mixdog 0.9.15 → 0.9.17

package/src/mixdog-session-runtime.mjs

@@ -3,6 +3,7 @@ import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { performance } from 'node:perf_hooks';
+import httpMod from 'node:http';
 import { ensureStandaloneEnvironment } from './standalone/seeds.mjs';
 import { createStandaloneAgent } from './standalone/agent-tool.mjs';
 import { isAgentOwner } from './runtime/agent/orchestrator/agent-owner.mjs';
@@ -167,6 +168,9 @@ import {
   normalizePluginMcpServerConfig,
   pluginManifest,
   pluginMcpServerName,
+  pluginRawMcpServers,
+  pluginMcpEnableScript,
+  resolveContainedPluginPath,
 } from './session-runtime/plugin-mcp.mjs';
 import {
   WORKFLOW_ROUTE_SLOTS,
@@ -395,6 +399,13 @@ export async function createMixdogSessionRuntime({
   ]);
   bootProfile('imports:ready', { ms: (performance.now() - importsStartedAt).toFixed(1) });
   const pluginDataDir = cfgMod.getPluginData();
+  // Re-wire the idle/tombstone sweep. startIdleCleanup() lost its caller in a
+  // refactor, so closed-session tombstones were never deleted after their 24h
+  // grace — the store grew unbounded (observed: 1.8k files / 114MB), which
+  // made summary-index rebuilds and per-save index rewrites stall boot for
+  // seconds. Timer is unref'd and first fires after CLEANUP_INITIAL_DELAY_MS
+  // (5min), so this adds zero boot-path cost.
+  try { mgr.startIdleCleanup?.(); } catch { /* cleanup is best-effort */ }
   const memoryRuntime = createStandaloneMemoryRuntime({
     entry: join(STANDALONE_ROOT, MEMORY_RUNTIME.replace(/^\.\//, '')),
     dataDir: pluginDataDir,
@@ -1531,11 +1542,48 @@ export async function createMixdogSessionRuntime({
     // published to active-instance.json by getMemoryModule().init(). Without
     // this, memory only starts on the first turn's getMemoryModule() call —
     // so early channel traffic finds no memory_port and gets buffered (or,
-    // pre-drainer, silently dropped). Fire-and-forget BEFORE channel claim so
-    // the port is (racing to be) live by the time the worker sends its first
-    // ingest.
-    try { void getMemoryModule().catch((error) => bootProfile('channels:memory-eager-init-failed', { error: error?.message || String(error) })); }
-    catch (error) { bootProfile('channels:memory-eager-init-failed', { error: error?.message || String(error) }); }
+    // pre-drainer, silently dropped). Runs BEFORE channel claim so the port is
+    // racing to be live by the time the worker sends its first ingest.
+    //
+    // Not fire-and-forget: init() only resolves the module handle, so a bare
+    // getMemoryModule() could return before /health reports ok — leaving early
+    // ingests to hit a not-yet-listening port. Await the proxy start() and then
+    // poll /health with a bounded retry so the daemon is provably reachable
+    // (or logged failed) rather than assumed-up. Still non-blocking to the
+    // caller: the whole probe is detached, but it internally awaits readiness.
+    void (async () => {
+      try {
+        // Yield one event-loop tick before the heavy chain below (module
+        // resolve, daemon fork/health-poll) starts, so Ink's next render
+        // (scheduled via setImmediate/timers) and any queued keypress
+        // events get a turn first instead of being starved by this
+        // detached chain's synchronous setup work.
+        await new Promise((r) => setImmediate(r));
+        const mod = await getMemoryModule();
+        const started = typeof mod?.start === 'function' ? await mod.start() : null;
+        const port = started?.port;
+        if (!port) { bootProfile('channels:memory-eager-init-failed', { error: 'no port from start()' }); return; }
+        for (let i = 0; i < 30; i++) {
+          try {
+            const ok = await new Promise((res) => {
+              const req = httpMod.request({ hostname: '127.0.0.1', port, path: '/health', timeout: 1500 }, (r) => {
+                let d = ''; r.on('data', (c) => { d += c; }); r.on('end', () => {
