mixdog 0.9.131 → 0.9.133

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.131",
+  "version": "0.9.133",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -59,7 +59,7 @@
     "test:tool-contracts": "npm run build:spawn:test && node scripts/tool-smoke.mjs",
     "smoke:patch": "node scripts/apply-patch-edit-smoke.mjs",
     "test:shellhardening": "npm run build:spawn:test && node --test scripts/suite-shellhardening-test.mjs scripts/suite-shell-direct-exe-test.mjs",
-    "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-outcome-test.mjs",
+    "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-outcome-test.mjs scripts/cursor-provider-test.mjs",
     "test:embedding-runtime:warmup": "node scripts/verify-embedding-runtime.mjs --warmup",
     "test:release-assets": "node --check scripts/verify-release-assets.mjs && node --check scripts/release-gate-test.mjs && node --check scripts/prepare-native-assets.mjs && node --test scripts/release-gate-test.mjs scripts/prepare-native-assets-test.mjs",
     "test:native-edit-wire": "node scripts/native-edit-wire-test.mjs",

package/scripts/fixtures/patch-replay-corpus.json

@@ -169,9 +169,9 @@
   },
   {
     "id": "add-overwrite-crlf",
-    "note": "Add File overwrite of an existing CRLF file must keep CRLF",
-    "expect": "applied",
-    "expect_content": { "a.txt": "NEW\r\n" },
+    "note": "Add File must reject an existing file without changing its CRLF content",
+    "expect": "rejected",
+    "expect_error": "Add File target already exists",
     "file_snapshots": { "a.txt": "old\r\n" },
     "args": { "patch": "*** Begin Patch\n*** Add File: a.txt\n+NEW\n*** End Patch\n" }
   },
@@ -194,24 +194,24 @@
   {
     "id": "already-applied-insert",
     "note": "observed: re-sent insertion whose unique new-side is already on disk",
-    "expect": "applied",
-    "expect_content": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n" },
+    "expect": "rejected",
+    "expect_error": "context not found",
     "file_snapshots": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n" },
     "args": { "patch": "*** Begin Patch\n*** Update File: a.js\n@@\n const STATUS = {\n   pending: 1,\n+  archived: 2,\n }\n*** End Patch\n" }
   },
   {
     "id": "already-applied-replace",
     "note": "observed: re-sent replacement whose unique new-side is already on disk",
-    "expect": "applied",
-    "expect_content": { "a.js": "head\nreturn ALL.has(v) || v === 'core' || v === 'lineage'\ntail\n" },
+    "expect": "rejected",
+    "expect_error": "context not found",
     "file_snapshots": { "a.js": "head\nreturn ALL.has(v) || v === 'core' || v === 'lineage'\ntail\n" },
     "args": { "patch": "*** Begin Patch\n*** Update File: a.js\n@@\n head\n-return ALL.has(v) || v === 'core'\n+return ALL.has(v) || v === 'core' || v === 'lineage'\n tail\n*** End Patch\n" }
   },
   {
     "id": "already-applied-mixed-remaining",
     "note": "already-applied hunks skip; a later unique old-side hunk still applies",
-    "expect": "applied",
-    "expect_content": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n// lineage backfill\n" },
+    "expect": "rejected",
+    "expect_error": "context not found",
     "file_snapshots": { "a.js": "const STATUS = {\n  pending: 1,\n  archived: 2,\n}\n// pending/active only\n" },
     "args": { "patch": "*** Begin Patch\n*** Update File: a.js\n@@\n const STATUS = {\n   pending: 1,\n+  archived: 2,\n }\n@@\n-// pending/active only\n+// lineage backfill\n*** End Patch\n" }
   },

