mixdog 0.9.174 → 1.0.0

package/src/{ui → runtime/shared/statusline}/statusline-segments.mjs

@@ -1,5 +1,5 @@
 /**
- * src/ui/statusline-segments.mjs — filesystem-backed L2 segment sources.
+ * src/runtime/shared/statusline/statusline-segments.mjs — filesystem-backed L2 segment sources.
  *
  * The shell-jobs segment (owner-scoped job scan + liveness) and the
  * memory-cycle segment (daemon state file) each keep a 1s process-local
@@ -13,8 +13,8 @@ import { readdir, readFile, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { formatElapsed } from './statusline-format.mjs';
-import { positiveInt } from '../runtime/shared/numbers.mjs';
-import { isPidAlive } from '../runtime/shared/pid-liveness.mjs';
+import { positiveInt } from '../numbers.mjs';
+import { isPidAlive } from '../pid-liveness.mjs';
 
 const DEFAULT_MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
 const DEFAULT_STANDALONE_DATA_DIR = join(DEFAULT_MIXDOG_HOME, 'data');
@@ -126,34 +126,7 @@ async function refreshShellJobsStatus(ownerPid) {
       _shellJobsSegmentCache = { ownerPid, at: Date.now(), value };
       return;
     }
-    const done = new Set(names.filter((n) => n.endsWith('.done')).map((n) => n.slice(0, -5)));
-    const ownerByJob = new Map();
-    for (const n of names) {
-      const i = n.lastIndexOf('.owner-');
-      if (i > 0) {
-        const pid = positiveInt(n.slice(i + 7));
-        if (pid) ownerByJob.set(n.slice(0, i), pid);
-      }
-    }
-    const ids = names
-      .filter((n) => n.endsWith('.json'))
-      .map((n) => n.slice(0, -5))
-      // Session buckets are NOT pid-scoped. A desktop pane's background shell
-      // is published by the session SHARD that ran it, so the record's
-      // `.owner-<pid>` marker carries the shard pid while the desktop poller
-      // asks with its own host pid. The two never intersect, so every desktop
-      // background shell was missing from the agent+shell chip even though its
-      // record was on disk and correctly stamped with ownerSessionId. Session
-      // ids are globally unique (sess_daemon_<ts>_<uuid>), so bucketing by
-      // session needs no pid axis at all. The owner-wide aggregate below still
-      // honours the pid, keeping the CLI statusline and keep-awake counting
-      // only their own process.
-      .filter((id) => !done.has(id))
-      .sort((a, b) => jobStampMs(b) - jobStampMs(a))
-      // Scanning both scopes from one list doubles the worst-case window, so
-      // the per-refresh cap doubles with it; a live (non-.done) record set is
-      // a handful in practice and terminal ones age out on their own.
-      .slice(0, 60);
+    const { ids, ownerByJob } = listOpenShellJobs(names);
     let count = 0;
     let oldestMs = Infinity;
     const jobs = [];
@@ -198,25 +171,61 @@ async function refreshShellJobsStatus(ownerPid) {
     // A desktop pane's job lands in a session bucket while the owner-wide
     // count stays 0 (its publisher is a shard, not this host), so an empty
     // aggregate must NOT discard the session buckets.
-    if (count || bySession.size) {
-      const now = Date.now();
-      const elapsedLabel = Number.isFinite(oldestMs) ? formatElapsed(now - oldestMs) : '';
-      const sessions = {};
-      for (const [owner, bucket] of bySession) {
-        sessions[owner] = {
-          count: bucket.count,
-          elapsedLabel: Number.isFinite(bucket.oldestMs) ? formatElapsed(now - bucket.oldestMs) : '',
-          jobs: bucket.jobs,
-        };
-      }
-      value = { count, elapsedLabel, jobs, sessions };
-    }
+    if (count || bySession.size) value = summarizeShellJobs({ count, oldestMs, jobs, bySession });
   } catch {
     value = EMPTY_SHELL_JOBS;
   }
   _shellJobsSegmentCache = { ownerPid, at: Date.now(), value };
 }
 
