mixdog 0.7.8 → 0.7.12

package/src/agent/orchestrator/tools/patch-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.6.5",
+  "version": "0.7.12",
   "_comment": "Rewritten by .github/workflows/patch-release.yml on each tagged release. assets maps platformKey (process.platform-process.arch, e.g. win32-x64, linux-x64, darwin-arm64) to { url, sha256 } of the mixdog-patch binary on the GitHub release. A local cargo build under native/mixdog-patch/target/release always takes precedence; otherwise the binary is fetched per this manifest into the data dir (apply is native-only — no JS apply engine).",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.6.5/mixdog-patch-darwin-arm64",
-      "sha256": "d37afb583cd597a9599ea9feac76a853d215ffaadc2bb2b54cf71ef28848f7ae"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.12/mixdog-patch-darwin-arm64",
+      "sha256": "836a0b60a443b0a6a8c1bbe24d15a79ed70ee92c2f0fbc05374c4e9ed2536415"
     },
     "darwin-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.6.5/mixdog-patch-darwin-x64",
-      "sha256": "bc4dad6a7fdc2fcdfceb850bcaae43757ae304740ca503be955eb57cf8cd07e3"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.12/mixdog-patch-darwin-x64",
+      "sha256": "cab10c4e1e8b72d3958241dffdff764712ed74f4861d105bafa8258961215c98"
     },
     "linux-arm64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.6.5/mixdog-patch-linux-arm64",
-      "sha256": "ebe3fd45aaed0f383f7b7940733fd141dd0b93c4c44e08fbffab10a3e43b788c"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.12/mixdog-patch-linux-arm64",
+      "sha256": "a90c32ce3417a7d853f2723f82f3613cf2cd030fe885cf710cfc9f8e4b193264"
     },
     "linux-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.6.5/mixdog-patch-linux-x64",
-      "sha256": "627289a3b5c0156bc299d4ff7563e4e4536a5a5bf6329e7c9151e811c795928f"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.12/mixdog-patch-linux-x64",
+      "sha256": "0fea40ab98acd35bfb47515756024d1882a2abbaddce8a0b51642d20ac405577"
     },
     "win32-x64": {
-      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.6.5/mixdog-patch-win32-x64.exe",
-      "sha256": "4282546719a8c149597d3afe21eaf31aab3079a371876bf7f91ff0bccbe316b2"
+      "url": "https://github.com/trib-plugin/mixdog/releases/download/v0.7.12/mixdog-patch-win32-x64.exe",
+      "sha256": "f8a74fb9bb7bf333fa441b800b76b28d83a2a7b4795e4a769122faf47a59d1f1"
     }
   }
 }

package/src/channels/index.mjs

@@ -183,10 +183,18 @@ const _bootLogEarly = path.join(
   process.env.CLAUDE_PLUGIN_DATA || path.join(os.tmpdir(), "mixdog"),
   "boot.log"
 );
+const {
+  isMixdogDebugEnabled: isMixdogDebug,
+  pruneStalePluginDataLogSiblings,
+  appendSessionStartCriticalLog,
+  DEFAULT_STALE_LOG_SIBLING_MAX,
+} = _require("../../lib/mixdog-debug.cjs");
 // One-shot log rotation at worker boot (10 MB threshold, .1 suffix overwrite).
-try { if (fs.statSync(_bootLogEarly).size > 10 * 1024 * 1024) fs.renameSync(_bootLogEarly, _bootLogEarly + '.1') } catch {}
-fs.appendFileSync(_bootLogEarly, `[${localTimestamp()}] bootstrap start pid=${process.pid}
+if (isMixdogDebug()) {
+  try { if (fs.statSync(_bootLogEarly).size > 10 * 1024 * 1024) fs.renameSync(_bootLogEarly, _bootLogEarly + '.1') } catch {}
+  fs.appendFileSync(_bootLogEarly, `[${localTimestamp()}] bootstrap start pid=${process.pid}
 `);
+}
 const _bootLog = path.join(DATA_DIR, "boot.log");
 let config = loadConfig();
 let backend = createBackend(config);
@@ -238,6 +246,11 @@ try {
     try { if (_now - fs.statSync(_p).mtimeMs > _STALE_SESSION_TTL_MS) fs.unlinkSync(_p); } catch {}
   }
 } catch {}
+// Count-based cap: drop oldest *.log siblings when plugin-data accumulates
+// hundreds of per-process files (doctor warns above 300).
+try {
+  pruneStalePluginDataLogSiblings(DATA_DIR, DEFAULT_STALE_LOG_SIBLING_MAX);
+} catch {}
 