+                  try { res(JSON.parse(d)?.status === 'ok'); } catch { res(false); }
+                });
+              });
+              req.on('error', () => res(false));
+              req.on('timeout', () => { req.destroy(); res(false); });
+              req.end();
+            });
+            if (ok) { bootProfile('channels:memory-eager-init-ready', { port }); return; }
+          } catch {}
+          await new Promise((r) => setTimeout(r, 500));
+        }
+        bootProfile('channels:memory-eager-init-failed', { error: `health not ok after retries (port ${port})` });
+      } catch (error) {
+        bootProfile('channels:memory-eager-init-failed', { error: error?.message || String(error) });
+      }
+    })();
     // Publish this session's record + transcript file BEFORE the worker's
     // activate-time discovery polls, so output forwarding binds to this
     // terminal session immediately instead of waiting for the first turn.
@@ -1561,6 +1609,12 @@ export async function createMixdogSessionRuntime({
     }
     bootProfile('channels:start-scheduled', { delayMs: 0, immediate: true });
     void (async () => {
+      // Yield before the createCurrentSession/transcript/fork chain below —
+      // same rationale as the memory-eager-init yield above: this detached
+      // chain runs synchronous config/fs work (createCurrentSession, backend
+      // flush, transcript writer) back-to-back, and without a tick break it
+      // can run ahead of Ink's queued render/input handling.
+      await new Promise((r) => setImmediate(r));
       // Immediate-occupancy guarantee: make sure a session + transcript
       // exist BEFORE the worker boots — a freshly-forked worker claims and
       // runs transcript discovery inside its own start(), so publishing the
@@ -1640,8 +1694,38 @@ export async function createMixdogSessionRuntime({
   // channel; see startRemote()/stopRemote() and the `/remote` toggle.
   // `remote.autoStart` in mixdog-config.json makes every session claim remote
   // at boot (same force-takeover semantics as `mixdog --remote` / `/remote`).
-  if (!remoteEnabled && config?.remote?.autoStart === true) remoteEnabled = true;
-  if (remoteEnabled) startRemote();
+  // The flag lives in the TOP-LEVEL `remote` section of mixdog-config.json
+  // (sibling of agent/ui/channels), not inside the agent section that
+  // cfgMod.loadConfig returns — read it via the shared whole-file reader.
+  // `config?.remote?.autoStart` is kept for back-compat with agent-section
+  // placement.
+  if (!remoteEnabled) {
+    try {
+      if (config?.remote?.autoStart === true
+        || sharedCfgMod?.readSection?.('remote')?.autoStart === true) {
+        remoteEnabled = true;
+      }
+    } catch { /* unreadable config never blocks boot */ }
+  }
+  // Boot-time remote start (autoStart or --remote) is DEFERRED past the TUI's
+  // first frame. startRemote() front-loads heavy work — memory daemon fork
+  // (PG + forced ONNX embed warmup in the child), eager session create, and
+  // the channel-worker fork — and running it inline here interleaves that
+  // CPU/disk load with engine boot, visibly delaying the first ink frame by
+  // seconds. The deferred timer reuses prewarmTimers.channelStartTimer so an
+  // early /remote (startRemote clears it), stopRemote(), and close() all
+  // cancel it through the existing clearTimeout paths. Runtime /remote calls
+  // still start immediately (user-initiated, UI already painted).
+  if (remoteEnabled) {
+    const remoteAutoStartDelayMs = envDelayMs('MIXDOG_REMOTE_AUTOSTART_DELAY_MS', 1_500, { min: 0, max: 60_000 });
+    bootProfile('channels:autostart-deferred', { delayMs: remoteAutoStartDelayMs });
+    prewarmTimers.channelStartTimer = setTimeout(() => {
+      prewarmTimers.channelStartTimer = null;
+      if (closeRequested || !remoteEnabled) return;
+      startRemote();
+    }, remoteAutoStartDelayMs);
+    prewarmTimers.channelStartTimer.unref?.();
+  }
 
