mixdog 0.9.134 → 0.9.135

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.134",
+  "version": "0.9.135",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/src/headless-exec.mjs

@@ -583,6 +583,7 @@ export async function runHeadlessExec({
   let runtime = null;
   let signalCleanup = null;
   let unsubscribeNotification = null;
+  let completionPending = false;
   let cleanupPromise = null;
   let result = null;
   let resultText = '';
@@ -644,18 +645,25 @@ export async function runHeadlessExec({
       toolMode: 'full',
       approvalMode: 'implicit',
       disallowDelegation: true,
+      autoWakeCompletions: false,
       initialConfig: boundary.loadConfig(),
     });
     if (lifecycle && !clean(runtime?.id) && typeof runtime?.reserveSessionId === 'function') {
       runtime.reserveSessionId(lifecycle.threadId);
     }
     lifecycle?.start(runtime);
-    if (lifecycle && typeof runtime?.onNotification === 'function') {
+    if (typeof runtime?.onNotification === 'function') {
       unsubscribeNotification = runtime.onNotification(
-        (event) => lifecycle.onNotification(event),
+        (event) => {
+          lifecycle?.onNotification(event);
+          const status = clean(event?.meta?.status).toLowerCase();
+          if (['completed', 'failed', 'cancelled', 'canceled', 'timed_out'].includes(status)) {
+            completionPending = true;
+          }
+        },
       );
     }
-    ({ result } = await runtime.ask(prompt, {
+    const askOptions = {
       onTextReset: () => true,
       onUsageDelta: (delta) => {
         applyUsageDelta(stats, delta);
@@ -672,13 +680,22 @@ export async function runHeadlessExec({
         onToolPhaseCompleted: (detail) => lifecycle.onToolBatchCompleted(detail),
         onStageChange: (stage, detail) => lifecycle.onStageChange(stage, detail),
       } : {}),
-    }));
-    await waitForTrackedTasks({
-      sessionId: runtime.id,
+    };
+    ({ result } = await runtime.ask(prompt, askOptions));
+    const taskScope = {
+      ...(clean(runtime.id) ? { callerSessionId: clean(runtime.id) } : {}),
       clientHostPid: runtime.clientHostPid,
-      hasActiveTasks,
-      pollMs: idlePollMs,
-    });
+    };
+    while (completionPending || hasActiveTasks(taskScope)) {
+      await waitForTrackedTasks({
+        sessionId: runtime.id,
+        clientHostPid: runtime.clientHostPid,
+        hasActiveTasks,
+        pollMs: idlePollMs,
+      });
+      completionPending = false;
+      ({ result } = await runtime.ask('', askOptions));
+    }
     resultText = String(result?.content ?? result?.text ?? '');
     if (!json && resultText) {
       write(resultText.endsWith('\n') ? resultText : `${resultText}\n`);

package/src/headless-exec.test.mjs

@@ -90,7 +90,7 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
       hasActiveTasks: (scope) => {
         activeScopes.push(scope);
         activeChecks += 1;
-        return activeChecks === 1;
+        return false;
       },
       installSignalCleanupFn: () => ({ uninstall() {} }),
     });
@@ -100,6 +100,7 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
     assert.deepEqual(errors, []);
     assert.equal(runtimeOptions[0].approvalMode, 'implicit');
     assert.equal(runtimeOptions[0].disallowDelegation, true);
+    assert.equal(runtimeOptions[0].autoWakeCompletions, false);
     assert.equal(runtimeOptions[0].toolMode, 'full');
     assert.deepEqual(activeScopes[0], {
       callerSessionId: 'sess_exec_test',
@@ -121,6 +122,58 @@ test('headless exec runs one implicit-approval session and waits for tracked tas
   }
 });
 
+test('headless exec drains tracked work and returns the completion follow-up answer', async () => {
+  const output = [];
+  const errors = [];
+  const prompts = [];
+  let active = true;
+  let notificationListener = null;
+  const code = await runHeadlessExec({
+    message: 'start the long task',
+    provider: 'openai-oauth',
+    model: 'gpt-test',
+    usageLogPath: '',
+    idlePollMs: 1,
+    write: (text) => output.push(text),
+    writeErr: (text) => errors.push(text),
+    boundaryFactory: () => ({
+      loadConfig: () => ({ providers: { 'openai-oauth': { enabled: true } } }),
+      cleanup() {},
+    }),
+    runtimeFactory: async () => ({
+      id: 'sess_headless_drain',
+      model: 'gpt-test',
+      clientHostPid: 123,
+      onNotification(listener) {
+        notificationListener = listener;
+        return () => { notificationListener = null; };
+      },
+      async ask(prompt) {
+        prompts.push(prompt);
+        if (prompts.length === 1) {
+          setTimeout(() => {
+            active = false;
+            notificationListener?.({
+              content: 'background task completed',
+              meta: { status: 'completed', execution_id: 'job_drain' },
+            });
+          }, 10);
+          return { result: { content: 'task started' } };
+        }
+        return { result: { content: 'final result' } };
+      },
+      async close() {},
+    }),
+    hasActiveTasks: () => active,
+    installSignalCleanupFn: () => ({ uninstall() {} }),
+  });
+
+  assert.equal(code, 0);
+  assert.deepEqual(errors, []);
+  assert.deepEqual(prompts, ['start the long task', '']);
+  assert.deepEqual(output, ['final result\n']);
+});
+
 test('headless exec emits a timestamped JSONL lifecycle and exact tool count', async () => {
   const root = mkdtempSync(join(tmpdir(), 'mixdog-headless-json-test-'));
   const usageLogPath = join(root, 'usage.json');
@@ -199,7 +252,7 @@ test('headless exec emits a timestamped JSONL lifecycle and exact tool count', a
           options.onToolPhaseCompleted({ iteration: 1, calls: 1, elapsedMs: 2 });
           notificationListener?.({
             content: 'background task completed',
-            meta: { status: 'completed' },
+            meta: { status: 'progress' },
           });
           options.onProviderSendStarted();
           options.onAssistantText('done');

package/src/rules/shared/01-tool.md

@@ -1,5 +1,7 @@
 # Tool Use
 
+- When an internal Mixdog rule conflicts with the user's latest explicit
+  request, follow the user's request.
 - Baseline routing assigns each facet directly by the evidence needed to
   determine the complete answer or edit:
   path/name only→`find`; wildcard/recursive paths→`glob` (including known-root

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -655,10 +655,10 @@ function guardRead(a) {
 }
 
 function guardShell(a) {
-    const allowed = new Set(['command', 'timeout_ms']);
+    const allowed = new Set(['command', 'timeout_ms', 'run_in_background']);
     const unsupported = Object.keys(a).find((key) => !allowed.has(key));
     if (unsupported) {
-        return `Error: shell arg "${unsupported}" is unsupported; use only command and timeout_ms`;
+        return `Error: shell arg "${unsupported}" is unsupported; use only command, timeout_ms, and run_in_background`;
     }
     if (!hasOwn(a, 'command')) {
         return 'Error: shell requires "command"';
@@ -672,6 +672,9 @@ function guardShell(a) {
     if (hasOwn(a, 'timeout_ms') && (typeof a.timeout_ms !== 'number' || !Number.isFinite(a.timeout_ms) || a.timeout_ms < 0)) {
         return `Error: shell arg "timeout_ms" must be a non-negative number (got ${describeType(a.timeout_ms)})`;
     }
+    if (hasOwn(a, 'run_in_background') && typeof a.run_in_background !== 'boolean') {
+        return `Error: shell arg "run_in_background" must be a boolean (got ${describeType(a.run_in_background)})`;
+    }
     return null;
 }
 

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -469,6 +469,10 @@ export async function executeBashTool(args, workDir, options = {}) {
     const _bgTasksDisabled = /^(1|true|yes|on)$/i.test(
         String(process.env.MIXDOG_SHELL_DISABLE_BACKGROUND_TASKS || '').trim(),
     );
+    const runInBackground = args.run_in_background === true;
+    if (runInBackground && _bgTasksDisabled) {
+        return formatShellToolFailure('background tasks are disabled for this process');
+    }
 
     let shellEffects;
     let combinedBashAbort = null;
@@ -603,6 +607,7 @@ export async function executeBashTool(args, workDir, options = {}) {
             timeoutMs: timeout,
             abortSignal: combinedBashAbort.signal,
             autoBackgroundMs,
+            startInBackground: runInBackground,
             // On a foreground timeout, promote the still-running child to a
             // tracked background job only when an explicit deadline has
             // remaining budget; omitted deadlines may stay unlimited.

