mixdog 0.9.111 → 0.9.113

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.111",
+  "version": "0.9.113",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -48,72 +48,24 @@
     "prepublishOnly": "node -e \"if(!process.env.CI){console.error('local npm publish is disabled — run npm run release:patch');process.exit(1)}\"",
     "start": "node src/cli.mjs",
     "smoke": "node scripts/smoke.mjs",
-    "test:contract": "node scripts/run-suite.mjs contract",
-    "smoke:all": "npm run smoke && npm run smoke:boot && npm run smoke:patch && npm run smoke:output && npm run smoke:tui && npm run smoke:live-worker",
+    "smoke:all": "npm run smoke && npm run smoke:boot && npm run smoke:patch && npm run smoke:compact",
     "smoke:boot": "node scripts/boot-smoke.mjs",
     "smoke:compact": "node scripts/compact-smoke.mjs",
-    "test:compact": "node --test scripts/compact-active-turn-test.mjs scripts/compact-file-reattach-test.mjs scripts/compact-prior-context-flatten-test.mjs scripts/compact-recall-digest-test.mjs scripts/compact-pressure-test.mjs",
-    "test:context": "node --test scripts/context-mcp-metering-test.mjs scripts/v4a-context-miss-excerpt-test.mjs",
+    "test:compact": "node --test scripts/suite-compact-test.mjs",
     "smoke:loop": "node scripts/smoke-loop.mjs",
     "smoke:loop:final": "node scripts/smoke-loop-report.mjs --require-complete --min-elapsed 5h --min-iterations 400 --max-gap 60s --max-smoke-ms 10000 --max-avg-smoke-ms 8500 --max-step-ms smoke.mjs=4000 --max-step-ms boot-smoke.mjs=8000 --max-rss-mb 140 --max-rss-growth-mb 50",
     "smoke:loop:report": "node scripts/smoke-loop-report.mjs",
     "test:tool-contracts": "node scripts/tool-smoke.mjs",
     "smoke:patch": "node scripts/apply-patch-edit-smoke.mjs",
-    "smoke:patch-replay": "node scripts/apply-patch-replay-smoke.mjs",
-    "smoke:tool-rescue": "node scripts/tool-rescue-smoke.mjs",
-    "smoke:output": "node scripts/output-style-smoke.mjs",
-    "smoke:tui": "node scripts/build-tui.mjs && node scripts/tui-render-smoke.mjs && npm run test:tui-input-render && npm run test:tui-streaming-window && npm run test:tui-queue",
-    "smoke:freevars": "node scripts/freevar-smoke.mjs",
-    "smoke:logguard": "node scripts/log-writer-guard-smoke.mjs",
-    "smoke:live-worker": "node scripts/live-worker-smoke.mjs",
-    "smoke:agent-tag-reuse": "node scripts/agent-tag-reuse-smoke.mjs",
-    "test:agent-terminal-reap": "node scripts/agent-terminal-reap-test.mjs",
-    "test:agent-job-views": "node --test scripts/agent-job-terminal-view-test.mjs",
-    "test:agent-fanout": "node scripts/agent-parallel-smoke.mjs && node --test scripts/agent-route-batch-test.mjs scripts/execution-completion-dedup-test.mjs",
-    "test:toolcall": "node --test scripts/toolcall-args-test.mjs",
-    "test:tool-batching": "node --test scripts/eager-patch-shell-order-test.mjs scripts/session-bench-batching-test.mjs scripts/tool-cwd-rebind-test.mjs",
-    "test:shipmode": "node --test scripts/ship-mode-test.mjs",
-    "test:shellhardening": "node --test scripts/shell-hardening-test.mjs scripts/shell-failure-diagnostics-test.mjs scripts/windows-hide-spawn-options-test.mjs scripts/shell-job-session-scope-test.mjs",
-    "test:placeholder": "node --test scripts/compacted-placeholder-scrub-test.mjs",
-    "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-stall-test.mjs scripts/provider-stream-outcome-test.mjs scripts/stream-frame-fault-matrix-test.mjs scripts/gemini-provider-test.mjs scripts/anthropic-transport-policy-test.mjs scripts/anthropic-native-block-replay-test.mjs scripts/openai-oauth-ws-1006-retry-test.mjs scripts/stream-close-retry-test.mjs scripts/openai-end-turn-signal-test.mjs",
-    "test:provider-admission": "node --test scripts/provider-admission-scheduler-test.mjs scripts/provider-stream-json-test.mjs",
-    "test:resource-admission": "node --test scripts/resource-admission-test.mjs scripts/child-spawn-isolation-test.mjs scripts/owner-fair-gate-test.mjs",
-    "test:deferred-tools": "node --test scripts/deferred-tool-loading-test.mjs",
-    "test:anthropic-oauth-race": "node --test scripts/anthropic-oauth-refresh-race-test.mjs",
-    "test:grok-oauth-race": "node --test scripts/grok-oauth-refresh-race-test.mjs",
-    "test:atomiclock": "node --test scripts/atomic-lock-tryonce-test.mjs",
-    "test:keychain": "node --test scripts/keychain-prewarm-test.mjs",
-    "test:memory-leaks": "node --expose-gc --test scripts/memory-retention-test.mjs scripts/memory-worker-stability-test.mjs scripts/session-transport-test.mjs apps/desktop/src/renderer/memory-retention.test.mjs",
-    "test:memory-routing": "node --test scripts/memory-cycle-routing-test.mjs scripts/maintenance-default-routes-test.mjs scripts/embedding-worker-exit-test.mjs scripts/embedding-runtime-prune-test.mjs",
-    "test:embedding-runtime": "node --test scripts/embedding-runtime-prune-test.mjs scripts/memory-pg-recovery-test.mjs && node scripts/verify-embedding-runtime.mjs",
-    "test:embedding-runtime:core": "node --test scripts/embedding-runtime-prune-test.mjs scripts/memory-pg-recovery-test.mjs && node scripts/verify-embedding-runtime.mjs --core",
+    "test:shellhardening": "node --test scripts/suite-shellhardening-test.mjs",
