mixdog 0.9.37 → 0.9.39

package/src/session-runtime/runtime-core.mjs

@@ -32,6 +32,11 @@ import {
 import { setConfiguredShell } from '../runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs';
 import { hasUserConversationMessage } from '../runtime/agent/orchestrator/session/manager/prompt-utils.mjs';
 import { markCompletionEntry } from '../runtime/agent/orchestrator/session/manager/pending-messages.mjs';
+import {
+  recordDeliveredCompletion,
+  isDeliveredCompletion,
+  logDuplicateSkip,
+} from '../runtime/agent/orchestrator/session/manager/delivered-completions.mjs';
 import {
   beginOAuthProviderLogin,
   forgetProviderAuth,
@@ -306,6 +311,26 @@ export function __saveModelSettingsForTest(cfgMod, route, options = {}) {
   return saveModelSettings(cfgMod, route, options);
 }
 
+// Decide whether notifyFnForSession should mirror a terminal tool completion
+// into the pending-message queue. Only the TUI execution-ui path actually
+// injects the model-visible twin of the completion into the active loop, and it
+// signals that with an EXPLICIT ack (modelVisibleDelivered) — never a generic
+// truthy onNotification return. Skipping the mirror on a bare `handled===true`
+// would let a display-only / API listener suppress the sole model-visible copy,
+// so the model would never see the completion body. Mirror UNLESS the body was
+// explicitly delivered; unknown/generic-handled → keep the mirror.
+export function shouldMirrorCompletionToPendingQueue({
+  callerSessionId,
+  modelVisibleDelivered,
+  hasEnqueue,
+  text,
+  meta = {},
+} = {}) {
+  if (!callerSessionId || !hasEnqueue) return false;
+  if (modelVisibleDelivered) return false;
+  return shouldPersistModelVisibleToolCompletion(text, meta);
+}
+
 export async function createMixdogSessionRuntime({
   provider,
   model,
@@ -742,7 +767,7 @@ export async function createMixdogSessionRuntime({
 
   function emitRuntimeNotification(content, meta = {}) {
     const text = String(content || '').trim();
-    if (!text) return false;
+    if (!text) return { handled: false, modelVisibleDelivered: false };
     const event = { content: text, meta: meta && typeof meta === 'object' ? meta : {} };
     let handled = false;
     for (const listener of [...notificationListeners]) {
@@ -750,24 +775,58 @@ export async function createMixdogSessionRuntime({
         if (listener(event) === true) handled = true;
       } catch {}
     }
-    return handled;
+    // EXPLICIT model-visible-delivery ack: only the TUI execution-ui path sets
+    // event.modelVisibleDelivered when it enqueues the model-visible completion
+    // body into the active loop. A generic display-only / API listener that
+    // returns true does NOT set it, so `handled` alone must never be read as
+    // "the model saw the body".
+    const modelVisibleDelivered = event.modelVisibleDelivered === true;
+    return { handled, modelVisibleDelivered };
   }
 