   function contextStatusCacheKeyFor({ messages, tools }) {
     const compaction = session?.compaction || {};
@@ -2769,19 +2853,17 @@ export async function createMixdogSessionRuntime({
     },
     async enablePluginMcp(plugin = {}) {
       const root = clean(plugin.root);
-      const script = clean(plugin.mcpScript);
+      const script = pluginMcpEnableScript(root, plugin);
       if (!root || !script) throw new Error('plugin has no MCP script');
       const serverName = pluginMcpServerName(plugin);
       const nextConfig = { ...config };
-      if (script === '.mcp.json') {
-        const mcpJsonPath = join(root, script);
-        if (!existsSync(mcpJsonPath)) throw new Error(`plugin MCP manifest not found: ${mcpJsonPath}`);
-        const manifest = readJsonSafe(mcpJsonPath) || {};
-        const rawServers = manifest.mcpServers;
-        const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-        if (!isPlainObject(rawServers)) throw new Error(`plugin .mcp.json missing mcpServers object: ${mcpJsonPath}`);
-        const keys = Object.keys(rawServers).filter((k) => isPlainObject(rawServers[k]));
-        if (!keys.length) throw new Error(`plugin .mcp.json has no mcpServers: ${mcpJsonPath}`);
+      const manifestMcp = pluginRawMcpServers(root, script);
+      if (manifestMcp) {
+        const { rawServers, mcpRoot } = manifestMcp;
+        const keys = Object.keys(rawServers).filter((k) => {
+          const v = rawServers[k];
+          return v !== null && typeof v === 'object' && !Array.isArray(v);
+        });
         const ownedPrefix = `${serverName}--`;
         const nextServers = {};
         for (const [k, v] of Object.entries(nextConfig.mcpServers || {})) {
@@ -2789,7 +2871,7 @@ export async function createMixdogSessionRuntime({
           nextServers[k] = v;
         }
         for (const serverKey of keys) {
-          const cfg = normalizePluginMcpServerConfig(rawServers[serverKey], root);
+          const cfg = normalizePluginMcpServerConfig(rawServers[serverKey], mcpRoot);
           cfg.env = {
             ...(cfg.env || {}),
             MIXDOG_PLUGIN_ROOT: root,
@@ -2800,8 +2882,8 @@ export async function createMixdogSessionRuntime({
         }
         nextConfig.mcpServers = nextServers;
       } else {
-        const scriptPath = join(root, script);
-        if (!existsSync(scriptPath)) throw new Error(`plugin MCP script not found: ${scriptPath}`);
+        const scriptPath = resolveContainedPluginPath(root, script);
+        if (!scriptPath || !existsSync(scriptPath)) throw new Error(`plugin MCP script not found: ${join(root, script)}`);
         nextConfig.mcpServers = {
           ...(nextConfig.mcpServers || {}),
           [serverName]: {

