mixdog 0.9.23 → 0.9.24

package/src/runtime/shared/atomic-file.mjs

@@ -13,7 +13,10 @@ import {
 } from 'fs';
 import { dirname, basename, join } from 'path';
 import { randomBytes } from 'crypto';
-import { execFileSync } from 'child_process';
+import { execFile, execFileSync } from 'child_process';
+import { promisify } from 'util';
+
+const _execFileAsync = promisify(execFile);
 
 const RETRY_CODES = new Set(['EPERM', 'EACCES', 'EBUSY', 'EEXIST']);
 const LOCK_WAIT_CODES = new Set(['EEXIST', 'EPERM', 'EACCES', 'EBUSY']);
@@ -419,7 +422,10 @@ export async function withFileLock(lockPath, fn, opts = {}) {
     }
     try { writeFileSync(fd, `${process.pid} ${Date.now()} ${_OWNER_TOKEN}\n`, 'utf8'); } catch {}
     try {
-      if (opts.secret === true) _enforceOwnerOnlyAclWin32(lockPath);
+      // Async ACL enforcement (promisified execFile) so a secret-bearing
+      // async holder never blocks the event loop on icacls; identical
+      // fail-closed semantics to the sync variant.
+      if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(lockPath);
       return await fn();
     } finally {
       try { closeSync(fd); } catch {}
@@ -523,6 +529,59 @@ function _enforceOwnerOnlyAclWin32(targetPath) {
   }
 }
 
+// ── Async owner-only ACL enforcement (non-blocking, fail-closed) ─────
+// Byte-for-byte the same policy as `_enforceOwnerOnlyAclWin32`, but the two
+// icacls invocations (and the one-time whoami SID resolution) run through
+// promisified execFile so the event loop is never blocked on a subprocess.
+// Shares the `_cachedUserSid` cache with the sync variant, and throws the
+// same EACL* codes so callers keep their fail-closed guarantees.
+async function _resolveCurrentUserPrincipalAsync() {
+  const systemRoot = process.env.SystemRoot || process.env.windir;
+  if (systemRoot) {
+    const whoami = join(systemRoot, 'System32', 'whoami.exe');
+    if (existsSync(whoami)) {
+      try {
+        const { stdout } = await _execFileAsync(whoami, ['/user', '/fo', 'csv', '/nh'], {
+          encoding: 'utf8',
+          windowsHide: true,
+        });
+        const m = String(stdout).match(/S-1-5-[0-9-]+/);
+        if (m) return m[0];
+      } catch {}
+    }
+  }
+  const err = new Error('cannot resolve current Windows user for owner-only ACL enforcement');
+  err.code = 'EACLNOUSER';
+  throw err;
+}
+
+async function _enforceOwnerOnlyAclWin32Async(targetPath) {
+  if (process.platform !== 'win32') return;
+  const systemRoot = process.env.SystemRoot || process.env.windir;
+  if (!systemRoot) {
+    const err = new Error('SystemRoot not set; cannot locate icacls.exe for owner-only ACL enforcement');
+    err.code = 'EACLNOROOT';
+    throw err;
+  }
+  const icacls = join(systemRoot, 'System32', 'icacls.exe');
+  if (!existsSync(icacls)) {
+    const err = new Error(`icacls.exe not found at ${icacls}; refusing to leave secret world-readable`);
+    err.code = 'EACLNOICACLS';
+    throw err;
+  }
+  if (_cachedUserSid === null) _cachedUserSid = await _resolveCurrentUserPrincipalAsync();
+  const principal = _icaclsPrincipal(_cachedUserSid);
+  try {
+    await _execFileAsync(icacls, [targetPath, '/reset'], { windowsHide: true });
+    await _execFileAsync(icacls, [targetPath, '/inheritance:r', '/grant:r', `${principal}:(F)`], { windowsHide: true });
+  } catch (err) {
+    const e = new Error(`icacls failed to apply owner-only ACL to ${targetPath}: ${err?.message || err}`);
+    e.code = 'EACLFAIL';
+    e.cause = err;
+    throw e;
+  }
+}
+
 export function writeFileAtomicSync(filePath, data, opts = {}) {
   const run = () => {
     const dir = dirname(filePath);
@@ -648,6 +707,75 @@ export function updateJsonAtomicSync(filePath, mutator, opts = {}) {
   }, opts);
 }
 
