mixdog 0.9.37 → 0.9.39

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -26,6 +26,7 @@ let _localTracePath = null;
 let _localTraceBuffer = [];
 let _localTraceTimer = null;
 let _localTraceFlushInFlight = false;
+let _localTraceFlushPromise = null;
 let _toolFailurePath = null;
 let _toolFailureBuffer = [];
 let _toolFailureTimer = null;
@@ -132,12 +133,10 @@ function _flushLocalTrace() {
         clearTimeout(_localTraceTimer);
         _localTraceTimer = null;
     }
-    if (_localTraceBuffer.length === 0) return;
     if (_localTraceFlushInFlight) {
-        _localTraceTimer = setTimeout(_flushLocalTrace, 25);
-        _localTraceTimer.unref?.();
-        return;
+        return _localTraceFlushPromise;
     }
+    if (_localTraceBuffer.length === 0) return null;
     const path = _resolveLocalTracePath();
     if (!path) return;
     const chunk = _localTraceBuffer.join('');
@@ -157,17 +156,20 @@ function _flushLocalTrace() {
     // mode only applies on file creation; existing files keep their mode.
     // Windows ignores POSIX bits — ACL governs there.
     _localTraceFlushInFlight = true;
-    appendFile(path, chunk, { encoding: 'utf8', mode: 0o600 })
+    const pending = appendFile(path, chunk, { encoding: 'utf8', mode: 0o600 })
         .catch((err) => {
             warnAgentOnce('agent-trace:local-spool', `[agent-trace] local spool failed (${err?.message})`);
         })
         .finally(() => {
             _localTraceFlushInFlight = false;
+            _localTraceFlushPromise = null;
             if (_localTraceBuffer.length > 0) {
                 _localTraceTimer = setTimeout(_flushLocalTrace, 0);
                 _localTraceTimer.unref?.();
             }
         });
+    _localTraceFlushPromise = pending;
+    return pending;
 }
 
 function _flushLocalTraceSync() {
@@ -294,7 +296,20 @@ function _scheduleFlush(immediate = false) {
     }
 }
 
+async function _drainLocalTrace() {
+    if (!_resolveLocalTracePath()) return;
+    if (_localTraceTimer) {
+        clearTimeout(_localTraceTimer);
+        _localTraceTimer = null;
+    }
+    while (_localTraceBuffer.length > 0 || _localTraceFlushInFlight) {
+        const pending = _flushLocalTrace();
+        if (pending) await pending;
+    }
+}
+
 async function drainAgentTrace() {
+    await _drainLocalTrace();
     if (!_resolveServiceUrl()) return;
     if (_flushTimer) { clearTimeout(_flushTimer); _flushTimer = null; }
     for (let i = 0; i < 10 && _buffer.length > 0; i++) {

