mixdog 0.9.52 → 0.9.53

package/src/runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs

@@ -1,7 +1,6 @@
 import { spawn } from 'child_process';
-import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, unlinkSync, watch as fsWatch, writeFileSync } from 'fs';
+import { existsSync, readFileSync, statSync, unlinkSync, watch as fsWatch, writeFileSync } from 'fs';
 import { basename } from 'path';
-import { stripAnsi } from '../shell-command.mjs';
 import { scrubLoaderVars, scrubProviderSecrets } from '../env-scrub.mjs';
 import {
     normalizeToolNotifyContext,
@@ -43,313 +42,38 @@ import {
     _liveJobIdsByPid,
     _killLiveJobPid,
 } from './shell-job-process.mjs';
+import {
+    attachJobInsights,
+    looksLikeInteractivePrompt,
+    readPromptTail,
+    shellJobOutputBytes,
+    shellJobPublicTaskResult,
+    SHELL_JOB_OUTPUT_DISK_CAP,
+} from './lib/shell-job-insights.mjs';
+import {
+    sleep,
+    awaitSpawnReady,
+    adoptSpawnErrorHandler,
+    discardSpawnErrorGuard,
+    rollbackSpawnedChild,
+    shellQuoteSingle,
+    psSingleQuote,
+    isPowerShellShell,
+} from './lib/shell-spawn-helpers.mjs';
 
 // Facade re-exports: path/detail helpers and the job-not-found message moved
 // to sibling modules; keep existing importers of shell-jobs.mjs resolving.
 export { buildJobNotFoundMessage } from './shell-job-paths.mjs';
+export { shellJobPublicTaskResult } from './lib/shell-job-insights.mjs';
 
 globalThis.__mixdogShellJobsRuntimeLoaded = true;
 
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-const SPAWN_ERROR_GUARD = Symbol('mixdog.spawnErrorGuard');
-function awaitSpawnReady(child, label) {
-    return new Promise((resolve, reject) => {
-        if (!child || typeof child.once !== 'function') {
-            reject(new Error(`${label} spawn returned no child process`));
-            return;
-        }
-        let spawned = false;
-        let bufferedError = null;
-        const cleanup = () => child.removeListener('spawn', onSpawn);
-        const onError = (error) => {
-            if (spawned) {
-                bufferedError = bufferedError || error;
-                return;
-            }
-            cleanup();
-            child.removeListener('error', onError);
-            reject(error);
-        };
-        const onSpawn = () => {
-            cleanup();
-            spawned = true;
-            const pid = Number(child.pid);
-            if (!Number.isFinite(pid) || pid <= 0) {
-                child.removeListener('error', onError);
-                reject(new Error(`${label} spawn returned no pid`));
-                return;
-            }
-            child[SPAWN_ERROR_GUARD] = {
-                adopt(handler) {
-                    child.on('error', handler);
-                    child.removeListener('error', onError);
-                    if (bufferedError) handler(bufferedError);
-                    delete child[SPAWN_ERROR_GUARD];
-                },
-                discard() {
-                    child.removeListener('error', onError);
-                    delete child[SPAWN_ERROR_GUARD];
-                },
-            };
-            resolve(child);
-        };
-        child.once('error', onError);
-        child.once('spawn', onSpawn);
-    });
-}
-
-function adoptSpawnErrorHandler(child, handler) {
-    const guard = child?.[SPAWN_ERROR_GUARD];
-    if (guard) guard.adopt(handler);
-    else child?.on?.('error', handler);
-}
 
