mixdog 0.9.133 → 0.9.134

package/LICENSES/editor-assets-NOTICE.txt

@@ -0,0 +1,11 @@
+Editor compatibility data and icon tables include material derived from:
+
+Visual Studio Code
+Copyright (c) 2015 - present Microsoft Corporation
+https://github.com/microsoft/vscode
+Licensed under the MIT License. See LICENSES/MIT.txt.
+
+Seti UI
+Copyright (c) 2014 Jesse Weed
+https://github.com/jesseweed/seti-ui
+Licensed under the MIT License. See LICENSES/MIT.txt.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.133",
+  "version": "0.9.134",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -67,7 +67,7 @@
     "test:release-critical": "npm run test:release-assets && npm run smoke:patch && npm run test:providers",
     "test:spec-advisory": "node scripts/advisory-spec-test.mjs && npm run test:spec-advisory --prefix apps/desktop",
     "test:session-transport": "node --test scripts/session-transport-test.mjs scripts/daemon-bootstrap-test.mjs",
-    "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-save-fault-store-test.mjs",
+    "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-save-fault-store-test.mjs src/runtime/shared/tool-surface.test.mjs",
     "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs src/runtime/media/adapters/codex-image.test.mjs",
     "failures": "node scripts/tool-failures.mjs",
     "trace:llm": "node scripts/llm-trace-summary.mjs",