 // ── Buffered drop-trace writer (channels/index) ──────────────────────────────
 // Flushes every 1 s OR when buffer reaches 64 KB — whichever fires first.
@@ -2030,8 +2043,12 @@ backend.onInteraction = (interaction) => {
     const [, uuid, action] = match;
     const access = config.access;
     if (!access) {
-      fs.appendFileSync(_bootLog, `[${localTimestamp()}] perm interaction dropped: no access config
-`);
+      const _permDropLine = `[${localTimestamp()}] perm interaction dropped: no access config\n`;
+      if (isMixdogDebug()) {
+        fs.appendFileSync(_bootLog, _permDropLine);
+      } else {
+        appendSessionStartCriticalLog(DATA_DIR, `[channels] ${_permDropLine}`);
+      }
       return;
     }
     if (access.allowFrom?.length > 0 && !access.allowFrom.includes(interaction.userId)) {
@@ -3016,12 +3033,14 @@ async function stop() {
     return false;
   };
   _channelFlagDetected = detectChannelFlag();
-  fs.appendFileSync(_bootLog, `[${localTimestamp()}] channelFlag: ${_channelFlagDetected}
-`);
+  if (isMixdogDebug()) {
+    fs.appendFileSync(_bootLog, `[${localTimestamp()}] channelFlag: ${_channelFlagDetected}\n`);
+    if (_channelFlagDetected) {
+      fs.appendFileSync(_bootLog, `[${localTimestamp()}] channel mode detected — bridge auto-activated\n`);
+    }
+  }
   if (_channelFlagDetected) {
     channelBridgeActive = true;
-    fs.appendFileSync(_bootLog, `[${localTimestamp()}] channel mode detected \u2014 bridge auto-activated
-`);
   }
   writeBridgeState(channelBridgeActive);
   const previousOwner = readActiveInstance();

package/src/channels/lib/event-queue.mjs

@@ -1,4 +1,4 @@
-import { readdirSync, readFileSync, existsSync as fsExistsSync } from "fs";
+import { readdirSync, readFileSync, existsSync as fsExistsSync, statSync, unlinkSync } from "fs";
 import { join } from "path";
 import { DATA_DIR } from "./config.mjs";
 import { ensureDir } from "./state-file.mjs";
@@ -7,6 +7,27 @@ import { renameWithRetrySync, writeJsonAtomicSync } from "../../shared/atomic-fi
 const QUEUE_DIR = join(DATA_DIR, "events", "queue");
 const IN_PROGRESS_DIR = join(DATA_DIR, "events", "in-progress");
 const PROCESSED_DIR = join(DATA_DIR, "events", "processed");
+const PROCESSED_DIR_MAX_ENTRIES = 200;
+function pruneProcessedDir() {
+  try {
+    if (!fsExistsSync(PROCESSED_DIR)) return;
+    const names = readdirSync(PROCESSED_DIR);
+    if (names.length <= PROCESSED_DIR_MAX_ENTRIES) return;
+    const ranked = [];
+    for (const name of names) {
+      try {
+        const st = statSync(join(PROCESSED_DIR, name));
+        ranked.push({ name, mtime: st.mtimeMs });
+      } catch {}
+    }
+    ranked.sort((a, b) => b.mtime - a.mtime);
+    for (let i = PROCESSED_DIR_MAX_ENTRIES; i < ranked.length; i++) {
+      try {
+        unlinkSync(join(PROCESSED_DIR, ranked[i].name));
+      } catch {}
+    }
+  } catch {}
+}
 function finiteInt(value, { min, max, def }) {
   const n = Number(value);
   if (!Number.isFinite(n)) return def;
@@ -290,6 +311,7 @@ ${p.item.prompt}`).join("\n\n")}`;
       const fromQueue = join(QUEUE_DIR, file);
       const src = this.existsSync(fromInProgress) ? fromInProgress : fromQueue;
       renameWithRetrySync(src, join(PROCESSED_DIR, `${status}-${file}`));
+      pruneProcessedDir();
     } catch {
     }
   }
@@ -297,6 +319,7 @@ ${p.item.prompt}`).join("\n\n")}`;
     try {
       ensureDir(PROCESSED_DIR);
       renameWithRetrySync(join(IN_PROGRESS_DIR, file), join(PROCESSED_DIR, `${status}-${file}`));
+      pruneProcessedDir();
     } catch {
     }
   }