+// Newest-first, capped ids of job records with no `.done` marker, plus the
+// `.owner-<pid>` marker map.
+function listOpenShellJobs(names) {
+  const done = new Set(names.filter((n) => n.endsWith('.done')).map((n) => n.slice(0, -5)));
+  const ownerByJob = new Map();
+  for (const n of names) {
+    const i = n.lastIndexOf('.owner-');
+    if (i > 0) {
+      const pid = positiveInt(n.slice(i + 7));
+      if (pid) ownerByJob.set(n.slice(0, i), pid);
+    }
+  }
+  const ids = names
+    .filter((n) => n.endsWith('.json'))
+    .map((n) => n.slice(0, -5))
+    // Session buckets are NOT pid-scoped. A desktop pane's background shell
+    // is published by the session SHARD that ran it, so the record's
+    // `.owner-<pid>` marker carries the shard pid while the desktop poller
+    // asks with its own host pid. The two never intersect, so every desktop
+    // background shell was missing from the agent+shell chip even though its
+    // record was on disk and correctly stamped with ownerSessionId. Session
+    // ids are globally unique (sess_daemon_<ts>_<uuid>), so bucketing by
+    // session needs no pid axis at all. The owner-wide aggregate still
+    // honours the pid, keeping the CLI statusline and keep-awake counting
+    // only their own process.
+    .filter((id) => !done.has(id))
+    .sort((a, b) => jobStampMs(b) - jobStampMs(a))
+    // Scanning both scopes from one list doubles the worst-case window, so
+    // the per-refresh cap doubles with it; a live (non-.done) record set is
+    // a handful in practice and terminal ones age out on their own.
+    .slice(0, 60);
+  return { ids, ownerByJob };
+}
+
+function summarizeShellJobs({ count, oldestMs, jobs, bySession }) {
+  const now = Date.now();
+  const elapsedLabel = Number.isFinite(oldestMs) ? formatElapsed(now - oldestMs) : '';
+  const sessions = {};
+  for (const [owner, bucket] of bySession) {
+    sessions[owner] = {
+      count: bucket.count,
+      elapsedLabel: Number.isFinite(bucket.oldestMs) ? formatElapsed(now - bucket.oldestMs) : '',
+      jobs: bucket.jobs,
+    };
+  }
+  return { count, elapsedLabel, jobs, sessions };
+}
+
 async function isShellJobAlive(detail, detailPath, dir, id) {
   const pid = positiveInt(detail?.pid);
   if (!pid) return false;
@@ -235,12 +244,7 @@ async function isShellJobAlive(detail, detailPath, dir, id) {
   } catch {
     return false;
   }
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    return e?.code === 'EPERM';
-  }
+  return isPidAlive(pid);
 }
 
 function jobStampMs(id) {

package/src/runtime/shared/tool-card-model/background-task.mjs

@@ -139,7 +139,7 @@ export function backgroundTaskFailureDetail(meta = {}, parsedArgs = {}) {
   return backgroundTaskFailureStatusLabel(status, error, { surface });
 }
 
-export function backgroundTaskDetail(meta = {}, elapsed = '', _parsedArgs = {}) {
+export function backgroundTaskDetail(meta = {}, elapsed = '') {
   const parts = [];
   const status = displayTerminalStatus(meta.status);
   if (status) parts.push(status);

package/src/runtime/shared/tool-card-model/card-detail.mjs

@@ -15,7 +15,7 @@ function toolArgPathOf(parsedArgs) {
 /** The completed detail of every non-shell tool, first match wins. */
 function nonShellDetail(base, surface, display, status, imageDetail) {
   const { pending, isError, elapsed } = base;
-  const { normalizedName, label, parsedArgs, isShellSurface } = surface;
+  const { normalizedName, label, isShellSurface } = surface;
   const { resultSummary, hasResult, firstResultLine } = display;
   const { agentDetail, agentCompletionDetail, backgroundElapsed, backgroundMetadataHeaderFailure } = status;
   const genericDetail =
@@ -24,7 +24,7 @@ function nonShellDetail(base, surface, display, status, imageDetail) {
       : '';
   const backgroundMetadataDetail =
     display.isBackgroundMetadataResult && !backgroundMetadataHeaderFailure
-      ? backgroundTaskDetail(display.backgroundMeta, backgroundElapsed, parsedArgs)
+      ? backgroundTaskDetail(display.backgroundMeta, backgroundElapsed)
       : '';
   const backgroundResponseDetail =
     display.isBackgroundResponse && resultSummary ? prefixElapsed(resultSummary, backgroundElapsed) : resultSummary;