+// ── Async atomic file write (non-blocking secret ACL) ───────────────
+// Mirror of writeFileAtomicSync, but the owner-only ACL enforcement on the
+// temp and final path runs through the async icacls variant so a debounced
+// timer flush never blocks the event loop on a subprocess. The tiny
+// writeFileSync/renameSync of a small JSON payload stay synchronous (they are
+// not the hitch); only the icacls calls — the actual blockers — are awaited.
+// The truncate renameFallback branch is intentionally omitted: it only ever
+// applied to non-secret writes (opts.secret !== true), and every async caller
+// here is a secret config write, so behavior is identical.
+export async function writeFileAtomicAsync(filePath, data, opts = {}) {
+  const run = async () => {
+    const dir = dirname(filePath);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.${basename(filePath)}.${randomBytes(12).toString('hex')}.tmp`);
+    try {
+      const writeOpts = { encoding: opts.encoding || 'utf8', flag: 'wx', mode: opts.mode !== undefined ? opts.mode : 0o600 };
+      writeFileSync(tmp, data, writeOpts);
+      if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(tmp);
+      if (opts.fsync !== false) {
+        let fd = null;
+        try {
+          fd = openSync(tmp, 'r');
+          fsyncSync(fd);
+        } catch (err) {
+          if (!['EPERM', 'ENOTSUP', 'EINVAL'].includes(err?.code)) throw err;
+        } finally {
+          try { if (fd !== null) closeSync(fd); } catch {}
+        }
+      }
+      if (opts.createOnly === true) {
+        try {
+          linkSync(tmp, filePath);
+        } catch (err) {
+          try { unlinkSync(tmp); } catch {}
+          if (err?.code === 'EEXIST') return false;
+          throw err;
+        }
+        try { unlinkSync(tmp); } catch {}
+      } else {
+        renameWithRetrySync(tmp, filePath, opts);
+      }
+      if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(filePath);
+      if (opts.fsyncDir === true) {
+        let dfd = null;
+        try {
+          dfd = openSync(dir, 'r');
+          fsyncSync(dfd);
+        } catch (err) {
+          if (!['EPERM', 'ENOTSUP', 'EINVAL', 'EACCES'].includes(err?.code)) throw err;
+        } finally {
+          try { if (dfd !== null) closeSync(dfd); } catch {}
+        }
+      }
+      return true;
+    } catch (err) {
+      try { if (existsSync(tmp)) unlinkSync(tmp); } catch {}
+      throw err;
+    }
+  };
+  if (opts.lock === true) {
+    return withFileLock(`${filePath}.lock`, run, opts);
+  }
+  return run();
+}
+
+export function writeJsonAtomicAsync(filePath, value, opts = {}) {
+  return writeFileAtomicAsync(filePath, JSON.stringify(value, null, opts.compact ? 0 : 2) + '\n', opts);
+}
+
 // Async read-modify-write. Same lock path (`${filePath}.lock`) and protocol
 // as updateJsonAtomicSync, so it is mutually exclusive with the sync variant.
 // The critical section itself is synchronous (readFileSync + writeJsonAtomicSync);

package/src/runtime/shared/background-tasks.mjs

@@ -51,7 +51,7 @@ export function executionModeSchemaDescription(defaultMode = 'sync') {
   if (defaultMode === 'async') {
     return 'sync = inline result; async = task_id + completion notification. Default async.';
   }
-  return 'Runs sync; long-running auto-promotes to a background task_id + completion notification. async forces background.';
+  return 'Runs sync (inline result); no default auto-background. async forces a background task_id + completion notification.';
 }
 
