mixdog 0.9.25 → 0.9.26

package/src/runtime/shared/schedules-db.mjs

@@ -0,0 +1,350 @@
+/**
+ * PG-backed schedules store — the single source of truth for registered
+ * schedules (schema `scheduler`, table `scheduler.schedules`).
+ *
+ * All schedule readers/writers (scheduler.mjs, config.mjs, channel-admin.mjs)
+ * go through this module. Legacy `<dataDir>/schedules/<name>/SCHEDULE.md`
+ * files are imported once by the migration hook in getDb and the directory is
+ * renamed to `schedules.migrated`; the old file-based schedules-store.mjs has
+ * been removed.
+ *
+ * DDL is idempotent and runs once on the first call per process. All queries
+ * fully-qualify `scheduler.schedules` so they are correct regardless of the
+ * connection search_path.
+ */
+
+import { ensurePgInstance, withSchemaBootstrapLock } from '../memory/lib/pg/adapter.mjs';
+import { resolvePluginData } from './plugin-paths.mjs';
+import { readdirSync, readFileSync, renameSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { readMarkdownDocument } from './markdown-frontmatter.mjs';
+
+const SCHEMA = 'scheduler';
+
+// ---------------------------------------------------------------------------
+// Lazy connection + one-shot idempotent DDL (keyed per resolved dataDir).
+// ---------------------------------------------------------------------------
+
+const _ready = new Map(); // dataDir → Promise<db>
+
+const DDL = `
+CREATE TABLE IF NOT EXISTS scheduler.schedules (
+  name           text PRIMARY KEY,
+  description    text NOT NULL DEFAULT '',
+  when_at        timestamptz,
+  when_cron      text,
+  timezone       text,
+  target         text NOT NULL CHECK (target IN ('channel','session')),
+  channel_id     text,
+  model          text,
+  prompt         text NOT NULL,
+  enabled        boolean NOT NULL DEFAULT true,
+  status         text NOT NULL DEFAULT 'active' CHECK (status IN ('active','done')),
+  last_fired_at  timestamptz,
+  next_fire_at   timestamptz,
+  deferred_until timestamptz,
+  skipped_until  timestamptz,
+  created_at     timestamptz NOT NULL DEFAULT now(),
+  updated_at     timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT schedules_when_xor CHECK ((when_at IS NOT NULL) <> (when_cron IS NOT NULL))
+);
+`;
+
+async function getDb(dataDir = resolvePluginData()) {
+  if (_ready.has(dataDir)) return _ready.get(dataDir);
+  const p = (async () => {
+    const { db, pool } = await ensurePgInstance(dataDir, { schema: SCHEMA });
+    // Serialize the CREATE TABLE across concurrent first-boot processes on the
+    // same cluster-global advisory lock the adapter uses for schema bootstrap,
+    // so racing first calls can't run the DDL simultaneously.
+    await withSchemaBootstrapLock(pool, () => db.exec(DDL));
+    await migrateLegacySchedules(db, dataDir);
+    return db;
+  })();
+  _ready.set(dataDir, p);
+  try {
+    return await p;
+  } catch (err) {
+    _ready.delete(dataDir); // let the next call retry DDL after a transient failure
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// One-time legacy SCHEDULE.md migration (additive; runs once per dataDir on
+// first getDb, right after DDL). Imports every `<dataDir>/schedules/<name>/
+// SCHEDULE.md` not already present in the table (by name), using the same
+// days->cron folding as the admin write path, then renames the directory to
+// `schedules.migrated` (never deletes user data). Per-entry failures are
+// isolated and never block store readiness.
+// ---------------------------------------------------------------------------
+
+// Day-name / keyword -> cron day-of-week number (Sun=0 .. Sat=6).
+const MIGRATE_DAY_TO_DOW = {
+  sun: 0, sunday: 0,
+  mon: 1, monday: 1,
+  tue: 2, tues: 2, tuesday: 2,
+  wed: 3, weds: 3, wednesday: 3,
+  thu: 4, thur: 4, thurs: 4, thursday: 4,
+  fri: 5, friday: 5,
+  sat: 6, saturday: 6,
+};
+
+function foldLegacyDaysIntoCron(cron, days) {
+  const parts = String(cron || '').trim().split(/\s+/).filter(Boolean);
+  if (parts.length !== 5 && parts.length !== 6) {
+    throw new Error(`invalid cron "${cron}"`);
+  }
+  const raw = String(days || '').trim().toLowerCase();
+  const dowIndex = parts.length - 1;
+  // days absent -> keep the cron's own day-of-week field ('0 9 * * 1' stays
+  // Monday-only). Only an explicit selector rewrites the dow field.
