mixdog 0.9.22 → 0.9.23

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -0,0 +1,187 @@
+// Full-tree shutdown for stdio MCP child processes.
+//
+// The MCP SDK's StdioClientTransport.close() closes stdin, waits ~2s, then
+// SIGTERMs / SIGKILLs the *direct* child only. On Windows that maps to
+// TerminateProcess on the spawned wrapper (uvx/npx/uv) and leaves its
+// grandchildren (uv.exe -> mcp-for-unity.exe -> python.exe) orphaned. This
+// module implements the MCP spec shutdown order over the whole process tree:
+// close stdin -> grace wait for voluntary exit -> force-kill the recorded
+// tree (taskkill /T /F on Windows, SIGTERM->SIGKILL of every descendant on
+// POSIX). No external dependencies.
+import { spawn } from 'node:child_process';
+
+const isWin = process.platform === 'win32';
+
+function delay(ms) {
+    return new Promise((resolve) => {
+        const t = setTimeout(resolve, ms);
+        if (t.unref) t.unref();
+    });
+}
+
+// Spawn a helper command and resolve its stdout (empty string on any error).
+function run(cmd, args) {
+    return new Promise((resolve) => {
+        let out = '';
+        let cp;
+        try {
+            cp = spawn(cmd, args, { windowsHide: true });
+        }
+        catch {
+            resolve('');
+            return;
+        }
+        cp.stdout?.on('data', (d) => { out += String(d); });
+        cp.on('error', () => resolve(out));
+        cp.on('close', () => resolve(out));
+    });
+}
+
+// Snapshot the whole process table once: parent map + a per-pid identity
+// token (Windows CreationDate, POSIX lstart) so a later kill can prove a pid
+// number was not recycled onto a different process before signalling it.
+async function enumerate() {
+    const childrenOf = new Map();
+    const tokenOf = new Map();
+    const out = isWin
+        ? await run('powershell.exe', [
+            '-NoProfile', '-NonInteractive', '-Command',
+            `Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $($_.CreationDate.ToString('o'))" }`,
+        ])
+        : await run('ps', ['-A', '-o', 'pid=,ppid=,lstart=']);
+    for (const line of out.split(/\r?\n/)) {
+        const m = line.trim().match(/^(\d+)\s+(\d+)(?:\s+(.+))?$/);
+        if (!m) continue;
+        const pid = Number(m[1]);
+        const ppid = Number(m[2]);
+        const token = (m[3] || '').trim() || null;
+        if (!childrenOf.has(ppid)) childrenOf.set(ppid, []);
+        childrenOf.get(ppid).push(pid);
+        tokenOf.set(pid, token);
+    }
+    return { childrenOf, tokenOf };
+}
+
+// BFS every descendant pid of rootPid (excludes rootPid).
+function descendantsOf(childrenOf, rootPid) {
+    const result = [];
+    const seen = new Set([rootPid]);
+    const stack = [rootPid];
+    while (stack.length) {
+        const cur = stack.pop();
+        for (const child of childrenOf.get(cur) ?? []) {
+            if (!seen.has(child)) {
+                seen.add(child);
+                result.push(child);
+                stack.push(child);
+            }
+        }
+    }
+    return result;
+}
+
+// Exposed for tests: descendant pid list captured while the tree is intact.
+export async function collectDescendants(rootPid) {
+    const { childrenOf } = await enumerate();
+    return descendantsOf(childrenOf, rootPid);
+}
+
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        // EPERM => exists but not signalable by us; ESRCH => gone.
+        return Boolean(e && e.code === 'EPERM');
+    }
+}
+
+function waitExit(proc, ms) {
+    if (!proc || proc.exitCode !== null || proc.signalCode !== null) {
+        return Promise.resolve(true);
+    }
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (v) => { if (!done) { done = true; resolve(v); } };
+        const t = setTimeout(() => finish(false), ms);
+        if (t.unref) t.unref();
+        proc.once('exit', () => { clearTimeout(t); finish(true); });
+        proc.once('close', () => { clearTimeout(t); finish(true); });
