mixdog 0.9.174 → 1.0.0

package/src/headless-role.mjs

@@ -4,6 +4,7 @@ import {
   formatPristineExecutionAudit,
   validateExplicitPristineRoute,
 } from './runtime/shared/pristine-execution.mjs';
+import { BUNDLED_PATCH_MANIFEST_PATH } from './runtime/agent/orchestrator/tools/patch-manifest-path.mjs';
 import { installProcessSignalCleanup, waitWithTimeout } from './runtime/shared/process-shutdown.mjs';
 import { sleep } from './runtime/shared/sleep.mjs';
 import { clean } from './runtime/shared/clean.mjs';
@@ -42,7 +43,7 @@ async function buildAgentRunner(cwd, boundary) {
   // Import runtime/config modules only after MIXDOG_DATA_DIR and all behavioral
   // guards point at the ephemeral pristine boundary.
   const [{ createStandaloneAgent }, cfgMod, reg, mgr] = await Promise.all([
-    import('./standalone/agent-tool.mjs'),
+    import('./session-runtime/services/agent-tool.mjs'),
     import('./runtime/agent/orchestrator/config.mjs'),
     import('./runtime/agent/orchestrator/providers/registry.mjs'),
     import('./runtime/agent/orchestrator/session/manager.mjs'),
@@ -60,6 +61,69 @@ async function buildAgentRunner(cwd, boundary) {
   });
 }
 
+// One-shot memoized shutdown: close the agent, drain the trace, close native
+// patch servers, then remove the pristine boundary. Each step is time-boxed
+// against a shared deadline and failures never skip the later steps.
+function createRoleCleanup(run, { tag, context }) {
+  let cleanupPromise = null;
+  const shutdown = async () => {
+    const deadline = Date.now() + HEADLESS_SHUTDOWN_TIMEOUT_MS - HEADLESS_CLEANUP_RESERVE_MS;
+    const runCleanupStep = async (start, maxMs, label) => {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) return;
+      const budget = Math.min(maxMs, remaining);
+      // waitWithTimeout intentionally unrefs its timer. Keep this one-shot
+      // headless cleanup alive until the step settles or consumes its budget,
+      // otherwise an unresolved close can terminate Node before `finally`.
+      const keepAlive = setTimeout(() => {}, budget + 1);
+      try {
+        await waitWithTimeout(start(), budget, label);
+      } finally {
+        clearTimeout(keepAlive);
+      }
+    };
+    try {
+      if (run.agentRunner) {
+        await runCleanupStep(
+          () => run.agentRunner.execute({ type: 'close', tag }, context),
+          HEADLESS_CLOSE_TIMEOUT_MS,
+          'headless agent close'
+        );
+      }
+    } catch {
+      // Trace drain and boundary cleanup remain mandatory when close hangs.
+    }
+    try {
+      if (run.drainTrace) {
+        await runCleanupStep(run.drainTrace, HEADLESS_SHUTDOWN_TIMEOUT_MS, 'headless trace drain');
+      }
+    } catch {
+      // Telemetry must never block cleanup of the pristine boundary.
+    } finally {
+      try {
+        await runCleanupStep(
+          async () => {
+            const closeNativePatchServers = globalThis.__mixdogCloseNativePatchServers;
+            if (typeof closeNativePatchServers === 'function') {
+              await closeNativePatchServers();
+            }
+          },
+          HEADLESS_CLOSE_TIMEOUT_MS,
+          'headless native patch close'
+        );
+      } catch {
+        // The boundary cleanup below remains mandatory if native shutdown hangs.
+      } finally {
+        run.boundary?.cleanup();
+      }
+    }
+  };
+  return () => {
+    cleanupPromise ??= shutdown();
+    return cleanupPromise;
+  };
+}
+
 export async function runHeadlessRole({
   agent,
   message,
@@ -117,89 +181,38 @@ export async function runHeadlessRole({
     fast,
   });
 