package/src/runtime/shared/tool-card-model/card-status.mjs

@@ -8,7 +8,8 @@ import { agentTerminalDetail, isAgentTool } from './agent-surface.mjs';
 import { backgroundTaskElapsed, backgroundTaskFailureDetail, isBackgroundTaskTool } from './background-task.mjs';
 import { shellDisplayStatus } from './shell-surface.mjs';
 import { normalizeTerminalStatus, resultTerminalStatus, shellResultElapsed } from './terminal-status.mjs';
-import { gitResultError, gitResultExitCode } from './git-result.mjs';
+import { gitTerminalStatus } from './git-result.mjs';
+import { isUserControlCancellation } from '../tool-status.mjs';
 
 function shellFragments(base, display, isShellSurface) {
   if (!isShellSurface) return { shellStatus: '', shellElapsed: '' };
@@ -59,16 +60,17 @@ export function deriveCardStatus(base, { normalizedName, parsedArgs, isShellSurf
     !pending && isAgentTool(normalizedName) && !agentHeaderFailure
       ? agentTerminalDetail(parsedArgs?.status, isError, elapsed, parsedArgs?.error)
       : '';
-  const gitFailed =
-    normalizedName === 'git' &&
-    (gitResultExitCode(display.displayedResultText) !== null || Boolean(gitResultError(display.displayedResultText)));
-  const failedOrCompleted = isError || failedCount > 0 || gitFailed ? 'failed' : 'completed';
+  const gitStatus = normalizedName === 'git' ? gitTerminalStatus(display.displayedResultText) : '';
+  const failedOrCompleted = isError || failedCount > 0 ? 'failed' : 'completed';
   const terminalStatus = pending
     ? 'running'
     : shellStatus ||
+      gitStatus ||
       normalizeTerminalStatus(display.backgroundMeta?.status) ||
       normalizeTerminalStatus(parsedArgs?.status) ||
       resultTerminalStatus(display.displayedResultText) ||
+      // A one-line error body is hidden from display, so read the raw result.
+      (isUserControlCancellation(base.rt) ? 'cancelled' : '') ||
       failedOrCompleted;
   return {
     shellStatus,

package/src/runtime/shared/tool-card-model/git-result.mjs

@@ -1,3 +1,5 @@
+import { hasBenignExitOutcome } from '../tool-status.mjs';
+
 // Only command result headers, not arbitrary lines in a patch, carry exits.
 export function gitResultExitCode(text) {
   const match = /(?:^(?:## [^\n]+\n)?|\n## [^\n]+\n)exit ([1-9]\d*)\r?(?:\n|$)/.exec(String(text ?? ''));
@@ -7,3 +9,11 @@ export function gitResultExitCode(text) {
 export function gitResultError(text) {
   return /(?:^|\n)error: command failed: [^\n]+|^error: [^\n]+/.exec(String(text ?? ''))?.[0].trim() || '';
 }
+
+// A tool error fails the call; a git process that ran and exited non-zero is
+// a command exit, like the shell's, unless the tool marked the exit a signal.
+export function gitTerminalStatus(text) {
+  if (gitResultError(text)) return 'failed';
+  if (gitResultExitCode(text) !== null && !hasBenignExitOutcome(text)) return 'exit';
+  return '';
+}

package/src/runtime/shared/tool-card-model/terminal-status.mjs

@@ -2,11 +2,11 @@
  * terminal-status.mjs — terminal status words, their outcome tone, status
  * marker stripping and the ` · <time>` detail conventions.
  */
-import { normalizeToolTerminalStatus, toolResultTerminalStatus } from '../tool-status.mjs';
+import { leadingResultBlock, normalizeToolTerminalStatus, toolResultTerminalStatus } from '../tool-status.mjs';
 import { formatElapsed } from '../time-format.mjs';
 
 export function shellResultStatus(value) {
-  const match = String(value || '').match(
+  const match = leadingResultBlock(value).match(
     /(?:^|\b)status:\s*(running|pending|queued|completed|failed|cancelled|canceled)\b/im
   );
   return match ? String(match[1] || '').toLowerCase() : '';
@@ -48,6 +48,7 @@ const TERMINAL_STATUS_LABELS = new Map([
   ['cancelled', 'Cancelled'],
   ['denied', 'Denied'],
 ]);
+const BARE_STATUS_WORDS = new Set([...TERMINAL_STATUS_LABELS.values()].map((label) => label.toLowerCase()));
 