package/scripts/reduction-trace-report.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { summarizeReductionTraceRows } from '../src/runtime/agent/orchestrator/session/reduction-metrics.mjs';
+
+export function parseTraceJsonl(text) {
+    const rows = [];
+    for (const line of String(text || '').split(/\r?\n/)) {
+        if (!line.trim()) continue;
+        try { rows.push(JSON.parse(line)); } catch { /* retain valid rows */ }
+    }
+    return rows;
+}
+
+function main(argv) {
+    const tracePath = argv[2];
+    if (!tracePath) {
+        process.stderr.write('Usage: node scripts/reduction-trace-report.mjs <agent-trace.jsonl>\n');
+        return 2;
+    }
+    const rows = parseTraceJsonl(readFileSync(resolve(tracePath), 'utf8'));
+    process.stdout.write(`${JSON.stringify(summarizeReductionTraceRows(rows), null, 2)}\n`);
+    return 0;
+}
+
+if (resolve(process.argv[1] || '') === fileURLToPath(import.meta.url)) {
+    process.exitCode = main(process.argv);
+}

package/scripts/tool-failures.mjs

@@ -2,6 +2,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { resolve } from 'node:path';
+import { classifyToolFailure } from '../src/runtime/agent/orchestrator/agent-trace-format.mjs';
 
 function argValue(name, fallback = null) {
   const idx = process.argv.indexOf(name);
@@ -87,9 +88,40 @@ function rowCategory(row) {
   return row.category || row.result_kind || row.resultKind || '(uncategorized)';
 }
 
+function rowErrorText(row) {
+  return row.error_preview || row.result || row.error || row.message || row.error_first_line || '';
+}
+
+function isKnownTestFixture(row) {
+  if (row.session_id !== 'no-session' || row.agent != null || row.model != null) return false;
+  const tool = rowTool(row);
+  if (tool === 'unknown_test_tool') return true;
+  return tool === 'apply_patch' && /^Error:\s*patch failed\s*$/i.test(String(rowErrorText(row)).trim());
+}
+
+function normalizeRowCategory(row) {
+  const storedCategory = rowCategory(row);
+  let category = storedCategory;
+  if (isKnownTestFixture(row)) {
+    category = 'expected-test';
+  } else if (rowTool(row) === 'apply_patch') {
+    const derived = classifyToolFailure(rowErrorText(row), 'apply_patch');
+    // Failure previews are bounded and may end before the nested cause. Never
+    // downgrade a stored specific category to the generic fallback merely
+    // because the historical preview lacks that tail.
+    if (derived !== 'runtime/failure' || storedCategory === 'runtime/failure') {
+      category = derived;
+    }
+  }
+  return category === storedCategory
+    ? row
+    : { ...row, stored_category: storedCategory, category };
+}
+
 const sinceTs = parseSince(sinceArg);
 const onlyArg = String(argValue('--only', 'all') || 'all').toLowerCase();
 const rows = files.flatMap(readRows)
+  .map(normalizeRowCategory)
   .filter((row) => sinceTs == null || Number(row.ts || 0) >= sinceTs)
   .filter((row) => !toolFilter || rowTool(row) === toolFilter)
   .filter((row) => !agentFilter || String(row.agent || '-') === agentFilter)
@@ -150,6 +182,8 @@ const actionableByFamily = tally(actionableRows, categoryFamily);
 const commandExitByTool = tally(commandExitRows, rowTool);
 const expectedByCategory = tally(expectedRows, rowCategory);
 const patchByCategory = tally(patchRows, rowCategory);
+const reclassifiedRows = rows.filter((row) => row.stored_category && row.stored_category !== rowCategory(row));
+const reclassifiedByCategory = tally(reclassifiedRows, (row) => `${row.stored_category} -> ${rowCategory(row)}`);
 
 if (jsonMode) {
   console.log(JSON.stringify({
@@ -160,6 +194,7 @@ if (jsonMode) {
     expected_absorbed: { shown: expectedRecent.length, matched: expectedRows.length },
     session_cancellations: { shown: 0, matched: cancellationRows.length },
     patch_failures: { matched: patchRows.length, categories: asObject(patchByCategory) },
+    reclassified: { matched: reclassifiedRows.length, categories: asObject(reclassifiedByCategory) },
     since: sinceTs ? new Date(sinceTs).toISOString() : null,
     filters: {
       tool: toolFilter,
@@ -200,6 +235,7 @@ console.log(`actionable families (matched): ${asText(actionableByFamily)}`);
 console.log(`patch failures (matched): ${patchRows.length} — ${asText(patchByCategory)}`);
 console.log(`command-exit tools (matched): ${asText(commandExitByTool)}`);
 console.log(`expected/absorbed categories (matched): ${asText(expectedByCategory)}`);
+console.log(`reclassified rows (matched): ${reclassifiedRows.length} — ${asText(reclassifiedByCategory)}`);
 console.log(`shown categories: ${asText(byCategory)}`);
 for (const row of recent) {
   const tool = rowTool(row);

