mixdog 0.9.24 → 0.9.26

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -5,6 +5,7 @@ import { tmpdir } from 'os';
 import { randomUUID } from 'crypto';
 import { smartReadTruncate } from '../tools/builtin/read-formatting.mjs';
 import { shutdownStdioChild, killStdioChildTreeFast } from './child-tree.mjs';
+import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../../shared/service-discovery.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -13,7 +14,7 @@ import { shutdownStdioChild, killStdioChildTreeFast } from './child-tree.mjs';
  *  in-process through agent's toolExecutor (see orchestrator/internal-tools),
  *  so this registry is for genuinely external port-based MCP targets only. */
 const AUTO_DETECT_PORTS = {
-    'mixdog-memory': { dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
+    'mixdog-memory': { discovery: 'memory', dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
 };
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 0;
 // Per-server STARTUP handshake budget (connect + listTools). Codex parity: 10s.
@@ -452,20 +453,31 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
     const client = new Client({ name: `mixdog-agent/${name}`, version: '1.0.0' });
     let transport;
     const kind = resolveMcpTransportKind(cfg);
+    // When the autoDetect port comes from a discovery advert (not the legacy
+    // port file), remember { service, port } so a connect/handshake failure can
+    // distrust it — a pid-live advert can point at a recycled-pid corpse port,
+    // and this transport has no other health probe of its own.
+    let _autoDetectAdvert = null;
     // Auto-detect: read port from a running service's port file
     if (kind === 'autoDetect') {
         const spec = AUTO_DETECT_PORTS[cfg.autoDetect];
         if (!spec)
             throw new Error(`Unknown autoDetect target: "${cfg.autoDetect}"`);
-        const portFile = spec.dir === 'mixdog' && process.env.MIXDOG_RUNTIME_ROOT
+        // Prefer the single-writer discovery advert (discovery/<service>.json),
+        // pid-validated. Fall back to the legacy active-instance.json portField
+        // when no live advert is present (cross-version compat).
+        let port = spec.discovery ? readServicePort(spec.discovery, { requirePid: false }) : null;
+        if (port && spec.discovery) _autoDetectAdvert = { service: spec.discovery, port };
+        let portFile = null;
+        if (!port) {
+          portFile = spec.dir === 'mixdog' && process.env.MIXDOG_RUNTIME_ROOT
             ? join(process.env.MIXDOG_RUNTIME_ROOT, spec.file)
             : join(tmpdir(), spec.dir, spec.file);
-        if (!existsSync(portFile)) {
+          if (!existsSync(portFile)) {
             throw new Error(`autoDetect server "${name}": port file missing (${portFile})`);
-        }
-        let port;
-        const raw = readFileSync(portFile, 'utf-8').trim();
-        if (spec.portField) {
+          }
+          const raw = readFileSync(portFile, 'utf-8').trim();
+          if (spec.portField) {
             try {
                 const json = JSON.parse(raw);
                 const v = json[spec.portField];
@@ -477,12 +489,13 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
                 if (jsonErr instanceof Error && jsonErr.message.startsWith('autoDetect server')) throw jsonErr;
                 throw new Error(`autoDetect server "${name}": invalid JSON in port file ${portFile}`);
             }
-        }
-        else {
+          }
+          else {
             port = parseInt(raw, 10);
+          }
         }
         if (!Number.isFinite(port) || port < 1 || port > 65535) {
-            throw new Error(`autoDetect server "${name}": invalid port value in ${portFile}`);
+            throw new Error(`autoDetect server "${name}": invalid port value${portFile ? ` in ${portFile}` : ''}`);
         }
         const url = `http://127.0.0.1:${port}${spec.endpoint}`;
         transport = new StreamableHTTPClientTransport(new URL(url));
@@ -568,6 +581,11 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
                 ({ instructions, toolsResult } = await handshake);
             }
         } catch (err) {
+            // A discovery-advert port that fails to connect is a corpse (recycled
+            // pid): distrust it so the next connect falls back to the legacy port
+            // file instead of re-trusting the same advert. Connection-level errors
+            // ONLY — a startup/handshake timeout is a slow-but-alive server.
+            if (_autoDetectAdvert && isConnRefuseError(err)) markServiceUnreachable(_autoDetectAdvert.service, _autoDetectAdvert.port);
             if (startupTimedOut) {
                 // Tear down the pending transport/child so a hung handshake never
                 // leaks a stdio process or socket — fire-and-forget (like the