-  let boundary = null;
-  let agentRunner = null;
   let signalCleanup = null;
-  let cleanupPromise = null;
-  let drainTrace = null;
   let taskId = null;
   let lastOutput = '';
-  const cleanup = (_reason = 'headless-exit') => {
-    if (cleanupPromise) return cleanupPromise;
-    cleanupPromise = (async () => {
-      const deadline = Date.now() + HEADLESS_SHUTDOWN_TIMEOUT_MS - HEADLESS_CLEANUP_RESERVE_MS;
-      const runCleanupStep = async (start, maxMs, label) => {
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) return;
-        const budget = Math.min(maxMs, remaining);
-        // waitWithTimeout intentionally unrefs its timer. Keep this one-shot
-        // headless cleanup alive until the step settles or consumes its budget,
-        // otherwise an unresolved close can terminate Node before `finally`.
-        const keepAlive = setTimeout(() => {}, budget + 1);
-        try {
-          await waitWithTimeout(start(), budget, label);
-        } finally {
-          clearTimeout(keepAlive);
-        }
-      };
-      try {
-        if (agentRunner) {
-          await runCleanupStep(
-            () => agentRunner.execute({ type: 'close', tag }, context),
-            HEADLESS_CLOSE_TIMEOUT_MS,
-            'headless agent close'
-          );
-        }
-      } catch {
-        // Trace drain and boundary cleanup remain mandatory when close hangs.
-      }
-      try {
-        if (drainTrace) {
-          await runCleanupStep(drainTrace, HEADLESS_SHUTDOWN_TIMEOUT_MS, 'headless trace drain');
-        }
-      } catch {
-        // Telemetry must never block cleanup of the pristine boundary.
-      } finally {
-        try {
-          await runCleanupStep(
-            async () => {
-              const closeNativePatchServers = globalThis.__mixdogCloseNativePatchServers;
-              if (typeof closeNativePatchServers === 'function') {
-                await closeNativePatchServers();
-              }
-            },
-            HEADLESS_CLOSE_TIMEOUT_MS,
-            'headless native patch close'
-          );
-        } catch {
-          // The boundary cleanup below remains mandatory if native shutdown hangs.
-        } finally {
-          boundary?.cleanup();
-        }
-      }
-    })();
-    return cleanupPromise;
-  };
+  // Live handles the shutdown path reads at cleanup time, not at creation.
+  const run = { boundary: null, agentRunner: null, drainTrace: null };
+  const cleanup = createRoleCleanup(run, { tag, context });
   try {
     try {
-      boundary = createPristineExecutionBoundary({ provider, model, effort, fast });
+      run.boundary = createPristineExecutionBoundary({
+        provider,
+        model,
+        effort,
+        fast,
+        patchManifestPath: BUNDLED_PATCH_MANIFEST_PATH,
+      });
     } catch (error) {
       writeErr(`mixdog: ${error?.message || error}\n`);
       return 1;
     }
-    writeErr(`${formatPristineExecutionAudit(boundary.audit)}\n`);
+    writeErr(`${formatPristineExecutionAudit(run.boundary.audit)}\n`);
     signalCleanup = installProcessSignalCleanup({
       name: 'mixdog-headless',
       timeoutMs: HEADLESS_SHUTDOWN_TIMEOUT_MS,
       cleanup,
     });
-    agentRunner = await agentRunnerFactory(cwd, boundary);
+    run.agentRunner = await agentRunnerFactory(cwd, run.boundary);
     try {
-      ({ drainAgentTrace: drainTrace } = await import('./runtime/agent/orchestrator/agent-trace.mjs'));
+      ({ drainAgentTrace: run.drainTrace } = await import('./runtime/agent/orchestrator/agent-trace.mjs'));
     } catch {
-      drainTrace = null;
+      run.drainTrace = null;
     }
-    const started = await agentRunner.execute(spawnArgs, context);
+    const started = await run.agentRunner.execute(spawnArgs, context);
     lastOutput = clean(started);
     taskId = taskIdFromOutput(started);
     if (!taskId) {
@@ -208,7 +221,7 @@ export async function runHeadlessRole({
     }
 
     for (;;) {
-      lastOutput = clean(await agentRunner.execute({ type: 'read', task_id: taskId }, context));
+      lastOutput = clean(await run.agentRunner.execute({ type: 'read', task_id: taskId }, context));
       if (TERMINAL_STATUS_RE.test(lastOutput)) break;
       await sleep(500);
     }

package/src/lib/keychain-cjs.cjs

@@ -69,7 +69,7 @@ function invalidateSecretCache(account) {
   _cacheInvalidate(account);
 }
 
