mixdog 0.9.44 → 0.9.46

package/src/rules/lead/lead-brief.md

@@ -1,21 +1,18 @@
 # Lead Brief
 
-- One-line fragments. `Task:` is mandatory and lossless: include the intent,
-  required outcomes, negative outcomes, and completion/stop boundary. Minimum
-  chars, maximum info: omit role-known rules and repeated context/facts; split
-  scope, don't pad or discard task requirements.
-- Preserve user-supplied exact targets and exact replacements/outputs in
-  `Task:`. Never infer exactness from a task name, file count, or perceived
-  difficulty.
-- All other fields are optional task-specific deltas: `Anchors:`
-  `Allow/Forbid:` `Deliver:`. Omit any that add no information.
-- Anchors: `file:line` + one-line conclusion; never log/code bodies. Specify
-  outcome, not method unless required. `Deliver:` gives shape/size, never a long
-  handoff. The original request and official spec/test acceptance criteria beat
-  their brief summary.
-- Each role independently constructs a role-appropriate, lossless `Task:` from
-  the original request and official spec/test acceptance criteria.
-- Full brief only for fresh spawn/`respawned: true`; live follow-ups are delta.
-  Dead-tag send is cold: re-supply anchors.
+- Use one-line fragments. `Task:` is mandatory and lossless: preserve intent,
+  required and forbidden outcomes, completion/stop boundary, user-supplied
+  exact targets, and exact replacements/outputs. Never infer exactness from
+  task name, file count, or difficulty.
+- Each role constructs its own `Task:` from the original request and official
+  spec/test acceptance criteria, preserving every requirement and boundary.
+- Omit role-known rules, repeated context/facts, and padding; split scope
+  without discarding requirements.
+- Other fields are task-specific deltas: `Anchors:`, `Allow/Forbid:`,
+  `Deliver:`. Omit empty fields. Anchors are `file:line` plus a one-line
+  conclusion, never log/code bodies. State outcomes, not methods, unless the
+  method is required. `Deliver:` sets handoff shape/size.
+- Send a full brief only for a fresh spawn or `respawned: true`; live follow-ups
+  contain only the delta. A dead-tag send is cold and must re-supply anchors.
 - Never `send` mid-run; batch one follow-up after completion; interrupt only to
   cancel. Agent communication is English.

package/src/rules/lead/lead-tool.md

@@ -1,5 +1,5 @@
 # Lead Tools
 
-- Write-role agents self-verify via `shell`; Lead runs cross-scope
-  verification, benches, and all git via it.
-- Use current project/workspace unless user request/tool need.
+- Write-role agents self-verify with `shell`. Lead uses `shell` for cross-scope
+  verification, benches, and all git.
+- Use the current project/workspace unless the request or tool requires another.

