mixdog 0.9.34 → 0.9.35

package/src/rules/agent/00-core.md

@@ -1,23 +1,16 @@
 # Agent Constraints
 
 - Use English for agent task communication.
-- ONE TURN = ONE BATCH: a read-only call that could have ridden the prior
-  turn is a wasted round-trip.
-- NEVER PREAMBLE: no status/progress narration, "I will..." setup, or any text
-  before tool calls — call needed tools immediately; emit text only for the
-  final handoff after tool work is done.
-- Final handoff: minimum characters, maximum information for Lead. Follow the
-  role's stricter output contract if defined; else fragments — outcome (1
-  line), key `file:line`(s), verification result, material risks (only if
-  any).
-- Never repeat what Lead already knows (the brief, the process, how you
-  searched); state only what changed and where to look. Verification =
-  command + result in one line. Same fact twice = delete one.
-- Handoff cap ~30 lines unless `Deliver:` raises it — a ceiling, not a target.
-- A blocked or partial report is a valid completion: state done/missing/
-  blocker in fragments — never keep retrieving to avoid reporting.
-- Banned as pure cost: report headings, markdown tables (unless requested),
-  prose narration, raw logs/tool traces, speculative next-checks, restated
-  brief, articles/politeness.
-- Exception: a runtime wrap-up directive (exploration budget reached) overrides
-  this — then summarize done/remaining/blocking as instructed.
+- One turn = one batch; any read-only call that could have ridden the prior
+  turn is wasted.
+- Never preamble/progress before tools; call tools immediately. Text only in
+  the final handoff after tool work.
+- Final handoff: fragments only — outcome, key `file:line`, verification
+  command+result, material risks/blockers. Follow stricter role contracts.
+- Do not repeat the brief, process, search path, or any fact. Report done/
+  missing/blocker instead of retrieving to avoid reporting.
+- Handoff cap ~30 lines unless `Deliver:` raises it; this is a ceiling.
+- Ban headings, tables unless requested, prose narration, raw logs/tool traces,
+  speculative next-checks, restated brief, articles/politeness.
+- Runtime wrap-up directives override this and may require done/remaining/
+  blocking summary.

package/src/rules/agent/20-skip-protocol.md

@@ -1,10 +1,5 @@
 # Skip Protocol
 
-For inbound-event agent reports (`webhook-handler`, `scheduler-task`):
-if Lead has nothing actionable to relay
-(label-only, duplicate/dedup, no action needed, nothing to report),
-prefix the whole response with:
-
-```
-[meta:silent]
-```
+For inbound-event reports (`webhook-handler`, `scheduler-task`) with nothing
+actionable to relay (label-only, duplicate/dedup, no action needed/report),
+prefix the whole response with `[meta:silent]`.

package/src/rules/agent/30-explorer.md

@@ -6,66 +6,43 @@ kind: retrieval
 
 # Role: explorer
 
-Coordinate locator. Deliverable = WHERE as `path:line`, never WHY — no
-explaining or tracing. You ARE the `explore` tool: never call it; shared
-rules pointing at `explore` don't apply.
+Coordinate locator. Deliver WHERE as `path:line`, never WHY. You ARE
+`explore`; never call it.
 
-Tools: grep/find/glob/code_graph ONLY. `read` and `list` are FORBIDDEN —
-grep match lines already carry every `path:line` you may output; opening a
-file to "confirm" or "understand" a hit is the WHY you must not answer.
-This ban has NO exception: not after a hit, not for the reason field, not
-"just one read" — a `read`/`list` call anywhere in the session is a defect.
+Tools: grep/find/glob/code_graph ONLY. `read`/`list` are forbidden with no
+exception; grep/code_graph lines already carry the `path:line` answer.
 
-Turn 1 is the whole search, ONE message: one grep whose `pattern[]` packs
-3-6 token variants (camelCase/kebab-case/snake_case/SCREAMING_SNAKE casings,
-synonyms, library/domain names), plus `find` with name fragments, plus `code_graph`
-symbol_search when the query names an identifier. A single-pattern,
-single-tool first turn is a defect.
+Turn 1 is the whole search in ONE message: grep `pattern[]` with 3-6 code-token
+variants, find name fragments, and code_graph symbol_search for identifiers. A
+single-pattern or single-tool first turn is a defect.
 
