mixdog 0.7.11 → 0.7.13

package/setup/launch-core.mjs

@@ -285,7 +285,6 @@ async function spawnServerWithLog(pluginRoot, pluginData, { openOnStart = true }
         MIXDOG_SETUP_OPEN_ON_START: openOnStart ? '1' : '0',
         MIXDOG_SETUP_PARENT_PID: String(findAncestorPid() || ''),
       },
-      windowsHide: true,
     });
   } catch (error) {
     closeLog(launchLog.fd);

package/setup/setup-server.mjs

@@ -599,9 +599,17 @@ function _modelFromConfiguredId(id, provider) {
 }
 
 function _familyFromModelId(id) {
-  const claude = String(id || '').match(/^claude-(opus|sonnet|haiku)/i);
+  const s = String(id || '').toLowerCase();
+  const claude = s.match(/^claude-(opus|sonnet|haiku)/i);
   if (claude) return claude[1].toLowerCase();
-  const gpt = String(id || '').match(/^(gpt-\d+)/i);
+  if (s.includes('nano')) return 'gpt-nano';
+  if (s.includes('mini')) return 'gpt-mini';
+  if (s.includes('codex')) return 'gpt-codex';
+  if (s.startsWith('gpt-5.5')) return 'gpt-5.5';
+  if (s.startsWith('gpt-5.4')) return 'gpt-5.4';
+  if (s.startsWith('gpt-5.2')) return 'gpt-5.2';
+  if (s.startsWith('gpt-5')) return 'gpt-5';
+  const gpt = s.match(/^(gpt-\d+(?:\.\d+)?)/i);
   if (gpt) return gpt[1].toLowerCase();
   return undefined;
 }
@@ -1228,28 +1236,18 @@ async function openAppWindowSequence() {
         // inherit so they do not allocate their own conhost instances.
         const escVbs = s => String(s).replace(/"/g, '""');
         const argsStr = args.join(' ');
-        // Warm open + cold-open invariant. The profile dir is stable per
-        // install (CHROME_PROFILE_DIR) and chrome enforces ONE singleton per
-        // --user-data-dir, so two facts decide the action:
-        //
-        //  1. A live mixdog chrome already owns the profile (FindChromePid by
-        //     --app + --user-data-dir, ignoring --type= helpers) → just focus
-        //     it. Killing+respawning a live window is wasteful and races the
-        //     /generation self-close poll. (warm open)
-        //
-        //  2. No live owner → the profile may still carry a STALE singleton
-        //     lock (SingletonLock/Socket/Cookie) left by a prior chrome that
-        //     was force-killed (takeover taskkill /T /F) or lost to sleep/
-        //     crash. A fresh `--app` launch then rendezvouses with that dead
-        //     instance over the singleton socket, forwards its URL, and exits
-        //     WITHOUT opening a window — the reported cold-open bug (URL
-        //     printed, no window, a later /open works once the lock is reaped).
-        //     Deleting the stale Singleton* files first guarantees chrome
-        //     boots a real window instead of IPC-forwarding to a ghost. This
-        //     is the invariant ("spawn into a clean singleton when no live
-        //     owner"), not a retry. The title-scoped taskkill is kept only as
-        //     a defensive belt for a same-title window with a non-matching
-        //     command line; it is a no-op in the common case.
+        // Hybrid warm-focus / ghost-respawn. A chrome process can outlive its
+        // window (closed / crashed / IPC-forwarded over the singleton socket),
+        // so "a process exists" never proves "a window is visible" — the old
+        // focus-if-found path then opened nothing (the "URL printed, no window"
+        // cold-open bug), while killing+respawning on EVERY open cold-boots
+        // chrome each time (slow). Balance: TryFocus the existing MAIN with a
+        // short bound. If it activates → healthy window, just focus it (fast,
+        // no respawn). If it can't (ghost) or none exists → KillMixdogChromes
+        // for this profile (--user-data-dir match, MAIN + helpers), clear the
+        // stale Singleton* locks, spawn one fresh --app window. The VBS finally
+        // re-checks FindChromePid and exits 0 only if a MAIN is live (else 2 →
+        // default-browser fallback in JS), so /open's ok reflects a real window.
         //
         // The taskkill → chrome chain runs under one hidden cmd.exe (one
         // cmd.exe per /open). `&` runs both regardless of exit code (taskkill
@@ -1267,7 +1265,7 @@ async function openAppWindowSequence() {
         const vbsLines = [
           'Option Explicit',
           'Const HIDDEN_WINDOW = 0',
-          'Dim Wmi, Startup, Wsh, cmdLine, cmdPid, rc, appNeedle, profileNeedle, existingPid, profileDir, procName',
+          'Dim Wmi, Startup, Wsh, cmdLine, cmdPid, rc, appNeedle, profileNeedle, existingPid, profileDir, procName, focused',
           'Set Wmi = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2")',
           'Set Wsh = CreateObject("WScript.Shell")',
           `appNeedle = "${escVbs(appNeedle)}"`,
@@ -1275,15 +1273,22 @@ async function openAppWindowSequence() {
           `profileDir = "${escVbs(chromeProfile)}"`,
           `procName = "${escVbs(procName)}"`,
           'existingPid = FindChromePid(Wmi, appNeedle, profileNeedle)',
-          'If existingPid = 0 Then',
+          'focused = False',
+          'If existingPid <> 0 Then focused = TryFocus(Wsh, existingPid, 8)',
+          'If Not focused Then',
+          '  Call KillMixdogChromes(Wmi, profileNeedle)',
+          '  WScript.Sleep 200',
           '  Call ClearSingletonLocks(profileDir)',
           '  Set Startup = Wmi.Get("Win32_ProcessStartup").SpawnInstance_',
           '  Startup.ShowWindow = HIDDEN_WINDOW',
           `  cmdLine = "cmd.exe ${escVbs(cmdArg)}"`,
           '  rc = Wmi.Get("Win32_Process").Create(cmdLine, Null, Startup, cmdPid)',
           '  If rc <> 0 Then WScript.Quit rc',
+          '  Call FocusMixdogWindow(Wmi, Wsh, appNeedle, profileNeedle)',
           'End If',
-          'Call FocusMixdogWindow(Wmi, Wsh, appNeedle, profileNeedle)',
+          'existingPid = FindChromePid(Wmi, appNeedle, profileNeedle)',
+          'If existingPid = 0 Then WScript.Quit 2',
+          'WScript.Quit 0',
           '',
           'Sub ClearSingletonLocks(profileDir)',
           '  Dim Fso, names, i, p',
@@ -1297,6 +1302,32 @@ async function openAppWindowSequence() {