 export function taskIdFromArgs(args = {}) {

package/src/runtime/shared/config.mjs

@@ -6,9 +6,10 @@ import { readFileSync, mkdirSync, existsSync } from 'fs'
 import { join, dirname } from 'path'
 import { createRequire } from 'module'
 import { resolvePluginData } from './plugin-paths.mjs'
-import { renameWithRetrySync, writeJsonAtomicSync, withFileLockSync } from './atomic-file.mjs'
+import { renameWithRetrySync, writeJsonAtomicSync, writeJsonAtomicAsync, withFileLockSync, withFileLock } from './atomic-file.mjs'
 import {
   backupUserData,
+  backupUserDataAsync,
   markUserDataInitialized,
   loadLatestMixdogConfigFromBackup,
   hasUserDataInitMarker,
@@ -210,6 +211,57 @@ export function updateSection(section, updater) {
   })
 }
 
+// ── Async write path (non-blocking) ─────────────────────────────────
+// Parity with the sync RMW above, but every heavy blocker (cross-process
+// lock wait, owner-only icacls ACL, user-data backup copy tree) is awaited
+// off the event loop. Reuses the SAME lock file (`${CONFIG_PATH}.lock`) and
+// secret:true ACL protocol, so an async writer and a sync writer are mutually
+// exclusive against one another AND against other processes — cross-process
+// RMW linearizability is preserved. The in-lock read (readAllForRmW) stays
+// synchronous: it is a small local read, not the hitch source.
+async function writeJsonFileAsync(path, data) {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 })
+  if (path === CONFIG_PATH) {
+    try { await backupUserDataAsync(DATA_DIR, 'pre-config-write') } catch {}
+  }
+  await writeJsonAtomicAsync(path, data, { lock: false, fsyncDir: true, mode: 0o600, secret: true })
+  if (path === CONFIG_PATH) {
+    try { markUserDataInitialized(DATA_DIR) } catch {}
+    try { await backupUserDataAsync(DATA_DIR, 'post-config-write') } catch {}
+  }
+}
+
+async function writeAllAsync(data) {
+  await writeJsonFileAsync(CONFIG_PATH, data)
+}
+
+// secret:true clamps the shared-home lock file owner-only on win32 via the
+// ASYNC icacls variant inside withFileLock (fail-closed, non-blocking).
+function withConfigLockAsync(fn) {
+  return withFileLock(`${CONFIG_PATH}.lock`, fn, { secret: true })
+}
+
+export async function updateConfigAsync(updater) {
+  let saved = null
+  await withConfigLockAsync(async () => {
+    const current = stripGeneratedMarker(readAllForRmW()) || {}
+    const next = typeof updater === 'function' ? updater({ ...current }) : updater
+    if (!isPlainObject(next)) throw new Error('[config] updateConfigAsync updater must return an object')
+    saved = stripGeneratedMarker(next) || {}
+    await writeAllAsync(saved)
+  })
+  return saved
+}
+
+export async function updateSectionAsync(section, updater) {
+  await withConfigLockAsync(async () => {
+    const all = readAllForRmW()
+    const current = stripGeneratedMarker(all[section] || {})
+    all[section] = stripGeneratedMarker(typeof updater === 'function' ? updater(current) : updater)
+    await writeAllAsync(all)
+  })
+}
+
 // ── Capabilities (B2 central path policy) ───────────────────────────
 // Top-level `capabilities` section in mixdog-config.json. Safe defaults
 // win on missing/malformed input — every cap is OFF unless explicitly

package/src/runtime/shared/tool-execution-contract.mjs

@@ -2,7 +2,7 @@ export const TOOL_SYNC_EXECUTION_CONTRACT =
   'Runs synchronously in this tool call.';
 
 export const TOOL_ASYNC_EXECUTION_CONTRACT =
-  'Runs sync; long-running auto-promotes to a task_id + completion notification. async forces background. status/read/wait are recovery/blocking only.';
+  'Runs sync inline; no default auto-background. async forces a background task_id + completion notification. status/read/wait are recovery/blocking only.';
 
 export const TOOL_MANUAL_CONTROL_CONTRACT =
   'wait/read/status/cancel are for explicit blocking or recovery only.';

package/src/runtime/shared/tool-surface.mjs

@@ -583,6 +583,25 @@ export function aggregateToolCategoryEntry(name, args = {}, category = '') {
   };
 }
 