-A turn-1 broad grep MUST set `output_mode:"files_with_matches"` — an
-unscoped `content`/`content_with_context` scan reads every match body and is
-a defect (a full-content scan across the tree costs seconds). Use
-`content_with_context` ONLY against a `path` that appeared in an earlier
-result THIS session, and always with `head_limit`.
+Broad grep must use `output_mode:"files_with_matches"`. Use
+`content_with_context` only on a path returned earlier in THIS session and with
+`head_limit`.
 
-Search tokens are CODE tokens: first translate natural-language or
-non-English queries into probable English identifiers (e.g. "최대 루프 반복
-횟수" → maxLoop, loop-policy, iterations). Grep non-ASCII text only when
-the query quotes a literal string.
+Translate natural/non-English queries to probable English identifiers first;
+grep non-ASCII only for quoted literal strings.
 
-Search scope is ALWAYS the session working directory: omit `path` (default
-scope) or pass ONLY a path that appeared in an earlier result this session.
-Inventing a directory (`/workspace/...`, guessed `src/lib`, another repo's
-layout) is a defect — those results are always empty; on zero hits change
-TOKENS, never guess paths.
+Scope = session working directory. Omit `path` or use only paths returned
+earlier in this session. Never invent directories; after zero hits change
+TOKENS/scope, not wording or guessed paths.
 
-Credibility is mechanical: hit = line/path contains ANY query token or
-obvious synonym — never judge "is this the real implementation". Sole
-exception: a generic-word-only match (schema, handler, config, resolver…)
-with no SPECIFIC query token (product/library/domain name) = zero, not a hit.
-A `code_graph` symbol hit (find_symbol/symbol_search returning `path:line`)
-IS an anchor — emit it directly; never re-locate it with grep.
+Hit test is mechanical: any `path:line` containing a query token or obvious
+synonym is an anchor; generic-only words (schema/handler/config/resolver…)
+without a specific token are zero. code_graph `path:line` hits are anchors —
+never re-locate them with grep.
 
-Rule zero — after EVERY tool result: ≥1 `path:line` matching a query token
-→ answer NOW with those coordinates, mark weak anchors `?`; zero → one more
-batch if budget remains. No third branch: "hits exist but I want better
-ones" IS branch one. Once ANY turn yields a matching line, the only legal
-next output is the final answer text — every further tool call is a defect.
+Rule zero after every tool result: any matching anchor → answer NOW (mark weak
+anchors `?`); zero → one more batch if budget remains. Further searching after
+a matching anchor is a defect.
 
-Turns: hard max 3, expected 1; start each tool message with `turn N/3`.
-Turns 2-3 are miss-recovery only (prior turn had ZERO matching lines) and
-must change tokens OR scope, never reword.
-Flow/how questions: first matching entry/definition anchors ARE the answer,
-one anchor per concept — never trace the chain.
-Compound queries ("where is X and what value/default does it use"): the
-definition anchor answers BOTH parts — never launch extra searches for the
-value, threshold, or content; one anchor per concept, all from the same batch.
+Turns: max 3, expected 1; start tool messages with `turn N/3`. Turns 2-3 are
+miss recovery only and must change tokens or scope.
 
-Answer, nothing else: anchor lines `path:line — symbol — short reason`
-(`?` if weak), max 3 lines — extra anchors are cost, not quality; pick the
-3 with the most specific token match. Or `EXPLORATION_FAILED` — only after
-the turn budget is
-spent with zero anchors, or when every anchor matches only generic words.
-Before emitting `EXPLORATION_FAILED`, re-scan ALL earlier tool results: if
-any line anywhere matched a specific query token, answer with that anchor
-(`?` if weak) instead — a weak anchor beats a false miss.
+Flow/how and compound queries: first matching entry/definition anchors answer
+the concept/value/default; never trace chains or launch extra value searches.
+
+Answer only: up to 3 lines `path:line — symbol — short reason` (`?` if weak),
+choosing the most specific token matches. Emit `EXPLORATION_FAILED` only after
+budget is spent with zero specific-token anchors; before failing, re-scan prior
+results and prefer any weak specific-token anchor over a false miss.

package/src/rules/lead/01-general.md

@@ -1,11 +1,8 @@
 # General
 
-- Preambles are optional: one short sentence only when it adds user-visible
-  value; no direct names, honorifics, headings, labels, or routine lookup
-  narration.
+- Preambles are optional: one short sentence only when useful; no direct names,
+  honorifics, headings, labels, or routine lookup narration.
 - Destructive/hard-to-reverse actions require explicit confirmation.
 - Never push, build, or deploy without an explicit user request —
   implementation approval is not deploy approval.
-- Handle what you can proactively rather than deferring to the user; propose
-  only the parts needing a decision, consultatively ("Shall we proceed this
-  way?").
+- Handle what you can proactively; ask only for decisions, consultatively.