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -396,7 +396,14 @@ function toAnthropicMessages(messages) {
         // turn after tool_result renders as `</function_results>\n\nHuman:`
         // on the wire and trains the model toward 3-token empty end_turn
         // completions (see foldUserTextIntoToolResultTail).
-        if (m.role === 'user' && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
+        //   EXCEPTION: steering-origin user messages (human/TUI interjections)
+        //   must keep their own user turn so their provenance survives — folding
+        //   them into the preceding tool_result would disguise user input as
+        //   tool output. Anthropic accepts a user text message after a
+        //   tool_result message, so the distinct turn stays request-valid.
+        const isSteering = m.role === 'user' && m.meta?.source === 'steering';
+        if (m.role === 'user' && !isSteering
+            && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
             continue;
         }
         result.push({ role: m.role, content: normalizeContentForAnthropic(m.content) });

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -397,7 +397,13 @@ function toAnthropicMessages(messages) {
         // First-party client parity: fold a user text turn that directly follows a
         // tool_result turn into that tool_result's content (empty end_turn
         // livelock prevention; see foldUserTextIntoToolResultTail).
-        if (m.role === 'user' && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
+        //   EXCEPTION: steering-origin user messages (human/TUI interjections)
+        //   keep their own user turn so provenance survives — folding them would
+        //   disguise user input as tool output. Anthropic accepts a user text
+        //   message after a tool_result message, so the turn stays request-valid.
+        const isSteering = m.role === 'user' && m.meta?.source === 'steering';
+        if (m.role === 'user' && !isSteering
+            && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
             continue;
         }
         result.push({ role: m.role, content: normalizeContentForAnthropic(m.content) });
@@ -405,6 +411,13 @@ function toAnthropicMessages(messages) {
     return sanitizeAnthropicContentPairs(result);
 }
 
+// Test-only: expose the lowering so the steering-provenance test can assert
+// the API-key provider keeps steering-tagged user turns distinct (mirrors
+// anthropic-oauth._buildRequestBodyForCacheSmoke coverage).
+export function _toAnthropicMessagesForTest(messages) {
+    return toAnthropicMessages(messages);
+}
+
 // Applies cache_control markers to the FINAL, already-sanitized Anthropic
 // message array — by INVARIANT, never by pre-sanitize index. Because
 // sanitizeAnthropicContentPairs has already run (and must NOT run again

package/src/runtime/agent/orchestrator/providers/oauth-usage.mjs

@@ -242,10 +242,15 @@ function windowFromPercent(label, value, source) {
 }
 
 // Grok Build billing periods are migrating from monthly to a shared weekly
-// pool (xAI rollout is per-account). Derive the window cadence from the
-// actual billing period length instead of hardcoding monthly: <=10 days
-// means a weekly cycle, anything longer (or unknown) stays monthly.
+// pool (xAI rollout is per-account). Unified-billing accounts state the
+// cadence explicitly via currentPeriod.type (USAGE_PERIOD_TYPE_WEEKLY);
+// otherwise derive it from the actual billing period length instead of
+// hardcoding monthly: <=10 days means a weekly cycle, anything longer (or
+// unknown) stays monthly.
 function grokBillingCadence(config) {
+  const periodType = cleanString(config?.currentPeriod?.type ?? config?.current_period?.type ?? '').toUpperCase();
+  if (periodType.includes('WEEKLY')) return { label: 'W', period: 'weekly' };
+  if (periodType.includes('MONTHLY')) return { label: 'M', period: 'monthly' };
   if (config?.weeklyLimit !== undefined || config?.weekly_limit !== undefined) {
     return { label: 'W', period: 'weekly' };
   }
@@ -259,6 +264,11 @@ function grokBillingCadence(config) {
 