   function notifyFnForSession(callerSessionId) {
     return (text, meta = {}) => {
-      const handledByRuntimeListener = emitRuntimeNotification(text, meta);
+      const { handled: handledByRuntimeListener, modelVisibleDelivered } = emitRuntimeNotification(text, meta);
       let enqueued = false;
+      // Model-visible delivery ack (TUI execution-ui only): register this
+      // completion in the process-local delivered registry so a racing enqueue
+      // on another path (background reconcile/fallback/notify) within THIS
+      // process is skipped instead of double-injecting the same body next turn.
+      if (modelVisibleDelivered) {
+        try {
+          const deliveredVisible = modelVisibleToolCompletionMessage(text, meta);
+          recordDeliveredCompletion({ executionId: meta?.execution_id, text: deliveredVisible });
+        } catch {}
+      }
       // TUI sessions consume raw execution notifications for UI/task cards via
       // onNotification, but those raw envelopes are internal-only in pending
-      // drain. Always mirror terminal completions with a model-visible wrapper
-      // while keeping the raw text for UI display.
-      if (callerSessionId && typeof mgr.enqueuePendingMessage === 'function'
-        && shouldPersistModelVisibleToolCompletion(text, meta)) {
+      // drain. The TUI execution-ui path injects the model-visible twin of a
+      // terminal completion into the active loop and acks with
+      // modelVisibleDelivered, so mirroring it into the pending queue would
+      // double-inject the same completion — skip only on that EXPLICIT ack. A
+      // generic display-only / API listener returning true is NOT an ack: the
+      // mirror stays as the sole model-visible delivery.
+      if (shouldMirrorCompletionToPendingQueue({
+        callerSessionId,
+        modelVisibleDelivered,
+        hasEnqueue: typeof mgr.enqueuePendingMessage === 'function',
+        text,
+        meta,
+      })) {
         try {
           const visible = modelVisibleToolCompletionMessage(text, meta);
           // Terminal completion (gated by shouldPersistModelVisibleToolCompletion)
           // → tag so drain discards it on resume rather than replaying out-of-order.
-          if (visible) enqueued = mgr.enqueuePendingMessage(callerSessionId, markCompletionEntry(visible)) > 0;
+          if (visible) {
+            if (isDeliveredCompletion({ executionId: meta?.execution_id, text: visible })) {
+              // Already delivered+ACKed on the TUI path → suppress the mirror but
+              // report DELIVERED so the caller marks it notified and never retries.
+              logDuplicateSkip('mirror', { executionId: meta?.execution_id, text: visible });
+              enqueued = true;
+            } else {
+              enqueued = mgr.enqueuePendingMessage(callerSessionId, markCompletionEntry(visible)) > 0;
+            }
+          }
         } catch {}
       }
       // Headless/API listeners may exist but not consume the event; preserve
@@ -779,7 +838,16 @@ export async function createMixdogSessionRuntime({
           // modelVisibleToolCompletionMessage only returns non-empty for a
           // persistable terminal completion, so this fallback is a completion
           // too → tag it (genuine non-completion notifications yield '' above).
-          if (visible) enqueued = mgr.enqueuePendingMessage(callerSessionId, markCompletionEntry(visible)) > 0;
+          if (visible) {
+            if (isDeliveredCompletion({ executionId: meta?.execution_id, text: visible })) {
+              // Already delivered+ACKed on the TUI path → suppress the fallback
+              // enqueue but report DELIVERED so the caller stops retrying.
+              logDuplicateSkip('fallback', { executionId: meta?.execution_id, text: visible });
+              enqueued = true;
+            } else {
+              enqueued = mgr.enqueuePendingMessage(callerSessionId, markCompletionEntry(visible)) > 0;
+            }
+          }
         } catch {}
       }
       return enqueued || handledByRuntimeListener;
@@ -973,7 +1041,7 @@ export async function createMixdogSessionRuntime({
       const meta = params.meta && typeof params.meta === 'object' ? params.meta : {};
       const content = channelNotificationModelContent(params);
       if (!content) return;
-      const handled = emitRuntimeNotification(content, meta);
+      const { handled } = emitRuntimeNotification(content, meta);
       if (!handled && session?.id && shouldMirrorChannelNotificationToPending(meta)) {
         try { mgr.enqueuePendingMessage(session.id, content); } catch {}
       }

package/src/session-runtime/tool-catalog.mjs

@@ -27,6 +27,35 @@ export const MEASURED_TOOL_USAGE = Object.freeze({
   web_fetch: 2,
 });
 const MEASURED_TOOL_ORDER = Object.freeze(Object.keys(MEASURED_TOOL_USAGE));
+const toolSchemaBreakdownMemo = new WeakMap();
+
+function sameToolSchemaEntries(cached, tools) {
+  if (!cached || cached.entries.length !== tools.length) return false;
+  for (let index = 0; index < tools.length; index += 1) {
+    const entry = cached.entries[index];
+    const tool = tools[index];
+    if (entry.tool !== tool
+      || entry.name !== tool?.name
+      || entry.description !== tool?.description
+      || entry.inputSchema !== tool?.inputSchema
+      || entry.input_schema !== tool?.input_schema
+      || entry.parameters !== tool?.parameters
+      || entry.schema !== tool?.schema) return false;
+  }
+  return true;
+}
+
+function toolSchemaEntry(tool) {
+  return {
+    tool,
+    name: tool?.name,
+    description: tool?.description,
+    inputSchema: tool?.inputSchema,
+    input_schema: tool?.input_schema,
+    parameters: tool?.parameters,
+    schema: tool?.schema,
+  };
+}
 export const DEFERRED_DEFAULT_FULL_TOOLS = Object.freeze([
   'read',
   'code_graph',
@@ -125,6 +154,10 @@ export function toolSchemaBucket(tool) {
 }
 