+    });
+}
+
+// A pid is safe to signal only if its CURRENT identity token equals the one
+// recorded at snapshot time. Both must be present; a gone/recycled pid has a
+// missing or mismatched token and is skipped. Tokens come from batched table
+// reads (Map), so verification is O(1) with zero extra process spawns.
+function stillSame(pid, snapshotToken, currentTokens) {
+    const want = snapshotToken.get(pid);
+    const cur = currentTokens.get(pid);
+    return Boolean(want && cur && want === cur);
+}
+
+// Force-kill the given pids, identity-checked against a batched current-token
+// table captured immediately before signalling so a recycled pid is never hit.
+async function killVerified(pids, snapshotToken, currentTokens) {
+    const verified = pids.filter((pid) => stillSame(pid, snapshotToken, currentTokens));
+    if (verified.length === 0) return;
+    if (isWin) {
+        // /T also reaps any still-live children spawned since enumeration;
+        // every listed /PID was identity-checked just above.
+        const args = ['/F', '/T'];
+        for (const p of verified) args.push('/PID', String(p));
+        await run('taskkill', args);
+        return;
+    }
+    // POSIX: terminate, brief wait, then hard-kill survivors. Re-verify with a
+    // single fresh batched table read (not per-pid) before the SIGKILL pass.
+    for (const p of verified) { try { process.kill(p, 'SIGTERM'); } catch { /* ignore */ } }
+    await delay(500);
+    const { tokenOf: fresh } = await enumerate().catch(() => ({ tokenOf: new Map() }));
+    for (const p of verified) {
+        if (isAlive(p) && stillSame(p, snapshotToken, fresh)) {
+            try { process.kill(p, 'SIGKILL'); } catch { /* ignore */ }
+        }
+    }
+}
+
+/**
+ * Shut down an stdio MCP transport's child process tree per MCP spec order.
+ * Returns false when the transport has no live child (non-stdio / already
+ * exited); true once the tree has been shut down.
+ */
+export async function shutdownStdioChild(transport, { graceMs = 2000 } = {}) {
+    const proc = transport?._process;
+    const pid = (typeof transport?.pid === 'number' ? transport.pid : null) ?? proc?.pid ?? null;
+    if (!pid) return false;
+    const empty = { childrenOf: new Map(), tokenOf: new Map() };
+    const snapshotToken = new Map();
+    // Snapshot #1: tree + identity tokens while it is still fully intact.
+    // Covers children that later get re-parented/orphaned during shutdown.
+    const before = await enumerate().catch(() => empty);
+    const initial = descendantsOf(before.childrenOf, pid);
+    snapshotToken.set(pid, before.tokenOf.get(pid) ?? null);
+    for (const d of initial) snapshotToken.set(d, before.tokenOf.get(d) ?? null);
+    // 1. Close stdin to request a voluntary shutdown.
+    try { proc?.stdin?.end(); } catch { /* ignore */ }
+    // 2. Grace period for the server to exit on its own.
+    const exited = await waitExit(proc, graceMs);
+    // 3. Snapshot #2 after the grace: catches children spawned late during
+    //    shutdown that were absent from the first snapshot.
+    const after = await enumerate().catch(() => empty);
+    const fresh = descendantsOf(after.childrenOf, pid);
+    for (const d of fresh) {
+        if (!snapshotToken.has(d)) snapshotToken.set(d, after.tokenOf.get(d) ?? null);
+    }
+    // 4. Candidate set = union of both snapshots' descendants; add the root
+    //    only when it did NOT exit on its own (skip stale-root kill per spec).
+    const candidates = new Set(initial);
+    for (const d of fresh) candidates.add(d);
+    if (!exited) candidates.add(pid);
+    if (candidates.size === 0) return true;
+    // 5. Force-kill. Snapshot #2 is the pre-kill verify table (captured just
+    //    now, immediately before signalling) — no per-pid queries.
+    await killVerified([...candidates], snapshotToken, after.tokenOf);
+    return true;
+}