package/src/rules/shared/01-tool.md

@@ -1,50 +1,48 @@
 # Tool Use
 
-- Before the first call, gather all presently-known facets in one tool message;
-  for each facet choose exactly one shortest locator route: broad/uncertain→
-  `explore`; partial path/name→`find`; verified root+wildcard→`glob`;
-  quoted/non-identifier literal or regex→`grep`; exact code identifier/relation→
-  `code_graph` before grep (grep only for a requested literal occurrence or
-  after graph zero/error). Batch compatible targets; parallelize distinct facets
-  only, never alternative routes for one facet. Known file/span→`read`;
-  verified directory→`list`;
-  edit→`apply_patch`; program/state change→`shell`; web/current external
-  info→`search`.
-- Put independent read-only calls in one turn; they may run concurrently
-  regardless of tool. Later turns are only for targets dependent on prior
-  results or unresolved facets. Shell/write calls are serial and dependencies
-  are serialized. Combine variants, symbols, scopes, paths and queries in one
-  call. After locator results, collect all known candidate files/regions before
-  inspection; batch compatible reads, including same-file regions, in one
+- Before the first call, gather every known facet in one tool message; for
+  each facet choose exactly one shortest locator route:
+  broad/uncertain→`explore` (roles without it: `find`); partial path/name→
+  `find`; verified root+wildcard→
+  `glob`; quoted/non-identifier literal or regex→`grep`; exact code
+  identifier/relation→`code_graph` before grep; known file/span→`read`
+  directly without `grep`; verified directory→`list`; edit→`apply_patch`;
+  program/state change→`shell`; web/current external info→`search`. Use grep
+  only for a requested literal occurrence or after graph zero/error.
+- Batch compatible targets and combine variants, symbols, scopes, paths, and
+  queries. Parallelize distinct facets only, never alternative routes for one
+  facet. Put independent read-only calls in one turn; they may run
+  concurrently regardless of tool. Later turns are only for targets dependent
+  on prior results or unresolved facets. Shell/write calls are serial.
+- After locator results, collect all known candidate files/regions before
+  inspection. Batch compatible reads, including same-file regions, in one
   `path[]` call and graph targets in arrays. Parallelize independent
-  incompatible read-only inspections; do not start a singleton while a known
+  incompatible read-only inspections. Do not start a singleton while a known
   compatible candidate remains. Put all known edits in one patch.
 - Project root, session cwd, user-provided and tool-returned paths are
-  verified. For a genuinely guessed path/name fragment, use `find` first
-  (same turn as independent probes); do not find verified roots or use
-  `path:"."` with guessed `src/**`. ENOENT→find the basename, never retry the
-  guess. Unscoped root grep/glob/list needs no find.
-- At task start, `explore` facets (implementation, config, tests, errors, ...)
-  go in one `query[]` call (max 8, parallel), never rephrased duplicates;
-  on `EXPLORATION_FAILED`, retry once with changed tokens.
+  verified. Use `find` first for every genuinely guessed path/name fragment, in
+  the same turn as independent probes. Never find verified roots or use
+  `path:"."` with guessed `src/**`. On ENOENT, find the basename; never retry
+  the guess. Unscoped root grep/glob/list requires no find.
+- At task start, batch all `explore` facets in one `query[]` call, maximum 8,
+  without rephrased duplicates. Retry `EXPLORATION_FAILED` once with changed
+  tokens.
 - Stop when evidence covers the deliverable; never re-locate, re-verify,
-  refine or upgrade a sufficient anchor.
-  Every returned requested `path:line` freezes the LOCATION only; read or
-  code_graph detail inspection is valid when content was not returned, but
-  never re-locate it. Content_with_context with sufficient context is
-  actionable directly.
-- Grep content mode needs enough `-C` context to avoid rereads; sufficient
-  contextual grep means no overlapping `read`. `files_with_matches`, `count`,
-  capped, or insufficient context may inspect only missing content. Known
-  file/span→`read` directly without `grep`; A nonzero `content_with_context`
-  result resolves that search concept: act directly, without regex tweaks,
-  narrowing or re-search. Only zero/error results may change tokens/scope.
-- `read` batches independent files/regions as real arrays (regions are
-  `{path,offset,limit}`), and reads the whole logical unit; do not page or
-  reread returned spans. A third window means the first was too narrow.
-- One carve-out to parallel-first: apply the edit, then verify it in a
-  separate shell turn and consume results in order. Otherwise stay parallel.
+  refine, or upgrade a sufficient anchor. Every returned requested `path:line`
+  freezes the LOCATION only. When content was not returned, read or
+  code_graph detail inspection is valid; never re-locate it.
+- Give grep content mode enough `-C` to avoid rereads; a sufficient contextual
+  grep means no overlapping `read`. After `files_with_matches`, `count`,
+  capped, or insufficient context, inspect only missing content. A nonzero
+  `content_with_context` result resolves the concept; act directly without
+  token changes, narrowing, or re-search. Only zero/error results permit token
+  or scope changes.
+- Batch independent read files/regions as real arrays, using
+  `{path,offset,limit}` regions, and read the whole logical unit. Never page or
+  reread returned spans.
+- Apply edits before verification, then verify in a separate shell turn and
+  consume results in order. Otherwise remain parallel.
 - A long-running command promoted to background is a decision point, not a
-  cue to wait: estimate from its observed progress whether it can finish
-  within the remaining budget; if not, diagnose the bottleneck and switch to
-  an alternative route. Waiting is chosen, never assumed.
+  cue to wait. Estimate whether observed progress can finish within budget;
+  otherwise diagnose the bottleneck and switch routes. Choose waiting
+  explicitly.