+/**
+ * Rebuild the per-category count map for the DONE state, excluding calls that
+ * terminated in an error (rec.isError). Mirrors the call-time accumulation in
+ * turn.mjs (sum aggregateToolCategoryEntry(...).count per key) but drops failed
+ * calls so the completed label counts only successful work — across ALL
+ * categories, not just Memory. The active/in-flight header keeps using the raw
+ * `categories` map, so in-flight counting is unchanged.
+ */
+export function aggregateDoneCategories(calls = []) {
+  const map = new Map();
+  for (const rec of calls || []) {
+    if (!rec || rec.isError) continue;
+    const entry = aggregateToolCategoryEntry(rec.name, rec.args, rec.category);
+    const prev = map.get(entry.key);
+    map.set(entry.key, { ...entry, count: Number(prev?.count || 0) + Number(entry.count || 1) });
+  }
+  return Object.fromEntries(map);
+}
+
 function aggregateCount(value) {
   if (value && typeof value === 'object') return Math.max(0, Number(value.count || 0));
   return Math.max(0, Number(value || 0));

package/src/runtime/shared/update-checker.mjs

@@ -188,6 +188,9 @@ export function runGlobalUpdate() {
       child = spawn(npmCmd, ['install', '-g', `${PACKAGE_NAME}@latest`], {
         stdio: 'ignore',
         windowsHide: true,
+        // detached: survive parent exit — quitting the TUI mid-install must
+        // not kill npm halfway and leave the global install corrupted.
+        detached: true,
         shell: process.platform === 'win32',
       });
     } catch (err) {

package/src/runtime/shared/user-data-guard.mjs

@@ -8,6 +8,13 @@ import {
   statSync,
   writeFileSync,
 } from 'fs';
+import {
+  copyFile as copyFileP,
+  mkdir as mkdirP,
+  readdir as readdirP,
+  rm as rmP,
+  stat as statP,
+} from 'fs/promises';
 import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
 import { createHash } from 'crypto';
@@ -158,6 +165,65 @@ export function backupUserData(dataDir, reason = 'snapshot') {
   return { dir: copied.length > 0 ? backupDir : null, copied };
 }
 
+// ── Async backup variant (fs.promises) ──────────────────────────────
+// Byte-for-byte the same policy/skip guards/prune behavior as backupUserData,
+// but every filesystem op yields via fs.promises so a debounced config flush
+// on the UI event loop never blocks on the copy tree or the prune sweep.
+async function copyTreeAsync(src, dst, copied) {
+  const st = await statP(src);
+  if (st.isDirectory()) {
+    for (const name of await readdirP(src)) {
+      await copyTreeAsync(join(src, name), join(dst, name), copied);
+    }
+    return;
+  }
+  if (!st.isFile()) return;
+  await mkdirP(dirname(dst), { recursive: true });
+  await copyFileP(src, dst);
+  copied.push(dst);
+}
+
+async function pruneBackupsAsync(keep = 40) {
+  let entries = [];
+  try {
+    entries = (await readdirP(getBackupRoot(), { withFileTypes: true }))
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .sort()
+      .reverse();
+  } catch {
+    return;
+  }
+  for (const name of entries.slice(keep)) {
+    try { await rmP(join(getBackupRoot(), name), { recursive: true, force: true }); } catch {}
+  }
+}
+
+export async function backupUserDataAsync(dataDir, reason = 'snapshot') {
+  if (process.env.MIXDOG_SKIP_USER_DATA_BACKUP === '1' || process.env.MIXDOG_SKIP_USER_DATA_BACKUP === 'true') {
+    return { dir: null, copied: [] };
+  }
+  if (!dataDir || !existsSync(dataDir)) return { dir: null, copied: [] };
+  const backupDir = join(getBackupRoot(), `${stamp()}-${safeReason(reason)}`);
+  const copied = [];
+  for (const rel of USER_DATA_FILES) {
+    const src = join(dataDir, rel);
+    if (existsSync(src)) await copyTreeAsync(src, join(backupDir, rel), copied);
+  }
+  for (const rel of USER_DATA_DIRS) {
+    const src = join(dataDir, rel);
+    if (existsSync(src)) await copyTreeAsync(src, join(backupDir, rel), copied);
+  }
+  if (copied.length > 0) {
+    markUserDataInitialized(dataDir);
+    await pruneBackupsAsync();
+    if (process.env.MIXDOG_SETUP_QUIET !== '1') {
+      process.stderr.write(`[user-data-backup] ${reason}: copied ${copied.length} file(s) to ${backupDir}\n`);
+    }
+  }
+  return { dir: copied.length > 0 ? backupDir : null, copied };
+}
+
 export function shouldSeedMissingUserData(dataDir, rel) {
   if (!dataDir) return true;
   if (existsSync(join(dataDir, rel))) {