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -14,6 +14,13 @@ const _shellSyntaxCheat =
 const _shellToolRouting = process.platform === 'win32'
     ? 'Use read, NOT cat/Get-Content/head/tail; list, NOT ls/dir; find/glob, NOT find; grep, NOT grep/rg/Select-String; edit/apply_patch, NOT sed/awk/heredocs/echo/Set-Content.'
     : 'Use read, NOT cat/head/tail; list, NOT ls; find/glob, NOT find; grep, NOT grep/rg; edit/apply_patch, NOT sed/awk/heredocs/echo.';
+// CC parity: when background tasks are disabled for this process, drop the
+// run_in_background field from the schema entirely so the model cannot burn a
+// failure turn attempting it. Mirrors bash-tool's runtime guard, which stays
+// as defense in depth. Process-stable env, evaluated once at module load.
+const _shellBackgroundDisabled = /^(1|true|yes|on)$/i.test(
+    String(process.env.MIXDOG_SHELL_DISABLE_BACKGROUND_TASKS || '').trim(),
+);
 
 export const BUILTIN_TOOLS = [
     {
@@ -77,7 +84,7 @@ export const BUILTIN_TOOLS = [
         name: 'shell',
         title: 'Shell',
         annotations: { title: 'Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: `Run programs, runtime/state operations, calculations, transformations, file generation, and unsupported-format inspection. Avoid file operations covered by dedicated tools unless explicitly instructed or after verifying that a dedicated tool cannot do the job. ${_shellToolRouting} Commands start in the foreground; after 15s, a still-running command continues as a tracked task_id and completes by notification.`,
+        description: `Run programs, runtime/state operations, calculations, transformations, file generation, and unsupported-format inspection. Avoid file operations covered by dedicated tools unless explicitly instructed or after verifying that a dedicated tool cannot do the job. ${_shellToolRouting} Commands start in the foreground${_shellBackgroundDisabled ? '' : ' unless run_in_background is true'}; after 15s, a still-running foreground command continues as a tracked task_id and completes by notification.`,
         inputSchema: {
             type: 'object',
             properties: {
@@ -87,6 +94,13 @@ export const BUILTIN_TOOLS = [
                     minimum: 0,
                     description: 'Hard total deadline in milliseconds; omit or use 0 to allow unlimited runtime after task promotion.',
                 },
+                ...(_shellBackgroundDisabled ? {} : {
+                    run_in_background: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Start as a tracked background task immediately; use only when the result is not needed for the next step — completion arrives by notification. Default false.',
+                    },
+                }),
             },
             required: ['command'],
             additionalProperties: false,

package/src/runtime/agent/orchestrator/tools/builtin/cache-layers.mjs

@@ -191,6 +191,7 @@ async function subscribeResultCacheInFlight(entry, signal) {
 
 export async function runResultCacheInFlight(key, compute, options = {}) {
     const subscriberSignal = options?.signal || options?.abortSignal || null;
+    let invalidationRetries = 0;
     for (;;) {
         const cached = cacheGet(key);
         if (cached !== null) return cached;
@@ -233,6 +234,13 @@ export async function runResultCacheInFlight(key, compute, options = {}) {
             // freshness retry, not a user-visible abort: start a new generation
             // unless this subscriber itself was cancelled.
             if (!entry.invalidated || subscriberSignal?.aborted) throw error;
+            // Continuous invalidation (watcher churn, eviction broadcasts)
+            // must not spin forever: after a few generations run the compute
+            // directly — uncached and no longer abortable by invalidation —
+            // mirroring the server-side MAX_WALK_RESTARTS cap.
+            if (++invalidationRetries >= 3) {
+                return await compute({ signal: subscriberSignal });
+            }
         }
     }
 }

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-pattern-fanout.mjs

@@ -11,6 +11,7 @@ import { runRgWindowedLines } from '../native-search-runner.mjs';
 import { statReachable } from '../fs-reachability.mjs';
 import { dedupeFanoutMatchLines, formatGrepOutput } from './grep-output.mjs';
 import { expandGrepAnchorContextOutput } from './grep-context-expander.mjs';
+import { markScopedCacheIncomplete } from '../../../session/cache/scoped-cache-outcome.mjs';
 