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch.mjs

@@ -256,6 +256,40 @@ function maintenanceRouteToPreset(routeOrName, agent) {
  *   provider call tears down promptly (parent→child cascade).
  * @returns {(args: { prompt, preset?, sourceName? }) => Promise<string>}
  */
+// runtime-liveness keeps one parent link per session because askSession swaps
+// its controller at turn start.  Agent dispatch can have several independent
+// cancellation sources, so collapse them before installing that one link.
+// The first already-aborted source wins (in declaration order), retaining its
+// original reason instead of replacing it with a generic AbortError.
+export function composeAgentDispatchAbortSignal(signals) {
+    const sources = (Array.isArray(signals) ? signals : [])
+        .filter((signal) => signal instanceof AbortSignal);
+    if (sources.length === 0) return { signal: null, dispose: () => {} };
+    const controller = new AbortController();
+    const listeners = [];
+    const abortFrom = (signal) => {
+        if (controller.signal.aborted) return;
+        try { controller.abort(signal.reason); } catch { try { controller.abort(); } catch { /* ignore */ } }
+    };
+    for (const signal of sources) {
+        if (signal.aborted) {
+            abortFrom(signal);
+            break;
+        }
+        const listener = () => abortFrom(signal);
+        signal.addEventListener('abort', listener, { once: true });
+        listeners.push([signal, listener]);
+    }
+    return {
+        signal: controller.signal,
+        dispose: () => {
+            for (const [signal, listener] of listeners) {
+                try { signal.removeEventListener('abort', listener); } catch { /* ignore */ }
+            }
+        },
+    };
+}
+
 export function makeAgentDispatch(opts = {}) {
     if (!opts.agent || typeof opts.agent !== 'string') {
         throw new Error('[agent-dispatch] opts.agent is required');
@@ -375,14 +409,6 @@ export function makeAgentDispatch(opts = {}) {
         const _getProgressSnapshot = _managerMod?.getSessionProgressSnapshot;
         const _getLastProgressAt = _managerMod?.getSessionLastProgressAt;
         const _getSession = _managerMod?.getSession || getSession;
-        if (_linkSignal) {
-            if (opts.parentSignal instanceof AbortSignal) {
-                try { _linkSignal(session.id, opts.parentSignal); } catch { /* ignore */ }
-            }
-            if (callParentSignal instanceof AbortSignal) {
-                try { _linkSignal(session.id, callParentSignal); } catch { /* ignore */ }
-            }
-        }
         // Watchdog policy is split:
         // - firstResponseTimeoutMs cuts quickly only when the model produces no
         //   first stream/tool activity at all.
@@ -396,8 +422,17 @@ export function makeAgentDispatch(opts = {}) {
         const _idleController = (agentWatchdogPolicyActive(_watchdogPolicy) && _linkSignal)
             ? new AbortController()
             : null;
-        if (_idleController) {
-            try { _linkSignal(session.id, _idleController.signal); } catch { /* ignore */ }
+        // Do not link factory parent, per-call explore cancellation, and the
+        // watchdog one at a time: each link replaces the previous listener in
+        // runtime-liveness.  One composite survives askSession's controller
+        // swap and makes every source reach the provider call.
+        const _abortLink = composeAgentDispatchAbortSignal([
+            opts.parentSignal,
+            callParentSignal,
+            _idleController?.signal,
+        ]);
+        if (_linkSignal && _abortLink.signal) {
+            try { _linkSignal(session.id, _abortLink.signal); } catch { /* ignore */ }
         }
         // Watchdog blind spot guard: when the runtime snapshot is missing AND
         // no progress timestamp exists (pre-liveness hang, swept runtime), the
@@ -491,6 +526,7 @@ export function makeAgentDispatch(opts = {}) {
             try { closeSession(session.id, 'ephemeral-error'); } catch { /* ignore */ }
             throw err;
         } finally {
+            _abortLink.dispose();
             if (_idleTimer) {
                 try { clearInterval(_idleTimer); } catch { /* ignore */ }
             }

package/src/runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs

@@ -11,7 +11,7 @@ import {
     resolveAgentToolThresholdSeconds,
 } from '../stall-policy.mjs';
 