 export function displayTerminalStatus(value) {
   // 'exit' is a shell-only pseudo-status (command RAN but exited non-zero); it
@@ -107,5 +108,8 @@ export function mergeTerminalDetail(status, detail = '') {
   if (label === 'Finished' && text) return text;
   if (!text) return label;
   if (text.toLowerCase().startsWith(label.toLowerCase())) return text;
+  // A bare status word (the generic "Failed" of an error without a body) is
+  // superseded by the resolved status, e.g. a user-takeover "Cancelled".
+  if (BARE_STATUS_WORDS.has(text.toLowerCase())) return label;
   return `${label} · ${text}`;
 }

package/src/runtime/shared/tool-card-model.golden-cases.mjs

@@ -16,7 +16,8 @@ export const GIT_GOLDEN_CASES = [
     summary: 'diff --git a/a.txt b/a.txt',
     status: 'completed',
   },
-  { result: 'exit 128\nfatal: missing ref\n', summary: 'Exit 128', status: 'failed' },
+  { result: 'exit 128\nfatal: missing ref\n', summary: 'Exit 128', status: 'exit' },
+  { result: 'exit 1\n[outcome: no-match]\ndiff --git a/a.txt b/a.txt\n', summary: 'Exit 1', status: 'completed' },
   {
     result: '## git show missing\nexit 128\nfatal: missing\nerror: command failed: git show missing',
     summary: 'Exit 128',

package/src/runtime/shared/tool-output-limit.mjs

@@ -0,0 +1,60 @@
+// Single source of truth for the model-facing tool-output byte budget.
+// read / shell / list-tree all truncate their output to this cap so the
+// context cost of any one tool call is bounded and consistent. Override with
+// MIXDOG_TOOL_OUTPUT_MAX_BYTES. Line-based sub-caps (e.g. bash max lines) stay
+// per-tool; this governs only the byte budget.
+// A positive integer from an env var, or `fallback` when unset or invalid.
+export function positiveEnvInt(name, fallback) {
+  const v = parseInt(process.env[name], 10);
+  return Number.isFinite(v) && v > 0 ? v : fallback;
+}
+export const TOOL_OUTPUT_MAX_BYTES = positiveEnvInt('MIXDOG_TOOL_OUTPUT_MAX_BYTES', 50 * 1024);
+export const LOCATOR_OUTPUT_MAX_BYTES = positiveEnvInt('MIXDOG_LOCATOR_OUTPUT_MAX_BYTES', 20 * 1024);
+// grep results stay in context for the rest of the session. 2026-09-28 cost
+// audit: only 6% of greps capped at 10KB were paged, so carrying the tail cost
+// more than the follow-up turns it saved.
+export const GREP_OUTPUT_MAX_BYTES = positiveEnvInt('MIXDOG_GREP_OUTPUT_MAX_BYTES', 5 * 1024);
+export const CODE_GRAPH_OUTPUT_MAX_BYTES = positiveEnvInt('MIXDOG_CODE_GRAPH_OUTPUT_MAX_BYTES', 30 * 1024);
+// recall/memory search returns model-facing prose blocks; uncapped multi-query
+// browses were observed injecting 42KB in one call (2026-08-05 audit). Same
+// class as locators: 20KB with a factual continuation footer.
+export const RECALL_OUTPUT_MAX_BYTES = positiveEnvInt('MIXDOG_RECALL_OUTPUT_MAX_BYTES', 20 * 1024);
+
+function _prefixByBytes(value, maxBytes) {
+  const text = String(value || '');
+  let lo = 0;
+  let hi = text.length;
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (Buffer.byteLength(text.slice(0, mid), 'utf8') <= maxBytes) lo = mid;
+    else hi = mid - 1;
+  }
+  return text.slice(0, lo);
+}
+
+// Preserve complete leading rows and replace the omitted tail with a
+// tool-specific continuation. Unlike the generic middle truncator this keeps
+// locator/graph output structurally usable and byte-accurate.
+export function capLineOrientedToolOutput(result, maxBytes, footerForPrefix) {
+  if (typeof result !== 'string' || !(Number(maxBytes) > 0)) return result;
+  const cap = Math.trunc(Number(maxBytes));
+  if (Buffer.byteLength(result, 'utf8') <= cap) return result;
+  const lines = result.split(/\r?\n/);
+  let lo = 0;
+  let hi = lines.length;
+  let best = '';
+  while (lo <= hi) {
+    const mid = Math.floor((lo + hi) / 2);
+    const kept = lines.slice(0, mid);
+    const footer = String(footerForPrefix?.(kept, lines) || '... [output budget reached; remainder omitted]');
+    const candidate = `${kept.join('\n')}${kept.length ? '\n' : ''}${footer}`;
+    if (Buffer.byteLength(candidate, 'utf8') <= cap) {
+      best = candidate;
+      lo = mid + 1;
+    } else {
+      hi = mid - 1;
+    }
+  }
+  if (best) return best;
+  return _prefixByBytes(String(footerForPrefix?.([], lines) || '... [output budget reached; remainder omitted]'), cap);
+}