 export async function runGrepPatternFanout({
     args,
@@ -77,7 +78,9 @@ export async function runGrepPatternFanout({
             const pre = await runRgWindowedLines(
                 prefilterArgs,
                 { cwd: preSpawnCwd, signal: options.signal },
-                { offset: 0, limit: GREP_FANOUT_PREFILTER_FILE_CAP, summaryLimit: 0 },
+                // Speculative whole-scope pass: bulk lane keeps it from
+                // competing with interactive searches for disk bandwidth.
+                { offset: 0, limit: GREP_FANOUT_PREFILTER_FILE_CAP, summaryLimit: 0, bulkHint: true },
             );
             return pre.complete && !pre.partial ? pre.lines : null;
         } catch { return null; }
@@ -130,15 +133,34 @@ export async function runGrepPatternFanout({
         });
         const perPatternWindow = headLimit === Infinity ? 300 : (offset + headLimit + 4);
         const combinedCap = Math.min(4000, Math.max(400, perPatternWindow * patterns.length));
+        // Unfiltered multi-pattern directory scans are the broad-scope shape
+        // that saturated the interactive pool; route them to the bulk lane.
+        const combinedBulkHint = normalizedGlobPatterns.length === 0 && !fileType;
         let streamed;
         try {
             streamed = await runRgWindowedLines(
                 combinedArgs,
                 { cwd: rgCwd, signal: options.signal },
-                { offset: 0, limit: combinedCap, summaryLimit: 0 },
+                { offset: 0, limit: combinedCap, summaryLimit: 0, bulkHint: combinedBulkHint },
             );
         } catch { break combined; }
-        if (!streamed.complete || streamed.partial) break combined;
+        // Cap overflow (complete:false without partial) still falls back: the
+        // per-pattern rescan restores correct per-pattern windows. Timeout and
+        // scan-error partials keep their collected lines instead — the legacy
+        // fallback would rescan the same scope from scratch and usually time
+        // out again, discarding everything the first pass already found.
+        if (streamed.partial ? streamed.lines.length === 0 : !streamed.complete) break combined;
+        const combinedPartial = streamed.partial === true;
+        const combinedPartialSuffix = !combinedPartial
+            ? ''
+            : streamed.timeout
+                ? '\n[warning] rg timed out; partial results shown. Narrow path/glob/pattern for a complete result.'
+                : streamed.rgStderr
+                    ? `\n[warning] rg exit 2 (partial results): ${String(streamed.rgStderr).trim().slice(0, 300)}`
+                    : '\n[warning] rg exit 2 (partial results)';
+        if (combinedPartial && options?.scopedCacheOutcome) {
+            markScopedCacheIncomplete(options.scopedCacheOutcome);
+        }
         const adaptive = contextN > 0 && !(beforeN > 0) && !(afterN > 0);
         const byPattern = patterns.map(() => []);
         const residual = [];
@@ -175,7 +197,7 @@ export async function runGrepPatternFanout({
                     filenameOmitted: false,
                     headLimit,
                     offset,
-                    totalKnown: true,
+                    totalKnown: !combinedPartial,
                     requestedContext: contextN,
                     maxContext: GREP_AUTO_CONTEXT_LINES,
                     patterns: [p],
@@ -190,7 +212,7 @@ export async function runGrepPatternFanout({
                 body = formatGrepOutput({
                     windowed: windowedLines,
                     totalWindowed: post.length,
-                    totalKnown: true,
+                    totalKnown: !combinedPartial,
                     headLimit,
                     offset,
                     outputMode,
@@ -211,14 +233,15 @@ export async function runGrepPatternFanout({
             sections.push(`# grep pattern:${JSON.stringify(p)}\n${dedupeFanoutMatchLines(body, seenCombined)}`);
         }
         if (noMatchPatterns.length > 0) {
-            sections.push(`(no matches) pattern=${JSON.stringify(noMatchPatterns)} path=${searchPath}${globStr}; path exists`);
+            // Under a partial scan a zero-hit pattern is NOT a proven no-match.
+            sections.push(`(no matches${combinedPartial ? ' in partial results' : ''}) pattern=${JSON.stringify(noMatchPatterns)} path=${searchPath}${globStr}; path exists`);
         }
         if (residual.length > 0) {
             // Rust/JS regex divergence or --max-columns truncation left
             // matches no pattern claimed; surface them rather than drop.
             sections.push(`# grep (unattributed matches)\n${residual.slice(0, 40).join('\n')}`);
         }
-        return patternCapNote + sections.join('\n\n');
+        return patternCapNote + sections.join('\n\n') + combinedPartialSuffix;
     }
     // Prefilter result (started above, overlapped with the combined
     // attempt): when it completed under the cap, each per-pattern grep

package/src/runtime/agent/orchestrator/tools/builtin/lib/shell-job-records.mjs

@@ -33,7 +33,7 @@ function dataDir() {
         || join(process.env.MIXDOG_HOME || join(homedir(), '.mixdog'), 'data');
 }
 
-function pidAlive(pid) {
+export function pidAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0) return false;
     try { process.kill(pid, 0); return true; }
     catch (error) { return error?.code === 'EPERM'; } // EPERM = alive, not ours

package/src/runtime/agent/orchestrator/tools/builtin/native-search-client.mjs

@@ -194,6 +194,31 @@ function _teardown(error, { countFailure = true, detail = '' } = {}) {
   try { server.child.kill(); } catch {}
 }
 
+export async function shutdownNativeSearchServer(reason = 'process-exit', timeoutMs = 1_000) {
+  const server = _server;
+  if (!server) return true;
+  const child = server.child;
+  const exited = new Promise((resolve) => {
+    child.once('exit', () => resolve(true));
+    child.once('error', () => resolve(true));
+  });
+  try { child.stdin?.end?.(); } catch {}
+  _teardown(new Error(`native search server shutdown (${reason})`), { countFailure: false });
+  _warmPromise = null;
+  let timer;
+  const stopped = await Promise.race([
+    exited,
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(false), Math.max(10, Number(timeoutMs) || 1_000));
+    }),
+  ]);
+  if (timer) clearTimeout(timer);
+  if (!stopped) {
+    try { child.kill('SIGKILL'); } catch {}
+  }
+  return stopped;
+}
+
 export function _bindNativeSearchServerLifecycle(child, { onError, onExit } = {}) {
   if (!child?.on) return;
   child.on('error', onError);
@@ -541,6 +566,7 @@ export async function tryServeSearch(argsList, execOptions = {}, opts = {}) {
       : 0,
     deadlineMs: softDeadlineMs(remaining),
     keepWarm: opts.keepWarm === true,
+    ...(opts.bulkHint === true ? { bulkHint: true } : {}),
   });
   let response = await requestNativeWithRestart(buildRequest, execOptions, deadlineMs);
   // Deadline-swallow defense (binaries before the serve_search response-level

package/src/runtime/agent/orchestrator/tools/builtin/search-glob-tool.mjs

@@ -342,7 +342,20 @@ export async function executeGlobTool(args, workDir, options = {}) {
     const canWindowNatural = sortMode === 'natural' && headLimit !== Infinity;
     const groupRuns = await Promise.all(globGroups.map(async ([root, rels]) => {
         const rgArgs = ['--files', '--hidden'];
-        for (const ex of DEFAULT_IGNORE_GLOBS) rgArgs.push('--glob', ex);
+        // Explicit literal basenames (no glob magic in the final segment)
+        // name a concrete file: honor rg's later-glob-wins contract and let
+        // the lookup descend dependency-noise dirs, which the native walker
+        // would otherwise prune before the pattern could ever match. Wildcard
+        // basenames keep the noise prunes; device-name globs (no trailing
+        // /**) always apply.
+        const explicitBasenames = rels.length > 0 && rels.every((rel) => {
+            const base = String(rel).split('/').filter(Boolean).pop() || '';
+            return base !== '' && !hasGlobMagic(base);
+        });
+        for (const ex of DEFAULT_IGNORE_GLOBS) {
+            if (explicitBasenames && /^!\*\*\/[^/]+\/\*\*$/.test(ex)) continue;
+            rgArgs.push('--glob', ex);
+        }
         for (const ex of extraIgnoreGlobs) rgArgs.push('--glob', ex);
         for (const rel of rels) rgArgs.push('--glob', rel);
         const rgCwd = resolvedForSearchRoot(root);

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -1,8 +1,16 @@
 import os from 'node:os';
 import {
+    modelVisibleToolCompletionMessage,
     normalizeToolNotifyContext,
     notifyToolCompletion,
 } from '../../../../shared/tool-execution-contract.mjs';
+// Runtime-only bindings (used inside completion delivery, never at module
+// eval), so the static cycle through session/manager.mjs is safe — same
+// pattern as loop/tool-exec.mjs.
+import {
+    enqueuePendingMessage,
+    markCompletionEntry,
+} from '../../session/manager.mjs';
 import {
     completeBackgroundTask,
 } from '../../../../shared/background-tasks.mjs';
@@ -22,6 +30,8 @@ import {
 } from './lib/shell-job-insights.mjs';
 import {
     completeShellJobRecord,
+    listShellJobRecords,
+    pidAlive,
     publishShellJobRecord,
 } from './lib/shell-job-records.mjs';
 import {
@@ -86,7 +96,7 @@ function shellJobTaskStatus(status) {
     return 'failed';
 }
 
