mixdog 0.9.25 → 0.9.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -48,6 +48,7 @@
     "smoke:freevars": "node scripts/freevar-smoke.mjs",
     "smoke:logguard": "node scripts/log-writer-guard-smoke.mjs",
     "test:toolcall": "node --test scripts/toolcall-args-test.mjs",
+    "test:placeholder": "node --test scripts/compacted-placeholder-scrub-test.mjs",
     "test:providers": "node --test scripts/provider-toolcall-test.mjs",
     "test:atomiclock": "node --test scripts/atomic-lock-tryonce-test.mjs",
     "failures": "node scripts/tool-failures.mjs",

package/scripts/arg-guard-test.mjs

@@ -0,0 +1,68 @@
+// Regression tests for validateBuiltinArgs numeric coercion + over-max clamp:
+// - integer-shaped strings ("5") coerce to numbers instead of erroring
+// - over-max integers clamp to the cap instead of erroring
+// - truly non-numeric / below-min input keeps the existing error
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { validateBuiltinArgs } from '../src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs';
+
+test('read offset/limit as numeric strings coerce to numbers', () => {
+    const a = { path: 'x.mjs', offset: '5', limit: '40' };
+    assert.equal(validateBuiltinArgs('read', a), null);
+    assert.equal(a.offset, 5);
+    assert.equal(a.limit, 40);
+});
+
+test('read line/context as numeric strings coerce and window', () => {
+    const a = { path: 'x.mjs', line: '100', context: '5' };
+    assert.equal(validateBuiltinArgs('read', a), null);
+    assert.equal(a.offset, 94);
+    assert.equal(a.limit, 11);
+});
+
+test('grep head_limit/offset/-C as numeric strings coerce', () => {
+    const a = { pattern: 'x', head_limit: '3', offset: '10', '-C': '2' };
+    assert.equal(validateBuiltinArgs('grep', a), null);
+    assert.equal(a.head_limit, 3);
+    assert.equal(a.offset, 10);
+    assert.equal(a['-C'], 2);
+});
+
+test('list/find/glob head_limit as numeric string coerces', () => {
+    const l = { path: '.', head_limit: '5' };
+    assert.equal(validateBuiltinArgs('list', l), null);
+    assert.equal(l.head_limit, 5);
+    const f = { query: 'x', head_limit: '5' };
+    assert.equal(validateBuiltinArgs('find', f), null);
+    assert.equal(f.head_limit, 5);
+    const g = { pattern: '*.mjs', head_limit: '5' };
+    assert.equal(validateBuiltinArgs('glob', g), null);
+    assert.equal(g.head_limit, 5);
+});
+
+test('over-max integer clamps to the cap instead of erroring', () => {
+    // read n cap is 0..10000; a huge value clamps down instead of erroring.
+    const a = { path: 'x.mjs', n: 999999999 };
+    assert.equal(validateBuiltinArgs('read', a), null);
+    assert.equal(a.n, 10000);
+});
+
+test('over-max numeric-string clamps too', () => {
+    const a = { path: 'x.mjs', n: '999999999' };
+    assert.equal(validateBuiltinArgs('read', a), null);
+    assert.equal(a.n, 10000);
+});
+
+test('non-numeric string still errors', () => {
+    assert.match(validateBuiltinArgs('read', { path: 'x.mjs', limit: 'soon' }), /must be an integer/);
+    assert.match(validateBuiltinArgs('list', { path: '.', head_limit: 'soon' }), /finite integer/);
+});
+
+test('below-min (negative) still errors', () => {
+    assert.match(validateBuiltinArgs('read', { path: 'x.mjs', offset: -1 }), /must be >= 0/);
+    assert.match(validateBuiltinArgs('list', { path: '.', head_limit: '-2' }), /must be >= 0/);
+});
+
+test('fractional numeric string is not coerced (still errors)', () => {
+    assert.match(validateBuiltinArgs('read', { path: 'x.mjs', limit: '3.5' }), /must be an integer/);
+});