package/src/runtime/shared/tool-primitives.mjs

@@ -1,4 +1,4 @@
-import { displayModelName as sharedDisplayModelName } from '../../ui/model-display.mjs';
+import { displayModelName as sharedDisplayModelName } from './model-display.mjs';
 
 // Default cap for tool-arg summaries (header parenthetical, channel tool lines).
 // Unified at 80 so every tool surface line — header arg summary and collapsed

package/src/runtime/shared/tool-result-summary.mjs

@@ -312,6 +312,7 @@ function summarizeLineCount({ text, trimmed }, { zero, singular, plural }) {
 function summarizeReadResult({ text, trimmed }) {
   if (/^\[image:/i.test(trimmed)) return 'Image';
   if (!trimmed) return null;
+  if (trimmed.startsWith('(no lines in range')) return '0 lines';
   const n = text.split('\n').length;
   return `${n} ${pluralize(n, 'line')}`;
 }

package/src/runtime/shared/tool-status.mjs

@@ -23,15 +23,48 @@ export function normalizeToolTerminalStatus(value) {
   return '';
 }
 
+// Status markers live in the result's leading block: the cancel marker, the
+// shell exit header, a background-task header, a task/agent status line.
+// Command output and fetched documents follow a blank line and can carry
+// `status:` text of their own, which says nothing about the tool call.
+export function leadingResultBlock(text) {
+  const lines = String(text || '').split('\n');
+  let index = 0;
+  if (/^\[tool output offloaded:/i.test(String(lines[0] || '').trim())) {
+    index = 1;
+    while (index < lines.length && !lines[index].trim()) index += 1;
+  }
+  const block = [];
+  for (; index < lines.length && lines[index].trim(); index += 1) block.push(lines[index]);
+  return block.join('\n');
+}
+
+// The user taking over the browser/desktop, or the session cancelling a
+// computer command, stops the call on purpose; it is not a failed invocation.
+const USER_CONTROL_CANCELLATION_RE =
+  /^(?:Error:\s*)?(?:Browser command interrupted by local user input\.|computer_session_aborted:|computer_user_control_active:)/i;
+
+export function isUserControlCancellation(text) {
+  return USER_CONTROL_CANCELLATION_RE.test(String(text || '').trimStart());
+}
+
+// A non-zero exit the tool itself marked as a signal (search no-match, a
+// `git diff --exit-code` difference) rather than a command failure.
+export function hasBenignExitOutcome(text) {
+  return /^\[outcome:\s*(?:no-match|no-change)\]\s*$/im.test(String(text || ''));
+}
+
 export function toolResultTerminalStatus(text) {
   const body = String(text || '');
   const tagged = body.match(/<status[^>]*>([\s\S]*?)<\/status>/i)?.[1]?.trim();
   if (tagged) return normalizeToolTerminalStatus(tagged);
-  const bracketed = body.match(/^\[status:\s*([^\]]*)\]/im)?.[1]?.trim();
+  const head = leadingResultBlock(body);
+  const bracketed = head.match(/^\[status:\s*([^\]]*)\]/im)?.[1]?.trim();
   if (bracketed) return normalizeToolTerminalStatus(bracketed);
-  const inline = body.match(/^(?:status|state):\s*([^\s·,;]+)/im)?.[1]?.trim();
+  const inline = head.match(/^(?:status|state):\s*([^\s·,;]+)/im)?.[1]?.trim();
   const fromInline = normalizeToolTerminalStatus(inline);
   if (fromInline) return fromInline;
+  if (isUserControlCancellation(body)) return 'cancelled';
   // Bare control bodies written on cancel/crash (current + legacy).
   const trimmed = body.trim();
   if (/^(?:cancelled|canceled)$/i.test(trimmed)) return 'cancelled';