package/src/channels/lib/hook-pipe-server.mjs

@@ -24,6 +24,11 @@ import { request as httpsRequest } from 'node:https'
 import { createRequire } from 'node:module'
 
 const moduleRequire = createRequire(import.meta.url)
+const {
+  isMixdogDebugEnabled,
+  pruneStalePluginDataLogSiblings,
+  DEFAULT_STALE_LOG_SIBLING_MAX,
+} = moduleRequire('../../../lib/mixdog-debug.cjs')
 
 // IPC transport path. Windows uses a named pipe (`\\.\pipe\…`); Unix uses a
 // Unix domain socket under XDG_RUNTIME_DIR (or /tmp as fallback). Node's
@@ -57,9 +62,13 @@ const POLL_INTERVAL_MS = 2000
 const SUBAGENT_TIMEOUT_MS = 120_000
 const DEFAULT_DISPATCH_TIMEOUT_MS = 15_000
 const SESSION_START_MEMORY_DISPATCH_TIMEOUT_MS = 125_000
-const SESSION_START_TRACE_ENABLED =
-  process.env.MIXDOG_DEBUG_SESSION_START === '1' ||
-  process.env.MIXDOG_DEBUG_SESSION_START === 'true'
+const MIXDOG_DEBUG_ENABLED = isMixdogDebugEnabled()
+let _hookPipeLogsPruned = false
+
+function hookPipeDebugStderr(line) {
+  if (!MIXDOG_DEBUG_ENABLED) return
+  try { process.stderr.write(line) } catch {}
+}
 
 let _started = false
 let _server = null
@@ -82,13 +91,17 @@ function formatError(err) {
 }
 
 function traceSessionStart(message) {
-  if (!SESSION_START_TRACE_ENABLED) return
+  if (!MIXDOG_DEBUG_ENABLED) return
   const line = `[${new Date().toISOString()}] [hook-pipe][session-start] ${message}\n`
   try { process.stderr.write(line) } catch {}
   try {
     const dataDir = process.env.CLAUDE_PLUGIN_DATA ||
       join(homedir(), '.claude', 'plugins', 'data', 'mixdog-trib-plugin')
     mkdirSync(dataDir, { recursive: true })
+    if (!_hookPipeLogsPruned) {
+      _hookPipeLogsPruned = true
+      pruneStalePluginDataLogSiblings(dataDir, DEFAULT_STALE_LOG_SIBLING_MAX)
+    }
     appendFileSync(join(dataDir, 'session-start.log'), line)
   } catch {}
 }
@@ -320,10 +333,10 @@ async function handlePreToolSubagent(payload) {
   }
   const route = routeMod.shouldRoutePermissionToDiscord()
   if (route.route !== 'discord') {
-    process.stderr.write(`[hook-pipe] pre-tool-subagent discord-route=off agent=${agentIdRaw || 'unknown'} tool=${toolName} reason=${route.reason || 'inactive'}\n`)
+    hookPipeDebugStderr(`[hook-pipe] pre-tool-subagent discord-route=off agent=${agentIdRaw || 'unknown'} tool=${toolName} reason=${route.reason || 'inactive'}\n`)
     return null
   }
-  process.stderr.write(`[hook-pipe] pre-tool-subagent discord-route=on agent=${agentIdRaw || 'unknown'} tool=${toolName}\n`)
+  hookPipeDebugStderr(`[hook-pipe] pre-tool-subagent discord-route=on agent=${agentIdRaw || 'unknown'} tool=${toolName}\n`)
 
   let getDiscordToken
   try {
@@ -715,7 +728,7 @@ export function startHookPipeServer() {
   _server.on('error', (err) => {
     const msg = String(err?.message || err || '')
     if (err?.code === 'EADDRINUSE' || msg.includes('EADDRINUSE') || msg.includes('Failed to listen')) {
-      process.stderr.write(`[hook-pipe] ${PIPE_PATH} already owned by a peer daemon; standby for hook IPC\n`)
+      hookPipeDebugStderr(`[hook-pipe] ${PIPE_PATH} already owned by a peer daemon; standby for hook IPC\n`)
       _server = null
       _started = false
       return
@@ -727,7 +740,7 @@ export function startHookPipeServer() {
     try {
       _server.listen(PIPE_PATH, () => {
         _started = true
-        process.stderr.write(`[hook-pipe] listening on ${PIPE_PATH}\n`)
+        hookPipeDebugStderr(`[hook-pipe] listening on ${PIPE_PATH}\n`)
       })
     } catch (err) {
       process.stderr.write(`[hook-pipe] listen failed: ${err?.message || err}\n`)