package/src/runtime/agent/orchestrator/dispatch-persist.mjs

@@ -372,6 +372,27 @@ export function recoverPending(dataDir, notifyFn, { sessionId, priorSessionId, c
         const entry = map[handle] || {};
         const tool = entry.tool || 'dispatch';
         const queries = Array.isArray(entry.queries) ? entry.queries : [];
+        // Determine the true owner session for this entry. A scoped recovery
+        // may have matched purely on clientHostPid (not on the owner session
+        // id); in that case we must NOT stamp the reconnecting filter session's
+        // id onto another session's abort — that injects an old-session abort
+        // into the wrong resumed session. Deliver to the true owner session, or
+        // leave the entry persisted when it carries no owner session to target.
+        const cid = entry.callerSessionId != null && String(entry.callerSessionId)
+          ? String(entry.callerSessionId)
+          : null;
+        const ownerMatch = cid != null && (cid === filterSid || (priorSid != null && cid === priorSid));
+        if (scoped && !ownerMatch && cid == null) {
+          // hostPid-only match with no owner session id — cannot target a
+          // session safely. Leave persisted for a correctly-scoped recovery.
+          continue;
+        }
+        // Owner match → prefer the reconnecting filter session id (the owner's
+        // new session). When only priorSessionId matched and no current
+        // sessionId was supplied, filterSid is null — keep the entry's known
+        // owner `cid` for stamping/ack scoping rather than dropping it.
+        // Non-owner matches (hostPid-only) always stamp the entry's true owner.
+        const stampSid = (ownerMatch && filterSid) ? filterSid : cid;
         // Single recovery mode: the worker was in flight at restart. Emit the
         // Aborted boilerplate so the Lead can retry. Completed result bodies are
         // never persisted, so there is nothing to replay here.
@@ -383,21 +404,23 @@ export function recoverPending(dataDir, notifyFn, { sessionId, priorSessionId, c
           dispatch_id: handle,
           tool,
           error: String(isError),
-          ...(filterSid
-            ? { caller_session_id: filterSid }
-            : (entry.callerSessionId ? { caller_session_id: entry.callerSessionId } : {})),
+          ...(stampSid ? { caller_session_id: stampSid } : {}),
           ...(filterHostPid > 0
             ? { client_host_pid: String(filterHostPid) }
             : (entry.clientHostPid > 0 ? { client_host_pid: String(entry.clientHostPid) } : {})),
           instruction: `Earlier ${tool} dispatch (${handle}) was aborted by a plugin restart. Retry if the answer is still needed.`,
         };
         try { process.stderr.write(`[dispatch-persist] recover handle=${handle} tool=${tool} kind=abort\n`); } catch { /* best-effort */ }
-        // Entry remains on disk until notifyFn resolves.  A crash between
-        // fire and ack is safe: the entry survives and recoverPending re-fires
-        // it on the next restart.  Only clear AFTER ack to prevent silent loss.
+        // Entry remains on disk until notifyFn settles as DELIVERED. Matching
+        // notifyToolCompletion settlement semantics (tool-execution-contract),
+        // only an explicit `false`/`0` resolve counts as undelivered and keeps
+        // the entry for retry; any other resolve (including `undefined`/void
+        // from a delivered notifyFn) removes it — otherwise it re-fires until
+        // TTL. A crash between fire and ack is likewise safe: the entry survives
+        // and recoverPending re-fires it on the next restart.
         try {
-          Promise.resolve(notifyFn(content, meta)).then(() => {
-            removePending(dataDir, handle);
+          Promise.resolve(notifyFn(content, meta)).then((ok) => {
+            if (ok !== false && ok !== 0) removePending(dataDir, handle);
           }).catch(() => { /* best-effort — entry stays for next recoverPending */ });
         } catch { /* best-effort */ }
       }

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-credentials.mjs

@@ -411,6 +411,14 @@ export async function beginOAuthLogin() {
     };
     const url = buildUrl(OAUTH_REDIRECT_URI);
     const manualUrl = buildUrl(OAUTH_MANUAL_REDIRECT_URI);
+    const openLoginUrl = async (targetUrl, label = 'login') => {
+        try {
+            const { openInBrowser } = await import('../../../shared/open-url.mjs');
+            openInBrowser(targetUrl.toString());
+        } catch (err) {
+            process.stderr.write(`[anthropic-oauth] browser open failed for ${label} URL: ${String(err?.message || err).slice(0, 200)}\n`);
+        }
+    };
 
     let server = null;
     let timeout = null;
@@ -454,14 +462,12 @@ export async function beginOAuthLogin() {
         timeout = setTimeout(() => finish(null), OAUTH_LOGIN_TIMEOUT_MS);
         server.listen(OAUTH_CALLBACK_PORT, OAUTH_CALLBACK_HOST, async () => {
             process.stderr.write(`\n[anthropic-oauth] Open this URL to log in with Claude:\n${url.toString()}\n\nIf the localhost callback cannot complete, open this manual URL and paste the shown code#state:\n${manualUrl.toString()}\n\n`);
-            try {
-                const { openInBrowser } = await import('../../../shared/open-url.mjs');
-                openInBrowser(url.toString());
-            } catch (err) {
-                process.stderr.write(`[anthropic-oauth] browser open failed: ${String(err?.message || err).slice(0, 200)}\n`);
-            }
+            await openLoginUrl(url, 'callback');
+        });
+        server.on('error', async (err) => {
+            process.stderr.write(`\n[anthropic-oauth] localhost callback unavailable on ${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}: ${err?.message || err}\n[anthropic-oauth] Opening manual login URL instead. Paste the shown code#state:\n${manualUrl.toString()}\n\n`);
+            await openLoginUrl(manualUrl, 'manual');
         });
-        server.on('error', (err) => finish(null, new Error(`[anthropic-oauth] callback server failed on ${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}: ${err?.message || err}`)));
     });
 
     return {

package/src/runtime/agent/orchestrator/providers/codex-client-meta.mjs

@@ -16,7 +16,10 @@
 import os from 'node:os';
 
