mixdog 0.9.38 → 0.9.40

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -8,12 +8,13 @@ import * as fsp from 'fs/promises';
 import { randomBytes } from 'crypto';
 import { join } from 'path';
 import { Worker } from 'worker_threads';
-import { getPluginData } from '../config.mjs';
+import { getPluginData, loadConfig } from '../config.mjs';
 import { isAgentOwner } from '../agent-owner.mjs';
 import { renameWithRetrySync } from '../../../shared/atomic-file.mjs';
 import { sanitizeContentForStoredHistory } from '../providers/media-normalization.mjs';
 import { scanTopLevelLifecycle } from './lifecycle-scan.mjs';
 import { rotateBoundedLog, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../../../../lib/mixdog-debug.cjs';
+import { resolveAgentTerminalReapMs } from '../../../../session-runtime/config-helpers.mjs';
 import {
     summaryIndexPath,
     _sessionSummary,
@@ -288,7 +289,10 @@ function _getOrSpawnWorker() {
         // (the originating call plus any that coalesced onto it before it was
         // posted). A supersede never lands here as a rejection — only a real
         // worker failure does.
-        if (ok) { for (const w of waiters) w.resolve(); }
+        if (ok) {
+            clearSessionSaveError(id);
+            for (const w of waiters) w.resolve();
+        }
         else {
             const e = new Error(`[session-store] worker save failed: ${error}`);
             for (const w of waiters) w.reject(e);
@@ -440,6 +444,7 @@ function _doSaveSync(payload) {
         }
         _renameWithRetrySync(tmp, target);
         _upsertSessionSummary(session);
+        clearSessionSaveError(id);
     } catch (err) {
         try { unlinkSync(tmp); } catch { /* ignore cleanup failure */ }
         throw err;
@@ -579,6 +584,7 @@ async function _doSave(payload) {
         }
         _renameWithRetrySync(tmp, target);
         _upsertSessionSummary(session);
+        clearSessionSaveError(id);
     } catch (err) {
         try { unlinkSync(tmp); } catch { /* ignore cleanup failure */ }
         _savePending.delete(id);
@@ -600,8 +606,37 @@ export function markSessionClosed(id, reason = 'manual') {
     _clearDebounce(id);
     const existing = loadSession(id);
     if (!existing) return null;
-    const newGen = (typeof existing.generation === 'number' ? existing.generation : 0) + 1;
-    const tombstone = { ...existing, closed: true, closedReason: reason, status: 'closed', generation: newGen, updatedAt: Date.now() };
+    // Re-close idempotence: a session that is ALREADY tombstoned keeps its
+    // ORIGINAL close time (updatedAt) and generation. The old code refreshed
+    // updatedAt=Date.now() on every call, so the 5-min idle sweep re-closing a
+    // stale summary row reset the tombstone age each cycle — tombstones never
+    // matured past the sweep threshold (immortality loop). Preserving the
+    // original close time lets the age accumulate so the tombstone sweep can
+    // reclaim it.
+    //
+    // The alreadyClosed / original-close-time / generation decision MUST come
+    // from the ON-DISK JSON, read cache-bypassing — NOT from loadSession(),
+    // which can serve a stale in-memory OPEN payload (a pending debounced save
+    // or a _liveSessions entry) after a late save. Deciding off that stale open
+    // copy would make a re-close of an already-tombstoned session look like a
+    // FIRST close and reset updatedAt+generation, resurrecting the exact
+    // immortality refresh this guard prevents. The disk file is the
+    // authoritative tombstone state.
+    let onDisk = null;
+    try { onDisk = JSON.parse(readFileSync(sessionPath(id), 'utf-8')); }
+    catch { onDisk = null; }
+    const alreadyClosed = onDisk
+        ? (onDisk.closed === true || onDisk.status === 'closed')
+        : (existing.closed === true);
+    // When the on-disk copy is already closed, base the (idempotent) tombstone
+    // rewrite on IT rather than on `existing`, so a stale open in-memory
+    // payload can never clobber the persisted tombstone's content/fields.