+    "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-outcome-test.mjs",
     "test:embedding-runtime:warmup": "node scripts/verify-embedding-runtime.mjs --warmup",
-    "prepare:code-graph-test": "node scripts/prepare-code-graph-test.mjs",
-    "test:code-graph-dispatch": "node --test scripts/code-graph-dispatch-test.mjs",
-    "test:tui-queue": "node --test scripts/submit-commandbusy-race-test.mjs scripts/steering-drain-buckets-test.mjs scripts/abort-recovery-test.mjs scripts/message-rewind-test.mjs scripts/execution-pending-resume-kick-test.mjs scripts/execution-resume-esc-integration-test.mjs scripts/pending-stale-injection-test.mjs",
-    "test:tui-input-render": "node --test scripts/prompt-immediate-render-test.mjs scripts/prompt-key-parity-test.mjs",
-    "test:tui-streaming-window": "node --test scripts/streaming-tail-window-test.mjs scripts/tui-store-frame-batch-test.mjs && node scripts/tui-transcript-jitter-harness.mjs",
-    "test:tui-ambiguous-width": "node --test scripts/tui-ambiguous-width-test.mjs",
-    "test:release-assets": "node --check scripts/verify-release-assets.mjs && node --check scripts/verify-release-assets-test.mjs && node --check scripts/deploy-workflow-test.mjs && node --check scripts/release-version-discipline-test.mjs && node --test scripts/verify-release-assets-test.mjs scripts/deploy-workflow-test.mjs scripts/release-version-discipline-test.mjs",
-    "test:release-focused": "npm run test:release-focused:contracts && npm run test:release-focused:providers && npm run test:release-focused:compact && npm run test:release-focused:session",
-    "test:release-focused:contracts": "npm run test:release-assets && npm run test:tool-contracts && npm run test:tool-batching && npm run test:placeholder && npm run smoke:patch && npm run test:patch-binary-cache",
-    "test:release-focused:providers": "npm run test:providers && npm run test:deferred-tools && npm run test:compact && npm run test:context && npm run prepare:code-graph-test && node --test scripts/code-graph-root-federation-test.mjs scripts/code-graph-aggregate-cwd-test.mjs && npm run test:code-graph-dispatch && node --test scripts/code-graph-disk-hit-test.mjs",
-    "test:release-focused:compact": "npm run smoke:compact && npm run test:shellhardening",
-    "test:release-focused:session": "npm run test:project-registry && npm run test:session && npm run test:workflow-editor && npm run test:embedding-runtime && node --test scripts/tui-transcript-perf-test.mjs",
-    "test:native-edit-wire": "node --test scripts/native-edit-wire-test.mjs",
-    "test:patch-binary-cache": "node --test scripts/patch-binary-cache-test.mjs",
-    "test:patch-parity": "node --test scripts/v4a-parity-test.mjs",
-    "test:project-registry": "node --test scripts/project-registry-isolation-test.mjs",
-    "test:session-transport": "node --test scripts/fair-call-scheduler-test.mjs scripts/session-transport-test.mjs scripts/session-tui-parity-test.mjs scripts/session-recovery-test.mjs scripts/session-submit-delivery-test.mjs scripts/daemon-process-lifetime-test.mjs scripts/session-multipane-stress-test.mjs && node --test scripts/runtime-isolation-stress-test.mjs",
-    "smoke:session": "node scripts/session-smoke.mjs",
-    "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-orphan-sweep-test.mjs scripts/interrupted-turn-history-test.mjs scripts/turn-checkpoint-crash-test.mjs scripts/turn-outcome-fault-matrix-test.mjs scripts/session-save-fault-store-test.mjs scripts/session-disk-authority-test.mjs scripts/session-load-cache-race-test.mjs scripts/agent-loop-complete-turn-test.mjs scripts/session-heartbeat-lifecycle-test.mjs scripts/remote-transition-order-test.mjs scripts/session-new-reset-test.mjs scripts/turn-ttft-critical-path-test.mjs",
-    "test:live-canary": "node --test scripts/live-canary-test.mjs",
-    "test:rebindtail": "node --test scripts/forwarder-rebind-tail-test.mjs scripts/channel-remote-format-test.mjs",
-    "test:workflow-editor": "node --test scripts/workflow-id-test.mjs scripts/workflow-pack-editor-test.mjs",
-    "test:route-scope": "node --test scripts/route-scope-isolation-test.mjs",
-    "test:schedule-reload": "node --test scripts/schedule-reload-arm-test.mjs",
+    "test:release-assets": "node --check scripts/verify-release-assets.mjs && node --check scripts/release-gate-test.mjs && node --test scripts/release-gate-test.mjs",
+    "test:release-focused": "npm run test:release-critical && npm run test:compact && npm run test:shellhardening && npm run test:tool-contracts && npm run test:session && npm run test:session-transport",
+    "test:release-critical": "npm run test:release-assets && npm run smoke:patch && npm run test:providers",
+    "test:session-transport": "node --test scripts/session-transport-test.mjs",
+    "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-save-fault-store-test.mjs",
     "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs src/runtime/media/adapters/codex-image.test.mjs",
-    "test:shell-harness": "node --test scripts/shell-harness-regression-test.mjs",
     "failures": "node scripts/tool-failures.mjs",
     "trace:llm": "node scripts/llm-trace-summary.mjs",
     "diag:sessions": "node scripts/session-diag.mjs",