 export function estimateToolSchemaBreakdown(tools) {
+  if (Array.isArray(tools)) {
+    const cached = toolSchemaBreakdownMemo.get(tools);
+    if (sameToolSchemaEntries(cached, tools)) return cached.value;
+  }
   const out = {};
   for (const tool of Array.isArray(tools) ? tools : []) {
     const bucket = toolSchemaBucket(tool);
@@ -133,6 +166,7 @@ export function estimateToolSchemaBreakdown(tools) {
     row.tokens += estimateToolSchemaTokens([tool]);
     out[bucket] = row;
   }
+  if (Array.isArray(tools)) toolSchemaBreakdownMemo.set(tools, { entries: tools.map(toolSchemaEntry), value: out });
   return out;
 }
 

package/src/session-runtime/warmup-schedulers.mjs

@@ -102,7 +102,13 @@ export function createWarmupSchedulers({
         scheduleProviderModelWarmup(backgroundBusyRetryMs);
         return;
       }
-      warmProviderModelCache();
+      if (!isFirstTurnCompleted() && !envFlag('MIXDOG_PROVIDER_WARMUP_BEFORE_FIRST_TURN')) {
+        bootProfile('provider-models:warm-deferred', { reason: 'first-turn-pending' });
+        warmProviderModelCache();
+        scheduleProviderModelWarmup(backgroundBusyRetryMs);
+        return;
+      }
+      warmProviderModelCache({ loadSecrets: true });
     }, delayMs);
     timers.providerModelWarmupTimer.unref?.();
   }

package/src/standalone/agent-tool/notify.mjs

@@ -4,6 +4,7 @@
 import { modelVisibleToolCompletionMessage } from '../../runtime/shared/tool-execution-contract.mjs';
 import { renderBackgroundTask, sanitizeTaskMeta, setBackgroundTaskEnqueueFallback } from '../../runtime/shared/background-tasks.mjs';
 import { markCompletionEntry } from '../../runtime/agent/orchestrator/session/manager/pending-messages.mjs';
+import { isDeliveredCompletion, logDuplicateSkip } from '../../runtime/agent/orchestrator/session/manager/delivered-completions.mjs';
 import { clean } from './helpers.mjs';
 
 export function createNotify(mgr) {
@@ -13,6 +14,18 @@ export function createNotify(mgr) {
     try {
       const visible = modelVisibleToolCompletionMessage(text, meta);
       if (!visible) return false;
+      // Skip-if-delivered: the TUI already injected + ACKed this completion
+      // body into the active loop, so this racing enqueue (fallback/reconcile
+      // or the async reject/false-resolve rescue) would double-inject it.
+      // Report DELIVERED (truthy), not false — a false return propagates through
+      // tryEnqueueFallback→onSettled(false), which un-marks notified/
+      // notifiedWithBody (background-tasks.mjs) and makes reconcile refire
+      // forever, eventually enqueuing a post-eviction duplicate. Suppressed here
+      // == already delivered, so the caller must mark it notified and stop.
+      if (isDeliveredCompletion({ executionId: meta?.execution_id, text: visible })) {
+        logDuplicateSkip('notify-enqueue', { executionId: meta?.execution_id, text: visible });
+        return true;
+      }
       // Mark this as a deferred completion/task notification so a later session
       // resume drops it rather than replaying it out-of-order (owner decision).
       return Boolean(mgr.enqueuePendingMessage(target, markCompletionEntry(visible)) > 0);

package/src/standalone/agent-tool.mjs

@@ -60,6 +60,7 @@ import {
 import { abnormalEmptyFinishError, renderResult } from './agent-tool/render.mjs';
 import { createProviderInit } from './agent-tool/provider-init.mjs';
 import { createNotify } from './agent-tool/notify.mjs';
+import { resolveAgentTerminalReapMs } from '../session-runtime/config-helpers.mjs';
 // Re-export the static tool descriptor so importers of this facade keep the
 // identical public surface (`import { AGENT_TOOL } from './agent-tool.mjs'`).
 export { AGENT_TOOL };
@@ -68,30 +69,6 @@ ensureProcessListenerHeadroom(64);
 