+    const base = (alreadyClosed && onDisk) ? onDisk : existing;
+    const closeTime = (alreadyClosed && typeof base.updatedAt === 'number' && base.updatedAt > 0)
+        ? base.updatedAt
+        : Date.now();
+    const newGen = (typeof base.generation === 'number' ? base.generation : 0) + (alreadyClosed ? 0 : 1);
+    const tombstone = { ...base, closed: true, closedReason: alreadyClosed ? (base.closedReason || reason) : reason, status: 'closed', generation: newGen, updatedAt: closeTime };
     // Bypass the queue + guard — this IS the tombstone write.
     const target = sessionPath(id);
     const tmp = target + '.' + randomBytes(6).toString('hex') + '.tmp';
@@ -613,6 +648,7 @@ export function markSessionClosed(id, reason = 'manual') {
         return null;
     }
     _savePending.delete(id);
+    clearSessionSaveError(id);
     _clearLiveSession(id);
     _deleteHeartbeat(id);
     _upsertSessionSummary(tombstone);
@@ -622,7 +658,10 @@ export function markSessionClosed(id, reason = 'manual') {
     // it reflects the session's full lifetime including the close turn.
     try {
         const _dataDir = getPluginData();
-        if (_dataDir) {
+        // Emit the close metric only on the FIRST close — a re-close of an
+        // already-tombstoned session is a no-op idempotent write and must not
+        // spam the close log or double-count lifetimes.
+        if (_dataDir && !alreadyClosed) {
             const _ts = new Date().toISOString();
             const _lifeMs = (typeof existing.createdAt === 'number' && existing.createdAt > 0)
                 ? (tombstone.updatedAt - existing.createdAt)
@@ -669,6 +708,7 @@ export function bumpSessionGeneration(id, reason = 'detach') {
         return null;
     }
     _savePending.delete(id);
+    clearSessionSaveError(id);
     _clearLiveSession(id);
     _deleteHeartbeat(id);
     _upsertSessionSummary(detached);
@@ -715,6 +755,7 @@ export function deleteSession(id, options = {}) {
         catch { /* fall through to .hb cleanup */ }
     }
     _deleteHeartbeat(id);
+    if (removed || !existsSync(path)) clearSessionSaveError(id);
     // deferSummaryUpdate: bulk callers (tombstone sweep) remove thousands of
     // rows — a per-id _removeSessionSummary would parse+rewrite the multi-MB
     // summary index once PER DELETION. They batch the index update themselves.
@@ -722,16 +763,24 @@ export function deleteSession(id, options = {}) {
     return removed;
 }
 const DEFAULT_SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes idle — aligned with Anthropic 5m messages tier and OpenAI in-memory cache window
-// Completed agents (idle/done/error) live until terminal reap - must
-// match TERMINAL_REAP_MS / _scheduleBridgeReap (3_600_000) in index.mjs and
-// agent stall watchdog, so the store sweep is the durable 1h reaper.
-const AGENT_TERMINAL_TTL_MS = 60 * 60 * 1000;
 const AGENT_TERMINAL_STATUSES = new Set(['idle', 'done', 'error']);
 // Hard wall-clock ceiling for sessions stuck in status='running'. The
 // stream-watchdog should abort stalled streams within ~120s, but if it misses
 // one (process crash, watchdog not started, provider never returned), this
 // backstop reclaims the file so the sweep doesn't leak zombies indefinitely.
 const RUNNING_STALL_MS = 10 * 60 * 1000;
+// Retention cap for resumable OPEN (non-tombstone) sessions. Lead/user resume
+// closes sessions with { tombstone:false } — the runtime detaches but the
+// session JSON stays open/resumable and is never lifecycle-closed, so without
+// a cap the sessions/ dir grows without bound (observed 782 open files). The
+// sweep prunes open sessions past EITHER bound: older than 14d, or beyond the
+// newest 300 (oldest first). The cap targets ONLY ephemeral agent/ownerless
+// sessions — explicit USER-owned conversations are never auto-pruned (deleting
+// a user's history, including the current foreground session which is idle
+// during a gated sweep, is unacceptable). A session with a live runtime entry
+// (options.isSessionLive) is additionally protected as defense-in-depth.
+const RESUMABLE_OPEN_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
+const RESUMABLE_OPEN_MAX_COUNT = 300;
 
 export function listStoredSessions() {
     const dir = getStoreDir();
@@ -800,12 +849,44 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     }
     const maxAge = ttlMs || DEFAULT_SESSION_TTL_MS;
     const sweepIdle = options.sweepIdle !== false;
+    let terminalReapConfig = null;
+    try { terminalReapConfig = loadConfig({ secrets: false }); } catch { /* built-ins remain available */ }
     const tombstoneMaxAgeMs = Number(options.tombstoneMaxAgeMs);
     const sweepTombstones = Number.isFinite(tombstoneMaxAgeMs) && tombstoneMaxAgeMs > 0;
+    // Retention cap for resumable open sessions runs only on the idle sweep
+    // (never on a tombstone-only pass). isSessionLive protects the current /
+    // actively-running sessions from being pruned by the retention cap.