 function creditWindowFromBilling(config) {
   if (!config || typeof config !== 'object') return null;
+  const cadence = grokBillingCadence(config);
+  const resetAt = resetAtMs(
+    config.currentPeriod?.end ?? config.current_period?.end
+      ?? config.billingPeriodEnd ?? config.billing_period_end,
+  );
   const limit = num(
     config.weeklyLimit?.val ?? config.weeklyLimit
       ?? config.monthlyLimit?.val ?? config.monthlyLimit
@@ -266,10 +276,27 @@ function creditWindowFromBilling(config) {
     null,
   );
   const used = num(config.used?.val ?? config.includedUsed?.val ?? config.used, null);
-  if (limit === null || used === null || !(limit > 0)) return null;
-  const resetAt = resetAtMs(config.billingPeriodEnd ?? config.billing_period_end);
+  if (limit === null || used === null || !(limit > 0)) {
+    // Unified-billing accounts (shared weekly pool) report utilization as a
+    // percentage instead of credit totals; absent means 0% used.
+    const unified = config.isUnifiedBillingUser === true
+      || config.is_unified_billing_user === true
+      || config.currentPeriod || config.current_period;
+    if (!unified) return null;
+    const usedPct = num(
+      config.creditUsagePercent?.val ?? config.creditUsagePercent
+        ?? config.credit_usage_percent,
+      0,
+    );
+    return {
+      label: cadence.label,
+      source: 'grok-build-billing',
+      usedPct: round(Math.min(100, Math.max(0, usedPct)), 2),
+      ...(resetAt ? { resetAt } : {}),
+    };
+  }
   return {
-    label: grokBillingCadence(config).label,
+    label: cadence.label,
     source: 'grok-build-billing',
     usedPct: round(Math.min(100, used * 100 / limit), 2),
     usedCredits: round(used, 2),
@@ -495,29 +522,38 @@ async function fetchGrokUsage(providerObj, routeInfo) {
     Authorization: `Bearer ${token}`,
     'X-XAI-Token-Auth': 'xai-grok-cli',
     'x-userid': userId,
+    'x-grok-client-version': '0.2.87',
     Accept: 'application/json',
-    'User-Agent': 'xai-grok-build/0.2.16',
+    'User-Agent': 'xai-grok-build/0.2.87',
   };
 
-  try {
-    const res = await fetch('https://cli-chat-proxy.grok.com/v1/billing', fetchOptions(cliHeaders));
-    if (res.ok) {
+  // format=credits is what the official grok CLI requests; unified-billing
+  // (shared weekly pool) accounts only report their real cadence and reset
+  // there. The legacy /v1/billing shape keeps serving a stale monthly cycle
+  // for migrated accounts, so it is only a fallback.
+  for (const url of [
+    'https://cli-chat-proxy.grok.com/v1/billing?format=credits',
+    'https://cli-chat-proxy.grok.com/v1/billing',
+  ]) {
+    try {
+      const res = await fetch(url, fetchOptions(cliHeaders));
+      if (!res.ok) continue;
       const data = await res.json();
       const config = data?.config && typeof data.config === 'object' ? data.config : data;
-      const monthly = creditWindowFromBilling(config);
-      if (monthly) {
+      const window = creditWindowFromBilling(config);
+      if (window) {
         return {
           provider: routeInfo?.provider || 'grok-oauth',
           model: routeInfo?.model || null,
           source: 'grok-build-billing',
-          quotaWindows: [monthly],
+          quotaWindows: [window],
           balance: balanceFromGrokBilling(config),
           rawKeys: Object.keys(data || {}).sort(),
         };
       }
+    } catch {
+      // Fall through to the next candidate / generic probes below.
     }
-  } catch {
-    // Fall through to generic probes below.
   }
 
   // xAI documents per-request cost tracking and console rate-limit pages, but

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -202,7 +202,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         if (typeof options.beforeAppend === 'function') {
             try { options.beforeAppend(); } catch { /* best-effort hook */ }
         }
-        messages.push({ role: 'user', content: merged.content });
+        // Tag steering-origin user messages so provider lowering keeps them a
+        // distinct user turn (see anthropic-oauth foldUserTextIntoToolResultTail):
+        // human/TUI steering must stay attributed as user input, never folded
+        // into a preceding tool_result where it reads as tool output.
+        messages.push({ role: 'user', content: merged.content, meta: { source: 'steering' } });
         try { opts.onSteerMessage?.(merged.text || steeringContentText(merged.content)); } catch {}
         if (sessionId) {
             try { process.stderr.write(`[steer] sess=${sessionId} injected ${stage} user message (merged=${merged.count} len=${String(merged.text || '').length})\n`); } catch {}