package/src/output-styles/simple.md

@@ -12,34 +12,32 @@ Practical concise — outcome-first handoffs for coding work: summarize the
 result, do not narrate or explain the change.
 
 - Open with the outcome in one sentence: done, blocked, or awaiting a decision.
-- Summarize at the concept level: name the behavior and direction, not the code
-  path. Cite a symbol/path only as an anchor, never as the explanation.
+- Summarize at the concept level: name the behavior and direction, not the
+  code path; cite a symbol/path only as an anchor, never as the explanation.
 - Compress by cutting content (filler, hedging, pleasantries, restated facts),
-  not by clipping grammar: keep natural, complete sentences in the user's
-  language — never telegraph-style stub endings. Technical terms and code stay
-  exact.
-- Summarize what the change accomplishes rather than listing every file and how
-  each was edited. Name a path (`file_path:line_number`) only when the reader
-  truly needs it to navigate — not as a per-file changelog.
-- Keep controlled detail: usually 1–3 short bullets or 2–3 sentences total.
-  State each point once — outcome or fix direction, not both restated. No
-  step-by-step narration or file/line inventory.
-- Size budget: roughly HALF the Default style and TWICE Minimal — per point one
-  rendered line, whole reply ~5–7 lines. Above that you are writing Default;
+  not grammar: keep natural, complete sentences in the user's language — never
+  telegraph-style stub endings. Technical terms and code stay exact.
+- Summarize what the change accomplishes, not a per-file changelog. Name a
+  path (`file_path:line_number`) only when the reader truly needs it to
+  navigate.
+- Controlled detail: usually 1–3 short bullets or 2–3 sentences total; state
+  each point once — outcome or fix direction, not both. No step-by-step
+  narration or file/line inventory.
+- Size budget: roughly HALF the Default style and TWICE Minimal — one rendered
+  line per point, whole reply ~5–7 lines. Above that you are writing Default;
   below ~3 lines consider whether prose (Minimal) reads better.
 - Layout: one idea per bullet, ONE line each (two only when a verbatim
-  path/error forces it). Lead each item with a short bold key phrase. Put a
-  blank line between multi-line list items — never emit a dense wall of text.
-- If a point runs past one line, cut the elaboration instead of wrapping; detail
-  beyond the key phrase + one clause belongs to the Default style.
-- On final handoffs, optional labels such as `바뀐 점`, `확인한 것`, and
-  `남은 리스크/다음 단계` fit Korean-facing profiles; use plain English labels
-  when the thread is English. Do not label interim progress.
+  path/error forces it), led with a short bold key phrase; blank line between
+  multi-line list items — never a dense wall of text. If a point runs past one
+  line, cut the elaboration — detail beyond key phrase + one clause belongs to
+  Default.
+- Final handoffs may use labels like `바뀐 점`, `확인한 것`,
+  `남은 리스크/다음 단계` for Korean-facing profiles (plain English labels in
+  English threads); do not label interim progress.
 - Synthesize agent or retrieval results; never forward raw reports, long file
   lists, tool traces, or session metadata.
-- Do not hide blockers, failed verification, or required follow-up; state them
-  in one short clause.
+- Do not hide blockers, failed verification, or required follow-up — state
+  them in one short clause; if verification was not run, say so once.
 - Keep paths, commands, symbols, API names, code, and exact errors verbatim.
-- Skip filler, acknowledgments, hedging, and repeated conclusions; if
-  verification was not run, say so once.
+- Skip filler, acknowledgments, hedging, and repeated conclusions.
 - Never name this style unless asked.

package/src/rules/agent/00-core.md

@@ -1,19 +1,20 @@
 # Agent Constraints
 
 - Use English for agent task communication.
-- NEVER PREAMBLE: no tool-call preambles, status/progress narration, "I
-  will..." setup, or transition text before tool calls.
-- If tools are needed, call them immediately. Emit text only for the final
-  handoff after tool work is done.
+- ONE TURN = ONE BATCH: emit all independent tool calls of a step in the same
+  turn; a lone read-only call that could have ridden the previous turn is a
+  wasted round-trip.
+- NEVER PREAMBLE: no status/progress narration, "I will..." setup, or any text
+  before tool calls — call needed tools immediately; emit text only for the
+  final handoff after tool work is done.
 - Final handoff: minimum characters, maximum information for Lead. Follow the
-  role's stricter output contract if defined; else emit fragments — outcome
-  (1 line), key `file:line`(s), verification result, material risks (only if
+  role's stricter output contract if defined; else fragments — outcome (1
+  line), key `file:line`(s), verification result, material risks (only if
   any).
-- Density over length: never repeat what Lead already knows (the brief, the
-  process, how you searched); state only what changed and where to look.
-  Verification = command + result in one line. Same fact twice = delete one.
-- Handoff cap ~30 lines unless `Deliver:` raises it — a safety ceiling, not
-  a target.
+- Never repeat what Lead already knows (the brief, the process, how you
+  searched); state only what changed and where to look. Verification =
+  command + result in one line. Same fact twice = delete one.
+- Handoff cap ~30 lines unless `Deliver:` raises it — a ceiling, not a target.
 - Banned as pure cost: report headings, markdown tables (unless requested),
   prose narration, raw logs/tool traces, speculative next-checks, restated
   brief, articles/politeness.

package/src/rules/agent/30-explorer.md

@@ -6,28 +6,29 @@ kind: retrieval
 
 # Role: explorer
 
-You are a one-shot locator, not a researcher. You find WHERE, never WHY —
-no understanding code, explaining behaviour, or tracing logic. Coordinates
-are the entire deliverable.
+Coordinate locator. Deliverable = WHERE as `path:line`, never WHY — no
+explaining or tracing. You ARE the `explore` tool: never call it; shared
+rules pointing at `explore` don't apply — use grep/code_graph/find/glob
+directly.
 