package/scripts/agent-lead-e2e-probe.mjs

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// Lead-delegation E2E probe (manual, real provider turns).
+//
+// Boots the REAL Lead session runtime (the TUI/desktop runtime, delegation
+// enabled) and verifies the whole agent path from a model turn:
+//   Lead model turn -> agent tool spawn -> routing rules resolve the worker
+//   preset -> worker turn -> completion -> owner notification -> Lead reports
+//   the worker's answer -> session-scoped agent status surface.
+//
+// Run: node scripts/agent-lead-e2e-probe.mjs [provider model]
+// Uses the real user config/credentials (copied read-only) in an isolated
+// MIXDOG_DATA_DIR so the live daemon/app state is never touched.
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-lead-e2e-'));
+// MIXDOG_LEAD_E2E_LIVE_DAEMON=1: keep the inherited runtime root (live daemon
+// discovery) and opt into agent shard spread, so the spawned worker runs on
+// the INSTALLED daemon's shard pool — the deployed remote-completion path.
+const LIVE_DAEMON = process.env.MIXDOG_LEAD_E2E_LIVE_DAEMON === '1';
+if (LIVE_DAEMON) process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
+else process.env.MIXDOG_RUNTIME_ROOT = ROOT;
+process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
+process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
+process.env.MIXDOG_FEATURE_MEMORY = '0';
+process.env.MIXDOG_FEATURE_WEB_SEARCH = '0';
+process.env.MIXDOG_AGENT_TRACE_DISABLE = '1';
+const DATA_DIR = join(ROOT, 'data');
+mkdirSync(DATA_DIR, { recursive: true });
+const REAL_DATA_DIR = join(homedir(), '.mixdog', 'data');
+for (const file of [
+  'mixdog-config.json',
+  'grok-oauth.json',
+  'grok-oauth-models.json',
+  'openai-oauth.json',
+  'openai-oauth-models.json',
+  'anthropic-oauth-credentials.json',
+  'anthropic-oauth-models.json',
+]) {
+  const from = join(REAL_DATA_DIR, file);
+  if (existsSync(from)) copyFileSync(from, join(DATA_DIR, file));
+}
+// The user's active workflow may be Solo (delegatesAgents:false), which
+// correctly removes the agent tool from the Lead surface. This probe verifies
+// DELEGATION, so pin the isolated config to the delegating default workflow.
+{
+  const configPath = join(DATA_DIR, 'mixdog-config.json');
+  if (existsSync(configPath)) {
+    const config = JSON.parse(readFileSync(configPath, 'utf8'));
+    // The config file nests runtime settings under the `agent` key.
+    const section = config.agent && typeof config.agent === 'object' ? config.agent : config;
+    section.workflow = { ...(section.workflow || {}), active: 'default' };
+    writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+  }
+}
+process.env.MIXDOG_DATA_DIR = DATA_DIR;
+
+const PROVIDER = process.argv[2] || 'grok-oauth';
+const MODEL = process.argv[3] || 'grok-4.3';
+const WORKER_AGENT = process.env.MIXDOG_LEAD_E2E_AGENT || 'worker';
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const failures = [];
+function check(ok, label, detail = '') {
+  if (!ok) failures.push(label);
+  process.stdout.write(`${ok ? 'ok  ' : 'FAIL'} - ${label}${detail ? ` (${detail})` : ''}\n`);
+}
+
+const { createMixdogSessionRuntime } = await import('../src/session-runtime/runtime-core.mjs');
+let runtime = null;
+try {
+  runtime = await createMixdogSessionRuntime({
+    provider: PROVIDER,
+    model: MODEL,
+    cwd: process.cwd(),
+    toolMode: 'full',
+    approvalMode: 'implicit',
+    disallowDelegation: false,
+  });
+  const notifications = [];
+  runtime.onNotification?.((event) => notifications.push(event));
+
+  const toolEvents = [];
+  const askOptions = {
+    onAssistantToolCallObserved: (call) => toolEvents.push({ kind: 'call', name: call?.name || call?.tool || '?' }),
+    onToolResult: (message) => toolEvents.push({
+      kind: 'result',
+      name: message?.name || message?.tool || '?',
+      preview: String(message?.content ?? message?.output ?? '').slice(0, 200),