+  if (!raw) return parts.join(' ');
+  let dow;
+  if (raw === 'daily' || raw === 'everyday' || raw === 'every day') dow = '*';
+  else if (raw === 'weekday' || raw === 'weekdays') dow = '1-5';
+  else if (raw === 'weekend' || raw === 'weekends') dow = '0,6';
+  else {
+    const nums = raw.split(/[\s,]+/).filter(Boolean).map((t) => (
+      /^[0-6]$/.test(t) ? Number(t) : MIGRATE_DAY_TO_DOW[t]
+    ));
+    if (nums.some((n) => n === undefined)) {
+      throw new Error(`days "${days}" is not a recognizable day selector`);
+    }
+    dow = nums.join(',');
+  }
+  parts[dowIndex] = dow;
+  return parts.join(' ');
+}
+
+async function migrateLegacySchedules(db, dataDir) {
+  const dir = join(dataDir, 'schedules');
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return; // no legacy schedules/ dir -> nothing to migrate
+  }
+  let imported = 0;
+  let skipped = 0;
+  const failed = [];
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    const name = ent.name;
+    try {
+      const { rows } = await db.query('SELECT 1 FROM scheduler.schedules WHERE name = $1', [name]);
+      if (rows.length) { skipped++; continue; }
+      let md;
+      try { md = readFileSync(join(dir, name, 'SCHEDULE.md'), 'utf8'); }
+      catch { skipped++; continue; }
+      const { frontmatter, body } = readMarkdownDocument(md);
+      const cron = foldLegacyDaysIntoCron(frontmatter.time, frontmatter.days);
+      const channel = String(frontmatter.channel || '').trim();
+      const enabled = frontmatter.enabled !== 'false' && frontmatter.enabled !== false;
+      await db.query(
+        `INSERT INTO scheduler.schedules
+           (name, description, when_cron, timezone, target, channel_id, model, prompt, enabled)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+         ON CONFLICT (name) DO NOTHING`,
+        [
+          name,
+          String(frontmatter.description || '').trim(),
+          cron,
+          frontmatter.timezone ? String(frontmatter.timezone).trim() : null,
+          channel ? 'channel' : 'session',
+          channel || null,
+          frontmatter.model ? String(frontmatter.model).trim() : null,
+          String(body || '').trim(),
+          enabled,
+        ],
+      );
+      imported++;
+    } catch (err) {
+      failed.push(name);
+      console.error(`[schedules] migration failed for "${name}": ${err?.message || err}`);
+    }
+  }
+  if (failed.length) {
+    // Some entries failed to import. Leave schedules/ in place (do NOT rename)
+    // so the next boot retries them; already-imported entries are skipped by
+    // the name check above, so retry is idempotent.
+    console.error(`[schedules] migrated ${imported} legacy schedule(s), ${failed.length} failed (${failed.join(', ')}); leaving schedules/ for retry`);
+    return;
+  }
+  try {
+    let target = `${dir}.migrated`;
+    if (existsSync(target)) target = `${dir}.migrated-${Date.now()}`;
+    renameSync(dir, target);
+  } catch (err) {
+    console.error(`[schedules] migrated ${imported} legacy schedule(s) but could not rename schedules/: ${err?.message || err}`);
+    return;
+  }
+  console.error(`[schedules] migrated ${imported} legacy schedule(s) (${skipped} skipped); renamed schedules/ -> schedules.migrated`);
+}
+
+// ---------------------------------------------------------------------------
+// Row <-> def mapping
+// ---------------------------------------------------------------------------
+
+function rowToDef(row) {
+  if (!row) return null;
+  return {
+    name:          row.name,
+    description:   row.description,
+    whenAt:        row.when_at,
+    whenCron:      row.when_cron,
+    timezone:      row.timezone,
+    target:        row.target,
+    channelId:     row.channel_id,
+    model:         row.model,
+    prompt:        row.prompt,
+    enabled:       row.enabled,
+    status:        row.status,
+    lastFiredAt:   row.last_fired_at,
+    nextFireAt:    row.next_fire_at,
+    deferredUntil: row.deferred_until,
+    skippedUntil:  row.skipped_until,
+    createdAt:     row.created_at,
+    updatedAt:     row.updated_at,
+  };
+}
+
+const COLS = 'name, description, when_at, when_cron, timezone, target, channel_id, model, prompt, enabled, status, last_fired_at, next_fire_at, deferred_until, skipped_until, created_at, updated_at';
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+export async function listSchedules({ dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(`SELECT ${COLS} FROM scheduler.schedules ORDER BY name`);
+  return rows.map(rowToDef);
+}
+
+export async function getSchedule(name, { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(`SELECT ${COLS} FROM scheduler.schedules WHERE name = $1`, [name]);
+  return rowToDef(rows[0]);
+}
+
+/**
+ * Insert-or-replace a schedule by name. Exactly one of `whenAt`/`whenCron`
+ * must be provided (enforced by the table's XOR CHECK constraint).