 // Offline fallback only; live value refreshes from npm (24h TTL, in-process).
-export const CODEX_CLIENT_VERSION_FLOOR = '0.142.5';
+// The backend gates model exposure AND per-request model access on the client
+// version (gpt-5.6-* require >= 0.144.0 per codex models-manager/models.json,
+// verified 2026-07-09), so keep this at the current release when bumping.
+export const CODEX_CLIENT_VERSION_FLOOR = '0.144.1';
 const VERSION_TTL_MS = 24 * 60 * 60_000;
 let _cache = { value: null, fetchedAt: 0 };
 let _refreshInFlight = null;
@@ -52,6 +55,23 @@ export function codexClientVersionSync() {
     return _cache.value || CODEX_CLIENT_VERSION_FLOOR;
 }
 
+/**
+ * Awaitable warmup for cold-start paths: resolves the live npm version (or
+ * floor on failure) and fills the shared cache so codexClientVersionSync()
+ * and codexVersionHeader() stop reporting the floor. Never rejects; dedupes
+ * with the in-flight background refresh. First turns await this so the
+ * backend's minimal_client_version gate never sees a stale floor.
+ */
+export function warmCodexClientVersion() {
+    if (_cache.value && Date.now() - _cache.fetchedAt < VERSION_TTL_MS) {
+        return Promise.resolve(_cache.value);
+    }
+    if (!_refreshInFlight) {
+        _refreshInFlight = _refresh().finally(() => { _refreshInFlight = null; });
+    }
+    return _refreshInFlight;
+}
+
 function _osType() {
     // codex os_info reports "Windows"/"Mac OS"/"Linux"; node os.type() gives
     // Windows_NT/Darwin/Linux. Map to codex's vocabulary.

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -897,12 +897,12 @@ export async function sendViaWebSocket({
 
             // Warmup writes the same prefix with generate:false, but the first
             // real response must still be a FULL generating frame. Reusing the
-            // warmup response_id here causes _buildResponseCreateFrame() to drop
-            // `instructions` (previous_response_id frames cannot carry them) and
-            // can also reduce the frame input to [] when the warmup input matches.
-            // That made first-turn lead/system rules effectively disappear
-            // ("who are you?" answered as a generic OpenAI assistant). Keep the
-            // warmup state for cache/trace, but compute the main frame as cold.
+            // warmup response_id here would make _computeDelta reduce the frame
+            // input to [] when the warmup input matches, and a generate:false
+            // warmup is not a chainable response to continue from — so the first
+            // real turn would generate from an empty frame. Keep the warmup state
+            // for cache/trace, but compute the main frame as cold (full input +
+            // instructions).
             const deltaEntry = warmupResult
                 ? {
                     ...entry,