package/src/rules/shared/01-tool.md

@@ -8,7 +8,8 @@
   known file/range→`read`;
   web/current→`search`; returned URL body→`web_fetch`; prior work→`recall`
   (history only, never current local state);
-  durable compact English memory→`memory`; explicit project change→`cwd`;
+  durable compact English memory→`memory`; explicit Project change→`cwd`
+  (`shell.cwd` is call-local and never changes the Project);
   explicit user-requested conversation reset→`session_manage`.
   Use only named tools present in the current tool surface.
 - Act only on verified identities (cwd/project/user/tool-returned) — paths,
@@ -24,16 +25,23 @@
   another's output or can change another's inputs/state; otherwise
   serialize. Before each batch, deduplicate the facets still required by the request,
   route each once to the cheapest sufficient tool with all required
-  variants/scopes, and launch every independent call together — never
+  variants/scopes — every distinct sample/format in the same batch —
+  and launch every independent call together — never
   split or duplicate a facet across tools, mutate merely to widen
-  retrieval, reserve known work, or cap fanout. Symbol relations end at
+  retrieval, reserve known work, or cap fanout. Guessed terms go wide
+  with batched fan-out; narrow a scope only on verified cues — returned
+  siblings/conventions or known literals. Mine each returned output for
+  every remaining facet before the next round. Symbol relations end at
   `code_graph`; values/locations end at the context grep returns; `read`
   covers only what returned spans cannot, as an anchored offset/limit
   window. The moment evidence determines the answer, edit, or deliverable,
   stop retrieving; patch if needed.
 - Once the edit or deliverable is determined, finish in one assistant turn:
-  issue `apply_patch` calls serially, never in parallel; use one cohesive call
-  with one file section per target, all patches first, then one
+  before `apply_patch`, obtain every target hunk's exact current content and
+  anchor from `grep`, `code_graph`, or `read`; never infer patch context from
+  another file, a sample, or expected text. Then issue `apply_patch` calls
+  serially, never in parallel; use one cohesive call with one file section per
+  target, all patches first, then one
   batched verification `shell` that runs the real required postconditions
   on every changed file and produced artifact, never echoes a claim;
   runtime waits for every patch and skips the shell
@@ -43,6 +51,7 @@
   (data/reports/derived values) come from `shell` computation, never
   hand-transcribed numbers. Earlier `shell` is only for runtime/state
   evidence unavailable to file tools—an independent facet, batched with
-  the rest.
+  the rest; independent probes are parallel shell calls, never one
+  serial script per round.
 - A background `task_id` ends the turn; completion resumes work. Never poll;
   use task control only for recovery or a required blocking result.