package/scripts/tool-stress.mjs

@@ -129,13 +129,13 @@ try {
 
   // ── Phase D: cancellation under load ─────────────────────────────────────
   const bg = await timed('shell-async', /task_id/, () => executeBuiltinTool('shell', {
-    command: 'node -e "setTimeout(()=>{}, 30000)"', run_in_background: true, timeout_ms: 60_000,
+    command: 'node -e "setTimeout(()=>{}, 30000)"',
   }, root, { sessionId: 'stress-cancel' }));
   const bgId = (/task_id:\s*(\S+)/.exec(String(bg)) || [])[1];
   if (!bgId) failures.push('async shell did not return task_id');
   else {
     await timed('task-cancel', /cancelled/, () => executeBuiltinTool('task', { action: 'cancel', task_id: bgId }, root, { sessionId: 'stress-cancel' }));
-    const st = await timed('task-status', /cancelled|failed/, () => executeBuiltinTool('task', { action: 'status', task_id: bgId }, root, { sessionId: 'stress-cancel' }));
+    const st = await timed('task-status', /cancelled|failed/, () => executeBuiltinTool('task', { action: 'read', task_id: bgId }, root, { sessionId: 'stress-cancel' }));
     if (!/cancelled/.test(String(st))) failures.push(`cancelled task not reported cancelled: ${String(st).slice(0, 120)}`);
   }
 } finally {

package/src/lib/rules-builder.cjs

@@ -211,9 +211,6 @@ function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR, includeLeadBrief = true }
   const general = readOptional(path.join(LEAD_DIR, '01-general.md'));
   const parts = [];
 
-  const toolLead = readOptional(path.join(LEAD_DIR, 'lead-tool.md'));
-  if (toolLead) parts.push(toolLead);
-
   if (includeLeadBrief) {
     const briefLead = readOptional(path.join(LEAD_DIR, 'lead-brief.md'));
     if (briefLead) parts.push(briefLead);

package/src/rules/lead/01-general.md

@@ -7,17 +7,9 @@
 - Confirm destructive/hard-to-reverse actions against explicit validated paths;
   never `~`, a root, or unresolved variables/globs; report material deletion
   recoverability.
-- Ask only for decisions.
-- Investigate, build, and verify only what the requested outcome requires;
-  trust internal and framework guarantees.
-- Blocking tests cover only essential integrity, security, compatibility, and
-  buildability invariants. Treat mutable behavior, UX, exact text, snapshots,
-  and implementation shape as advisory specifications; update them when the
-  requested behavior changes instead of preserving obsolete behavior.
 - After required work, run final verification only when the outcome needs
   evidence the successful tool result does not already give, and run only
-  affected blocking invariants. Verification is that extra check, not
-  reopening already obtained content. Combine commands when dependency or
+  affected blocking invariants. Combine commands when dependency or
   atomicity requires it.
 - Mid-task: replacement supersedes; addition folds in; status gets a brief
   answer while work continues. After compaction, resume the summary.