-function buildShellCompletion(jobId, detail) {
+export function buildShellCompletion(jobId, detail) {
     const startedAtMs = Date.parse(detail?.startedAt || '');
     const finishedAtMs = Date.parse(detail?.finishedAt || '') || Date.now();
     const elapsedMs = Number.isFinite(startedAtMs)
@@ -247,7 +257,12 @@ export function watchBackgroundShellJob(jobId, notifyCtx) {
             instruction: completion.instruction,
             terminalReason: 'shell-native-event',
         });
-        if (!completedTask && ctx && typeof ctx.notifyFn === 'function') {
+        if (!completedTask) {
+            // Delivery order: owner notifyFn when present, else the owner
+            // session's pending queue. A ctx-less finish (daemon restarted
+            // between job start and completion, or a watcher armed without a
+            // notify context) previously dropped the completion silently.
+            const owner = String(ctx?.callerSessionId || detail.ownerSessionId || '');
             notifyToolCompletion({
                 surface: 'shell',
                 id: jobId,
@@ -255,7 +270,19 @@ export function watchBackgroundShellJob(jobId, notifyCtx) {
                 text: completion.body,
                 resultType: 'shell_task_result',
                 instruction: completion.instruction,
-                context: ctx,
+                context: ctx || { callerSessionId: owner },
+                enqueueFallback: (sessionId, message, meta) => {
+                    let visible = modelVisibleToolCompletionMessage(message, meta);
+                    // Bodyless envelopes (a finished command with no output)
+                    // fail the persistence gate's result-body requirement;
+                    // retry with an explicit "(no output)" section rather
+                    // than dropping the completion.
+                    if (!visible && !/\n\s*\n/.test(String(message || ''))) {
+                        visible = modelVisibleToolCompletionMessage(`${message}\n\n(no output)`, meta);
+                    }
+                    if (!visible) return false;
+                    return enqueuePendingMessage(sessionId, markCompletionEntry(visible)) > 0;
+                },
                 logPrefix: 'shell-jobs',
             });
         }
@@ -287,6 +314,56 @@ export async function adoptForegroundShellJob({
     return native;
 }
 
+// Daemon-restart recovery: records left 'running' by a dead daemon can never
+// finish through the live watcher path — their completion (and output) used to
+// vanish silently. Finalize each dead-pid record and push one completion
+// notice to the owner session's pending queue. Content-addressed completion
+// ids keep multi-shard reconciliation idempotent.
+let _recoveredCompletionsReconciled = false;
+export async function reconcileRecoveredShellJobCompletions() {
+    if (_recoveredCompletionsReconciled) return 0;
+    _recoveredCompletionsReconciled = true;
+    let records = [];
+    try { records = await listShellJobRecords(); } catch { return 0; }
+    let notified = 0;
+    for (const record of records) {
+        if (!record || record.terminal) continue;
+        if (getNativeTask(record.jobId)) continue; // live in this daemon
+        if (pidAlive(Number(record.pid) || 0)) continue; // survived the restart
+        const detail = {
+            ...record,
+            status: 'failed',
+            error: 'daemon restarted while this shell task was running; its outcome was lost. Re-run the command if the result is still needed.',
+        };
+        try { await completeShellJobRecord(record.jobId, detail); } catch { /* best-effort */ }
+        const owner = String(record.ownerSessionId || '');
+        if (!owner) continue;
+        try {
+            const completion = buildShellCompletion(record.jobId, detail);
+            const delivered = notifyToolCompletion({
+                surface: 'shell',
+                id: record.jobId,
+                status: completion.taskStatus,
+                // The pending-queue persistence gate requires a blank-line
+                // separated result body; a bodyless bracketed envelope would
+                // be dropped. The restart notice IS the result here.
+                text: `${completion.body}\n\n${detail.error}`,
+                resultType: 'shell_task_result',
+                instruction: completion.instruction,
+                context: { callerSessionId: owner },
+                enqueueFallback: (sessionId, message, meta) => {
+                    const visible = modelVisibleToolCompletionMessage(message, meta);
+                    if (!visible) return false;
+                    return enqueuePendingMessage(sessionId, markCompletionEntry(visible)) > 0;
+                },
+                logPrefix: 'shell-jobs-recovery',
+            });
+            if (delivered) notified += 1;
+        } catch { /* best-effort */ }
+    }
+    return notified;
+}
+
 export async function shutdownShellJobs(_reason = 'runtime-close', { scope = null } = {}) {
     const scoped = Boolean(scope);
     const ownerSessionId = scoped ? String(scope.ownerSessionId || '') : '';

package/src/runtime/agent/orchestrator/tools/env-scrub.mjs

@@ -78,26 +78,10 @@ export function scrubLoaderVars(env) {
     return _continueScrubLoaderVars(env);
 }
 
-// Headless "web off" reaches shell children too: `mixdog exec` pins
-// MIXDOG_FEATURE_WEB_SEARCH=0 (default; --web-search opts back in) and every
-// model-spawned subprocess then receives the standard proxy variables pointed
-// at a dead loopback endpoint. curl/wget/git-http/pip/apt honor these and
-// fail fast on public hosts, while NO_PROXY keeps loopback traffic
-// (task-local servers) working. Raw-socket clients bypass proxy variables —
-// this is a uniform egress policy for the common tooling path, not a sandbox.
-// The runtime's own provider calls are unaffected: this mutates only the
-// child spawn env, never process.env.
-const SHELL_EGRESS_DEAD_PROXY = 'http://127.0.0.1:1';
-const SHELL_EGRESS_PROXY_VARS = ['HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'FTP_PROXY', 'RSYNC_PROXY'];
+// Web-search availability is independent from ordinary shell networking.
+// Keep this boundary explicit so disabling the search tool never blocks
+// package managers, source-control clients, or user-configured proxies.
 export function applyShellEgressPolicy(env) {
-    if (!env || typeof env !== 'object') return env;
-    if (String(process.env.MIXDOG_FEATURE_WEB_SEARCH ?? '') !== '0') return env;
-    for (const name of SHELL_EGRESS_PROXY_VARS) {
-        env[name] = SHELL_EGRESS_DEAD_PROXY;
-        env[name.toLowerCase()] = SHELL_EGRESS_DEAD_PROXY;
-    }
-    env.NO_PROXY = 'localhost,127.0.0.1,::1';
-    env.no_proxy = env.NO_PROXY;
     return env;
 }
 

package/src/runtime/agent/orchestrator/tools/env-scrub.test.mjs

@@ -0,0 +1,25 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { applyShellEgressPolicy } from './env-scrub.mjs';
+
+test('web-search disabled preserves ordinary shell network environment', () => {
+    const previous = process.env.MIXDOG_FEATURE_WEB_SEARCH;
+    process.env.MIXDOG_FEATURE_WEB_SEARCH = '0';
+    try {
+        const env = {
+            HTTP_PROXY: 'http://proxy.example:8080',
+            HTTPS_PROXY: 'http://proxy.example:8080',
+            NO_PROXY: 'localhost',
+        };
+        assert.equal(applyShellEgressPolicy(env), env);
+        assert.deepEqual(env, {
+            HTTP_PROXY: 'http://proxy.example:8080',
+            HTTPS_PROXY: 'http://proxy.example:8080',
+            NO_PROXY: 'localhost',
+        });
+    } finally {
+        if (previous === undefined) delete process.env.MIXDOG_FEATURE_WEB_SEARCH;
+        else process.env.MIXDOG_FEATURE_WEB_SEARCH = previous;
+    }
+});