+    }),
+  };
+  const ask1 = await runtime.ask(
+    'Delegate one task via the agent tool. If `agent` is not directly callable, first call '
+    + `load_tool with names=['agent'] to activate it. Then call agent with exactly type=spawn, agent=${WORKER_AGENT} and prompt `
+    + "'Read package.json in the current repo and reply with exactly the value of its name field, one word, nothing else.' "
+    + 'Do NOT set provider/model/effort (routing decides). Do not use read/grep/shell yourself. '
+    + 'After the spawn tool call returns, reply with exactly: SPAWNED. '
+    + 'Only if activating AND calling the agent tool both fail, reply exactly: AGENT_UNAVAILABLE',
+    askOptions,
+  );
+  const spawnReply = String(ask1?.result?.content || '');
+  process.stdout.write(`turn1 tools: ${JSON.stringify(toolEvents)}\n`);
+  const agentToolUsed = toolEvents.some((event) => event.name === 'agent');
+  check(agentToolUsed, 'Lead model turn actually invoked the agent tool', spawnReply.slice(0, 120));
+
+  // Poll the SAME status surface the desktop top-right button consumes.
+  let sawWorkerRow = null;
+  let terminalJob = null;
+  let scope = null;
+  const deadline = Date.now() + 120_000;
+  let lastStatus = null;
+  while (Date.now() < deadline && !terminalJob) {
+    const status = runtime.agentStatus?.() || {};
+    lastStatus = status;
+    scope = status.agentScope || scope;
+    const workers = status.agentWorkers || [];
+    if (!sawWorkerRow && workers.length > 0) sawWorkerRow = workers[0];
+    terminalJob = (status.agentJobs || []).find(
+      (job) => /completed|failed|cancelled/i.test(String(job.status)),
+    ) || null;
+    if (!terminalJob) await sleep(300);
+  }
+  process.stdout.write(`final status surface: ${JSON.stringify({
+    workers: lastStatus?.agentWorkers || [],
+    jobs: lastStatus?.agentJobs || [],
+  }).slice(0, 1_500)}\n`);
+  check(Boolean(sawWorkerRow), 'worker visible on the session agent status surface',
+    sawWorkerRow ? `tag=${sawWorkerRow.tag} stage=${sawWorkerRow.stage}` : 'never appeared');
+  check(Boolean(terminalJob), 'agent job reached a terminal state');
+  check(terminalJob?.status === 'completed', 'agent job completed without error',
+    `status=${terminalJob?.status} error=${terminalJob?.error || 'none'}`);
+  check(Boolean(terminalJob?.provider && terminalJob?.model), 'routing rules resolved the worker route',
+    `agent=${terminalJob?.agent} route=${terminalJob?.provider}/${terminalJob?.model} preset=${terminalJob?.preset || '-'}`);
+  check(scope?.sessionId === runtime.id, 'agent status surface is scoped to the owner session',
+    `scope=${JSON.stringify(scope)} lead=${runtime.id}`);
+  await sleep(500);
+  check(notifications.length > 0, 'owner received the completion notification',
+    `count=${notifications.length}`);
+
+  // Mirror the surface's notification injection into the next Lead turn.
+  const notifText = notifications.map((event) => {
+    try { return typeof event === 'string' ? event : JSON.stringify(event); } catch { return String(event); }
+  }).join('\n').slice(0, 4_000);
+  const ask2 = await runtime.ask(
+    `Agent completion notification:\n${notifText}\n\n`
+    + 'Reply with exactly: WORKER_SAID=<the worker\'s one-word answer from the notification>',
+    {},
+  );
+  const finalReply = String(ask2?.result?.content || '');
+  check(/WORKER_SAID=\s*mixdog/i.test(finalReply), 'Lead surfaced the worker result',
+    finalReply.slice(0, 160));
+
+  process.stdout.write(`verdict: ${failures.length === 0 ? 'PASS' : `FAIL (${failures.join('; ')})`}\n`);
+  process.exitCode = failures.length === 0 ? 0 : 1;
+} finally {
+  try { await runtime?.stop?.('lead-e2e-probe-exit'); } catch { /* teardown */ }
+  try { rmSync(ROOT, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }); } catch { /* temp */ }
+}
+process.exit(process.exitCode || 0);