-// CommonJS module: cannot import the ESM src/shared/wsl.mjs, so inline an
+// CommonJS module: cannot import the ESM src/runtime/shared/wsl.mjs, so inline an
 // equivalent WSL check (process.platform reports 'linux' inside WSL).
 function isWSL() {
   if (process.platform !== 'linux') return false;
@@ -124,7 +124,7 @@ function powershellEnv() {
   return env;
 }
 
-function powershell(script) {
+function powershell(script, input = null) {
   // Bound DPAPI PowerShell calls with a timeout: a hung powershell.exe
   // (AV scan stall, profile loader, transient cert chain lookup) would
   // otherwise block hook/server callers synchronously. The default is long
@@ -137,7 +137,11 @@ function powershell(script) {
   const exe = resolvePowershellExe();
   const profiled = /^(1|true|yes|on)$/i.test(String(process.env.MIXDOG_BOOT_PROFILE || ''));
   const startedAt = profiled ? Date.now() : 0;
-  const r = run(exe, ['-NonInteractive', '-NoProfile', '-Command', script], { timeout: POWERSHELL_TIMEOUT_MS });
+  const r = run(exe, ['-NonInteractive', '-NoProfile', '-Command', script], {
+    timeout: POWERSHELL_TIMEOUT_MS,
+    env: powershellEnv(),
+    ...(input == null ? {} : { input, stdio: ['pipe', 'pipe', 'pipe'] }),
+  });
   if (profiled) {
     const caller = (new Error().stack || '')
       .split('\n')
@@ -370,8 +374,7 @@ function linuxDelete(account) {
 const PS_PROTECT = [
   'Add-Type -AssemblyName System.Security -ErrorAction SilentlyContinue;',
   '[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;',
-  '$value = $args[0];',
-  '$bytes = [System.Text.Encoding]::UTF8.GetBytes($value);',
+  '$bytes = [Convert]::FromBase64String(([Console]::In.ReadToEnd()).Trim());',
   '$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser;',
   '$enc = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, $scope);',
   '[Convert]::ToBase64String($enc)',
@@ -475,10 +478,9 @@ function prewarmSecrets() {
 function win32Set(account, value) {
   const dir = secretsDir();
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  // Pass value as a PS argument via -Command inline to avoid shell injection;
-  // value is embedded as a PS single-quoted string literal with ' escaped.
-  const escaped = value.replace(/'/g, "''");
-  const r = powershell(`& { ${PS_PROTECT} } '${escaped}'`);
+  // The secret travels via stdin (base64 of UTF-8) so it never appears in the
+  // process argv or needs script-level quoting.
+  const r = powershell(`& { ${PS_PROTECT} }`, Buffer.from(value, 'utf8').toString('base64'));
   if (r.status !== 0) throw new Error(`[keychain] DPAPI encrypt failed (exit ${r.status}): ${r.stderr || r.stdout}`);
   const out = (r.stdout || '').trim();
   if (!out) throw new Error(`[keychain] DPAPI encrypt returned empty output (stderr: ${(r.stderr || '').trim()})`);
@@ -495,23 +497,22 @@ function win32Delete(account) {
 // Public API
 // ---------------------------------------------------------------------------
 
+const BACKENDS = {
+  darwin: { get: darwinGet, set: darwinSet, delete: darwinDelete },
+  linux: { get: linuxGet, set: linuxSet, delete: linuxDelete },
+  win32: { get: win32Get, set: win32Set, delete: win32Delete },
+};
+
+function backend() {
+  const selected = BACKENDS[platform()];
+  if (!selected) throw new Error(`[keychain] unsupported platform: ${process.platform}`);
+  return selected;
+}
+
 function getSecret(account) {
   const cached = _cacheGet(account);
   if (cached !== undefined) return cached;
-  let value;
-  switch (platform()) {
-    case 'darwin':
-      value = darwinGet(account);
-      break;
-    case 'linux':
-      value = linuxGet(account);
-      break;
-    case 'win32':
-      value = win32Get(account);
-      break;
-    default:
-      throw new Error(`[keychain] unsupported platform: ${process.platform}`);
-  }
+  const value = backend().get(account);
   _cacheSet(account, value);
   return value;
 }
@@ -529,19 +530,7 @@ function hasSecret(account) {
 