-const WATCHDOG_ABORT_RE = /^agent (?:first response stale|task stale|tool running stale)\s*\(/;
+const WATCHDOG_ABORT_RE = /^agent (?:first (?:transport|semantic response|response) stale|task stale|tool running stale)\s*\(/;
 
 /**
  * Typed abort error for the agent progress watchdog. Carrying a stable `name`
@@ -209,12 +209,12 @@ function resolveExplicitMs(value, fallback) {
 }
 
 export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
-    const firstResponseMs = resolveExplicitMs(
-        overrides.firstResponseTimeoutMs,
+    const firstTransportMs = resolveExplicitMs(
+        overrides.firstTransportTimeoutMs ?? overrides.firstResponseTimeoutMs,
         DEFAULT_FIRST_RESPONSE_TIMEOUT_MS,
     );
-    const firstVisibleCeilingMs = resolveExplicitMs(
-        overrides.firstVisibleTimeoutMs,
+    const firstSemanticMs = resolveExplicitMs(
+        overrides.firstSemanticTimeoutMs ?? overrides.firstVisibleTimeoutMs,
         DEFAULT_FIRST_VISIBLE_CEILING_MS,
     );
 
@@ -245,8 +245,12 @@ export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
     const toolRunningMs = Math.max(0, Math.floor(toolRunningSec * 1000));
 
     return {
-        firstResponseMs,
-        firstVisibleCeilingMs,
+        firstTransportMs,
+        firstSemanticMs,
+        // Compatibility aliases for persisted/background metadata and callers
+        // using the previous option names.
+        firstResponseMs: firstTransportMs,
+        firstVisibleCeilingMs: firstSemanticMs,
         idleStaleMs,
         toolRunningMs,
     };
@@ -255,19 +259,21 @@ export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
 export function evaluateAgentWatchdogAbort(snapshot, now, policy) {
     if (!snapshot || !policy) return null;
 
-    if (snapshot.waitingForFirstActivity) {
-        const startedAt = snapshot.modelRequestStartedAt || snapshot.askStartedAt;
-        const hasTransport = Boolean(
-            startedAt
-            && snapshot.lastTransportAt
-            && snapshot.lastTransportAt > startedAt
-        );
-        const ceilingMs = hasTransport
-            ? policy.firstVisibleCeilingMs
-            : policy.firstResponseMs;
-        if (ceilingMs > 0 && startedAt && now - startedAt > ceilingMs) {
-            return new AgentStallAbortError(`agent first response stale (${ceilingMs}ms)`);
-        }
+    const startedAt = snapshot.modelRequestStartedAt || snapshot.askStartedAt;
+    const firstTransportMs = policy.firstTransportMs ?? policy.firstResponseMs ?? 0;
+    const firstSemanticMs = policy.firstSemanticMs ?? policy.firstVisibleCeilingMs ?? 0;
+    // Independent fixed deadlines from request start. Transport can satisfy
+    // only the transport deadline; it never switches, extends, or resets the
+    // semantic-response deadline.
+    if (snapshot.waitingForTransport && firstTransportMs > 0 && startedAt
+        && now - startedAt > firstTransportMs) {
+        return new AgentStallAbortError(`agent first transport stale (${firstTransportMs}ms)`);
+    }
+    if ((snapshot.waitingForFirstSemantic ?? snapshot.waitingForFirstActivity)
+        && firstSemanticMs > 0 && startedAt && now - startedAt > firstSemanticMs) {
+        return new AgentStallAbortError(`agent first semantic response stale (${firstSemanticMs}ms)`);
+    }
+    if (snapshot.waitingForFirstSemantic ?? snapshot.waitingForFirstActivity) {
         return null;
     }
 
