Fix edit_file corruption and matching, shell timeout process groups, grep/glob read boundary

[nvdorman]

Summary

• edit_file: the adjacent-insertion recovery replaced the first substring occurrence of the matched line anywhere in the file, corrupting an unrelated line mid-text while reporting success. It now splices by the matched line's byte range and never combines with replace_all.
• edit_file matching: the verbatim old_string is tried before any EOL normalization, fileEOL picks the majority flavor (one stray CR/CRLF no longer poisons every multi-line edit on a file), and NUMBER| prefix stripping requires consecutive numbers so pipe-delimited data is never mangled. Adds stale-edit diagnostics: ambiguous matches list their line numbers, near-miss lines are surfaced, mixed pastes are called out.
• read_file: no longer misreads a rune split at the 400 KB cap as binary; lone-CR files display per line.
• shell: timed-out/cancelled foreground commands are killed with their whole process group (descendants held the shell's pipes and wedged the session); configureProcessGroup preserves existing SysProcAttr instead of clobbering sandbox flags.
• grep/glob: follow the same read boundary as read_file (project sessions may search outside the workspace); grep reports lines exceeding the scanner buffer instead of silently presenting the rest of the file as match-free.

Merged latest main (PowerShell terminal protocol, MCP background reader, fast model switching) with conflicts resolved to keep both sides' fixes: killLocked keeps main's reap-wait but upgrades to a process-group kill; mcp/client.go takes main's reviewed implementation wholesale.

Test plan

• New regression tests written first and observed failing: wrong-line splice, replace_all multiplication, mixed-EOL exact match, stray-CR exact match, non-sequential prefix strip, rune-split truncation, lone-CR display, project-session grep/glob boundary, overlong-line report
• go build ./..., go vet, full go test ./... — green except pre-existing internal/llm live tests requiring a valid OpenAI key; TestStdioRoundTrip / TestModelSetConcurrentWithConfigReads verified flaky-under-load only (pass isolated and on retry, identical code to main)
• make install-cli build with dashboard embedded; daemon restarted and healthy on the new binary

Made with Cursor

[enowdev]

Merged as 8ccfe98. Reviewed the byte-range splice, the majority fileEOL detection, the verbatim-first matching, and the process-group kill; the core fixes hold up, and the grep/glob change matches read_file's existing resolveRead rather than widening anything.

The red go check was not this PR — TestModelSetConcurrentWithConfigReads asserted that model-19 specifically won a race between twenty detached savers. It reproduces on main at GOMAXPROCS=2 and is fixed in 9f2cd57.

Four defects found in review are fixed on top in 9e3710f, two of them reproduced against your merged code first:

1. NUMBER| paste reached the fuzzy path. The prefix stayed in the anchor's token set, so a stale 12|- **pool39v2** | 14 hand | still scored high, and the new row was written to the file carrying a literal 13| prefix — reported as 1 replacement(s). Prefixed pastes now never reach the guess.
2. A deleted anchor spliced onto its surviving sibling row. Table rows share nearly every token, so a removed row cleared both the 0.78 floor and the 0.12 margin. Edit distance doesn't separate these either — 2026-02-01 vs 2026-03-01 is one character, same as a typo. The guard now keys on digits, which a rewording preserves and a different row doesn't.
3. read_file and edit_file disagreed on a lone CR. read_file split on every CR while your own stray-CR test treats an embedded CR as data, so the model got line numbers the file doesn't have — manufacturing the stale anchors this PR set out to remove. Both now split on a lone CR only in a genuinely CR-terminated file.
4. kill(-pid) had no fallback. Every path calls configureProcessGroup today, but nothing enforces it; if a shell ever isn't a group leader, the negative kill takes the daemon down. The PGID is now checked against our own first.

Regression tests for all four are in internal/tools/file_edit_recovery_test.go. Thanks — the recovery path is genuinely useful, it just needed tighter gates given that it reports success.