 const STANDALONE_SOURCE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 
-// Grace window during which a terminated/idle worker row is kept around so the
-// same terminal can re-use (or cleanly re-spawn) the same tag. Cached as a
-// constant like the other timeouts; override with MIXDOG_AGENT_TERMINAL_REAP_MS.
-// 5m (was 1h): aligned with the BP4 message-tail cache TTL — past 5m the
-// session's prompt cache is cold anyway, so same-tag reuse pays a full prefix
-// rewrite; a fresh respawn (send dead-tag fallback) starts smaller and cheaper.
-// Trace replay (2026-07): agent tail cost 1h 1.77M -> 5m 1.11M (-37%).
-const TERMINAL_REAP_MS = envTimeoutMs('MIXDOG_AGENT_TERMINAL_REAP_MS', 5 * 60_000);
-// Provider-aware reap windows: the 5m default matches Anthropic's 5m agent
-// tail TTL, but providers with long-lived automatic prefix caches (OpenAI 24h
-// retention, DeepSeek hours-days, Groq 2h) keep a warm cache well past 5m, so
-// same-tag reuse stays cheaper than a respawn. Capped at 1h — holding closed
-// worker sessions longer hoards manager memory for a reuse pattern that
-// rarely spans hours. Explicit MIXDOG_AGENT_TERMINAL_REAP_MS overrides all.
-const PROVIDER_REAP_MS = {
-  'openai': 60 * 60_000,
-  'deepseek': 60 * 60_000,
-  'groq': 60 * 60_000,
-  'openai-oauth': 10 * 60_000,
-};
-function reapMsForProvider(provider) {
-  if (clean(process.env.MIXDOG_AGENT_TERMINAL_REAP_MS)) return TERMINAL_REAP_MS;
-  return PROVIDER_REAP_MS[clean(provider)] || TERMINAL_REAP_MS;
-}
 // Independent hard cap for the spawn *prep* phase (ensureProvider /
 // prepareAgentSession / catalog+rules load). Kept separate from the
 // first-response watchdog so prep cannot hang a whole fanout before the model
@@ -161,7 +138,8 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
     const t = workerRowTime(row);
     if (!t) return true;
     if (!isTerminalWorkerStatus(row.status || row.stage)) return true;
-    return Date.now() - t < reapMsForProvider(row.provider);
+    const reapMs = resolveAgentTerminalReapMs(cfgMod.loadConfig(), row.provider);
+    return reapMs == null || Date.now() - t < reapMs;
   }
 
   function normalizeWorkerRows(value) {
@@ -562,6 +540,17 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
     removeWorkerRow({ tag, sessionId });
   }
 
+  function forgetTerminalSession(tag, sessionId) {
+    const value = clean(tag);
+    const id = clean(sessionId);
+    if (value && id && tags.get(value) === id) {
+      tags.delete(value);
+      tagAgents.delete(value);
+      tagCwds.delete(value);
+    }
+    if (id) removeWorkerRow({ sessionId: id });
+  }
+
   function cancelReap(sessionId) {
     const handle = reapTimers.get(sessionId);
     if (!handle) return false;
@@ -574,15 +563,16 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
     if (!sessionId) return;
     cancelReap(sessionId);
     const reapProvider = provider || getLiveSession(sessionId)?.provider || null;
+    const reapMs = resolveAgentTerminalReapMs(cfgMod.loadConfig(), reapProvider);
+    if (reapMs == null) return;
     const handle = setTimeout(() => {
       reapTimers.delete(sessionId);
       try { mgr.hideSessionFromList?.(sessionId); } catch {}
       const tag = tagForSession(sessionId);
-      if (tag) forgetTag(tag);
-      removeWorkerRow({ tag, sessionId });
+      forgetTerminalSession(tag, sessionId);
       clearAgentStatuslineRoute(sessionId);
       try { mgr.closeSession(sessionId, 'terminal-reap'); } catch {}
-    }, reapMsForProvider(reapProvider));
+    }, reapMs);
     handle.unref?.();
     reapTimers.set(sessionId, handle);
   }
@@ -872,8 +862,7 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
     if (!prepared?.session?.id) return;
     try { mgr.closeSession(prepared.session.id, reason); } catch {}
     try { clearAgentStatuslineRoute(prepared.session.id); } catch {}
-    if (prepared.tag) forgetTag(prepared.tag);
-    removeWorkerRow({ tag: prepared.tag, sessionId: prepared.session.id });
+    forgetTerminalSession(prepared.tag, prepared.session.id);
   }
 