@@ -290,15 +296,7 @@ export function evaluateAgentWatchdogAbort(snapshot, now, policy) {
         // is still caught after the grace window. Unknown/missing self-deadline
         // (selfDeadlineMs <= 0) keeps the plain toolRunningMs behavior. All
         // other tools are unaffected.
-        let ceilingMs = policy.toolRunningMs;
-        const selfDeadlineMs = Number(snapshot.toolSelfDeadlineMs);
-        if (
-            isSelfDeadlineTool(snapshot.currentTool)
-            && Number.isFinite(selfDeadlineMs)
-            && selfDeadlineMs > 0
-        ) {
-            ceilingMs = Math.max(policy.toolRunningMs, selfDeadlineMs + TOOL_SELF_DEADLINE_GRACE_MS);
-        }
+        const ceilingMs = resolveEffectiveToolRunningCeilingMs(snapshot, policy);
         if (now - snapshot.toolStartedAt > ceilingMs) {
             return new AgentStallAbortError(`agent tool running stale (${ceilingMs}ms)`);
         }
@@ -307,10 +305,25 @@ export function evaluateAgentWatchdogAbort(snapshot, now, policy) {
     return null;
 }
 
+/** The exact tool ceiling enforced by evaluateAgentWatchdogAbort. */
+export function resolveEffectiveToolRunningCeilingMs(snapshot, policy) {
+    const policyMs = Number(policy?.toolRunningMs);
+    let ceilingMs = Number.isFinite(policyMs) && policyMs > 0 ? policyMs : 0;
+    const selfDeadlineMs = Number(snapshot?.toolSelfDeadlineMs);
+    if (
+        isSelfDeadlineTool(snapshot?.currentTool)
+        && Number.isFinite(selfDeadlineMs)
+        && selfDeadlineMs > 0
+    ) {
+        ceilingMs = Math.max(ceilingMs, selfDeadlineMs + TOOL_SELF_DEADLINE_GRACE_MS);
+    }
+    return ceilingMs;
+}
+
 export function agentWatchdogPolicyActive(policy) {
     if (!policy) return false;
-    return (policy.firstResponseMs > 0)
-        || (policy.firstVisibleCeilingMs > 0)
+    return ((policy.firstTransportMs ?? policy.firstResponseMs) > 0)
+        || ((policy.firstSemanticMs ?? policy.firstVisibleCeilingMs) > 0)
         || (policy.idleStaleMs > 0)
         || (policy.toolRunningMs > 0);
 }

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -23,6 +23,7 @@ let _serviceUrl = null;
 let _serviceAdvertPort = null;
 let _flushInFlight = false;
 let _localTracePath = null;
+let _localTraceIsExplicit = false;
 let _localTraceBuffer = [];
 let _localTraceTimer = null;
 let _localTraceFlushInFlight = false;
@@ -93,6 +94,12 @@ function _rotateLocalTraceIfNeeded(path) {
     }
 }
 