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -4,6 +4,7 @@ import { join } from 'path';
 import { tmpdir } from 'os';
 import { randomUUID } from 'crypto';
 import { smartReadTruncate } from '../tools/builtin/read-formatting.mjs';
+import { shutdownStdioChild } from './child-tree.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -182,7 +183,7 @@ export async function executeMcpTool(name, args) {
         mcpLog(`[mcp-client] Tool call failed, attempting reconnect...\n`);
         await new Promise(r => setTimeout(r, 500));
         try {
-            await server.client.close();
+            await _closeServer(server);
         } catch { /* ignore close error */ }
         try {
             await connectServer(serverName, server.cfg);
@@ -241,7 +242,9 @@ async function _callToolWithTimeout(server, toolName, args) {
     }
     const timeout = new Promise((_, rej) => {
         timer = setTimeout(() => {
-            try { server.client.close().catch(() => {}); } catch { /* ignore */ }
+            // Route through the full tree-shutdown path so a timed-out stdio
+            // server never orphans grandchildren. Fire-and-forget.
+            try { _closeServer(server).catch(() => {}); } catch { /* ignore */ }
             const err = new Error(`MCP tool call timed out after ${timeoutMs}ms (server="${server.name}", tool="${toolName}")`);
             err.code = 'EMCPTOOLTIMEOUT';
             err.serverName = server.name;
@@ -338,13 +341,47 @@ export function mcpToolHasField(name, field) {
 export async function disconnectAll() {
     for (const [name, server] of servers) {
         try {
-            await server.client.close();
+            await _closeServer(server);
         }
         catch { /* ignore */ }
         servers.delete(name);
     }
     _invalidateMcpToolFieldMemo();
 }
+/**
+ * Disconnect a single MCP server by name. No-op (returns false) when the
+ * server is not in the live registry; otherwise closes its transport, removes
+ * it, and invalidates the tool-field memo. Lets callers toggle one server
+ * without a full disconnectAll()/reconnect cycle.
+ */
+export async function disconnectMcpServer(name) {
+    const server = servers.get(name);
+    if (!server) return false;
+    try {
+        await _closeServer(server);
+    }
+    catch { /* ignore */ }
+    servers.delete(name);
+    _invalidateMcpToolFieldMemo();
+    return true;
+}
+/**
+ * Close a single server: for stdio transports first shut down the full child
+ * process tree (close stdin -> grace -> tree kill) so wrapper chains such as
+ * uvx/npx/uv never orphan grandchildren, then release the SDK client. The
+ * tree teardown runs before client.close() because the SDK's own close()
+ * only kills the direct child and discards the pid we need to walk the tree.
+ */
+async function _closeServer(server) {
+    const transport = server?.transport;
+    // Live stdio transports expose the spawned ChildProcess on _process.
+    if (transport && transport._process) {
+        try { await shutdownStdioChild(transport); }
+        catch { /* ignore */ }
+    }
+    try { await server.client.close(); }
+    catch { /* ignore */ }
+}
 async function connectServer(name, cfg) {
     const {
         Client,