-async function rollbackSpawnedChild(child, { timeoutMs = 5000 } = {}) {
-    if (!child || child.exitCode != null || child.signalCode != null) {
-        return { confirmed: true, errors: [] };
-    }
-    const errors = [];
-    let timer = null;
-    let settled = false;
-    const outcome = await new Promise((resolve) => {
-        const finish = (confirmed) => {
-            if (settled) return;
-            settled = true;
-            if (timer) clearTimeout(timer);
-            child.removeListener('exit', onExit);
-            child.removeListener('close', onExit);
-            child.removeListener('error', onError);
-            resolve({ confirmed, errors });
-        };
-        const onExit = () => finish(true);
-        const onError = (error) => { errors.push(error); };
-        child.on('error', onError);
-        child.once('exit', onExit);
-        child.once('close', onExit);
-        timer = setTimeout(() => finish(false), Math.max(1, Number(timeoutMs) || 5000));
-        try { killProcessTree(child.pid, 'SIGKILL'); } catch (error) { errors.push(error); }
-        try { child.kill?.('SIGKILL'); } catch (error) { errors.push(error); }
-    });
-    return outcome;
-}
-
-const JOB_STATUS_PREVIEW_MAX_BYTES = 4096;
-const JOB_STATUS_PREVIEW_MAX_LINES = 20;
-const JOB_STATUS_PREVIEW_MAX_CHARS = 1200;
-// Hard ceiling on a background job's on-disk stdout+stderr. Mirrors the
-// foreground SHELL_OUTPUT_DISK_CAP (shell-command.mjs) so a runaway
-// background loop is killed and flagged instead of filling the filesystem.
-const SHELL_JOB_OUTPUT_DISK_CAP = 100 * 1024 * 1024;
 // Poll cadence for the adopted-job output-cap self-tick (mirrors the
 // foreground sizeWatchdog in shell-command.mjs).
 const ADOPTED_JOB_CAP_POLL_MS = 1_000;
 