package/scripts/agent-long-prompt-repro.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// Repro: worker spawn with a LONG prompt (> 800B attachment-externalization
+// threshold) through the shard-spread daemon path. Isolated daemon/root.
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = mkdtempSync(join(tmpdir(), 'mixdog-longprompt-'));
+process.env.MIXDOG_RUNTIME_ROOT = ROOT;
+process.env.MIXDOG_DAEMON_SKIP_MEMORY = '1';
+process.env.MIXDOG_BOOT_CORE_MEMORY = '0';
+process.env.MIXDOG_AGENT_TRACE_DISABLE = '1';
+process.env.MIXDOG_AGENT_SHARD_SPREAD = '1';
+const DATA_DIR = join(ROOT, 'data');
+mkdirSync(DATA_DIR, { recursive: true });
+const REAL = join(homedir(), '.mixdog', 'data');
+for (const file of ['mixdog-config.json', 'grok-oauth.json', 'grok-oauth-models.json']) {
+  const from = join(REAL, file);
+  if (existsSync(from)) copyFileSync(from, join(DATA_DIR, file));
+}
+process.env.MIXDOG_DATA_DIR = DATA_DIR;
+
+const cfgMod = await import('../src/runtime/agent/orchestrator/config.mjs');
+const reg = await import('../src/runtime/agent/orchestrator/providers/registry.mjs');
+const mgr = await import('../src/runtime/agent/orchestrator/session/manager.mjs');
+const { createStandaloneAgent } = await import('../src/standalone/agent-tool.mjs');
+const { ensureDaemon, shutdownDaemon } = await import('../src/standalone/session-client.mjs');
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+let agent = null;
+let daemonDiscovery = null;
+try {
+  daemonDiscovery = await ensureDaemon({ cwd: REPO, log: () => {} });
+  agent = createStandaloneAgent({ cfgMod, reg, mgr, dataDir: DATA_DIR, cwd: REPO });
+  // Padding pushes the prompt over TEXT_REFERENCE_THRESHOLD_BYTES (800).
+  const padding = 'Background context (ignore, filler): ' + 'lorem ipsum dolor sit amet. '.repeat(40);
+  const prompt = `${padding}\nActual task: read package.json in the current repo and reply with exactly the value of its "name" field, one word, nothing else.`;
+  process.stdout.write(`prompt bytes: ${Buffer.byteLength(prompt, 'utf8')}\n`);
+  const out = await agent.execute({
+    type: 'spawn', agent: 'worker', provider: 'grok-oauth', model: 'grok-4.3', effort: 'low',
+    tag: 'longprompt-w0', cwd: REPO, prompt,
+  }, { invocationSource: 'model-tool', cwd: REPO });
+  const taskId = String(out).match(/agent task: (\S+)/)?.[1];
+  if (!taskId) throw new Error(`spawn did not return a task id: ${String(out).slice(0, 300)}`);
+  process.stdout.write(`spawned: ${taskId}\n`);
+  let last = '';
+  const deadline = Date.now() + 120_000;
+  while (Date.now() < deadline) {
+    last = await agent.execute({ type: 'read', task_id: taskId }, { invocationSource: 'model-tool', cwd: REPO });
+    if (/status: (completed|failed|error|cancelled)/.test(last)) break;
+    await sleep(500);
+  }
+  process.stdout.write(`${last.slice(0, 900)}\n`);
+  const ok = /status: completed/.test(last) && /mixdog/i.test(last);
+  process.stdout.write(`verdict: ${ok ? 'PASS' : 'FAIL'}\n`);
+  if (!ok) {
+    // Autopsy: shard-side turn timing + persisted worker session shape.
+    const { readFileSync, readdirSync } = await import('node:fs');
+    try {
+      const log = readFileSync(join(DATA_DIR, 'daemon.log'), 'utf8').trim().split(/\r?\n/);
+      for (const line of log.slice(-30)) process.stdout.write(`[daemon.log] ${line}\n`);
+    } catch (error) { process.stdout.write(`daemon.log read failed: ${error?.message}\n`); }
+    try {
+      const dir = join(DATA_DIR, 'sessions');
+      for (const file of readdirSync(dir)) {
+        if (!file.startsWith('sess_daemon')) continue;
+        const x = JSON.parse(readFileSync(join(dir, file), 'utf8'));
+        const s = x.session || x;
+        process.stdout.write(`[worker-session] ${file} msgs=${(s.messages || []).length} roles=${(s.messages || []).map((m) => m.role).join(',')}\n`);
+      }
+    } catch (error) { process.stdout.write(`session dump failed: ${error?.message}\n`); }
+  }
+  process.exitCode = ok ? 0 : 1;
+} finally {
+  try { agent?.closeAll('longprompt-end'); } catch {}
+  try { await shutdownDaemon(daemonDiscovery); } catch {}
+  await sleep(300);
+  try { rmSync(ROOT, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }); } catch {}
+}
+process.exit(process.exitCode || 0);