           '  On Error GoTo 0',
           'End Sub',
           '',
+          'Sub KillMixdogChromes(Wmi, profileNeedle)',
+          '  Dim proc, commandLine',
+          '  On Error Resume Next',
+          '  For Each proc In Wmi.ExecQuery("SELECT ProcessId,CommandLine FROM Win32_Process WHERE Name = \'" & procName & "\'")',
+          '    commandLine = ""',
+          '    If Not IsNull(proc.CommandLine) Then commandLine = CStr(proc.CommandLine)',
+          '    If InStr(1, commandLine, profileNeedle, vbTextCompare) > 0 Then proc.Terminate',
+          '  Next',
+          '  On Error GoTo 0',
+          'End Sub',
+          '',
+          'Function TryFocus(Wsh, pid, maxTicks)',
+          '  Dim i, ok',
+          '  ok = False',
+          '  On Error Resume Next',
+          '  For i = 1 To maxTicks',
+          '    Wsh.SendKeys "%"',
+          '    WScript.Sleep 25',
+          '    ok = Wsh.AppActivate(CLng(pid))',
+          '    If ok Then Exit For',
+          '    WScript.Sleep 120',
+          '  Next',
+          '  On Error GoTo 0',
+          '  TryFocus = ok',
+          'End Function',
+          '',
           'Sub FocusMixdogWindow(Wmi, Wsh, appNeedle, profileNeedle)',
           '  Dim i, pid, activated',
           '  On Error Resume Next',
@@ -1362,29 +1393,37 @@ async function openAppWindowSequence() {
         // parented to wscript, so a tree-kill of wscript reaps only the focus
         // loop.
         const WSCRIPT_OPEN_DEADLINE_MS = 12000;
-        const timedOut = await new Promise(resolve => {
+        const outcome = await new Promise(resolve => {
           const wscriptChild = spawn('wscript.exe', ['//B', '//NoLogo', vbsPath], {
             stdio: 'ignore', windowsHide: true,
           });
           let settled = false;
-          const finish = via => { if (settled) return; settled = true; clearTimeout(timer); resolve(via); };
+          const finish = v => { if (settled) return; settled = true; clearTimeout(timer); resolve(v); };
           const timer = setTimeout(() => {
             // Tree-kill the wscript launcher only; the detached browser lives on.
             try { spawnSync('taskkill', ['/F', '/T', '/PID', String(wscriptChild.pid)], { windowsHide: true, stdio: 'ignore', timeout: 4000 }); } catch {}
             try { wscriptChild.kill(); } catch {}
-            finish(true);
+            finish({ timedOut: true });
           }, WSCRIPT_OPEN_DEADLINE_MS);
           if (typeof timer.unref === 'function') timer.unref();
-          wscriptChild.once('error', () => finish(false));
-          wscriptChild.once('exit', () => finish(false));
+          wscriptChild.once('error', () => finish({ timedOut: false, code: -1 }));
+          wscriptChild.once('exit', code => finish({ timedOut: false, code }));
         });
-        if (timedOut) {
+        if (outcome.timedOut) {
           const err = `wscript launcher did not exit within ${WSCRIPT_OPEN_DEADLINE_MS}ms; killed launcher (browser left running)`;
           attempts.push({ method: 'browser app mode (wscript)', ok: false, error: err });
           logOpenFailure('browser app mode (wscript)', err);
-        } else {
+        } else if (outcome.code === 0) {
+          // VBS exits 0 only after it re-checks FindChromePid post-spawn and a
+          // MAIN (non-helper) chrome for this profile is live — an honest
+          // "window materialized" signal, not just "the launcher exited". Any
+          // other code (esp. 2 = no window) falls through to the default browser.
           chromeSpawnOk = true;
           attempts.push({ method: 'browser app mode (wscript)', ok: true });
+        } else {
+          const err = `wscript exited ${outcome.code}; config window did not materialize`;
+          attempts.push({ method: 'browser app mode (wscript)', ok: false, error: err });
+          logOpenFailure('browser app mode (wscript)', err);
         }
       } catch (error) {
         attempts.push({ method: 'browser app mode (wscript)', ok: false, error: formatOpenError(error) });
@@ -2210,12 +2249,19 @@ async function handleRequest(req, res) {
     const rawMaint = cfg.maintenance || {};
     // Strip legacy keys that no longer belong in maintenance
     // (classification/recap were retired with the cycle1 split;
-    // scheduler/webhook keep their model per-entry).
+    // scheduler/webhook keep their model per-entry; the three memory-cycle
+    // MODEL presets collapsed into a single `memory` key — fold the first
+    // present legacy cycle value into `memory` before stripping).
     // Persist back when the stored config carried any of them so the Setup
     // panel and the runtime resolver stop having to dual-match name vs id.
     const allowedKeys = new Set([...Object.keys(DEFAULT_MAINTENANCE), ...MAINTENANCE_SLOTS]);
     const cleanMaint = {};
     let changed = false;
+    const legacyCycleKeys = ['cycle1', 'cycle2', 'cycle3'];
+    if (!('memory' in rawMaint) && legacyCycleKeys.some(k => k in rawMaint)) {
+      cleanMaint.memory = rawMaint.cycle1 ?? rawMaint.cycle2 ?? rawMaint.cycle3 ?? DEFAULT_MAINTENANCE.memory;
+      changed = true;
+    }
     for (const [k, v] of Object.entries(rawMaint)) {
       if (allowedKeys.has(k)) cleanMaint[k] = v;
       else changed = true;
@@ -2259,6 +2305,15 @@ async function handleRequest(req, res) {
       return;
     }
     const nextMaint = { ...(cfg.maintenance || {}) };
+    // Migrate any stored legacy cycle1/2/3 model keys into `memory` (one-time
+    // schema collapse) so the persisted config never carries them forward.
+    {
+      const legacyCycleKeys = ['cycle1', 'cycle2', 'cycle3'];
+      if (!('memory' in nextMaint) && legacyCycleKeys.some(k => k in nextMaint)) {
+        nextMaint.memory = nextMaint.cycle1 ?? nextMaint.cycle2 ?? nextMaint.cycle3 ?? DEFAULT_MAINTENANCE.memory;
+      }
+      for (const k of legacyCycleKeys) delete nextMaint[k];
+    }
     for (const [k, v] of Object.entries(data)) {
       if (v == null || v === '') delete nextMaint[k];   // inherit → remove override
       else nextMaint[k] = v;