package/src/runtime/agent/orchestrator/config.mjs

@@ -339,7 +339,6 @@ function canonicalizeShellStorage(value) {
 function canonicalizeModulesStorage(value) {
     const modules = configObject(value);
     delete modules.memory;
-    delete modules.explore;
     for (const name of ['search']) {
         if (!Object.prototype.hasOwnProperty.call(modules, name)) continue;
         const raw = modules[name];

package/src/runtime/agent/orchestrator/providers/anthropic-sse.mjs

@@ -107,6 +107,12 @@ function _anthropicSseError(event) {
         err.httpStatus = status;
         err.status = status;
     }
+    // Wire-error marker: an error type OUTSIDE the documented enumeration
+    // (no status resolved above) default-retries under the shared wire-error
+    // contract instead of failing the turn as 'unknown'. Typed statuses and
+    // the fatal-code deny-list still take precedence in classifyError().
+    err.providerWireError = true;
+    if (typeof type === 'string' && type && type !== 'error') err.providerErrorCode = type;
     return err;
 }
 

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -841,7 +841,8 @@ function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesT
 // Copy the TYPED failure evidence a Responses `response.failed` / `error`
 // event carries (numeric HTTP status, provider error code/type) onto the
 // thrown error. Message text is never parsed, and nothing is synthesized when
-// the event declares no typed status.
+// the event declares no typed status. The wire-event marker routes the error
+// through the fatal-code deny-list / default-retry classification.
 function _applyTypedResponsesFailure(err, event) {
     const detail = event?.response?.error || event?.error || null;
     const typed = typedStatusFrom(detail, event);
@@ -849,6 +850,7 @@ function _applyTypedResponsesFailure(err, event) {
     const code = detail?.code ?? detail?.type ?? event?.code ?? null;
     if (code != null && code !== '') err.providerErrorCode = String(code);
     if (detail) err.providerError = detail;
+    err.providerWireError = true;
     return err;
 }
 

package/src/runtime/agent/orchestrator/providers/openai-oauth-http-sse.mjs

@@ -959,9 +959,15 @@ export async function sendViaHttpSse({
             case 'response.failed': {
                 const msg = event.response?.error?.message || event.error?.message || event.message || 'response.failed';
                 const err = new Error(`OpenAI OAuth HTTP fallback response.failed: ${msg}`);
-                // Typed status only — a text-only failure stays unclassified.
+                // Typed status only — nothing is synthesized from text. The
+                // frame itself is preserved so the wire-error default-retry
+                // classification applies (fatal codes stay terminal).
+                err.responseFailed = event;
                 const typed = typedStatusFrom(event.response?.error, event.error, event);
                 if (typed) err.httpStatus = typed;
+                const detail = event.response?.error || event.error || null;
+                const code = detail?.code ?? detail?.type ?? null;
+                if (typeof code === 'string' && code) err.providerErrorCode = code;
                 throw err;
             }
             case 'response.incomplete': {
@@ -987,8 +993,12 @@ export async function sendViaHttpSse({
             case 'error': {
                 const msg = event.message || event.error?.message || 'unknown';
                 const err = new Error(`OpenAI OAuth HTTP fallback error: ${msg}`);
+                // Same wire-error contract as response.failed.
+                err.responseFailed = event;
                 const typed = typedStatusFrom(event.error, event);
                 if (typed) err.httpStatus = typed;
+                const code = event.error?.code ?? event.error?.type ?? event.code ?? null;
+                if (typeof code === 'string' && code) err.providerErrorCode = code;
                 throw err;
             }
             default:

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -1310,11 +1310,15 @@ export async function _streamResponse({
                         responseFailed: event,
                     });
                     // TYPED status only (event/error payload). A failure whose
-                    // only evidence is message text is 'unknown' to the retry
-                    // classifiers and is surfaced instead of replayed.
+                    // only evidence is message text synthesizes no status; the
+                    // typed code/type string is preserved for the wire-error
+                    // default-retry classification (fatal codes stay terminal).
                     {
                         const typed = typedStatusFrom(event.response?.error, event.error, event);
                         if (typed) terminalError.httpStatus = typed;
+                        const detail = event.response?.error || event.error || null;
+                        const code = detail?.code ?? detail?.type ?? null;
+                        if (typeof code === 'string' && code) terminalError.providerErrorCode = code;
                     }
                     finish();
                     break;
@@ -1322,9 +1326,16 @@ export async function _streamResponse({
                 case 'error': {
                     const errMsg = String(event.message || event.error?.message || 'unknown');
                     terminalError = new Error(`${errLabel} error: ${errMsg}`);
+                    // Same wire-error contract as response.failed: stash the
+                    // frame so the mid-stream classifier and classifyError()
+                    // apply the typed fatal-code deny-list / default-retry.
+                    midState.responseFailedPayload = event;
+                    terminalError.responseFailed = event;
                     {
                         const typed = typedStatusFrom(event.error, event);
                         if (typed) terminalError.httpStatus = typed;
+                        const code = event.error?.code ?? event.error?.type ?? event.code ?? null;
+                        if (typeof code === 'string' && code) terminalError.providerErrorCode = code;
                     }
                     finish();
                     break;

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -133,6 +133,20 @@ export function classifyError(err) {
     String(item?.message || '').trim(),
   ))) return 'transient'
 
+  // Provider wire error event (`response.failed` / terminal `error` frame):
+  // default-retry, codex parity. codex maps every response.failed whose typed
+  // code is not a deterministic refusal to ApiError::Retryable (fatal codes
+  // are an explicit allow-list); cc retries all 5xx/overloaded 10×; opencode
+  // marks server_error/server_is_overloaded isRetryable. Evidence stays
+  // structural — the event's own typed code/type field — message text is
+  // never parsed. Exposure precedence is preserved: the replayUnsafe gate at
+  // the top of this function already returned 'permanent' for any stream
+  // that relayed output or dispatched a tool call.
+  {
+    const wireKind = classifyWireErrorEvent(err)
+    if (wireKind) return wireKind
+  }
+
   return 'unknown'
 }
 