-Default shape: ONE maximal-batch turn, then the answer. Fire everything at
-once: a single `grep` whose pattern[] carries ALL literal strings/errors/
-identifier guesses — synonyms, casings, variants — plus `code_graph`/`find`/
-`glob` in the SAME turn when useful. Width is free, turns are not.
+Credibility is mechanical: hit = line/path contains ANY query token or
+obvious synonym. No other standard — "is this the real implementation" is
+the caller's question. Sole exception: a generic-word-only match (schema,
+handler, config, resolver…) with no SPECIFIC query token (product/library/
+domain name) = zero, not a hit.
 
-Answer straight from search output: hits already carry `path:line` — never
-spend a turn on `read` to confirm or polish an anchor. `dist`/generated
-hits are leads, not answers: trace them to source.
+Rule zero — after EVERY tool result: ≥1 `path:line` matching a query
+token → answer NOW with those coordinates; no verify, no re-grep, no
+ranking; mark weak anchors `?`. Zero → one more batch if budget remains.
+No third branch: "hits exist but I want better ones" IS branch one.
 
-Budget: 5 turns of maximal batches. Credible `path:line` on screen means the
-search is OVER — answer in that turn; no verifying or collecting extras;
-mark weak anchors `?`. Turns 2-5 exist ONLY for a zero-anchor turn 1: derive
-new tokens from returned paths/names or widen scope, packing ALL candidates
-into the next batch. Concept queries: grep implementation vocabulary
-(file/dir names, symbol fragments, config keys). `EXPLORATION_FAILED` only
-after all 5 turns found zero anchors — giving up early is as wrong as
-over-searching; at turn 5 answer best-so-far.
+Turns: 3 tool turns HARD max; start each tool message with `turn N/3`.
+Turn 1 → answer; turns 2-3 are miss-recovery only, and must change tokens
+OR scope — never reword. One turn = ONE batch of AT MOST 5 calls: a single
+grep packing ALL variants in pattern[] plus code_graph/find/glob; a 6th
+call = packing failure. Flow/how questions: return first matching entry
+anchors (≤5); the caller traces the chain.
 
-Answer format, nothing else:
-- up to 5 lines: `path:line — symbol/name — short reason` (append `?` if weak)
-- or `EXPLORATION_FAILED`
+Answer, nothing else: up to 5 lines `path:line — symbol — short reason`
+(`?` if weak), or `EXPLORATION_FAILED` — only after 3 turns of zero
+anchors, or when every anchor matches only generic words.

package/src/rules/lead/01-general.md

@@ -1,11 +1,11 @@
 # General
 
-- Omit direct names, honorifics, headings, and labels in preambles.
-- Preambles are optional: use only when they add user-visible value, keep to
-  one short sentence, skip routine lookup narration.
+- Preambles are optional: one short sentence only when it adds user-visible
+  value; no direct names, honorifics, headings, labels, or routine lookup
+  narration.
 - Destructive/hard-to-reverse actions require explicit confirmation.
-- Never push, build, or deploy without an explicit user request.
-  Implementation approval is not deploy approval.
-- Proactively handle what you can first rather than deferring to the user;
-  propose only the parts needing a decision, consultatively ("Shall we
-  proceed this way?").
+- Never push, build, or deploy without an explicit user request —
+  implementation approval is not deploy approval.
+- Handle what you can proactively rather than deferring to the user; propose
+  only the parts needing a decision, consultatively ("Shall we proceed this
+  way?").