-// Combined byte size of a job's spilled stdout/stderr files, or 0 if
-// unreadable. mergeStderr collapses both onto stdoutPath, so count it once.
-function shellJobOutputBytes(detail) {
-    let total = 0;
-    const seen = new Set();
-    for (const p of [detail?.stdoutPath, detail?.stderrPath]) {
-        if (!p || seen.has(p)) continue;
-        seen.add(p);
-        try {
-            if (existsSync(p)) total += statSync(p).size;
-        } catch { /* ignore */ }
-    }
-    return total;
-}
-
-function shellQuoteSingle(s) {
-    return `'${String(s).replace(/'/g, `'\"'\"'`)}'`;
-}
-
-function psSingleQuote(s) {
-    return `'${String(s).replace(/'/g, "''")}'`;
-}
-
-function isPowerShellShell(shell, shellType) {
-    if (shellType === 'powershell') return true;
-    const stem = basename(String(shell || '')).toLowerCase().replace(/\.exe$/, '');
-    return stem === 'pwsh' || stem === 'powershell';
-}
-
-function readTailPreviewSync(filePath, { maxBytes = JOB_STATUS_PREVIEW_MAX_BYTES, maxLines = JOB_STATUS_PREVIEW_MAX_LINES, maxChars = JOB_STATUS_PREVIEW_MAX_CHARS } = {}) {
-    try {
-        if (!filePath || !existsSync(filePath)) return null;
-        const st = statSync(filePath);
-        if (!st.isFile()) return null;
-        const size = st.size;
-        if (size <= 0) return { bytes: 0, preview: '' };
-        const readBytes = Math.min(size, maxBytes);
-        const fd = openSync(filePath, 'r');
-        try {
-            const buf = Buffer.alloc(readBytes);
-            readSync(fd, buf, 0, readBytes, size - readBytes);
-            let text = buf.toString('utf8');
-            if (size > readBytes) {
-                const nl = text.indexOf('\n');
-                if (nl !== -1) text = text.slice(nl + 1);
-            }
-            let lines = text.split(/\r?\n/);
-            if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop();
-            let truncated = size > readBytes;
-            if (lines.length > maxLines) {
-                lines = lines.slice(-maxLines);
-                truncated = true;
-            }
-            let preview = lines.join('\n');
-            if (preview.length > maxChars) {
-                preview = preview.slice(preview.length - maxChars);
-                const nl = preview.indexOf('\n');
-                if (nl !== -1) preview = preview.slice(nl + 1);
-                truncated = true;
-            }
-            return {
-                bytes: size,
-                preview,
-                truncated,
-            };
-        } finally {
-            try { closeSync(fd); } catch { /* ignore */ }
-        }
-    } catch {
-        return null;
-    }
-}
-
-function attachJobPreview(detail) {
-    if (!detail || typeof detail !== 'object') return detail;
-    const withPreview = { ...detail };
-    const stdoutInfo = readTailPreviewSync(detail.stdoutPath);
-    if (stdoutInfo) {
-        withPreview.stdoutBytes = stdoutInfo.bytes;
-        if (stdoutInfo.preview) withPreview.stdoutPreview = stdoutInfo.preview;
-        if (stdoutInfo.truncated) withPreview.stdoutPreviewTruncated = true;
-    }
-    if (detail.mergeStderr !== true) {
-        const stderrInfo = readTailPreviewSync(detail.stderrPath);
-        if (stderrInfo) {
-            withPreview.stderrBytes = stderrInfo.bytes;
-            if (stderrInfo.preview) withPreview.stderrPreview = stderrInfo.preview;
-            if (stderrInfo.truncated) withPreview.stderrPreviewTruncated = true;
-        }
-    }
-    return withPreview;
-}
-
-function summarizeJobPreviewText(text, maxChars = 160) {
-    if (typeof text !== 'string' || !text.trim()) return '';
-    const lines = text
-        .split(/\r?\n/)
-        .map((line) => stripAnsi(line).replace(/\s+/g, ' ').trim())
-        .filter(Boolean);
-    if (lines.length === 0) return '';
-    let summary = lines[lines.length - 1];
-    if (summary.length > maxChars) summary = `${summary.slice(0, maxChars - 1)}…`;
-    return summary;
-}
-
 const SHELL_JOB_PROMPT_STALL_MS = 45_000;
-const SHELL_JOB_PROMPT_TAIL_BYTES = 1024;
-const SHELL_JOB_PROMPT_TAIL_LINES = 16;
-const SHELL_JOB_PROMPT_TAIL_CHARS = 1024;
-const SHELL_JOB_PROMPT_PATTERNS = [
-    /\((?:y|yes)\/(?:n|no)\)\s*[:?]?\s*$/i,
-    /\[(?:y|yes)\/(?:n|no)\]\s*[:?]?\s*$/i,
-    /\b(?:continue|proceed|confirm|overwrite|replace)\b[^\n]*[?:]\s*$/i,
-    /\bpress\s+(?:enter|return)\b[^\n]*$/i,
-    /\bdo you (?:want|wish|agree|accept)\b[^\n]*\?\s*$/i,
-    /\b(?:password|passphrase|otp|verification code)\b[^\n]*[:?]\s*$/i,
-];
-
-function looksLikeInteractivePrompt(text) {
-    const tail = stripAnsi(String(text || '')).trim();
-    if (!tail) return false;
-    const last = tail.split(/\r?\n/).slice(-4).join('\n').trim();
-    return SHELL_JOB_PROMPT_PATTERNS.some((pattern) => pattern.test(last));
-}
-
-function readPromptTail(detail) {
-    if (!detail || typeof detail !== 'object') return { bytes: 0, text: '' };
-    const stdoutInfo = readTailPreviewSync(detail.stdoutPath, {
-        maxBytes: SHELL_JOB_PROMPT_TAIL_BYTES,
-        maxLines: SHELL_JOB_PROMPT_TAIL_LINES,
-        maxChars: SHELL_JOB_PROMPT_TAIL_CHARS,
-    });
-    const stderrInfo = detail.mergeStderr === true ? null : readTailPreviewSync(detail.stderrPath, {
-        maxBytes: SHELL_JOB_PROMPT_TAIL_BYTES,
-        maxLines: SHELL_JOB_PROMPT_TAIL_LINES,
-        maxChars: SHELL_JOB_PROMPT_TAIL_CHARS,
-    });
-    const bytes = (stdoutInfo?.bytes || 0) + (stderrInfo?.bytes || 0);
-    const parts = [
-        stdoutInfo?.preview ? `[stdout tail]\n${stdoutInfo.preview}` : '',
-        stderrInfo?.preview ? `[stderr tail]\n${stderrInfo.preview}` : '',
-    ].filter(Boolean);
-    return { bytes, text: parts.join('\n\n') };
-}
-
-function attachJobInsights(detail) {
-    const withPreview = attachJobPreview(detail);
-    if (!withPreview || typeof withPreview !== 'object') return withPreview;
-    let summary = '';
-    let summarySource = '';
-    if (withPreview.status === 'completed') {
-        summary = summarizeJobPreviewText(withPreview.stdoutPreview)
-            || summarizeJobPreviewText(withPreview.stderrPreview);
-        summarySource = summary ? (withPreview.stdoutPreview ? 'stdout' : 'stderr') : '';
-    } else if (withPreview.status === 'failed') {
-        summary = summarizeJobPreviewText(withPreview.stderrPreview)
-            || summarizeJobPreviewText(withPreview.stdoutPreview)
-            || String(withPreview.error || '').trim();
-        summarySource = summary ? (withPreview.stderrPreview ? 'stderr' : (withPreview.stdoutPreview ? 'stdout' : 'status')) : '';
-    } else if (withPreview.status === 'cancelled') {
-        summary = 'cancelled before completion';
-        summarySource = 'status';
-    } else if (withPreview.status === 'running') {
-        summary = summarizeJobPreviewText(withPreview.stdoutPreview)
-            || summarizeJobPreviewText(withPreview.stderrPreview);
-        summarySource = summary ? (withPreview.stdoutPreview ? 'stdout' : 'stderr') : '';
-    }
-    if (summary) {
-        withPreview.summary = summary;
-        withPreview.summarySource = summarySource;
-    }
-    return withPreview;
-}
-
-export function shellJobPublicTaskResult(detail) {
-    if (!detail || typeof detail !== 'object') return detail;
-    const result = {
-        task_id: detail.jobId || detail.task_id || null,
-        shell: detail.shellType || null,
-        status: detail.status || null,
-        cwd: detail.cwd || null,
-        pid: detail.pid || null,
-        exit_code: (typeof detail.exitCode === 'number') ? detail.exitCode : null,
-        signal: detail.signal || null,
-        timed_out: detail.timedOut === true ? true : null,
-        killed: detail.killed === true ? true : null,
-        stdout_bytes: (typeof detail.stdoutBytes === 'number') ? detail.stdoutBytes : null,
-        stderr_bytes: (typeof detail.stderrBytes === 'number') ? detail.stderrBytes : null,
-        stdout_preview: detail.stdoutPreview || null,
-        stderr_preview: detail.stderrPreview || null,
-        summary: detail.summary || null,
-        summary_source: detail.summarySource || null,
-        waited_ms: (typeof detail.waitedMs === 'number') ? detail.waitedMs : null,
-        wait_timed_out: detail.waitTimedOut === true ? true : null,
-        started_at: detail.startedAt || null,
-        finished_at: detail.finishedAt || null,
-        error: detail.error || null,
-    };
-    for (const [key, value] of Object.entries(result)) {
-        if (value == null || value === '') delete result[key];
-    }
-    return result;
-}
 