   // Owner/worker completion notification lives in ./agent-tool/notify.mjs; the
@@ -1464,7 +1453,12 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
     const sessionId = resolveTag(target, scopedContext, { scanSessions: wantsSessionScan(args) });
     if (!sessionId) {
       if (!target.startsWith('sess_') && tagAgents.has(target)) {
-        forgetTag(target);
+        // This is only stale local metadata: resolveTag found no session in
+        // this terminal/scope, so there is no sessionId-safe worker row to
+        // delete. Never turn it into a tag-wide persisted-row removal.
+        tags.delete(target);
+        tagAgents.delete(target);
+        tagCwds.delete(target);
         if (task?.taskId) cancelBackgroundTask(task.taskId, 'cancelled by agent close');
         return { closed: true, forgotten: true, tag: target, sessionId: null, task_id: task?.taskId || null };
       }
@@ -1472,8 +1466,7 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
     }
     cancelReap(sessionId);
     const tag = tagForSession(sessionId);
-    if (tag) forgetTag(tag);
-    removeWorkerRow({ tag, sessionId });
+    forgetTerminalSession(tag, sessionId);
     clearAgentStatuslineRoute(sessionId);
     // Cancel any running background task bound to this session BEFORE closing
     // the session. Otherwise closeSession rejects the in-flight runSpawn with
@@ -1549,16 +1542,12 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
   function reapTerminalTraceForTag(tag, context = {}) {
     const value = clean(tag);
     if (!value || value.startsWith('sess_')) return false;
-    if (!hasTerminalTrace(value, context)) return false;
+    const row = terminalWorkerRowForTag(value, context);
+    if (!row) return false;
     refreshTagsFromSessions({ context });
-    let sessionId = tags.get(value) || '';
-    if (!sessionId) {
-      const row = readWorkerRows(context).find((item) => clean(item.tag) === value);
-      sessionId = clean(row?.sessionId) || '';
-    }
+    const sessionId = clean(row.sessionId);
     if (sessionId) cancelReap(sessionId);
-    forgetTag(value);
-    removeWorkerRow({ tag: value, sessionId });
+    forgetTerminalSession(value, sessionId);
     return true;
   }
 
@@ -1593,38 +1582,25 @@ export function createStandaloneAgent({ cfgMod, reg, mgr, dataDir, cwd: defaultC
           if (!fallbackTag || fallbackTag.startsWith('sess_') || !isDeadTarget) throw err;
           const prompt = clean(args.message || args.prompt);
           if (!prompt) throw err;
-          // Inherit the dead session's agent/cwd so the auto-respawn doesn't
-          // die on "agent spawn: agent is required" when Lead's send (correctly)
-          // omitted them. Read BEFORE forgetTag wipes the registry entries.
-          //
-          // Root cause of the surfaced "target not found" errors: when a tag is
-          // FULLY reaped (session gone past the 5m grace window), the in-memory
-          // tagAgents/tagCwds maps are cleared, so inheritedAgent came back empty
-          // and this path re-threw instead of respawning. Recover the agent/cwd
-          // from the persisted worker row, then fall back to the default `worker`
-          // agent so an unknown-but-plausible tag still cold-respawns. The guards
-          // above (empty tag / raw sess_ id / non-dead error) keep plainly invalid
-          // targets erroring.
-          // readWorkerRows is already scoped to THIS terminal (clientHostPid,
-          // via rowMatchesContext), so inheritedRow — and every mutation below
-          // keyed on its sessionId — never touches another terminal's same-tag
-          // worker row.
+          // A retained row is proof that this terminal owned the tag. Once the
+          // reaper removes that row, an explicit agent plus usable cwd is enough
+          // to cold-spawn a replacement without retaining closed sessions.
           let inheritedRow = null;
           try {
             inheritedRow = readWorkerRows(scopedContext).find((row) => clean(row.tag) === fallbackTag) || null;
           } catch { inheritedRow = null; }
-          // Gate the respawn on evidence the tag previously existed IN THIS
-          // terminal: a persisted, clientHostPid-scoped worker row. The
-          // in-memory tags/tagAgents/tagCwds maps are NOT reliable evidence —
-          // closeAll() calls refreshTagsFromSessions() with NO context
-          // (see ~L1501), which populates them from EVERY terminal's rows
-          // (readWorkerRows({}) — rowMatchesContext returns true with no pid),
-          // so they can hold a peer terminal's tag. A typo'd / never-existed
-          // tag has no scoped row and must keep the original "not found" error.
-          if (!inheritedRow) throw err;
-          const inheritedSessionId = clean(inheritedRow.sessionId);
-          const inheritedAgent = clean(args.agent) || clean(inheritedRow.agent) || 'worker';
-          const inheritedCwd = clean(args.cwd) || clean(inheritedRow.cwd) || clean(callerCwd);
+          // Never use explicit cold-spawn identity to take over a tag retained
+          // by another terminal. In-memory maps can contain peer entries, so
+          // inspect the persisted index directly.
+          const peerRow = readAllWorkerRows().find((row) => (
+            clean(row.tag) === fallbackTag && !rowMatchesContext(row, scopedContext)
+          ));
+          const explicitAgent = clean(args.agent);
+          const explicitCwd = clean(args.cwd) || clean(callerCwd);
+          if (peerRow || (!inheritedRow && (!explicitAgent || !explicitCwd))) throw err;
+          const inheritedSessionId = clean(inheritedRow?.sessionId);
+          const inheritedAgent = explicitAgent || clean(inheritedRow?.agent) || 'worker';
+          const inheritedCwd = clean(args.cwd) || clean(inheritedRow?.cwd) || clean(callerCwd);
           // Drop this terminal's in-memory trace and remove ONLY the persisted
           // row matching inheritedRow.sessionId. Do NOT call forgetTag here: it
           // does a tag-wide removeWorkerRow({tag,sessionId}) (L556) whose OR