package/src/rules/lead/lead-brief.md

@@ -1,21 +1,15 @@
 # Lead Brief Contract
 
 - Brief = one-line fragments `Goal:` `Anchors:` `Allow/Forbid:` `Deliver:`
-  `Verify:` (+`Stop:` heavy-worker). Minimum characters, maximum information:
-  no background/motivation, no role-known rules; never restate prior context
-  or the same fact twice. A brief that feels long is a scope problem — split
-  the scope, don't pad.
-- Anchors = `file:line` + one-line conclusion each; never paste log/code
-  bodies — the agent reads the file itself.
-- Instruct by outcome ("make X behave Y"), not method (no code snippets, no
-  step-by-step edits) unless the method IS the requirement.
-- `Deliver:` states output size/shape (e.g. "fragments <=15 lines", "verdict
-  + top-3 risks", "detail to file, path only"); never request a long report
-  in the handoff itself.
-- Full brief only on fresh spawn or `respawned: true` (dead-tag send = cold
-  session; re-supply anchors); live-session follow-ups = delta only, never
-  restating Goal/rules.
-- Never `send` mid-run; batch all adjustments into ONE follow-up after
-  completion. Interrupt only to cancel.
+  `Verify:` (+`Stop:` heavy-worker). Minimum chars, maximum info: no
+  background/motivation, role-known rules, repeated context, or duplicate facts.
+  If it feels long, split scope instead of padding.
+- Anchors = `file:line` + one-line conclusion; never paste log/code bodies.
+- Instruct by outcome, not method, unless the method is the requirement.
+- `Deliver:` states output size/shape; never request a long report in the handoff.
+- Full brief only on fresh spawn or `respawned: true`; live-session follow-ups
+  are delta only. Dead-tag send = cold session, re-supply anchors.
+- Never `send` mid-run; batch adjustments into ONE follow-up after completion.
+  Interrupt only to cancel.
 - All agent communication in English.
 - Referenced spec/test file beats its summary in the brief.

package/src/rules/lead/lead-tool.md

@@ -1,8 +1,6 @@
 # Lead Tool Use
 
-- Write-role agents run their own build/test verification via `shell`; Lead
-  runs cross-scope verification, benches, and everything git via `shell`
-  directly.
-- Use the session's current project/workspace. Change the work project only
-  when the user asks for another project or a tool call needs another root.
+- Write-role agents self-verify via `shell`; Lead runs cross-scope verification,
+  benches, and all git via `shell`.
+- Use the current project/workspace; change it only on user request or tool need.
 - Use `agent` for scoped implementation, research, review, and debugging.

package/src/rules/shared/01-tool.md

@@ -7,20 +7,18 @@
   solo call. Merge variants/scopes into ONE call wherever the schema takes
   arrays (`pattern[]`, `path[]`, `symbols[]`, `query[]`), chain shell with
   `;`/`&&` or run them in parallel, and put every known edit in ONE patch.
-- Route by what is already known: known symbol/relation → `code_graph`;
-  exact text in a known scope → `grep`; unknown location, machine-wide/
-  out-of-repo whereabouts, or concept-level question → `explore` (which uses
-  the hardened `find` internally); name fragment → `find`; exact name pattern
-  → `glob`; known directory → `list`; known file/region → `read`.
+- Route by verified inputs: symbol/relation → `code_graph`; exact text in a
+  verified scope → `grep`; unknown/out-of-repo/machine-wide location or concept
+  → `explore`; name fragment → `find`; exact pattern → `glob`; verified dir →
+  `list`; verified file/span → `read`.
 - `explore` fan-out: at task start, decompose what the task needs to know
   into independent facets (implementation site, config/load path, tests,
   error origin, ...) and send them as ONE `query[]` call — facets run in
   parallel. Never fan out rephrasings of the same target; on
   EXPLORATION_FAILED, retry once with changed tokens.
-- Valid anchors come from user input or tool output in this session; locate
-  anything else with `find` before `grep`/`read`. On ENOENT the next call is
-  `find` on the basename — never a retried guess; and never guess an absolute
-  path outside the project — `find` from a verified broad root instead.
+- Verified paths = user-provided or tool-returned. Guessed/unknown path →
+  `find`/`glob`/`explore` first; ENOENT → `find` basename, never retry a guess
+  or invent absolute paths outside the project.
 - Retrieval stops when evidence covers the deliverable: single-answer tasks
   end at the first sufficient anchor; enumeration tasks (review, audit) end
   when the stated scope is covered. Never re-verify a hit already on screen;