 export async function waitForShellJob(jobId, { timeoutMs = 30_000, pollMs = 250 } = {}) {
     const started = Date.now();
@@ -1184,7 +908,7 @@ async function _startBackgroundShellJobImpl({
         terminal = true;
         const rollback = await rollbackSpawnedChild(child, { timeoutMs: rollbackTimeoutMs });
         child.removeListener('error', onRuntimeError);
-        child[SPAWN_ERROR_GUARD]?.discard?.();
+        discardSpawnErrorGuard(child);
         try { unlinkSync(wrappedTempPath); } catch {}
         const failure = { jobId, kind: 'bash', status: 'failed', error: `failed to persist shell background task: ${e?.message || e}` };
         if (!rollback.confirmed) {
@@ -1425,7 +1149,7 @@ async function startBackgroundPowerShellJob({
         terminal = true;
         const rollback = await rollbackSpawnedChild(child, { timeoutMs: rollbackTimeoutMs });
         child.removeListener('error', onRuntimeError);
-        child[SPAWN_ERROR_GUARD]?.discard?.();
+        discardSpawnErrorGuard(child);
         try { unlinkSync(wrappedTempPath); } catch {}
         try { unlinkSync(innerTempPath); } catch {}
         const failure = { jobId, kind: 'bash', status: 'failed', error: `failed to persist PowerShell background task: ${e?.message || e}` };

