|FAILED)\b/i,
+  /\bFAILURE\b/i,
+  /\bTESTS?\s+FAILED\b/i,
+  // TAP ("node --test") failure marker.
+  /^not ok\b/i,
   /thread '[^']*' panicked/,
+  /\bpanic:/i,
   /\bFATAL\b/,
 ]
 
+/** Lines that read like a SUCCESS summary. Quoting one as a failure's "last
+ * error" teaches the agent to fix something that worked — the store held
+ * "17 passed (3.1m)" as evidence for a failing gate (MidasAI). Matched as a
+ * SUBSTRING so decorated summaries ("==== 10 passed ====", "ok\tpkg 0.3s",
+ * "BUILD SUCCESSFUL") are caught too — the pass shape need not start the line. */
+const SUCCESS_SHAPED: RegExp[] = [
+  /\b\d+\s+passed\b/i,
+  /\b\d+\s+(?:tests?|specs?|examples?)\s+passed\b/i,
+  /\ball tests passed\b/i,
+  /\bBUILD SUCCESS(?:FUL)?\b/i,
+  /\btest result: ok\b/i,
+  /\bOK\s*\(\s*\d+\s+tests?/i,
+  /^ok\s+\S/i,
+  // dotnet: pass summaries lead with "Passed!" ("Failed!" = failure) or say
+  // "Build succeeded." / "Test Run Successful."
+  /^Passed!/i,
+  /\bBuild succeeded\b/i,
+  /\bTest Run Successful\b/i,
+  /\bno offenses detected\b/i,
+  /\b0 issues\b/i,
+  // gradle/node noise that is never failure evidence: task summary, config-cache
+  // note, node version banner (printed at the tail of a crash, it is not the cause).
+  /\b\d+\s+actionable tasks?\b/i,
+  /\bConfiguration cache entry\b/i,
+  /^Node\.js v\d+\./i,
+]
+
+export function looksLikeSuccess(line: string): boolean {
+  // A line that reports failures is not a success even when it also tallies
+  // passes ("1 failed, 1780 passed", "Failed: 1"). Non-zero count in either
+  // order, mirroring the failure signatures.
+  if (/\b[1-9]\d*\s+fail(?:ed|ures?)\b/i.test(line)) return false
+  if (/\bfail(?:ed|ures?)\s*[:=]\s*[1-9]\d*\b/i.test(line)) return false
+  return SUCCESS_SHAPED.some((rule) => rule.test(line))
+}
+
+/** Leading decorations runners wrap summaries in ("====", "---", "[info]",
+ * "✔") — stripped before matching so a pattern needs not anticipate every
+ * tool's framing. Bounded so a real line is never eaten whole. */
+const LEADING_DECORATION = /^[\s=\-─—_*#•»>]{0,40}/
+
+export function looksLikeFailure(line: string): boolean {
+  if (line.trim() === "" || looksLikeSuccess(line)) return false
+  const bare = line.replace(LEADING_DECORATION, "")
+  return FAILURE_SIGNATURES.some((rule) => rule.test(line) || rule.test(bare))
+}
+
 export function detectFailure(outputText: string): FailureDetection {
-  for (const line of outputText.split("\n")) {
+  // PowerShell colors errors with VT sequences — strip before scanning, or
+  // the escapes persist into snippets/corrections shown to the agent.
+  for (const line of stripControl(outputText).split("\n")) {
     for (const signature of FAILURE_SIGNATURES) {
       if (signature.test(line)) {
         return { matched: true, snippet: line.trim().slice(0, 200) }
@@ -463,14 +953,29 @@ export function detectFailure(outputText: string): FailureDetection {
 /**
  * For exit-code failures whose output matched no signature, a bare
  * "exit code N" gives a human/agent nothing to write a correction from.
- * Bash output is command output (safe to surface), so keep the last non-empty
- * line — compilers/test runners print their summary at the end.
+ * Bash output is command output (safe to surface). Scan from the END for a
+ * failure-shaped line — compilers/test runners print their summary last, but a
+ * SUCCESS-shaped tail ("17 passed") is never failure evidence: chained commands
+ * and `Select-Object -Last N` pipelines put another shard's pass summary there.