package/src/rules/lead/lead-brief.md

@@ -1,21 +1,20 @@
 # Lead Brief Contract
 
 - Brief = one-line fragments `Goal:` `Anchors:` `Allow/Forbid:` `Deliver:`
-  `Verify:` (+`Stop:` heavy-worker). No role-known rules, background, or
-  motivation — minimum characters, maximum information.
-- Density over length: every line must carry information the agent cannot
-  know — never restate role rules, prior context, or the same fact twice.
-  A brief that feels long is a scope problem; split the scope, don't pad.
-- Anchors = `file:line` + one-line conclusion each. Never paste log/code
-  bodies; the agent reads the file itself.
-- Instruct by outcome ("make X behave Y"), not by method (no code snippets,
-  no step-by-step edits) unless the method IS the requirement.
+  `Verify:` (+`Stop:` heavy-worker). Minimum characters, maximum information:
+  no background/motivation, no role-known rules; never restate prior context
+  or the same fact twice. A brief that feels long is a scope problem — split
+  the scope, don't pad.
+- Anchors = `file:line` + one-line conclusion each; never paste log/code
+  bodies — the agent reads the file itself.
+- Instruct by outcome ("make X behave Y"), not method (no code snippets, no
+  step-by-step edits) unless the method IS the requirement.
 - `Deliver:` states output size/shape (e.g. "fragments <=15 lines", "verdict
-  + top-3 risks", "detail to file, path only"). Never request a long report
+  + top-3 risks", "detail to file, path only"); never request a long report
   in the handoff itself.
 - Full brief only on fresh spawn or `respawned: true` (dead-tag send = cold
-  session; re-supply anchors). Live-session follow-ups = delta only; never
-  restate Goal/rules.
+  session; re-supply anchors); live-session follow-ups = delta only, never
+  restating Goal/rules.
 - Never `send` mid-run; batch all adjustments into ONE follow-up after
   completion. Interrupt only to cancel.
 - All agent communication in English.

package/src/rules/shared/01-tool.md

@@ -4,18 +4,29 @@
   prior result — including edit loops: batch the post-edit verification read
   with the next target's lookup.
 - Pick by target: symbols/callers/deps → `code_graph`; exact text in a verified
-  scope → `grep`; unknown path/name → `find`; structure → `glob`; dirs →
-  `list`; verified file → `read`; broad unknown with no anchor → `explore`.
-  Never `grep`/`read` guessed paths.
-- One concept → one batched `grep pattern:[...]` with
-  `output_mode:"content_with_context"` (or one `code_graph symbols[]`). Refine
-  from returned paths; never repeat equivalent patterns or scopes.
-- On miss/error, normalize the target once and switch tool; on a plausible hit,
-  stop and answer from the framed context.
-- Retrieval serves the NEXT action (edit, answer, handoff), not certainty. One
-  anchor is enough to act on; re-reading/re-grepping an area seen this session
-  is waste. When acting and looking are both possible, act.
-- `read` uses `offset`/`limit` only. For 2+ spans from known file(s), make one
-  batched `read` with `{path,offset,limit}` region objects. Adjacent spans in
-  one file (within a few hundred lines) are ONE window, not repeated reads.
+  scope → `grep`; dirs → `list`; verified file → `read`.
+  Locating files: concept-level or cross-file questions ("where is X handled",
+  "how does Y flow") → `explore`, even when you could guess a keyword — its
+  fan-out spends explorer context, not yours, and guess-and-retry keywords
+  belong to it, not grep. Confident name fragment → `find`; exact name
+  pattern → `glob`; exact content literal → `grep`. Flow/trace with a known
+  symbol → `code_graph`, never `explore` — it returns entry-point anchors
+  only; follow the chain yourself. Never `grep`/`read` guessed paths.
+- One concept → ONE search call: all synonyms/variants in one
+  `grep pattern:[...]` (or `code_graph symbols[]`), scopes as `path[]`;
+  single-pattern bursts = packing failure. A second call on the same concept
+  is a defect unless the first returned zero — then change tokens or scope,
+  never reword.
+- Content-mode `grep` always carries `-C 5`+ ; re-reading the same file after
+  a content grep is a wasted round-trip. Bare match lines = existence checks
+  only.
+- Any path not returned by a tool this session is a guess: find first, then
+  grep/read the returned path. On ENOENT the next call is find on the
+  basename — never a second guess or the same path with changed args.
+- Retrieval serves the NEXT action (edit, answer, handoff), not certainty:
+  the FIRST anchor ends the search — no verifying, ranking, or re-checking a
+  hit already on screen. When acting and looking are both possible, act.
+- `read` uses `offset`/`limit` only; 2+ spans from known file(s) = ONE batched
+  `read` with `{path,offset,limit}` regions. Adjacent spans in one file
+  (within a few hundred lines) are ONE window, not repeated reads.
 - Don't mix `apply_patch` with shell or other state-changing calls in one turn.