package/src/runtime/agent/orchestrator/session/loop/steering-ladder.mjs

@@ -40,6 +40,38 @@ function _pathsOf(arg) {
 function _normPath(p) { return String(p).replace(/\\/g, '/').toLowerCase(); }
 function _baseName(p) { const s = _normPath(p); const i = s.lastIndexOf('/'); return i >= 0 ? s.slice(i + 1) : s; }
 function _dirName(p) { const s = _normPath(p); const i = s.lastIndexOf('/'); return i >= 0 ? s.slice(0, i) : ''; }
+// A path targets a specific file (not a directory scope) when its basename
+// carries a file extension — the signal that a grep was already file-scoped.
+function _isFileScopedPath(p) { return /\.[A-Za-z0-9]{1,12}$/.test(_baseName(p)); }
+// Grep context flag: -C/-A/-B count as context ONLY when > 0. An explicit
+// -C:0 / -A:0 / -B:0 is NO context (bare match lines).
+function _hasGrepContext(a) { return Number(a?.['-A']) > 0 || Number(a?.['-B']) > 0 || Number(a?.['-C']) > 0; }
+// Canonical path segments: normalize slashes/case, drop '.' and resolve '..'
+// so ./ and ../ variants collapse. Used by the abs/rel-tolerant path match.
+function _canonSegs(p) {
+    const out = [];
+    for (const seg of _normPath(p).split('/')) {
+        if (seg === '' || seg === '.') continue;
+        if (seg === '..') { if (out.length && out[out.length - 1] !== '..') out.pop(); else out.push('..'); continue; }
+        out.push(seg);
+    }
+    return out;
+}
+function _canonPath(p) { return _canonSegs(p).join('/'); }
+// abs/rel-tolerant same-file test: equal when one canonical path is a
+// segment-aligned suffix of the other (so C:/proj/src/x.mjs, src/x.mjs and
+// ./src/x.mjs all match). Basename equality is implied by the suffix compare.
+function _pathsMatch(a, b) {
+    if (!a || !b) return false;
+    const A = _canonSegs(a); const B = _canonSegs(b);
+    if (!A.length || !B.length) return false;
+    const long = A.length >= B.length ? A : B;
+    const short = A.length >= B.length ? B : A;
+    for (let i = 0; i < short.length; i += 1) {
+        if (long[long.length - short.length + i] !== short[i]) return false;
+    }
+    return true;
+}
 // Exact (normalized) same-file test — used where "related" is too loose.
 function _samePath(a, b) { return !!a && !!b && _normPath(a) === _normPath(b); }
 // Loose sibling/variant relation — cluster detector pairs this WITH token overlap.
@@ -148,6 +180,15 @@ export function createSteeringLadder(ctx) {
     // same-path regions in ONE call are the recommended batched form and are
     // never counted. Fires once per path per session.
     const _readWindowsByPath = new Map();
+    // Detector A state: prior turn's file-scoped grep paths that ran WITHOUT
+    // any -C/-B/-A context (a bare match-line grep on a specific file). Seeds
+    // the grep-no-context-then-read nudge for the next turn.
+    let _lastFileScopedGrepNoCtxPaths = null;
+    // Detector B state: per-path consecutive-read streak (canonical path ->
+    // count). Tracked as a Map so multi-file turns keep independent streaks
+    // ([A,B]->B->B fires on B). Files not read this turn are pruned; a path is
+    // dropped after it fires.
+    const _readStreaks = new Map();
 