+    const isSessionLive = typeof options.isSessionLive === 'function' ? options.isSessionLive : null;
+    const retainOpen = sweepIdle && options.retainOpenSessions !== false;
+    const _optAge = Number(options.openMaxAgeMs);
+    const _optCount = Number(options.openMaxCount);
+    const openMaxAgeMs = Number.isFinite(_optAge) && _optAge > 0 ? _optAge : RESUMABLE_OPEN_MAX_AGE_MS;
+    const openMaxCount = Number.isFinite(_optCount) && _optCount >= 0 ? _optCount : RESUMABLE_OPEN_MAX_COUNT;
     const dir = getStoreDir();
     if (!existsSync(dir))
         return { cleaned: 0, remaining: 0, details: [], tombstonesCleaned: 0, tombstoneDetails: [], tombstoneErrors: [] };
-    const summaries = listStoredSessionSummaries();
+    // Reconcile the index-derived candidate set with a direct directory scan:
+    // the summary index is a best-effort sidecar that can lag far behind disk
+    // (thousands of on-disk .json files may be absent from a smaller index).
+    // Any such orphan closed+mature tombstone would otherwise be unreachable by
+    // this sweep and accumulate forever. Union the index rows with every
+    // on-disk .json id, deduped by id; synthetic { id } rows are sufficient
+    // because the loop below re-reads all lifecycle truth from disk. This stays
+    // sweep-local and does NOT change listStoredSessionSummaries for other
+    // callers. Steady-state cost is one readdirSync plus cheap per-orphan reads.
+    const indexRows = listStoredSessionSummaries();
+    const summaries = indexRows;
+    try {
+        const seen = new Set();
+        for (const row of indexRows) { if (row?.id) seen.add(row.id); }
+        for (const f of readdirSync(dir)) {
+            if (!f.endsWith('.json')) continue;
+            const id = f.slice(0, -5);
+            if (!id || seen.has(id)) continue;
+            seen.add(id);
+            summaries.push({ id });
+        }
+    } catch { /* dir scan failure — fall back to index rows only */ }
     const now = Date.now();
     let cleaned = 0;
     let remaining = 0;
@@ -813,6 +894,11 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     const details = [];
     const tombstoneDetails = [];
     const tombstoneErrors = [];
+    // Retention-cap bookkeeping: collect surviving open (non-tombstone)
+    // sessions here, then prune oldest-first after the main loop.
+    const openCandidates = [];
+    let openPruned = 0;
+    const openPrunedDetails = [];
     for (const row of summaries) {
         try {
             if (!row?.id) continue;
@@ -828,38 +914,116 @@ export function sweepStaleSessions(ttlMs, options = {}) {
                 const hbPath = join(dir, `${row.id}.hb`);
                 if (existsSync(hbPath)) heartbeatMtime = statSync(hbPath).mtimeMs || 0;
             } catch { /* .hb unavailable — fall back to JSON fields */ }
-            const freshnessGateMs = sweepIdle ? maxAge : (sweepTombstones ? tombstoneMaxAgeMs : 0);
-            const newestKnown = Math.max(row.updatedAt || 0, row.lastHeartbeatAt || 0, row.createdAt || 0, jsonMtime, heartbeatMtime);
-            if (freshnessGateMs > 0 && newestKnown > 0 && now - newestKnown <= freshnessGateMs) {
-                remaining++;
-                continue;
+            // Truth source: the summary index is a deferred/best-effort sidecar,
+            // so a row can still claim status='idle'/open while the session JSON
+            // was already tombstoned. Read the real session JSON BEFORE the
+            // freshness gate so closed-ness is decided from AUTHORITATIVE on-disk
+            // state — otherwise idle-sweep re-closes an already-closed session via
+            // markSessionClosed (which, pre-fix, reset the tombstone age every
+            // 5-min cycle → immortality loop).