package/src/rules/shared/01-tool.md

@@ -5,15 +5,18 @@
   path/name only→`find`; wildcard/recursive paths→`glob` (including known-root
   unknown descendants); exact directory entries→`list`;
   file-content search→`grep`; known-file content→`read`;
-  exact symbol, body, or relation→`code_graph`;
+  exact symbol, body, or relation→`code_graph`
+  (identifier declarations/usages→`code_graph`; literal values/strings→`grep`);
+  local Git repository inspection and mutation→`git`;
   program execution, calculations, data transformation, file generation, or
   unsupported formats→`shell`;
   web/current→`search`; returned URL body→`web_fetch`;
   prior work→`recall` (history only, never current local state);
   durable compact English memory→`memory`;
   explicit Project change→`cwd`
-  (a shell-local `cd` never changes the Project);
-  explicit user-requested conversation reset→`session_manage`.
+  (a shell-local `cd` never changes the Project).
+  Paths reachable by expanding an environment variable or the home directory
+  are resolved locations, not unknowns.
   Use only named tools present in the current tool surface.
 - Requirements define what must be true; evidence establishes what is true.
   Never use one as the other. Treat supplied target locations as resolved;
@@ -22,30 +25,56 @@
   inspect the original content itself. Within the current project, pass project-relative
   paths and omit optional scopes equal to its root; explicit paths may be
   outside cwd only for targets outside the project.
-- After identifying all result-critical evidence needs, plan the fewest
-  evidence-complete dependent rounds, then the fewest calls. Known state —
-  system/framework guarantees, supplied facts, exact lines or values already
-  visible here, tool returns, applied patches, and proved checks — is never
-  re-found, re-derived, or re-verified.
+  For a required new file, Add File itself is the atomic absence check: call
+  it directly, and inspect only if it reports that the target already exists.
+- Evidence economy: investigate, build, and verify only what the requested
+  outcome requires; trust internal and framework guarantees. After
+  identifying all result-critical evidence needs, plan the fewest
+  evidence-complete dependent rounds, then the fewest calls.
+  Known state — system/framework guarantees, supplied facts, exact lines or
+  values already visible here, tool returns, applied patches, and proved
+  checks — is never re-found, re-derived, or re-verified at any granularity:
+  no re-query call, no confirmation subcommand inside a shell command, no
+  availability probe for what the operation itself would report, no reopening
+  a file to rebuild context or confirm an edit, no rerun of a passed check.
   A hole (needed content absent and not reconstructable) is fetched once;
-  a change re-opens only that hole. Batch only calls whose need and inputs
-  cannot be changed or eliminated by another result; otherwise run the cheapest
-  decisive call that satisfies the remaining evidence needs. Before each batch, deduplicate
-  the remaining necessary facets, route each once to the cheapest sufficient
-  tool, and launch independent facets together — never split or duplicate a
-  facet across tools, mutate merely to widen retrieval, reserve known work, or
-  cap fanout.
-  Cover every independent facet of the round in one batch — one best-routed
-  call per facet; extra tools on the same facet add cost, not progress.
-  Returned output is fully mined
-  before the next round. `code_graph references` supplies the declaration and
-  scoped usages and ends that facet; values/locations end at the context grep returns; `read`
-  covers only what returned spans cannot, as an anchored offset/limit
-  window. Already obtained hunk text is any visible span — `grep`,
-  `code_graph`, `shell`, system/reminder text, or `read` — not only `read`.
-  Each follow-up may address only facts left unresolved or changed by
-  prior results; never re-query or re-verify established facts. Evidence that
-  determines the answer, edit, or deliverable ends retrieval — patch if needed.
+  a change re-opens only that hole. Returned output is fully mined before the
+  next round. `code_graph references` supplies the declaration and scoped
+  usages and ends that facet; values/locations end at the context grep
+  returns; `read` covers only what returned spans cannot, as an anchored
+  offset/limit window. Already obtained hunk text is any visible span —
+  `grep`, `code_graph`, `shell`, system/reminder text, or `read` — not only
+  `read`. Each follow-up may address only facts left unresolved or changed by
+  prior results. Evidence that determines the answer, edit, or deliverable
+  ends retrieval — patch if needed.