package/src/runtime/agent/orchestrator/providers/openai-oauth.mjs

@@ -59,6 +59,7 @@ import {
     _shouldUseOpenAIHttpFallback,
 } from './openai-oauth-http-sse.mjs';
 import { createOpenAIOAuthLogin } from './openai-oauth-login.mjs';
+import { warmCodexClientVersion } from './codex-client-meta.mjs';
 import {
     _displayCodexModel,
     _codexFamily,
@@ -77,42 +78,13 @@ const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
 export const CODEX_OAUTH_ORIGINATOR = 'codex_cli_rs';
 const TOKEN_URL = 'https://auth.openai.com/oauth/token';
 export const CODEX_RESPONSES_URL = 'https://chatgpt.com/backend-api/codex/responses';
-// Version string baked into the models endpoint query — the OAuth backend
-// rejects the request without it, and gates new model exposures (e.g.
-// gpt-5.5 only on >= 0.130.0) on this client_version header; older versions
-// trigger a visibility-filtered catalog (e.g. only rollout models). Resolved
-// dynamically from npm so newly-shipped models surface within a day instead
-// of waiting on a hardcoded bump here. Cached 24h in-process; npm failure
-// falls back to the floor below.
-// Offline fallback only — _resolveCodexClientVersion() fetches the live
-// @openai/codex latest from npm first. Bumped to the current release
-// (0.142.5, verified 2026-07-03) so the offline path stays close to what the
-// backend expects for client-version gating.
-const CODEX_CLIENT_VERSION_FLOOR = '0.142.5';
-const CODEX_VERSION_CACHE_TTL_MS = 24 * 60 * 60_000;
-let _codexVersionCache = { value: null, fetchedAt: 0 };
-
-async function _resolveCodexClientVersion() {
-    const now = Date.now();
-    if (_codexVersionCache.value && now - _codexVersionCache.fetchedAt < CODEX_VERSION_CACHE_TTL_MS) {
-        return _codexVersionCache.value;
-    }
-    try {
-        const res = await fetch('https://registry.npmjs.org/@openai/codex/latest', {
-            signal: AbortSignal.timeout(5_000),
-        });
-        if (res.ok) {
-            const j = await res.json();
-            const v = String(j?.version || '').trim();
-            if (/^\d+\.\d+\.\d+/.test(v)) {
-                _codexVersionCache = { value: v, fetchedAt: now };
-                return v;
-            }
-        }
-    } catch { /* network down / npm rejects — use floor */ }
-    _codexVersionCache = { value: CODEX_CLIENT_VERSION_FLOOR, fetchedAt: now };
-    return CODEX_CLIENT_VERSION_FLOOR;
-}
+// Client version for the models endpoint query and the `version`/User-Agent
+// request headers — the OAuth backend rejects requests without it, gates new
+// model exposures on it (gpt-5.6-* require >= 0.144.0), and rejects turns on
+// gated models when the reported version is below the model's
+// minimal_client_version. Resolution is unified in codex-client-meta.mjs
+// (live npm @openai/codex latest, 24h in-process cache, offline floor) so the
+// catalog query and the transport headers can never disagree.
 const CODEX_MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
 const CODEX_MODEL_CACHE_SCHEMA_VERSION = 3;
 const TOKEN_REFRESH_SKEW_MS = 5 * 60_000;
@@ -784,7 +756,14 @@ export class OpenAIOAuthProvider {
             ? Promise.resolve(opts._prebuiltBody)
             : Promise.resolve().then(() => buildRequestBody(messages, useModel, tools, bodyOpts));
         const _authP = this.ensureAuth();
+        // Cold-start guard: the WS/SSE transports read the client version via
+        // the SYNC accessor for the `version` header + User-Agent. Await the
+        // shared resolver (parallel with auth; never rejects; no-op once
+        // cached) so the first turn after boot doesn't report the offline
+        // floor and trip the backend's minimal_client_version gate.
+        const _verP = warmCodexClientVersion();
         let auth = await _authP;
+        await _verP;
         const body = await _bodyP;
         // poolKey != cacheKey by design (see openai-oauth-ws.mjs header note).
         // poolKey is per-session so parallel reviewer/worker callers each get
@@ -1038,7 +1017,7 @@ export class OpenAIOAuthProvider {
         }
         try {
             const auth = await this.ensureAuth();
-            const clientVersion = await _resolveCodexClientVersion();
+            const clientVersion = await warmCodexClientVersion();
             const url = `https://chatgpt.com/backend-api/codex/models?client_version=${clientVersion}`;
             const res = await fetch(url, {
                 signal: AbortSignal.timeout(10_000),
@@ -1076,7 +1055,7 @@ export class OpenAIOAuthProvider {
         _codexRefreshInFlight = (async () => {
             try {
                 const auth = await this.ensureAuth();
-                const clientVersion = await _resolveCodexClientVersion();
+                const clientVersion = await warmCodexClientVersion();
                 const url = `https://chatgpt.com/backend-api/codex/models?client_version=${clientVersion}`;
                 const res = await fetch(url, {
                     signal: AbortSignal.timeout(10_000),