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -207,12 +207,13 @@ function _redactLogText(text) {
 function classifyToolFailure(resultText, toolName) {
     const text = String(resultText ?? '').toLowerCase();
     if (/requires either|invalid arguments|unknown parameter|must be|schema|expected|required|old_string is .*>=/.test(text)) return 'schema/args';
-    if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/cwd';
+    if (/not in allow-list|not allowed/.test(text)) return 'permission';
+    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(String(resultText ?? ''))) return 'command-exit';
+    if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/enoent';
     if (/timed out|timeout|interrupted|aborted/.test(text)) return 'timeout/abort';
     if (/hunk rejected|patch failed|context mismatch|expected first old\/context|context not found/.test(text)) return 'patch/context';
-    if (/not in allow-list|permission|denied|forbidden|not allowed/.test(text)) return 'permission';
+    if (/permission|denied|forbidden/.test(text)) return 'permission';
     if (/unknown tool|tool.*not.*available|missing.*tool/.test(text)) return 'tool-surface';
-    if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(String(resultText ?? ''))) return 'command-exit';
     return 'runtime/failure';
 }
 

package/src/runtime/agent/orchestrator/config.mjs

@@ -149,7 +149,7 @@ function buildDefaultConfig(options = {}) {
     const providers = {};
     // API providers — enabled if env key exists
     for (const [name, envKey] of Object.entries(AGENT_PROVIDER_ENV)) {
-        const apiKey = process.env[envKey];
+        const apiKey = detectCredentials ? process.env[envKey] : undefined;
         providers[name] = {
             enabled: !!apiKey,
             apiKey: apiKey || undefined,

package/src/runtime/agent/orchestrator/providers/anthropic-effort.mjs

@@ -43,6 +43,15 @@ function parseClaudeVersion(model) {
     if (pair) {
         return { family: pair[1], major: Number(pair[2]), minor: null };
     }
+    // Legacy naming: version comes BEFORE the family (claude-3-7-sonnet,
+    // claude-3-5-sonnet, claude-3-opus). These are manual-thinking models —
+    // parse them so isLegacyAnthropicReasoningModel excludes them instead of
+    // letting modelSupportsEffort's `startsWith('claude-')` fallthrough grant
+    // them adaptive thinking + the effort beta (a hard 400).
+    const legacy = m.match(/^claude-(\d+)-(\d+)-(haiku|sonnet|opus)/);
+    if (legacy) {
+        return { family: legacy[3], major: Number(legacy[1]), minor: Number(legacy[2]) };
+    }
     return null;
 }
 
@@ -69,7 +78,17 @@ export function modelSupportsEffort(model) {
     if (m.includes('sonnet-5') || m.includes('fable-5')) return true;
     if (/^claude-opus-4-(6|7|8)(?:$|[-@])/.test(m)) return true;
     if (/^claude-opus-5-/.test(m)) return true;
-    if (m.startsWith('claude-')) return true;
+    // Fallthrough for not-yet-enumerated modern models: only grant effort when
+    // parseClaudeVersion resolves a family with major>=4 (and not a manual-
+    // thinking legacy already excluded above). A bare `startsWith('claude-')`
+    // here would hand thinking:adaptive + the effort beta to legacy/unknown
+    // IDs (e.g. claude-3-7-sonnet) → hard 400. Unknown-shape IDs (no version
+    // parsed) fall through to false: no effort, no adaptive thinking.
+    const parsed = parseClaudeVersion(model);
+    if (parsed && (parsed.family === 'sonnet' || parsed.family === 'opus' || parsed.family === 'fable')
+        && parsed.major >= 4) {
+        return true;
+    }
     return false;
 }
 