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -4,6 +4,7 @@ import { dirname, join } from 'path';
 import os from 'os';
 import { getPluginData } from './config.mjs';
 import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../shared/service-discovery.mjs';
+import { isDiagnosticIOEnabled } from '../../../lib/mixdog-debug.cjs';
 
 const WARNED_KEYS = new Set();
 
@@ -94,8 +95,13 @@ function _rotateLocalTraceIfNeeded(path) {
 function _resolveLocalTracePath() {
     if (process.env.MIXDOG_AGENT_TRACE_LOCAL_DISABLE === '1') return null;
     if (_localTracePath) return _localTracePath;
+    const explicit = process.env.MIXDOG_AGENT_TRACE_PATH;
+    // Ship-mode default: skip diagnostic local trace file IO unless dev/debug,
+    // MIXDOG_DIAGNOSTICS, or an explicit trace path opts back in. In-memory
+    // buffer + memory-service flush (session metrics) are unaffected.
+    if (!explicit && !isDiagnosticIOEnabled()) return null;
     try {
-        _localTracePath = process.env.MIXDOG_AGENT_TRACE_PATH
+        _localTracePath = explicit
             || join(getPluginData(), 'history', 'agent-trace.jsonl');
         // R4 data-at-rest: trace rows may carry tool payloads / prompts;
         // clamp dir to owner-only on POSIX (advisory on Windows).
@@ -332,8 +338,12 @@ function appendAgentTrace(record = {}) {
 function _resolveToolFailurePath() {
     if (process.env.MIXDOG_TOOL_FAILURE_LOG_DISABLE === '1') return null;
     if (_toolFailurePath) return _toolFailurePath;
+    const explicit = process.env.MIXDOG_TOOL_FAILURE_LOG_PATH;
+    // Ship-mode default: skip diagnostic tool-failure log file IO unless
+    // dev/debug, MIXDOG_DIAGNOSTICS, or an explicit path opts back in.
+    if (!explicit && !isDiagnosticIOEnabled()) return null;
     try {
-        _toolFailurePath = process.env.MIXDOG_TOOL_FAILURE_LOG_PATH
+        _toolFailurePath = explicit
             || join(getPluginData(), 'history', 'tool-failures.jsonl');
         mkdirSync(dirname(_toolFailurePath), { recursive: true, mode: 0o700 });
         return _toolFailurePath;
@@ -422,6 +432,7 @@ export {
     drainAgentTrace,
     normalizeSessionId,
     warnAgentOnce,
+    _resolveLocalTracePath,
     _resolveToolFailurePath,
     _appendToolFailureRow,
 };