package/src/runtime/agent/orchestrator/providers/openai-ws-delta.mjs

@@ -195,9 +195,11 @@ const TRANSPORT_ONLY_FRAME_FIELDS = new Set(['stream', 'background']);
 // identical byte-for-byte: `type` always leads, then the body's codex
 // struct-order keys follow verbatim. A delta send passes previousResponseId
 // (inserted immediately before `input`, matching codex's refs position) and
-// inputOverride (the stripped tail); instructions are dropped whenever
-// previous_response_id is present because the server resolves them from the
-// chained response and rejects sending both fields together.
+// inputOverride (the stripped tail). `instructions` MUST still be resent on
+// previous_response_id frames: per the OpenAI Responses API, the previous
+// response's top-level instructions are NOT carried over to the chained
+// response, so dropping them here strips the system/lead prompt from every
+// continuation turn. Only an empty instructions string is omitted.
 // Full/warmup frames pass the body unchanged and keep every key in place.
 // omitTransportFields is used by wire-parity/prewarm helpers to drop stream/background.
 export function _buildResponseCreateFrame(body, { previousResponseId = null, inputOverride, omitTransportFields = false } = {}) {
@@ -215,7 +217,6 @@ export function _buildResponseCreateFrame(body, { previousResponseId = null, inp
     for (const key of Object.keys(src)) {
         if (omitTransportFields && TRANSPORT_ONLY_FRAME_FIELDS.has(key)) continue;
         if (key === 'instructions') {
-            if (previousResponseId != null) continue;
             const instr = src.instructions;
             if (typeof instr === 'string' && instr.length) frame.instructions = instr;
             continue;

package/src/runtime/agent/orchestrator/providers/openai-ws-pool.mjs

@@ -15,6 +15,10 @@ import { codexOriginator, codexUserAgent, codexVersionHeader } from './codex-cli
 import {
     PROVIDER_WS_ACQUIRE_TIMEOUT_MS,
     PROVIDER_WS_HANDSHAKE_TIMEOUT_MS,
+    PROVIDER_WS_PING_ENABLED,
+    PROVIDER_WS_PING_INTERVAL_MS,
+    PROVIDER_WS_PONG_TIMEOUT_MS,
+    PROVIDER_WS_LIVENESS_STALE_MS,
     resolveTimeoutMs,
 } from '../stall-policy.mjs';
 
@@ -36,6 +40,10 @@ export const WS_IDLE_MS = resolveTimeoutMs(
 );
 const WS_HANDSHAKE_TIMEOUT_MS = PROVIDER_WS_HANDSHAKE_TIMEOUT_MS;
 const WS_ACQUIRE_TIMEOUT_MS = PROVIDER_WS_ACQUIRE_TIMEOUT_MS;
+const WS_PING_INTERVAL_MS = PROVIDER_WS_PING_INTERVAL_MS;
+const WS_PONG_TIMEOUT_MS = PROVIDER_WS_PONG_TIMEOUT_MS;
+const WS_LIVENESS_STALE_MS = PROVIDER_WS_LIVENESS_STALE_MS;
+const WS_PING_ENABLED = PROVIDER_WS_PING_ENABLED;
 
 // WS socket pool buckets are keyed by `poolKey` (the per-call sessionId)
 // to isolate parallel agent invocations — each gets its own socket so
@@ -263,6 +271,10 @@ function _getPoolArr(poolKey) {
 }
 
 function _removeFromPool(poolKey, entry) {
+    // Always tear down per-entry timers so evicting a socket never leaks an
+    // idle-close or liveness-ping interval.
+    _clearIdle(entry);
+    _clearLiveness(entry);
     if (!poolKey) return;
     const arr = _wsPool.get(poolKey);
     if (!arr) return;
@@ -293,6 +305,70 @@ function _isOpen(entry) {
     return entry?.socket?.readyState === WebSocket.OPEN;
 }
 