package/scripts/compacted-placeholder-scrub-test.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+// Regression test for the pre-send compacted-placeholder invariant: no
+// provider-visible assistant toolCall may ship a `[mixdog compacted …]`
+// placeholder body that the model could copy back as apply_patch input.
+// scrubCompactedPlaceholderToolCalls is the single enforcement point invoked
+// by repairTranscriptBeforeProviderSend right before provider.send.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    compactToolCallsForHistory,
+    scrubCompactedPlaceholderToolCalls,
+} from '../src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs';
+import { repairTranscriptBeforeProviderSend } from '../src/runtime/agent/orchestrator/session/loop/transcript-repair.mjs';
+
+// A patch body longer than the body limit compacts to a marker-alone string.
+const BIG_PATCH = '*** Begin Patch\n' + '+x\n'.repeat(2000) + '*** End Patch';
+
+function assistantWithCompactedPatch(id = 'call_1') {
+    const calls = [{ id, name: 'apply_patch', arguments: { patch: BIG_PATCH, base_path: '/repo' } }];
+    return { role: 'assistant', content: '', toolCalls: compactToolCallsForHistory(calls) };
+}
+
+test('compact leaves a placeholder patch body (precondition)', () => {
+    const msg = assistantWithCompactedPatch();
+    assert.match(msg.toolCalls[0].arguments.patch, /^\[mixdog compacted /);
+    assert.equal(msg.toolCalls[0].arguments.base_path, '/repo');
+});
+
+test('scrub drops the placeholder patch key, keeps other args', () => {
+    const msg = assistantWithCompactedPatch();
+    scrubCompactedPlaceholderToolCalls([msg]);
+    assert.equal('patch' in msg.toolCalls[0].arguments, false);
+    assert.equal(msg.toolCalls[0].arguments.base_path, '/repo');
+});
+
+test('scrub is recursive across nested batch body args', () => {
+    const calls = [{
+        id: 'call_2', name: 'edit',
+        arguments: { edits: [{ path: 'a.js', old_string: BIG_PATCH, new_string: 'ok' }] },
+    }];
+    const msg = { role: 'assistant', content: '', toolCalls: compactToolCallsForHistory(calls) };
+    assert.match(msg.toolCalls[0].arguments.edits[0].old_string, /^\[mixdog compacted /);
+    scrubCompactedPlaceholderToolCalls([msg]);
+    const edit = msg.toolCalls[0].arguments.edits[0];
+    assert.equal('old_string' in edit, false);
+    assert.equal(edit.path, 'a.js');
+    assert.equal(edit.new_string, 'ok');
+});
+
+test('scrub leaves real (restored) patch bodies untouched', () => {
+    const real = '*** Begin Patch\n@@\n-a\n+b\n*** End Patch';
+    const msg = { role: 'assistant', content: '', toolCalls: [
+        { id: 'call_3', name: 'apply_patch', arguments: { patch: real } },
+    ] };
+    scrubCompactedPlaceholderToolCalls([msg]);
+    assert.equal(msg.toolCalls[0].arguments.patch, real);
+});
+
+test('scrub ignores non-assistant / non-toolCall messages', () => {
+    const msgs = [
+        { role: 'user', content: 'hi' },
+        { role: 'tool', content: 'x', toolCallId: 'call_1' },
+        { role: 'assistant', content: 'text only' },
+    ];
+    assert.doesNotThrow(() => scrubCompactedPlaceholderToolCalls(msgs));
+});
+
+test('repairTranscriptBeforeProviderSend enforces the invariant end-to-end', () => {
+    const msgs = [
+        { role: 'user', content: 'do it' },
+        assistantWithCompactedPatch('call_9'),
+        { role: 'tool', content: 'applied', toolCallId: 'call_9' },
+    ];
+    repairTranscriptBeforeProviderSend(msgs, null);
+    const asst = msgs.find((m) => m.role === 'assistant');
+    assert.equal('patch' in asst.toolCalls[0].arguments, false);
+});

