mixdog 0.9.175 → 1.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.175",
+  "version": "1.0.1",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/context-renewal-live-check.mjs

@@ -125,7 +125,8 @@ try {
   for (const spec of specs) {
     const dataDir = path.join(sandbox, spec.name);
     const db = path.join(dataDir, 'pgdata');
-    const ctl = path.join(dataDir, 'runtime', 'runtime-pg16.4+pgvector-0.8.2', 'bin', 'pg_ctl.exe');
+    const runtimeKey = fs.readFileSync(path.join(dataDir, 'runtime', 'active-version'), 'utf8').trim();
+    const ctl = path.join(dataDir, 'runtime', `runtime-${runtimeKey}`, 'bin', 'pg_ctl.exe');
     if (process.platform === 'win32' && fs.existsSync(ctl) && fs.existsSync(path.join(db, 'postmaster.pid'))) {
       const stopped = spawnSync(ctl, ['-D', db, '-m', 'fast', '-w', 'stop'], { stdio: 'inherit' });
       if (stopped.status !== 0) cleanupFailed = true;

package/scripts/plan-runtime-release-tag.mjs

@@ -0,0 +1,57 @@
+// Decides the release tag a memory runtime build publishes under.
+//
+// Published runtime assets are immutable: every app that shipped a manifest
+// naming a tag verifies that tag's assets by size and sha256, so replacing an
+// asset under a shipped tag breaks the next runtime install of all of those
+// apps. A build that would replace an asset of a shipped tag (any tag at or
+// below the bundled manifest's release_tag) moves to the next patch tag; the
+// manifest sync then points new app builds at it.
+//
+// CLI: node scripts/plan-runtime-release-tag.mjs <requested-tag> <shipped-tag> <needed-assets-file> <published-assets-file>
+// prints the tag to build. The asset files hold one asset name per line.
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+const TAG_RE = /^runtime-v(\d+)\.(\d+)\.(\d+)$/;
+
+function parseTag(tag) {
+  const match = TAG_RE.exec(String(tag ?? '').trim());
+  if (!match) throw new Error(`invalid runtime release tag: ${tag}`);
+  return match.slice(1).map(Number);
+}
+
+function compareTags(left, right) {
+  const a = parseTag(left);
+  const b = parseTag(right);
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] - b[index];
+  }
+  return 0;
+}
+
+export function planRuntimeReleaseTag({ requestedTag, shippedTag, neededAssets, publishedAssets }) {
+  const published = new Set(publishedAssets);
+  const replacesPublished = neededAssets.some((name) => published.has(name));
+  if (!replacesPublished || compareTags(requestedTag, shippedTag) > 0) return requestedTag;
+  const [major, minor, patch] = parseTag(shippedTag);
+  return `runtime-v${major}.${minor}.${patch + 1}`;
+}
+
+function readNames(path) {
+  return readFileSync(path, 'utf8')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || '').href) {
+  const [requestedTag, shippedTag, neededPath, publishedPath] = process.argv.slice(2);
+  process.stdout.write(
+    `${planRuntimeReleaseTag({
+      requestedTag,
+      shippedTag,
+      neededAssets: readNames(neededPath),
+      publishedAssets: readNames(publishedPath),
+    })}\n`
+  );
+}

package/src/defaults/skills/computer-use/SKILL.md

@@ -115,18 +115,19 @@ GNOME with the Window Calls extension); prefer accessibility refs there.
   of the shared desktop. If that surface is unavailable, use semantic refs or
   report `pixel_unavailable`; do not substitute a screen grab.
 - If the user intervenes, preserve their cursor and focus. Worker termination
-  and input cleanup must finish before resuming; a failed cleanup is not cleared
-  by a resume request. Ask the user to press `Ctrl+Alt+Esc`, or the overlay's
-  Stop control, for verified cleanup recovery.
-  If target-local release remains unconfirmed, the user must inspect/recover
-  that window; restarting the host alone does not prove release. Obtain a new
-  observation after an interruption.
-  Use `wait_for_user` to keep the task waiting without sending input. The host
-  may resume ordinary physical-input interruptions after its configured quiet
-  interval; renewed input resets that interval. Explicit pauses/stops and
-  uncertain observation/cleanup never auto-resume. The overlay's only control
-  is Stop, which cancels the task. Never operate it or the recovery controls,
-  or change the idle policy, on the user's behalf.
+  and input cleanup must finish before resuming. The user's Resume on the
+  overlay continues a pause; an ordinary physical-input pause may also resume
+  after the host's configured quiet interval (renewed input resets it), while
+  explicit pauses, stops and uncertain cleanup never auto-resume. Stop (or
+  `Ctrl+Alt+Esc`) cancels the task, which then reports the stop as a failure.
+  A cleanup that could not be confirmed is retried before the next input
+  command; if it still fails, that command returns the reason — relay it to
+  the user. If target-local release remains unconfirmed, the user must
+  inspect/recover that window; restarting the host alone does not prove
+  release. Obtain a new observation after an interruption.
+  Use `wait_for_user` to keep the task waiting without sending input. Never
+  operate Resume, Stop or the recovery controls, or change the idle policy, on
+  the user's behalf.
   While paused, only `list`, `diagnose` and `wait_for_user` are available.
   Chat text alone does not clear the host. After `resumed`, capture fresh state;
   after `timeout` or `cancelled`, no input is authorized. Never replay the