+function _clearLiveness(entry) {
+    if (entry?.pingTimer) {
+        clearInterval(entry.pingTimer);
+        entry.pingTimer = null;
+    }
+}
+
+// Force a dead/half-open socket out of the pool. close() alone can hang on a
+// wedged socket, so follow with terminate() to guarantee FD release.
+function _evictDead(poolKey, entry) {
+    try { entry.socket.close(1000, 'ws_liveness_dead'); } catch {}
+    try { entry.socket.terminate?.(); } catch {}
+    _removeFromPool(poolKey, entry);
+}
+
+// Send one ws-level ping and resolve true iff a pong lands within timeoutMs.
+// Never rejects. On any success it refreshes lastAliveAt so the caller/loop
+// treats the socket as fresh.
+function _pingProbe(entry, timeoutMs) {
+    return new Promise((resolve) => {
+        const socket = entry?.socket;
+        if (!socket || socket.readyState !== WebSocket.OPEN) { resolve(false); return; }
+        let done = false;
+        const finish = (alive) => {
+            if (done) return;
+            done = true;
+            clearTimeout(timer);
+            try { socket.removeListener('pong', onPong); } catch {}
+            resolve(alive);
+        };
+        const onPong = () => { entry.lastAliveAt = Date.now(); finish(true); };
+        const timer = setTimeout(() => finish(false), timeoutMs);
+        try { timer.unref?.(); } catch {}
+        try {
+            socket.on('pong', onPong);
+            socket.ping();
+        } catch {
+            finish(false);
+        }
+    });
+}
+
+// While an entry sits idle in the pool, ping it every WS_PING_INTERVAL_MS.
+// A missed pong (or a socket that is no longer OPEN) evicts the entry so it can
+// never be handed out dead. Busy entries are skipped — an in-flight turn has
+// its own inter-chunk/semantic-idle watchdogs.
+function _armLiveness(poolKey, entry) {
+    _clearLiveness(entry);
+    entry.pingTimer = setInterval(async () => {
+        if (entry.busy || entry.closing || entry.probing) return;
+        if (!_isOpen(entry)) { _evictDead(poolKey, entry); return; }
+        // Recent activity ⇒ assume live, skip the probe this tick.
+        if (Date.now() - (entry.lastAliveAt || 0) < WS_LIVENESS_STALE_MS) return;
+        entry.probing = true;
+        try {
+            const alive = await _pingProbe(entry, WS_PONG_TIMEOUT_MS);
+            if (!alive && !entry.busy) _evictDead(poolKey, entry);
+        } finally {
+            entry.probing = false;
+        }
+    }, WS_PING_INTERVAL_MS);
+    try { entry.pingTimer.unref?.(); } catch {}
+}
+
 // Awaited frame send. Asserts the socket is OPEN and resolves only after
 // the underlying transport reports the buffered write succeeded (or fails)
 // via the WebSocket send callback. Raw `socket.send(JSON.stringify(...))`
@@ -596,15 +672,36 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
         for (let i = arr.length - 1; i >= 0; i--) {
             if (!_isOpen(arr[i]) || arr[i].closing) {
                 _clearIdle(arr[i]);
+                _clearLiveness(arr[i]);
                 arr.splice(i, 1);
             }
         }
         if (arr.length === 0) _wsPool.delete(poolKey);
-        // Reuse any idle open entry (cache-warm path).
-        const idle = arr.find(e => !e.busy);
-        if (idle) {
+        // Reuse an idle open entry (cache-warm path). An entry with no observed
+        // activity within the freshness window is ping-probed under a short
+        // bound before hand-out; a dead one is evicted and the scan retries the
+        // next idle entry so a busy caller is never handed a wedged socket.
+        let idle;
+        while ((idle = arr.find(e => !e.busy))) {
             _clearIdle(idle);
+            _clearLiveness(idle);
+            // Reserve the entry BEFORE awaiting the probe: _pingProbe yields the
+            // event loop, so without this a second concurrent acquire could scan
+            // the same still-idle entry and both would take it. Marking busy up
+            // front makes the find() above skip it; on probe failure it is
+            // evicted (removed from arr) so the loop continues cleanly.
             idle.busy = true;
+            if (WS_PING_ENABLED && Date.now() - (idle.lastAliveAt || 0) >= WS_LIVENESS_STALE_MS) {
+                const alive = await _pingProbe(idle, WS_PONG_TIMEOUT_MS);
+                if (!alive) {
+                    if (process.env.MIXDOG_DEBUG_AGENT) {
+                        process.stderr.write(`[agent-trace] acquire-evict-dead poolKey=${poolKey} reason=missed_pong elapsed=${Date.now() - _acqStart}ms\n`);
+                    }
+                    _evictDead(poolKey, idle);
+                    continue;
+                }
+            }
+            idle.lastAliveAt = Date.now();
             // Defensive: pre-existing pooled entries created before the
             // prefix-hash field was introduced may not have it set. Normalize
             // to null so the first delta check reads a deterministic value
@@ -646,6 +743,11 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
                 ephemeral: true,
                 sessionToken: ephSessionToken,
             };
+            entry.lastAliveAt = Date.now();
+            entry.pingTimer = null;
+            entry.probing = false;
+            socket.on('pong', () => { entry.lastAliveAt = Date.now(); });
+            socket.on('message', () => { entry.lastAliveAt = Date.now(); });
             socket.on('close', () => { entry.closing = true; });
             return { entry, reused: false };
         }
@@ -674,6 +776,11 @@ export async function acquireWebSocket({ auth, poolKey, cacheKey, codexHeaders,
         ephemeral: false,
         sessionToken,
     };
+    entry.lastAliveAt = Date.now();
+    entry.pingTimer = null;
+    entry.probing = false;
+    socket.on('pong', () => { entry.lastAliveAt = Date.now(); });
+    socket.on('message', () => { entry.lastAliveAt = Date.now(); });
     if (poolKey && !forceFresh) _getPoolArr(poolKey).push(entry);
     socket.on('close', () => {
         entry.closing = true;
@@ -690,7 +797,12 @@ export function releaseWebSocket({ entry, poolKey, keep }) {
         _removeFromPool(poolKey, entry);
         return;
     }
+    // Mark activity at release, then arm both the idle-close timer and the
+    // periodic liveness ping so a socket that dies while pooled is evicted
+    // before the next acquire can hand it out.
+    entry.lastAliveAt = Date.now();
     _scheduleIdleClose(poolKey, entry);
+    if (WS_PING_ENABLED) _armLiveness(poolKey, entry);
 }
 