+- Parallel batching: independent calls share one batch by default — one
+  best-routed call per facet. Cost is counted in rounds, not calls: a batch
+  of N calls in one message is one round, so a call-count saving never
+  justifies folding work into a single worse-routed call.
+  The opening round is a one-shot sweep: every facet knowable from the
+  request alone — enumeration, content probes, file samples — launches in
+  that single first batch. Each later round exists only for facets the
+  previous round's results created; a facet no result produced belonged in
+  the round before it.
+  Opening-round batching never licenses a guessed path. `glob.path` must be
+  an established existing directory; omit it for the current Project. When
+  the location itself is unknown, use `find` first and call `glob` only if
+  wildcard descendants are still needed.
+  Serialize two calls only when the later call's
+  inputs are actually produced by the earlier result; the mere possibility
+  that a result could reshape later work never defers an independent call.
+  Before each batch, deduplicate the remaining necessary facets and route
+  each once to the cheapest sufficient tool — never split or duplicate a
+  facet across tools, mutate merely to widen retrieval, reserve known work,
+  or cap fanout. Applying one analysis to many targets is a single
+  parameterized call over all targets, not one call per target.
+  Enumerating sibling directories or same-kind files is one wildcard call
+  (`glob`, or `read` with a glob for content sampling), never a
+  directory-by-directory `list` walk or one `read` per file.
+- Blocking checks cover only essential integrity, security, compatibility,
+  and buildability invariants. Treat mutable behavior, UX, exact text,
+  snapshots, and implementation shape as advisory specifications; update them
+  when the requested behavior changes instead of preserving obsolete behavior.
 - A successful verification closes the task unless later changes affect it.
   Rerun a failed action only after its inputs or subject changes; otherwise
   report it unresolved.
@@ -53,17 +82,19 @@
   mutate only when the deliverable requires it, first preserving evidence
   at risk. Never mutate merely to clear an obstacle or unexpected state;
   unrecoverably lost evidence ends its search — report best effort.
- - Before `apply_patch`, use only already obtained hunk text. Never infer
-   patch context from another file, a sample, or expected text. Never
-   reopen a path to refresh patch context or to confirm a successful
-   apply_patch. Apply all determined edits in one cohesive `apply_patch`
-   call.
-  Hand-authored text is edited only with `apply_patch`. Use `shell` for program
-  execution, runtime/state operations, calculations, data transformation, file
-  generation, or formats unsupported by file tools. Do not use `shell` instead
-  of an available file tool for ordinary file-content inspection.
-- Shell commands start in the foreground. If still running after 10 seconds,
-  the call returns a tracked `task_id` and completion arrives by notification.
+- Before the exposed file-editing tool, use only already obtained exact source
+  text. Never infer edit context from another file, a sample, or expected text.
+  For context patches, include exact unchanged lines around each change and use
+  a class/function locator when that context is not unique.
+- Apply all determined changes in the fewest safe calls the active tool
+  supports. Hand-authored text is edited only with the exposed file-editing
+  tool.
+- Avoid Shell for file operations covered by dedicated tools unless explicitly
+  instructed or after verifying that a dedicated tool cannot do the job.
+  Shell otherwise joins investigation only for facts requiring execution or
+  unsupported decoding; an already-open shell is never a routing reason.
+- Shell commands start in the foreground. If still running after 15 seconds,
+  the command continues as a tracked `task_id`; completion arrives by notification.
   Only when the request explicitly requires
   a service to survive after the run exits, detach it at shell level (for
   example, `nohup ... &`); never detach ordinary jobs merely to avoid tracking.
@@ -73,5 +104,6 @@
   to return the current status and output snapshot. If it is still running,
   await the completion notification; do not
   call `task` again unless the user explicitly asks for another snapshot.
-  Omit timeout by default, including for long jobs; set it only for a real total
-  deadline, since it kills even async jobs.
+  Omit `timeout_ms` by default, including for long jobs. A positive value is a
+  hard total deadline that kills the command even after task promotion; `0`
+  means no deadline.