+            let raw = null;
+            try { raw = readFileSync(jsonPath, 'utf-8'); }
+            catch { /* racing unlink / transient read failure */ }
+            let actual = null;
+            let diskClosed;
+            if (raw == null) {
+                diskClosed = (row.closed === true || row.status === 'closed');
+            } else {
+                // Cheap top-level scan avoids allocating the whole messages array
+                // just to read the closed flag for the (common) fresh open
+                // session the gate will skip; full-parse only when the scan can't
+                // resolve the top-level flag.
+                const scan = scanTopLevelLifecycle(raw);
+                if (scan && typeof scan.closed === 'boolean') {
+                    diskClosed = scan.closed;
+                } else {
+                    try { actual = JSON.parse(raw); } catch { actual = null; }
+                    diskClosed = actual
+                        ? (actual.closed === true || actual.status === 'closed')
+                        : (row.closed === true || row.status === 'closed');
+                }
             }
-            // Already-closed tombstones are handled here before heartbeat
-            // sidecar checks; they do not need liveness probing.
-            if (row.closed === true || row.status === 'closed') {
-                if (sweepTombstones) {
-                    const updated = Number(row.updatedAt);
-                    const age = now - updated;
-                    if (Number.isFinite(updated) && age >= tombstoneMaxAgeMs) {
-                        try {
-                            if (deleteSession(row.id, { deferSummaryUpdate: true })) {
-                                tombstonesCleaned++;
-                                tombstoneDetails.push({ id: row.id, ageSeconds: Math.floor(age / 1000) });
-                                continue;
-                            }
-                        } catch (err) {
-                            tombstoneErrors.push({ id: row.id, message: err?.message || String(err) });
-                            remaining++;
+            if (diskClosed) {
+                // Closed sessions are EXEMPT from the freshness gate: a tombstone
+                // whose file/hb mtime keeps getting bumped would otherwise stay
+                // perpetually "fresh" and never mature. Maturity is governed ONLY
+                // by the ORIGINAL close time (disk updatedAt, not row.updatedAt
+                // which a stale row may carry from before the close).
+                if (!actual && raw != null) { try { actual = JSON.parse(raw); } catch { actual = null; } }
+                const closedAt = Number(actual?.updatedAt ?? row.updatedAt);
+                const age = now - closedAt;
+                if (sweepTombstones && Number.isFinite(closedAt) && age >= tombstoneMaxAgeMs) {
+                    try {
+                        if (deleteSession(row.id, { deferSummaryUpdate: true })) {
+                            tombstonesCleaned++;
+                            tombstoneDetails.push({ id: row.id, ageSeconds: Math.floor(age / 1000) });
                             continue;
                         }
+                    } catch (err) {
+                        tombstoneErrors.push({ id: row.id, message: err?.message || String(err) });
+                        remaining++;
+                        continue;
                     }
                 }
+                // Repair a stale summary row that still claimed the session was
+                // open: reflect the real closed state so the next sweep sees the
+                // correct closed=true/updatedAt and never re-closes it.
+                if (actual && !(row.closed === true || row.status === 'closed')) {
+                    try { _upsertSessionSummary(actual); } catch { /* best-effort */ }
+                }
                 remaining++;
                 continue;
             }
+            // Parse the open record before its freshness gate: completed agents
+            // use their provider's Advanced terminal duration rather than the
+            // general sweep cadence. A short provider override must therefore
+            // not be hidden behind the default 5-minute gate.
+            if (!actual && raw != null) { try { actual = JSON.parse(raw); } catch { actual = null; } }
+            const gateOwner = (actual && typeof actual.owner === 'string' && actual.owner.length > 0)
+                ? actual.owner : row.owner;
+            const gateStatus = (actual && typeof actual.status === 'string') ? actual.status : row.status;
+            const gateProvider = (actual && typeof actual.provider === 'string') ? actual.provider : row.provider;
+            const isCompletedAgentForGate = isAgentOwner({ owner: gateOwner })
+                && AGENT_TERMINAL_STATUSES.has(gateStatus);
+            const terminalReapMsForGate = isCompletedAgentForGate
+                ? resolveAgentTerminalReapMs(terminalReapConfig, gateProvider)
+                : null;
+            if (isCompletedAgentForGate && terminalReapMsForGate == null) {
+                remaining++;
+                continue;
+            }
+            // Freshness gate — OPEN sessions only (closed sessions handled and
+            // `continue`d above). Recently-touched open sessions are skipped
+            // cheaply here.
