mixdog 0.9.130 → 0.9.132

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.130",
+  "version": "0.9.132",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -59,7 +59,7 @@
     "test:tool-contracts": "npm run build:spawn:test && node scripts/tool-smoke.mjs",
     "smoke:patch": "node scripts/apply-patch-edit-smoke.mjs",
     "test:shellhardening": "npm run build:spawn:test && node --test scripts/suite-shellhardening-test.mjs scripts/suite-shell-direct-exe-test.mjs",
-    "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-outcome-test.mjs",
+    "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-outcome-test.mjs scripts/cursor-provider-test.mjs",
     "test:embedding-runtime:warmup": "node scripts/verify-embedding-runtime.mjs --warmup",
     "test:release-assets": "node --check scripts/verify-release-assets.mjs && node --check scripts/release-gate-test.mjs && node --check scripts/prepare-native-assets.mjs && node --test scripts/release-gate-test.mjs scripts/prepare-native-assets-test.mjs",
     "test:native-edit-wire": "node scripts/native-edit-wire-test.mjs",

package/scripts/fixtures/patch-replay-corpus.json

@@ -169,9 +169,9 @@
   },
   {
     "id": "add-overwrite-crlf",
-    "note": "Add File overwrite of an existing CRLF file must keep CRLF",
-    "expect": "applied",
-    "expect_content": { "a.txt": "NEW\r\n" },
+    "note": "Add File must reject an existing file without changing its CRLF content",
+    "expect": "rejected",
+    "expect_error": "Add File target already exists",
     "file_snapshots": { "a.txt": "old\r\n" },
     "args": { "patch": "*** Begin Patch\n*** Add File: a.txt\n+NEW\n*** End Patch\n" }
   },
@@ -194,24 +194,24 @@
   {
     "id": "already-applied-insert",
     "note": "observed: re-sent insertion whose unique new-side is already on disk",
-    "expect": "applied",
-    "expect_content": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n" },
+    "expect": "rejected",
+    "expect_error": "context not found",
     "file_snapshots": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n" },
     "args": { "patch": "*** Begin Patch\n*** Update File: a.js\n@@\n const STATUS = {\n   pending: 1,\n+  archived: 2,\n }\n*** End Patch\n" }
   },
   {
     "id": "already-applied-replace",
     "note": "observed: re-sent replacement whose unique new-side is already on disk",
-    "expect": "applied",
-    "expect_content": { "a.js": "head\nreturn ALL.has(v) || v === 'core' || v === 'lineage'\ntail\n" },
+    "expect": "rejected",
+    "expect_error": "context not found",
     "file_snapshots": { "a.js": "head\nreturn ALL.has(v) || v === 'core' || v === 'lineage'\ntail\n" },
     "args": { "patch": "*** Begin Patch\n*** Update File: a.js\n@@\n head\n-return ALL.has(v) || v === 'core'\n+return ALL.has(v) || v === 'core' || v === 'lineage'\n tail\n*** End Patch\n" }
   },
   {
     "id": "already-applied-mixed-remaining",
     "note": "already-applied hunks skip; a later unique old-side hunk still applies",
-    "expect": "applied",
-    "expect_content": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n// lineage backfill\n" },
+    "expect": "rejected",
+    "expect_error": "context not found",
     "file_snapshots": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n// pending/active only\n" },
     "args": { "patch": "*** Begin Patch\n*** Update File: a.js\n@@\n const STATUS = {\n   pending: 1,\n+  archived: 2,\n }\n@@\n-// pending/active only\n+// lineage backfill\n*** End Patch\n" }
   },

package/scripts/reduction-trace-report.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { summarizeReductionTraceRows } from '../src/runtime/agent/orchestrator/session/reduction-metrics.mjs';
+
+export function parseTraceJsonl(text) {
+    const rows = [];
+    for (const line of String(text || '').split(/\r?\n/)) {
+        if (!line.trim()) continue;
+        try { rows.push(JSON.parse(line)); } catch { /* retain valid rows */ }
+    }
+    return rows;
+}
+
+function main(argv) {
+    const tracePath = argv[2];
+    if (!tracePath) {
+        process.stderr.write('Usage: node scripts/reduction-trace-report.mjs <agent-trace.jsonl>\n');
+        return 2;
+    }
+    const rows = parseTraceJsonl(readFileSync(resolve(tracePath), 'utf8'));
+    process.stdout.write(`${JSON.stringify(summarizeReductionTraceRows(rows), null, 2)}\n`);
+    return 0;
+}
+
+if (resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+    process.exitCode = main(process.argv);
+}