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -173,6 +173,9 @@ function maintenanceRouteToPreset(routeOrName, agent) {
     const effort = String(routeOrName.effort || '').trim();
     if (effort) out.effort = effort;
     if (routeOrName.fast === true) out.fast = true;
+    if (routeOrName.modelParameters && typeof routeOrName.modelParameters === 'object') {
+        out.modelParameters = { ...routeOrName.modelParameters };
+    }
     return out;
 }
 

package/src/runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs

@@ -49,8 +49,9 @@ function isAgentProgressWatchdogAbortError(err) {
     return typeof msg === 'string' && WATCHDOG_ABORT_RE.test(msg);
 }
 
-// Tools that enforce their own execution deadline: 'shell' kills the process
-// at its configured timeout. These are NOT blanket-exempted from the
+// Tools that enforce their own execution deadline: shell kills the process
+// only when the caller supplied a positive timeout_ms. These are NOT
+// blanket-exempted from the
 // tool-running watchdog — if their own
 // deadline timer dies the session would otherwise hang forever. Instead the
 // watchdog raises the tool-running ceiling to their self-deadline + a grace
@@ -60,10 +61,6 @@ const SELF_DEADLINE_TOOLS = new Set(['shell']);
 // Grace added on top of a tool's own deadline before the watchdog steps in, so
 // the tool's in-process kill always fires first under normal operation.
 const TOOL_SELF_DEADLINE_GRACE_MS = 60_000;
-// Fallback deadline matching the shell implementation's 120s foreground
-// timeout.
-const SHELL_DEFAULT_TIMEOUT_MS = 120_000;
-
 function bareToolName(toolName) {
     if (typeof toolName !== 'string' || !toolName) return '';
     // Strip any MCP/server prefix (e.g. 'server__shell' or 'server.shell').
@@ -80,17 +77,16 @@ function isSelfDeadlineTool(toolName) {
  * recorded into the progress snapshot at dispatch time. Returns a positive
  * number when the tool enforces its own deadline, or null when unknown/missing
  * (caller then falls back to the plain toolRunningMs ceiling).
- *   - shell: explicit `timeout` (ms) if positive, else the 120s default.
+ *   - shell: explicit positive `timeout_ms`; omitted/0 has no self-deadline.
  */
 export function resolveToolSelfDeadlineMs(toolName, args) {
     if (!isSelfDeadlineTool(toolName)) return null;
     const bare = bareToolName(toolName);
     const a = (args && typeof args === 'object') ? args : {};
     if (bare === 'shell') {
-        const t = Number(a.timeout);
+        const t = Number(a.timeout_ms);
         if (Number.isFinite(t) && t > 0) return t;
-        const envDefault = parseInt(process.env.BASH_DEFAULT_TIMEOUT_MS ?? '', 10);
-        return envDefault > 0 ? envDefault : SHELL_DEFAULT_TIMEOUT_MS;
+        return null;
     }
     return null;
 }

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -130,7 +130,7 @@ function traceAgentCompact({
 }
 
 const TOOL_ARG_KEYS = {
-    read: ['path', 'offset', 'limit', 'line', 'context', 'symbol'],
+    read: ['path', 'offset', 'limit', 'line', 'context'],
     grep: ['pattern', 'path', 'glob', 'output_mode', 'head_limit', 'offset'],
     glob: ['pattern', 'path', 'head_limit', 'offset', 'sort'],
     find: ['query', 'path', 'head_limit'],
@@ -140,7 +140,7 @@ const TOOL_ARG_KEYS = {
     code_graph: ['mode', 'file', 'files', 'symbol', 'symbols', 'body', 'language', 'limit', 'depth', 'page', 'cwd'],
     shell: ['command', 'timeout_ms'],
     task: ['action', 'task_id'],
-    edit: ['path', 'replace_all', 'edits'],
+    edit: ['file_path', 'replace_all'],
     edit_many: ['edits'],
     write: ['path'],
     apply_patch: ['base_path', 'dry_run'],
@@ -305,11 +305,10 @@ function classifyPatchFailure(text) {
     if (PATCH_COMMITTED_WRITES_RE.test(text)) return 'patch/partial-apply';
     // Resource guards (byte cap) are deliberate rejections, not tool defects.
     if (/patch too large|byte cap/.test(text)) return 'patch/limit';
-    if (/parse failed|invalid patch|malformed patch|missing \*\*\* (?:begin|end) patch|patch body is empty|unsupported patch format/.test(text)
-        // `patch contained no file sections` / `contains an empty file path`:
-        // the envelope parsed but produced nothing applicable — a patch-text
-        // defect, not a context miss.
-        || /contained no file sections|contains an empty file path/.test(text)) return 'patch/parse';
+    if (/(?:multiple|conflicting) operations target/.test(text)) return 'patch/duplicate-target';
+    // Inspect the nested cause before the outer `V4A parse failed` wrapper.
+    // Conversion-time context misses are edit-evidence failures, not malformed
+    // patch envelopes.
     if (/hunk rejected|context not found|context mismatch|anchor not found|expected first old(?:\/context| line)/.test(text)) {
         // Stale context requires REAL evidence that the region exists but has
         // moved/changed (nearest line, divergent line, rejected hunk). The
@@ -319,10 +318,16 @@ function classifyPatchFailure(text) {
             ? 'patch/stale-context'
             : 'patch/context';
     }
+    if (/parse failed|invalid patch|malformed patch|missing \*\*\* (?:begin|end) patch|patch body is empty|unsupported patch format/.test(text)
+        // `patch contained no file sections` / `contains an empty file path`:
+        // the envelope parsed but produced nothing applicable — a patch-text
+        // defect, not a context miss.
+        || /contained no file sections|contains an empty file path/.test(text)) return 'patch/parse';
+    if (/target\(s\) fall outside the write root/.test(text)) return 'path/outside-root';
     // Missing/unreadable targets are path problems even when a preflight
     // wrapper reports them; fall through to the generic path rules.
     if (/enoent|no such file|target unreadable|source (?:missing or )?unreadable|destination unreadable|cannot find/.test(text)) return null;
-    if (/preflight rejected|does not support|cannot be combined|only one v4a rename|missing parsed entry|internal js dispatch|rollback snapshot target/.test(text)) return 'patch/verification';
+    if (/preflight rejected|does not support|cannot be combined|only one v4a rename|missing parsed entry|internal js dispatch|rollback snapshot target|refusing hunkless delete/.test(text)) return 'patch/verification';
     return null;
 }
 