+ * Prefer the last real error line, then the last non-success line, then the exit code.
  */
 export function failureSnippet(outputText: string, exitCode: number | null): string {
-  const lines = outputText
+  const lines = stripControl(outputText)
     .split("\n")
     .map((l) => l.trim())
     .filter((l) => l !== "")
+  if (exitCode !== null && exitCode !== 0) {
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i] ?? ""
+      if (looksLikeFailure(line)) return line.slice(0, 200)
+    }
+    // No failure-shaped line: the last non-success line beats a bare exit code.
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i] ?? ""
+      if (!looksLikeSuccess(line)) return line.slice(0, 200)
+    }
+    return `exit code ${exitCode}`
+  }
   const tail = lines[lines.length - 1]
   if (tail !== undefined && tail !== "") return tail.slice(0, 200)
   return `exit code ${exitCode}`
@@ -482,6 +987,9 @@ export function failureSnippet(outputText: string, exitCode: number | null): str
  * Infrastructure noise, not agent mistakes: aborted/cancelled executions
  * (user hit stop, background task reaped) teach nothing and fragmented the
  * store with unactionable patterns. Aborted != failed.
+ * Boundary: SERVER-side unavailability (daemon down, transport errors, 5xx)
+ * is noise — the agent cannot learn from "the service was down". CLIENT-side
+ * mistakes (4xx, wrong path, syntax) stay teachable and are NOT matched here.
  */
 const NOISE_ERRORS: RegExp[] = [
   /tool execution aborted/i,
@@ -489,12 +997,132 @@ const NOISE_ERRORS: RegExp[] = [
   /\baborted by user\b/i,
   /\bcancelled by user\b/i,
   /\bcanceled by user\b/i,
+  /no results found for your query/i, // grep_app empty search: the tool worked, nothing matched
+  /user dismissed this question/i, // question tool: the user's choice, not a failure
+  // Infrastructure unavailability: the service, not the command, failed.
+  /lsp (?:server|daemon|process)[^.\n]*(?:unreachable|not running|disconnected|crashed|did not become reachable)/i,
+  /\b(?:daemon|server)\b[^.\n]*(?:unreachable|did not become reachable)/i,
+  /streamable ?http ?error/i, // MCP streamable-http transport failure
+  /\bmcp error\b/i, // MCP transport/protocol errors
+  /non.?2xx status code/i, // webfetch HTTP failure: the endpoint answered, the URL fetch didn't
+  /\btransport error\b/i, // webfetch/gRPC transport failure: the connection itself never completed
+  // Browser automation: the page/context/browser was already closed when the
+  // action ran — a transient startup/state hiccup fixed by relaunching, not an
+  // agent habit (and a non-bash tool error could only ever watch anyway).
+  /target page, context or browser has been closed/i,
+  // LSP too slow to answer a diagnostics request in the window — a latency
+  // hiccup, not an agent mistake (and lsp_* tools only ever watch anyway).
+  /timed out waiting for (?:fresh )?diagnostics/i,
 ]
 
 export function isNoiseError(errorText: string): boolean {
   return NOISE_ERRORS.some((rule) => rule.test(errorText))
 }
 
+// --- Long-running command guard ------------------------------------------------
+
+/**
+ * High-confidence dev-server / watcher starters. Running one in FOREGROUND bash
+ * blocks the tool call until its timeout (~2 min) and strands an orphan process.
+ * Deliberately conservative: only unambiguous starters are listed (ambiguous
+ * `node <file>`, `go run`, `dotnet run` are NOT here — they may be one-shots).
+ * This is a bounded, recognizable class, unlike open-ended error detection.
+ */
+const SERVER_STARTERS: RegExp[] = [
+  // `start` included: `npm start` is the canonical dev-server script (CRA et al).
+  // `workspace <name>` covers monorepo `yarn workspace app dev`.
+  /\b(npm|yarn|pnpm|bun)\s+(run\s+|workspace\s+\S+\s+)?(dev|serve|watch|start)\b/i,
+  /\b(next|nuxt|astro)\s+dev\b/i,
+  /\bng\s+serve\b/i, // Angular
+  // `vite` as a command: not in a filename ("vite.config.ts"), not "vitest", not a
+  // `build:` script target ("npm run build:vite"), and not followed by a bare
+  // `build` (one-shot). `vite build --watch` is a watcher (separate rule).