package/scripts/release-timing-report.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+
+import { appendFile, readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+function payloadJobs(payload) {
+  const pages = Array.isArray(payload) ? payload : [payload];
+  return pages.flatMap((page) => Array.isArray(page?.jobs) ? page.jobs : []);
+}
+
+function elapsedSeconds(startedAt, completedAt) {
+  const start = Date.parse(startedAt || '');
+  const end = Date.parse(completedAt || '');
+  if (!Number.isFinite(start) || !Number.isFinite(end) || end < start) return null;
+  return Math.round((end - start) / 1000);
+}
+
+function timingRows(payload) {
+  return payloadJobs(payload).flatMap((job) => (job.steps || []).flatMap((step) => {
+    const seconds = elapsedSeconds(step.started_at, step.completed_at);
+    if (seconds === null) return [];
+    return [{
+      key: `${job.name} / ${step.name}`,
+      job: job.name,
+      step: step.name,
+      seconds,
+    }];
+  }));
+}
+
+function workflowSeconds(payload) {
+  const jobs = payloadJobs(payload);
+  const starts = jobs.map((job) => Date.parse(job.started_at || '')).filter(Number.isFinite);
+  const ends = jobs.map((job) => Date.parse(job.completed_at || '')).filter(Number.isFinite);
+  if (starts.length === 0 || ends.length === 0) return null;
+  return Math.round((Math.max(...ends) - Math.min(...starts)) / 1000);
+}
+
+function percentChange(current, baseline) {
+  if (!(baseline > 0)) return null;
+  return Math.round(((current - baseline) / baseline) * 100);
+}
+
+export function buildReleaseTimingReport(currentPayload, baselinePayload = []) {
+  const currentRows = timingRows(currentPayload);
+  const baselineRows = timingRows(baselinePayload);
+  const baselineByKey = new Map(baselineRows.map((row) => [row.key, row]));
+  const regressions = currentRows.flatMap((row) => {
+    const baseline = baselineByKey.get(row.key);
+    if (!baseline) return [];
+    const percent = percentChange(row.seconds, baseline.seconds);
+    if (percent === null || percent <= 10 || row.seconds - baseline.seconds < 15) return [];
+    return [{ ...row, baselineSeconds: baseline.seconds, percent }];
+  }).sort((a, b) => b.percent - a.percent || b.seconds - a.seconds);
+
+  const currentWorkflowSeconds = workflowSeconds(currentPayload);
+  const baselineWorkflowSeconds = workflowSeconds(baselinePayload);
+  const workflowPercent = currentWorkflowSeconds !== null && baselineWorkflowSeconds !== null
+    ? percentChange(currentWorkflowSeconds, baselineWorkflowSeconds)
+    : null;
+  const slowest = [...currentRows].sort((a, b) => b.seconds - a.seconds).slice(0, 15);
+  const markdown = [
+    '## Release timing',
+    '',
+    `- Current workflow span: ${currentWorkflowSeconds ?? 'n/a'}s`,
+    `- Previous successful span: ${baselineWorkflowSeconds ?? 'n/a'}s`,
+    `- Material step regressions (>10% and ≥15s): ${regressions.length}`,
+    '',
+    '| Slowest step | Current | Previous | Change |',
+    '| --- | ---: | ---: | ---: |',
+    ...slowest.map((row) => {
+      const baseline = baselineByKey.get(row.key);
+      const change = baseline ? percentChange(row.seconds, baseline.seconds) : null;
+      return `| ${row.key.replaceAll('|', '\\|')} | ${row.seconds}s | ${baseline ? `${baseline.seconds}s` : 'n/a'} | ${change === null ? 'n/a' : `${change > 0 ? '+' : ''}${change}%`} |`;
+    }),
+    '',
+  ].join('\n');
+
+  return {
+    currentWorkflowSeconds,
+    baselineWorkflowSeconds,
+    workflowPercent,
+    regressions,
+    markdown,
+  };
+}
+
+function commandValue(value) {
+  return String(value).replaceAll('%', '%25').replaceAll('\r', '%0D').replaceAll('\n', '%0A');
+}
+
+const invokedPath = process.argv[1] ? pathToFileURL(resolve(process.argv[1])).href : '';
+if (invokedPath === import.meta.url) {
+  const currentPath = process.argv[2];
+  const baselinePath = process.argv[3];
+  if (!currentPath) throw new Error('Usage: release-timing-report.mjs <current-jobs.json> [baseline-jobs.json]');
+  const current = JSON.parse(await readFile(currentPath, 'utf8'));
+  const baseline = baselinePath ? JSON.parse(await readFile(baselinePath, 'utf8')) : [];
+  const report = buildReleaseTimingReport(current, baseline);
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    await appendFile(process.env.GITHUB_STEP_SUMMARY, `${report.markdown}\n`);
+  }
+  if (report.workflowPercent > 10
+      && report.currentWorkflowSeconds - report.baselineWorkflowSeconds >= 30) {
+    console.log(`::warning title=Release duration regression::Workflow span increased ${report.workflowPercent}% to ${report.currentWorkflowSeconds}s`);
+  }
+  for (const row of report.regressions) {
+    console.log(`::warning title=Release step regression::${commandValue(row.key)} increased ${row.percent}% (${row.baselineSeconds}s to ${row.seconds}s)`);
+  }
+  console.log(`Release timing recorded: ${report.currentWorkflowSeconds ?? 'n/a'}s, ${report.regressions.length} material step regressions.`);
+}