package/scripts/steering-fold-provenance-test.mjs

@@ -0,0 +1,71 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { foldUserTextIntoToolResultTail } from '../src/runtime/agent/orchestrator/session/context-utils.mjs';
+import { _buildRequestBodyForCacheSmoke } from '../src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs';
+
+// A tool_result turn followed by a plain user text turn.
+function baseTranscript(userMeta) {
+    return [
+        { role: 'user', content: 'do the thing' },
+        { role: 'assistant', content: '', toolCalls: [{ id: 't1', name: 'read', arguments: {} }] },
+        { role: 'tool', toolCallId: 't1', content: 'file contents here' },
+        { role: 'user', content: 'actually stop and do X instead', ...(userMeta ? { meta: userMeta } : {}) },
+    ];
+}
+
+test('plain user text after tool_result is folded into the tool_result turn', () => {
+    const body = _buildRequestBodyForCacheSmoke(baseTranscript(null), 'claude-sonnet-4');
+    const msgs = body.messages;
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user');
+    const hasToolResult = lastUser.content.some((b) => b.type === 'tool_result');
+    assert.ok(hasToolResult, 'trailing user turn carries the tool_result');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'plain text folded into tool_result');
+});
+
+test('steering-tagged user text after tool_result stays a separate user turn', () => {
+    const body = _buildRequestBodyForCacheSmoke(baseTranscript({ source: 'steering' }), 'claude-sonnet-4');
+    const msgs = body.messages;
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user', 'steering message is its own user turn');
+    const isToolResultTurn = Array.isArray(lastUser.content)
+        && lastUser.content.some((b) => b.type === 'tool_result');
+    assert.equal(isToolResultTurn, false, 'steering turn is not a tool_result turn');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'steering text preserved as user input');
+    const prev = msgs[msgs.length - 2];
+    assert.ok(
+        Array.isArray(prev.content) && prev.content.some((b) => b.type === 'tool_result'),
+        'tool_result stays on its own preceding turn',
+    );
+});
+
+test('foldUserTextIntoToolResultTail unit: folds plain text tail', () => {
+    const result = [{ role: 'user', content: [{ type: 'tool_result', tool_use_id: 't1', content: 'r' }] }];
+    assert.equal(foldUserTextIntoToolResultTail(result, 'hi'), true);
+});
+
+// --- API-key Anthropic provider (anthropic.mjs) path ---
+import { _toAnthropicMessagesForTest } from '../src/runtime/agent/orchestrator/providers/anthropic.mjs';
+
+test('anthropic.mjs: plain user text after tool_result is folded', () => {
+    const msgs = _toAnthropicMessagesForTest(baseTranscript(null));
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user');
+    assert.ok(lastUser.content.some((b) => b.type === 'tool_result'), 'trailing turn carries tool_result');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'plain text folded into tool_result');
+});
+
+test('anthropic.mjs: steering-tagged user text stays a separate user turn', () => {
+    const msgs = _toAnthropicMessagesForTest(baseTranscript({ source: 'steering' }));
+    const lastUser = msgs[msgs.length - 1];
+    assert.equal(lastUser.role, 'user', 'steering message is its own user turn');
+    const isToolResultTurn = Array.isArray(lastUser.content)
+        && lastUser.content.some((b) => b.type === 'tool_result');
+    assert.equal(isToolResultTurn, false, 'steering turn is not a tool_result turn');
+    assert.ok(JSON.stringify(lastUser.content).includes('do X instead'), 'steering text preserved as user input');
+    const prev = msgs[msgs.length - 2];
+    assert.ok(
+        Array.isArray(prev.content) && prev.content.some((b) => b.type === 'tool_result'),
+        'tool_result stays on its own preceding turn',
+    );
+});

package/scripts/webhook-smoke.mjs

@@ -1,23 +1,27 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import * as crypto from 'node:crypto';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { mkdtempSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { readMarkdownDocument } from '../src/runtime/shared/markdown-frontmatter.mjs';
 