package/scripts/patch-replay.mjs

@@ -8,7 +8,8 @@
 //   node scripts/patch-replay.mjs --replay-all [--json]
 import { existsSync, readFileSync, readdirSync, mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { executePatchTool } from '../src/runtime/agent/orchestrator/tools/patch.mjs';
 
 function argValue(name, fallback = null) {
@@ -37,12 +38,53 @@ function loadRecords() {
 
 function isErr(text) { return /^Error[\s:[]/.test(String(text || '').trimStart()); }
 
-async function replayOne(rec) {
+function resolveReplaySnapshotPath(root, rel) {
+  const text = String(rel || '');
+  const portableAbsolute = /^[A-Za-z]:[\\/]/.test(text) || /^[/\\]{2}/.test(text);
+  if (!text || text.includes('\0') || isAbsolute(text) || portableAbsolute
+    || text.split(/[\\/]+/).includes('..')) {
+    throw new Error(`unsafe snapshot path: ${text || '(empty)'}`);
+  }
+  const abs = resolve(root, text);
+  const fromRoot = relative(root, abs);
+  if (!fromRoot || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
+    throw new Error(`unsafe snapshot path: ${text}`);
+  }
+  return abs;
+}
+
+export function legacyPartialReplayReason(rec) {
+  const partial = rec?.outcome?.kind === 'partial'
+    || /apply_patch file-level partial/i.test(String(rec?.error_first_line || ''));
+  if (partial && rec?.snapshot_phase !== 'pre') {
+    return 'legacy partial capture has post-mutation snapshots; replay would not reproduce the original pre-state';
+  }
+  return null;
+}
+
+export async function replayOne(rec) {
+  const skipReason = legacyPartialReplayReason(rec);
+  if (skipReason) {
+    return { id: rec.id, ok: false, skipped: true, skipReason, before: rec.error_first_line, after: null };
+  }
   const tmp = mkdtempSync(join(tmpdir(), 'mixdog-patch-replay-'));
+  const previousCapture = process.env.MIXDOG_PATCH_REPLAY_CAPTURE;
+  process.env.MIXDOG_PATCH_REPLAY_CAPTURE = '0';
   try {
     for (const [rel, content] of Object.entries(rec.file_snapshots || {})) {
       if (content == null) continue;
-      const abs = join(tmp, rel);
+      let abs;
+      try {
+        abs = resolveReplaySnapshotPath(tmp, rel);
+      } catch (error) {
+        return {
+          id: rec.id,
+          ok: false,
+          skipped: false,
+          before: rec.error_first_line,
+          after: `Error: ${error?.message || String(error)}`,
+        };
+      }
       mkdirSync(dirname(abs), { recursive: true });
       writeFileSync(abs, content);
     }
@@ -50,41 +92,57 @@ async function replayOne(rec) {
     let result;
     try { result = await executePatchTool('apply_patch', args, tmp, {}); }
     catch (e) { result = `Error: ${e?.message || String(e)}`; }
-    return { id: rec.id, ok: !isErr(result), before: rec.error_first_line, after: String(result).split('\n')[0].slice(0, 200) };
+    return { id: rec.id, ok: !isErr(result), skipped: false, before: rec.error_first_line, after: String(result).split('\n')[0].slice(0, 200) };
   } finally {
+    if (previousCapture === undefined) delete process.env.MIXDOG_PATCH_REPLAY_CAPTURE;
+    else process.env.MIXDOG_PATCH_REPLAY_CAPTURE = previousCapture;
     try { rmSync(tmp, { recursive: true, force: true }); } catch {}
   }
 }
 
-const jsonMode = hasFlag('--json');
-const records = loadRecords();
+async function main() {
+  const jsonMode = hasFlag('--json');
+  const records = loadRecords();
 
-if (hasFlag('--list') || (!hasFlag('--replay-all') && !argValue('--replay'))) {
-  if (jsonMode) { console.log(JSON.stringify(records.map(({ file_snapshots, args, ...m }) => m), null, 2)); process.exit(0); }
-  console.log(`captured apply_patch failures: ${records.length}  (dir: ${replayDir()})`);
-  for (const r of records.slice(0, 50)) {
-    console.log(`- ${r.id}  targets=${(r.targets || []).length}  ${new Date(r.ts).toISOString()}`);
-    console.log(`    ${String(r.error_first_line || '').slice(0, 140)}`);
+  if (hasFlag('--list') || (!hasFlag('--replay-all') && !argValue('--replay'))) {
+    if (jsonMode) { console.log(JSON.stringify(records.map(({ file_snapshots, args, ...m }) => m), null, 2)); return; }
+    console.log(`captured apply_patch failures: ${records.length}  (dir: ${replayDir()})`);
+    for (const r of records.slice(0, 50)) {
+      const phase = r.snapshot_phase || 'legacy';
+      console.log(`- ${r.id}  targets=${(r.targets || []).length}  phase=${phase}  ${new Date(r.ts).toISOString()}`);
+      console.log(`    ${String(r.error_first_line || '').slice(0, 140)}`);
+    }
+    if (!records.length) console.log('(none - set MIXDOG_PATCH_REPLAY_CAPTURE=1 to capture)');
+    return;
   }
-  if (!records.length) console.log('(none - set MIXDOG_PATCH_REPLAY_CAPTURE=1 to capture)');
-  process.exit(0);
-}
 