package/src/defaults/skills/setup/SKILL.md

@@ -25,7 +25,7 @@ supported `setup` action, and read its result as the change receipt.
   arguments and the transcript. Open the Providers surface and let the user
   enter them.
 - A mutation follows the active workflow's approval rules. Status, catalog,
-  definition, MCP-config and Instructions reads do not change persisted settings.
+  definition and MCP-config reads do not change persisted settings.
 - Most changes affect new sessions. Report `appliedToCurrentSession` and
   `appliesTo` exactly when the result supplies them.
 - This skill does not own source edits, builds, installation deployment,
@@ -78,9 +78,6 @@ that a call returned without transport error.
 - Read definitions before editing them; use skill-creator when authoring a
   skill. Setup persists the supported definition fields. Workflow and agent
   ids are stable identities, distinct from their display names.
-- Read Instructions before replacing them and pass the returned text as
-  `expectedContent`. `projectPath:null` means Common Instructions; otherwise
-  use an exact registered Project root. Keep the returned backup.
 - MCP servers and plugins are machine-global integrations whose visibility may
   be scoped to selected Projects.
 - User skills are machine-global. Enabled plugin skills and built-in skills are

package/src/defaults/skills/setup/references/actions.md

@@ -68,8 +68,6 @@ Read this when choosing a `setup` mutation.
 | Desktop theme, display language, side panels, or zoom | `set_appearance` |
 | Register a Project and optionally set its display alias | `save_project` |
 | Unregister a Project without deleting its files | `remove_project` |
-| Read Project/Common Instructions before editing | `get_instructions` |
-| Replace unchanged Project/Common Instructions and retain a backup | `set_instructions` |
 | Revoke one linked device; re-pairing restores access | `revoke_linked_device` |
 | Managed local model context allocation; null restores automatic | `set_local_context` |
 

package/src/defaults/skills/setup/references/surfaces.md

@@ -38,8 +38,7 @@ An attached Desktop or TUI may navigate and return `opened:true`.
 - Extensions → Plugin → Git & GitHub: Git/GitHub CLI installation and connection.
 - Settings → Connection: web-app pairing and linked devices.
 - Settings → System: update, keep-awake, and Doctor.
-- Projects: Project registration, name, Instructions, Common Instructions, and
-  Core Memories.
+- Projects: Project registration, name, Project Memories, and Common Memory.
 - Workflows: workflow packs, Main and Web Search defaults, and agent editing.
 - Extensions → Plugin: Built-in cards and plugins.
 - Extensions → Skill: skills and MCP servers.
@@ -51,7 +50,7 @@ the user to Desktop.
 
 Setup can read and change Desktop appearance, keep-awake, usage pin,
 Computer observe-only, Browser/Computer/voice installation and toggles,
-Projects, Instructions, and linked-device revocation through the attached
+Projects, and linked-device revocation through the attached
 Desktop. A receipt identifies `scope:desktop-host`; appearance is not applied
 to the paired browser. No Desktop claimant means no confirmed change.
 