@@ -305,6 +319,54 @@ function isPermanentQuotaError(err) {
   return false
 }
 
+// ── Wire error events: default-retry with a fatal-code deny-list ────────────
+// Deterministic refusal codes a `response.failed` / `error` wire event may
+// carry: retrying the identical request can never succeed. Mirrors codex's
+// fatal set (context/quota/policy) plus the auth/billing refusals the
+// Responses and Anthropic wire formats use. Everything OUTSIDE this set —
+// server_error, server_is_overloaded, slow_down, or an event with no code at
+// all — is a server-side fault and is retried under the bounded budgets
+// (observed live 2026-08-11: two turns failed on typed `server_error`
+// response.failed events that every reference implementation retries).
+const WIRE_ERROR_FATAL_CODES = new Set([
+  'context_length_exceeded', 'context_window_exceeded',
+  'insufficient_quota', 'quota_exceeded', 'resource_exhausted',
+  'usage_not_included', 'usage_limit_reached',
+  'invalid_prompt', 'bio_policy', 'cyber_policy',
+  'invalid_request', 'invalid_request_error',
+  'invalid_api_key', 'authentication_error', 'permission_error',
+  'permission_denied', 'billing_not_active',
+])
+
+function wireErrorCode(err) {
+  const failed = err?.responseFailed
+  const detail = failed?.response?.error || failed?.error || err?.providerError || failed || null
+  for (const field of [detail?.code, detail?.type, err?.providerErrorCode]) {
+    if (typeof field === 'string' && field.trim()) return field.trim().toLowerCase()
+  }
+  return ''
+}
+
+// 'transient' | 'permanent' for errors born from a provider wire error event;
+// null for everything else (no blanket retry for untyped local failures).
+function classifyWireErrorEvent(err) {
+  if (!err || (err.responseFailed == null && err.providerWireError !== true)) return null
+  const code = wireErrorCode(err)
+  if (code && WIRE_ERROR_FATAL_CODES.has(code)) return 'permanent'
+  return 'transient'
+}
+
+/**
+ * True when `err` came from a provider wire error event whose typed code is
+ * not a deterministic refusal — i.e. the send-with-recovery loop may replay
+ * it (after text retraction when something was exposed). classifyError()
+ * reports 'permanent' the moment output was exposed, so the loop names this
+ * symptom directly, exactly like stall/truncated/non-terminal-close.
+ */
+export function isRetryableWireErrorEvent(err) {
+  return classifyWireErrorEvent(err) === 'transient'
+}
+
 /**
  * Convenience predicate: should this error be retried at the request level?
  * Wraps classifyError() with the standard "transient = retry, otherwise no"
@@ -541,9 +603,10 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   if (failed) {
     // STRUCTURED evidence only: the failure's own numeric status and its
     // explicit error code/type field. The payload is never stringified and
-    // searched — a message/body that merely CONTAINS "network_error",
-    // "stream_disconnected" or "auth context expired" is not a typed retry
-    // signal and leaves the turn terminal.
+    // searched — a message/body that merely CONTAINS "network_error" or
+    // "stream_disconnected" never selects a SPECIFIC bucket. Buckets need
+    // typed codes; the DEFAULT for an unrecognized (or absent) code is the
+    // bounded retry below, with fatal refusal codes staying terminal.
     const detail = failed?.response?.error || failed?.error || failed
     const failedStatus = typedStatusFrom(detail, failed?.response, failed)
     if (failedStatus >= 500 && failedStatus < 600) {
@@ -553,7 +616,15 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
       const key = typeof field === 'string' ? field.trim().toLowerCase() : ''
       const classifier = RESPONSE_FAILED_CODE_CLASSIFIERS.get(key)
       if (classifier) return _allowMidstream(classifier, attemptIndex, policy)
+      if (key && WIRE_ERROR_FATAL_CODES.has(key)) return null
     }
+    // A typed non-transient 4xx on the failure payload is a deterministic
+    // refusal even without a recognized code string.
+    if (failedStatus >= 400 && failedStatus < 500 && !TRANSIENT_STATUSES.has(failedStatus)) return null
+    // Default-retry (codex parity): a wire failure that is neither a fatal
+    // refusal nor a typed 4xx is a server-side fault — re-issue it under the
+    // bounded mid-stream budget instead of failing the turn.
+    return _allowMidstream('response_failed_retryable', attemptIndex, policy)
   }
 