+  /(?<![:\w])vite\b(?![.\w])(?![^\n]*\bbuild\b)/i,
+  /\bvite\s+build\b[^\n]*\bwatch\b/i,
+  // Flask 2.3+ puts `--app X` between the binary and `run`.
+  /\b(flask|streamlit)\b[^\n|;&]*\brun\b/i,
+  // Require an arg (module:var or flag) so `pip install uvicorn gunicorn` and
+  // `grep uvicorn` (mention/install) don't read as starting a server.
+  /\b(uvicorn|gunicorn)\s+(?:--?\w[^\s]*|\S+:\S+)/i,
+  /\bpython\d?(?:\.\d+)?\s+-m\s+http\.server\b/i,
+  /\b(python\d?(?:\.\d+)?\s+)?manage\.py\s+runserver\b/i, // Django
+  /\bdjango-admin\s+runserver\b/i,
+  // Python scripts named like servers (Flask/FastAPI entrypoints).
+  // Negative lookahead for `\s+cli\b`: `python …/server.py cli …` is a one-shot
+  // CLI invocation (e.g. muffin-supervisor), not a foreground server start.
+  /\bpython\d?(?:\.\d+)?\s+(?:\S*[\/\\])?(?:app|server|main|run|wsgi|asgi)\.py\b(?!\s+cli\b)/i,
+  /\bphp\s+(-S|artisan\s+serve)\b/i, // built-in / Laravel
+  /\bjupyter\s+(lab|notebook)\b/i,
+  /\b(webpack-dev-server|webpack\s+serve)\b/i,
+  /\b(http-server|live-server)\b/i,
+  // Docker foreground services: `compose up` / `run` WITHOUT -d/--detach block.
+  // `docker run` constrained to server-ish flags (-p/--publish/-it) to avoid
+  // flagging one-shot containers (`docker run --rm alpine echo hi`).
+  /\bdocker(?:-compose)?\s+compose\s+up\b(?![^\n]*\s(?:-d|--detach)\b)/i,
+  /\bdocker\s+run\b(?![^\n]*\s(?:-d|--detach)\b)(?=[^\n]*\s(?:-p|--publish|-it)\b)/i,
+  // Built-in runtime watchers (Node 18+ / Bun): unambiguous long-running.
+  /\bnode\s+--watch\b/i,
+  /\bbun\s+--watch\b/i,
+  /\bmvn\b[^\n]*\bspring-boot:run\b/i,
+  /\bgradlew?\b[^\n]*\bbootRun\b/i,
+  /\bdotnet\s+watch\b/i, // `dotnet run` stays excluded (ambiguous one-shot vs server)
+  /\brails\s+(s|server)\b/i,
+  /\bhugo\s+server\b/i,
+  /\bjekyll\s+serve\b/i,
+  /\bmkdocs\s+serve\b/i,
+  /\bmix\s+phx\.server\b/i, // Elixir/Phoenix
+  /\biex\s+-S\s+mix\b/i,
+  /\bnodemon\b/i,
+  /\b(expo|react-native)\s+start\b/i,
+  /\bollama\s+serve\b/i,
+]
+
+/** Markers that mean the process is already detached / backgrounded. */
+function isDetached(command: string): boolean {
+  // Start-Process detaches UNLESS -Wait (blocks for exit) or -NoNewWindow
+  // (runs in the caller's window, effectively foreground).
+  if (/\bStart-Process\b/i.test(command)) return !/\s-(?:Wait|NoNewWindow)\b/i.test(command)
+  // Self-detaching managers/sessions.
+  if (/\b(Start-Job|pm2|forever|daemonize|systemd-run|setsid)\b/i.test(command)) return true
+  if (/\btmux\s+(new-session|new)\b/i.test(command)) return true
+  // `screen -dmS`/`-d -m` start detached; a bare `screen -S name` is foreground.