package/src/runtime/shared/transcript-metadata.mjs

@@ -1,7 +1,7 @@
 // Transcript route identity is separate from the human-readable model label.
 // These pure helpers keep live rows, persisted messages and restored rows on
 // the same field contract without rewriting older display-only transcripts.
-import { displayModelName } from '../../ui/model-display.mjs';
+import { displayModelName } from './model-display.mjs';
 
 export function transcriptRouteMetadataFields(value) {
   if (!value || typeof value !== 'object') return {};

package/src/runtime/shared/transcript-writer/transcript-file.mjs

@@ -6,8 +6,7 @@
 import { existsSync, mkdirSync, statSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
-// Canonical project-slug mapping for `<mixdogHome>/projects/<slug>` transcript
-// dirs (originally shared with the retired channel session-discovery).
+// Canonical project-slug mapping for `<mixdogHome>/projects/<slug>` transcript dirs.
 export function cwdToProjectSlug(cwd) {
   return resolve(cwd)
     .replace(/\\/g, '/')

package/src/runtime/shared/turn-snapshot-store.mjs

@@ -18,7 +18,6 @@ import { join } from 'node:path';
 import { cleanString as clean } from './clean.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
-const DATA_DIR = resolvePluginData();
 const RECORD_VERSION = 1;
 // Matches the shadow repository's own `gc --prune` window: once the tree object
 // is collected the record cannot restore anything anyway.
@@ -32,7 +31,12 @@ const MAX_SESSION_SCOPES = 8;
 // A bounded directory: one file per session, oldest swept first.
 const MAX_RECORD_FILES = 512;
 
-let recordRoot = join(DATA_DIR, 'turn-snapshots');
+// Test override; otherwise resolved per call because the pristine-execution
+// boundary retargets MIXDOG_DATA_DIR at runtime.
+let recordRootOverride = '';
+function recordRoot() {
+  return recordRootOverride || join(resolvePluginData(), 'turn-snapshots');
+}
 // Per-session write chain. Two turns of one session never race their own file,
 // and a read never observes a partially written record (writes land by rename).
 const writeChains = new Map();
@@ -43,6 +47,16 @@ function rootKey(value) {
   return process.platform === 'win32' ? root.toLowerCase() : root;
 }
 
+// Fold a turn's files into an existing scope: session-owned paths keep the
+// baseline they first recorded, and every tool-mutated path joins the owned set.
+function mergeScopeFiles(scope, baselineFiles, toolFiles) {
+  const owned = new Set([...scope.toolFiles].map(rootKey));
+  for (const file of baselineFiles) {
+    if (!owned.has(rootKey(file.path))) scope.baselineFiles.set(rootKey(file.path), file);
+  }
+  for (const file of toolFiles) scope.toolFiles.add(file);
+}
+
 function sessionScopes(record) {
   const scopes = [];
   const add = (entry) => {
@@ -54,11 +68,7 @@ function sessionScopes(record) {
     const files = (Array.isArray(entry?.toolFiles) ? entry.toolFiles : []).map((value) => clean(value)).filter(Boolean);
     const baselineFiles = Array.isArray(entry?.baselineFiles) ? entry.baselineFiles : [];
     if (existing) {
-      const owned = new Set([...existing.toolFiles].map(rootKey));
-      for (const file of baselineFiles) {
-        if (!owned.has(rootKey(file.path))) existing.baselineFiles.set(rootKey(file.path), file);
-      }
-      for (const file of files) existing.toolFiles.add(file);
+      mergeScopeFiles(existing, baselineFiles, files);
       existing.updatedAt = Math.max(existing.updatedAt, Number(entry?.updatedAt) || 0);
       return;
     }
@@ -94,7 +104,7 @@ function serializeScope(entry) {
 