+            const freshnessGateMs = sweepIdle
+                ? (terminalReapMsForGate ?? maxAge)
+                : (sweepTombstones ? tombstoneMaxAgeMs : 0);
+            const newestKnown = Math.max(row.updatedAt || 0, row.lastHeartbeatAt || 0, row.createdAt || 0, jsonMtime, heartbeatMtime);
+            if (freshnessGateMs > 0 && newestKnown > 0 && now - newestKnown <= freshnessGateMs) {
+                remaining++;
+                continue;
+            }
+            // Prefer the AUTHORITATIVE on-disk JSON over the best-effort (and
+            // possibly stale) summary row for every open/idle liveness and
+            // ownership decision below — a stale row must not close or prune the
+            // wrong session. Full-parse here if the cheap scan skipped it.
+            if (!actual && raw != null) { try { actual = JSON.parse(raw); } catch { actual = null; } }
+            const effOwner = (actual && typeof actual.owner === 'string' && actual.owner.length > 0)
+                ? actual.owner : row.owner;
+            const ownerRef = { owner: effOwner };
+            const effStatus = (actual && typeof actual.status === 'string') ? actual.status : row.status;
+            const effUpdatedAt = Number(actual?.updatedAt) > 0 ? Number(actual.updatedAt) : (row.updatedAt || 0);
+            const effLastHb = Number(actual?.lastHeartbeatAt) > 0 ? Number(actual.lastHeartbeatAt) : (row.lastHeartbeatAt || 0);
+            const effCreatedAt = Number(actual?.createdAt) > 0 ? Number(actual.createdAt) : (row.createdAt || 0);
+            const effBashId = (actual && actual.implicitBashSessionId) || row.implicitBashSessionId || null;
+            const effProvider = (actual && typeof actual.provider === 'string') ? actual.provider : row.provider;
             // Sweep agent-owned and ownerless (legacy) sessions; skip explicit
-            // user sessions before touching heartbeat sidecars.
-            if (typeof row.owner === 'string' && row.owner.length > 0 && !isAgentOwner(row)) {
+            // user sessions before touching heartbeat sidecars. USER-owned
+            // conversations are NEVER added to the retention-cap candidate set —
+            // the cap must not auto-delete user history (nor the current
+            // foreground session, which is idle during a gated sweep). Only the
+            // ephemeral agent/ownerless sessions below feed the cap.
+            if (typeof effOwner === 'string' && effOwner.length > 0 && !isAgentOwner(ownerRef)) {
                 remaining++;
                 continue;
             }
@@ -870,18 +1034,19 @@ export function sweepStaleSessions(ttlMs, options = {}) {
             // Prefer .hb sidecar mtime — updated at tight cadence (≤5s) without
             // serialising the full JSON, so it reflects true liveness more
             // accurately than the JSON timestamp fields.
-            let lastActive = row.lastHeartbeatAt || row.updatedAt || row.createdAt || 0;
+            let lastActive = effLastHb || effUpdatedAt || effCreatedAt || 0;
             if (heartbeatMtime) lastActive = Math.max(lastActive, heartbeatMtime);
             // Running sessions are normally reaped by the stream-watchdog
             // within ~120s. Skip them here unless they've been silent past
             // RUNNING_STALL_MS, at which point they are treated as zombies.
-            if (row.status === 'running' && now - lastActive <= RUNNING_STALL_MS) {
+            if (effStatus === 'running' && now - lastActive <= RUNNING_STALL_MS) {
                 remaining++;
                 continue;
             }
-            const isCompletedAgent = isAgentOwner(row)
-                && AGENT_TERMINAL_STATUSES.has(row.status);
-            const sessionMaxAge = isCompletedAgent ? AGENT_TERMINAL_TTL_MS : maxAge;
+            const isCompletedAgent = isAgentOwner(ownerRef)
+                && AGENT_TERMINAL_STATUSES.has(effStatus);
+            const terminalReapMs = isCompletedAgent ? terminalReapMsForGate : null;
+            const sessionMaxAge = terminalReapMs ?? maxAge;
             if (now - lastActive > sessionMaxAge) {
                 try { markSessionClosed(row.id, 'idle-sweep'); }
                 catch (err) {
@@ -891,16 +1056,40 @@ export function sweepStaleSessions(ttlMs, options = {}) {
                 cleaned++;
                 details.push({
                     id: row.id,
-                    owner: row.owner || 'unknown',
+                    owner: effOwner || 'unknown',
                     idleMinutes: Math.round((now - lastActive) / 60000),
-                    bashSessionId: row.implicitBashSessionId || null,
+                    bashSessionId: effBashId,
                 });
             } else {
+                if (retainOpen) openCandidates.push({ id: row.id, lastActive });
                 remaining++;
             }
         }
         catch { /* skip corrupt */ }
     }
+    // ── Retention cap: prune resumable open (non-tombstone) sessions ──────────
+    // Newest-first: keep the most recent openMaxCount, prune anything older than
+    // openMaxAgeMs OR beyond the count. Live/current sessions (isSessionLive)
+    // are never pruned but still occupy a kept slot.