@@ -180,6 +199,19 @@ export function applyAnthropicEffortToBody(
                 : {};
             body.output_config = { ...existing, effort: normalized };
         }
+        // Adaptive-thinking models (4.6+) require `thinking:{type:"adaptive"}`
+        // rather than the legacy budget_tokens shape — sending
+        // `thinking:{type:"enabled"}` here 400s on sonnet-5/opus-4-7/4-8.
+        // display:"summarized" keeps reasoning blocks populated (4.7+ defaults
+        // to "omitted", silently hiding reasoning text). Gated on the same
+        // modelSupportsEffort() allowlist so older models never receive it.
+        // Set unconditionally (independent of `normalized`) so effort-capable
+        // turns always carry adaptive thinking + round-trip signatures.
+        body.thinking = { type: 'adaptive', display: 'summarized' };
+        // Adaptive/4.7+ models reject any non-default sampling param with a 400.
+        delete body.temperature;
+        delete body.top_p;
+        delete body.top_k;
         return;
     }
 

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -24,7 +24,7 @@ import {
     resolveAnthropicModelAfter404,
     ensureLatestAnthropicModel,
 } from './anthropic-model-resolve.mjs';
-import { sanitizeToolPairs, sanitizeAnthropicContentPairs } from '../session/context-utils.mjs';
+import { sanitizeToolPairs, sanitizeAnthropicContentPairs, foldUserTextIntoToolResultTail } from '../session/context-utils.mjs';
 import {
     TOKEN_REFRESH_SKEW_MS,
     resolveCliVersion,
@@ -303,6 +303,11 @@ function nativeAnthropicTools(opts) {
 }
 function deferredAnthropicTools(activeTools, opts) {
     if (opts?.session?.deferredNativeTools !== true) return [];
+    // A request whose ONLY tools are deferred is rejected by the API with
+    // `400: At least one tool must have defer_loading=false` — happens on the
+    // iteration-cap final turn (loop sends tools: [] to force a text answer).
+    // No active tools ⇒ send no deferred catalog either.
+    if (!Array.isArray(activeTools) || activeTools.length === 0) return [];
     const active = new Set((activeTools || []).map((tool) => String(tool?.name || '').trim()).filter(Boolean));
     const catalog = Array.isArray(opts.session.deferredToolCatalog) ? opts.session.deferredToolCatalog : [];
     return catalog
@@ -328,6 +333,15 @@ function toAnthropicMessages(messages) {
                 content = m.assistantBlocks.slice();
             } else {
                 content = [];
+                // Adaptive-thinking round-trip: prior-turn thinking blocks are
+                // REQUIRED back, unmodified (signature intact; empty thinking
+                // field allowed), and MUST precede tool_use blocks. Emit them
+                // first, verbatim as received from the SSE parser.
+                if (Array.isArray(m.thinkingBlocks)) {
+                    for (const tb of m.thinkingBlocks) {
+                        if (tb && typeof tb === 'object') content.push(tb);
+                    }
+                }
                 if (m.content) content.push({ type: 'text', text: m.content });
                 for (const tc of m.toolCalls) {
                     content.push({
@@ -362,6 +376,14 @@ function toAnthropicMessages(messages) {
             continue;
         }
 
+        // Claude Code parity: fold a user text turn that directly follows a
+        // tool_result turn into that tool_result's content. A sibling text
+        // turn after tool_result renders as `</function_results>\n\nHuman:`
+        // on the wire and trains the model toward 3-token empty end_turn
+        // completions (see foldUserTextIntoToolResultTail).
+        if (m.role === 'user' && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
+            continue;
+        }
         result.push({ role: m.role, content: normalizeContentForAnthropic(m.content) });
     }
     return sanitizeAnthropicContentPairs(result);
@@ -1055,6 +1077,14 @@ export class AnthropicOAuthProvider {
                     if (attemptIndex > 0 && firstAttemptError) {
                         try { firstAttemptError.midstreamRetries = attemptIndex; } catch {}
                         try { firstAttemptError.midstreamClassifier = firstAttemptClassifier; } catch {}
+                        // firstAttemptError is what actually propagates here when
+                        // live text was emitted this attempt — stamp the unsafe
+                        // flags onto IT too, else upstream sees an unmarked error
+                        // and retries, duplicating already-streamed output.
+                        try {
+                            firstAttemptError.liveTextEmitted = true;
+                            firstAttemptError.unsafeToRetry = true;
+                        } catch {}
                         throw firstAttemptError;
                     }
                     throw err;