package/src/runtime/agent/orchestrator/providers/gemini.mjs

@@ -784,21 +784,29 @@ export class GeminiProvider {
         // exact value the trace already recorded (including the
         // cachedFallback when cachedContentTokenCount / total_cached_tokens
         // under-reports).
-        let cachedTokens = 0;
+        let resolvedUsage = null;
         if (um) {
             const {
                 inputTokens,
                 reportedCachedTokens,
                 cachedFallbackTokens,
-                cachedTokens: resolvedCachedTokens,
+                cachedTokens,
                 cacheTokenSource,
             } = _resolveGeminiCacheUsage({
                 usageMetadata: um,
                 cachedContent,
                 providerState: opts.providerState,
             });
-            cachedTokens = resolvedCachedTokens;
-            const outputTokens = (um.candidatesTokenCount || 0) + (um.thoughtsTokenCount || 0);
+            const outputTokens = (um.candidatesTokenCount || um.candidates_token_count || 0)
+                + (um.thoughtsTokenCount || um.thoughts_token_count || 0);
+            resolvedUsage = {
+                inputTokens,
+                outputTokens,
+                cachedTokens,
+                // Gemini promptTokenCount is total (cachedContentTokenCount is
+                // a subset). Alias the resolver's normalized total directly.
+                promptTokens: inputTokens,
+            };
             if (cachedContent && inputTokens > 0 && cachedTokens <= 0) {
                 try {
                     appendAgentTrace({
@@ -820,11 +828,11 @@ export class GeminiProvider {
             traceAgentUsage({
                 sessionId: opts.sessionId || opts.session?.id || null,
                 iteration: Number.isFinite(Number(opts.iteration)) ? Number(opts.iteration) : null,
-                inputTokens,
-                outputTokens,
-                cachedTokens,
+                inputTokens: resolvedUsage.inputTokens,
+                outputTokens: resolvedUsage.outputTokens,
+                cachedTokens: resolvedUsage.cachedTokens,
                 cacheWriteTokens: 0,
-                promptTokens: inputTokens,
+                promptTokens: resolvedUsage.promptTokens,
                 model: useModel,
                 modelDisplay: useModel,
                 rawUsage: um,
@@ -837,21 +845,9 @@ export class GeminiProvider {
             toolCalls,
             citations: citations.length ? citations : undefined,
             providerState: opts.providerState,
-            usage: um ? (() => {
-                const input = um.promptTokenCount || um.totalTokenCount || 0;
-                return {
-                    inputTokens: input,
-                    outputTokens: (um.candidatesTokenCount || 0) + (um.thoughtsTokenCount || 0),
-                    // Use the already-computed cachedTokens (with
-                    // cache-create fallback applied) rather than the raw
-                    // metadata field, so the returned usage matches what
-                    // traceAgentUsage recorded for this same call.
-                    cachedTokens,
-                    // Gemini promptTokenCount is total (cachedContentTokenCount
-                    // is a subset). Alias directly into promptTokens.
-                    promptTokens: input,
-                };
-            })() : undefined,
+            // Use the same normalized usage object traceAgentUsage recorded,
+            // including snake_case SDK aliases and cache-create fallback.
+            usage: resolvedUsage || undefined,
         };
     }
 

package/src/runtime/agent/orchestrator/providers/model-catalog.mjs

@@ -405,16 +405,32 @@ export function getModelMetadataSync(id, provider) {
     //    id, and add fields LiteLLM lacks, such as opencode-go reasoning_options.
     if (mappedProvider) {
         const md = _modelsDevMetadataSync(id, provider);
-        if (md) meta = mergeModelMetadata(meta, md, { preserveBaseCosts: metaFromPricingOverride });
+        if (md) meta = mergeModelMetadata(meta, md, {
+            preserveBaseCosts: metaFromPricingOverride,
+            preserveBaseLimits: metaFromPricingOverride,
+        });
     }
-    if (providerUsesEndpointScopedLimits(provider) && !providerNative && meta) {
+    if (providerUsesEndpointScopedLimits(provider) && !providerNative && meta && !metaFromPricingOverride) {
         // OAuth/backend routes can expose smaller account/backend windows than
         // the public API SKU. External catalogs remain useful for costs and
         // capabilities, but their limits are not authoritative for these routes.
         meta = { ...meta, contextWindow: null, outputTokens: null };
     }
     if (providerNative) {
-        meta = mergeModelMetadata(meta, providerNative, { preserveBaseCosts: true });
+        // Provider cache limits are only authoritative for endpoint-scoped
+        // routes (OAuth/backend), where the cached row reflects the live
+        // account/backend window. For every other provider the cache is a
+        // best-effort snapshot that can go stale, so it must NOT override the
+        // catalog/known limits — otherwise this function returns cache limits
+        // labelled as catalog data and downstream catalog-vs-cache staleness
+        // checks (context-meta, statusline route-meta) compare stale-vs-stale
+        // and can never correct an outdated cached window. Capabilities and
+        // gap-filling (base limit null) still flow through the merge.
+        const nativeLimitsAuthoritative = providerUsesEndpointScopedLimits(provider);
+        meta = mergeModelMetadata(meta, providerNative, {
+            preserveBaseCosts: true,
+            preserveBaseLimits: metaFromPricingOverride || !nativeLimitsAuthoritative,
+        });
     }
     return meta;
 }
@@ -444,8 +460,8 @@ function mergeModelMetadata(base, overlay, opts = {}) {
     if (!overlay) return base;
     return {
         ...base,
-        contextWindow: overlay.contextWindow || base.contextWindow || null,
-        outputTokens: overlay.outputTokens || base.outputTokens || null,
+        contextWindow: opts.preserveBaseLimits ? (base.contextWindow || overlay.contextWindow || null) : (overlay.contextWindow || base.contextWindow || null),
+        outputTokens: opts.preserveBaseLimits ? (base.outputTokens || overlay.outputTokens || null) : (overlay.outputTokens || base.outputTokens || null),
         // Provider-scoped models.dev rates beat generic base (LiteLLM) rates
         // when present — the overlay is the provider-scoped source, so a
         // non-null overlay value always wins over the generic fallback —