package/src/runtime/agent/orchestrator/tools/graph-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.1.16",
+  "version": "0.1.17",
   "_comment": "Synced from immutable graph-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-darwin-arm64",
-      "sha256": "29ff99fd358759b78ddd2df4096e56e80e7302c7e2b173c5a851d3198ad39e29"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.17/mixdog-graph-darwin-arm64",
+      "sha256": "3b8850422ad267b45572ceef7993fb57c2b7b9c71cc4c026056335828a28a65a"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-darwin-x64",
-      "sha256": "c65ecd85d3d51b061972a10ee57eae0b1b6bd0a8760eb3c260e044c10d83bd60"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.17/mixdog-graph-darwin-x64",
+      "sha256": "0d793977ddd1d84851d1a9e3244415e7dc5b35f2f636a43f17af4745ea4485a8"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-linux-arm64",
-      "sha256": "4af49fb83e3f95230849c3c8c4a959f52053e81e317d038febc662ec3241fa53"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.17/mixdog-graph-linux-arm64",
+      "sha256": "036dcc5f16a5cfc72e95de198de8b5d2ad56d62e88677bb90222206624268a6a"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-linux-x64",
-      "sha256": "723efc22949442abe9c60733b78ad3f59ccf15778debbfb98efe167b2d8de506"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.17/mixdog-graph-linux-x64",
+      "sha256": "7bd4325dc1761f3fcf77cc8926a45e007f85d1b6954bfea819fafb6625635904"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.16/mixdog-graph-win32-x64.exe",
-      "sha256": "685914bc3e56c545e23c63fe236cf260c5784707720bc29d63431b923e00a83a"
+      "url": "https://github.com/tribgames/mixdog/releases/download/graph-v0.1.17/mixdog-graph-win32-x64.exe",
+      "sha256": "c0441052d0a09ddb3a3c291c7e7bffcf767dac9b6353e2f2e3e6954be2994712"
     }
   }
 }

package/src/runtime/agent/orchestrator/tools/lib/native-spawn-client.mjs

@@ -79,7 +79,7 @@ class LineStream extends EventEmitter {
 }
 
 export class NativeSpawnChild extends EventEmitter {
-  constructor(id, cancel) {
+  constructor(id, cancel, send = null) {
     super();
     this.pid = undefined;
     this.killed = false;
@@ -91,9 +91,27 @@ export class NativeSpawnChild extends EventEmitter {
     this.__nativeSpawn = true;
     this._id = id;
     this._cancel = cancel;
+    this._send = send;
     this._closed = false;
   }
 
+  // stdinPipe children only (warm shell standby): forward script text to the
+  // child's stdin via the spawn server. No-ops (false) when the child was
+  // spawned without stdinPipe or the server link is gone.
+  writeStdin(text, { close = false } = {}) {
+    if (this._closed || this.killed || typeof this._send !== 'function') return false;
+    return this._send({
+      stdinWrite: this._id,
+      data: String(text ?? ''),
+      ...(close ? { close: true } : {}),
+    });
+  }
+
+  endStdin() {
+    if (typeof this._send !== 'function') return false;
+    return this._send({ stdinClose: this._id });
+  }
+
   kill() {
     this.killed = true;
     this._cancel?.(this._id);
@@ -140,6 +158,28 @@ function _setServerReferenced(server, referenced) {
   try { server?.child?.stdout?.[method]?.(); } catch {}
 }
 
+// Referenced only while a NON-idle request is pending. Idle requests (parked
+// warm shell standbys) live for minutes-to-hours; counting them would pin the
+// host event loop — a one-shot CLI or test runner could never exit.
+function _recomputeServerRef(server) {
+  let active = false;
+  for (const entry of server.pending.values()) {
+    if (!entry.idle) { active = true; break; }
+  }
+  _setServerReferenced(server, active);
+}
+
+/** Mark a pending spawn request idle (parked) or active. Idle requests do not
+ *  keep the host process alive. Returns false when the request is gone. */
+export function setNativeSpawnRequestIdle(child, idle = true) {
+  const server = _server;
+  const entry = server?.pending?.get?.(Number(child?._id));
+  if (!entry) return false;
+  entry.idle = idle === true;
+  _recomputeServerRef(server);
+  return true;
+}
+
 function _teardown(error) {
   const server = _server;
   _server = null;
@@ -164,6 +204,30 @@ function _teardown(error) {
   try { server.child.kill(); } catch {}
 }
 
+export async function shutdownNativeSpawnServer(reason = 'process-exit', timeoutMs = 1_000) {
+  const server = _server;
+  if (!server) return true;
+  const child = server.child;
+  const exited = new Promise((resolve) => {
+    child.once('exit', () => resolve(true));
+    child.once('error', () => resolve(true));
+  });
+  try { child.stdin?.end?.(); } catch {}
+  _teardown(new Error(`native spawn server shutdown (${reason})`));
+  let timer;
+  const stopped = await Promise.race([
+    exited,
+    new Promise((resolve) => {
+      timer = setTimeout(() => resolve(false), Math.max(10, Number(timeoutMs) || 1_000));
+    }),
+  ]);
+  if (timer) clearTimeout(timer);
+  if (!stopped) {
+    try { child.kill('SIGKILL'); } catch {}
+  }
+  return stopped;
+}
+
 function _ensureServer() {
   if (_server) return _server;
   if (Date.now() - _lastFailureAt < RESTART_BACKOFF_MS) return null;
@@ -184,7 +248,10 @@ function _ensureServer() {
   lines.on('line', (line) => {
     let message;
     try { message = JSON.parse(line); } catch { return; }
-    if (message?.ready === true) return;
+    if (message?.ready === true) {
+      server.caps = (message.caps && typeof message.caps === 'object') ? message.caps : {};
+      return;
+    }
     if (String(message?.event || '').startsWith('task_')) acceptTask(message);
     const pending = server.pending.get(Number(message?.id));
     if (!pending) return;
@@ -227,6 +294,11 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
   const id = ++server.sequence;
   const fake = new NativeSpawnChild(id, (cancelId) => {
     try { server.child.stdin.write(`${JSON.stringify({ cancel: cancelId })}\n`); } catch {}
+  }, (payload) => {
+    try {
+      server.child.stdin.write(`${JSON.stringify({ id: ++server.sequence, ...payload })}\n`);
+      return true;
+    } catch { return false; }
   });
   const request = {
     id,
@@ -239,6 +311,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
     timeoutMs: Math.max(0, Number(spawnOptions.timeoutMs) || 0),
     outputLimit: Math.max(0, Number(spawnOptions.outputLimit) || 0),
     mergeStderr: spawnOptions.mergeStderr === true,
+    ...(spawnOptions.stdinPipe === true ? { stdinPipe: true } : {}),
     command: spawnOptions.command || undefined,
     shellType: spawnOptions.shellType || undefined,
     ownerSessionId: spawnOptions.ownerSessionId || undefined,
@@ -255,7 +328,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         fake.emit('error', err);
         fake.emit('close', 1, null);
       }
-      if (server.pending.size === 0) _setServerReferenced(server, false);
+      _recomputeServerRef(server);
     },
     onMessage(message) {
       const event = String(message?.event || '');
@@ -279,7 +352,7 @@ export function tryNativeSpawn({ shell, argv, spawnOptions = {}, cwd } = {}) {
         fake.signalCode = message.signal || null;
         fake._closed = true;
         fake.emit('close', fake.exitCode, fake.signalCode);
-        if (server.pending.size === 0) _setServerReferenced(server, false);
+        _recomputeServerRef(server);
       } else if (event === 'error') {
         const detail = String(message.message || 'native spawn failed');
         const err = new Error(message.code ? `${message.code}: ${detail}` : detail);
@@ -425,7 +498,7 @@ export function adoptNativeTaskByPid({
     const finish = (task, error = null) => {
       if (timer) clearTimeout(timer);
       server.pending.delete(id);
-      if (server.pending.size === 0) _setServerReferenced(server, false);
+      _recomputeServerRef(server);
       if (error) reject(error);
       else resolve(task);
     };
@@ -468,6 +541,15 @@ export function adoptNativeTaskByPid({
   });
 }
 