package/scripts/tool-failures.mjs

@@ -2,6 +2,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { resolve } from 'node:path';
+import { classifyToolFailure } from '../src/runtime/agent/orchestrator/agent-trace-format.mjs';
 
 function argValue(name, fallback = null) {
   const idx = process.argv.indexOf(name);
@@ -87,9 +88,40 @@ function rowCategory(row) {
   return row.category || row.result_kind || row.resultKind || '(uncategorized)';
 }
 
+function rowErrorText(row) {
+  return row.error_preview || row.result || row.error || row.message || row.error_first_line || '';
+}
+
+function isKnownTestFixture(row) {
+  if (row.session_id !== 'no-session' || row.agent != null || row.model != null) return false;
+  const tool = rowTool(row);
+  if (tool === 'unknown_test_tool') return true;
+  return tool === 'apply_patch' && /^Error:\s*patch failed\s*$/i.test(String(rowErrorText(row)).trim());
+}
+
+function normalizeRowCategory(row) {
+  const storedCategory = rowCategory(row);
+  let category = storedCategory;
+  if (isKnownTestFixture(row)) {
+    category = 'expected-test';
+  } else if (rowTool(row) === 'apply_patch') {
+    const derived = classifyToolFailure(rowErrorText(row), 'apply_patch');
+    // Failure previews are bounded and may end before the nested cause. Never
+    // downgrade a stored specific category to the generic fallback merely
+    // because the historical preview lacks that tail.
+    if (derived !== 'runtime/failure' || storedCategory === 'runtime/failure') {
+      category = derived;
+    }
+  }
+  return category === storedCategory
+    ? row
+    : { ...row, stored_category: storedCategory, category };
+}
+
 const sinceTs = parseSince(sinceArg);
 const onlyArg = String(argValue('--only', 'all') || 'all').toLowerCase();
 const rows = files.flatMap(readRows)
+  .map(normalizeRowCategory)
   .filter((row) => sinceTs == null || Number(row.ts || 0) >= sinceTs)
   .filter((row) => !toolFilter || rowTool(row) === toolFilter)
   .filter((row) => !agentFilter || String(row.agent || '-') === agentFilter)
@@ -150,6 +182,8 @@ const actionableByFamily = tally(actionableRows, categoryFamily);
 const commandExitByTool = tally(commandExitRows, rowTool);
 const expectedByCategory = tally(expectedRows, rowCategory);
 const patchByCategory = tally(patchRows, rowCategory);
+const reclassifiedRows = rows.filter((row) => row.stored_category && row.stored_category !== rowCategory(row));
+const reclassifiedByCategory = tally(reclassifiedRows, (row) => `${row.stored_category} -> ${rowCategory(row)}`);
 