package/src/runtime/agent/orchestrator/tools/lib/shell-spawn-retry.mjs

@@ -0,0 +1,67 @@
+import { spawn } from 'node:child_process';
+
+let activeShellSpawns = 0;
+
+function isPowerShellSpawn(shell, shellArg) {
+  return /pwsh|powershell/i.test(String(shell || '')) || shellArg === '-Command';
+}
+
+export async function spawnShellWithRetry({ shell, argv, spawnOptions, shellArg, cwd }) {
+  const delays = [100, 300, 700];
+  const isPowerShell = isPowerShellSpawn(shell, shellArg);
+  activeShellSpawns++;
+  try {
+    let attempt = 0;
+    for (;;) {
+      try {
+        const child = spawn(shell, argv, spawnOptions);
+        let bufferedError = null;
+        const guardError = (err) => { bufferedError = bufferedError || err; };
+        child.on('error', guardError);
+        try {
+          await new Promise((resolveSpawn, rejectSpawn) => {
+            const onSpawn = () => {
+              child.removeListener('error', onError);
+              resolveSpawn();
+            };
+            const onError = (err) => {
+              child.removeListener('spawn', onSpawn);
+              rejectSpawn(err);
+            };
+            child.once('spawn', onSpawn);
+            child.once('error', onError);
+          });
+        } catch (err) {
+          child.removeListener('error', guardError);
+          throw err;
+        }
+        return {
+          child,
+          adoptErrorHandler(handler) {
+            child.on('error', handler);
+            child.removeListener('error', guardError);
+            if (bufferedError) handler(bufferedError);
+          },
+        };
+      } catch (err) {
+        try {
+          console.error('[shell-spawn-retry] ' + JSON.stringify({
+            code: (err && err.code) || null,
+            syscall: (err && err.syscall) || null,
+            shell,
+            cwd,
+            activeSpawnCount: activeShellSpawns,
+          }));
+        } catch { /* logging must never mask the spawn error */ }
+        const canRetry = err && err.code === 'EPERM'
+          && process.platform === 'win32'
+          && isPowerShell
+          && attempt < delays.length;
+        if (!canRetry) throw err;
+        await new Promise((r) => setTimeout(r, delays[attempt++]));
+      }
+    }
+  } finally {
+    activeShellSpawns--;
+  }
+}

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -44,6 +44,7 @@ import {
   _maybeEncodePowerShellCommand,
   extractPowerShellCommandInner,
 } from './shell-powershell.mjs';
+import { spawnShellWithRetry as _spawnShellWithRetry } from './lib/shell-spawn-retry.mjs';
 
 export {
   _maybeEncodePowerShellCommand,
@@ -447,12 +448,6 @@ async function _execPolicyBlockMessage(command) {
 // EPERM backoff). Logged with each failed spawn so a Defender-induced storm
 // is reconstructable: activeSpawnCount > 1 means concurrent spawns were
 // racing the AV scan when the failure hit.
-let _activeShellSpawns = 0;
-
-function _isPowerShellSpawn(shell, shellArg) {
-  return /pwsh|powershell/i.test(String(shell || '')) || shellArg === '-Command';
-}
-
 // Windows Defender intermittently fails node→PowerShell spawns with EPERM
 // while it scans the child image (see shell-runtime.mjs Trojan false-positive
 // note). The failure is at spawn() time — before any stdio/side effect — so a
@@ -460,71 +455,6 @@ function _isPowerShellSpawn(shell, shellArg) {
 // Retry ONLY on EPERM/win32/powershell; everything else throws on first
 // failure. Backoff 100/300/700ms caps added latency at ~1.1s. Every failed
 // attempt logs one diagnostic line for later reconstruction.
-async function _spawnShellWithRetry({ shell, argv, spawnOptions, shellArg, cwd }) {
-  const _delays = [100, 300, 700];
-  const _isPowerShell = _isPowerShellSpawn(shell, shellArg);
-  _activeShellSpawns++;
-  try {
-    let attempt = 0;
-    for (;;) {
-      try {
-        const child = spawn(shell, argv, spawnOptions);
-        // spawn() reports ENOENT/EACCES on nextTick. Keep a guard listener
-        // attached from the same synchronous frame as spawn(), and do not
-        // resolve this helper until the child emits `spawn`. The caller adopts
-        // the guard atomically (new listener first, guard removal second), so
-        // there is never an unhandled-error window across either await.
-        let bufferedError = null;
-        const guardError = (err) => { bufferedError = bufferedError || err; };
-        child.on('error', guardError);
-        try {
-          await new Promise((resolveSpawn, rejectSpawn) => {
-            const onSpawn = () => {
-              child.removeListener('error', onError);
-              resolveSpawn();
-            };
-            const onError = (err) => {
-              child.removeListener('spawn', onSpawn);
-              rejectSpawn(err);
-            };
-            child.once('spawn', onSpawn);
-            child.once('error', onError);
-          });
-        } catch (err) {
-          child.removeListener('error', guardError);
-          throw err;
-        }
-        return {
-          child,
-          adoptErrorHandler(handler) {
-            child.on('error', handler);
-            child.removeListener('error', guardError);
-            if (bufferedError) handler(bufferedError);
-          },
-        };
-      } catch (err) {
-        try {
-          console.error('[shell-spawn-retry] ' + JSON.stringify({
-            code: (err && err.code) || null,
-            syscall: (err && err.syscall) || null,
-            shell,
-            cwd,
-            activeSpawnCount: _activeShellSpawns,
-          }));
-        } catch { /* logging must never mask the spawn error */ }
-        const _canRetry = err && err.code === 'EPERM'
-          && process.platform === 'win32'
-          && _isPowerShell
-          && attempt < _delays.length;
-        if (!_canRetry) throw err;
-        await new Promise((r) => setTimeout(r, _delays[attempt++]));
-      }
-    }
-  } finally {
-    _activeShellSpawns--;
-  }
-}
-
 export function execShellCommand({
   shell,
   shellArg,