package/src/session-runtime/config-lifecycle.mjs

@@ -31,6 +31,7 @@ export function createConfigLifecycle({
   cfgMod,
   sharedCfgMod,
   setBackend,
+  setBackendAsync,
   setConfiguredShell,
   normalizeSystemShellConfig,
   normalizeSearchRouteConfig,
@@ -90,8 +91,61 @@ export function createConfigLifecycle({
   }
 
   // --- debounced config save --------------------------------------------------
+  // Coexistence strategy (sync vs async flush):
+  //  * The debounce TIMER fires the ASYNC flush (async lock wait + async icacls
+  //    + async backup + async atomic write) so a toggle never blocks the UI
+  //    event loop.
+  //  * Per-channel serialization: each channel keeps ONE in-flight promise tail;
+  //    a new async flush chains after it so flushes never interleave. The pending
+  //    payload is re-read at write time (identity guard), so a burst collapses to
+  //    the last writer without dropping a newer toggle.
+  //  * The SYNC flush is retained for reloadFullConfig/teardown (they need the
+  //    write durable before continuing). It nulls the pending payload and writes
+  //    synchronously; that sync write takes the SAME cross-process lock file as
+  //    any in-flight async write, so it serializes AFTER it (lock contention),
+  //    and the async loop's identity guard then finds a null/superseded payload
+  //    and does not rewrite — never a revert, and no double-write except a rare
+  //    idempotent same-content window if a sync flush lands mid async disk-write.
   let pendingConfigToSave = null;
   let configSaveTimer = null;
+  let configFlushInFlight = null;
+
+  async function runConfigFlushAsync() {
+    // Drain config, then skills, and RE-CHECK config. A config snapshot queued
+    // after the skills patch may carry a stale snapshot.skills (the snapshot
+    // captured an older config object ref, before the skills toggle replaced it)
+    // that would overwrite the just-patched skills.disabled. Looping until BOTH
+    // channels are quiescent keeps the skills patch the last writer relative to
+    // EVERY pending/queued config snapshot.
+    do {
+      let configFailed = false;
+      while (pendingConfigToSave !== null) {
+        const snapshot = pendingConfigToSave;
+        try {
+          await cfgMod.saveConfigAsync(snapshot);
+        } catch (err) {
+          process.stderr.write(`[config] async saveConfig failed: ${err?.message || err}\n`);
+          // Keep the payload: a failed write must not drop the pending change.
+          configFailed = true;
+          break;
+        }
+        if (pendingConfigToSave === snapshot) pendingConfigToSave = null;
+      }
+      // Ordering invariant: skills.disabled patch lands AFTER the config save.
+      await flushSkillsSaveAsync();
+      if (configFailed) break; // avoid a hot spin on a persistently failing write
+    } while (pendingConfigToSave !== null);
+  }
+
+  function flushConfigSaveAsync() {
+    if (configSaveTimer) { clearTimeout(configSaveTimer); configSaveTimer = null; }
+    const start = () => runConfigFlushAsync();
+    const p = configFlushInFlight ? configFlushInFlight.then(start, start) : start();
+    configFlushInFlight = p;
+    const clear = () => { if (configFlushInFlight === p) configFlushInFlight = null; };
+    p.then(clear, clear);
+    return p;
+  }
 