package/src/standalone/explore-tool.mjs

@@ -9,6 +9,8 @@ import { ensureProcessListenerHeadroom } from '../runtime/shared/process-listene
 
 ensureProcessListenerHeadroom(64);
 
+const EXPLORE_NO_RELOOKUP_CONTRACT = 'Every returned requested path:line freezes the LOCATION only; read/code_graph detail inspection is valid when content was not returned; never re-locate it, and search only unresolved facets.';
+
 // Ported from the original mixdog tool-defs.mjs `explore` entry.
 // `aiWrapped` is dropped: in the standalone build there is no aiWrapped
 // dispatch hub — execution is wired directly in the runtime executor below
@@ -18,7 +20,7 @@ export const EXPLORE_TOOL = {
   name: 'explore',
   title: 'Explore',
   annotations: { title: 'Explore', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-  description: 'Locator for broad/uncertain targets with no known path — repo anchors AND out-of-repo/machine-wide file locations (e.g. "where does X store its logs/config"). Searches dot-directories via the hardened find internally. Array = independent targets: when starting a task, decompose what you need to know into facets (implementation site / config-load path / tests / error origin, ...) and fan them out as one query[] call (max 8, parallel) — never send rephrasings of the same target.',
+  description: `Broad/uncertain locator with no known path; use after input-state classification for repo anchors or out-of-repo/machine-wide locations. Hardened find searches dot-directories. Array = independent targets; array-first, facets in one query[] (max 8, parallel), never rephrasings. ${EXPLORE_NO_RELOOKUP_CONTRACT}`,
   inputSchema: {
     type: 'object',
     properties: {
@@ -87,14 +89,11 @@ function escapeXml(str) {
   return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }
 
-// Mirrors buildExplorerPrompt from the original ai-wrapped-dispatch: each
-// explorer receives ONLY its own query, with a trailing descriptive-only
-// reminder. The full no-verdict contract lives at system level
-// (rules/agent/30-explorer.md).
+// Each explorer receives only its own query. The full routing and behavioral
+// contract lives at system level (rules/agent/30-explorer.md).
 export function buildExplorerPrompt(query) {
-  return `<query>${escapeXml(query)}</query>\nReminder: RULE ZERO is a binary gate after every tool result: >=1 path:line matching a SPECIFIC query token (product/library/domain name) -> STOP and answer NOW with those exact coordinates, this IS your final turn; zero -> one more batch if budget remains. Turns 2-3 exist SOLELY as zero-hit recovery (the previous turn matched ZERO specific tokens); spending a turn to confirm, refine, or upgrade an anchor you already hold is a defect. A generic-word-only match (schema, handler, config, resolver, index, error...) while the query's specific tokens match nowhere counts as ZERO, not a hit. There is no third branch: "hits exist but I want better ones" IS branch one — answer now. A code_graph symbol hit (find_symbol/symbol_search returning path:line) IS an anchor — emit it directly, never re-locate it with grep. Credibility is mechanical (specific-token match), never judged: "is this the real implementation / final handler / just a wrapper" are caller questions, FORBIDDEN here; mark weak anchors ? and answer anyway. Flow/how/trigger queries: first matching definition/entry anchors ARE the complete answer — never trace the chain, one anchor per concept. You locate WHERE, never WHY. Scope is ALWAYS the session working directory: omit path or pass only a path seen in an earlier result; inventing a directory (/workspace/..., another repo's layout) is a defect — on zero hits change TOKENS, never guess paths. HARD max 3 tool turns; counter line (turn 1/3, turn 2/3, turn 3/3) on every tool message; expected shape is turn 1 -> answer, turns 2-3 are miss-recovery only (previous turn had ZERO matching lines), with changed tokens; after turn 3/3 you MUST answer best-so-far. Each turn = ONE maximal batch: a single grep whose pattern[] packs ALL token variants PLUS code_graph/find/glob in the SAME message; a single-tool turn is a wasted turn. Before emitting EXPLORATION_FAILED re-scan ALL earlier results: any line matching a specific query token -> answer with that anchor (? if weak) — a weak anchor beats a false miss; EXPLORATION_FAILED only when all 3 turns found zero token-matching lines. Output only anchor lines formatted as path:line — symbol/name — short reason, max 3 lines, or EXPLORATION_FAILED. No preamble, bullets, numbering, headings, summary, code quotes, analysis, verdicts, ratings, or recommendations.`;
+  return `<query>${escapeXml(query)}</query>`;
 }
-
 export function normalizeExploreQueries(rawQuery) {
   let raw = rawQuery;
   // Some clients JSON-stringify arrays when the schema field is loosely typed.