 if (jsonMode) {
   console.log(JSON.stringify({
@@ -160,6 +194,7 @@ if (jsonMode) {
     expected_absorbed: { shown: expectedRecent.length, matched: expectedRows.length },
     session_cancellations: { shown: 0, matched: cancellationRows.length },
     patch_failures: { matched: patchRows.length, categories: asObject(patchByCategory) },
+    reclassified: { matched: reclassifiedRows.length, categories: asObject(reclassifiedByCategory) },
     since: sinceTs ? new Date(sinceTs).toISOString() : null,
     filters: {
       tool: toolFilter,
@@ -200,6 +235,7 @@ console.log(`actionable families (matched): ${asText(actionableByFamily)}`);
 console.log(`patch failures (matched): ${patchRows.length} — ${asText(patchByCategory)}`);
 console.log(`command-exit tools (matched): ${asText(commandExitByTool)}`);
 console.log(`expected/absorbed categories (matched): ${asText(expectedByCategory)}`);
+console.log(`reclassified rows (matched): ${reclassifiedRows.length} — ${asText(reclassifiedByCategory)}`);
 console.log(`shown categories: ${asText(byCategory)}`);
 for (const row of recent) {
   const tool = rowTool(row);

package/scripts/tool-stress.mjs

@@ -129,13 +129,13 @@ try {
 
   // ── Phase D: cancellation under load ─────────────────────────────────────
   const bg = await timed('shell-async', /task_id/, () => executeBuiltinTool('shell', {
-    command: 'node -e "setTimeout(()=>{}, 30000)"', run_in_background: true, timeout_ms: 60_000,
+    command: 'node -e "setTimeout(()=>{}, 30000)"',
   }, root, { sessionId: 'stress-cancel' }));
   const bgId = (/task_id:\s*(\S+)/.exec(String(bg)) || [])[1];
   if (!bgId) failures.push('async shell did not return task_id');
   else {
     await timed('task-cancel', /cancelled/, () => executeBuiltinTool('task', { action: 'cancel', task_id: bgId }, root, { sessionId: 'stress-cancel' }));
-    const st = await timed('task-status', /cancelled|failed/, () => executeBuiltinTool('task', { action: 'status', task_id: bgId }, root, { sessionId: 'stress-cancel' }));
+    const st = await timed('task-status', /cancelled|failed/, () => executeBuiltinTool('task', { action: 'read', task_id: bgId }, root, { sessionId: 'stress-cancel' }));
     if (!/cancelled/.test(String(st))) failures.push(`cancelled task not reported cancelled: ${String(st).slice(0, 120)}`);
   }
 } finally {

package/src/lib/rules-builder.cjs

@@ -211,9 +211,6 @@ function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR, includeLeadBrief = true }
   const general = readOptional(path.join(LEAD_DIR, '01-general.md'));
   const parts = [];
 
-  const toolLead = readOptional(path.join(LEAD_DIR, 'lead-tool.md'));
-  if (toolLead) parts.push(toolLead);
-
   if (includeLeadBrief) {
     const briefLead = readOptional(path.join(LEAD_DIR, 'lead-brief.md'));
     if (briefLead) parts.push(briefLead);

package/src/rules/lead/01-general.md

@@ -7,17 +7,9 @@
 - Confirm destructive/hard-to-reverse actions against explicit validated paths;
   never `~`, a root, or unresolved variables/globs; report material deletion
   recoverability.
-- Ask only for decisions.
-- Investigate, build, and verify only what the requested outcome requires;
-  trust internal and framework guarantees.
-- Blocking tests cover only essential integrity, security, compatibility, and
-  buildability invariants. Treat mutable behavior, UX, exact text, snapshots,
-  and implementation shape as advisory specifications; update them when the
-  requested behavior changes instead of preserving obsolete behavior.
 - After required work, run final verification only when the outcome needs
   evidence the successful tool result does not already give, and run only
-  affected blocking invariants. Verification is that extra check, not
-  reopening already obtained content. Combine commands when dependency or
+  affected blocking invariants. Combine commands when dependency or
   atomicity requires it.
 - Mid-task: replacement supersedes; addition folds in; status gets a brief
   answer while work continues. After compaction, resume the summary.