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -275,7 +275,22 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // so the statusline context gauge climbs as the turn accumulates
             // tool output instead of freezing at the pre-turn snapshot. Cleared
             // on turn commit (below) and in the ask finally.
+            //
+            // Also commit the user turn to the live session BEFORE the provider
+            // call. Previously the prompt only reached session.messages after
+            // agentLoop returned. If a worker/lead session was closed or aborted
+            // before first response, closeSession() wrote a tombstone from the
+            // still-system-only session and the handoff brief vanished forever
+            // (agent row showed messages=2). Pre-committing makes cancellation,
+            // close, and post-mortem files retain the exact user task; completion
+            // below overwrites this provisional transcript with the fully mutated
+            // outgoing history and appends the assistant result, so no duplicate
+            // user turn is introduced.
+            session.messages = sanitizeSessionMessagesForModel(outgoing);
             session.liveTurnMessages = outgoing;
+            saveSessionAsync(session, { expectedGeneration: askGeneration }).catch((err) => {
+                try { process.stderr.write(`[session] preflight user-turn save failed: ${err?.message || err}\n`); } catch {}
+            });
             // Per-turn injected-context trace row (complements kind:"usage").
             // Cheap byte-length accounting — no hashing, no payload bodies.
             // Honors the same MIXDOG_AGENT_TRACE_DISABLE gate as usage rows;

package/src/runtime/agent/orchestrator/session/manager/context-meta.mjs

@@ -6,7 +6,6 @@ import {
     COMPACT_TYPE_SEMANTIC,
     COMPACT_TYPE_RECALL_FASTTRACK,
     CONTEXT_SHARE_RATIO,
-    DEFAULT_EFFECTIVE_CONTEXT_WINDOW_PERCENT,
     COMPACT_TARGET_MIN_TOKENS,
 } from '../compact.mjs';
 import { isAgentOwner } from '../../agent-owner.mjs';
@@ -116,13 +115,13 @@ function compactTargetTokensForBoundary(boundaryTokens) {
     return Math.max(1, Math.min(boundary, Math.max(minTarget, byRatio)));
 }
 function defaultEffectiveContextWindowPercent(provider) {
-    // Gateway/statusline route metadata reserves a universal 10% headroom from
-    // the raw catalog window. Keep session compaction on the same effective
-    // capacity so /context, the TUI statusline, and gateway telemetry agree.
+    // The session boundary is the model's full raw window. Headroom is applied
+    // by resolveSessionCompactPolicy instead: agent semantic sessions compact at
+    // the buffered trigger (default 90%), while main/user recall-fasttrack
+    // sessions compact on the boundary itself (100%).
     void provider;
-    return DEFAULT_EFFECTIVE_CONTEXT_WINDOW_PERCENT;
+    return 100;
 }
-const PROVIDER_SYNTHETIC_CONTEXT_DEFAULT = 1_000_000;
 function providerRawContextWindow(info, catalogInfo) {
     if (!info || typeof info !== 'object') return null;
     const fromApiFields = positiveContextWindow(info.context_window)
@@ -130,17 +129,18 @@ function providerRawContextWindow(info, catalogInfo) {
     if (fromApiFields) return fromApiFields;
     const fromCache = positiveContextWindow(info.contextWindow)
         || positiveContextWindow(info.maxContextWindow);
-    if (!fromCache) return null;
     const catalogWindow = positiveContextWindow(catalogInfo?.contextWindow)
         || positiveContextWindow(catalogInfo?.maxContextWindow)
         || positiveContextWindow(catalogInfo?.context_window)
         || positiveContextWindow(catalogInfo?.max_context_window);
-    if (fromCache === PROVIDER_SYNTHETIC_CONTEXT_DEFAULT
-        && catalogWindow
-        && fromCache !== catalogWindow) {
-        return null;
-    }
-    return fromCache;
+    // Catalog/known metadata is authoritative for models present in the
+    // catalog. A stale provider cache can hold an outdated window (e.g. Opus
+    // 4.8 cached at 272k after its window grew to the catalog's 1M, or a
+    // synthetic 1M placeholder for a smaller real model); whenever the catalog
+    // disagrees with the cached snapshot, trust the catalog value rather than
+    // the cache. Only live API fields (handled above) outrank the catalog.
+    if (catalogWindow && fromCache !== catalogWindow) return catalogWindow;
+    return fromCache || null;
 }
 export function resolveSessionContextMeta(provider, model, seed = {}) {
     const info = typeof provider?.getCachedModelInfo === 'function'