package/src/runtime/channels/backends/discord-gateway.mjs

@@ -31,7 +31,7 @@ async function connectInner(self) {
     self.client = null;
     throw err;
   }
-  self.persistAccessFromMainChannel();
+  await self.persistAccessFromMainChannel();
 }
 
 async function buildClient(self) {

package/src/runtime/channels/backends/discord.mjs

@@ -18,7 +18,7 @@ import { join, sep } from "path";
 import { createHash } from "crypto";
 import { chunk, formatForDiscord, MAX_DISCORD_MESSAGE } from "../lib/format.mjs";
 import { withConfigLock } from "../lib/config-lock.mjs";
-import { readSection, updateSection } from "../../shared/config.mjs";
+import { readSection, updateSectionAsync } from "../../shared/config.mjs";
 import { normalizeAccess, safeAttName } from "./discord-access.mjs";
 import { MAX_ATTACHMENT_BYTES, downloadSingleAttachment } from "./discord-attachments.mjs";
 import * as gateway from "./discord-gateway.mjs";
@@ -473,7 +473,7 @@ class DiscordBackend {
       return this.initialAccess;
     }
   }
-  persistAccessFromMainChannel() {
+  async persistAccessFromMainChannel() {
     if (this.isStatic || !this.configFile) return;
     try {
       const id = this.mainChannelId;
@@ -482,7 +482,7 @@ class DiscordBackend {
       const access = normalizeAccess(parsed.access);
       if (!(id in access.channels)) {
         access.channels[id] = { requireMention: false, allowFrom: [] };
-        this.saveAccess(access);
+        await this.saveAccess(access);
       }
     } catch (err) {
       process.stderr.write(`mixdog discord: persistAccessFromMainChannel failed: ${err}\n`);
@@ -499,10 +499,10 @@ class DiscordBackend {
     }
     return a;
   }
-  saveAccess(a) {
+  async saveAccess(a) {
     if (this.isStatic) return;
     if (!this.configFile) return;
-    return withConfigLock(() => {
+    return withConfigLock(async () => {
       mkdirSync(this.stateDir, { recursive: true, mode: 448 });
       const access = {
         dmPolicy: a.dmPolicy,
@@ -513,7 +513,7 @@ class DiscordBackend {
         ...a.replyToMode ? { replyToMode: a.replyToMode } : {},
         ...a.textChunkLimit ? { textChunkLimit: a.textChunkLimit } : {}
       };
-      updateSection("channels", (channels) => ({
+      await updateSectionAsync("channels", (channels) => ({
         ...channels,
         access
       }));