package/src/defaults/skills/xlsx/SKILL.md

@@ -37,6 +37,7 @@ Excel proves the numbers and makes their meaning readable. Keep sourced inputs a
 1. Settle the table first: headers, one row per record, consistent units, numeric cells as numbers (not text), dates as ISO strings (both backends store `2026-09-30` as the Excel date under `yyyy-mm-dd`, so date arithmetic is `=D5-DATE(2026,9,22)`, not `DATEVALUE`), percentages as fractions (`0.15`, formatted `0.0%`). A figure written as text is stored as the number Excel types from it, on both backends — `"1,234"` under `#,##0`, `"15%"` as 0.15 under `0%` — and any other text stays exactly as written (`"1-2"`, `"007"`, `"1e3"`, `"TRUE"` never become a date, a 7, a 1000, or a truth value). Keep the same `design.content` model as the deck or document in the same package.
 2. For a report, design the reading order, sheet roles, column proportions, chart placement and intended screen/print use. Author with native cell, style, merge and chart operations by default. `compose_sheet` is an opt-in preset only when its table-plus-panel structure already fits; do not select it merely to save calls. Batch all known operations. Use `describe format:'xlsx' operation:<op>` when fields are unknown; cell styles belong in `properties`.
 3. Add sheets with `add_sheet`, then native ranges and formulas targeting `sheet`. Use `set_formula` for derived cells and `define_name` for reused inputs. Check representative formulas against the intended ranges before extending a model; clean recalculation proves evaluation, not correct modelling. A design specimen is optional, not required for every workbook.
+   If `create` fails, stop dependent `open`, `render`, and `finalize` calls: a failed creation is not an artifact. Correct the reported inputs and resume only from a successful `create` result.
 4. Raw tabular files (`.csv`, `.tsv`) take `set_range` with a 2D `values` array and `append_row`; they carry no styles, formulas, or multiple sheets.
 5. `finalize` recalculates and returns current rendered pages for review; add `auditProfile:'financial-model'` for a decision model. Read the actual images as in `report-design.md`, with concrete keep/fix observations about hierarchy, charts and print layout. Correct material issues and rerender, rather than filling a pass checklist. Complete with `design:{ reviewed:true, reviewToken:<current token>, critique:[{ page:1, verdict:'pass', note:<page-specific observations> }, ...] }`. This records agent review, not user approval. CSV/TSV needs no visual approval. Resolve validation failures against their original baseline, never by reopening as a new baseline.
 

package/src/rules/shared/70-delivery.md

@@ -7,6 +7,9 @@
   absolute path, optionally `:line[:column]` (`deliverables/report.docx`,
   `src/app.ts:42`); never a bare name, a path relative to another folder, or a
   `file://` URI.
+- Deliver requested visual artifacts (SVG, diagrams, HTML pages) as saved files
+  and give their path; never paste their source as the answer unless the user
+  asks for the code.
 
 <!-- tools: git -->
 - A commit request includes selecting and staging its changes; a stage-only

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -4,6 +4,7 @@ import { countJsonNextCalls } from './tools/next-call-utils.mjs';
 import { parseGrepContextHeader, splitGrepLinePrefix } from './tools/builtin/grep-formatting.mjs';
 import { isReadOnlyNavigationMiss } from './session/result-classification.mjs';
 import { nonNegativeInt } from '../../shared/numbers.mjs';
+import { isUserControlCancellation } from '../../shared/tool-status.mjs';
 import {
   appendAgentTrace,
   normalizeSessionId,
@@ -128,7 +129,7 @@ function traceAgentCompact({
 }
 
 const TOOL_ARG_KEYS = {
-  read: ['path', 'offset', 'limit', 'line', 'context'],
+  read: ['file_path', 'path', 'offset', 'limit', 'line', 'context'],
   grep: ['pattern', 'path', 'glob', 'output_mode', 'head_limit', 'offset'],
   glob: ['pattern', 'path', 'head_limit', 'offset', 'sort'],
   find: ['query', 'path', 'head_limit'],
@@ -211,12 +212,11 @@ function summarizeToolArgs(toolName, args) {
   for (const key of keys) {
     if (Object.hasOwn(args, key)) out[key] = compactTraceArgValue(args[key], key);
   }
-  for (const countKey of ['edits', 'writes']) {
+  // Arrays are clipped to 6 entries above; the count keeps batch-limit
+  // failures (more than 10 read/grep targets) diagnosable.
+  for (const countKey of ['edits', 'writes', 'file_path', 'path']) {
     if (Array.isArray(args[countKey])) out[`${countKey}_count`] = args[countKey].length;
   }
-  if (toolName === 'read' && Array.isArray(args.path)) {
-    out.path_count = args.path.length;
-  }
   return Object.keys(out).length ? out : null;
 }
 