+// Capability handshake: true only after the connected spawn server announced
+// stdinPipe support in its ready line. An older binary silently ignores the
+// unknown stdinPipe field and gives the child a null stdin — a standby taken
+// in that state would run an EMPTY script and report exit 0 without ever
+// executing the command. Gate the warm-standby feature on this.
+export function nativeSpawnSupportsStdinPipe() {
+  return _server?.caps?.stdinPipe === true;
+}
+
 export function _resetNativeSpawnClientForTest() {
   _teardown(new Error('test reset'));
   _binaryPath = undefined;

package/src/runtime/agent/orchestrator/tools/lib/shell-warm-standby.mjs

@@ -0,0 +1,131 @@
+// Warm pwsh standby: one pre-spawned PowerShell per (shell path, env
+// signature) waits with a stdin-reading bootstrap. Taking it skips
+// CreateProcess + Defender scan (~300ms warm, ~1.8s cold) for the next shell
+// call; the script arrives via the spawn server's stdinWrite message and runs
+// with identical exit-code/stdout/stderr semantics. Any miss falls back to
+// the regular gated spawn. MIXDOG_SHELL_WARM_STANDBY=0 disables.
+import { createHash } from 'node:crypto';
+import { nativeSpawnSupportsStdinPipe, setNativeSpawnRequestIdle, tryNativeSpawn } from './native-spawn-client.mjs';
+import { SHELL_OUTPUT_DISK_CAP } from '../shell-exec-output.mjs';
+
+// Bootstrap: pre-warm scriptblock compilation while parked, re-decode stdin
+// as UTF-8 (console input encoding would mangle non-ASCII), then dot-source
+// the fed script so exit codes, $LASTEXITCODE and terminating errors behave
+// exactly like `-Command <script>`.
+const STANDBY_BOOTSTRAP = "$null = . ([scriptblock]::Create('$null')); [Console]::InputEncoding=[System.Text.UTF8Encoding]::new($false); . ([scriptblock]::Create([Console]::In.ReadToEnd()))";
+const STANDBY_ARGS = ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', STANDBY_BOOTSTRAP];
+const STANDBY_TTL_MS = 10 * 60_000;
+
+let _slot = null; // { native, shell, envSig, createdAt }
+
+function _disabled() {
+    return process.env.MIXDOG_SHELL_WARM_STANDBY === '0';
+}
+
+function envSignature(env) {
+    const entries = Object.entries(env || {})
+        .map(([key, value]) => `${key}=${value}`)
+        .sort()
+        .join('\n');
+    return createHash('sha256').update(entries).digest('hex');
+}
+
+function _slotAlive(slot) {
+    return Boolean(slot
+        && slot.native?.child
+        && slot.native.child.exitCode == null
+        && !slot.native.child.killed);
+}
+
+function psQuote(value) {
+    return String(value).replace(/'/g, "''");
+}
+
+/** Pre-spawn the next standby (fire-and-forget; a live one is kept). */
+export function ensureWarmShellStandby({ shell, env }) {
+    if (_disabled() || !shell) return;
+    // Old spawn binaries ignore stdinPipe (null stdin → instant-EOF standby
+    // that would ack commands without running them); require the handshake.
+    if (!nativeSpawnSupportsStdinPipe()) return;
+    if (_slotAlive(_slot)) return;
+    let native = null;
+    try {
+        native = tryNativeSpawn({
+            shell: String(shell),
+            argv: STANDBY_ARGS,
+            spawnOptions: {
+                env,
+                cwd: process.cwd(),
+                outputLimit: SHELL_OUTPUT_DISK_CAP,
+                stdinPipe: true,
+                shellType: 'powershell',
+                command: '(warm shell standby)',
+            },
+        });
+    } catch { native = null; }
+    if (!native?.child) return;
+    // Parked standby must not pin the host event loop (a one-shot CLI or test
+    // runner would otherwise never exit); reactivated at take time.
+    setNativeSpawnRequestIdle(native.child, true);
+    const slot = {
+        native,
+        shell: String(shell),
+        envSig: envSignature(env),
+        createdAt: Date.now(),
+    };
+    native.child.once('close', () => { if (_slot === slot) _slot = null; });
+    native.child.once('error', () => { if (_slot === slot) _slot = null; });
+    _slot = slot;
+}
+
+/** Take the parked standby for immediate use, or null on any mismatch.
+ *  Always refills so the NEXT call finds a warm one. */
+export function takeWarmShellStandby({ shell, env, cwd }) {
+    if (_disabled() || !shell) return null;
+    const slot = _slot;
+    const refill = () => { try { ensureWarmShellStandby({ shell, env }); } catch { /* best-effort */ } };
+    const usable = _slotAlive(slot)
+        && slot.shell === String(shell)
+        && typeof slot.native.child.writeStdin === 'function'
+        && Number.isFinite(slot.native.child.pid) && slot.native.child.pid > 0
+        && Date.now() - slot.createdAt <= STANDBY_TTL_MS
+        && slot.envSig === envSignature(env);
+    if (!usable) {
+        // Stale (TTL/env/shell drift): kill so it cannot linger; a still-
+        // warming slot (no pid yet) is left in place for a later call.
+        if (_slotAlive(slot) && Number.isFinite(slot.native.child.pid)
+            && (slot.shell !== String(shell)
+                || Date.now() - slot.createdAt > STANDBY_TTL_MS
+                || slot.envSig !== envSignature(env))) {
+            _slot = null;
+            try { slot.native.child.kill(); } catch { /* best-effort */ }
+        }
+        refill();
+        return null;
+    }
+    _slot = null;
+    // Back to active: the caller is about to run a real command on it and the
+    // host must stay alive until that command settles.
+    setNativeSpawnRequestIdle(slot.native.child, false);
+    refill();
+    const feed = (commandText, workDir) => {
+        // cwd prelude: the standby was spawned in the daemon cwd. Set-Location
+        // fixes $PWD and native-child working dirs; Environment.CurrentDirectory
+        // fixes .NET relative-path APIs.
+        const prelude = workDir
+            ? `Set-Location -LiteralPath '${psQuote(workDir)}'; [System.Environment]::CurrentDirectory = '${psQuote(workDir)}'; `
+            : '';
+        // Single atomic write+EOF: a separate close message can race ahead
+        // of the server's async write thread and feed an empty script.
+        slot.native.child.writeStdin(prelude + String(commandText ?? ''), { close: true });
+    };
+    return { spawned: slot.native, feed };
+}
+
+export function _resetWarmShellStandbyForTest() {
+    const slot = _slot;
+    _slot = null;
+    if (slot?.native?.child) {
+        try { slot.native.child.kill(); } catch { /* best-effort */ }
+    }
+}