package/src/channels/lib/webhook.mjs

@@ -4,7 +4,7 @@ import { join } from "path";
 import { spawn, spawnSync, execSync } from "child_process";
 import { DATA_DIR, isInQuietWindow } from "./config.mjs";
 import { getWebhookAuthtoken } from "../../shared/config.mjs";
-import { appendFileSync, readFileSync, readdirSync, mkdirSync, writeFileSync, unlinkSync, statSync, existsSync, watch as fsWatch } from "fs";
+import { appendFileSync, readFileSync, readdirSync, mkdirSync, writeFileSync, unlinkSync, statSync, existsSync, renameSync, watch as fsWatch } from "fs";
 import { randomUUID } from "crypto";
 const WEBHOOKS_DIR = join(DATA_DIR, "webhooks");
 const WEBHOOK_LOG = join(DATA_DIR, "webhook.log");
@@ -144,39 +144,160 @@ function loadEndpointConfig(name) {
 // then {status:"done"|"failed"|"dedup"}. Earlier fields (payloadPreview,
 // headersSummary) are kept on the first line only; later status updates
 // reference the same `id` and are merged latest-wins at read time.
+const DELIVERY_INDEX_MAX_IDS = 2000;
+const DELIVERY_LOG_MAX_LINES = 10_000;
+/** @type {Map<string, Map<string, object>>} */
+const _deliveryIndexByEndpoint = new Map();
+/** @type {Set<string>} */
+const _deliveryIndexWarmed = new Set();
+/** @type {Map<string, number>} */
+const _deliveryLogLineCountByEndpoint = new Map();
+/** @type {Map<string, number>} distinct-id count at last warm/compaction; drives the redundancy-based compaction trigger. */
+const _deliveryKeptCountByEndpoint = new Map();
 function _deliveriesPath(name) {
   return join(WEBHOOKS_DIR, name, "deliveries.jsonl");
 }
-function appendDelivery(name, entry) {
-  try {
-    const dir = join(WEBHOOKS_DIR, name);
-    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-    const line = JSON.stringify({ ts: new Date().toISOString(), ...entry }) + "\n";
-    appendFileSync(_deliveriesPath(name), line);
-    return true;
-  } catch (err) {
-    logWebhook(`${name}: deliveries append failed: ${err?.message ?? err}`);
-    return false;
+function _mergeDeliveryRows(prior, entry) {
+  return prior ? { ...prior, ...entry } : entry;
+}
+function _isBlockingDeliveryStatus(status) {
+  return status === "received" || status === "processing" || status === "done";
+}
+function _deliveryIndexFor(name) {
+  let map = _deliveryIndexByEndpoint.get(name);
+  if (!map) {
+    map = new Map();
+    _deliveryIndexByEndpoint.set(name, map);
   }
+  return map;
 }
-function readDeliveries(name) {
+function _pruneDeliveryIndexMap(byId) {
+  if (byId.size <= DELIVERY_INDEX_MAX_IDS) return;
+  const rows = [...byId.entries()];
+  const blocking = rows.filter(([, e]) => _isBlockingDeliveryStatus(e.status));
+  const nonBlocking = rows.filter(([, e]) => !_isBlockingDeliveryStatus(e.status));
+  nonBlocking.sort((a, b) => String(b[1].ts || "").localeCompare(String(a[1].ts || "")));
+  const keepIds = new Set(blocking.map(([id]) => id));
+  for (const [id] of nonBlocking) {
+    if (keepIds.size >= DELIVERY_INDEX_MAX_IDS) break;
+    keepIds.add(id);
+  }
+  for (const id of byId.keys()) {
+    if (!keepIds.has(id)) byId.delete(id);
+  }
+}
+function _deliveryLogLineCount(name) {
+  return _deliveryLogLineCountByEndpoint.get(name) ?? 0;
+}
+function _setDeliveryLogLineCount(name, n) {
+  _deliveryLogLineCountByEndpoint.set(name, Math.max(0, n));
+}
+function _bumpDeliveryLogLineCount(name, delta = 1) {
+  _setDeliveryLogLineCount(name, _deliveryLogLineCount(name) + delta);
+}
+function _readDeliveriesFileMerged(name) {
   const p = _deliveriesPath(name);
-  if (!existsSync(p)) return [];
   const byId = new Map();
+  let lineCount = 0;
+  if (!existsSync(p)) return { byId, lineCount };
   try {
     const raw = readFileSync(p, "utf8");
     for (const line of raw.split("\n")) {
       if (!line) continue;
+      lineCount++;
       try {
         const entry = JSON.parse(line);
-        if (!entry || !entry.id) continue;
-        const prior = byId.get(entry.id);
-        const merged = prior ? { ...prior, ...entry } : entry;
-        byId.set(entry.id, merged);
+        if (!entry?.id) continue;
+        byId.set(entry.id, _mergeDeliveryRows(byId.get(entry.id), entry));
       } catch {}
     }
   } catch {}
-  return [...byId.values()];
+  return { byId, lineCount };
+}
+function _ingestDeliveriesFileIntoIndex(name) {
+  const { byId: merged, lineCount } = _readDeliveriesFileMerged(name);
+  const byId = _deliveryIndexFor(name);
+  byId.clear();
+  for (const [id, row] of merged) byId.set(id, row);