package/src/rules/shared/01-tool.md

@@ -5,15 +5,18 @@
   path/name only→`find`; wildcard/recursive paths→`glob` (including known-root
   unknown descendants); exact directory entries→`list`;
   file-content search→`grep`; known-file content→`read`;
-  exact symbol, body, or relation→`code_graph`;
+  exact symbol, body, or relation→`code_graph`
+  (identifier declarations/usages→`code_graph`; literal values/strings→`grep`);
+  local Git repository inspection and mutation→`git`;
   program execution, calculations, data transformation, file generation, or
   unsupported formats→`shell`;
   web/current→`search`; returned URL body→`web_fetch`;
   prior work→`recall` (history only, never current local state);
   durable compact English memory→`memory`;
   explicit Project change→`cwd`
-  (a shell-local `cd` never changes the Project);
-  explicit user-requested conversation reset→`session_manage`.
+  (a shell-local `cd` never changes the Project).
+  Paths reachable by expanding an environment variable or the home directory
+  are resolved locations, not unknowns.
   Use only named tools present in the current tool surface.
 - Requirements define what must be true; evidence establishes what is true.
   Never use one as the other. Treat supplied target locations as resolved;
@@ -22,30 +25,56 @@
   inspect the original content itself. Within the current project, pass project-relative
   paths and omit optional scopes equal to its root; explicit paths may be
   outside cwd only for targets outside the project.
-- After identifying all result-critical evidence needs, plan the fewest
-  evidence-complete dependent rounds, then the fewest calls. Known state —
-  system/framework guarantees, supplied facts, exact lines or values already
-  visible here, tool returns, applied patches, and proved checks — is never
-  re-found, re-derived, or re-verified.
+  For a required new file, Add File itself is the atomic absence check: call
+  it directly, and inspect only if it reports that the target already exists.
+- Evidence economy: investigate, build, and verify only what the requested
+  outcome requires; trust internal and framework guarantees. After
+  identifying all result-critical evidence needs, plan the fewest
+  evidence-complete dependent rounds, then the fewest calls.
+  Known state — system/framework guarantees, supplied facts, exact lines or
+  values already visible here, tool returns, applied patches, and proved
+  checks — is never re-found, re-derived, or re-verified at any granularity:
+  no re-query call, no confirmation subcommand inside a shell command, no
+  availability probe for what the operation itself would report, no reopening
+  a file to rebuild context or confirm an edit, no rerun of a passed check.
   A hole (needed content absent and not reconstructable) is fetched once;
-  a change re-opens only that hole. Batch only calls whose need and inputs
-  cannot be changed or eliminated by another result; otherwise run the cheapest
-  decisive call that satisfies the remaining evidence needs. Before each batch, deduplicate
-  the remaining necessary facets, route each once to the cheapest sufficient
-  tool, and launch independent facets together — never split or duplicate a
-  facet across tools, mutate merely to widen retrieval, reserve known work, or
-  cap fanout.
-  Cover every independent facet of the round in one batch — one best-routed
-  call per facet; extra tools on the same facet add cost, not progress.
-  Returned output is fully mined
-  before the next round. `code_graph references` supplies the declaration and
-  scoped usages and ends that facet; values/locations end at the context grep returns; `read`
-  covers only what returned spans cannot, as an anchored offset/limit
-  window. Already obtained hunk text is any visible span — `grep`,
-  `code_graph`, `shell`, system/reminder text, or `read` — not only `read`.
-  Each follow-up may address only facts left unresolved or changed by
-  prior results; never re-query or re-verify established facts. Evidence that
-  determines the answer, edit, or deliverable ends retrieval — patch if needed.
+  a change re-opens only that hole. Returned output is fully mined before the
+  next round. `code_graph references` supplies the declaration and scoped
+  usages and ends that facet; values/locations end at the context grep
+  returns; `read` covers only what returned spans cannot, as an anchored
+  offset/limit window. Already obtained hunk text is any visible span —
+  `grep`, `code_graph`, `shell`, system/reminder text, or `read` — not only
+  `read`. Each follow-up may address only facts left unresolved or changed by
+  prior results. Evidence that determines the answer, edit, or deliverable
+  ends retrieval — patch if needed.
+- Parallel batching: independent calls share one batch by default — one
+  best-routed call per facet. Cost is counted in rounds, not calls: a batch
+  of N calls in one message is one round, so a call-count saving never
+  justifies folding work into a single worse-routed call.
+  The opening round is a one-shot sweep: every facet knowable from the