package/setup/setup.html

@@ -2640,9 +2640,48 @@ const AG_EFFORT_LABEL = { none: 'None', low: 'Low', medium: 'Medium', high: 'Hig
 // Families that don't support fast mode even when the provider does.
 const AG_FAMILY_NO_FAST = new Set(['haiku', 'gpt-nano', 'gpt-codex']);
 const AG_FAST_PROVIDERS = new Set(['anthropic', 'anthropic-oauth', 'openai', 'openai-oauth']);
+const AG_OPENAI_DIRECT_FAST_MODEL_RE = [
+  /^gpt-5\.5(?:-\d{4}|$)/,
+  /^gpt-5\.4(?:-\d{4}|$)/,
+  /^gpt-5\.4-mini(?:-\d{4}|$)/,
+];
 let agModelList = [];
 const AG_ACCESS_LABELS = { full: 'Read & Write', readonly: 'Read Only', mcp: 'None' };
 
+function agNormalizeFastProvider(provider) {
+  return provider === 'openai-api' ? 'openai' : provider;
+}
+
+function agOpenAIDirectSupportsFast(modelId) {
+  const id = String(modelId || '').trim();
+  return AG_OPENAI_DIRECT_FAST_MODEL_RE.some(re => re.test(id));
+}
+
+function agExplicitFastSupport(model) {
+  const hasServiceTiers = Array.isArray(model?.serviceTiers);
+  const hasSpeedTiers = Array.isArray(model?.additionalSpeedTiers);
+  if (!hasServiceTiers && !hasSpeedTiers) return null;
+  const serviceTiers = hasServiceTiers ? model.serviceTiers : [];
+  const speedTiers = hasSpeedTiers ? model.additionalSpeedTiers : [];
+  const serviceFast = serviceTiers.some(t => {
+    const id = typeof t === 'string' ? t : t?.id;
+    return id === 'priority' || id === 'fast';
+  });
+  const speedFast = speedTiers.some(t => t === 'fast' || t === 'priority');
+  return serviceFast || speedFast;
+}
+
+function agModelSupportsFast(provider, model) {
+  const normalizedProvider = agNormalizeFastProvider(provider);
+  if (!model) return false;
+  const explicit = agExplicitFastSupport(model);
+  if (explicit !== null) return explicit;
+  if (normalizedProvider === 'openai') return agOpenAIDirectSupportsFast(model.id);
+  const providerFast = AG_FAST_PROVIDERS.has(normalizedProvider);
+  const familyNoFast = model?.family && AG_FAMILY_NO_FAST.has(model.family);
+  return providerFast && !familyNoFast;
+}
+
 async function loadAgentData() {
   const r = await fetch('/agent/config').then(r => r.json()).catch(() => ({}));
   agConfig = r.config || {};
@@ -2974,9 +3013,7 @@ function agUpdateEffortAndFast(provider) {
     effortSel.innerHTML = allowed.map(v => `<option value="${v}">${AG_EFFORT_LABEL[v] || v}</option>`).join('');
   }
 