@@ -410,21 +410,21 @@ function classifyToolFailure(resultText, toolName) {
     if (/\[signal:\s*[^\]]+/i.test(leading)) return 'process/signal';
     return 'command-exit';
   }
+  // edit quotes the file around a miss (the nearest line and a current-file
+  // excerpt). That quoted text is file content, so a word in it such as
+  // "unreadable", "timeout" or "permission" must not pick the category.
+  if (toolName === 'edit' && /^edit failed \(old_string (?:not found|found \d+ times)\b/i.test(leading))
+    return 'runtime/failure';
   if (/compacted-history placeholder/.test(text)) return 'expected-preflight';
   if (/\[tool-input-validation\]/.test(text)) return 'schema/args';
   // These are emitted validation/cancellation contracts, not keywords found
   // somewhere in a quoted document, command output, or error preview.
-  if (
-    /^(?:Browser command interrupted by local user input\.|computer_session_aborted: queued command was cancelled before execution|computer_user_control_active:)/i.test(
-      leading
-    )
-  )
-    return 'expected-cancellation';
+  if (isUserControlCancellation(leading)) return 'expected-cancellation';
   if (
     /^The arguments provided to `[^`]+` are invalid JSON and could not be parsed:/i.test(leading) ||
     /^new Goal tasks must omit ids; use updates for existing tasks$/i.test(leading) ||
     /^goal task exceeds \d+ characters$/i.test(leading) ||
-    /^goal (?:tasks|updates) support at most \d+ entries$/i.test(leading) ||
+    /^goal (?:tasks|updates) support at most \d+ entries(?:$|;)/i.test(leading) ||
     /^goal arguments contain unknown fields:/i.test(leading) ||
     /^Unsupported field for GitHub [\w.]+\.$/i.test(leading) ||
     /^browser action "[^"]+" (?:does not accept input field|requires input\.|accepts only one input target form|fields must be inside input:|input\.[^\n]*(?:must be|requires|accepts at most))/i.test(

package/src/runtime/agent/orchestrator/config.mjs

@@ -100,7 +100,9 @@ export function buildDefaultConfig(options = {}) {
   providers['mixdog-local'] = { enabled: false };
   return {
     providers,
-    disabledAgents: [...DEFAULT_DISABLED_AGENT_IDS],
+    // The Maintainer also starts off: background upkeep spends model calls, so
+    // it runs only once the user turns it on and picks its model.
+    disabledAgents: [...DEFAULT_DISABLED_AGENT_IDS, 'maintainer'],
     workflow: { active: 'default' },
     orchestrationMode: 'none',
   };
@@ -272,6 +274,11 @@ export function loadConfig(options = {}) {
     recap: { enabled: true },
     developer: {},
     modules: {},
+    // No stored section at all is a brand-new profile: its built-ins start
+    // uninstalled. The defaults above carry presets/recap/modules, which
+    // would otherwise read as a pre-section profile and be grandfathered.
+    // A stored section that failed to parse proves nothing and keeps that path.
+    ...(hasKeys(sectionRaw) ? {} : { builtins: {} }),
   };
 }
 /** In-lock patch of `skills.disabled` only (avoids whole-config lost-update). */

package/src/runtime/agent/orchestrator/providers/anthropic-api-transport.mjs

@@ -21,6 +21,7 @@ import {
 } from './retry-classifier.mjs';
 import { PROVIDER_FIRST_BYTE_TIMEOUT_MS, createTimeoutSignal } from '../stall-policy.mjs';
 import { noteFastModeCapacityError } from './anthropic-fast-mode.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { notifyCurrentAnthropicRateLimit } from './admission-scheduler.mjs';
 
 /**
@@ -103,6 +104,7 @@ export function createAnthropicApiTransport({ client, label, opts, useModel, par
   const requestStreamingResponse = () =>
     withRetry(
       async ({ signal: attemptSignal }) => {
+        noteRequestServiceTier(params.speed);
         const res = await client.messages.create(params, requestOptions(attemptSignal)).asResponse();
         if (!res.ok) {
           const text = await res.text().catch(() => '');
@@ -156,7 +158,10 @@ export function createAnthropicApiTransport({ client, label, opts, useModel, par
 
   const requestNonStreamingMessage = (nonStreamingParams, signal) =>
     withRetry(
-      async ({ signal: attemptSignal }) => client.messages.create(nonStreamingParams, requestOptions(attemptSignal)),
+      async ({ signal: attemptSignal }) => {
+        noteRequestServiceTier(nonStreamingParams.speed);
+        return client.messages.create(nonStreamingParams, requestOptions(attemptSignal));
+      },
       {
         ...retryPolicy(signal, `${label} Anthropic non-streaming fallback`, `${label}-nonstreaming-request`),
         onRetry: ({ attempt, maxAttempts, lastErr, delayMs }) =>