+  request alone — enumeration, content probes, file samples — launches in
+  that single first batch. Each later round exists only for facets the
+  previous round's results created; a facet no result produced belonged in
+  the round before it.
+  Opening-round batching never licenses a guessed path. `glob.path` must be
+  an established existing directory; omit it for the current Project. When
+  the location itself is unknown, use `find` first and call `glob` only if
+  wildcard descendants are still needed.
+  Serialize two calls only when the later call's
+  inputs are actually produced by the earlier result; the mere possibility
+  that a result could reshape later work never defers an independent call.
+  Before each batch, deduplicate the remaining necessary facets and route
+  each once to the cheapest sufficient tool — never split or duplicate a
+  facet across tools, mutate merely to widen retrieval, reserve known work,
+  or cap fanout. Applying one analysis to many targets is a single
+  parameterized call over all targets, not one call per target.
+  Enumerating sibling directories or same-kind files is one wildcard call
+  (`glob`, or `read` with a glob for content sampling), never a
+  directory-by-directory `list` walk or one `read` per file.
+- Blocking checks cover only essential integrity, security, compatibility,
+  and buildability invariants. Treat mutable behavior, UX, exact text,
+  snapshots, and implementation shape as advisory specifications; update them
+  when the requested behavior changes instead of preserving obsolete behavior.
 - A successful verification closes the task unless later changes affect it.
   Rerun a failed action only after its inputs or subject changes; otherwise
   report it unresolved.
@@ -53,26 +82,28 @@
   mutate only when the deliverable requires it, first preserving evidence
   at risk. Never mutate merely to clear an obstacle or unexpected state;
   unrecoverably lost evidence ends its search — report best effort.
- - Before `apply_patch`, use only already obtained hunk text. Never infer
-   patch context from another file, a sample, or expected text. Never
-   reopen a path to refresh patch context or to confirm a successful
-   apply_patch. Apply all determined edits in one cohesive `apply_patch`
-   call.
-  Hand-authored text is edited only with `apply_patch`. Use `shell` for program
-  execution, runtime/state operations, calculations, data transformation, file
-  generation, or formats unsupported by file tools. Do not use `shell` instead
-  of an available file tool for ordinary file-content inspection.
-- Start shell commands in the foreground. Set `run_in_background:true` only when their result is not needed
-  immediately and completion notification is sufficient. Tracked sync/async
-  commands belong to the current run. Only when the request explicitly requires
+- Before the exposed file-editing tool, use only already obtained exact source
+  text. Never infer edit context from another file, a sample, or expected text.
+  For context patches, include exact unchanged lines around each change and use
+  a class/function locator when that context is not unique.
+- Apply all determined changes in the fewest safe calls the active tool
+  supports. Hand-authored text is edited only with the exposed file-editing
+  tool.
+- Avoid Shell for file operations covered by dedicated tools unless explicitly
+  instructed or after verifying that a dedicated tool cannot do the job.
+  Shell otherwise joins investigation only for facts requiring execution or
+  unsupported decoding; an already-open shell is never a routing reason.
+- Shell commands start in the foreground. If still running after 15 seconds,
+  the command continues as a tracked `task_id`; completion arrives by notification.
+  Only when the request explicitly requires
   a service to survive after the run exits, detach it at shell level (for
   example, `nohup ... &`); never detach ordinary jobs merely to avoid tracking.
   A sync call may return a `task_id` and partial output after its blocking
   budget. Do not poll: completion resumes automatically. When intermediate output must drive
-  decisions or the user requests monitoring, use `task check_after` with an
-  explicit `after_ms` to schedule one non-blocking progress snapshot: normally
-  10–30s for active progress and 30–60s for long downloads/builds. Schedule
-  another only after inspecting that snapshot; completion cancels a pending
-  check.
-  Omit timeout by default, including for long jobs; set it only for a real total
-  deadline, since it kills even async jobs.
+  decisions or the user explicitly requests monitoring, call `task read` once
+  to return the current status and output snapshot. If it is still running,
+  await the completion notification; do not
+  call `task` again unless the user explicitly asks for another snapshot.
+  Omit `timeout_ms` by default, including for long jobs. A positive value is a
+  hard total deadline that kills the command even after task promotion; `0`
+  means no deadline.