package/src/runtime/channels/lib/config.mjs

@@ -2,7 +2,16 @@ import { readFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { DiscordBackend } from "../backends/discord.mjs";
 import { TelegramBackend } from "../backends/telegram.mjs";
-import { readSection, updateSection, CONFIG_PATH as MIXDOG_CONFIG_PATH, getDiscordToken, getTelegramToken, diagnoseDiscordTokenValue } from "../../shared/config.mjs";
+import {
+  readSection,
+  updateSection,
+  CONFIG_PATH as MIXDOG_CONFIG_PATH,
+  SECRET_ACCOUNTS,
+  getDiscordToken,
+  getTelegramToken,
+  diagnoseDiscordTokenValue,
+  invalidateSecretReadCache,
+} from "../../shared/config.mjs";
 import { listSchedules } from "../../shared/schedules-db.mjs";
 import { resolvePluginData } from "../../shared/plugin-paths.mjs";
 const DATA_DIR = resolvePluginData();
@@ -46,8 +55,12 @@ function resolveChannelId(raw = {}, backend = "discord") {
   return "";
 }
 
-async function loadConfig() {
+async function loadConfig({ freshSecrets = false } = {}) {
   try {
+    if (freshSecrets) {
+      invalidateSecretReadCache(SECRET_ACCOUNTS.discordToken);
+      invalidateSecretReadCache(SECRET_ACCOUNTS.telegramToken);
+    }
     let raw = readSection("channels");
     raw = raw && typeof raw === "object" ? raw : {};
     // Schedules are the PG `scheduler.schedules` table (single source of

package/src/runtime/channels/lib/memory-client.mjs

@@ -218,6 +218,16 @@ function atomicWrite(targetPath, contents) {
 // site, so no drain/replay format or TTL semantics change.
 const _dedupeIndex = new Map()
 let _dedupeIndexSeeded = false
+function dropDedupeIndexForPath(bufferPath) {
+  for (const [key, indexedPath] of _dedupeIndex) {
+    if (indexedPath === bufferPath) _dedupeIndex.delete(key)
+  }
+}
+function replaceDedupeIndexPath(previousPath, nextPath) {
+  for (const [key, indexedPath] of _dedupeIndex) {
+    if (indexedPath === previousPath) _dedupeIndex.set(key, nextPath)
+  }
+}
 function seedDedupeIndex(kind) {
   if (_dedupeIndexSeeded) return
   _dedupeIndexSeeded = true
@@ -266,9 +276,11 @@ function bufferToDisk(kind, payload, { dedupeKey = null } = {}) {
 // leaves the file in place and returns false so the caller skips it this pass.
 function moveToDead(name, reason) {
   process.stderr.write(`[memory-client] quarantining ${name} to dead/ (${reason})\n`)
+  const bufferPath = path.join(BUFFER_DIR, name)
   try {
     fs.mkdirSync(DEAD_DIR, { recursive: true })
-    fs.renameSync(path.join(BUFFER_DIR, name), path.join(DEAD_DIR, name))
+    fs.renameSync(bufferPath, path.join(DEAD_DIR, name))
+    dropDedupeIndexForPath(bufferPath)
     return true
   } catch (e) {
     process.stderr.write(`[memory-client] quarantine of ${name} failed (${e.message}) — leaving in place\n`)
@@ -355,7 +367,10 @@ export async function drainBuffer() {
         // throwOnError: non-2xx status or an {error} body REJECTS, so the
         // file is kept/aged for retry instead of unlinked (HIGH: data loss).
         await memoryFetch('POST', endpoint, payload, 10_000, { throwOnError: true })
-        try { fs.unlinkSync(bufferPath) } catch {}
+        try {
+          fs.unlinkSync(bufferPath)
+          dropDedupeIndexForPath(bufferPath)
+        } catch {}
         drained++
       } catch (e) {
         const attempts = parseRetry(name) + 1
@@ -375,7 +390,9 @@ export async function drainBuffer() {
           // THIS pass so it can't block the oldest-first queue forever — the
           // next drain re-reads its (unchanged) .rN and retries.
           try {
-            fs.renameSync(bufferPath, path.join(BUFFER_DIR, retryName(name, attempts)))
+            const nextPath = path.join(BUFFER_DIR, retryName(name, attempts))
+            fs.renameSync(bufferPath, nextPath)
+            replaceDedupeIndexPath(bufferPath, nextPath)
           } catch {
             // Rename lock/EPERM: don't break the whole pass on a file we
             // couldn't even age — skip it and CONTINUE so later buffered