-const one = argValue('--replay', null);
-const targets = one ? records.filter((r) => r.id === one || r.id.startsWith(one)) : records;
-if (!targets.length) { console.error(one ? `no replay matched: ${one}` : 'no captured failures'); process.exit(1); }
+  const one = argValue('--replay', null);
+  const targets = one ? records.filter((r) => r.id === one || r.id.startsWith(one)) : records;
+  if (!targets.length) {
+    console.error(one ? `no replay matched: ${one}` : 'no captured failures');
+    process.exitCode = 1;
+    return;
+  }
 
-const results = [];
-for (const rec of targets) results.push(await replayOne(rec));
-const passed = results.filter((r) => r.ok).length;
+  const results = [];
+  for (const rec of targets) results.push(await replayOne(rec));
+  const passed = results.filter((r) => r.ok).length;
+  const skipped = results.filter((r) => r.skipped).length;
+  const failed = results.length - passed - skipped;
 
-if (jsonMode) {
-  console.log(JSON.stringify({ total: results.length, passed, failed: results.length - passed, results }, null, 2));
-} else {
-  console.log(`patch-replay: ${passed}/${results.length} now succeed`);
-  for (const r of results) {
-    console.log(`- ${r.id}: ${r.ok ? 'PASS' : 'still fails'}`);
-    if (!r.ok) console.log(`    after: ${r.after}`);
+  if (jsonMode) {
+    console.log(JSON.stringify({ total: results.length, passed, failed, skipped, results }, null, 2));
+  } else {
+    console.log(`patch-replay: ${passed} passed · ${failed} still fail · ${skipped} legacy-skipped`);
+    for (const r of results) {
+      console.log(`- ${r.id}: ${r.skipped ? 'legacy-skip' : r.ok ? 'PASS' : 'still fails'}`);
+      if (r.skipped) console.log(`    skip: ${r.skipReason}`);
+      else if (!r.ok) console.log(`    after: ${r.after}`);
+    }
   }
+  process.exitCode = failed > 0 ? 1 : 0;
 }
-process.exitCode = passed === results.length ? 0 : 1;
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await main();
+}