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-request.mjs

@@ -12,6 +12,7 @@ import { traceAgentFetch } from '../agent-trace.mjs';
 import { createAbortController } from '../../../shared/abort-controller.mjs';
 import { notifyCurrentAnthropicRateLimit } from './admission-scheduler.mjs';
 import { noteFastModeCapacityError } from './anthropic-fast-mode.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import {
   ANTHROPIC_RETRY_BACKOFF_MS,
   ANTHROPIC_RETRY_JITTER_RATIO,
@@ -66,6 +67,7 @@ export function createAnthropicOAuthRequest({
       // provider-visible cache breakpoint off the cached one — the
       // exact COLD-turn bug this change fixes. Order is fixed:
       // build → sanitize (once) → mark → prepare image bytes → JSON.stringify.
+      noteRequestServiceTier(requestBody?.speed);
       const response = await postMessages({
         accessToken,
         requestBody,

package/src/runtime/agent/orchestrator/providers/cursor.mjs

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { getAgentApiKey } from '../../../shared/config.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import {
   knownToolNamesFromOpenAITools,
   parseToolCalls,
@@ -510,6 +511,15 @@ function selectParameterizedCursorVariant(group, requested, sendOpts = {}) {
   };
 }
 
+// Fast is a RequestedModel parameter on parameterized models and an id
+// suffix on raw variants.
+function cursorSelectionIsFast(selection) {
+  if (selection.parameters?.length) {
+    return selection.parameters.some((parameter) => parameter.id === 'fast' && parameter.value === 'true');
+  }
+  return parseCursorVariantId(selection.modelId).fast;
+}
+
 function selectCursorVariant(group, { effort = null, fast = false } = {}) {
   if (!Array.isArray(group) || group.length === 0) return null;
   const normalizedEffort =
@@ -680,11 +690,13 @@ class CursorProviderBase {
       sendOpts.sessionId || sendOpts.providerCacheKey || sendOpts.promptCacheKey || `cursor-call:${randomUUID()}`
     );
     const openAiTools = tools?.length ? toOpenAITools(tools) : undefined;
-    const dispatch = () =>
-      this._dispatchChat(
+    const dispatch = () => {
+      noteRequestServiceTier(cursorSelectionIsFast(cursorSelection) ? 'fast' : '');
+      return this._dispatchChat(
         this._chatBody(messages, { cursorSelection, sessionScope, openAiTools, toolChoice: sendOpts.toolChoice }),
         { runtime, accessToken, signal, sendOpts, openAiTools }
       );
+    };
     let assembled;
     try {
       assembled = await dispatch();
@@ -702,9 +714,15 @@ class CursorProviderBase {
       assembled = await dispatch();
     }
     const rawUsage = assembled.rawUsage;
+    // A pinned raw variant (effort/Fast suffix) bills as its catalog model;
+    // the Fast part is carried by the request's tier, not the id.
+    const pinned = parseCursorVariantId(canonicalCursorModelId(String(model || '').trim()));
+    const pricingModel =
+      pinned.baseId !== pinned.id && this._cursorCatalog?.groups?.has(pinned.baseId) ? pinned.baseId : undefined;
     return {
       content: assembled.content || '',
       model: model || assembled.model || 'auto',
+      ...(pricingModel ? { pricingModel } : {}),
       toolCalls: assembled.toolCalls,
       stopReason: assembled.stopReason,
       ...(assembled.reasoningContent ? { reasoningContent: assembled.reasoningContent } : {}),