+    if (retainOpen && openCandidates.length > 0) {
+        openCandidates.sort((a, b) => (b.lastActive || 0) - (a.lastActive || 0));
+        let kept = 0;
+        for (const c of openCandidates) {
+            if (isSessionLive && isSessionLive(c.id)) { kept++; continue; }
+            const tooOld = openMaxAgeMs > 0 && now - (c.lastActive || 0) > openMaxAgeMs;
+            const overCount = kept >= openMaxCount;
+            if (!tooOld && !overCount) { kept++; continue; }
+            try {
+                if (deleteSession(c.id, { deferSummaryUpdate: true })) {
+                    openPruned++;
+                    openPrunedDetails.push({ id: c.id, ageSeconds: Math.floor((now - (c.lastActive || 0)) / 1000) });
+                    if (remaining > 0) remaining--;
+                } else {
+                    kept++;
+                }
+            } catch { kept++; }
+        }
+    }
     // Orphan .hb reap: a heartbeat sidecar whose .json no longer exists is dead
     // weight once it is also stale (older than maxAge) — the session JSON was
     // swept/closed but the .hb lingered (a pre-fix orphaned heartbeat). The
@@ -920,11 +1109,11 @@ export function sweepStaleSessions(ttlMs, options = {}) {
     // read-modify-write for the whole sweep instead of one per deleted id
     // (the index is multi-MB at scale; per-id rewrites made large sweeps
     // quadratic and stalled boot for seconds).
-    if (tombstoneDetails.length > 0) {
+    if (tombstoneDetails.length > 0 || openPrunedDetails.length > 0) {
         try {
-            const deletedIds = new Set(tombstoneDetails.map((d) => d.id));
+            const deletedIds = new Set([...tombstoneDetails, ...openPrunedDetails].map((d) => d.id));
             _pruneSummaryIndexIds(deletedIds);
         } catch { /* summary index is best-effort */ }
     }
-    return { cleaned, remaining, details, tombstonesCleaned, tombstoneDetails, tombstoneErrors };
+    return { cleaned, remaining, details, tombstonesCleaned, tombstoneDetails, tombstoneErrors, openPruned, openPrunedDetails };
 }

package/src/runtime/agent/orchestrator/session/tool-result-offload.mjs

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync } from 'fs';
-import { readdir, rmdir, unlink, writeFile } from 'fs/promises';
+import { readdir, rmdir, stat, unlink, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { getPluginData } from '../config.mjs';
 import { normalizeOutputPath } from '../tools/builtin/path-utils.mjs';
@@ -11,6 +11,7 @@ const TOOL_RESULT_SHELL_THRESHOLD_CHARS = 30_000;
 const TOOL_RESULT_SEARCH_THRESHOLD_CHARS = 50_000;
 const TOOL_RESULT_GREP_THRESHOLD_CHARS = 20_000;
 export const TOOL_RESULT_OFFLOAD_PREFIX = '[tool output offloaded:';
+const OFFLOAD_PRUNE_MIN_AGE_MS = 10 * 60 * 1000;
 
 // Per-tool persistence limits mirror reference per-tool maxResultSizeChars
 // rather than a single global value: Grep persists at 20k (CC GrepTool), Glob
@@ -147,6 +148,47 @@ export async function clearOffloadSession(sessionId) {
     } catch { /* best-effort */ }
 }
 
+// Remove sidecars that no longer occur in the live transcript. A serialized
+// path match is conservative: if messages cannot be serialized, or a path is
+// mentioned anywhere in a message, retain the file rather than risk deleting
+// one that can still be read by the model.