+  _pruneDeliveryIndexMap(byId);
+  _setDeliveryLogLineCount(name, lineCount);
+  _deliveryKeptCountByEndpoint.set(name, merged.size);
+}
+function _ensureDeliveryIndex(name) {
+  if (_deliveryIndexWarmed.has(name)) return;
+  _deliveryIndexWarmed.add(name);
+  _ingestDeliveriesFileIntoIndex(name);
+}
+function _applyDeliveryEntryToIndex(name, entry) {
+  if (!entry?.id) return;
+  const byId = _deliveryIndexFor(name);
+  byId.set(entry.id, _mergeDeliveryRows(byId.get(entry.id), entry));
+  _pruneDeliveryIndexMap(byId);
+}
+function _compactDeliveriesLogIfNeeded(name) {
+  // Redundancy-based trigger: compact only when the log holds meaningfully more
+  // lines than distinct ids (i.e. there are status-update rows to collapse).
+  // The threshold scales with the distinct-id count so an endpoint with many
+  // legitimate blocking ids does NOT re-compact on every append (which would
+  // re-read the whole log permanently once distinct > DELIVERY_LOG_MAX_LINES).
+  const kept = _deliveryKeptCountByEndpoint.get(name) ?? _deliveryIndexFor(name).size;
+  const threshold = Math.max(DELIVERY_LOG_MAX_LINES, kept * 2);
+  if (_deliveryLogLineCount(name) <= threshold) return;
+  const { byId: merged } = _readDeliveriesFileMerged(name);
+  const rows = [...merged.values()];
+  const blocking = rows.filter((e) => _isBlockingDeliveryStatus(e.status));
+  const nonBlocking = rows.filter((e) => !_isBlockingDeliveryStatus(e.status));
+  nonBlocking.sort((a, b) => String(b.ts || "").localeCompare(String(a.ts || "")));
+  const keep = new Map();
+  for (const e of blocking) keep.set(e.id, e);
+  for (const e of nonBlocking) {
+    if (keep.size >= DELIVERY_INDEX_MAX_IDS) break;
+    if (!keep.has(e.id)) keep.set(e.id, e);
+  }
+  const lines = [...keep.values()]
+    .sort((a, b) => String(a.ts || "").localeCompare(String(b.ts || "")))
+    .map((e) => JSON.stringify(e) + "\n")
+    .join("");
+  const p = _deliveriesPath(name);
+  const tmp = `${p}.compact-${process.pid}-${Date.now()}.tmp`;
+  try {
+    writeFileSync(tmp, lines);
+    renameSync(tmp, p);
+    // Refresh index + counters by RE-READING the post-rename file (not the
+    // pre-rename `keep` snapshot). The webhook daemon is the single writer and
+    // append+compact run synchronously in one process, so no append can
+    // interleave between the fresh read and the rename; re-reading keeps the
+    // warmed state exactly matching on-disk content.
+    _ingestDeliveriesFileIntoIndex(name);
+  } catch (err) {
+    logWebhook(`${name}: deliveries compact failed: ${err?.message ?? err}`);
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp);
+    } catch {}
+  }
+}
+function appendDelivery(name, entry) {
+  try {
+    const dir = join(WEBHOOKS_DIR, name);
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    const full = { ts: new Date().toISOString(), ...entry };
+    const line = JSON.stringify(full) + "\n";
+    appendFileSync(_deliveriesPath(name), line);
+    const wasWarmed = _deliveryIndexWarmed.has(name);
+    _ensureDeliveryIndex(name);
+    if (wasWarmed) _bumpDeliveryLogLineCount(name, 1);
+    _applyDeliveryEntryToIndex(name, full);
+    _compactDeliveriesLogIfNeeded(name);
+    return true;
+  } catch (err) {
+    logWebhook(`${name}: deliveries append failed: ${err?.message ?? err}`);
+    return false;
+  }
+}
+function readDeliveries(name) {
+  _ensureDeliveryIndex(name);
+  const byId = _deliveryIndexByEndpoint.get(name);
+  return byId ? [...byId.values()] : [];
 }
 // Dedup gate against a still-active claim or a successful prior delivery.
 // Only rows with status "received" (non-terminal claim) or "done"
@@ -186,12 +307,13 @@ function readDeliveries(name) {
 // scoping, every prior row would permanently dedup the id and stop
 // legit redelivery.
 function deliveryExists(name, id) {
-  const list = readDeliveries(name);
   // "processing" must also dedup: a delegate dispatch in flight (up to
   // DISPATCH_TIMEOUT_MS = 10 min) would otherwise be duplicated by a
   // retried delivery of the same id while the first handler is still
   // running. Block on any non-terminal status.
-  return list.some((e) => e.id === id && (e.status === "received" || e.status === "processing" || e.status === "done"));
+  _ensureDeliveryIndex(name);
+  const entry = _deliveryIndexFor(name).get(id);
+  return Boolean(entry && _isBlockingDeliveryStatus(entry.status));
 }
 function extractDeliveryId(headers) {
   return headers["x-github-delivery"]