package/src/tui/App.jsx

@@ -592,6 +592,37 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false })
       searchModelsCacheRef.current = { models: null, at: 0 };
     }
   }, []);
+  // Boot-time catalog prefetch: warm the /model & /agents provider catalog and
+  // the /search catalog once at startup so those pickers open instantly from
+  // cache (openModelPicker still TTL-refreshes stale rows in the background).
+  // Provider models load first so the search catalog derives from the full
+  // runtime cache instead of the sparse quick rows. Guarded by the same
+  // generation seq as the onboarding prefetch so an auth-triggered
+  // clearModelCaches() can't be clobbered by a stale in-flight result.
+  useEffect(() => {
+    let alive = true;
+    const timer = setTimeout(async () => {
+      const seq = onboardingPrefetchSeqRef.current;
+      try {
+        const models = await Promise.resolve(store.listProviderModels?.() || []);
+        if (alive && seq === onboardingPrefetchSeqRef.current
+          && Array.isArray(models) && models.length > 0
+          && !Array.isArray(providerModelsCacheRef.current.models)) {
+          providerModelsCacheRef.current = { models, at: Date.now() };
+        }
+      } catch { /* prefetch is advisory; pickers fall back to their own load */ }
+      if (!alive) return;
+      try {
+        const searchModels = await Promise.resolve(store.listSearchModels?.() || []);
+        if (alive && Array.isArray(searchModels) && searchModels.length > 0
+          && !Array.isArray(searchModelsCacheRef.current.models)) {
+          searchModelsCacheRef.current = { models: searchModels, at: Date.now() };
+        }
+      } catch { /* prefetch is advisory; /search falls back to its own load */ }
+    }, 1500);
+    timer.unref?.();
+    return () => { alive = false; clearTimeout(timer); };
+  }, [store]);
   // Onboarding wizard + channel setup picker factories. Instantiated here —
   // after the onboarding refs above (const-TDZ) — with later-defined openers
   // (openProviderSetupPicker/openOutputStylePicker) threaded as lazy getters

package/src/tui/app/model-options.mjs

@@ -70,11 +70,13 @@ export const compareModelRecency = (a, b) => {
 
   const ta = releaseTime(a);
   const tb = releaseTime(b);
-  if (ta !== tb) return tb - ta;
-
-  if (!!a?.latest !== !!b?.latest) return a?.latest ? -1 : 1;
   const versionDelta = compareModelVersion(a, b);
+  // Release dates win only when both sides have one; sparse OAuth catalogs
+  // must not sink undated (often newest) models below dated/latest ones.
+  if (ta > 0 && tb > 0 && ta !== tb) return tb - ta;
   if (versionDelta) return versionDelta;
+  if (!!a?.latest !== !!b?.latest) return a?.latest ? -1 : 1;
+  if (ta !== tb) return tb - ta;
   return String(a?.display || a?.id || '').localeCompare(String(b?.display || b?.id || ''));
 };
 