 function setSecret(account, value) {
   try {
-    switch (platform()) {
-      case 'darwin':
-        darwinSet(account, value);
-        break;
-      case 'linux':
-        linuxSet(account, value);
-        break;
-      case 'win32':
-        win32Set(account, value);
-        break;
-      default:
-        throw new Error(`[keychain] unsupported platform: ${process.platform}`);
-    }
+    backend().set(account, value);
   } finally {
     _cacheInvalidate(account);
   }
@@ -549,19 +538,7 @@ function setSecret(account, value) {
 
 function deleteSecret(account) {
   try {
-    switch (platform()) {
-      case 'darwin':
-        darwinDelete(account);
-        break;
-      case 'linux':
-        linuxDelete(account);
-        break;
-      case 'win32':
-        win32Delete(account);
-        break;
-      default:
-        throw new Error(`[keychain] unsupported platform: ${process.platform}`);
-    }
+    backend().delete(account);
   } finally {
     _cacheInvalidate(account);
   }

package/src/lib/mixdog-debug.cjs

@@ -164,7 +164,7 @@ function pruneStalePluginDataLogSiblings(
 
 const SESSION_START_CRITICAL_LOG = 'session-start-critical.log';
 const SESSION_START_CRITICAL_MAX_BYTES = 64 * 1024;
-const SESSION_START_CRITICAL_KEEP_BYTES = 64 * 1024;
+const SESSION_START_CRITICAL_KEEP_BYTES = 32 * 1024;
 
 function rotateBoundedLog(filePath, maxBytes, keepBytes) {
   try {

package/src/lib/rules-builder.cjs

@@ -23,7 +23,8 @@
  *   - output-styles/common.md        — shared built-in output composition policy
  *   - output-styles/<name>.md        — selected built-in depth variant or standalone user style
  *   - agent/AGENT.md                 — common agent contract: chain of command, handoff (BP3, all profiles)
- *   - agent/10..50-*.md              — per-hidden-agent bodies (consumed by loadScopedRoleInstructions)
+ *   - agent/4*-*.md                  — per-hidden-agent bodies (consumed by loadScopedRoleInstructions)
+ *   - routes/*.md                    — optional provider/model-scoped rules appended to BP1 (buildRouteRulesContent)
  *
  * Core memory snapshot is injected separately from the memory worker (pgdata)
  * (Lead only).
@@ -361,7 +362,7 @@ function buildRouteRulesContent({
   return omitToolRoutes(parts.join('\n'), omitTools, allowTools);
 }
 
-function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR: _DATA_DIR, includeLeadBrief = true }) {
+function buildLeadRoleContent({ PLUGIN_ROOT, includeLeadBrief = true }) {
   const RULES_DIR = path.join(PLUGIN_ROOT, 'rules');
   const lead = readOptional(path.join(RULES_DIR, 'lead', 'LEAD.md'));
   if (!lead) return '';
@@ -429,7 +430,7 @@ function buildAgentRoleContent({ PLUGIN_ROOT, profile = 'full' }) {
 }
 
 /**
- * BP2 role rules for narrow hidden retrieval roles. These roles already carry a separate
+ * BP3 role rules for narrow hidden retrieval roles. These roles already carry a separate
  * read-only tool schema shard, so keeping the full agent worker prefix does
  * not improve cross-role cache reuse and only adds unrelated shell/edit/git
  * guidance.

package/src/mixdog-session-runtime.mjs

@@ -2,11 +2,11 @@ export { createMixdogSessionRuntime } from './session-runtime/runtime-core.mjs';
 export {
   compactToolSearchDescription,
   defaultDeferredToolNames,
-} from './session-runtime/tool-catalog.mjs';
+} from './runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 export {
   SKILL_TOOL,
   TOOL_SEARCH_TOOL,
-} from './session-runtime/tool-defs.mjs';
+} from './runtime/agent/orchestrator/runtime-core/tool-defs.mjs';
 export {
   __renderToolSearchForTest,
   __saveModelSettingsForTest,