-  const providerFast = AG_FAST_PROVIDERS.has(provider);
-  const familyNoFast = model?.family && AG_FAMILY_NO_FAST.has(model.family);
-  const fastAllowed = modelResolved && providerFast && !familyNoFast;
+  const fastAllowed = modelResolved && agModelSupportsFast(provider, model);
   fastRow.style.display = fastAllowed ? 'flex' : 'none';
   if (!fastAllowed) document.getElementById('ag-pf-fast').classList.remove('on');
 }
@@ -3479,8 +3516,8 @@ async function srRenderModelPresets() {
 }
 
 // Reveal/hide effort + fast based on the currently selected openai model.
-// Mirrors agUpdateEffortAndFast() so the rules are identical: model family
-// drives effort options, AG_FAST_PROVIDERS / AG_FAMILY_NO_FAST drive fast.
+// Mirrors agUpdateEffortAndFast() so the rules are identical: provider/model
+// metadata drives effort options and Fast Mode availability.
 function srUpdateOpenAIEffortFast() {
   const body = document.getElementById('sr-model-presets-body');
   if (!body) return;
@@ -3505,9 +3542,7 @@ function srUpdateOpenAIEffortFast() {
     effortSel.style.display = '';
     effortSel.innerHTML = allowed.map(v => '<option value="' + v + '"' + (v === storedEffort ? ' selected' : '') + '>' + (AG_EFFORT_LABEL[v] || v) + '</option>').join('');
   }
-  const providerFast = AG_FAST_PROVIDERS.has(normalizedProvider);
-  const familyNoFast = model?.family && AG_FAMILY_NO_FAST.has(model.family);
-  const fastAllowed = !!model && providerFast && !familyNoFast;
+  const fastAllowed = !!model && agModelSupportsFast(normalizedProvider, model);
   const fastLabel = body.querySelector('[data-fam-fast-label="openai"]');
   fastEl.style.display = fastAllowed ? '' : 'none';
   if (fastLabel) fastLabel.style.display = fastAllowed ? '' : 'none';
@@ -3607,9 +3642,7 @@ async function srSavePanel() {
 // -- Agent Maintenance --
 const AG_MAINT_TASKS = [
   { id: 'explore', label: 'Explore', desc: 'Filesystem exploration agent (explore tool)' },
-  { id: 'cycle1', label: 'Memory Cycle 1', desc: 'Chunker / classifier (memory ingestion)' },
-  { id: 'cycle2', label: 'Memory Cycle 2', desc: 'Root re-scorer (core memory promotion)' },
-  { id: 'cycle3', label: 'Memory Cycle 3', desc: 'Core memory reviewer' },
+  { id: 'memory', label: 'Memory Cycles', desc: 'Chunker / re-scorer / core reviewer (cycles 1-3)' },
 ];
 let agMaintenance = {};
 let agMaintenanceDefaults = {};

package/skills/setup/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: setup
-description: Invoke for ANY mixdog setup or config task — onboarding a fresh install AND editing existing config. Covers agent providers/models, bridge role→preset mapping (changing worker/reviewer/tester/debugger models), agent.presets, channels/Discord, memory, search, webhook/ngrok, quiet hours, DM access, address form (user title), launch flag, and secrets. Trigger on intents like "mixdog config", "edit/change settings", "set up", "세팅"/"설정 수정", "호칭 변경" (change how the assistant addresses the user), "조용시간"/quiet hours, DM access, "change worker (or any role) model", "add a preset", "switch provider", or first-time "what goes where". Also handles uninstall/restore intents ("remove mixdog", "restore pre-install state", "원상복구") — route those to `node scripts/uninstall.mjs` and UNINSTALL.md.
+description: Invoke for ANY mixdog setup or config task — onboarding a fresh install AND editing existing config. Covers agent providers/models, bridge role→preset mapping (changing worker/reviewer/tester/debugger models), agent.presets, the cross-verification workflow text & role roster (add/remove a role, tune the debugger/reviewer loop prose), channels/Discord, memory, search, webhook/ngrok, quiet hours, DM access, address form (user title), launch flag, and secrets. Trigger on intents like "mixdog config", "edit/change settings", "set up", "세팅"/"설정 수정", "호칭 변경" (change how the assistant addresses the user), "조용시간"/quiet hours, DM access, "change worker (or any role) model", "add a preset", "switch provider", "remove the tester role", "tune the debugger loop", "edit the workflow prose", or first-time "what goes where". Also handles uninstall/restore intents ("remove mixdog", "restore pre-install state", "원상복구") — route those to `node scripts/uninstall.mjs` and UNINSTALL.md.
 version: 0.1.0
 ---
 