package/src/runtime/agent/orchestrator/providers/openai-compat-stream.mjs

@@ -514,7 +514,7 @@ function handleCompatResponsesStreamEvent(event, state, { label, parseResponsesT
             : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: callId, name: 'tool_search', finishReason: 'done' });
         const call = {
             id: callId,
-            name: 'tool_search',
+            name: 'load_tool',
             // Schema is a plain object ({query,select,limit}); an array must
             // never pass through as args.
             arguments: (_tsArgs && typeof _tsArgs === 'object' && !Array.isArray(_tsArgs)) ? _tsArgs : {},

package/src/runtime/agent/orchestrator/providers/openai-compat-wire.mjs

@@ -107,7 +107,9 @@ export function toOpenAITools(tools) {
 
 export function toResponsesTools(tools) {
     return tools.map((t) => {
-        if (t?.name === 'tool_search') {
+        // load_tool advertises as the OpenAI-native `tool_search` wire type
+        // (legacy 'tool_search' name still accepted for back-compat).
+        if (t?.name === 'load_tool' || t?.name === 'tool_search') {
             return {
                 type: 'tool_search',
                 execution: 'client',
@@ -193,7 +195,7 @@ export function parseResponsesToolCalls(response, label) {
                 : parseCompletedToolCallArgumentsJson(item.arguments || '{}', label, { id: item.call_id || item.id, name: 'tool_search', finishReason });
             out.push({
                 id: item.call_id || item.id,
-                name: 'tool_search',
+                name: 'load_tool',
                 // Schema is a plain object ({query,select,limit}); an array
                 // (parsed JSON or passthrough) must never pass through as args.
                 arguments: (_tsArgs && typeof _tsArgs === 'object' && !Array.isArray(_tsArgs)) ? _tsArgs : {},
@@ -294,7 +296,7 @@ export function toResponsesInputMessage(m, pendingToolMedia = null, customToolCa
         const items = [];
         if (m.content) items.push({ role: 'assistant', content: normalizeContentForOpenAIResponses(m.content, { role: 'assistant' }) });
         for (const tc of m.toolCalls) {
-            if (tc.nativeType === 'tool_search_call' || tc.name === 'tool_search') {
+            if (tc.nativeType === 'tool_search_call' || tc.name === 'load_tool' || tc.name === 'tool_search') {
                 items.push({
                     type: 'tool_search_call',
                     call_id: tc.id,

package/src/runtime/agent/orchestrator/providers/openai-oauth-http-sse.mjs

@@ -451,7 +451,7 @@ export async function sendViaHttpSse({
         }
         const call = {
             id: callId,
-            name: 'tool_search',
+            name: 'load_tool',
             arguments: args,
             nativeType: 'tool_search_call',
         };
@@ -501,7 +501,7 @@ export async function sendViaHttpSse({
                     // mistakes it for a function call by id collision/empty id.
                     if (event.item.id) {
                         pendingCalls.set(event.item.id, {
-                            name: 'tool_search',
+                            name: 'load_tool',
                             callId: event.item.call_id || '',
                             kind: 'tool_search',
                         });

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -444,7 +444,7 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
             // reasoning in `input` triggers "Duplicate item".
             if (m.content) out.push({ role: 'assistant', content: normalizeContentForOpenAIResponses(m.content, { role: 'assistant' }) });
             for (const tc of m.toolCalls) {
-                if (tc.nativeType === 'tool_search_call' || tc.name === 'tool_search') {
+                if (tc.nativeType === 'tool_search_call' || tc.name === 'load_tool' || tc.name === 'tool_search') {
                     out.push({
                         type: 'tool_search_call',
                         call_id: tc.id,
@@ -480,7 +480,7 @@ function convertMessagesToResponsesInput(messages, opts = {}) {
 }
 
 function toOpenAIResponsesTool(t) {
-    if (t?.name === 'tool_search') {
+    if (t?.name === 'load_tool' || t?.name === 'tool_search') {
         return {
             type: 'tool_search',
             execution: 'client',

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -355,7 +355,7 @@ export async function _streamResponse({
         if (!callId || toolCalls.some((call) => call.id === callId)) return;
         const call = {
             id: callId,
-            name: 'tool_search',
+            name: 'load_tool',
             arguments: parseToolSearchArgs(item.arguments),
             nativeType: 'tool_search_call',
         };

package/src/runtime/agent/orchestrator/session/loop/completion-guards.mjs

@@ -24,8 +24,9 @@ export function crossTurnSignature(name, args) {
 
 // Tool names that are non-eager (no readOnlyHint) but are NOT edits/progress —
 // they must not reset the escalation ladder's "zero edit" condition. Skill /
-// recall / agent / task / cwd / tool_search are exploration/meta plumbing.
-const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'tool_search']);
+// recall / agent / task / cwd / load_tool are exploration/meta plumbing.
+// (tool_search kept as legacy alias for old transcripts.)
+const NON_PROGRESS_TOOLS = new Set(['Skill', 'recall', 'agent', 'task', 'cwd', 'load_tool', 'tool_search']);
 
 // True when a successfully-executed tool represents real edit/progress. A tool
 // counts as progress only if its def lacks readOnlyHint (not eager) AND it is

package/src/runtime/agent/orchestrator/session/loop/deferred-call-through.mjs

@@ -1,7 +1,7 @@
 // Deferred catalog call-through: inactive catalog tool_use → discovery bookkeeping
 // then normal executeTool routing (runtime errors only; no pre-dispatch schema).
 import { clean } from '../../../../../session-runtime/session-text.mjs';
-import { isReadonlySelectable, selectDeferredTools } from '../../../../../session-runtime/tool-catalog.mjs';
+import { deferredCatalogUnion, isReadonlySelectable, selectDeferredTools } from '../../../../../session-runtime/tool-catalog.mjs';
 