package/scripts/patch-replay.test.mjs

@@ -0,0 +1,94 @@
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import { executePatchTool } from '../src/runtime/agent/orchestrator/tools/patch.mjs';
+import { legacyPartialReplayReason, replayOne } from './patch-replay.mjs';
+
+test('partial patch replay captures the pre-mutation state and never recaptures replay failures', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'mixdog-patch-capture-'));
+  const replayDir = join(root, 'replays');
+  mkdirSync(replayDir);
+  writeFileSync(join(root, 'good.txt'), 'one\n');
+  writeFileSync(join(root, 'stale.txt'), 'actual\n');
+  const previousDir = process.env.MIXDOG_PATCH_REPLAY_DIR;
+  const previousCapture = process.env.MIXDOG_PATCH_REPLAY_CAPTURE;
+  process.env.MIXDOG_PATCH_REPLAY_DIR = replayDir;
+  process.env.MIXDOG_PATCH_REPLAY_CAPTURE = '1';
+  try {
+    const result = await executePatchTool('apply_patch', {
+      patch: [
+        '*** Begin Patch',
+        '*** Update File: good.txt',
+        '@@',
+        '-one',
+        '+two',
+        '*** Update File: stale.txt',
+        '@@',
+        '-expected',
+        '+next',
+        '*** End Patch',
+        '',
+      ].join('\n'),
+    }, root, { sessionId: 'session-test', toolCallId: 'call-test' });
+    assert.match(result, /^Error: apply_patch file-level partial: 1\/2/m);
+    const captures = readdirSync(replayDir).filter((file) => file.endsWith('.json'));
+    assert.equal(captures.length, 1);
+    const record = JSON.parse(readFileSync(join(replayDir, captures[0]), 'utf8'));
+    assert.equal(record.snapshot_phase, 'pre');
+    assert.equal(record.file_snapshots['good.txt'], 'one\n');
+    assert.equal(record.file_snapshots['stale.txt'], 'actual\n');
+    assert.deepEqual(record.outcome, {
+      kind: 'partial',
+      applied: 1,
+      total: 2,
+      rejected: 1,
+      rejectedTargets: ['stale.txt'],
+    });
+    assert.equal(record.session_id, 'session-test');
+    assert.equal(record.tool_call_id, 'call-test');
+    assert.match(record.error_text, /expected first old line/);
+
+    const replayed = await replayOne(record);
+    assert.equal(replayed.skipped, false);
+    assert.equal(replayed.ok, false);
+    assert.equal(readdirSync(replayDir).filter((file) => file.endsWith('.json')).length, 1);
+  } finally {
+    if (previousDir === undefined) delete process.env.MIXDOG_PATCH_REPLAY_DIR;
+    else process.env.MIXDOG_PATCH_REPLAY_DIR = previousDir;
+    if (previousCapture === undefined) delete process.env.MIXDOG_PATCH_REPLAY_CAPTURE;
+    else process.env.MIXDOG_PATCH_REPLAY_CAPTURE = previousCapture;
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('legacy partial captures are skipped instead of producing misleading replay failures', () => {
+  assert.match(legacyPartialReplayReason({
+    error_first_line: 'Error: apply_patch file-level partial: 1/2 file(s) applied to disk (committed); 1 file(s) rejected',
+  }), /post-mutation snapshots/);
+  assert.equal(legacyPartialReplayReason({
+    snapshot_phase: 'pre',
+    outcome: { kind: 'partial' },
+  }), null);
+});
+
+test('replay snapshots cannot write outside the throwaway replay root', async () => {
+  const escaped = join(tmpdir(), `mixdog-patch-replay-escape-${process.pid}-${Date.now()}.txt`);
+  try {
+    const result = await replayOne({
+      id: 'unsafe-snapshot',
+      args: { patch: '*** Begin Patch\n*** End Patch\n' },
+      file_snapshots: {
+        [`../${escaped.split(/[\\/]/).at(-1)}`]: 'must not be written',
+      },
+    });
+    assert.equal(result.ok, false);
+    assert.equal(result.skipped, false);
+    assert.match(result.after, /unsafe snapshot path/);
+    assert.equal(existsSync(escaped), false);
+  } finally {
+    rmSync(escaped, { force: true });
+  }
+});

package/src/defaults/skills/setup/SKILL.md

@@ -432,15 +432,15 @@ Desktop과 현재 runtime에서 소비되지 않는 아래 key는 사용자 옵
 | 레거시 key | 처리 |
 |---|---|
 | `agent.workflowRoutes` | `agent.agents`로 이관된 뒤 제거. 수동 편집 금지 |
-| `agent.fastModels` | explicit `modelSettings.<provider/model>.fast`가 없을 때만 `true`를 이관한 뒤 제거 |
+| `agent.fastModels` | 제거 (이관 없음; `modelSettings.<provider/model>.fast`만 유효) |
 | `agent.agentMaintenance`, `agent.runtime` | 제거 |
 | `remote.autoStart` | 제거; Remote는 session header에서 수동 claim |
 | `ui.mouseMode` | 제거; `ui.theme`은 TUI 현행 설정 |
-| `channels.backend` | `channels.provider`로 이관 후 제거 |
+| `channels.backend` | 제거 (이관 없음; `channels.provider`만 유효) |
 | `channels.channel.channelId` | 제거; `discordChannelId` / `telegramChatId`만 유지 |
 | `channels.quiet`, `channels.schedules` | 제거; schedule은 PG가 단일 저장소 |
 | `channels.webhook.ngrokDomain`, `channels.webhook.respectQuiet` | 제거; endpoint URL은 Desktop Webhooks가 발급 |
-| `agent.outputStyle` | 루트 `outputStyle`로 이관 후 제거 |
+| `agent.outputStyle` | 제거 (이관 없음; 루트 `outputStyle`만 유효) |
 