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -39,6 +39,7 @@ import {
   resolveProviderCacheKey,
 } from '../agent-runtime/cache-strategy.mjs';
 import { preconnect } from '../../../shared/llm/http-agent.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { sendViaHttpSse, _envFlag } from './openai-oauth-http-sse.mjs';
 import { warmCodexClientVersion } from './codex-client-meta.mjs';
 import { CODEX_BACKEND_ORIGIN } from './openai-codex-endpoints.mjs';
@@ -209,6 +210,8 @@ export class OpenAIOAuthProvider {
     const authState = { tokens: await _authP };
     await _verP;
     const body = await _bodyP;
+    // Every WS/HTTP attempt of this send carries this body's tier unchanged.
+    noteRequestServiceTier(body.service_tier);
     // poolKey != cacheKey by design. poolKey isolates socket/delta state per
     // session. cacheKey is body.prompt_cache_key and affects prompt-cache
     // routing only; Codex handshake identity comes from sendOpts and remains

package/src/runtime/agent/orchestrator/providers/openai-ws.mjs

@@ -23,6 +23,7 @@ import { applyOpenAIDirectCachePolicy, openAiDirectSupportsFast } from './openai
 import { streamCallbacks } from './lib/send-callbacks.mjs';
 import { getAgentApiKey } from '../../../shared/provider-api-key.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
+import { noteRequestServiceTier } from '../../../shared/llm/usage-context.mjs';
 import { resolveProviderCacheKey, resolveProviderPromptCacheLane } from '../agent-runtime/cache-strategy.mjs';
 
 function applyOpenAIDirectFastTier(body, model, opts) {
@@ -122,6 +123,7 @@ export class OpenAIDirectProvider {
     // so a model can opt into Fast even when the OAuth catalog does not
     // advertise a Fast tier for its OAuth endpoint.
     applyOpenAIDirectFastTier(body, useModel, opts);
+    noteRequestServiceTier(body.service_tier);
     // Keep public response storage and model-specific cache options out of
     // the shared OAuth payload. Storage opt-out still forces full frames in
     // _computeDelta; retained output items make those frames self-contained.

package/src/runtime/agent/orchestrator/providers/registry-errors.mjs

@@ -0,0 +1,9 @@
+// Error code for a provider init that has no enabled provider to register.
+// The registry refuses such an init to protect its live instances; readers
+// that legitimately run before any provider exists (the model catalog on a
+// fresh install) treat it as "nothing to load" instead of a failure.
+export const NO_ENABLED_PROVIDERS = 'PROVIDERS_NONE_ENABLED';
+
+export function noEnabledProvidersError(message) {
+  return Object.assign(new Error(message), { code: NO_ENABLED_PROVIDERS });
+}

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -4,6 +4,7 @@ import { refreshCatalog as refreshMetadataCatalog } from './model-catalog.mjs';
 import { wrapProviderAdmission } from './admission-scheduler.mjs';
 import { createAccountPoolProvider } from './account-pool.mjs';
 import { isInclusiveProvider } from '../../../shared/llm/cost.mjs';
+import { noEnabledProvidersError } from './registry-errors.mjs';
 // OpenAI-compat provider names are self-declared by openai-compat-presets.mjs via
 // OPENAI_COMPAT_PRESETS. No parallel list maintained here.
 const providers = new Map();
@@ -223,7 +224,7 @@ async function _initProvidersUnsynchronized(config, signal = null) {
   // here preserves whatever was already registered.
   const entries = Object.entries(config || {});
   if (entries.length === 0) {
-    throw new Error('[provider] initProviders called with empty config — refusing to clear registry');
+    throw noEnabledProvidersError('[provider] initProviders called with empty config — refusing to clear registry');
   }
   const next = new Map();
   const nextSignatures = new Map();
@@ -258,7 +259,7 @@ async function _initProvidersUnsynchronized(config, signal = null) {
   // Second guard: every entry was disabled. Same reasoning — keep the
   // existing registry rather than going dark.
   if (next.size === 0) {
-    throw new Error('[provider] all providers disabled in config — refusing to clear registry');
+    throw noEnabledProvidersError('[provider] all providers disabled in config — refusing to clear registry');
   }
   // OAuth preservation guard. anthropic-oauth / openai-oauth are NOT stored
   // in mixdog-config.json — buildDefaultConfig injects them at runtime by

package/src/runtime/agent/orchestrator/runtime-core/goal-tasks.mjs

@@ -6,11 +6,13 @@ import { clean } from '../../../shared/clean.mjs';
 // dropped on normalize rather than rejected.
 const TASK_ENTRY_FIELDS = ['id', 'text', 'status', 'kind'];
 