@@ -14,6 +14,7 @@ Guided onboarding for a fresh mixdog install **and** a reference for editing exi
 |---|---|---|
 | Any setting value (channels, memory, agent presets, search, capabilities, cwd) | `${DATA}/mixdog-config.json` | `defaults/*.template.json`, anything under `<plugin>/cache/` |
 | Which model a role uses | `${DATA}/user-workflow.json` (`roles[].preset`) | `defaults/user-workflow.json` |
+| Add/remove a role (e.g. drop `tester`), or tune the workflow loop prose (cross-verification / debugger fan-out) | `${DATA}/user-workflow.json` (`roles[]`) **and** `${DATA}/user-workflow.md` (loop text) | the `defaults/` + `cache/` copies — those are the shipped template, edited only to change fresh-install defaults |
 | A secret (bot token, API key, authtoken) | OS keychain / `MIXDOG_*` env | any JSON file |
 | Skill text / prompts / plugin code | the marketplace **source** (`<plugin>/marketplaces/trib-plugin/`; dev installs: the source repo, then sync) | the `cache/` copy — it is overwritten on update/sync |
 
@@ -51,10 +52,19 @@ Guided onboarding for a fresh mixdog install **and** a reference for editing exi
 ## Config structure & editing
 
 - Config lives under the plugin data dir `~/.claude/plugins/data/mixdog-trib-plugin/` (the `CLAUDE_PLUGIN_DATA` env var overrides it). Two files matter:
-- **user-workflow.json** — `roles[] {name, preset, permission}` maps each bridge role to a preset (the active role set is whatever this file defines — e.g. worker / reviewer / debugger / tester). This sets which model each role uses. To change a role's model, set its `preset` to one of the preset names below (takes effect LIVE — bridge dispatch re-reads this file on every spawn; only the Lead's injected `# Roles` list waits for the next SessionStart).
+- **user-workflow.json** — `roles[] {name, preset, permission}` maps each bridge role to a preset (the active role set is whatever this file defines — e.g. worker / reviewer / debugger). This sets which model each role uses. To change a role's model, set its `preset` to one of the preset names below (takes effect LIVE — bridge dispatch re-reads this file on every spawn; only the Lead's injected `# Roles` list waits for the next SessionStart).
 - **mixdog-config.json → `agent.presets[] {id, name, type, provider, model, tools, effort?, fast?, xaiCacheMaxInFlight?}`** defines each preset, e.g. opus-high → claude-opus-4-8 / high, composer-2.5 → grok-composer-2.5-fast, gpt-5.5-xhigh → gpt-5.5 / xhigh. `type` is `"bridge"` and `tools` is `"full"` for normal worker presets; `xaiCacheMaxInFlight` is a grok-oauth-only tuning knob. `agent.default` is the fallback preset for any role without its own mapping. To offer a new model, add a preset here first, then point a role at it in user-workflow.json.
 - Edit via the Setup UI (Custom Workflow for role→preset, Agent presets for presets) or edit the JSON files directly (reloads next session). These are user data — no rebuild needed.
 
+### Workflow files — quick-edit map (NO exploration needed)
+
+Two sibling files under `${DATA}` (`~/.claude/plugins/data/mixdog-trib-plugin/`) define the active bridge workflow — edit them directly, do not go hunting:
+- **`${DATA}/user-workflow.json`** — `roles[] {name, preset, permission}`. The active role set IS exactly this list. Add or remove a role here (e.g. drop `tester`); removal takes effect on the next bridge spawn (live re-read). Keep each remaining role's `preset` untouched.
+- **`${DATA}/user-workflow.md`** — the role-assignment table + cross-verification loop prose, injected as the Lead's `# User Workflow` rule. Tune the debugger fan-out / reviewer pairing text here. The Lead's injected copy refreshes on the next SessionStart.
+- To change the **shipped fresh-install defaults** (not just this user), edit the repo's `defaults/user-workflow.{json,md}` to match. `cache/` copies are never the edit target.
+
+After editing `${DATA}` files, call `reload_config`; after editing repo `defaults/`, run dev-sync to propagate.
+
 ## Agent providers — supported list & onboarding
 
 A preset's `provider` field selects the backend. Authoritative allow-list:

package/src/agent/index.mjs

@@ -190,7 +190,7 @@ function scheduleAgentConfigReload(reason = 'change') {
   _agentConfigReloadTimer.unref?.();
 }
 