 /** Skill-list plumbing only; mutation/MCP/builtins must use the catalog+mode gate. */
 const INACTIVE_INFRA_BYPASS = new Set(['skills_list', 'skill_view']);
@@ -13,7 +13,10 @@ function isActiveSessionTool(session, name) {
 }
 
 function lookupDeferredCatalogTool(session, name) {
-    const catalog = Array.isArray(session?.deferredToolCatalog) ? session.deferredToolCatalog : [];
+    // Union of the boot-frozen catalog and the late-connected MCP catalog so a
+    // direct call to a tool whose server connected after boot resolves and
+    // auto-loads (selectDeferredTools promotes it onto session.tools).
+    const catalog = deferredCatalogUnion(session);
     const key = clean(name);
     if (!key) return null;
     for (const tool of catalog) {
@@ -66,7 +69,7 @@ export function prepareDeferredToolCallThrough(sessionRef, name, _args) {
     if (resolvedMode === null) {
         if (!isReadonlySelectable(tool)) {
             return denyDeferredCallThrough(
-                `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; use tool_search or load it explicitly.`,
+                `Error: tool "${toolLabel}" is deferred and cannot be auto-loaded without a resolved tool mode; load it with load_tool names:["${toolLabel}"].`,
             );
         }
     } else if (resolvedMode === 'readonly' && !isReadonlySelectable(tool)) {

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -81,7 +81,7 @@ export function resolveToolResultAfterHook(originalResult, hookResult) {
 }
 
 export function parseNativeToolSearchPayload(toolName, result) {
-    if (toolName !== 'tool_search' || typeof result !== 'string') return null;
+    if ((toolName !== 'load_tool' && toolName !== 'tool_search') || typeof result !== 'string') return null;
     try {
         const parsed = JSON.parse(result);
         const native = parsed?.nativeToolSearch;