     // Level-2 steering emitter shared by both ladder paths (single-call
     // level-1 streak and the independent all-read-only streak). Sets the latch
@@ -178,20 +219,37 @@ export function createSteeringLadder(ctx) {
             // Steering hint gate: at most ONE hint per turn (priority:
             // level-2 > grep/shell detectors > level-1).
             let _hintFiredThisTurn = hintAlreadyFired;
+            // Specific-detector predicates (A: grep-no-context then re-read; B:
+            // 3rd consecutive same-file read). Evaluated up front so the GENERIC
+            // level-1 batching nudge can defer to them (more specific wins),
+            // while the level-2 runaway escalation below still outranks them.
+            const _readCallsThisTurn = calls.filter((c) => c?.name === 'read');
+            const _aWouldFire = !!_lastFileScopedGrepNoCtxPaths
+                && _readCallsThisTurn.some((c) => _pathsOf(c?.arguments?.path)
+                    .some((p) => [..._lastFileScopedGrepNoCtxPaths].some((g) => _pathsMatch(p, g))));
+            let _bWouldFire = false;
+            for (const c of _readCallsThisTurn) {
+                for (const w of _readWindows(c)) {
+                    for (const [k, cnt] of _readStreaks) { if (cnt >= 2 && _pathsMatch(k, w.path)) { _bWouldFire = true; break; } }
+                    if (_bWouldFire) break;
+                }
+                if (_bWouldFire) break;
+            }
             // Missed-parallelism steering: 2+ consecutive turns of a single
             // read-only tool call suggest the model isn't batching independent
             // lookups. Nudge once, then reset (fires again after 2 more).
             if (calls.length === 1 && isEagerDispatchable(calls[0].name, tools)) {
                 _serialReadOnlyStreak += 1;
-                if (_serialReadOnlyStreak >= 2 && !_hintFiredThisTurn) {
+                // Escalation ladder (Step 1). Cumulative level-1 fires are tracked
+                // and NEVER reset. Once level-1 has fired >=3 times with ZERO edits,
+                // escalate to level-2 steering (latched once per 5 turns). The
+                // level-2 escalation always wins; the plain batching nudge instead
+                // DEFERS to the specific A/B detectors when either would fire.
+                const _canEscalate = (_level1FireCount + 1) >= 3 && editCount === 0 && (iterations - _level2LatchAtIteration) >= 5;
+                if (_serialReadOnlyStreak >= 2 && !_hintFiredThisTurn && (_canEscalate || (!_aWouldFire && !_bWouldFire))) {
                     _serialReadOnlyStreak = 0;
-                    // Escalation ladder (Step 1). Cumulative level-1 fires are
-                    // tracked and NEVER reset. Once level-1 has fired >=3 times with
-                    // ZERO edits, escalate to level-2 steering (blocked-report is a
-                    // valid completion) instead of the batching nudge — latched to at
-                    // most once per 5 turns.
                     _level1FireCount += 1;
-                    if (_level1FireCount >= 3 && editCount === 0 && (iterations - _level2LatchAtIteration) >= 5) {
+                    if (_canEscalate) {
                         _emitLevel2Steer();
                     } else {
                         pushSystemReminder('Last 2 turns each ran a single read-only tool. Batch independent lookups (read/grep/glob/code_graph) into ONE turn, or start editing if you have enough context.');
@@ -303,8 +361,10 @@ export function createSteeringLadder(ctx) {
                 const _next = new Set();
                 for (const c of _grepCalls) {
                     const a = c?.arguments || {};
-                    const _hasCtx = a['-A'] != null || a['-B'] != null || a['-C'] != null;
-                    const _isContent = a.output_mode === 'content' || a.output_mode === 'content_with_context' || _hasCtx;
+                    // Bare output_mode:'content' WITHOUT real context is routed to
+                    // Detector A (which gives the add-`-C` advice); this detector
+                    // only owns greps that actually returned context.
+                    const _isContent = _hasGrepContext(a) || a.output_mode === 'content_with_context';
                     const _pathsOnly = a.output_mode === 'files_with_matches' || a.output_mode === 'count';
                     const _capped = a.head_limit != null;
                     if (_isContent && !_pathsOnly && !_capped) {
@@ -313,6 +373,55 @@ export function createSteeringLadder(ctx) {
                 }
                 _lastGrepContentPaths = _next.size ? _next : null;
             }
+            // Detector A (fire): a file-scoped grep WITHOUT context last turn,
+            // then a read of that same file this turn. Fires ahead of the read-
+            // fragmentation / B detectors below; the generic level-1 nudge
+            // already deferred to it via _aWouldFire, while the level-2
+            // escalation above still outranks it. On pre-emption by an
+            // earlier hint, the pending set is kept (not cleared) so A can fire
+            // next turn.
+            let _aPending = false;
+            if (_lastFileScopedGrepNoCtxPaths) {
+                const _rp = [];
+                for (const c of _readCallsThisTurn) { for (const p of _pathsOf(c?.arguments?.path)) _rp.push(p); }
+                const _hit = _rp.find((p) => [..._lastFileScopedGrepNoCtxPaths].some((g) => _pathsMatch(p, g)));
+                if (_hit) {
+                    if (!_hintFiredThisTurn) {