   function flushConfigSave() {
     if (configSaveTimer) {
@@ -100,9 +154,13 @@ export function createConfigLifecycle({
     }
     if (pendingConfigToSave !== null) {
       const snapshot = pendingConfigToSave;
-      pendingConfigToSave = null;
       try {
         cfgMod.saveConfig(snapshot);
+        // Clear ONLY after a durable write. saveConfig blocks on the same
+        // cross-process lock an async flush may hold, so it serializes after it;
+        // if it still fails (e.g. lock timeout) we keep the payload so a later
+        // flush / reloadFullConfig retries instead of reverting to stale disk.
+        if (pendingConfigToSave === snapshot) pendingConfigToSave = null;
       } catch (err) {
         process.stderr.write(`[config] debounced saveConfig failed: ${err?.message || err}\n`);
       }
@@ -126,7 +184,7 @@ export function createConfigLifecycle({
     // disk write after CONFIG_SAVE_DEBOUNCE_MS of quiet.
     pendingConfigToSave = getConfig();
     if (configSaveTimer) clearTimeout(configSaveTimer);
-    configSaveTimer = setTimeout(flushConfigSave, CONFIG_SAVE_DEBOUNCE_MS);
+    configSaveTimer = setTimeout(() => { flushConfigSaveAsync(); }, CONFIG_SAVE_DEBOUNCE_MS);
     configSaveTimer.unref?.();
     return adopted;
   }
@@ -134,6 +192,31 @@ export function createConfigLifecycle({
   // --- debounced backend switch ----------------------------------------------
   let pendingBackendName = null;
   let backendSaveTimer = null;
+  let backendFlushInFlight = null;
+
+  async function runBackendFlushAsync() {
+    while (pendingBackendName !== null) {
+      const name = pendingBackendName;
+      try {
+        await setBackendAsync(name);
+      } catch (err) {
+        process.stderr.write(`[channels] async setBackend failed: ${err?.message || err}\n`);
+        if (pendingBackendName === name) pendingBackendName = null;
+        break;
+      }
+      if (pendingBackendName === name) pendingBackendName = null;
+    }
+  }
+
+  function flushBackendSaveAsync() {
+    if (backendSaveTimer) { clearTimeout(backendSaveTimer); backendSaveTimer = null; }
+    const start = () => runBackendFlushAsync();
+    const p = backendFlushInFlight ? backendFlushInFlight.then(start, start) : start();
+    backendFlushInFlight = p;
+    const clear = () => { if (backendFlushInFlight === p) backendFlushInFlight = null; };
+    p.then(clear, clear);
+    return p;
+  }
 
   function flushBackendSave() {
     if (backendSaveTimer) {
@@ -153,7 +236,7 @@ export function createConfigLifecycle({
   function scheduleBackendSave(name) {
     pendingBackendName = name;
     if (backendSaveTimer) clearTimeout(backendSaveTimer);
-    backendSaveTimer = setTimeout(flushBackendSave, CONFIG_SAVE_DEBOUNCE_MS);
+    backendSaveTimer = setTimeout(() => { flushBackendSaveAsync(); }, CONFIG_SAVE_DEBOUNCE_MS);
     backendSaveTimer.unref?.();
   }
 