-async function reloadAgentConfig(reason = 'change') {
+export async function reloadAgentConfig(reason = 'change') {
   if (_agentConfigReloadRunning) {
     _agentConfigReloadQueued = true;
     return;

package/src/agent/orchestrator/config.mjs

@@ -1,5 +1,6 @@
 import { resolvePluginData } from '../../shared/plugin-paths.mjs';
 import { readSection, updateSection, getAgentApiKey } from '../../shared/config.mjs';
+import { OPENAI_COMPAT_PRESETS } from './providers/openai-compat.mjs';
 import { hasAnthropicOAuthCredentials } from './providers/anthropic-oauth.mjs';
 import { hasOpenAIOAuthCredentials } from './providers/openai-oauth.mjs';
 import { hasGrokOAuthCredentials } from './providers/grok-oauth.mjs';
@@ -23,15 +24,17 @@ const ENV_KEY_MAP = {
 // resolvePresetName() (bridge-llm) always resolves a model directly from
 // `maint[slot]` — no shared `defaultPreset` fallback is needed or used.
 // Memory cycles + Lead helper fan-out (explore/cycle1/cycle2/cycle3) and
-// entry-driven dispatch (scheduler/webhook) all default to `haiku`.
+// entry-driven dispatch (scheduler/webhook) all default to `haiku`. The three
+// memory cycles (chunker / re-scorer / core reviewer) share ONE `memory`
+// preset knob — the cycle agents stay separate (cycle1/2/3-agent, distinct
+// slots and invokedBy) but resolve their model from `maint.memory` via the
+// `maintKey` override on their hidden-role entries.
 // scheduler/webhook still let a per-entry config.json model win first (the
 // caller passes it explicitly via opts.preset); the haiku default below only
 // applies when an entry omits its own model.
 export const DEFAULT_MAINTENANCE = Object.freeze({
     explore: 'haiku',
-    cycle1: 'haiku',
-    cycle2: 'haiku',
-    cycle3: 'haiku',
+    memory: 'haiku',
     scheduler: 'haiku',
     webhook: 'haiku',
 });
@@ -41,7 +44,7 @@ export const DEFAULT_MAINTENANCE = Object.freeze({
 // SUBSET of DEFAULT_MAINTENANCE: scheduler/webhook carry a per-entry model and
 // are not shown as shared rows, but still inherit the haiku default above when
 // an entry omits its own model.
-export const MAINTENANCE_SLOTS = Object.freeze(['explore', 'cycle1', 'cycle2', 'cycle3']);
+export const MAINTENANCE_SLOTS = Object.freeze(['explore', 'memory']);
 
 // Map short Anthropic family labels to the full model ids used by the API.
 // Honors ANTHROPIC_DEFAULT_{OPUS|SONNET|HAIKU}_MODEL env overrides.
@@ -135,7 +138,11 @@ export function loadConfig() {
             // Provider API keys live in the OS keychain (std env / MIXDOG_AGENT_*
             // -> keychain), never plaintext in config. Overlay them so the
             // provider clients see config.apiKey populated.
-            for (const name of Object.keys(ENV_KEY_MAP)) {
+            // ENV_KEY_MAP covers first-class key providers; OPENAI_COMPAT_PRESETS
+            // covers compat providers (opencode-go, …) whose key also lives in
+            // the keychain. Without the union, a compat provider with a valid
+            // stored key still ships 'no-key' → 401.
+            for (const name of new Set([...Object.keys(ENV_KEY_MAP), ...Object.keys(OPENAI_COMPAT_PRESETS)])) {
                 const kc = getAgentApiKey(name);
                 if (kc) mergedProviders[name] = { ...(mergedProviders[name] || {}), apiKey: kc, enabled: true };
             }
@@ -148,6 +155,19 @@ export function loadConfig() {
             for (const [k, v] of Object.entries(raw.maintenance || {})) {
                 if (allowedMaintKeys.has(k)) rawMaint[k] = v;
             }
+            // One-time schema migration: the three memory-cycle MODEL presets
+            // (cycle1/cycle2/cycle3) collapsed into a single `memory` key. If the
+            // stored config still carries any old cycle key and no `memory`, fold
+            // the first present value into `memory` (preserving the user's
+            // choice), then the old keys drop via the allow-list above. This is a
+            // schema migration, NOT a runtime fallback — the persisted config is
+            // cleaned once so runtime never has to re-migrate.
+            const legacyCycleKeys = ['cycle1', 'cycle2', 'cycle3'];
+            let migratedMaintenance = false;
+            if (!('memory' in rawMaint) && legacyCycleKeys.some(k => k in (raw.maintenance || {}))) {
+                rawMaint.memory = raw.maintenance.cycle1 ?? raw.maintenance.cycle2 ?? raw.maintenance.cycle3 ?? DEFAULT_MAINTENANCE.memory;
+                migratedMaintenance = true;
+            }
             // Self-ref guard: mcpServers.mixdog / mcpServers["trib-plugin"]
             // would self-spawn through the in-process tool bridge. Strip on
             // ingress so user-edited configs cannot brick the agent boot.
@@ -180,6 +200,38 @@ export function loadConfig() {
                     process.stderr.write(`[config] persist sanitized config failed: ${err?.message}\n`);
                 }
             }
+            // Persist the memory-cycle schema migration once. rawMaint already
+            // carries the folded `memory` key and excludes the dropped cycle1/2/3
+            // keys (not in the allow-list); rebase onto the in-lock current so a
+            // concurrent writer's unrelated edits survive, mirroring the
+            // mcpServers self-ref strip above.
+            if (migratedMaintenance) {
+                try {
+                    persistAgentConfig((current) => {
+                        const cur = { ...current };
+                        const target = (cur.agent && cur.agent.providers)
+                            ? (cur.agent = { ...cur.agent })
+                            : cur;
+                        const curMaint = (target.maintenance && typeof target.maintenance === 'object') ? { ...target.maintenance } : {};
+                        // Derive `memory` from the IN-LOCK current, not the
+                        // pre-lock rawMaint snapshot — a concurrent writer may
+                        // have set maintenance.memory or changed a legacy cycle
+                        // value between this loadConfig()'s read and the lock.
+                        // If `memory` is already present in-lock, preserve it
+                        // (lost-update guard); otherwise fold the in-lock legacy
+                        // cycle value first, with the pre-lock snapshot as the
+                        // last-resort seed.
+                        if (!('memory' in curMaint)) {
+                            curMaint.memory = curMaint.cycle1 ?? curMaint.cycle2 ?? curMaint.cycle3 ?? rawMaint.memory;
+                        }
+                        for (const k of legacyCycleKeys) delete curMaint[k];
+                        target.maintenance = curMaint;
+                        return cur;
+                    });
+                } catch (err) {
+                    process.stderr.write(`[config] persist maintenance migration failed: ${err?.message}\n`);
+                }
+            }
             const rawPresets = Array.isArray(raw.presets) ? raw.presets : [];
             const normalizedPresets = rawPresets.map(p => normalizePreset(p)).filter(Boolean);
             return {