+                        pushSystemReminder(`You grepped ${_baseName(_hit)} last turn then re-opened it — request context with -C on file-scoped grep so the match window is already on screen.`);
+                        try {
+                            appendAgentTrace({
+                                sessionId,
+                                iteration: iterations,
+                                kind: 'steer',
+                                payload: { tag: 'grep_nocontext_reread', file: _baseName(_hit) },
+                                agent: sessionAgent || null,
+                            });
+                        } catch { /* best-effort */ }
+                        _hintFiredThisTurn = true;
+                        _lastFileScopedGrepNoCtxPaths = null;
+                    } else {
+                        _aPending = true; // pre-empted this turn — keep pending for next turn
+                    }
+                }
+            }
+            // Detector A (seed): record this turn's file-scoped greps that ran
+            // WITHOUT context so a same-file read next turn triggers the fire
+            // block above. When A was pre-empted this turn (_aPending) the
+            // existing pending set is kept rather than cleared.
+            if (!_aPending) {
+                const _next = new Set();
+                for (const c of _grepCalls) {
+                    const a = c?.arguments || {};
+                    // Exact complement of the content detector's seed: skip greps
+                    // that carried real context (positive -A/-B/-C) OR ran in
+                    // content_with_context mode — those belong to that detector.
+                    if (_hasGrepContext(a) || a.output_mode === 'content_with_context') continue;
+                    for (const p of _pathsOf(a.path)) {
+                        if (_isFileScopedPath(p)) _next.add(p);
+                    }
+                }
+                _lastFileScopedGrepNoCtxPaths = _next.size ? _next : null;
+            }
             // Detector: read fragmentation — 2nd+ single-window read into the
             // SAME file with offsets inside an 800-line span means the model is
             // paging small windows across turns instead of reading one wider
@@ -345,6 +454,50 @@ export function createSteeringLadder(ctx) {
                     }
                 }
             }
+            // Detector B: 3rd consecutive turn reading the SAME file (any
+            // window). Per-path streaks in a Map so multi-file turns keep
+            // independent counts ([A,B]->B->B fires on B). rel/abs spellings of
+            // one file collapse onto a single streak key; files not read this
+            // turn are pruned; a path is dropped after it fires.
+            {
+                // Resolve each read path to one streak key, merging rel/abs
+                // spellings against existing keys and keys already seen this turn.
+                const _touched = new Set();
+                for (const c of calls.filter((x) => x?.name === 'read')) {
+                    for (const w of _readWindows(c)) {
+                        let _key = null;
+                        for (const k of _readStreaks.keys()) { if (_pathsMatch(k, w.path)) { _key = k; break; } }
+                        if (!_key) { for (const k of _touched) { if (_pathsMatch(k, w.path)) { _key = k; break; } } }
+                        _touched.add(_key || _canonPath(w.path));
+                    }
+                }
+                // Prune streaks for files not read this turn (breaks consecutiveness).
+                for (const k of [..._readStreaks.keys()]) { if (!_touched.has(k)) _readStreaks.delete(k); }
+                // Increment each file read this turn (once per turn).
+                for (const k of _touched) {
+                    _readStreaks.set(k, (_readStreaks.get(k) || 0) + 1);
+                    if (_readStreaks.size > 32) _readStreaks.delete(_readStreaks.keys().next().value);
+                }
+                if (!_hintFiredThisTurn) {
+                    for (const [k, cnt] of _readStreaks) {
+                        if (cnt >= 3) {
+                            pushSystemReminder(`3rd window into ${_baseName(k)} — take the remaining span in ONE wide read (offset+limit) instead of paging.`);
+                            try {
+                                appendAgentTrace({
+                                    sessionId,
+                                    iteration: iterations,
+                                    kind: 'steer',
+                                    payload: { tag: 'consecutive_same_file_read', file: _baseName(k) },
+                                    agent: sessionAgent || null,
+                                });
+                            } catch { /* best-effort */ }
+                            _readStreaks.delete(k);
+                            _hintFiredThisTurn = true;
+                            break;
+                        }
+                    }
+                }
+            }
             // Detector: read-only shell (git status/log/diff --stat, ls/dir/cat/
             // type/Get-ChildItem) inspects state the dedicated tools cover.
             // Nudge toward them; never blocks execution.
@@ -366,6 +519,8 @@ export function createSteeringLadder(ctx) {
             _lastGrepContentPaths = null;
             _identGrepStreak = 0;
             _identGrepToken = null;
+            _lastFileScopedGrepNoCtxPaths = null;
+            _readStreaks.clear();
         },
     };
 }