+ */
+export async function upsertSchedule(def, { dataDir } = {}) {
+  if (!def || !def.name) throw new Error('upsertSchedule: def.name is required');
+  if (!def.prompt) throw new Error('upsertSchedule: def.prompt is required');
+  const db = await getDb(dataDir);
+  const params = [
+    def.name,
+    def.description ?? '',
+    def.whenAt ?? null,
+    def.whenCron ?? null,
+    def.timezone ?? null,
+    def.target,
+    def.channelId ?? null,
+    def.model ?? null,
+    def.prompt,
+    def.enabled ?? true,
+    def.status ?? 'active',
+    def.nextFireAt ?? null,
+  ];
+  const { rows } = await db.query(
+    `INSERT INTO scheduler.schedules
+       (name, description, when_at, when_cron, timezone, target, channel_id, model, prompt, enabled, status, next_fire_at)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)
+     ON CONFLICT (name) DO UPDATE SET
+       description  = EXCLUDED.description,
+       when_at      = EXCLUDED.when_at,
+       when_cron    = EXCLUDED.when_cron,
+       timezone     = EXCLUDED.timezone,
+       target       = EXCLUDED.target,
+       channel_id   = EXCLUDED.channel_id,
+       model        = EXCLUDED.model,
+       prompt       = EXCLUDED.prompt,
+       enabled      = EXCLUDED.enabled,
+       next_fire_at = EXCLUDED.next_fire_at,
+       -- Redefinition clears stale runtime state and reactivates so the
+       -- re-registered schedule is due again in listDue.
+       status         = 'active',
+       deferred_until = NULL,
+       skipped_until  = NULL,
+       last_fired_at  = NULL,
+       updated_at   = now()
+     RETURNING ${COLS}`,
+    params,
+  );
+  return rowToDef(rows[0]);
+}
+
+export async function deleteSchedule(name, { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rowCount } = await db.query(`DELETE FROM scheduler.schedules WHERE name = $1`, [name]);
+  return rowCount > 0;
+}
+
+export async function setEnabled(name, enabled, { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(
+    `UPDATE scheduler.schedules SET enabled = $2, updated_at = now() WHERE name = $1 RETURNING ${COLS}`,
+    [name, !!enabled],
+  );
+  return rowToDef(rows[0]);
+}
+
+export async function markFired(name, ts = new Date(), { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(
+    `UPDATE scheduler.schedules SET last_fired_at = $2, updated_at = now() WHERE name = $1 RETURNING ${COLS}`,
+    [name, ts],
+  );
+  return rowToDef(rows[0]);
+}
+
+export async function markDone(name, { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(
+    `UPDATE scheduler.schedules SET status = 'done', next_fire_at = NULL, updated_at = now() WHERE name = $1 RETURNING ${COLS}`,
+    [name],
+  );
+  return rowToDef(rows[0]);
+}
+
+export async function setDeferred(name, untilTs, { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(
+    `UPDATE scheduler.schedules SET deferred_until = $2, updated_at = now() WHERE name = $1 RETURNING ${COLS}`,
+    [name, untilTs ?? null],
+  );
+  return rowToDef(rows[0]);
+}
+
+export async function setSkippedUntil(name, ts, { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(
+    `UPDATE scheduler.schedules SET skipped_until = $2, updated_at = now() WHERE name = $1 RETURNING ${COLS}`,
+    [name, ts ?? null],
+  );
+  return rowToDef(rows[0]);
+}
+
+/**
+ * Schedules that are eligible to fire at `now`: active, enabled, with a
+ * next_fire_at at/before `now`, and not currently deferred or skipped past
+ * `now`.