package/src/memory/lib/memory-cycle1.mjs

@@ -545,9 +545,13 @@ async function _runCycle1Impl(db, config = {}, options = {}, dataDir = null) {
     }
   }
 
-  // Fire every window at once: windowCount is bounded by fetchLimit / batchSize
-  // (<= session_cap), so there is no need to throttle the fan-out.
-  const sem = createSemaphore(Math.max(1, windows.length))
+  // Cap fan-out concurrency so a large batch (or a manual run) doesn't fire all
+  // window LLM calls at once and spike the provider / collide with the global
+  // agent-IPC limit. Small batches (<= cap) still run fully parallel.
+  const cycle1Concurrency = Math.max(1, Number(
+    config.cycle1_concurrency ?? config.concurrency ?? options.concurrency ?? options.maxConcurrent ?? 4,
+  ))
+  const sem = createSemaphore(Math.min(Math.max(1, windows.length), cycle1Concurrency))
   const settled = await Promise.allSettled(
     windows.map((rows, idx) => sem(() => {
       throwIfAborted(signal)

package/src/memory/lib/memory-recall-store.mjs

@@ -504,6 +504,32 @@ LEFT JOIN exact  x ON x.id = c.id`
   const rootIdsForReturn = []
   const seen = new Set()
 
+  // Batch-resolve member-chunk roots in ONE query (was an N+1: a per-row SELECT
+  // inside the loop below). Collect the distinct in-scope chunk_root ids, fetch
+  // all matching roots at once, then resolve each member from rootById.
+  const memberRootIds = []
+  const memberRootSeen = new Set()
+  for (const { id } of filtered) {
+    const r0 = byId.get(id)
+    if (!r0 || r0.is_root === 1) continue
+    if (r0.chunk_root != null && r0.chunk_root !== r0.id) {
+      const rid = Number(r0.chunk_root)
+      if (!memberRootSeen.has(rid)) { memberRootSeen.add(rid); memberRootIds.push(rid) }
+    }
+  }
+  const rootById = new Map()
+  if (memberRootIds.length > 0) {
+    const { clause: rootScopeClause, params: rootScopeParams } = buildScopeClause(2)
+    const { rows: rootRows } = await recallReadQuery(
+      db,
+      `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
+              element, category, summary, project_id, status, score, last_seen_at
+       FROM entries WHERE id = ANY($1::bigint[]) AND is_root = 1 ${rootScopeClause}`,
+      [memberRootIds, ...rootScopeParams],
+    )
+    for (const rr of rootRows) rootById.set(Number(rr.id), rr)
+  }
+
   for (const { id, rrf, retrievalScore } of filtered) {
     const row = byId.get(id)
     if (!row) continue
@@ -511,16 +537,7 @@ LEFT JOIN exact  x ON x.id = c.id`
     if (row.is_root === 1) {
       targetRow = row
     } else if (row.chunk_root != null && row.chunk_root !== row.id) {
-      // $1 = chunk_root id, scope param (if any) = $2
-      const { clause: rootScopeClause, params: rootScopeParams } = buildScopeClause(2)
-      const { rows: rootRows } = await recallReadQuery(
-        db,
-        `SELECT id, ts, role, content, session_id, source_turn, chunk_root, is_root,
-                element, category, summary, project_id, status, score, last_seen_at
-         FROM entries WHERE id = $1 AND is_root = 1 ${rootScopeClause}`,
-        [row.chunk_root, ...rootScopeParams],
-      )
-      const r = rootRows[0]
+      const r = rootById.get(Number(row.chunk_root))