@@ -163,6 +246,31 @@ export function createConfigLifecycle({
   // burst of settings-toggle key presses collapses into one disk write.
   let pendingSkillsNames = null;
   let skillsSaveTimer = null;
+  let skillsFlushInFlight = null;
+
+  async function runSkillsFlushAsync() {
+    while (pendingSkillsNames !== null) {
+      const names = pendingSkillsNames;
+      try {
+        await cfgMod.patchSkillsDisabledAsync(names);
+      } catch (err) {
+        process.stderr.write(`[config] async patchSkillsDisabled failed: ${err?.message || err}\n`);
+        if (pendingSkillsNames === names) pendingSkillsNames = null;
+        break;
+      }
+      if (pendingSkillsNames === names) pendingSkillsNames = null;
+    }
+  }
+
+  function flushSkillsSaveAsync() {
+    if (skillsSaveTimer) { clearTimeout(skillsSaveTimer); skillsSaveTimer = null; }
+    const start = () => runSkillsFlushAsync();
+    const p = skillsFlushInFlight ? skillsFlushInFlight.then(start, start) : start();
+    skillsFlushInFlight = p;
+    const clear = () => { if (skillsFlushInFlight === p) skillsFlushInFlight = null; };
+    p.then(clear, clear);
+    return p;
+  }
 
   function flushSkillsSave() {
     if (skillsSaveTimer) {
@@ -182,13 +290,50 @@ export function createConfigLifecycle({
   function scheduleSkillsSave(names) {
     pendingSkillsNames = names;
     if (skillsSaveTimer) clearTimeout(skillsSaveTimer);
-    skillsSaveTimer = setTimeout(flushSkillsSave, CONFIG_SAVE_DEBOUNCE_MS);
+    skillsSaveTimer = setTimeout(() => { flushSkillsSaveAsync(); }, CONFIG_SAVE_DEBOUNCE_MS);
     skillsSaveTimer.unref?.();
   }
 
   // --- debounced top-level outputStyle persist -------------------------------
   let pendingOutputStyleId = null;
   let outputStyleSaveTimer = null;
+  let outputStyleFlushInFlight = null;
+
+  function outputStyleUpdater(styleId) {
+    return (root) => {
+      const next = { ...(root || {}), outputStyle: styleId };
+      if (next.agent && typeof next.agent === 'object' && !Array.isArray(next.agent)) {
+        const agent = { ...next.agent };
+        delete agent.outputStyle;
+        next.agent = agent;
+      }
+      return next;
+    };
+  }
+
+  async function runOutputStyleFlushAsync() {
+    while (pendingOutputStyleId !== null) {
+      const styleId = pendingOutputStyleId;
+      try {
+        await sharedCfgMod.updateConfigAsync(outputStyleUpdater(styleId));
+      } catch (err) {
+        process.stderr.write(`[config] async outputStyle save failed: ${err?.message || err}\n`);
+        if (pendingOutputStyleId === styleId) pendingOutputStyleId = null;
+        break;
+      }
+      if (pendingOutputStyleId === styleId) pendingOutputStyleId = null;
+    }
+  }
+
+  function flushOutputStyleSaveAsync() {
+    if (outputStyleSaveTimer) { clearTimeout(outputStyleSaveTimer); outputStyleSaveTimer = null; }
+    const start = () => runOutputStyleFlushAsync();
+    const p = outputStyleFlushInFlight ? outputStyleFlushInFlight.then(start, start) : start();
+    outputStyleFlushInFlight = p;
+    const clear = () => { if (outputStyleFlushInFlight === p) outputStyleFlushInFlight = null; };
+    p.then(clear, clear);
+    return p;
+  }
 