package/src/repl/slash-commands.mjs

@@ -2,7 +2,7 @@
  * repl/slash-commands.mjs — the REPL's `/command` table. Every command writes
  * to `ctx.out`; only `/exit` and `/quit` return 'exit'.
  */
-import { dim, green, red, yellow, colorEnabled } from '../ui/ansi.mjs';
+import { dim, green, red, yellow, colorEnabled } from '../runtime/shared/statusline/ansi.mjs';
 import { createSessionStats } from '../ui/session-stats.mjs';
 import { statuslineFor } from './turn-output.mjs';
 

package/src/repl/stream-sink.mjs

@@ -4,7 +4,7 @@
  * flags the tool cards and the final re-render depend on, and the erase used
  * to replace the raw stream with rendered markdown.
  */
-import { colorEnabled } from '../ui/ansi.mjs';
+import { colorEnabled } from '../runtime/shared/statusline/ansi.mjs';
 
 const STREAM_WRITE_BATCH_MS = 8;
 

package/src/repl/turn-output.mjs

@@ -3,12 +3,12 @@
  * markdown re-render of the streamed block (TTY only, text-only turns) and the
  * per-turn statusline footer.
  */
-import { colorEnabled } from '../ui/ansi.mjs';
+import { colorEnabled } from '../runtime/shared/statusline/ansi.mjs';
 import { buildStreamFinalPatch } from '../ui/stream-finalize.mjs';
 import { eraseStreamedBlock } from './stream-sink.mjs';
 
 /**
- * Approach (a): clear the raw streamed block and re-print as markdown. Only
+ * Clear the raw streamed block and re-print as markdown. Only
  * when we're on a TTY and actually streamed something — otherwise the raw text
  * already on screen is fine (and we must not emit cursor escapes into a pipe).
  */

package/src/repl.mjs

@@ -28,7 +28,7 @@ import { createInterface } from 'node:readline';
 import { stdin, stdout } from 'node:process';
 import { basename } from 'node:path';
 
-import { bold, dim, cyan, red, colorEnabled } from './ui/ansi.mjs';
+import { bold, dim, cyan, red, colorEnabled } from './runtime/shared/statusline/ansi.mjs';
 import { printHelp } from './help.mjs';
 import { createSessionStats, applyUsageDelta } from './ui/session-stats.mjs';
 import { createRuntimeHandle } from './repl/runtime-handle.mjs';

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch/session-prep.mjs

@@ -73,7 +73,7 @@ export function prepareDispatchSession({
   // resolveAgentSessionPermission (prepareAgentSession applies the same).
   const permission = resolveAgentSessionPermission(
     agent,
-    opts.permission ?? (isPoolC ? hidden?.permission || 'read' : null)
+    opts.permission ?? (isPoolC ? hidden.permission || 'read' : null)
   );
   // Pool C hidden-role instructions live in BP2 role-scoped context
   // (loaded by loadScopedRoleInstructions from rules/agent/*.md).