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -382,10 +382,18 @@ export function drainPendingMessages(sessionId) {
     // first. Reversing this order (buffer before disk) delivered newer
     // buffered sends ahead of older persisted ones after a restart.
     const persisted = [...drainPersistedPendingMessages(sessionId), ...takeBufferedPendingMessages(sessionId)];
-    // Discard deferred completion/task notifications instead of injecting them
-    // out-of-order into a future turn on resume. Genuine user/steering messages
-    // (plain strings / content entries) carry no marker and are kept in order.
-    const memoryKept = memory.filter((m) => !isCompletionNotificationEntry(m));
+    // Deferred completion/task notifications are dropped ONLY from the persisted
+    // (disk/buffer) path. Those are the entries a later session resume/restart
+    // would replay out-of-order into a future turn, once the in-memory queue is
+    // gone — discarding them there is the deliberate owner decision.
+    // Live in-memory completions (fallback/headless enqueues delivered within
+    // THIS process, e.g. the idle-resume kick that surfaces the model-visible
+    // body) are the intended payload and MUST survive the drain — filtering
+    // them here dropped the notification entirely. On a genuine resume the
+    // in-memory queue is empty, so keeping it only ever delivers live entries.
+    // Genuine user/steering messages carry no marker and are kept in order in
+    // both paths.
+    const memoryKept = memory;
     const persistedKept = persisted.filter((m) => !isCompletionNotificationEntry(m));
     const memoryVisible = modelVisiblePendingMessages(memoryKept);
     const persistedVisible = modelVisiblePendingMessages(persistedKept);
@@ -394,9 +402,15 @@ export function drainPendingMessages(sessionId) {
     const persistedTexts = persistedVisible.map(pendingMessageText);
     const prefixMatches = memoryVisible.every((m, i) => persistedTexts[i] === pendingMessageText(m));
     if (prefixMatches) return [...memoryVisible, ...persistedVisible.slice(memoryVisible.length)];
-    const out = persistedVisible.slice();
-    const seen = new Set(persistedTexts);
-    for (const m of memoryVisible) {
+    // The live in-memory queue holds the authoritative order — including the
+    // completion entries that were filtered out of the persisted path — so an
+    // interleaved [user, completion, user] must stay in that order and never be
+    // flattened to [user, user, completion] by rebuilding from persisted first.
+    // Start from the memory order and append only genuinely persisted-only
+    // entries; buffered duplicates of live sends are skipped by text.
+    const out = memoryVisible.slice();
+    const seen = new Set(out.map(pendingMessageText).filter(Boolean));
+    for (const m of persistedVisible) {
         const text = pendingMessageText(m);
         if (!text || seen.has(text)) continue;
         out.push(m);

package/src/runtime/agent/orchestrator/tools/bash-policy-scan.mjs

@@ -41,21 +41,17 @@ export function injectionBlockTargets(cmd) {
   return targets;
 }
 
-const _unquoteSpansForPolicy = (s) => s.replace(/"([^"\\]|\\.)*"|'([^'\\]|\\.)*'/g, (m) => m.slice(1, -1));
-
 export function buildBashPolicyScanTargets(command) {
   const cmd = String(command || '');
   if (!cmd) return [];
   const targets = [
     cmd,
     stripQuotedAndHeredoc(cmd),
-    _unquoteSpansForPolicy(cmd),
     ...extractShellCInner(cmd).map(stripQuotedAndHeredoc),
-    ...extractShellCInner(cmd).map(_unquoteSpansForPolicy),
     ...injectionBlockTargets(cmd),
   ];
   for (const inner of extractPowerShellCommandInner(cmd)) {
-    targets.push(inner, stripQuotedAndHeredoc(inner), _unquoteSpansForPolicy(inner));
+    targets.push(inner, stripQuotedAndHeredoc(inner));
   }
   const psDecoded = decodePowerShellEncodedCommand(cmd);
   if (psDecoded) targets.push(psDecoded);