-// Dropped rows remain in the record but are no longer requested work.
+// Dropped rows remain in the record but are no longer requested work. Every
+// row, completed and dropped included, still fills one of the capped slots.
 export function goalTaskProgress(tasks) {
   return {
     tasksCompleted: tasks.filter((task) => task?.status === 'completed').length,
     tasksTotal: tasks.filter((task) => task?.status !== 'dropped').length,
+    taskSlotsUsed: tasks.length,
   };
 }
 
@@ -34,7 +36,18 @@ export function optionalGoalTaskChanges({ tasks, updates } = {}) {
 export function normalizeGoalTasks(input, previous = [], { strict = false } = {}) {
   if (input == null) return previous.map((task) => ({ ...task }));
   if (!Array.isArray(input)) throw new Error('goal tasks must be an array');
-  if (input.length > MAX_GOAL_TASKS) throw new Error(`goal tasks support at most ${MAX_GOAL_TASKS} entries`);
+  if (input.length > MAX_GOAL_TASKS) {
+    // Settled rows count toward the cap; set_tasks may omit them (only
+    // unfinished tasks must be retained), which is how a long Goal makes room.
+    const settled = previous.some((task) => GOAL_TASK_SETTLED.includes(task?.status));
+    throw new Error(
+      `goal tasks support at most ${MAX_GOAL_TASKS} entries${
+        settled
+          ? '; completed and dropped tasks count, so to add more send set_tasks with only the unfinished tasks plus the new ones'
+          : ''
+      }`
+    );
+  }
   const previousByText = new Map(previous.map((task) => [clean(task?.text), task]));
   const reservedIds = new Set([...previous, ...input].map((task) => clean(task?.id)).filter(Boolean));
   let nextId = 1;
@@ -78,12 +91,18 @@ function taskInputRetains(entry, task) {
 }
 
 export function patchGoalTasks(previous, { updates, tasks } = {}) {
-  const patches = updates ?? [];
-  const additions = tasks ?? [];
-  if (!Array.isArray(patches) || !Array.isArray(additions)) throw new Error('goal updates and tasks must be arrays');
+  const requested = updates ?? [];
+  const entries = tasks ?? [];
+  if (!Array.isArray(requested) || !Array.isArray(entries)) throw new Error('goal updates and tasks must be arrays');
+  const byId = new Map(previous.map((task) => [task.id, { ...task }]));
+  // A new-task entry naming an id this Goal already has can only mean that
+  // task, so it is applied as the task's update. An id the Goal does not have
+  // is still refused below.
+  const addressesExisting = (entry) => byId.has(clean(entry?.id));
+  const patches = [...requested, ...entries.filter(addressesExisting)];
+  const additions = entries.filter((entry) => !addressesExisting(entry));
   if (!patches.length && !additions.length) throw new Error('goal update_tasks requires updates or new tasks');
   if (patches.length > MAX_GOAL_TASKS) throw new Error(`goal updates support at most ${MAX_GOAL_TASKS} entries`);
-  const byId = new Map(previous.map((task) => [task.id, { ...task }]));
   const seen = new Set();
   for (const patch of patches) {
     const id = clean(patch?.id);

package/src/runtime/agent/orchestrator/runtime-core/goal-text.mjs

@@ -3,6 +3,7 @@
 // No filesystem, no runtime coupling — values in, text out.
 
 import { goalTaskProgress } from './goal-tasks.mjs';
+import { MAX_GOAL_TASKS } from './goal-tool-defs.mjs';
 
 function escapeGoalPromptText(value) {
   return String(value ?? '')
@@ -214,7 +215,7 @@ export function goalStateReminder(goal, { reason = '' } = {}) {
   }
   if (reason === 'deadline-reached' && goal.status === 'active') return '';
   const tasks = Array.isArray(goal.tasks) ? goal.tasks : [];
-  const { tasksCompleted, tasksTotal } = goalTaskProgress(tasks);
+  const { tasksCompleted, tasksTotal, taskSlotsUsed } = goalTaskProgress(tasks);
   // Event-specific steering: what the model could not have learned from its own
   // tool results. Standing rules stay in the cached tool description.
   let lead = 'Current durable Goal snapshot:';
@@ -233,7 +234,7 @@ export function goalStateReminder(goal, { reason = '' } = {}) {
     ...(goal.status === 'blocked' ? [BLOCKED_LINE] : []),
     '',
     `Objective: ${escapeGoalPromptText(goal.objective)}`,
-    `Status: ${escapeGoalPromptText(goal.status)} · tasks ${tasksCompleted}/${tasksTotal}`,
+    `Status: ${escapeGoalPromptText(goal.status)} · tasks ${tasksCompleted}/${tasksTotal} · task slots used ${taskSlotsUsed}/${MAX_GOAL_TASKS}`,
     ...(goal.blocker ? [`Waiting or stop reason: ${escapeGoalPromptText(goal.blocker)}`] : []),
     ...(goal.revision ? [`Revision: ${goal.revision}`] : []),
     ...goalTimeLines(goal),