 // DATA_DIR resolves from MIXDOG_DATA_DIR at module import time (via
 // ./config.mjs -> resolvePluginData), so the env var MUST be set before
-// the first dynamic import of webhook.mjs.
+// the first dynamic import of webhook.mjs. Endpoint defs + delivery dedup now
+// live in PG; this smoke suite deliberately exercises ONLY the pure,
+// PG-free surface (signature verify + header helpers) so it needs no live DB.
 const dataDir = mkdtempSync(join(tmpdir(), 'mixdog-webhook-test-'));
 process.env.MIXDOG_DATA_DIR = dataDir;
 
 const {
   extractSignature,
   verifySignature,
-  loadEndpointConfig,
   STRIPE_TOLERANCE_MS,
 } = await import('../src/runtime/channels/lib/webhook.mjs');
+const { extractDeliveryId, buildHeadersSummary } = await import(
+  '../src/runtime/channels/lib/webhook/deliveries.mjs'
+);
 
 function hmacHex(secret, payload) {
   return crypto.createHmac('sha256', secret).update(payload).digest('hex');
@@ -141,56 +145,45 @@ test('extractSignature: returns null when no known signature header is present',
   assert.equal(extractSignature(headers, 'github'), null);
 });
 
-// ── endpoint config loader: WEBHOOK.md frontmatter + secret side file ─
-
-test('loadEndpointConfig: loads frontmatter + reads secret from side file', () => {
-  const name = 'my-endpoint';
-  const dir = join(dataDir, 'webhooks', name);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(
-    join(dir, 'WEBHOOK.md'),
-    [
-      '---',
-      'channel: main',
-      'parser: github',
-      'enabled: true',
-      '---',
-      '',
-      'Handle this webhook by summarizing the payload.',
-      '',
-    ].join('\n'),
-    'utf8',
-  );
-  writeFileSync(join(dir, 'secret'), 'my-webhook-secret\n', 'utf8');
-
-  const cfg = loadEndpointConfig(name);
-  assert.equal(cfg.channel, 'main');
-  assert.equal(cfg.parser, 'github');
-  assert.equal(cfg.enabled, true);
-});
-
-test('loadEndpointConfig: enabled: false frontmatter casts to boolean false', () => {
-  const name = 'disabled-endpoint';
-  const dir = join(dataDir, 'webhooks', name);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(
-    join(dir, 'WEBHOOK.md'),
-    ['---', 'channel: main', 'enabled: false', '---', '', 'body text', ''].join('\n'),
-    'utf8',
-  );
-  const cfg = loadEndpointConfig(name);
-  assert.equal(cfg.enabled, false);
-});
-
-test('loadEndpointConfig: returns null for a name with no WEBHOOK.md', () => {
-  assert.equal(loadEndpointConfig('never-registered'), null);
-});
-
-// loadEndpointConfig only surfaces the frontmatter (by design — see
-// webhook.mjs comment above loadEndpointConfig); confirm the underlying
-// shared parser it delegates to also recovers the markdown body, since
-// the loader's frontmatter/body split is not independently exercised
-// through the exported loadEndpointConfig surface.
+// ── delivery-id extraction: header precedence + null fallback ─────────
+
+test('extractDeliveryId: prefers x-github-delivery over other id headers', () => {
+  const headers = { 'x-github-delivery': 'gh-1', 'x-delivery-id': 'dl-1', 'x-request-id': 'rq-1' };
+  assert.equal(extractDeliveryId(headers), 'gh-1');
+});
+
+test('extractDeliveryId: falls back to x-delivery-id then x-request-id', () => {
+  assert.equal(extractDeliveryId({ 'x-delivery-id': 'dl-1', 'x-request-id': 'rq-1' }), 'dl-1');
+  assert.equal(extractDeliveryId({ 'x-request-id': 'rq-1' }), 'rq-1');
+});
+
+test('extractDeliveryId: returns null when no id header is present', () => {
+  assert.equal(extractDeliveryId({ 'content-type': 'application/json' }), null);
+});
+
+// ── headers summary: event/delivery/content-type + signature presence ─
+
+test('buildHeadersSummary: captures event, delivery, content-type and signature presence', () => {
+  const summary = buildHeadersSummary({
+    'x-github-event': 'issues',
+    'x-github-delivery': 'gh-1',
+    'x-hub-signature-256': 'sha256=abc',
+    'content-type': 'application/json',
+  });
+  assert.equal(summary.event_type, 'issues');
+  assert.equal(summary.delivery_id, 'gh-1');
+  assert.equal(summary.signature_present, true);
+  assert.equal(summary.content_type, 'application/json');
+});
+
+test('buildHeadersSummary: signature_present is false when no signature header is present', () => {
+  const summary = buildHeadersSummary({ 'x-github-event': 'push' });
+  assert.equal(summary.signature_present, false);
+  assert.equal(summary.event_type, 'push');
+});
+
+// The webhook body/instructions still round-trip through the shared markdown
+// parser (frontmatter + body split); confirm that pure surface directly.
 test('readMarkdownDocument: WEBHOOK.md-shaped input yields frontmatter + body', () => {
   const raw = [
     '---',