@@ -368,6 +373,7 @@ function classifyToolFailure(resultText, toolName) {
         || /must be|schema|required|old_string is .*>?=/.test(text)) return 'schema/args';
     if (/not in allow-list|not allowed/.test(text)) return 'permission';
     if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(raw)) return 'command-exit';
+    if (String(toolName || '') === 'glob' && /enoent|path does not exist|directory does not exist/.test(text)) return 'navigation/miss';
     if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/enoent';
     if (/timed out|timeout|interrupted|aborted/.test(text)) return 'timeout/abort';
     if (/unknown tool|tool.*not.*available|missing.*tool/.test(text)) return 'tool-surface';
@@ -414,7 +420,7 @@ function traceAgentToolFailure({ sessionId, iteration, toolName, toolKind, toolM
     }
 }
 
-function traceAgentTool({ sessionId, iteration, toolName, toolKind, toolMs, toolArgs, agent, resultKind, model, resultText, localSearchTelemetry = null, cwd }) {
+function traceAgentTool({ sessionId, iteration, toolName, toolKind, toolMs, toolArgs, agent, resultKind, model, resultText, localSearchTelemetry = null, resultTelemetry = null, cwd }) {
     const nextCallCount = countJsonNextCalls(resultText);
     const resultBytesEst = typeof resultText === 'string' ? Buffer.byteLength(resultText, 'utf8') : 0;
     const resultLinesEst = typeof resultText === 'string' && resultText.length > 0 ? resultText.split('\n').length : 0;
@@ -465,6 +471,9 @@ function traceAgentTool({ sessionId, iteration, toolName, toolKind, toolMs, tool
         local_search: localSearchTelemetry && Object.keys(localSearchTelemetry).length > 0
             ? { ...localSearchTelemetry }
             : null,
+        payload: resultTelemetry?.integrity
+            ? { integrity: { ...resultTelemetry.integrity } }
+            : {},
         cwd: cwd || null,
     });
     if (
@@ -586,6 +595,60 @@ export function traceAgentShellOutput({
     });
 }
 