+function _ensureLocalTraceDirectory(path) {
+    // The path may outlive an ephemeral runtime directory. Recreate its parent
+    // at flush time rather than relying on the one-time path resolution.
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+}
+
 function _resolveLocalTracePath() {
     if (process.env.MIXDOG_AGENT_TRACE_LOCAL_DISABLE === '1') return null;
     if (_localTracePath) return _localTracePath;
@@ -104,9 +111,10 @@ function _resolveLocalTracePath() {
     try {
         _localTracePath = explicit
             || join(getPluginData(), 'history', 'agent-trace.jsonl');
+        _localTraceIsExplicit = Boolean(explicit);
         // R4 data-at-rest: trace rows may carry tool payloads / prompts;
         // clamp dir to owner-only on POSIX (advisory on Windows).
-        mkdirSync(dirname(_localTracePath), { recursive: true, mode: 0o700 });
+        _ensureLocalTraceDirectory(_localTracePath);
         return _localTracePath;
     } catch {
         return null;
@@ -142,10 +150,15 @@ function _flushLocalTrace() {
     const chunk = _localTraceBuffer.join('');
     _localTraceBuffer = [];
     try {
+        _ensureLocalTraceDirectory(path);
         // Throttle rotation stat checks to avoid unnecessary statSync calls
         // on every flush. First flush (_lastRotateCheckMs === 0) always checks.
         const now = Date.now();
-        if (_lastRotateCheckMs === 0 || now - _lastRotateCheckMs >= MIXDOG_AGENT_TRACE_ROTATE_CHECK_MS) {
+        // Explicit sinks can have many short-lived headless writers. Keep that
+        // shared file append-only so no writer can rename it out from under a
+        // peer or from session-bench while scoring.
+        if (!_localTraceIsExplicit
+            && (_lastRotateCheckMs === 0 || now - _lastRotateCheckMs >= MIXDOG_AGENT_TRACE_ROTATE_CHECK_MS)) {
             _rotateLocalTraceIfNeeded(path);
             _lastRotateCheckMs = now;
         }
@@ -183,8 +196,10 @@ function _flushLocalTraceSync() {
     const chunk = _localTraceBuffer.join('');
     _localTraceBuffer = [];
     try {
+        _ensureLocalTraceDirectory(path);
         const now = Date.now();
-        if (_lastRotateCheckMs === 0 || now - _lastRotateCheckMs >= MIXDOG_AGENT_TRACE_ROTATE_CHECK_MS) {
+        if (!_localTraceIsExplicit
+            && (_lastRotateCheckMs === 0 || now - _lastRotateCheckMs >= MIXDOG_AGENT_TRACE_ROTATE_CHECK_MS)) {
             _rotateLocalTraceIfNeeded(path);
             _lastRotateCheckMs = now;
         }

package/src/runtime/agent/orchestrator/config.mjs

@@ -185,6 +185,29 @@ function hasKeys(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length > 0;
 }
 
+// Process-local write intent for project MCP overrides. A loaded config contains
+// snapshots for every project, but only entries toggled by this process may
+// override a newer value read from disk inside the save lock.
+const dirtyMcpProjectOverrides = new Map();
+let mcpProjectOverrideDirtySeq = 0;
+function mcpProjectOverrideDirtyKey(projectKey, serverName) {
+    return `${String(projectKey)}\u0000${String(serverName)}`;
+}
+export function markMcpProjectOverrideDirty(projectKey, serverName, enabled) {
+    const pairKey = mcpProjectOverrideDirtyKey(projectKey, serverName);
+    dirtyMcpProjectOverrides.set(pairKey, {
+        enabled: enabled !== false,
+        seq: ++mcpProjectOverrideDirtySeq,
+    });
+}
+function clearDurablySavedMcpProjectOverrides(appliedDirty) {
+    for (const { pairKey, seq } of appliedDirty) {
+        if (dirtyMcpProjectOverrides.get(pairKey)?.seq === seq) {
+            dirtyMcpProjectOverrides.delete(pairKey);
+        }
+    }
+}
+
 function normalizeSearchRoute(route) {
     if (!route || typeof route !== 'object' || Array.isArray(route))
         return null;
@@ -456,6 +479,9 @@ export function loadConfig(options = {}) {
             return {
                 providers: mergedProviders,
                 mcpServers,
+                mcpProjectOverrides: raw.mcpProjectOverrides && typeof raw.mcpProjectOverrides === 'object' && !Array.isArray(raw.mcpProjectOverrides)
+                    ? raw.mcpProjectOverrides
+                    : {},
                 presets: normalizedPresets,
                 default: raw.default || null,
                 maintenance: { ...DEFAULT_MAINTENANCE, ...migratedMaint },
@@ -489,6 +515,7 @@ export function loadConfig(options = {}) {
     return {
         ...defaults,
         mcpServers: {},
+        mcpProjectOverrides: {},
         presets: DEFAULT_PRESETS.map(p => ({ ...p })),
         default: null,
         maintenance: { ...DEFAULT_MAINTENANCE },
@@ -556,7 +583,7 @@ export async function patchSkillsDisabledAsync(disabledNames) {
     return nextSkills;
 }
 