+ */
+export async function listDue(now = new Date(), { dataDir } = {}) {
+  const db = await getDb(dataDir);
+  const { rows } = await db.query(
+    `SELECT ${COLS} FROM scheduler.schedules
+      WHERE status = 'active'
+        AND enabled = true
+        AND next_fire_at IS NOT NULL
+        AND next_fire_at <= $1
+        AND (deferred_until IS NULL OR deferred_until <= $1)
+        AND (skipped_until  IS NULL OR skipped_until  <= $1)
+      ORDER BY next_fire_at`,
+    [now],
+  );
+  return rows.map(rowToDef);
+}

package/src/runtime/shared/service-discovery.mjs

@@ -0,0 +1,169 @@
+// Per-service, SINGLE-WRITER port-advert files under RUNTIME_ROOT/discovery/.
+//
+// Motivation: service port discovery (memory_port, pg_port, ...) used to ride
+// inside the shared active-instance.json, whose write path takes a .lock. With
+// multiple terminals heartbeating and slow Windows renames, that lock could be
+// held long enough to starve a port advertise for an hour+. Splitting each
+// service's advert into its own file, written by its single owner via a plain
+// atomic rename (NO .lock), removes the shared-lock contention entirely.
+//
+// Each advert is stamped with the owner pid and updatedAt. Readers prefer the
+// discovery file (validating the owner pid is still alive) and callers may fall
+// back to the legacy active-instance fields for cross-version compat.
+import { readFileSync, unlinkSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { writeJsonAtomicSync } from './atomic-file.mjs'
+
+export function discoveryRoot() {
+  const root = process.env.MIXDOG_RUNTIME_ROOT
+    ? resolve(process.env.MIXDOG_RUNTIME_ROOT)
+    : join(tmpdir(), 'mixdog')
+  return join(root, 'discovery')
+}
+
+export function discoveryPath(service) {
+  return join(discoveryRoot(), `${service}.json`)
+}
+
+function parsePid(value) {
+  const pid = Number(value)
+  return Number.isInteger(pid) && pid > 0 ? pid : null
+}
+
+export function isPidAlive(value) {
+  const pid = parsePid(value)
+  if (!pid) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (e) {
+    // EPERM: process exists but we lack permission → alive. ESRCH → dead.
+    return e?.code === 'EPERM'
+  }
+}
+
+// Per-process "unreachable port" distrust set: service → { port, updatedAt,
+// pid, ts } a consumer WITHOUT its own health probe proved dead this process
+// (connect-failure). pid-liveness alone cannot catch a recycled owner pid: the
+// advert's pid can be alive as an UNRELATED process while its advertised port
+// is dead, so a pid-validated advert would keep routing consumers to a corpse
+// port and suppress the legacy fallback. Consumers call markServiceUnreachable()
+// on a CONNECTION-level failure (see isConnRefuseError); readLiveServiceAdvert
+// then skips THAT port so the caller falls back to legacy/buffer.
+//
+// The entry records the advert IDENTITY at mark time (updatedAt + pid). A
+// daemon restarted on the SAME port re-stamps updatedAt / gets a new pid, so
+// readLiveServiceAdvert detects the change and clears the distrust — the old
+// port-only key otherwise stayed distrusted for the whole process lifetime. A
+// short TTL is a second self-heal so any residual false positive expires.
+const _DISTRUST_TTL_MS = 30_000
+const _unreachablePorts = new Map()
+
+// Connection-level failure classifier for distrust decisions: only "nothing is
+// listening / socket died on connect" justifies distrusting an advert port.
+// Timeouts (slow-but-alive daemon) and HTTP/handshake status errors must NOT —
+// they would false-distrust a healthy service.
+const _CONN_REFUSE_CODES = new Set([
+  'ECONNREFUSED', 'ECONNRESET', 'ENOTFOUND', 'EHOSTUNREACH', 'ENETUNREACH',
+])
+export function isConnRefuseError(err) {
+  if (!err) return false
+  const code = String(err.code || err.cause?.code || '')
+  if (_CONN_REFUSE_CODES.has(code)) return true
+  const msg = String(err.message || err.cause?.message || '')
+  return /socket hang up|ECONNREFUSED|ECONNRESET|ENOTFOUND|EHOSTUNREACH|ENETUNREACH/i.test(msg)
+}
+
+export function markServiceUnreachable(service, port) {
+  const p = Number(port)
+  if (!Number.isInteger(p) || p <= 0) return
+  // Snapshot the CURRENT advert identity so a later restart on the same port is
+  // detected (newer updatedAt / different pid) and the distrust auto-clears.