       if (!r) continue
       memberHitRootIds.add(r.id)
       targetRow = r

package/src/search/lib/backends/openai-oauth.mjs

@@ -5,7 +5,11 @@
  * Calls Codex WebSocket endpoint via sendViaWebSocket with web_search server
  * tool. Model is config-driven (search.models.openai default 'gpt-5.4-mini').
  */
-import { OpenAIOAuthProvider, ensureLatestCodexModel } from '../../../agent/orchestrator/providers/openai-oauth.mjs'
+import {
+  OpenAIOAuthProvider,
+  ensureLatestCodexModel,
+  codexModelSupportsServiceTier,
+} from '../../../agent/orchestrator/providers/openai-oauth.mjs'
 import {
   OPENAI_SEARCH_SYSTEM_INSTRUCTIONS,
   buildOpenAISearchPrompt,
@@ -66,7 +70,7 @@ export async function searchViaOpenAIOAuth({
     parallel_tool_calls: false,
     tools: [buildOpenAIWebSearchTool({ site, type, locale, contextSize })],
   }
-  if (fast === true) body.service_tier = 'priority'
+  if (fast === true && codexModelSupportsServiceTier(useModel, 'priority')) body.service_tier = 'priority'
   // Route through provider.send() (not sendViaWebSocket directly) so the search
   // request inherits the 401/403 force-refresh retry + HTTP/SSE fallback. A
   // stale token or unhealthy WebSocket then recovers instead of hard-failing.

package/src/search/lib/cache.mjs

@@ -5,6 +5,52 @@ const DEFAULT_CACHE_STATE = {
   entries: {},
 }
 
+// Size bounds on top of TTL expiry so cache.local.json can't grow unbounded.
+const MAX_CACHE_ENTRIES = 500
+const MAX_CACHE_BYTES = 8 * 1024 * 1024
+
+// Approximate serialized size of ONE entry (never the whole map), so insert and
+// evict stay cheap. A running total on the state (`__approxBytes`) lets the byte
+// cap be checked without re-serializing every entry on each set.
+function approxEntryBytes(key, entry) {
+  try { return String(key).length + JSON.stringify(entry).length } catch { return String(key).length }
+}
+function cacheApproxBytes(state) {
+  if (typeof state.__approxBytes === 'number') return state.__approxBytes
+  let total = 0
+  for (const [k, e] of Object.entries(state.entries)) total += approxEntryBytes(k, e)
+  state.__approxBytes = total
+  return total
+}
+function removeCacheEntry(state, key) {
+  const e = state.entries[key]
+  if (e === undefined) return
+  if (typeof state.__approxBytes === 'number') state.__approxBytes -= approxEntryBytes(key, e)
+  delete state.entries[key]
+}
+function evictOldestCacheEntry(state) {
+  let oldestKey = null
+  let oldestAt = Infinity
+  for (const [k, e] of Object.entries(state.entries)) {
+    const at = e?.cachedAt ?? 0
+    if (at < oldestAt) { oldestAt = at; oldestKey = k }
+  }
+  if (oldestKey == null) return false
+  removeCacheEntry(state, oldestKey)
+  return true
+}
+// Best-effort: evict oldest entries until under both the count and byte caps.
+function enforceCacheSizeBounds(state) {
+  try {
+    while (Object.keys(state.entries).length > MAX_CACHE_ENTRIES) {
+      if (!evictOldestCacheEntry(state)) break
+    }
+    while (cacheApproxBytes(state) > MAX_CACHE_BYTES && Object.keys(state.entries).length > 0) {
+      if (!evictOldestCacheEntry(state)) break
+    }
+  } catch { /* size bounding is best-effort */ }
+}
+
 const FLUSH_DELAY_MS = 5000
 