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -13,7 +13,7 @@
  *   ---   system#4  (unmarked) — volatile session/project environment
  *         (cacheTier:'env'); covered by the messages-tail BP so an
  *         environment change never invalidates the BP3 core write
- *   BP_4  messages  (1h public/hidden agents; Lead linked to autoClear,
+ *   BP_4  messages  (5m public/hidden agents; Lead linked to autoClear,
  *                    whose Anthropic default is 1h — see below) —
  *         sliding tool_result / prior user-text tail
  *
@@ -24,7 +24,7 @@
  *
  * Tier 3 gets its own BP because role/memory context is stable within the
  * session. The volatile environment block stays unmarked and rides the sliding
- * 1h messages BP, which also handles tool_result accumulation and per-call
+ * messages BP, which also handles tool_result accumulation and per-call
  * task/event data while isolating volatile text from stable prefix BPs.
  *
  * Non-breakpoint providers:
@@ -91,18 +91,23 @@ export function resolveLeadMessagesTtl(autoClear) {
  * BP1~3 stay at 1h: the system/role/tier3 prefix is shared across sessions
  * (pool-stable), so the 2x write premium is amortized cross-session and the
  * warm window survives per-session gaps. The volatile message tail (BP4) is
- * per-session, but the 2026-07-16 6.8h trace supports a 1h tail: 24/25 Lead
- * intra-session gaps over 5m were agent waits (5–27m), during which autoClear
- * correctly cannot fire; 32.7% of agent intra-session gaps exceeded 5m due to
- * long tool executions, with sessions surviving through reviewer fix-loop
- * reuse; and no gap over 1h was observed. Tail-cost simulation (input-token
- * equivalents) is Lead 1h=11.75M vs 5m=20.11M and agents 1h=14.46M vs
- * 5m=45.04M: misses that rewrite the accumulated tail dominate the 2x-vs-1.25x
- * write premium. Hidden and public-agent sessions therefore use a 1h tail.
+ * per-session.
  *
  * Lead sessions are linked to the user's autoClear idle-sweep config (see
  * resolveLeadMessagesTtl); its Anthropic default is 1h, while explicit
- * shorter overrides retain the shorter-sweep behavior.
+ * shorter overrides retain the shorter-sweep behavior. The 2026-07-16 6.8h
+ * trace supports the 1h Lead tail: 24/25 Lead intra-session gaps over 5m were
+ * agent waits (5–27m), during which autoClear correctly cannot fire, and no
+ * gap over 1h was observed (tail-cost simulation, input-token equivalents:
+ * 1h=11.75M vs 5m=20.11M).
+ *
+ * Hidden and public-agent sessions use a 5m tail. Replaying the usage
+ * ledger's Anthropic agent requests (2026-09-15..30, 25K requests) found 0.9%
+ * of intra-session gaps over 5m, and pre-send compaction rebuilds an agent
+ * transcript once its 5m tail has expired (compact-policy.mjs
+ * shouldCompactForExpiredAgentCache), so the cold request rewrites the
+ * compacted transcript instead of the whole accumulated tail. Replayed agent
+ * cost vs a 1h tail: -24.6% with that compaction, +2.7% without it.
  * (Tail TTL only affects explicit-breakpoint providers — Anthropic; no-op
  * elsewhere.)
  *
@@ -132,9 +137,10 @@ export function resolveCacheStrategy(agent, { autoClear } = {}) {
     return strategy;
   };
   if (getHiddenAgent(agent) || (agent && agent !== 'lead')) {
-    // Hidden and public agents keep the flat 1h tail — only the Lead
-    // session's tail is linked to autoClear.
-    return applyEnv({ tools: 'none', system: '1h', tier3: '1h', messages: '1h' });
+    // Hidden and public agents use a flat 5m tail that pre-send compaction
+    // rebuilds once it expires — only the Lead session's tail is linked to
+    // autoClear.
+    return applyEnv({ tools: 'none', system: '1h', tier3: '1h', messages: '5m' });
   }
   // Lead session (agent === 'lead', or no agent — raw/CLI callers default
   // to Lead behavior): message tail TTL is linked to autoClear (see
@@ -468,5 +474,3 @@ export function buildProviderCacheOpts(provider, _sessionId, agent, options = {}
   }
   return {};
 }
-
-// --- Helpers ---

package/src/runtime/agent/orchestrator/agent-runtime/session-builder.mjs

@@ -130,9 +130,6 @@ export function prepareAgentSession({
       model: runtimeSpec?.model || preset?.model || null,
       provider: runtimeSpec?.provider || preset?.provider || null,
       parentSessionId: parentSessionId || null,
-      permission: effectivePermission || null,
-      sourceName: sourceName || null,
-      cacheKeyOverride: cacheKeyOverride || null,
     });
   } catch {
     /* telemetry best-effort */

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -4,6 +4,7 @@ import { countJsonNextCalls } from './tools/next-call-utils.mjs';
 import { parseGrepContextHeader, splitGrepLinePrefix } from './tools/builtin/grep-formatting.mjs';
 import { isReadOnlyNavigationMiss } from './session/result-classification.mjs';
 import { nonNegativeInt } from '../../shared/numbers.mjs';
+import { isUserControlCancellation } from '../../shared/tool-status.mjs';
 import {
   appendAgentTrace,
   normalizeSessionId,
@@ -128,7 +129,7 @@ function traceAgentCompact({
 }
 