+  const raw = readServiceAdvert(service)
+  const same = raw && Number(raw.port) === p
+  _unreachablePorts.set(service, {
+    port: p,
+    updatedAt: same ? (Number(raw.updatedAt) || 0) : 0,
+    pid: same && raw.pid != null ? Number(raw.pid) : null,
+    ts: Date.now(),
+  })
+}
+
+// Raw read of a service advert (no validation). Returns the parsed object or
+// null when absent/unreadable/partial (mid-rename).
+export function readServiceAdvert(service) {
+  try {
+    const raw = JSON.parse(readFileSync(discoveryPath(service), 'utf8'))
+    return raw && typeof raw === 'object' ? raw : null
+  } catch {
+    return null
+  }
+}
+
+// Validated read: returns the advert only when it carries a live port whose
+// owner pid (field `pid`) is still alive. A dead owner → null (stale advert).
+export function readLiveServiceAdvert(service, { requirePid = true } = {}) {
+  const raw = readServiceAdvert(service)
+  if (!raw) return null
+  const port = Number(raw.port)
+  if (!Number.isInteger(port) || port <= 0 || port >= 65536) return null
+  // A port a consumer already proved unreachable this process is treated as an
+  // invalid advert (recycled-pid corpse guard) → fall back to legacy/buffer.
+  // Self-heal: a restart on the same port re-stamps updatedAt / changes pid,
+  // and a stale entry ages out — either clears the distrust and re-trusts.
+  const distrust = _unreachablePorts.get(service)
+  if (distrust && distrust.port === port) {
+    const curUpdatedAt = Number(raw.updatedAt) || 0
+    const curPid = raw.pid != null ? Number(raw.pid) : null
+    const restarted = curUpdatedAt > distrust.updatedAt || curPid !== distrust.pid
+    const expired = Date.now() - distrust.ts > _DISTRUST_TTL_MS
+    if (restarted || expired) _unreachablePorts.delete(service)
+    else return null
+  }
+  if (raw.pid != null) {
+    if (!isPidAlive(raw.pid)) return null
+  } else if (requirePid) {
+    return null
+  }
+  return raw
+}
+
+// Convenience: live port only (or null).
+export function readServicePort(service, opts) {
+  const raw = readLiveServiceAdvert(service, opts)
+  return raw ? Number(raw.port) : null
+}
+
+// Single-writer full-replace advert. Plain atomic rename, NO .lock. Always
+// stamps updatedAt; callers pass port/pid + any extra metadata fields.
+export function writeServiceAdvert(service, fields = {}) {
+  const file = discoveryPath(service)
+  writeJsonAtomicSync(
+    file,
+    { ...fields, updatedAt: Date.now() },
+    { compact: true, fsyncDir: true, renameFallback: 'truncate' },
+  )
+  return file
+}
+
+// Single-writer merge patch: read current advert, apply fields (null/undefined
+// value ⇒ delete key), re-stamp updatedAt. When the merged result no longer
+// advertises a port, the file is removed (clean shutdown). Read-modify-write is
+// race-free enough for a genuine single owner (only the service's supervisor
+// writes its own file).
+export function patchServiceAdvert(service, fields = {}) {
+  const cur = readServiceAdvert(service) ?? {}
+  const merged = { ...cur }
+  for (const [k, v] of Object.entries(fields)) {
+    if (v == null) delete merged[k]
+    else merged[k] = v
+  }
+  const port = Number(merged.port)
+  if (!Number.isInteger(port) || port <= 0) {
+    // No live port left → drop the advert entirely rather than leaving a husk.
+    try { unlinkSync(discoveryPath(service)) } catch {}
+    return null
+  }
+  return writeServiceAdvert(service, merged)
+}

package/src/runtime/shared/spawn-flags.mjs

@@ -0,0 +1,27 @@
+// Centralized child_process spawn/fork flag presets (win32 console-leak fix).
+//
+// win32 rule: DETACHED_PROCESS (Node `detached:true`) makes the OS IGNORE
+// CREATE_NO_WINDOW (Node `windowsHide:true`), so every descendant allocates
+// its own VISIBLE console window. On win32 we therefore NEVER set
+// `detached:true` for hidden background spawns — `windowsHide` alone gives the
+// child a hidden own console that descendants inherit; it survives the parent
+// console closing, and Windows does not kill children on parent exit anyway.