 function recordPath(sessionId) {
   const hash = createHash('sha256').update(sessionId).digest('hex').slice(0, 24);
-  return join(recordRoot, `${hash}.json`);
+  return join(recordRoot(), `${hash}.json`);
 }
 
 function chain(sessionId, task) {
@@ -126,12 +136,12 @@ async function sweepRecords() {
   if (sweepDone) return;
   sweepDone = true;
   try {
-    const names = await readdir(recordRoot);
+    const names = await readdir(recordRoot());
     const now = Date.now();
     const kept = [];
     for (const name of names) {
       if (!name.endsWith('.json')) continue;
-      const path = join(recordRoot, name);
+      const path = join(recordRoot(), name);
       try {
         const info = await stat(path);
         if (now - info.mtimeMs > RECORD_TTL_MS) {
@@ -163,7 +173,7 @@ export async function saveTurnSnapshotRecord(sessionId, turn) {
   if (!id || !baselineTree || !root) return false;
   return await chain(id, async () => {
     try {
-      await mkdir(recordRoot, { recursive: true });
+      await mkdir(recordRoot(), { recursive: true });
       void sweepRecords();
       const path = recordPath(id);
       const existing = await readRecordFile(path);
@@ -189,11 +199,7 @@ export async function saveTurnSnapshotRecord(sessionId, turn) {
       const scopes = sessionScopes(existing);
       const scope = scopes.find((entry) => rootKey(entry.root) === rootKey(root));
       if (scope) {
-        const owned = new Set([...scope.toolFiles].map(rootKey));
-        for (const file of nextTurn.baselineFiles) {
-          if (!owned.has(rootKey(file.path))) scope.baselineFiles.set(rootKey(file.path), file);
-        }
-        for (const file of nextTurn.toolFiles) scope.toolFiles.add(file);
+        mergeScopeFiles(scope, nextTurn.baselineFiles, nextTurn.toolFiles);
         scope.updatedAt = nextTurn.updatedAt;
       } else {
         scopes.push({
@@ -254,7 +260,7 @@ export async function loadSessionSnapshotRecords(sessionId) {
 }
 
 export function _setTurnSnapshotStoreRootForTest(directory) {
-  recordRoot = clean(directory) || join(DATA_DIR, 'turn-snapshots');
+  recordRootOverride = clean(directory);
   writeChains.clear();
   sweepDone = false;
 }

package/src/runtime/shared/turn-worktree-snapshot.mjs

@@ -12,7 +12,10 @@ const MAX_UNTRACKED_FILE_BYTES = 2 * 1024 * 1024;
 // Baselines used to live in the OS temp directory, where a reboot or a disk
 // cleaner could remove the only copy of a turn's revert source. Keep them with
 // the rest of the runtime data.
-const SNAPSHOT_ROOT = join(resolvePluginData(), 'turn-worktree-snapshots-v1');
+// Resolved per call: the pristine-execution boundary retargets MIXDOG_DATA_DIR.
+function snapshotRoot() {
+  return join(resolvePluginData(), 'turn-worktree-snapshots-v1');
+}
 // A baseline tree is unreachable by design (no commit, no ref), so collection
 // is what bounds how long a review stays revertible.
 const SHADOW_GC_PRUNE = '7.days.ago';
@@ -69,11 +72,12 @@ async function repositoryRoot(worktree) {
 function stateForRoot(root) {
   const key = pathKey(root);
   let state = states.get(key);
-  if (state) return state;
   const hash = createHash('sha256').update(key).digest('hex').slice(0, 24);
+  const gitDir = join(snapshotRoot(), hash);
+  if (state && state.gitDir === gitDir) return state;
   state = {
     root,
-    gitDir: join(SNAPSHOT_ROOT, hash),
+    gitDir,
     initialized: false,
     sourceIndexPath: null,
     sourceIndexIdentity: null,
@@ -169,7 +173,7 @@ async function refreshSourceTracked(state, { force = false } = {}) {
 
 async function ensureState(state) {
   if (state.initialized && (await exists(join(state.gitDir, 'config')))) return;
-  await mkdir(SNAPSHOT_ROOT, { recursive: true });
+  await mkdir(dirname(state.gitDir), { recursive: true });
   if (!(await exists(join(state.gitDir, 'config')))) {
     // Migrate the short-lived prototype layout (`git init <dir>` created
     // <dir>/.git) before initializing the real external index repository.