package/src/cli.mjs

@@ -1,10 +1,46 @@
 #!/usr/bin/env node
 
-import { run } from './app.mjs';
+import { fileURLToPath } from 'node:url';
+import { performPendingSwap, registerLiveSession } from './runtime/shared/staged-update.mjs';
 
-run(process.argv.slice(2)).then((code) => {
-  const exitCode = Number.isInteger(code) ? code : 0;
-  process.exit(exitCode);
+const argv = process.argv.slice(2);
+
+// Pre-import self-update swap: BEFORE any runtime module is imported, if a
+// completed staged newer version exists and no other mixdog session is live,
+// atomically swap the global package dir into place. Doing it here (and only
+// here) means the process goes on to load the NEW files, and a live session
+// never has its files overwritten mid-run. Any obstacle → false, run current.
+let swapped = false;
+try { swapped = performPendingSwap(); } catch { swapped = false; }
+
+// Register this process in the live-session refcount BEFORE any runtime module
+// loads, so a concurrently-launching mixdog's liveness check can see us and
+// defer its own swap. Unregister is hooked on process 'exit' (and on graceful
+// close). Harmless for the swap decision above — our own pid is excluded.
+try { registerLiveSession(); } catch { /* advisory refcount only */ }
+
+async function main() {
+  // If we actually swapped, re-exec a fresh node process so the new package
+  // loads with a clean module cache (no stale pre-swap modules mixed in). The
+  // env guard prevents re-swap / relaunch loops. Foreground + inherited stdio
+  // keeps the interactive TUI intact. Best-effort: if the re-exec spawn fails,
+  // fall through and run in-place.
+  if (swapped && !process.env.MIXDOG_SWAP_REEXEC) {
+    try {
+      const { spawnSync } = await import('node:child_process');
+      const r = spawnSync(process.execPath, [fileURLToPath(import.meta.url), ...argv], {
+        stdio: 'inherit',
+        env: { ...process.env, MIXDOG_SWAP_REEXEC: '1' },
+      });
+      if (!r.error) return Number.isInteger(r.status) ? r.status : 0;
+    } catch { /* fall through to in-place run */ }
+  }
+  const { run } = await import('./app.mjs');
+  return await run(argv);
+}
+
+main().then((code) => {
+  process.exit(Number.isInteger(code) ? code : 0);
 }).catch((error) => {
   process.stderr.write(`${error?.stack || error?.message || String(error)}\n`);
   process.exit(1);

package/src/defaults/skills/setup/SKILL.md

@@ -261,7 +261,12 @@ TUI 피커 없음 (settings-api `setSystemShell`만 존재).
 ### 스케줄 / 웹훅 ("스케줄 추가", "웹훅")
 