+export async function pruneOffloadSession(sessionId, getMessages) {
+    if (!sessionId || typeof getMessages !== 'function') return;
+    const dir = join(getPluginData(), 'tool-results', safeSessionSegment(sessionId));
+    if (!existsSync(dir)) return;
+    let candidates;
+    try {
+        const entries = await readdir(dir);
+        candidates = (await Promise.all(entries
+            .filter((name) => name.endsWith('.txt'))
+            .map(async (name) => {
+                const filePath = join(dir, name);
+                try {
+                    const fileStat = await stat(filePath);
+                    if (Date.now() - fileStat.mtimeMs < OFFLOAD_PRUNE_MIN_AGE_MS) return null;
+                    return { name, filePath };
+                } catch {
+                    return null;
+                }
+            })
+        )).filter(Boolean);
+    } catch { /* best-effort */ }
+    if (!candidates) return;
+    let serialized;
+    try { serialized = JSON.stringify(getMessages()); } catch { return; }
+    const haystack = process.platform === 'win32' ? serialized.toLowerCase() : serialized;
+    await Promise.all(candidates
+        .filter(({ name, filePath }) => {
+            const normalizedPath = normalizeOutputPath(filePath);
+            const needles = [normalizedPath, name];
+            return !needles.some((needle) => {
+                const value = process.platform === 'win32' ? needle.toLowerCase() : needle;
+                return haystack.includes(value);
+            });
+        })
+        .map(({ filePath }) => unlink(filePath).catch(() => { /* best-effort */ })));
+}
+
 export function isOffloadedToolResultText(text) {
     return typeof text === 'string' && text.startsWith(TOOL_RESULT_OFFLOAD_PREFIX);
 }

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -79,6 +79,11 @@ function clearGrepContextKeys(args, keys) {
 /** Lead-facing grep context: canonicalize aliases and clamp explicit values (overrides still apply). */
 export function applyGrepContextLeadPolicy(args) {
     if (!args || typeof args !== 'object' || Array.isArray(args)) return;
+    // Idempotent guard: the outer builtin guard (validateBuiltinArgs) and the
+    // executor (executeGrepTool) both call this on the SAME args object. The
+    // first pass folds aliases onto -A/-B/-C and clamps; a second pass would
+    // recompute the same folding for no effect. Skip once applied.
+    if (args._grepContextPolicyApplied) return;
     for (const [canonical, keys] of GREP_CONTEXT_KEY_GROUPS) {
         const found = firstNonZeroGrepContextArg(args, keys) || firstGrepContextArg(args, keys);
         if (!found) continue;
@@ -87,6 +92,12 @@ export function applyGrepContextLeadPolicy(args) {
         clearGrepContextKeys(args, keys);
         args[canonical] = shaped;
     }
+    // Non-enumerable so it never leaks into arg spreads, cache keys, or output.
+    try {
+        Object.defineProperty(args, '_grepContextPolicyApplied', {
+            value: true, enumerable: false, configurable: true, writable: true,
+        });
+    } catch { args._grepContextPolicyApplied = true; }
 }
 
 function isString(v) {
@@ -435,7 +446,7 @@ function guardGrep(a) {
     const grepMode = a.output_mode || a.mode;
     const hasExplicitCtx = ['-A', '-B', '-C', 'context'].some((k) => grepContextKeyPresent(a, k));
     const isCountOrFiles = grepMode === 'files_with_matches' || grepMode === 'count';
-    if (!isCountOrFiles && (grepMode === 'content_with_context' || hasExplicitCtx)) {
+    if (!isCountOrFiles && (grepMode == null || grepMode === 'content_with_context' || hasExplicitCtx)) {
         const hl = Number(a.head_limit);
         if (grepContextKeyPresent(a, 'head_limit') && Number.isFinite(hl) && hl > GREP_CTX_HEAD_LIMIT_MAX) {
             a.head_limit = GREP_CTX_HEAD_LIMIT_MAX;

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -124,23 +124,31 @@ export function _isBenignSearchExitOne(command, exitCode, signal, stderr) {
 function _combineAbortSignals(sessionSignal, externalSignal) {
     const a = sessionSignal || null;
     const b = externalSignal || null;
-    if (!a && !b) return null;
-    if (!a) return b;
-    if (!b) return a;
-    if (a === b) return a;
+    if (!a && !b) return { signal: null, cleanup() {} };