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -74,6 +74,39 @@ function recallMemoryTimeoutMs(session) {
     // misconfigured tiny value can't turn the bound into a busy no-wait.
     return Math.max(250, configured || RECALL_MEMORY_CALL_TIMEOUT_MS);
 }
+// Cold-start allowance (clear/manual path only): a booting memory daemon can
+// miss the tight first bound (waitForPort + first-RPC warmup ~2-10s). On a
+// timeout we retry ONCE with a longer bound before honoring the bail-to-
+// semantic contract, so a rebooting runtime succeeds instead of instantly
+// failing. Non-timeout errors and outer aborts propagate immediately.
+// 15s: memory boot is ~2-4s warm-cache / ~10s worst since the PG fast-start
+// fix; keeping this tight bounds the clear path's worst case (2 memory calls
+// retried + 120s semantic) under the TUI auto-clear watchdog (180s).
+const RECALL_COLD_START_TIMEOUT_MS = 15_000;
+function isTimeoutError(err) {
+    return typeof err?.message === 'string' && err.message.includes('timed out after');
+}
+async function callMemoryColdStart(args, callerCtx, timeoutMs) {
+    try {
+        return await callMemoryBounded(args, callerCtx, timeoutMs);
+    } catch (err) {
+        if (!isTimeoutError(err) || callerCtx?.signal?.aborted) throw err;
+        const coldMs = Math.max(timeoutMs, RECALL_COLD_START_TIMEOUT_MS);
+        if (coldMs <= timeoutMs) throw err;
+        try { process.stderr.write(`[session] recall-fasttrack ${args?.action || 'call'} cold-start retry (${timeoutMs}ms -> ${coldMs}ms)\n`); } catch {}
+        return await callMemoryBounded(args, callerCtx, coldMs);
+    }
+}
+// Semantic-compact timeout scales with transcript size (clear/manual path):
+// default max(30s, ~10s per 25k estimated message tokens) capped at 120s, so a
+// large (~100k-token) transcript no longer dies on a fixed 30s bound.
+// session.compaction.timeoutMs still overrides.
+function semanticCompactTimeoutMs(session, messageTokens) {
+    const override = positiveContextWindow(session?.compaction?.timeoutMs);
+    if (override) return override;
+    const scaled = Math.ceil((messageTokens || 0) / 25_000) * 10_000;
+    return Math.min(120_000, Math.max(30_000, scaled));
+}
 async function callMemoryBounded(args, callerCtx, timeoutMs) {
     const ac = new AbortController();
     const outer = callerCtx?.signal;
@@ -118,7 +151,7 @@ async function runRecallFastTrackForSession(session, messages, opts = {}) {
         || Math.max(500, Math.min(5000, messages.length || 0));
     const memoryTimeoutMs = recallMemoryTimeoutMs(session);
     try {
-        await callMemoryBounded({
+        await callMemoryColdStart({
             action: 'ingest_session',
             sessionId,
             messages,
@@ -140,7 +173,7 @@ async function runRecallFastTrackForSession(session, messages, opts = {}) {
     // digest.
     let recallText = '';
     try {
-        const browsed = await callMemoryBounded({
+        const browsed = await callMemoryColdStart({
             action: 'search',
             sessionId,
             limit: positiveContextWindow(session?.compaction?.recallDigestLimit) || 30,
@@ -298,7 +331,7 @@ export async function runSessionCompaction(session, opts = {}) {
                             signal: opts.signal || null,
                             promptCacheKey: session.promptCacheKey || null,
                             providerCacheKey: session.promptCacheKey || null,
-                            timeoutMs: positiveContextWindow(session.compaction?.timeoutMs) || 30_000,
+                            timeoutMs: semanticCompactTimeoutMs(session, beforeMessageTokens),
                             tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
                             keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
                             preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),
@@ -341,7 +374,7 @@ export async function runSessionCompaction(session, opts = {}) {
                     signal: opts.signal || null,
                     promptCacheKey: session.promptCacheKey || null,
                     providerCacheKey: session.promptCacheKey || null,
-                    timeoutMs: positiveContextWindow(session.compaction?.timeoutMs) || 30_000,
+                    timeoutMs: semanticCompactTimeoutMs(session, beforeMessageTokens),
                     tailTurns: positiveContextWindow(session.compaction?.tailTurns) || 2,
                     keepTokens: positiveContextWindow(session.compaction?.keepTokens ?? session.compaction?.keep?.tokens),
                     preserveRecentTokens: positiveContextWindow(session.compaction?.preserveRecentTokens),

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -314,6 +314,11 @@ export function createSession(opts) {
         },
         tools,
         preset: toolPreset,
+        // Persisted so the deferred call-through gate (deferred-call-through.mjs
+        // resolveDeferredSelectMode) can resolve the session's tool mode; without
+        // this every session read `undefined` and write-capable deferred tools
+        // (e.g. MCP) were permanently denied auto-promotion.
+        toolSpec,
         presetName: presetObj?.name || null,
         effort,
         fast,
@@ -459,6 +464,8 @@ export async function resumeSession(sessionId, preset) {
     if (ownerIsAgent) {
         toolsForRouting = applyToolPermissionNarrowing(toolsForRouting, session.toolPermission, session.agent || null);
     }
+    // Keep the persisted tool mode in sync on resume (see createSession note).
+    session.toolSpec = toolSpec;
     session.tools = finalizeSessionToolList(toolsForRouting, {
         schemaAllowedTools: Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null,
         disallowedTools: getHiddenAgent(session.agent || null) ? ['Skill'] : null,