   return null

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -394,7 +394,15 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     const EMPTY_NUDGE_MAX = 3;
     let _refusalRetryUsed = false;
     let _maxOutputRecoveryCount = 0;
-    const _maxOutputContentParts = [];
+    // Committed-but-unsealed text segments for the caller-facing aggregate:
+    // max-output recovery parts plus (Lead/TUI only) text-only continuation
+    // segments (provider pause_turn / terminal steering / stop hook). The
+    // terminal response returns content = parts + terminal so the UI row that
+    // accumulated every streamed segment is not overwritten down to only the
+    // last segment; historyContent keeps persistence single-copy. Reset after
+    // each executed tool batch — the UI seals its row at tool boundaries, so a
+    // pre-tool part re-prepended at terminal would duplicate a sealed row.
+    const _committedTextParts = [];
     // Count of structured provider continuation signals honored this turn
     // (endTurn === false / stopReason === 'pause_turn'). Diagnostic only; the
     // hard iteration cap remains the sole bound on how long a provider may
@@ -799,7 +807,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             const isIncompleteStop = stopReason && INCOMPLETE_STOP_REASONS.has(stopReason);
             const isOutputLimitStop = isOutputLimitStopReason(stopReason);
             if (hasContent && isOutputLimitStop) {
-                _maxOutputContentParts.push(response.content);
+                _committedTextParts.push(response.content);
                 if (_maxOutputRecoveryCount < MAX_OUTPUT_RECOVERY_LIMIT) {
                     // The partial assistant turn must be visible to the model so
                     // it can resume at the exact cutoff instead of reconstructing
@@ -818,7 +826,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 const terminalSegment = `${response.content}\n\n${MAX_OUTPUT_EXHAUSTED_NOTICE}`;
                 response = {
                     ...response,
-                    content: `${_maxOutputContentParts.slice(0, -1).join('')}${terminalSegment}`,
+                    content: `${_committedTextParts.slice(0, -1).join('')}${terminalSegment}`,
                     historyContent: terminalSegment,
                     maxOutputRecoveryAttempts: _maxOutputRecoveryCount,
                 };
@@ -864,6 +872,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 } catch { /* best-effort */ }
             } else if (continuationSignal && pushIntermediateAssistantResponse(response)) {
                 if (hasContent && !suppressMidTurnText) {
+                    _committedTextParts.push(response.content);
                     try { opts.onAssistantText?.(response.content); } catch { /* best-effort */ }
                 }
                 _providerContinuationCount += 1;
@@ -913,7 +922,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             // Commit the terminal text first (beforeAppend), then resume.
             if (!_capFinalToolsDisabled && drainSteeringIntoMessages('terminal', {
                 maxPriority: 'next',
-                beforeAppend: () => { pushIntermediateAssistantResponse(response); },
+                beforeAppend: () => {
+                    if (pushIntermediateAssistantResponse(response) && hasContent && !suppressMidTurnText) {
+                        _committedTextParts.push(response.content);
+                    }
+                },
             })) {
                 _emptyNudgeStreak = 0;
                 continue;
@@ -928,6 +941,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                 const _hookPrompt = _toolFailureStopHook.takeContinuationPrompt();
                 if (_hookPrompt) {
                     pushIntermediateAssistantResponse(response);
+                    if (hasContent && !suppressMidTurnText) _committedTextParts.push(response.content);
                     messages.push({
                         role: 'user',
                         content: _hookPrompt,
@@ -945,13 +959,15 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
                     continue;
                 }
             }
-            if (_maxOutputContentParts.length > 0) {
+            if (_committedTextParts.length > 0) {
                 const terminalSegment = typeof response.content === 'string' ? response.content : '';
                 response = {
                     ...response,
-                    content: `${_maxOutputContentParts.join('')}${terminalSegment}`,
+                    content: `${_committedTextParts.join('')}${terminalSegment}`,
                     historyContent: terminalSegment,
-                    maxOutputRecoveryAttempts: _maxOutputRecoveryCount,
+                    ...(_maxOutputRecoveryCount > 0
+                        ? { maxOutputRecoveryAttempts: _maxOutputRecoveryCount }
+                        : {}),
                 };
             }
             break;
@@ -1082,6 +1098,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         _lastToolBatchEndedAt = _toolsEndedAt;
         _toolBatchJustCompleted = true;
         _continuationsSinceToolBatch = 0;
+        // The UI sealed its streaming row at this tool boundary; earlier
+        // committed parts must not re-prepend at terminal (duplicate rows).
+        _committedTextParts.length = 0;
         _lastToolBatchHadSleep = _callsToExecute.some(isSleepLikeToolCall);
     }
     // Classify WHY the loop ended so agent-tool can promote an empty/abnormal

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -128,7 +128,7 @@ export function createEagerDispatcher({
                         }
                     }
                     await opts.beforeToolExecution?.();
-                    return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration(), deferShellCwdCommit: true }) };
+                    return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration() }) };
                 } catch (error) {
                     return { ok: false, error };
                 }

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -9,6 +9,7 @@ import {
     classifyError,
     isContextOverflowError,
     isNonTerminalStreamClose,
+    isRetryableWireErrorEvent,
     jitterDelayMs,
 } from '../providers/retry-classifier.mjs';
 import { setTimeout as sleepMs } from 'timers/promises';
@@ -405,6 +406,10 @@ export async function sendWithRecovery(ctx) {
                             // gemini/compat EOF): classifyError calls it
                             // 'transient' only while nothing was exposed.
                             || outcome.truncatedStream === true
+                            // And for retryable wire error events
+                            // (response.failed server_error & co.): exposed
+                            // text is retracted, then the send is replayed.
+                            || isRetryableWireErrorEvent(sendErr)
                             || isNonTerminalStreamClose(sendErr))
                         && await retractExposedTextForReplay()
                     )