package/src/runtime/agent/orchestrator/runtime-core/goal-tool-defs.mjs

@@ -16,7 +16,7 @@ const taskFields = {
     type: 'string',
     minLength: 1,
     maxLength: MAX_GOAL_TASK_TEXT_LENGTH,
-    description: 'Required work or verification outcome.',
+    description: 'Brief work/check; results go in reply.',
   },
   status: {
     type: 'string',

package/src/runtime/agent/orchestrator/runtime-core/goal-tool-exec.mjs

@@ -22,6 +22,7 @@ function toolReply(ctx, id, goal, { full = false, previousIds = null } = {}) {
       status: goal.status,
       tasksCompleted: goal.tasksCompleted,
       tasksTotal: goal.tasksTotal,
+      taskSlotsUsed: goal.taskSlotsUsed,
       tasksUpdatedAt: goal.tasksUpdatedAt,
       timeUsedMs: goal.timeUsedMs,
     };

package/src/runtime/agent/orchestrator/session/result-classification.mjs

@@ -61,7 +61,7 @@ const ZERO_MATCH_PREFIXES = [
 const READ_ONLY_NAVIGATION_TOOLS = new Set(['find', 'glob', 'grep', 'list', 'read', 'code_graph']);
 
 const NAVIGATION_MISS_RE =
-  /\b(?:enoent|enotdir)\b|path does not exist|directory does not exist|no such (?:file|path)|not found at this path|file not found in graph/i;
+  /\b(?:enoent|enotdir)\b|path does not exist|directory does not exist|no such (?:file|path)|not found at this path|file not found\b|symbol "[^"\n]*" not found in /i;
 
 export function isReadOnlyNavigationMiss(toolName, result) {
   if (!READ_ONLY_NAVIGATION_TOOLS.has(String(toolName || '').toLowerCase())) return false;

package/src/runtime/agent/orchestrator/session/transcript-restore/tool-result-status.mjs

@@ -3,7 +3,11 @@
  * session runtime.
  */
 import { stripShellExitHeader, toolErrorDisplay } from './tool-result-text.mjs';
-import { normalizeToolTerminalStatus, toolResultTerminalStatus } from '../../../../shared/tool-status.mjs';
+import {
+  hasBenignExitOutcome,
+  normalizeToolTerminalStatus,
+  toolResultTerminalStatus,
+} from '../../../../shared/tool-status.mjs';
 import { isReadOnlyNavigationMiss } from '../result-classification.mjs';
 import { formatAggregateDetail, summarizeToolResult, toolLoadingTargets } from '../../../../shared/tool-surface.mjs';
 import { normalizeToolName } from '../../../../shared/tool-primitives.mjs';
@@ -43,7 +47,7 @@ export function shellCommandExitCode(text) {
 export function toolCallOutcome(message, rawText) {
   if (normalizeToolName(message?.toolName || message?.name) === 'git') {
     const exitCode = gitResultExitCode(rawText);
-    if (exitCode !== null) return { isCallError: false, isExitError: true, exitCode };
+    if (exitCode !== null) return { isCallError: false, isExitError: !hasBenignExitOutcome(rawText), exitCode };
     if (gitResultError(rawText)) return { isCallError: true, isExitError: false, exitCode: null };
   }
   const exitCode = shellCommandExitCode(rawText);
@@ -51,7 +55,7 @@ export function toolCallOutcome(message, rawText) {
     // Every completed shell result carries `[exit code: N]` — including 0.
     // A non-zero code is a command failure unless execution marked a known
     // successful no-match/no-change outcome.
-    const benignExit = exitCode !== 0 && /^\[outcome:\s*(?:no-match|no-change)\]\s*$/im.test(String(rawText || ''));
+    const benignExit = exitCode !== 0 && hasBenignExitOutcome(rawText);
     return { isCallError: false, isExitError: exitCode !== 0 && !benignExit, exitCode };
   }
   if (isReadOnlyNavigationMiss(message?.toolName || message?.name, rawText)) {