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -173,6 +173,9 @@ function maintenanceRouteToPreset(routeOrName, agent) {
     const effort = String(routeOrName.effort || '').trim();
     if (effort) out.effort = effort;
     if (routeOrName.fast === true) out.fast = true;
+    if (routeOrName.modelParameters && typeof routeOrName.modelParameters === 'object') {
+        out.modelParameters = { ...routeOrName.modelParameters };
+    }
     return out;
 }
 

package/src/runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs

@@ -49,8 +49,9 @@ function isAgentProgressWatchdogAbortError(err) {
     return typeof msg === 'string' && WATCHDOG_ABORT_RE.test(msg);
 }
 
-// Tools that enforce their own execution deadline: 'shell' kills the process
-// at its configured timeout. These are NOT blanket-exempted from the
+// Tools that enforce their own execution deadline: shell kills the process
+// only when the caller supplied a positive timeout_ms. These are NOT
+// blanket-exempted from the
 // tool-running watchdog — if their own
 // deadline timer dies the session would otherwise hang forever. Instead the
 // watchdog raises the tool-running ceiling to their self-deadline + a grace
@@ -60,10 +61,6 @@ const SELF_DEADLINE_TOOLS = new Set(['shell']);
 // Grace added on top of a tool's own deadline before the watchdog steps in, so
 // the tool's in-process kill always fires first under normal operation.
 const TOOL_SELF_DEADLINE_GRACE_MS = 60_000;
-// Fallback deadline matching the shell implementation's 120s foreground
-// timeout.
-const SHELL_DEFAULT_TIMEOUT_MS = 120_000;
-
 function bareToolName(toolName) {
     if (typeof toolName !== 'string' || !toolName) return '';
     // Strip any MCP/server prefix (e.g. 'server__shell' or 'server.shell').
@@ -80,17 +77,16 @@ function isSelfDeadlineTool(toolName) {
  * recorded into the progress snapshot at dispatch time. Returns a positive
  * number when the tool enforces its own deadline, or null when unknown/missing
  * (caller then falls back to the plain toolRunningMs ceiling).
- *   - shell: explicit `timeout` (ms) if positive, else the 120s default.
+ *   - shell: explicit positive `timeout_ms`; omitted/0 has no self-deadline.
  */
 export function resolveToolSelfDeadlineMs(toolName, args) {
     if (!isSelfDeadlineTool(toolName)) return null;
     const bare = bareToolName(toolName);
     const a = (args && typeof args === 'object') ? args : {};
     if (bare === 'shell') {
-        const t = Number(a.timeout);
+        const t = Number(a.timeout_ms);
         if (Number.isFinite(t) && t > 0) return t;
-        const envDefault = parseInt(process.env.BASH_DEFAULT_TIMEOUT_MS ?? '', 10);
-        return envDefault > 0 ? envDefault : SHELL_DEFAULT_TIMEOUT_MS;
+        return null;
     }
     return null;
 }