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -37,7 +37,6 @@ import {
     parseNativeToolSearchPayload,
 } from './loop/tool-helpers.mjs';
 import { restoreToolCallBodyForId } from './loop/stored-tool-args.mjs';
-import { commitSessionCwdProbe } from '../tools/shell-state.mjs';
 
 function classifyToolReturn(value) {
     const normalized = normalizeToolEnvelope(value);
@@ -308,7 +307,7 @@ export async function processToolBatch(ctx) {
                         _resultKind = 'error';
                     } else {
                         await opts.beforeToolExecution?.();
-                        result = await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: iterations, deferShellCwdCommit: true });
+                        result = await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: iterations });
                         toolEndedAt = Date.now();
                         // Boundary: tool-return string convention → structural kind.
                         // The only prefix check in this codebase; downstream layers
@@ -330,9 +329,6 @@ export async function processToolBatch(ctx) {
                 result = `Error: ${err instanceof Error ? err.message : String(err)}`;
                 _resultKind = 'error';
             }
-            if (_isShellTool(call.name) && _resultKind !== 'skipped') {
-                commitSessionCwdProbe(sessionId, call.id);
-            }
             // CENTRAL ENVELOPE NORMALIZE (general newMessages channel).
             // executeTool (serial + eager) and cache/error paths above all
             // funnel into `result`. Split ONCE here: downstream post-processing

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -461,7 +461,7 @@ function guardGrep(a) {
         const hl = Number(a.head_limit);
         if (grepContextKeyPresent(a, 'head_limit') && Number.isFinite(hl) && hl > GREP_CTX_HEAD_LIMIT_MAX) {
             a.head_limit = GREP_CTX_HEAD_LIMIT_MAX;
-            pushClampNotice(a, `notice: grep head_limit clamped to ${GREP_CTX_HEAD_LIMIT_MAX} match blocks (context mode)`);
+            pushClampNotice(a, `notice: grep limit clamped to ${GREP_CTX_HEAD_LIMIT_MAX} match blocks (context mode)`);
         }
     }
     return null;
@@ -706,12 +706,12 @@ function guardList(a) {
         const coerced = coerceIntegerString(a.head_limit);
         if (coerced !== null) a.head_limit = coerced;
         if (!isFiniteInt(a.head_limit)) {
-            return `Error: list arg "head_limit" must be a finite integer (got ${describeType(a.head_limit)})`;
+            return `Error: list arg "limit" must be a finite integer (got ${describeType(a.head_limit)})`;
         }
         // 0 is the valid "no cap" sentinel; a negative value is nonsensical
         // and downstream produces a degenerate window (clamps to 0 → empty).
         if (a.head_limit < 0) {
-            return `Error: list arg "head_limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
+            return `Error: list arg "limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
         }
     }
     return null;
@@ -745,10 +745,10 @@ function guardFind(a) {
         const coerced = coerceIntegerString(a.head_limit);
         if (coerced !== null) a.head_limit = coerced;
         if (!isFiniteInt(a.head_limit)) {
-            return `Error: find arg "head_limit" must be a finite integer (got ${describeType(a.head_limit)})`;
+            return `Error: find arg "limit" must be a finite integer (got ${describeType(a.head_limit)})`;
         }
         if (a.head_limit < 0) {
-            return `Error: find arg "head_limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
+            return `Error: find arg "limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
         }
     }
     return null;
@@ -787,12 +787,12 @@ function guardGlob(a) {
         const coerced = coerceIntegerString(a.head_limit);
         if (coerced !== null) a.head_limit = coerced;
         if (!isFiniteInt(a.head_limit)) {
-            return `Error: glob arg "head_limit" must be a finite integer (got ${describeType(a.head_limit)})`;
+            return `Error: glob arg "limit" must be a finite integer (got ${describeType(a.head_limit)})`;
         }
         // 0 is the valid "no cap" sentinel; a negative value is nonsensical
         // and downstream produces a degenerate window (clamps to 0 → empty).
         if (a.head_limit < 0) {
-            return `Error: glob arg "head_limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
+            return `Error: glob arg "limit" must be >= 0 (0 means no cap); got ${a.head_limit}`;
         }
     }
     return null;