package/src/tui/app/model-picker.mjs

@@ -48,11 +48,9 @@ export function createModelPicker({
     setChannelPrompt(null);
     setHookPrompt(null);
     setSettingsPrompt(null);
-    const modelPickerRequest = ++modelPickerRequestRef.current;
+    modelPickerRequestRef.current += 1;
     let modelPickerClosed = false;
-    let activeModelProvider = null;
     let providerListHighlightProvider = null;
-    const isActiveModelPicker = () => !modelPickerClosed && modelPickerRequestRef.current === modelPickerRequest;
     const returnTo = typeof options.returnTo === 'function' ? options.returnTo : null;
     const returnLabel = String(options.returnLabel || 'Agents');
     const returnOnNestedCancel = options.returnOnNestedCancel === true;
@@ -68,7 +66,6 @@ export function createModelPicker({
       : [];
     let refreshModelsPromise = null;
     let renderedQuickModels = false;
-    let renderActiveProviderModels = null;
     if (!providerModels.length || options.refreshModels === true) {
       setPicker({
         title: options.title || 'Model',
@@ -130,16 +127,12 @@ export function createModelPicker({
         providerListHighlightProvider = renderOptions.highlightProvider;
       }
       const highlightProvider = renderOptions.highlightProvider || providerListHighlightProvider || null;
-      activeModelProvider = null;
-      renderActiveProviderModels = null;
       const openProviderModelsPicker = (provider) => {
         if (!provider) return;
-        activeModelProvider = provider;
-        renderActiveProviderModels = () => openProviderModelsPicker(provider);
         const providerModels = models.filter((model) => model.provider === provider);
         const preferredEffort = (values = []) => {
           const allowed = values.filter(Boolean);
-          for (const value of ['high', 'medium', 'low', 'none', 'xhigh', 'max']) {
+          for (const value of ['high', 'medium', 'low', 'none', 'xhigh', 'max', 'ultra']) {
             if (allowed.includes(value)) return value;
           }
           return allowed[0] || null;
@@ -213,6 +206,7 @@ export function createModelPicker({
           if (value === 'medium') return '◑';
           if (value === 'high') return '◕';
           if (value === 'max') return '◆';
+          if (value === 'ultra') return '✦';
           return '●';
         };
         const effortColor = (value) => {
@@ -221,6 +215,7 @@ export function createModelPicker({
           if (value === 'medium') return theme.claude;
           if (value === 'high') return theme.error;
           if (value === 'max') return theme.permission;
+          if (value === 'ultra') return theme.permission;
           return theme.error;
         };
         const modelFooter = (model = null) => {
@@ -366,34 +361,27 @@ export function createModelPicker({
     };
 
     renderModelPicker();
-    const applyFreshModels = (freshModels) => {
-      if (!isActiveModelPicker()) return;
+    // Freshness policy: an open picker keeps the catalog it first rendered.
+    // Background refreshes only update the cache, so fresh rows apply on the
+    // NEXT open (re-entry) instead of re-sorting the list mid-selection.
+    const adoptFreshModels = (freshModels) => {
       if (!Array.isArray(freshModels) || freshModels.length === 0) return;
-      providerModels = freshModels;
-      models = normalizeModelOptions(providerModels);
-      cacheRef.current = { models: providerModels, at: Date.now() };
-      if (activeModelProvider === null) {
-        renderModelPicker();
-      } else if (typeof renderActiveProviderModels === 'function') {
-        renderActiveProviderModels();
-      }
+      cacheRef.current = { models: freshModels, at: Date.now() };
     };
     if (renderedQuickModels && refreshModelsPromise) {
-      void refreshModelsPromise.then(applyFreshModels).catch(() => {});
+      void refreshModelsPromise.then(adoptFreshModels).catch(() => {});
     } else if (cacheIsStale) {
       if (!providerModelsTtlRefreshPromise) {
         providerModelsTtlRefreshPromise = Promise.resolve(loadModels({ force: true }))
           .then((freshModels) => {
-            if (Array.isArray(freshModels) && freshModels.length > 0) {
-              cacheRef.current = { models: freshModels, at: Date.now() };
-            }
+            adoptFreshModels(freshModels);
             return freshModels;
           })
           .finally(() => {
             providerModelsTtlRefreshPromise = null;
           });
       }
-      void providerModelsTtlRefreshPromise.then(applyFreshModels).catch(() => {});
+      void providerModelsTtlRefreshPromise.catch(() => {});
     }
   };
 

package/src/tui/app/transcript-window.mjs

@@ -245,6 +245,7 @@ function toolHasDisplayResultForRows(item) {
 
 function toolExpandedRawTextForRows(item, rawRt) {
   if (item?.aggregate) return rawRt;
+  if (item?.agentResponseAggregate) return rawRt;
   const hasDisplayResult = toolHasDisplayResultForRows(item);
   if (hasDisplayResult) return toolDisplayedResultTextForRows(item);
   return stripLeadingStatusMarkerFromTextForRows(rawRt || '');