 1. **확인**: `/schedules` / `/webhooks` (둘 다 `/channels` 허브의 섹션 딥링크).  
-2. **변경**: 해당 피커에서 추가/편집 — 채널 모듈 설정에 저장.  
+2. **변경**: 해당 피커에서 추가/편집.  
+   - **스케줄 저장소 = PG 테이블 `scheduler.schedules`** (더 이상 `<mixdogData>/schedules/<n>/SCHEDULE.md` 파일 아님). 관리 API `saveSchedule/deleteSchedule/setScheduleEnabled/listSchedules` (`channel-admin.mjs`) → 스토어 `schedules-db.mjs`.  
+   - **필드**: 반복형은 `time`(5·6필드 cron) + 선택 `days`(cron 요일필드로 접힘: daily→`*`, weekday→`1-5`, weekend→`0,6`, `mon,wed,fri`/`1,3,5`→숫자; 못 매핑하면 에러) → `when_cron`. 1회성은 `at`(datetime) → `when_at`. `time`·`at`은 **택1**(스토어 XOR). `channel` 지정 시 `target=channel`+`channel_id`(이때 `model` 필수), 없으면 `target=session`. 본문(instructions)=`prompt`.  
+   - **레거시 마이그레이션**: 기존 `schedules/` 디렉터리는 스토어 첫 init 시 SCHEDULE.md들을 테이블로 1회 자동 임포트(같은 days→cron 접힘) 후 디렉터리를 `schedules.migrated`로 rename(삭제 안 함). 한 줄 요약 로그.  
+   - **웹훅 저장소 = PG 테이블 `webhooks.endpoints`** (더 이상 `<mixdogData>/webhooks/<n>/WEBHOOK.md` + `secret` 파일 아님). 관리 API `saveWebhook/deleteWebhook/setWebhookEnabled/listWebhooks` (`channel-admin.mjs`) → 스토어 `webhooks-db.mjs`(`upsertEndpoint/deleteEndpoint/setEndpointEnabled/listEndpoints`). 필드: `parser`(github·generic·stripe·sentry), 선택 `channel`(지정 시 `model` 필수)→`channel_id`, `secret`(미지정 시 랜덤 생성, 컬럼에 저장), 본문(instructions), `enabled`.  
+   - **웹훅 레거시 마이그레이션**: 기존 `webhooks/` 디렉터리는 스토어 첫 init 시 각 `WEBHOOK.md`+`secret`을 `upsertEndpoint`로 1회 자동 임포트 후 디렉터리를 **삭제**(rename 아님 — 사용자 선택). 부분 실패 시 디렉터리 보존·로그·다음 부팅 재시도. 옛 per-endpoint deliveries(중복제거 이력)는 임포트 안 함(리셋 허용).  
 3. **검증**: 피커 목록 반영; 스케줄은 다음 발동 시각 표시.
 
 ### 원격 세션 ("리모트 가져와")

package/src/rules/shared/01-tool.md

@@ -1,8 +1,10 @@
 # Tool Use
 
-- Batch independent calls in one turn; serialize only when a call needs a
-  prior result. Merge equivalent variants/scopes into ONE call wherever the
-  schema accepts arrays (`pattern[]`, `path[]`, `symbols[]`, `query[]`).
+- Every turn carries ALL independent calls you can already specify — a
+  second consecutive single-lookup turn is a defect, not a style choice;
+  serialize only on real data dependency. Merge variants/scopes into ONE
+  call wherever the schema accepts arrays (`pattern[]`, `path[]`,
+  `symbols[]`, `query[]`).
 - Route by what is already known: known symbol/relation → `code_graph`;
   exact text in a known scope → `grep`; unknown location, machine-wide/
   out-of-repo whereabouts, or concept-level question → `explore` (which uses
@@ -31,4 +33,9 @@
   unit (function/section) — over-read once instead of paging the same file
   in small windows across turns; a 3rd window into one file means the first
   should have been wider.
-- Don't mix `apply_patch` with shell or other state-changing calls in one turn.
+- Don't mix `apply_patch` with shell or other state-changing calls in one
+  turn; batch independent-file patches in one turn, then verify them all in
+  ONE shell call the next.
+- Consecutive single `shell` or `apply_patch` turns are a batching miss
+  unless output-dependent: chain shell commands with `;`/`&&` or call in
+  parallel; put all known edits in ONE patch.

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -349,7 +349,9 @@ export function traceAgentBatch({ sessionId, toolCallCount }) {
     appendAgentTrace({
         sessionId,
         kind: 'batch',
-        tool_call_count: toolCallCount,
+        // trace_events has no tool_call_count column — top-level unknown
+        // fields are dropped at insert time, so carry it in payload (jsonb).
+        payload: { tool_call_count: toolCallCount },
     });
 }
 

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -3,6 +3,7 @@ import { appendFile } from 'fs/promises';
 import { dirname, join } from 'path';
 import os from 'os';
 import { getPluginData } from './config.mjs';
+import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../shared/service-discovery.mjs';
 
 const WARNED_KEYS = new Set();
 