-function buildAgentSaveBuilder(config) {
+function buildAgentSaveBuilder(config, appliedDirty) {
     // Strip ephemeral defaults from providers but preserve any unknown
     // per-provider subkey so future schema additions round-trip through the
     // setup UI without changes here. apiKey is intentionally omitted —
@@ -590,40 +617,79 @@ function buildAgentSaveBuilder(config) {
     // Build the replacement from `existingRaw` — the section read INSIDE the
     // file lock — not a snapshot taken before it, so unmanaged keys written by
     // a concurrent instance survive the save (lost-update guard).
-    return (existingRaw) => ({
-        ...existingRaw,
-        guide: config.guide || existingRaw.guide || undefined,
-        providers: persistedProviders,
-        mcpServers: config.mcpServers || {},
-        presets,
-        default: config.default || null,
-        maintenance: config.maintenance || {},
-        workflowRoutes,
-        searchRoute: normalizeSearchRoute(config.searchRoute),
-        fastModels: config.fastModels || {},
-        modelSettings: config.modelSettings || {},
-        onboarding: config.onboarding || {},
-        agents: config.agents || {},
-        workflow: config.workflow || { active: 'default' },
-        agentMaintenance: config.agentMaintenance || {},
-        profile: normalizeProfileConfig(config.profile),
-        skills: normalizeSkillsConfig(config.skills),
-        autoClear: config.autoClear || {},
-        compaction: config.compaction || {},
-        trajectory: config.trajectory || {},
-        runtime: config.runtime || {},
-        shell: config.shell || {},
-        update: config.update || {},
-        recap: config.recap || {},
-        modules: config.modules || existingRaw.modules || {},
-    });
+    return (existingRaw) => {
+        const mcpServers = config.mcpServers || {};
+        const diskOverrides = existingRaw.mcpProjectOverrides && typeof existingRaw.mcpProjectOverrides === 'object'
+            ? existingRaw.mcpProjectOverrides
+            : {};
+        const memoryOverrides = config.mcpProjectOverrides && typeof config.mcpProjectOverrides === 'object'
+            ? config.mcpProjectOverrides
+            : {};
+        const mcpProjectOverrides = {};
+        for (const projectKey of new Set([...Object.keys(diskOverrides), ...Object.keys(memoryOverrides)])) {
+            const diskProject = diskOverrides[projectKey] && typeof diskOverrides[projectKey] === 'object'
+                ? diskOverrides[projectKey]
+                : {};
+            const memoryProject = memoryOverrides[projectKey] && typeof memoryOverrides[projectKey] === 'object'
+                ? memoryOverrides[projectKey]
+                : {};
+            // Disk wins for untouched snapshot entries. Only an override this
+            // process explicitly toggled may replace the in-lock disk value.
+            const mergedProject = { ...memoryProject, ...diskProject };
+            for (const serverName of Object.keys(memoryProject)) {
+                const pairKey = mcpProjectOverrideDirtyKey(projectKey, serverName);
+                const dirty = dirtyMcpProjectOverrides.get(pairKey);
+                if (dirty) {
+                    const appliedValue = { enabled: dirty.enabled };
+                    mergedProject[serverName] = appliedValue;
+                    appliedDirty.push({ pairKey, seq: dirty.seq, appliedValue });
+                }
+            }
+            for (const serverName of Object.keys(mergedProject)) {
+                if (!Object.prototype.hasOwnProperty.call(mcpServers, serverName)) delete mergedProject[serverName];
+            }
+            if (Object.keys(mergedProject).length > 0) mcpProjectOverrides[projectKey] = mergedProject;
+        }
+        return {
+            ...existingRaw,
+            guide: config.guide || existingRaw.guide || undefined,
+            providers: persistedProviders,
+            mcpServers,
+            mcpProjectOverrides,
+            presets,
+            default: config.default || null,
+            maintenance: config.maintenance || {},
+            workflowRoutes,
+            searchRoute: normalizeSearchRoute(config.searchRoute),
+            fastModels: config.fastModels || {},
+            modelSettings: config.modelSettings || {},
+            onboarding: config.onboarding || {},
+            agents: config.agents || {},
+            workflow: config.workflow || { active: 'default' },
+            agentMaintenance: config.agentMaintenance || {},
+            profile: normalizeProfileConfig(config.profile),
+            skills: normalizeSkillsConfig(config.skills),
+            autoClear: config.autoClear || {},
+            compaction: config.compaction || {},
+            trajectory: config.trajectory || {},
+            runtime: config.runtime || {},
+            shell: config.shell || {},
+            update: config.update || {},
+            recap: config.recap || {},
+            modules: config.modules || existingRaw.modules || {},
+        };
+    };
 }
 export function saveConfig(config) {
-    persistAgentConfig(buildAgentSaveBuilder(config));
+    const appliedDirty = [];
+    persistAgentConfig(buildAgentSaveBuilder(config, appliedDirty));
+    clearDurablySavedMcpProjectOverrides(appliedDirty);
 }
 // Async twin used by the debounced config-save flush timer.
 export async function saveConfigAsync(config) {
-    await persistAgentConfigAsync(buildAgentSaveBuilder(config));
+    const appliedDirty = [];
+    await persistAgentConfigAsync(buildAgentSaveBuilder(config, appliedDirty));
+    clearDurablySavedMcpProjectOverrides(appliedDirty);
 }
 // --- Preset helpers ---
 // preset shape: { id, name, type: 'agent', provider, model, effort?, fast?, tools? }