+    if (!a) return { signal: b, cleanup() {} };
+    if (!b) return { signal: a, cleanup() {} };
+    if (a === b) return { signal: a, cleanup() {} };
     if (typeof AbortSignal !== 'undefined' && typeof AbortSignal.any === 'function') {
-        try { return AbortSignal.any([a, b]); } catch { /* fall through */ }
+        try { return { signal: AbortSignal.any([a, b]), cleanup() {} }; } catch { /* fall through */ }
     }
     const ctl = new AbortController();
     const onAbort = (sig) => {
         if (ctl.signal.aborted) return;
         try { ctl.abort(sig?.reason); } catch { try { ctl.abort(); } catch {} }
     };
-    if (a.aborted) { onAbort(a); return ctl.signal; }
-    if (b.aborted) { onAbort(b); return ctl.signal; }
-    try { a.addEventListener('abort', () => onAbort(a), { once: true }); } catch {}
-    try { b.addEventListener('abort', () => onAbort(b), { once: true }); } catch {}
-    return ctl.signal;
+    if (a.aborted) { onAbort(a); return { signal: ctl.signal, cleanup() {} }; }
+    if (b.aborted) { onAbort(b); return { signal: ctl.signal, cleanup() {} }; }
+    const onAbortA = () => onAbort(a);
+    const onAbortB = () => onAbort(b);
+    try { a.addEventListener('abort', onAbortA, { once: true }); } catch {}
+    try { b.addEventListener('abort', onAbortB, { once: true }); } catch {}
+    return {
+        signal: ctl.signal,
+        cleanup() {
+            try { a.removeEventListener('abort', onAbortA); } catch {}
+            try { b.removeEventListener('abort', onAbortB); } catch {}
+        },
+    };
 }
 
 function _prefixPowerShellUtf8(command) {
@@ -228,7 +236,11 @@ export async function executeBashTool(args, workDir, options = {}) {
         const userProvidedSession = typeof args.session_id === 'string' && args.session_id.trim().length > 0;
         const shouldCreate = args.create === true || !userProvidedSession;
         effectiveArgs = { ...effectiveArgs, create: shouldCreate };
-        return executeBashSessionTool('bash_session', effectiveArgs, bashWorkDir, { abortSignal: combinedPersistAbort, sessionId: options?.sessionId });
+        try {
+            return await executeBashSessionTool('bash_session', effectiveArgs, bashWorkDir, { abortSignal: combinedPersistAbort.signal, sessionId: options?.sessionId });
+        } finally {
+            combinedPersistAbort.cleanup();
+        }
     }
 
     let command = args.command;
@@ -276,6 +288,7 @@ export async function executeBashTool(args, workDir, options = {}) {
     }
 
     let shellEffects;
+    let combinedBashAbort = null;
     try {
         shellEffects = await analyzeShellCommandEffects(command, bashWorkDir);
     } catch (err) {
@@ -423,7 +436,7 @@ export async function executeBashTool(args, workDir, options = {}) {
         let bashAbortSignal = null;
         try { bashAbortSignal = (await getAbortSignalForSession(options?.sessionId)) || null; }
         catch { bashAbortSignal = null; }
-        const combinedBashAbort = _combineAbortSignals(bashAbortSignal, options?.abortSignal || null);
+        combinedBashAbort = _combineAbortSignals(bashAbortSignal, options?.abortSignal || null);
         // Sync path only: chain a trailing cwd probe so the session's final
         // working directory persists to the next shell call. Async jobs run
         // detached and are intentionally excluded (they never reach here). The
@@ -456,7 +469,7 @@ export async function executeBashTool(args, workDir, options = {}) {
             env: spawnEnv,
             cwd: bashWorkDir,
             timeoutMs: timeout,
-            abortSignal: combinedBashAbort,
+            abortSignal: combinedBashAbort.signal,
             autoBackgroundMs,
             // On a foreground timeout, promote the still-running child to a
             // tracked background job (unlimited) instead of killing it.
@@ -592,6 +605,7 @@ export async function executeBashTool(args, workDir, options = {}) {
         return _prependDestructiveWarning(command, warningBlock ? `${warningBlock}\n${payload}` : payload);
     }
     finally {
+        combinedBashAbort?.cleanup?.();
         if (shellEffects.mutationMode === 'paths') {
             invalidateBuiltinResultCache(shellEffects.paths);
             markCodeGraphDirtyPaths(shellEffects.paths);