@@ -15,6 +16,10 @@ const _FLUSH_INTERVAL_MS = 5000;
 const _FLUSH_BATCH_SIZE = 500;
 let _flushTimer = null;
 let _serviceUrl = null;
+// Port of the discovery advert `_serviceUrl` was resolved from (null when it
+// came from legacy active-instance.json). Lets a flush connect-failure distrust
+// a recycled-pid corpse advert so the next resolve falls back to legacy/buffer.
+let _serviceAdvertPort = null;
 let _flushInFlight = false;
 let _localTracePath = null;
 let _localTraceBuffer = [];
@@ -197,6 +202,11 @@ try {
 function _resolveServiceUrl() {
     if (_serviceUrl) return _serviceUrl;
     try {
+        // Prefer the single-writer discovery advert (discovery/memory.json),
+        // pid-validated; fall back to legacy active-instance.json memory_port.
+        const advertPort = readServicePort('memory', { requirePid: false });
+        if (advertPort) { _serviceAdvertPort = advertPort; _serviceUrl = `http://127.0.0.1:${advertPort}`; return _serviceUrl; }
+        _serviceAdvertPort = null;
         const runtimeRoot = process.env.MIXDOG_RUNTIME_ROOT
             ? join(process.env.MIXDOG_RUNTIME_ROOT)
             : join(os.tmpdir(), 'mixdog');
@@ -245,6 +255,13 @@ async function _flush() {
             }
         } catch (err) {
             _serviceUrl = null;
+            // Discovery-first consumer with no health probe: a connect failure
+            // means the pid-validated advert points at a dead (recycled-pid)
+            // port. Distrust it (connection-level errors ONLY — a timeout is a
+            // slow-but-alive daemon, not a corpse) so the next resolve falls back
+            // to legacy/buffer instead of re-trusting the same advert.
+            if (_serviceAdvertPort && isConnRefuseError(err)) markServiceUnreachable('memory', _serviceAdvertPort);
+            _serviceAdvertPort = null;
             warnAgentOnce('agent-trace:flush-fetch', `[agent-trace] flush fetch failed (${err?.message}) — dropping batch`);
         }
         if (_buffer.length >= _FLUSH_BATCH_SIZE) {

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -9,6 +9,7 @@
 // tree (taskkill /T /F on Windows, SIGTERM->SIGKILL of every descendant on
 // POSIX). No external dependencies.
 import { spawn } from 'node:child_process';
+import { detachedSpawnOpts } from '../../../shared/spawn-flags.mjs';
 
 const isWin = process.platform === 'win32';
 
@@ -107,9 +108,8 @@ export function killStdioChildTreeFast(transport) {
     if (isWin) {
         try {
             const cp = spawn('taskkill', ['/PID', String(pid), '/T', '/F'], {
-                windowsHide: true,
-                detached: true,
                 stdio: 'ignore',
+                ...detachedSpawnOpts,
             });
             cp.unref();
         } catch { /* ignore */ }