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -9,6 +9,10 @@ import {
 } from '../../../shared/markdown-frontmatter.mjs';
 import { loadConfig, normalizeSkillsConfig } from '../config.mjs';
 
+function skillsDisabled() {
+    return /^(?:1|true|on|yes)$/i.test(String(process.env.MIXDOG_DISABLE_SKILLS || ''));
+}
+
 // --- mixdog asset roots (standalone CLI owns its own paths; never .claude) ---
 // Project-local:  <cwd>/.mixdog/<kind>
 // Data-local:     <mixdogData>/<kind>   (standalone default: ~/.mixdog/data/<kind>)
@@ -80,6 +84,7 @@ function pluginSkillDirs() {
  * Full content loaded on demand via loadSkillContent().
  */
 export function collectSkills(cwd) {
+    if (skillsDisabled()) return [];
     // When cwd is null/missing (e.g. agent maintenance callers that pass
     // cwd:null on purpose so provider-cache shards don't fork per caller
     // workspace), skip project-scoped skills entirely — DO NOT fall back
@@ -144,6 +149,7 @@ export function isSkillDisabled(name, config = null) {
 }
 
 export function filterSkillsExcludingDisabled(skills, config = null) {
+    if (skillsDisabled()) return [];
     const disabled = getDisabledSkillNameSet(config);
     if (!disabled.size) return Array.isArray(skills) ? skills : [];
     return (Array.isArray(skills) ? skills : []).filter((s) => {
@@ -160,6 +166,7 @@ const _skillsCache = new Map();
 const _mtimeCache = new Map();
 const _MTIME_TTL_MS = 2000;
 export function collectSkillsCached(cwd) {
+    if (skillsDisabled()) return [];
     const key = cwd ?? '';
     const projectDir = (typeof cwd === 'string' && cwd.length > 0) ? cwd : null;
     // Same mixdog-owned dirs collectSkills() reads, used as the freshness gate.
@@ -278,6 +285,7 @@ function compactSkillManifestText(value, max = 180) {
  * Full SKILL.md content is still loaded only through Skill(name).
  */
 export function buildSkillManifest(skills, { limit = 80 } = {}) {
+    if (skillsDisabled()) return '';
     const list = (Array.isArray(skills) ? skills : [])
         .map((skill) => ({
             name: String(skill?.name || '').trim(),
@@ -507,6 +515,7 @@ let _skillToolDefsCache = null;
  *   behaviour.
  */
 export function buildSkillToolDefs(skills, { ownerIsAgentSession = false } = {}) {
+    if (skillsDisabled()) return [];
     if (!ownerIsAgentSession && !skills.length) return [];
     if (_skillToolDefsCache) return _skillToolDefsCache;
     _skillToolDefsCache = [