 // Drain-complete fence — set true once _closeAllPooledSockets runs so any
@@ -706,6 +818,10 @@ export function _closeAllPooledSockets(reason = 'shutdown') {
     _drainComplete = true;
     for (const arr of _wsPool.values()) {
         for (const entry of arr) {
+            // Tear down per-entry timers before dropping the map, otherwise the
+            // idle-close and liveness-ping intervals outlive the drained pool.
+            _clearIdle(entry);
+            _clearLiveness(entry);
             try { entry.socket.close(1000, reason); } catch {}
         }
     }

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -305,11 +305,18 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // cut off early. Other runaway protection is behavior-based (steering
     // ladder hints, REPEAT_FAIL_LIMIT), never a lower iteration count.
     let _iterWarnStage = 0;
-    const _iterWarnAt = [
-        Math.floor(maxLoopIterations * 0.5),
-        Math.floor(maxLoopIterations * 0.75),
-        Math.floor(maxLoopIterations * 0.9),
-    ];
+    // Tiny-cap loops (e.g. explorer cap=3) can't afford staged 50/75/90%
+    // steers — the 50% stage lands on iteration 1 in every session, spamming
+    // the normal batch→answer path. For caps < 10 emit ONE wrap-up warning at
+    // the penultimate iteration instead; caps >= 10 keep staged behavior.
+    const _singleWarn = maxLoopIterations < 10;
+    const _iterWarnAt = _singleWarn
+        ? [Math.max(1, maxLoopIterations - 1)]
+        : [
+            Math.floor(maxLoopIterations * 0.5),
+            Math.floor(maxLoopIterations * 0.75),
+            Math.floor(maxLoopIterations * 0.9),
+        ];
     while (true) {
         throwIfAborted();
         if (iterations >= maxLoopIterations) {
@@ -341,9 +348,11 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         if (_iterWarnStage < _iterWarnAt.length && iterations >= _iterWarnAt[_iterWarnStage]) {
             _iterWarnStage += 1;
             const warnAt = _iterWarnAt[_iterWarnStage - 1];
-            const stageMsg = _iterWarnStage === 1
-                ? `Iteration budget notice: ${warnAt} of ${maxLoopIterations} iterations used. Converge on a conclusion: prefer finishing the current objective over opening new exploration.`
-                : `Iteration budget warning (stage ${_iterWarnStage}): ${warnAt} of ${maxLoopIterations} iterations used — the loop hard-stops at ${maxLoopIterations}. Wrap up now: summarize progress, state what remains, and finish with your best current result.`;
+            const stageMsg = _singleWarn
+                ? `Iteration budget nearly spent: ${warnAt} of ${maxLoopIterations} iterations used — answer NOW with the best anchors you already hold.`
+                : _iterWarnStage === 1
+                    ? `Iteration budget notice: ${warnAt} of ${maxLoopIterations} iterations used. Converge on a conclusion: prefer finishing the current objective over opening new exploration.`
+                    : `Iteration budget warning (stage ${_iterWarnStage}): ${warnAt} of ${maxLoopIterations} iterations used — the loop hard-stops at ${maxLoopIterations}. Wrap up now: summarize progress, state what remains, and finish with your best current result.`;
             messages.push({ role: 'user', content: `<system-reminder>\n${stageMsg}\n</system-reminder>`, meta: 'hook' });
             process.stderr.write(`[loop] iteration warning stage ${_iterWarnStage} at ${iterations} (sess=${sessionId || 'unknown'}); continuing with steer.\n`);
             try {