 let cacheDirty = false
@@ -75,6 +121,8 @@ export function loadCacheState() {
   _instance = state
   activeCacheState = state
   pruneExpiredEntries(state)
+  cacheApproxBytes(state)
+  enforceCacheSizeBounds(state)
   return state
 }
 
@@ -90,7 +138,7 @@ export function getCachedEntry(state, key) {
   const entry = state.entries[key]
   if (!entry) return null
   if (entry.expiresAt && entry.expiresAt <= nowMs()) {
-    delete state.entries[key]
+    removeCacheEntry(state, key)
     scheduleCacheFlush(state)
     return null
   }
@@ -99,11 +147,11 @@ export function getCachedEntry(state, key) {
 
 export function setCachedEntry(state, key, payload, ttlMs) {
   const cachedAt = nowMs()
-  state.entries[key] = {
-    cachedAt,
-    expiresAt: cachedAt + ttlMs,
-    payload,
-  }
+  if (state.entries[key] !== undefined) removeCacheEntry(state, key)
+  const entry = { cachedAt, expiresAt: cachedAt + ttlMs, payload }
+  state.entries[key] = entry
+  if (typeof state.__approxBytes === 'number') state.__approxBytes += approxEntryBytes(key, entry)
+  enforceCacheSizeBounds(state)
   scheduleCacheFlush(state)
   return state.entries[key]
 }
@@ -121,7 +169,7 @@ function pruneExpiredEntries(state) {
   let dirty = false
   for (const [key, entry] of Object.entries(state.entries)) {
     if (entry?.expiresAt && entry.expiresAt <= current) {
-      delete state.entries[key]
+      removeCacheEntry(state, key)
       dirty = true
     }
   }

package/src/shared/config.mjs

@@ -299,7 +299,7 @@ export function getSearchApiKey(provider) {
 // exports keep working, then MIXDOG_AGENT_<P>_APIKEY, then the OS keychain.
 const AGENT_PROVIDER_ENV = Object.freeze({
   openai: 'OPENAI_API_KEY', anthropic: 'ANTHROPIC_API_KEY', gemini: 'GEMINI_API_KEY',
-  deepseek: 'DEEPSEEK_API_KEY', xai: 'XAI_API_KEY', nvidia: 'NVIDIA_API_KEY',
+  deepseek: 'DEEPSEEK_API_KEY', xai: 'XAI_API_KEY',
 })
 
 // Last-resort env aliases honored AFTER the standard env / MIXDOG_AGENT_* /

package/src/shared/llm/cost.mjs

@@ -17,7 +17,7 @@ import { getModelMetadataSync } from '../../agent/orchestrator/providers/model-c
 // count *including* the cached portion (inclusive). Anthropic reports the
 // uncached remainder only and bills cached_read / cached_write as separate
 // additive slots (additive). Cost and prompt-total math has to branch on this.
-// OpenAI-compatible direct providers (deepseek / nvidia / ollama / lmstudio)
+// OpenAI-compatible direct providers (deepseek / ollama / lmstudio)
 // go through the OpenAI SDK and likewise report an inclusive prompt_tokens
 // with a separate cached-tokens detail — so they are inclusive too. Omitting
 // them bills the cached portion at the full input rate AND re-adds it as a
@@ -31,7 +31,7 @@ export function isInclusiveProvider(provider) {
     // usage rows — without it, cached tokens would be double-billed in the
     // cost fallback and prompt totals.
     return p.includes('openai') || p.includes('codex') || p.includes('gemini') || p.includes('google') || p.includes('xai') || p.includes('grok')
-        || p.includes('deepseek') || p.includes('nvidia') || p.includes('ollama') || p.includes('lmstudio') || p.includes('groq') || p.includes('openrouter');
+        || p.includes('deepseek') || p.includes('ollama') || p.includes('lmstudio') || p.includes('groq') || p.includes('openrouter');
 }
 
 /**