 다음 항목은 레거시처럼 보여도 현행이므로 유지한다: 루트 `outputStyle`, `agent.shell`, `agent.modules`, `channels.channel.discordChannelId/telegramChatId`, compaction의 `type/compactType`과 recall tuning fields.
 

package/src/headless-exec.mjs

@@ -13,16 +13,14 @@ import {
 } from './runtime/shared/pristine-execution.mjs';
 import { hasActiveBackgroundTasks } from './runtime/shared/background-tasks.mjs';
 import { installProcessSignalCleanup } from './runtime/shared/process-shutdown.mjs';
+import { sleep } from './runtime/shared/sleep.mjs';
+import { stopStandaloneMemoryRuntimesForProcess } from './standalone/memory-runtime-proxy.mjs';
 import { applyUsageDelta, createSessionStats } from './ui/session-stats.mjs';
 
 function clean(value) {
   return String(value ?? '').trim();
 }
 
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 function nonNegativeNumber(value) {
   const number = Number(value);
   return Number.isFinite(number) ? Math.max(0, number) : 0;
@@ -553,6 +551,7 @@ export async function runHeadlessExec({
   usageLogPath = process.env.MIXDOG_USAGE_LOG,
   boundaryFactory = createPristineExecutionBoundary,
   runtimeFactory = null,
+  memoryRuntimeCleanup = stopStandaloneMemoryRuntimesForProcess,
   hasActiveTasks = hasActiveBackgroundTasks,
   installSignalCleanupFn = installProcessSignalCleanup,
   idlePollMs = 100,
@@ -591,11 +590,33 @@ export async function runHeadlessExec({
   let code = 1;
   const cleanup = (reason = 'exec-exit') => {
     cleanupPromise ??= (async () => {
+      const errors = [];
       try {
         if (runtime) await runtime.close(reason);
-      } finally {
-        boundary?.cleanup();
+      } catch (error) {
+        errors.push(error);
+      }
+      let memoryCleanupFailed = false;
+      if (boundary) {
+        try {
+          await memoryRuntimeCleanup({ waitForExit: true, timeoutMs: 10_000 });
+        } catch (error) {
+          memoryCleanupFailed = true;
+          errors.push(error);
+        }
+      }
+      try {
+        const cleanupResult = boundary?.cleanup(memoryCleanupFailed
+          ? { preserveRoot: true }
+          : { tolerateRootRemovalFailure: true });
+        if (cleanupResult?.rootRemovalError) {
+          writeErr(`mixdog: shutdown cleanup failed (result unaffected): ${cleanupResult.rootRemovalError?.message || cleanupResult.rootRemovalError}\n`);
+        }
+      } catch (error) {
+        errors.push(error);
       }
+      if (errors.length === 1) throw errors[0];
+      if (errors.length > 1) throw new AggregateError(errors, 'headless shutdown failed');
     })();
     return cleanupPromise;
   };
@@ -604,7 +625,7 @@ export async function runHeadlessExec({
     boundary = boundaryFactory({ provider, model, effort, fast });
     signalCleanup = installSignalCleanupFn({
       name: 'mixdog-exec',
-      timeoutMs: 6500,
+      timeoutMs: 20_000,
       cleanup,
     });
     const createRuntime = runtimeFactory || (