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -106,3 +106,48 @@ function _restoreCompactedBodies(tcVal, origVal, key) {
     }
     return tcVal;
 }
+
+// Marker prefix emitted by compactStoredToolArgString for every compacted
+// body/long arg (`[mixdog compacted <key>: <N> chars, sha256:…]`). Both the
+// body-only form (marker alone) and the long form (marker + head/tail preview)
+// begin with this exact span.
+const COMPACTED_MARKER_PREFIX = '[mixdog compacted ';
+
+function _isCompactedPlaceholderString(v) {
+    return typeof v === 'string' && v.startsWith(COMPACTED_MARKER_PREFIX);
+}
+
+// Recursively drop every key whose stored value is a compacted-placeholder
+// string, at any depth (batch shapes like edits[].old_string carry nested
+// compacted bodies too). Non-placeholder values are kept verbatim.
+function _dropCompactedPlaceholders(val) {
+    if (Array.isArray(val)) return val.map((item) => _dropCompactedPlaceholders(item));
+    if (val && typeof val === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(val)) {
+            if (_isCompactedPlaceholderString(v)) continue; // drop the key entirely
+            out[k] = _dropCompactedPlaceholders(v);
+        }
+        return out;
+    }
+    return val;
+}
+
+// A SUCCESSFUL tool call's compacted body/long arg (patch / old_string /
+// new_string / content / rewrite / command / script) is never needed again —
+// the edit already applied. compactToolCallsForHistory (run at push time,
+// before the outcome is known) leaves a `[mixdog compacted …]` placeholder in
+// its place. For a success that placeholder persists in the stored assistant
+// tool_use and is transmitted back as a prior apply_patch INPUT, which the
+// model copies verbatim as new patch args — caught by the patch guard, but only
+// after a wasted turn. Drop those placeholder keys so no resubmittable
+// placeholder body survives in history. Failed calls take the opposite path
+// (restoreToolCallBodyForId expands to the full original); success and failure
+// are mutually exclusive per call id, so this never races the restore path.
+// Cache-safe: the caller runs this before the assistant message is transmitted.
+export function dropCompactedBodyArgsForId(assistantMsg, callId) {
+    if (!assistantMsg || !Array.isArray(assistantMsg.toolCalls) || !callId) return;
+    const tc = assistantMsg.toolCalls.find((t) => t && t.id === callId);
+    if (!tc || !tc.arguments || typeof tc.arguments !== 'object') return;
+    tc.arguments = _dropCompactedPlaceholders(tc.arguments);
+}