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -24,6 +24,7 @@ import {
   extractPowerShellCommandInner,
 } from './shell-powershell.mjs';
 import { spawnShellWithRetry as _spawnShellWithRetry } from './lib/shell-spawn-retry.mjs';
+import { takeWarmShellStandby } from './lib/shell-warm-standby.mjs';
 
 export {
   _maybeEncodePowerShellCommand,
@@ -199,6 +200,7 @@ export function execShellCommand({
   timeoutMs,
   abortSignal,
   autoBackgroundMs,
+  startInBackground = false,
   onProgress,
   onOutputTail,
   clientHostPid,
@@ -340,11 +342,23 @@ export function execShellCommand({
         else pendingChildError = pendingChildError || err;
       };
       _onChildErrorRef = _onChildError;
+      // Warm-standby fast path (pwsh only): a pre-spawned bootstrap pwsh
+      // reads the script from stdin, skipping CreateProcess + Defender scan
+      // for this call. Any miss (env drift, TTL, dead/warming standby,
+      // MIXDOG_SHELL_WARM_STANDBY=0) falls through to the gated spawn below.
+      let _standby = null;
+      if (!_useDirectArgv && shellArg === '-Command') {
+        try { _standby = takeWarmShellStandby({ shell, env, cwd }); } catch { _standby = null; }
+      }
       // Spawn-burst gate: hold a 'process-spawn' slot only across process
       // creation (CreateProcess + AV scan + EPERM retries), released the
       // moment the child exists. Bounds the Defender convoy a shell burst
       // creates without limiting how many commands RUN concurrently — the
       // full-lifetime gating concern in the note below stays true.
+      let spawned = null;
+      if (_standby) {
+        spawned = _standby.spawned;
+      } else {
       const _releaseSpawnSlot = await acquireChildSpawnSlot(abortSignal || null, 'process-spawn', {
         ownerKey: ownerSessionId,
       });
@@ -355,7 +369,6 @@ export function execShellCommand({
         try { _releaseSpawnSlot(); } catch { /* idempotent */ }
         throw abortSignal.reason || new Error('aborted');
       }
-      let spawned;
       try {
         spawned = await _spawnShellWithRetry({
         shell,
@@ -378,8 +391,12 @@ export function execShellCommand({
       } finally {
         try { _releaseSpawnSlot(); } catch { /* idempotent */ }
       }
+      }
       child = spawned.child;
       spawned.adoptErrorHandler(_onChildError);
+      // Feed the standby only after the error handler is attached; server
+      // messages cannot be processed before this synchronous block yields.
+      if (_standby) _standby.feed(_spawnCommand, cwd);
     } catch (err) {
       const cleanupError = await releaseResourceLease();
       const spawnText = String((err && err.message) || err);
@@ -684,7 +701,9 @@ export function execShellCommand({
       const secs = Math.max(0, Math.round((Date.now() - _startMs) / 1000));
       const _verb = reason === 'timeout'
         ? `moved to background at timeout after ${secs}s`
-        : `auto-backgrounded after ${secs}s`;
+        : (reason === 'explicit'
+          ? 'started in background'
+          : `auto-backgrounded after ${secs}s`);
       resolveResult(
         new ExecResult({
           stdout,
@@ -795,7 +814,9 @@ export function execShellCommand({
     // Arm the auto-background timer only for the genuine foreground one-shot
     // path: a positive threshold strictly below the hard timeout, and not a
     // trailing-`&` background command (those already detach + settle on exit).
-    if (
+    if (startInBackground && !_isBackground) {
+      setImmediate(() => { fireAutoBackground({ reason: 'explicit' }); });
+    } else if (
       typeof autoBackgroundMs === 'number' &&
       autoBackgroundMs > 0 &&
       !_isBackground &&

package/src/runtime/agent/orchestrator/tools/spawn-manifest.json

@@ -1,26 +1,26 @@
 {
-  "version": "0.1.1",
+  "version": "0.1.2",
   "_comment": "Synced from immutable spawn-v release assets.",
   "assets": {
     "darwin-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.1/mixdog-spawn-darwin-arm64",
-      "sha256": "0f793fbacae03ded349ae7884fc1c6d9177378a9e3045706ea3ea0f4aa64a765"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.2/mixdog-spawn-darwin-arm64",
+      "sha256": "3c2eb5ecf47dccb4aeea113f422ede24f6dde22dceab7c9c77f6963ef9aded7d"
     },
     "darwin-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.1/mixdog-spawn-darwin-x64",
-      "sha256": "c654a9d55ebf679a39e4d9b53e776f9c2f43b3f362be8d719989d19f8901b06a"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.2/mixdog-spawn-darwin-x64",
+      "sha256": "7288b073b940d82b64e9e888e723ae95204a28472053676fb6650d5c68362836"
     },
     "linux-arm64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.1/mixdog-spawn-linux-arm64",
-      "sha256": "f9116f828428067e746edef3d39c300a91e0c1763ec1f38bf1471cc4912ab2c3"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.2/mixdog-spawn-linux-arm64",
+      "sha256": "308a53b7c9dbae5ce8c36dc98ab35ac869f0251671829cbdcb09162261b063bf"
     },
     "linux-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.1/mixdog-spawn-linux-x64",
-      "sha256": "565dddf81959fe73e4a8e973eaa24317862afcbde6ac84ef10cef6b893ef9fbc"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.2/mixdog-spawn-linux-x64",
+      "sha256": "9f619c17d13e2786e38a2a6017a5e9b1e2f88370132d2c0ff8ee80245b64d0c3"
     },
     "win32-x64": {
-      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.1/mixdog-spawn-win32-x64.exe",
-      "sha256": "1130ee6f47da4e11a644e5c56a6bc29a4887201bfd42a3df3ab0f50acb9abcb6"
+      "url": "https://github.com/tribgames/mixdog/releases/download/spawn-v0.1.2/mixdog-spawn-win32-x64.exe",
+      "sha256": "ee229f2ee2066b2c1a7c984b2ac4cd5bcfed5758173115de366defb1f97c7b51"
     }
   }
 }

package/src/runtime/memory/lib/query-handlers.mjs

@@ -40,6 +40,7 @@ import {
   hasTimelineIntent,
   hasVagueLatestWorkIntent,
   latestRecallSearchTerms,
+  latestRecallTopicTerms,
   mergeHistoricalRecallRows,
   preserveLatestConceptRows,
   prioritizeHistoricalRootEvidence,

package/src/session-runtime/lifecycle-api.mjs

@@ -47,7 +47,8 @@ export function createLifecycleApi(deps) {
     hooks, hookCommonPayload, mgr, statusRoutes, channels, agentTool, mcpClient,
     warmupTimers, prewarmTimers,
     flushAllConfigSavesAsync,
-    withTeardownDeadline, closePatchRuntimeIfLoaded, stopSelfUpdateBootCheck,
+    withTeardownDeadline, closePatchRuntimeIfLoaded, closeNativeToolTransports,
+    stopSelfUpdateBootCheck,
     createCurrentSession, refreshRouteEffort,
     invalidateContextStatusCache, invalidatePreSessionToolSurface,
     applyResolvedCwd, resolveRoute, applyDeferredToolSurface, getStandaloneTools,
@@ -328,11 +329,16 @@ export function createLifecycleApi(deps) {
           }))
           .catch(() => {})
         : null;
+      const nativeToolStop = isProcessExit
+        ? Promise.resolve(shellJobsStop)
+          .then(() => closeNativeToolTransports?.(reason))
+          .catch(() => {})
+        : null;
       if (detach) {
         try { await withTeardownDeadline(channelStop, 300, false); } catch {}
         try { await withTeardownDeadline(shellJobsStop, 300, false); } catch {}
         try { await withTeardownDeadline(memoryStop, 1500, false); } catch {}
-        for (const stop of [mcpStop, openaiWsStop, patchStop]) {
+        for (const stop of [mcpStop, openaiWsStop, patchStop, nativeToolStop]) {
           Promise.resolve(stop).catch(() => {});
         }
         onProcessExit();
@@ -345,6 +351,7 @@ export function createLifecycleApi(deps) {
         withTeardownDeadline(patchStop, 1500, false),
         withTeardownDeadline(memoryStop, 5500, false),
         withTeardownDeadline(shellJobsStop, 1500, false),
+        withTeardownDeadline(nativeToolStop, 1500, false),
       ]);
       onProcessExit();
       return ok;