 const TOOL_ARG_KEYS = {
-  read: ['path', 'offset', 'limit', 'line', 'context'],
+  read: ['file_path', 'path', 'offset', 'limit', 'line', 'context'],
   grep: ['pattern', 'path', 'glob', 'output_mode', 'head_limit', 'offset'],
   glob: ['pattern', 'path', 'head_limit', 'offset', 'sort'],
   find: ['query', 'path', 'head_limit'],
@@ -155,6 +156,12 @@ const SECRET_ASSIGNMENT_RE = /((?:PASSWORD|SECRET|TOKEN|API_KEY|APIKEY)\s*=\s*)\
 const BEARER_HEADER_RE = /(Authorization:\s*Bearer\s+)\S+/gi;
 // URL query params carrying tokens/keys.
 const SECRET_QUERY_PARAM_RE = /([?&](?:token|api[-_]?key|access[-_]?token|auth|password|secret)=)[^&\s#]+/gi;
+// Long flags: --password <v> / --password=<v> (also --token, --secret, --api-key).
+const SECRET_LONG_FLAG_RE = /(--(?:password|token|secret|api[-_]?key)(?:\s+|=))\S+/gi;
+// Short -p <v> flag (mysql/psql/curl style).
+const SECRET_SHORT_FLAG_RE = /((?:^|\s)-p(?:\s+|=))\S+/g;
+// URL userinfo: scheme://user:secret@host -> scheme://user:[redacted]@host.
+const URL_USERINFO_RE = /(:\/\/[^:/\s@]+:)[^@\s]+(@)/g;
 // Redact shell `command` values that look like they carry secrets. Covers
 // assignment forms, Authorization headers, --password / -p flags, URL
 // userinfo and token query params. The shapes shared with log text are the
@@ -164,12 +171,9 @@ function _redactShellCommand(cmd) {
   let out = cmd;
   out = out.replace(SECRET_ASSIGNMENT_RE, REDACTED);
   out = out.replace(BEARER_HEADER_RE, REDACTED);
-  // Long flags: --password <v> / --password=<v> (also --token, --secret, --api-key).
-  out = out.replace(/(--(?:password|token|secret|api[-_]?key)(?:\s+|=))\S+/gi, '$1[redacted]');
-  // Short -p <v> flag (mysql/psql/curl style).
-  out = out.replace(/((?:^|\s)-p(?:\s+|=))\S+/g, '$1[redacted]');
-  // URL userinfo: scheme://user:secret@host -> scheme://user:[redacted]@host.
-  out = out.replace(/(:\/\/[^:/\s@]+:)[^@\s]+(@)/g, '$1[redacted]$2');
+  out = out.replace(SECRET_LONG_FLAG_RE, REDACTED);
+  out = out.replace(SECRET_SHORT_FLAG_RE, REDACTED);
+  out = out.replace(URL_USERINFO_RE, '$1[redacted]$2');
   out = out.replace(SECRET_QUERY_PARAM_RE, REDACTED);
   return out;
 }
@@ -208,12 +212,11 @@ function summarizeToolArgs(toolName, args) {
   for (const key of keys) {
     if (Object.hasOwn(args, key)) out[key] = compactTraceArgValue(args[key], key);
   }
-  for (const countKey of ['edits', 'writes']) {
+  // Arrays are clipped to 6 entries above; the count keeps batch-limit
+  // failures (more than 10 read/grep targets) diagnosable.
+  for (const countKey of ['edits', 'writes', 'file_path', 'path']) {
     if (Array.isArray(args[countKey])) out[`${countKey}_count`] = args[countKey].length;
   }
-  if (toolName === 'read' && Array.isArray(args.path)) {
-    out.path_count = args.path.length;
-  }
   return Object.keys(out).length ? out : null;
 }
 
@@ -240,6 +243,9 @@ function _redactLogText(text) {
   out = out.replace(BEARER_HEADER_RE, REDACTED);
   out = out.replace(SECRET_QUERY_PARAM_RE, REDACTED);
   out = out.replace(SECRET_ASSIGNMENT_RE, REDACTED);
+  out = out.replace(SECRET_LONG_FLAG_RE, REDACTED);
+  out = out.replace(SECRET_SHORT_FLAG_RE, REDACTED);
+  out = out.replace(URL_USERINFO_RE, '$1[redacted]$2');
   return out;
 }
 