+  if (/\bscreen\s+-(d|m)/i.test(command)) return true
+  if (/\bstart\s+\/b\b/i.test(command)) return true // cmd.exe background
+  // A standalone background `&` (not part of `&&`), anywhere — trailing,
+  // mid-chain, or closing a subshell (`(cmd &)`). `&&` chains stay foreground.
+  // BUT `& … wait` blocks until the background job finishes, and `nohup X`
+  // without `&` still runs in the foreground — both are NOT detached.
+  if (/(^|[^&])&([^&]|$)/.test(command.trim())) return !/\bwait\b/i.test(command)
+  if (/\b(nohup|disown)\b/i.test(command)) return false // needs `&` to detach; handled above
+  return false
+}
+
+export function isLongRunningCommand(command: string): boolean {
+  return SERVER_STARTERS.some((rule) => rule.test(command))
+}
+
+/** Warn only for a foreground server start; a detached one is fine. */
+export function shouldWarnLongRunning(command: string): boolean {
+  return isLongRunningCommand(command) && !isDetached(command)
+}
+
+/**
+ * Agent-written polling loops with no timeout guard. These are NOT servers —
+ * they hang in a while/until/for loop waiting for a condition (usually a health
+ * endpoint) that may never arrive, until the bash timeout kills them.
+ */
+const WAIT_LOOP: RegExp[] = [
+  /\b(?:while|until)\b[^\n]*\b(?:sleep|Start-Sleep)\s+\d/i,
+  // Multi-line loops: infinite condition ($true/true) or a network/health probe,
+  // with a sleep anywhere in the body (possibly on later lines).
+  /\b(?:while|until)\b[^\n]*(?:\$true|\btrue\b|\bTest-Connection\b|\bInvoke-WebRequest\b|\bInvoke-RestMethod\b|\bcurl\b|\bwget\b)[\s\S]{0,500}?\b(?:sleep|Start-Sleep)\b/i,
+  /\bfor\s*\([^\n]*\)\s*\{[\s\S]{0,400}?\b(?:sleep|Start-Sleep)\s+\d/i,
+]
+
+export function shouldWarnWaitLoop(command: string): boolean {
+  return WAIT_LOOP.some((rule) => rule.test(command))
+}
+
 // --- Default corrections ------------------------------------------------------
 
 /**
@@ -519,7 +1147,23 @@ export function suggestCorrection(signature: string, snippet: string): string {
   if (/\b(npm|yarn|pnpm|bun)\s+(install|ci)\b/i.test(signature)) {
     return "Dependency install failed — inspect the resolver error; try the lockfile/legacy-peer-deps route the repo documents."
   }
-  if (snippet !== "" && snippet !== "exit code 1") {
+  // Unix tools absent from PowerShell: a missing-command failure on one is a platform habit, teach the native form.
+  if (/\b(head|tail|cat|wc|grep|sed|awk|cut|sort|uniq|tr|xargs|less)\b/i.test(signature) && /not recognized|command not found|Check the spelling of the name/i.test(snippet)) {
+    return "Unix tool, not a PowerShell command — use the native equivalent: Select-Object -First/-Last for head/tail, Get-Content for cat, Select-String for grep, (Get-Content <file>).Count for wc -l."
+  }
+  // File-tool probes: not-found means a wrong path guess — locate the file
+  // instead of retrying guessed path variants.
+  if (/^(read|edit|write):/i.test(signature) && /ENOENT|no such file|not found/i.test(snippet)) {
+    return "The file does not exist at that path — locate the real path with glob/grep before reading/editing; do not guess path variants."
+  }
+  // Missing command on this machine — install it or pick an available tool.
+  if (/^bash:/i.test(signature) && /command not found|not recognized/i.test(snippet)) {
+    return "The command is not installed on this machine — install it first, or use an alternative tool that is already available."
+  }
+  // A success-shaped snippet is never an error — quoting it ("Last error:
+  // '17 passed'") teaches the agent to fix something that worked. Likewise a
+  // bare exit code carries nothing to quote. Fall through to the generic text.
+  if (snippet !== "" && !/^exit code \d+$/i.test(snippet) && !looksLikeSuccess(snippet)) {
     return `Last error: "${snippet}" — address that specific error before retrying this exact call.`
   }
   return "This exact call keeps failing — inspect the last output line and change approach before retrying."