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -5,6 +5,7 @@ import { tmpdir } from 'os';
 import { randomUUID } from 'crypto';
 import { smartReadTruncate } from '../tools/builtin/read-formatting.mjs';
 import { shutdownStdioChild, killStdioChildTreeFast } from './child-tree.mjs';
+import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../../shared/service-discovery.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -13,7 +14,7 @@ import { shutdownStdioChild, killStdioChildTreeFast } from './child-tree.mjs';
  *  in-process through agent's toolExecutor (see orchestrator/internal-tools),
  *  so this registry is for genuinely external port-based MCP targets only. */
 const AUTO_DETECT_PORTS = {
-    'mixdog-memory': { dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
+    'mixdog-memory': { discovery: 'memory', dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
 };
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 0;
 // Per-server STARTUP handshake budget (connect + listTools). Codex parity: 10s.
@@ -452,20 +453,31 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
     const client = new Client({ name: `mixdog-agent/${name}`, version: '1.0.0' });
     let transport;
     const kind = resolveMcpTransportKind(cfg);
+    // When the autoDetect port comes from a discovery advert (not the legacy
+    // port file), remember { service, port } so a connect/handshake failure can
+    // distrust it — a pid-live advert can point at a recycled-pid corpse port,
+    // and this transport has no other health probe of its own.
+    let _autoDetectAdvert = null;
     // Auto-detect: read port from a running service's port file
     if (kind === 'autoDetect') {
         const spec = AUTO_DETECT_PORTS[cfg.autoDetect];
         if (!spec)
             throw new Error(`Unknown autoDetect target: "${cfg.autoDetect}"`);
-        const portFile = spec.dir === 'mixdog' && process.env.MIXDOG_RUNTIME_ROOT
+        // Prefer the single-writer discovery advert (discovery/<service>.json),
+        // pid-validated. Fall back to the legacy active-instance.json portField
+        // when no live advert is present (cross-version compat).
+        let port = spec.discovery ? readServicePort(spec.discovery, { requirePid: false }) : null;
+        if (port && spec.discovery) _autoDetectAdvert = { service: spec.discovery, port };
+        let portFile = null;
+        if (!port) {
+          portFile = spec.dir === 'mixdog' && process.env.MIXDOG_RUNTIME_ROOT
             ? join(process.env.MIXDOG_RUNTIME_ROOT, spec.file)
             : join(tmpdir(), spec.dir, spec.file);
-        if (!existsSync(portFile)) {
+          if (!existsSync(portFile)) {
             throw new Error(`autoDetect server "${name}": port file missing (${portFile})`);
-        }
-        let port;
-        const raw = readFileSync(portFile, 'utf-8').trim();
-        if (spec.portField) {
+          }
+          const raw = readFileSync(portFile, 'utf-8').trim();
+          if (spec.portField) {
             try {
                 const json = JSON.parse(raw);
                 const v = json[spec.portField];
@@ -477,12 +489,13 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
                 if (jsonErr instanceof Error && jsonErr.message.startsWith('autoDetect server')) throw jsonErr;
                 throw new Error(`autoDetect server "${name}": invalid JSON in port file ${portFile}`);
             }
-        }
-        else {
+          }
+          else {
             port = parseInt(raw, 10);
+          }
         }
         if (!Number.isFinite(port) || port < 1 || port > 65535) {
-            throw new Error(`autoDetect server "${name}": invalid port value in ${portFile}`);
+            throw new Error(`autoDetect server "${name}": invalid port value${portFile ? ` in ${portFile}` : ''}`);
         }
         const url = `http://127.0.0.1:${port}${spec.endpoint}`;
         transport = new StreamableHTTPClientTransport(new URL(url));
@@ -568,6 +581,11 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
                 ({ instructions, toolsResult } = await handshake);
             }
         } catch (err) {
+            // A discovery-advert port that fails to connect is a corpse (recycled
+            // pid): distrust it so the next connect falls back to the legacy port
+            // file instead of re-trusting the same advert. Connection-level errors
+            // ONLY — a startup/handshake timeout is a slow-but-alive server.
+            if (_autoDetectAdvert && isConnRefuseError(err)) markServiceUnreachable(_autoDetectAdvert.service, _autoDetectAdvert.port);
             if (startupTimedOut) {
                 // Tear down the pending transport/child so a hung handshake never
                 // leaks a stdio process or socket — fire-and-forget (like the

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -396,7 +396,14 @@ function toAnthropicMessages(messages) {
         // turn after tool_result renders as `</function_results>\n\nHuman:`
         // on the wire and trains the model toward 3-token empty end_turn
         // completions (see foldUserTextIntoToolResultTail).
-        if (m.role === 'user' && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
+        //   EXCEPTION: steering-origin user messages (human/TUI interjections)
+        //   must keep their own user turn so their provenance survives — folding
+        //   them into the preceding tool_result would disguise user input as
+        //   tool output. Anthropic accepts a user text message after a
+        //   tool_result message, so the distinct turn stays request-valid.
+        const isSteering = m.role === 'user' && m.meta?.source === 'steering';
+        if (m.role === 'user' && !isSteering
+            && foldUserTextIntoToolResultTail(result, normalizeContentForAnthropic(m.content))) {
             continue;
         }
         result.push({ role: m.role, content: normalizeContentForAnthropic(m.content) });