@@ -408,17 +414,12 @@ function classifyToolFailure(resultText, toolName) {
   if (/\[tool-input-validation\]/.test(text)) return 'schema/args';
   // These are emitted validation/cancellation contracts, not keywords found
   // somewhere in a quoted document, command output, or error preview.
-  if (
-    /^(?:Browser command interrupted by local user input\.|computer_session_aborted: queued command was cancelled before execution|computer_user_control_active:)/i.test(
-      leading
-    )
-  )
-    return 'expected-cancellation';
+  if (isUserControlCancellation(leading)) return 'expected-cancellation';
   if (
     /^The arguments provided to `[^`]+` are invalid JSON and could not be parsed:/i.test(leading) ||
     /^new Goal tasks must omit ids; use updates for existing tasks$/i.test(leading) ||
     /^goal task exceeds \d+ characters$/i.test(leading) ||
-    /^goal (?:tasks|updates) support at most \d+ entries$/i.test(leading) ||
+    /^goal (?:tasks|updates) support at most \d+ entries(?:$|;)/i.test(leading) ||
     /^goal arguments contain unknown fields:/i.test(leading) ||
     /^Unsupported field for GitHub [\w.]+\.$/i.test(leading) ||
     /^browser action "[^"]+" (?:does not accept input field|requires input\.|accepts only one input target form|fields must be inside input:|input\.[^\n]*(?:must be|requires|accepts at most))/i.test(
@@ -593,6 +594,8 @@ function traceAgentTool({
   // `category`) so trace-level aggregation can exclude expected command
   // exits (`command-exit`) without joining tool-failures.jsonl.
   const errorCategory = resultKind === 'error' ? classifyToolFailure(resultText, toolName) : null;
+  const localSearch =
+    localSearchTelemetry && Object.keys(localSearchTelemetry).length > 0 ? { ...localSearchTelemetry } : null;
   // Flat shape — fields named exactly as the agent_calls PG columns so
   // insertAgentCalls can pick them up by direct property access without
   // a payload-unwrap step. result_kind has no column and rides as plain
@@ -617,8 +620,7 @@ function traceAgentTool({
     result_bytes_est: resultBytesEst,
     result_lines_est: resultLinesEst,
     grep_coverage: grepCoverage,
-    local_search:
-      localSearchTelemetry && Object.keys(localSearchTelemetry).length > 0 ? { ...localSearchTelemetry } : null,
+    local_search: localSearch,
     payload: {
       ...(summarizedTiming ? { timing: summarizedTiming } : {}),
       ...(toolBatchId ? { batch: { batch_id: toolBatchId, tool_call_id: toolCallId } } : {}),
@@ -653,8 +655,7 @@ function traceAgentTool({
         result_next_call_count: nextCallCount,
         result_bytes_est: resultBytesEst,
         result_lines_est: resultLinesEst,
-        local_search:
-          localSearchTelemetry && Object.keys(localSearchTelemetry).length > 0 ? { ...localSearchTelemetry } : null,
+        local_search: localSearch,
         cwd: cwd || null,
       },
     });

package/src/runtime/agent/orchestrator/context/skill-catalog.mjs

@@ -13,8 +13,8 @@ import {
 } from '../../../shared/skill-document.mjs';
 import { readSkillToolDependencies, skillToolDependenciesRoot } from '../../../shared/skill-tool-dependencies.mjs';
 import { loadConfig, normalizeSkillsConfig } from '../config.mjs';
-import { builtinFeatureActive, withGrandfatheredBuiltins } from '../../../../session-runtime/builtin-features.mjs';
-import { SKILL_TOOL } from '../../../../session-runtime/tool-defs.mjs';
+import { builtinFeatureActive, withGrandfatheredBuiltins } from '../runtime-core/builtin-features.mjs';
+import { SKILL_TOOL } from '../runtime-core/tool-defs.mjs';
 import { extensionScopesFromConfig, skillAllowedForCwd } from '../../../shared/extension-scopes.mjs';
 import { currentSkillContext, latestSkillBodies, skillMessageText } from './skill-state.mjs';
 import { compactPromptManifestText } from './deferred-tools.mjs';