package/src/agent/orchestrator/providers/model-catalog.mjs

@@ -32,7 +32,7 @@ const MODELSDEV_URL = 'https://models.dev/api.json';
 const MODELSDEV_CACHE_FILE = 'modelsdev-catalog.json';
 
 // mixdog provider id → models.dev provider id. Identity for ids that already
-// match (opencode-go / deepseek / xai / nvidia / openai / anthropic / groq /
+// match (opencode-go / deepseek / xai / openai / anthropic / groq /
 // mistral); only the OAuth aliases and gemini→google need remapping.
 const _MODELSDEV_PROVIDER_ALIAS = {
     'anthropic-oauth': 'anthropic',

package/src/agent/orchestrator/providers/openai-oauth.mjs

@@ -133,7 +133,14 @@ function _codexServiceTiers(modelInfo) {
     return Array.isArray(modelInfo?.serviceTiers) ? modelInfo.serviceTiers : [];
 }
 
-function _codexModelSupportsServiceTier(id, serviceTier) {
+function _codexModelBlocksServiceTier(id, serviceTier) {
+    if (serviceTier !== 'priority') return false;
+    const family = _codexFamily(id);
+    return family === 'gpt-mini' || family === 'gpt-nano' || family === 'gpt-codex';
+}
+
+export function codexModelSupportsServiceTier(id, serviceTier) {
+    if (_codexModelBlocksServiceTier(id, serviceTier)) return false;
     const info = _findCachedCodexModel(id);
     if (!info) return true;
     const tiers = _codexServiceTiers(info);
@@ -530,7 +537,7 @@ export function buildRequestBody(messages, model, tools, sendOpts) {
         // accepts on the wire: 'fast' is hard-rejected ("Unsupported
         // service_tier: fast", probed 2026-06-11). Match official Codex:
         // only send the request value when the model catalog advertises it.
-        if (_codexModelSupportsServiceTier(model, 'priority')) {
+        if (codexModelSupportsServiceTier(model, 'priority')) {
             body.service_tier = 'priority';
         }
     }

package/src/agent/orchestrator/providers/openai-ws.mjs

@@ -16,6 +16,24 @@ import { sendViaWebSocket } from './openai-oauth-ws.mjs';
 import { buildRequestBody } from './openai-oauth.mjs';
 import { resolveProviderCacheKey } from '../smart-bridge/cache-strategy.mjs';
 
+const OPENAI_DIRECT_PRIORITY_MODEL_PATTERNS = Object.freeze([
+    /^gpt-5\.5(?:-\d{4}|$)/,
+    /^gpt-5\.4(?:-\d{4}|$)/,
+    /^gpt-5\.4-mini(?:-\d{4}|$)/,
+]);
+
+export function openAiDirectSupportsPriority(model) {
+    const id = String(model || '').trim();
+    return OPENAI_DIRECT_PRIORITY_MODEL_PATTERNS.some(re => re.test(id));
+}
+
+export function applyOpenAIDirectFastTier(body, model, opts) {
+    if (opts?.fast === true && openAiDirectSupportsPriority(model)) {
+        body.service_tier = 'priority';
+    }
+    return body;
+}
+
 export class OpenAIDirectProvider {
     // input_tokens INCLUDES cached tokens (OpenAI convention). See registry.mjs.
     static inputExcludesCache = false;
@@ -38,6 +56,11 @@ export class OpenAIDirectProvider {
         const apiKey = this._ensureKey();
         const useModel = model || 'gpt-5.5';
         const body = buildRequestBody(messages, useModel, tools, sendOpts);
+        // Public OpenAI API priority support is documented separately from the
+        // Codex OAuth catalog. Keep this provider's service-tier decision local
+        // so gpt-5.4-mini can opt into Priority even when the Codex catalog does
+        // not advertise a Fast tier for its OAuth endpoint.
+        applyOpenAIDirectFastTier(body, useModel, opts);
         // Public Responses API supports prompt_cache_retention='24h' at no
         // extra cost (same cached_input_tokens billing as the default 5–10
         // min in-memory cache). Codex/oauth rejects the parameter, so it's