+export function buildToolOutputTelemetryPayload({
+    toolCallId,
+    preOffloadBytes,
+    postOffloadBytes,
+    modelVisibleBytes,
+    offloaded,
+    resultKind,
+}) {
+    const before = Number(preOffloadBytes);
+    const after = Number(postOffloadBytes);
+    if (!Number.isFinite(before) || before < 0 || !Number.isFinite(after) || after < 0) return null;
+    const visible = Math.max(0, Math.trunc(Number(modelVisibleBytes) || 0));
+    const saved = Math.max(0, Math.trunc(before) - visible);
+    return {
+        tool_call_id: toolCallId || null,
+        result_kind: resultKind || null,
+        pre_offload_bytes: Math.trunc(before),
+        post_offload_bytes: Math.trunc(after),
+        model_visible_bytes: visible,
+        saved_bytes: saved,
+        reduction_pct: before > 0
+            ? Math.round((1 - visible / before) * 100)
+            : null,
+        offloaded: offloaded === true,
+    };
+}
+
+export function traceAgentToolOutput({
+    sessionId,
+    toolName,
+    toolCallId,
+    preOffloadBytes,
+    postOffloadBytes,
+    modelVisibleBytes,
+    offloaded,
+    resultKind,
+}) {
+    const payload = buildToolOutputTelemetryPayload({
+        toolCallId,
+        preOffloadBytes,
+        postOffloadBytes,
+        modelVisibleBytes,
+        offloaded,
+        resultKind,
+    });
+    if (!sessionId || !payload || payload.offloaded !== true) return;
+    appendAgentTrace({
+        sessionId,
+        kind: 'tool_output',
+        tool_name: toolName || null,
+        payload,
+    });
+}
+
 // Per-turn batch shape — one row per assistant turn with the number of
 // tool calls observed. Lets a consumer compute Lead-side multi-tool
 // adoption ratio (calls > 1 / total turns) directly from trace rows

package/src/runtime/agent/orchestrator/agent-trace.mjs

@@ -13,6 +13,7 @@ import {
     traceAgentToolFailure,
     traceAgentCompress,
     traceAgentShellOutput,
+    traceAgentToolOutput,
     traceAgentBatch,
 } from './agent-trace-format.mjs';
 
@@ -342,6 +343,7 @@ export {
     grokCacheChainTraceFields,
     traceAgentCompress,
     traceAgentShellOutput,
+    traceAgentToolOutput,
     traceAgentBatch,
     traceStreamAborted,
     traceStreamStalled,

package/src/runtime/agent/orchestrator/config.mjs

@@ -9,6 +9,7 @@ import {
     hasAnthropicOAuthCredentials,
     hasOpenAIOAuthCredentials,
     hasGrokOAuthCredentials,
+    hasCursorOAuthCredentials,
 } from './providers/oauth-credential-probes.mjs';
 
 // Thin wrapper around resolvePluginData so callers in this orchestrator tree
@@ -155,6 +156,9 @@ function buildDefaultConfig(options = {}) {
     // stored in mixdog-config.json — enabled at runtime from the presence of
     // Mixdog-owned credentials.
     providers['grok-oauth'] = { enabled: detectCredentials ? hasGrokOAuthCredentials() : false };
+    // Experimental direct Cursor wire provider. It remains disabled unless a
+    // Mixdog-owned login or CURSOR_ACCESS_TOKEN is present.
+    providers['cursor-oauth'] = { enabled: detectCredentials ? hasCursorOAuthCredentials() : false };
     // Local providers — opt-in via setup UI after HTTP ping confirms server is running
     providers.ollama = { enabled: false, baseURL: 'http://localhost:11434/v1' };
     providers.lmstudio = { enabled: false, baseURL: 'http://localhost:1234/v1' };
@@ -479,6 +483,9 @@ export function loadConfig(options = {}) {
                     if (kc) mergedProviders[name] = { ...(mergedProviders[name] || {}), apiKey: kc, enabled: true };
                 }
             }
+            // Cursor account access is OAuth-only. The dashboard's "API"
+            // meter is a quota bucket on that account, not a separate provider.
+            delete mergedProviders['cursor-api'];
             // Drop unknown maintenance keys (e.g. truly legacy slot names from
             // pre-removal installs). Every valid fallback slot lives in
             // DEFAULT_MAINTENANCE, so the allow-list below is the single
@@ -799,6 +806,8 @@ const FAST_CAPABLE_PRESET_PROVIDERS = new Set([
     'anthropic-oauth',
     'openai',
     'openai-oauth',
+    'cursor-oauth',
+    'cursor-api',
 ]);
 function normalizeAgentProviderId(provider) {
     const id = String(provider || '').trim();