package/src/session-runtime/prewarm.mjs

@@ -103,6 +103,15 @@ export function createPrewarmSchedulers({
       } catch (error) {
         bootProfile('tool-runtime:native-shell-failed', { error: error?.message || String(error) });
       }
+      try {
+        // Shell jobs orphaned by a daemon restart: finalize their records and
+        // deliver one completion notice to each owner session so the outcome
+        // is never silently dropped.
+        const { reconcileRecoveredShellJobCompletions } = await import('../runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs');
+        bootProfile('tool-runtime:shell-job-recovery', { notified: await reconcileRecoveredShellJobCompletions() });
+      } catch (error) {
+        bootProfile('tool-runtime:shell-job-recovery-failed', { error: error?.message || String(error) });
+      }
       try {
         const { prewarmTokenEstimator } = await import('../runtime/agent/orchestrator/session/context-utils.mjs');
         bootProfile('tool-runtime:token-estimator', { warmed: prewarmTokenEstimator() === true });

package/src/session-runtime/runtime-core.mjs

@@ -326,6 +326,7 @@ export async function createMixdogSessionRuntime({
   toolMode = 'full',
   approvalMode = null,
   disallowDelegation = false,
+  autoWakeCompletions = true,
   initialConfig = null,
   remote = false,
   desktopSession: initialDesktopSession = null,
@@ -510,6 +511,17 @@ export async function createMixdogSessionRuntime({
     }
   }
 
+  async function closeNativeToolTransports(reason = 'process-exit') {
+    const [spawnClient, searchClient] = await Promise.all([
+      import('../runtime/agent/orchestrator/tools/lib/native-spawn-client.mjs'),
+      import('../runtime/agent/orchestrator/tools/builtin/native-search-client.mjs'),
+    ]);
+    await Promise.allSettled([
+      spawnClient.shutdownNativeSpawnServer?.(reason),
+      searchClient.shutdownNativeSearchServer?.(reason),
+    ]);
+  }
+
   const configStartedAt = performance.now();
   rt.config = initialConfig && typeof initialConfig === 'object'
     ? initialConfig
@@ -726,7 +738,7 @@ export async function createMixdogSessionRuntime({
   } = createNotificationBus({
     listeners: notificationListeners,
     mgr,
-    onCompletionQueued: wakeQueuedCompletion,
+    onCompletionQueued: autoWakeCompletions ? wakeQueuedCompletion : null,
   });
   // Adopt a session as this runtime's identity wherever setSession is
   // injected (lifecycle resume, model-route swap, workflow swap, turn api).
@@ -1585,6 +1597,7 @@ export async function createMixdogSessionRuntime({
     flushAllConfigSavesAsync,
     withTeardownDeadline,
     closePatchRuntimeIfLoaded,
+    closeNativeToolTransports,
     stopSelfUpdateBootCheck: () => selfUpdate.stopBootCheck(),
     createCurrentSession,
     refreshRouteEffort,

package/src/session-runtime/tool-policy-surface.test.mjs

@@ -35,6 +35,10 @@ test('omitToolRoutes drops search and memory clauses independently', () => {
 test('shared tool rules omit disabled search and memory routes', () => {
   const pluginRoot = join(process.cwd(), 'src');
   const full = buildSharedToolContent({ PLUGIN_ROOT: pluginRoot });
+  assert.match(
+    full,
+    /^# Tool Use\s+- When an internal Mixdog rule conflicts with the user's latest explicit\s+request, follow the user's request\./,
+  );
   assert.match(full, /`search`/);
   assert.match(full, /`memory`/);
   const omitted = buildSharedToolContent({

package/src/standalone/channel-transport.mjs

@@ -365,6 +365,9 @@ export function createChannelTransport({
     return 'cancelled';
   }
 
+  let emptyFireBackoffMs = 0;
+  let nextEmptyFireAt = 0;
+
   function cancelGrace() {
     if (graceTimer) { try { clearTimeout(graceTimer); } catch {} graceTimer = null; }
   }
@@ -373,10 +376,18 @@ export function createChannelTransport({
     if (closed || graceTimer) return;
     if (!everHadClient || clients.size > 0) return;
     if (typeof onClientsEmpty !== 'function' || clientGraceMs <= 0) return;
+    // No-op-fire backoff: when onClientsEmpty() repeatedly declines to shut
+    // the daemon down (a session client is still alive on the other front
+    // door), the sweep would otherwise re-fire every grace period and spam
+    // the log with an elapsed→deferred pair for hours. Double the re-fire
+    // interval up to 10 minutes; any client registration resets it.
+    if (Date.now() < nextEmptyFireAt) return;
     graceTimer = setTimeout(() => {
       graceTimer = null;
       pruneDeadClients();
       if (clients.size > 0) return;
+      emptyFireBackoffMs = Math.min(Math.max(clientGraceMs, emptyFireBackoffMs * 2), 600_000);
+      nextEmptyFireAt = Date.now() + emptyFireBackoffMs;
       log(`client grace elapsed (${reason}); no live clients — self-shutdown`);
       try { onClientsEmpty(); } catch {}
     }, clientGraceMs);
@@ -553,6 +564,8 @@ export function createChannelTransport({
     }
     everHadClient = true;
     cancelGrace();
+    emptyFireBackoffMs = 0;
+    nextEmptyFireAt = 0;
     startSweep();
     log(`client registered token=${token} lead=${pid} cwd=${cwd || '-'}`);
     // The unified daemon starts the channels runtime (automation, webhooks,

package/src/standalone/daemon.mjs

@@ -309,6 +309,7 @@ async function shutdown(reason, code = 0) {
 
 /** One process, two front doors (channels + sessions): an idle side must never
  *  evict a busy one, so every self-shutdown trigger checks BOTH registries. */
+let _lastDeferredLog = { key: '', at: 0, suppressed: 0 };
 function maybeSelfShutdown(reason) {
   const channelClients = transport?.clientCount ?? 0;
   const sessionClients = sessionTransport?.clientCount ?? 0;
@@ -319,7 +320,19 @@ function maybeSelfShutdown(reason) {
       clearTimeout(shutdownRecheckTimer);
       shutdownRecheckTimer = null;
     }
-    log(`shutdown deferred (${reason}): channels=${channelClients} sessionClients=${sessionClients} remote=${remoteClients}`);
+    // Identical defers repeat for hours while one front door stays occupied;
+    // log the first occurrence, then one summary line per minute.
+    const deferKey = `${reason}|${channelClients}|${sessionClients}|${remoteClients}`;
+    const now = Date.now();
+    if (deferKey === _lastDeferredLog.key && now - _lastDeferredLog.at < 60_000) {
+      _lastDeferredLog.suppressed += 1;
+    } else {
+      const suffix = _lastDeferredLog.suppressed > 0
+        ? ` (+${_lastDeferredLog.suppressed} identical defers suppressed)`
+        : '';
+      log(`shutdown deferred (${reason}): channels=${channelClients} sessionClients=${sessionClients} remote=${remoteClients}${suffix}`);
+      _lastDeferredLog = { key: deferKey, at: now, suppressed: 0 };
+    }
     return;
   }
   const activeCalls = (transport?.activeCount ?? 0) + (sessionTransport?.activeCount ?? 0);