package/src/runtime/agent/orchestrator/session/manager/compaction-runner.mjs

@@ -157,6 +157,10 @@ async function runRecallFastTrackForSession(session, messages, opts = {}) {
             messages,
             cwd: session?.cwd,
             limit: hydrateLimit,
+            // Clear/manual-compact path: these rows are about to be summarized
+            // away, so skip the bounded 15s synchronous embedding-flush wait —
+            // kick the flush fire-and-forget (dense-search immediacy is moot here).
+            embedWait: false,
         }, callerCtx, memoryTimeoutMs);
     } catch (err) {
         // Ingest failed (dead/timed-out memory runtime). The transcript is NOT

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -30,7 +30,7 @@ import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
 import { crossTurnSignature, crossTurnDedupStub, isEditProgressTool } from './loop/completion-guards.mjs';
 import { getToolKind, isEagerDispatchable, parseNativeToolSearchPayload } from './loop/tool-helpers.mjs';
-import { restoreToolCallBodyForId } from './loop/stored-tool-args.mjs';
+import { restoreToolCallBodyForId, dropCompactedBodyArgsForId } from './loop/stored-tool-args.mjs';
 
 export async function processToolBatch(ctx) {
     const {
@@ -586,6 +586,17 @@ export async function processToolBatch(ctx) {
                     toolKind: 'error',
                 });
             }
+            // Successful call: its compacted body/long args are never needed
+            // again. Drop any `[mixdog compacted …]` placeholder from the stored
+            // assistant tool_use so a prior apply_patch INPUT never surfaces a
+            // resubmittable placeholder patch body the model copies back verbatim
+            // (the patch guard catches it, but only after a wasted turn). Gated on
+            // full success + clean post-processing; the failed/post-fail paths run
+            // restoreToolCallBodyForId instead (mutually exclusive per call id).
+            // Cache-safe: assistantTurnMsg is not transmitted until the next send.
+            if (_postProcessOk && _executeOk && _resultKind === 'normal' && call?.id) {
+                dropCompactedBodyArgsForId(assistantTurnMsg, call.id);
+            }
             // Soft-cancel after each tool: if close landed during execution,
             // discard the rest of the batch and skip the next provider.send.
             throwIfAborted();

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -19,6 +19,7 @@ import {
     getBackgroundTask,
 } from '../../../../shared/background-tasks.mjs';
 import { startChildGuardian } from '../../../../shared/child-guardian.mjs';
+import { detachedSpawnOpts } from '../../../../shared/spawn-flags.mjs';
 import {
     getShellJobsDir,
     shellJobStdoutPath,
@@ -828,9 +829,8 @@ function _startBackgroundShellJobImpl({ command, timeoutMs, workDir, mergeStderr
     const child = spawn(shell, [wrappedTempPath], {
         cwd: workDir,
         env: scrubLoaderVars(scrubProviderSecrets({ ...spawnEnv })),
-        detached: true,
         stdio: 'ignore',
-        windowsHide: true,
+        ...detachedSpawnOpts,
     });
     startChildGuardian({
         childPid: child.pid,

package/src/runtime/agent/orchestrator/tools/shell-state.mjs

@@ -129,15 +129,19 @@ export function wrapPowerShellWithCwdProbe(command, stateFile) {
     // a failing native call $LASTEXITCODE holds its real code (case3 → 7).
     //
     // The `if (-not $?)` check MUST be the first statement after the command;
-    // any intervening statement resets $?. Terminating errors (`throw`) skip to
-    // catch → $__ec = 1. The cwd probe runs in finally regardless, and we exit
+    // any intervening statement resets $?. Terminating errors (`throw`,
+    // `-ErrorAction Stop`, .NET exceptions) skip to catch → $__ec = 1. A
+    // *caught* terminating error is NOT auto-written to the error stream, so
+    // without re-emitting it the caller only sees `[exit code: 1] (no output)`.
+    // Re-surface the ErrorRecord on stderr so the failure cause reaches the
+    // result envelope. The cwd probe runs in finally regardless, and we exit
     // with $__ec so the probe never masks the observed code.
     return '$global:LASTEXITCODE = 0\n'
         + '$__ec = 0\n'
         + 'try {\n'
         + `${command}\n`
         + '  if (-not $?) { $__ec = if ($LASTEXITCODE) { $LASTEXITCODE } else { 1 } }\n'
-        + '} catch { $__ec = 1 }\n'
+        + '} catch { [Console]::Error.WriteLine(($_ | Out-String).Trim()); $__ec = 1 }\n'
         + `finally { (Get-Location).Path | Out-File -Encoding utf8 ${qFile} }\n`
         + 'exit $__ec';
 }

package/src/runtime/channels/backends/discord.mjs

@@ -435,14 +435,21 @@ class DiscordBackend {
     const msg = await ch.messages.fetch(messageId);
     if (msg.attachments.size === 0) return [];
     const results = [];
+    // Optional filter bounds what gets fetched (e.g. image/* only) so a
+    // caller after images never pulls unrelated large attachments.
+    const filter = typeof opts.filter === "function" ? opts.filter : null;
     for (const att of msg.attachments.values()) {
-      const path = await this.downloadSingleAttachment(att, opts);
-      results.push({
+      const meta = {
         id: att.id,
-        path,
         name: safeAttName(att),
         contentType: att.contentType ?? "unknown",
         size: att.size
+      };
+      if (filter && !filter(meta)) continue;
+      const path = await this.downloadSingleAttachment(att, opts);
+      results.push({
+        ...meta,
+        path
       });
     }
     return results;