+//
+// POSIX has no console concept, so `windowsHide` is a no-op there and
+// `detached:true` stays REQUIRED: it makes the child a process-group leader so
+// the whole tree can be signalled / tree-killed.
+//
+// Modeled on hermes-agent's _subprocess_compat two-mode split.
+const isWin = process.platform === 'win32';
+
+// Background daemon / process-tree spawns: hidden window everywhere, plus
+// process-group detachment on POSIX only (dropped on win32 per the rule above).
+export const detachedSpawnOpts = Object.freeze({
+  windowsHide: true,
+  ...(isWin ? {} : { detached: true }),
+});
+
+// Short-lived helper spawns that only need the console window hidden on win32.
+export const hiddenSpawnOpts = Object.freeze({
+  windowsHide: true,
+});

package/src/runtime/shared/tool-primitives.mjs

@@ -54,7 +54,9 @@ export function titleCaseMcpServer(server) {
   return String(server || '')
     .split(/[_\s-]+/)
     .filter(Boolean)
-    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1).toLowerCase()}`)
+    .map((part) => (part === part.toLowerCase()
+      ? `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`
+      : part))
     .join(' ');
 }
 

package/src/runtime/shared/tool-surface.mjs

@@ -492,8 +492,14 @@ export function toolWorkUnit(name, args = {}, category = '') {
     case 'web_search_call':
       return unitDescriptor('Web Research', { count: queryCount(a, 'query', 'queries', 'keywords') || 1, noun: 'query', pluralNoun: 'queries' });
     case 'web_fetch':
-    case 'fetch':
       return unitDescriptor('Web Research', { count: queryCount(a, 'url', 'urls', 'uri', 'uris') || 1, active: 'Fetching', done: 'Fetched', noun: 'URL', pluralNoun: 'URLs' });
+    case 'fetch': {
+      const fetchLimit = Number(a.limit ?? a.messages);
+      const fetchCount = Number.isFinite(fetchLimit) && fetchLimit > 0
+        ? Math.floor(fetchLimit)
+        : queryCount(a, 'messages') || 1;
+      return unitDescriptor('Web Research', { count: fetchCount, active: 'Fetching', done: 'Fetched', noun: 'message' });
+    }
     case 'recall':
     case 'recall_memory':
     case 'search_memories':
@@ -501,8 +507,15 @@ export function toolWorkUnit(name, args = {}, category = '') {
     case 'remember':
     case 'save_memory':
     case 'update_memory':
-    case 'memory':
       return unitDescriptor('Memory', { count: queryCount(a, 'entries', 'items', 'memories', 'query', 'text', 'value') || 1, active: 'Writing', done: 'Wrote', noun: 'memory item' });
+    case 'memory': {
+      const action = String(a.action || '').toLowerCase();
+      const op = String(a.op || '').toLowerCase();
+      const isMutation = op === 'add' || op === 'edit' || op === 'delete' || op === 'promote' || op === 'dismiss'
+        || (action === 'core' && !op);
+      if (isMutation) return unitDescriptor('Memory', { count: queryCount(a, 'entries', 'items', 'memories', 'query', 'text', 'value') || 1, active: 'Writing', done: 'Wrote', noun: 'memory item' });
+      return unitDescriptor('Memory', { count: queryCount(a, 'entries', 'items', 'memories', 'query', 'text', 'value') || 1, active: 'Checking', done: 'Checked', noun: 'memory item' });
+    }
     case 'explore':
       return unitDescriptor('Explore', { count: queryCount(a, 'query', 'queries', 'prompt', 'task', 'goal') || 1, noun: 'query', pluralNoun: 'queries' });
     case 'shell':
@@ -514,8 +527,11 @@ export function toolWorkUnit(name, args = {}, category = '') {
     case 'agent':
     case 'bridge':
       return unitDescriptor('Agent', { count: queryCount(a, 'agents', 'roles', 'role', 'tag', 'task_id', 'sessionId') || 1, noun: 'agent' });
-    case 'task':
+    case 'task': {
+      const action = String(a.action || '').toLowerCase();
+      if (action === 'cancel') return unitDescriptor('Task', { count: queryCount(a, 'task_id', 'task_ids', 'id', 'ids') || 1, active: 'Cancelling', done: 'Cancelled', noun: 'task' });
       return unitDescriptor('Task', { count: queryCount(a, 'task_id', 'task_ids', 'id', 'ids') || 1, noun: 'task' });
+    }
     case 'skill':
     case 'skill_execute':
     case 'skill_view':