   function flushOutputStyleSave() {
     if (outputStyleSaveTimer) {
@@ -199,15 +344,7 @@ export function createConfigLifecycle({
     const styleId = pendingOutputStyleId;
     pendingOutputStyleId = null;
     try {
-      sharedCfgMod.updateConfig((root) => {
-        const next = { ...(root || {}), outputStyle: styleId };
-        if (next.agent && typeof next.agent === 'object' && !Array.isArray(next.agent)) {
-          const agent = { ...next.agent };
-          delete agent.outputStyle;
-          next.agent = agent;
-        }
-        return next;
-      });
+      sharedCfgMod.updateConfig(outputStyleUpdater(styleId));
     } catch (err) {
       process.stderr.write(`[config] debounced outputStyle save failed: ${err?.message || err}\n`);
     }
@@ -216,7 +353,7 @@ export function createConfigLifecycle({
   function scheduleOutputStyleSave(styleId) {
     pendingOutputStyleId = styleId;
     if (outputStyleSaveTimer) clearTimeout(outputStyleSaveTimer);
-    outputStyleSaveTimer = setTimeout(flushOutputStyleSave, CONFIG_SAVE_DEBOUNCE_MS);
+    outputStyleSaveTimer = setTimeout(() => { flushOutputStyleSaveAsync(); }, CONFIG_SAVE_DEBOUNCE_MS);
     outputStyleSaveTimer.unref?.();
   }
 
@@ -227,7 +364,30 @@ export function createConfigLifecycle({
     // subsequent adopt preserves) that change instead of reverting to a stale
     // on-disk snapshot.
     flushConfigSave();
-    return adoptConfig(cfgMod.loadConfig(), { hasSecrets: true });
+    const loaded = cfgMod.loadConfig();
+    if (pendingConfigToSave !== null) {
+      // The debounced write could not land (e.g. lock timeout), so on-disk is
+      // stale. Prefer the freshest in-memory state and re-overlay the keychain
+      // provider secrets that only the disk load carries, so a failed flush
+      // never reverts the user's latest change.
+      const current = getConfig();
+      const merged = { ...loaded, ...current, providers: { ...(current.providers || {}) } };
+      for (const [name, val] of Object.entries(loaded.providers || {})) {
+        if (val && val.apiKey) {
+          // Match loadConfig's keychain overlay: apiKey ⇒ enabled:true, UNLESS
+          // the in-memory pending state EXPLICITLY disabled this provider (a
+          // genuine newer user change that must not be reverted).
+          const explicitlyDisabled = current.providers?.[name]?.enabled === false;
+          merged.providers[name] = {
+            ...(merged.providers[name] || {}),
+            apiKey: val.apiKey,
+            enabled: explicitlyDisabled ? false : true,
+          };
+        }
+      }
+      return adoptConfig(merged, { hasSecrets: true });
+    }
+    return adoptConfig(loaded, { hasSecrets: true });
   }
 
   function ensureFullConfig() {

package/src/session-runtime/mcp-glue.mjs

@@ -250,11 +250,41 @@ export function createMcpGlue({
     return { name, config };
   }
 
+  // First-turn gate: await the in-flight INITIAL connect, bounded by the global
+  // startup budget. Boot/UI never call this; only the first ask awaits so
+  // servers that connect within the budget land in THIS request's tool surface.
+  // Resolves (never rejects): a server still connecting after the budget flows
+  // through the existing late-tool deferred announcement path unchanged.
+  async function awaitInitialMcpConnect() {
+    const inFlight = state.mcpConnectInFlight;
+    if (!inFlight) return;
+    let budgetMs = 10000;
+    try {
+      const resolved = mcpClient.resolveMcpStartupTimeoutMs?.({});
+      if (Number.isFinite(resolved)) budgetMs = resolved;
+    } catch { /* fall back to default budget */ }
+    // Swallow the in-flight rejection: failures are already captured in
+    // state.mcpFailures, and this gate must never reject the turn.
+    const settled = Promise.resolve(inFlight).catch(() => {});
+    // Budget disabled (0/off) = no per-server startup timeout, so the connect
+    // promise may never settle; never gate the turn on it — fall back to the
+    // legacy fire-and-forget behavior (late servers use the deferred path).
+    if (!(budgetMs > 0)) return;
+    let timer = null;
+    const budget = new Promise((resolveBudget) => { timer = setTimeout(resolveBudget, budgetMs); });
+    try {
+      await Promise.race([settled, budget]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
   return {
     mcpTransportLabel,
     resolveEffectiveMcpServers,
     mcpStatus,
     connectConfiguredMcp,
+    awaitInitialMcpConnect,
     normalizeMcpServerInput,
   };
 }