package/src/agent/orchestrator/session/loop.mjs

@@ -628,7 +628,7 @@ async function executeTool(name, args, cwd, callerSessionId, sessionRef, execute
     if (isBuiltinTool(name)) {
         // clientHostPid threaded for the same per-terminal job-scope reason as
         // the bash branch above (see resolveJobOwnerHostPid).
-        return executeBuiltinTool(name, args, cwd, { sessionId: callerSessionId, clientHostPid: sessionRef?.clientHostPid, ...toolOpts });
+        return executeBuiltinTool(name, args, cwd, { sessionId: callerSessionId, clientHostPid: sessionRef?.clientHostPid, signal: executeOpts.signal, ...toolOpts });
     }
     return formatUnknownBuiltinToolMessage(name, args, 'tool');
 }
@@ -807,7 +807,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 try {
                     const permBlocked = _checkWorkerPermission(call.name, call.arguments, sessionRef);
                     if (permBlocked !== null) return { ok: true, value: permBlocked };
-                    return { ok: true, value: await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id }) };
+                    return { ok: true, value: await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal }) };
                 } catch (error) {
                     return { ok: false, error };
                 }
@@ -1185,7 +1185,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                             toolEndedAt = Date.now();
                             _resultKind = 'error';
                         } else {
-                            result = await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id });
+                            result = await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal });
                             toolEndedAt = Date.now();
                             // Boundary: tool-return string convention → structural kind.
                             // The only prefix check in this codebase; downstream layers

package/src/agent/orchestrator/smart-bridge/bridge-llm.mjs

@@ -117,13 +117,17 @@ export function resolvePresetName({ preset, optsPreset, role, config: cfgIn = nu
     // Hidden roles resolve their maintenance preset by SLOT. Every slot carries
     // a concrete default in DEFAULT_MAINTENANCE, so `maint[slot]` resolves
     // directly; the Setup panel can still tune each slot independently.
-    // (explorer.slot = 'explore', cycle1-agent.slot = 'cycle1', …)
+    // (explorer.slot = 'explore', cycle1-agent.slot = 'cycle1', …). A hidden
+    // role may override which maintenance key it reads via `maintKey`
+    // (e.g. the cycle1/2/3 agents all read `maint.memory` instead of their
+    // own slot) so several agents can share one model knob while keeping
+    // distinct slots/identity.
     const hidden = getHiddenRole(role);
     if (hidden) {
         try {
             const config = cfgIn || loadConfig();
             const maint = config?.maintenance || {};
-            return maint[hidden.slot] || null;
+            return maint[hidden.maintKey || hidden.slot] || null;
         } catch { return null; }
     }
     try {

package/src/agent/orchestrator/tools/bash-session.mjs

@@ -47,6 +47,7 @@ import { stripQuotedAndHeredoc, extractShellCInner } from './destructive-warning
 import { _maybeEncodePowerShellCommand } from './shell-command.mjs';
 import { _captureTrackedMtimes, _trackedDriftNoteAfter, _injectionBlockTargets, getDedupedDestructiveWarnings } from './builtin/bash-tool.mjs';
 import { scrubLoaderVars, scrubProviderSecrets } from './env-scrub.mjs';
+import { checkExecPolicyMessage } from './bash-policy-scan.mjs';
 
 // Default 600 s (10 min), max 1800 s. Aligned with the one-shot bash tool's
 // 600 s default (builtin/bash-tool.mjs); the persistent shell carries

package/src/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -125,7 +125,7 @@ export const BUILTIN_TOOLS = [
         name: 'bash',
         title: 'Mixdog Shell',
         annotations: { title: 'Mixdog Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: "Shell for git/build/test/run. Use current-OS syntax: Windows default = PowerShell; POSIX default = /bin/sh. Always pass shell matching your syntax: 'bash' = POSIX via Git Bash, 'powershell' = PS cmdlets; omitting uses the OS default and mis-parses the other. run_in_background works for both shells, including Windows shell:'bash' (Git Bash). Single shell entry point; not for inline code you were asked to return.",
+        description: "Shell for git/build/test/run. ALWAYS set `shell` explicitly ('bash' = POSIX via Git Bash, 'powershell' = PS cmdlets); omitting defaults to the OS shell (Windows = PowerShell, POSIX = /bin/sh) and mis-parses the other syntax. run_in_background works for both shells, including Windows shell:'bash' (Git Bash). Single shell entry point; not for inline code you were asked to return.",
         inputSchema: {
             type: 'object',
             properties: {