package/src/runtime/shared/update-checker.mjs

@@ -9,7 +9,7 @@
  * best-effort convenience check, never a boot-blocking dependency.
  */
 
-import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { basename, delimiter, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { writeJsonAtomicSync } from './atomic-file.mjs';
@@ -74,8 +74,6 @@ function readCache(dataDir) {
 
 function writeCache(dataDir, payload) {
   try {
-    const dir = dataDir || resolvePluginData();
-    mkdirSync(dir, { recursive: true });
     writeJsonAtomicSync(cacheFilePath(dataDir), payload, {
       compact: true,
       lock: true,

package/src/runtime/tidy/apply.mjs

@@ -13,8 +13,8 @@ import {
   isBlockedDevicePath,
   isUncPath,
   isWindowsDevicePath,
-} from '../agent/orchestrator/tools/builtin/device-paths.mjs';
-import { markCodeGraphDirtyPaths } from '../agent/orchestrator/tools/code-graph-state.mjs';
+} from '../shared/device-paths.mjs';
+import { markCodeGraphDirtyPaths } from '../shared/code-graph-state.mjs';
 
 /** Same write-target guards the builtin edit surfaces enforce. */
 export function guardTidyWritePath(fullPath) {

package/src/runtime/tidy/function-length.mjs

@@ -0,0 +1,63 @@
+// Function-length summary for a check/fix run: spans come from the code-graph
+// engine's outline records (the rows `code_graph mode:"symbols"` prints as
+// `kind name (Lstart-end)`), so the counts match what the graph reports.
+import { extname } from 'node:path';
+
+const FILE_BATCH = 200;
+const FUNCTION_KINDS = new Set(['function', 'method', 'constructor']);
+const LONGEST_COUNT = 5;
+
+async function graphRunFiles(cwd, rels, signal) {
+  const { _runGraphFiles } = await import('../agent/orchestrator/tools/code-graph/graph-binary.mjs');
+  return _runGraphFiles(cwd, rels, [], signal);
+}
+
+const hasSpan = (symbol) => Number.isFinite(Number(symbol?.startLine)) && Number.isFinite(Number(symbol?.endLine));
+
+/**
+ * Count functions over 50/100/150 lines in `files` (project-relative). Files
+ * whose language emits no spans are listed under `notMeasured`, never counted
+ * as short.
+ */
+export async function summarizeFunctionLengths({ cwd, files = [], signal = null, runFiles = graphRunFiles }) {
+  const functions = [];
+  const spanned = new Set();
+  const seen = new Map();
+  try {
+    for (let index = 0; index < files.length; index += FILE_BATCH) {
+      const chunk = files.slice(index, index + FILE_BATCH);
+      for (const record of await runFiles(cwd, chunk, signal)) {
+        const rel = String(record.rel || '').replaceAll('\\', '/');
+        const language = record.lang || extname(rel) || 'unknown';
+        seen.set(rel, language);
+        const symbols = Array.isArray(record.symbols) ? record.symbols : [];
+        if (symbols.some(hasSpan)) spanned.add(language);
+        for (const symbol of symbols) {
+          if (!FUNCTION_KINDS.has(symbol.kind) || !hasSpan(symbol)) continue;
+          functions.push({
+            path: rel,
+            name: String(symbol.name || ''),
+            lines: Number(symbol.endLine) - Number(symbol.startLine) + 1,
+          });
+        }
+      }
+    }
+  } catch (error) {
+    return { measured: false, note: `function lengths not measured: ${error?.message || error}` };
+  }
+  for (const file of files) {
+    const rel = String(file).replaceAll('\\', '/');
+    if (!seen.has(rel)) seen.set(rel, extname(rel) || 'unknown');
+  }
+  const notMeasured = [...new Set(seen.values())].filter((language) => !spanned.has(language)).sort();
+  const over = (limit) => functions.filter((fn) => fn.lines > limit).length;
+  return {
+    measured: true,
+    functions: functions.length,
+    over50: over(50),
+    over100: over(100),
+    over150: over(150),
+    longest: functions.sort((a, b) => b.lines - a.lines).slice(0, LONGEST_COUNT),
+    ...(notMeasured.length ? { notMeasured } : {}),
+  };
+}