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -45,17 +45,20 @@ const _lastSaveError = new Map(); // id -> { message, at }
 // starving the model of the image mid-conversation. Returns the same object
 // reference when nothing changed (no-image sessions pay only a shallow scan).
 function _sessionForDisk(session) {
-    // Strip the in-flight live-turn alias (askSession sets session.liveTurnMessages
-    // for the turn duration so contextStatus() can estimate live context growth).
-    // It is a transient duplicate of the working transcript and must never be
-    // serialized: mid-turn saves (persistIterationMetrics) would otherwise bloat
-    // the session file and persist a non-canonical message array.
-    const hasLiveTurn = session && typeof session === 'object'
-        && Object.prototype.hasOwnProperty.call(session, 'liveTurnMessages');
+    // Strip transient in-flight aliases askSession sets for the turn duration:
+    //  - liveTurnMessages: live working transcript (so contextStatus() can
+    //    estimate live context growth) — a duplicate of the working transcript
+    //    that must never be serialized (mid-turn saves would bloat the file and
+    //    persist a non-canonical message array).
+    //  - toolApprovalHook: the askOpts.onToolApproval callback wired for the
+    //    turn — a function that must never be serialized.
+    const hasTransient = session && typeof session === 'object'
+        && (Object.prototype.hasOwnProperty.call(session, 'liveTurnMessages')
+            || Object.prototype.hasOwnProperty.call(session, 'toolApprovalHook'));
     const messages = Array.isArray(session?.messages) ? session.messages : null;
     if (!messages || messages.length === 0) {
-        if (!hasLiveTurn) return session;
-        const { liveTurnMessages: _drop, ...rest } = session;
+        if (!hasTransient) return session;
+        const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
         return rest;
     }
     let changed = false;
@@ -66,11 +69,11 @@ function _sessionForDisk(session) {
         return m;
     });
     if (!changed) {
-        if (!hasLiveTurn) return session;
-        const { liveTurnMessages: _drop, ...rest } = session;
+        if (!hasTransient) return session;
+        const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
         return rest;
     }
-    const { liveTurnMessages: _drop, ...rest } = session;
+    const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
     return { ...rest, messages: out };
 }
 
@@ -305,13 +308,26 @@ export function saveSessionAsync(session, opts) {
     setLiveSession(session);
     const reqId = ++_saveWorkerReqId;
     const safeOpts = opts || null;
+    // The Worker `postMessage` below structured-clones the whole session on the
+    // main thread. `session.liveTurnMessages` (live working transcript) and
+    // `session.toolApprovalHook` (askOpts.onToolApproval callback) are transient
+    // in-flight aliases askSession sets for the turn duration; both carry
+    // non-cloneable values (a function, and raw messages that can hold functions),
+    // which makes structuredClone throw "could not be cloned" for every mid-turn
+    // iteration save. The worker strips both via _sessionForDisk anyway, so drop
+    // them from the cloned payload here WITHOUT mutating the live session object.
+    const clonePayload = (session && typeof session === 'object'
+        && (Object.prototype.hasOwnProperty.call(session, 'liveTurnMessages')
+            || Object.prototype.hasOwnProperty.call(session, 'toolApprovalHook')))
+        ? (() => { const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session; return rest; })()
+        : session;
     return new Promise((resolve, reject) => {
         // Persist {session, opts} so drainSessionStore can sync-flush
         // outstanding writes if process exit interrupts the worker queue.
-        _saveWorkerPending.set(reqId, { resolve, reject, session, opts: safeOpts });
+        _saveWorkerPending.set(reqId, { resolve, reject, session: clonePayload, opts: safeOpts });
         try {
             const w = _getOrSpawnWorker();
-            w.postMessage({ session, opts: safeOpts, reqId });
+            w.postMessage({ session: clonePayload, opts: safeOpts, reqId });
             // Ref AFTER successful postMessage so a queue/throw failure path
             // does not leave the worker held alive with no pending message.
             // Paired with the unref in the message handler when count hits 0.

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-paths.mjs

@@ -109,7 +109,7 @@ async function sweepStaleShellJobs(dir) {
     });
     await Promise.all([
         ...expired.flatMap((jobId) =>
-            ['.json', '.done', '.exit', '.enforced', '.exit.cmd.sh', '.exit.cmd.ps1', '.stdout.log', '.stderr.log'].map((ext) =>
+            ['.json', '.done', '.exit', '.enforced', '.exit.cmd.sh', '.exit.cmd.ps1', '.exit.user.ps1', '.stdout.log', '.stderr.log'].map((ext) =>
                 fsPromises.unlink(join(dir, jobId + ext)).catch(() => {}),
             ),
         ),