mixdog 0.9.75 → 0.9.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.75",
+  "version": "0.9.76",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -848,7 +848,17 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                         activeSession.messages = finalized.messages;
                         if (!finalized.responsePreserved) {
                             releasePendingMessages(sessionId, _turnPendingEntries);
-                            activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
+                            if (finalized.userTurnPreserved) {
+                                // Non-user abort (app quit / engine dispose /
+                                // watchdog): the just-sent user turn stays in
+                                // history, so the session-start meta it carries
+                                // remains consumed, and the opaque provider
+                                // continuation no longer matches — force full
+                                // transcript replay on the next send.
+                                activeSession.providerState = undefined;
+                            } else {
+                                activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
+                            }
                         } else {
                             recordPendingMessageDelivery(activeSession, _turnPendingEntries);
                             // The opaque provider continuation now points at a

package/src/runtime/agent/orchestrator/session/manager/turn-interruption.mjs

@@ -10,6 +10,16 @@ const INTERRUPT_MESSAGE_FOR_TOOL_USE = '[Request interrupted by user for tool us
 const STREAMING_INTERRUPTED_TOOL_RESULT = 'Interrupted by user';
 const TOOL_USE_REJECT_RESULT = "The user doesn't want to proceed with this tool use. The tool use was rejected (eg. if it was a file edit, the new_string was NOT written to the file). STOP what you are doing and wait for the user to tell you how to proceed.";
 
+// Abort reasons that represent an EXPLICIT user cancellation of this turn.
+// Only these rewind a not-yet-answered user turn out of history — the TUI/
+// desktop restore the prompt into the input box on user cancel, so keeping
+// the message would duplicate it on resubmit. Any other closeReason (engine
+// shutdown `cli-react-exit`, watchdog, idle-sweep, runner-crash, …) must
+// PRESERVE the just-sent user turn: nothing restores the prompt there, and
+// rewinding erases the user's message from the persisted transcript (the
+// exact loss seen when the desktop app quits mid-turn).
+const USER_CANCEL_ABORT_REASONS = new Set(['cli-abort', 'user-cancel', 'turn-abort']);
+
 function assistantToolCallIds(message) {
     if (!message || message.role !== 'assistant') return [];
     const ids = [];
@@ -60,9 +70,21 @@ function finalizeInterruptedTurn({
     const preserveResponse = responseStarted
         && !isInternalRuntimeNotificationText(currentUserContent);
     if (!preserveResponse) {
+        // Null/unknown reasons keep the legacy rewind (status quo for wrapped
+        // aborts without a closeReason enum); named non-user reasons preserve.
+        const userCancelled = abortReason == null
+            || USER_CANCEL_ABORT_REASONS.has(abortReason);
+        if (!userCancelled) {
+            return {
+                messages,
+                responsePreserved: false,
+                userTurnPreserved: true,
+            };
+        }
         return {
             messages: rewindProvisionalUserTurn(messages, currentUserContent),
             responsePreserved: false,
+            userTurnPreserved: false,
         };
     }
 
@@ -132,7 +154,7 @@ function finalizeInterruptedTurn({
                 : INTERRUPT_MESSAGE,
         });
     }
-    return { messages: pairedMessages, responsePreserved: true };
+    return { messages: pairedMessages, responsePreserved: true, userTurnPreserved: true };
 }
 
 export function createTurnInterruptionTracker() {

package/src/runtime/agent/orchestrator/tools/bash-session.mjs

@@ -45,7 +45,7 @@ import { markCodeGraphDirtyPaths, drainCodeGraphCache } from './code-graph-state
 import { maybeRewriteWmicProcessCommand } from './shell-policy.mjs';
 import { _maybeEncodePowerShellCommand } from './shell-command.mjs';
 import { _captureTrackedMtimes, _trackedDriftNoteAfter, getDedupedDestructiveWarnings } from './builtin/bash-tool.mjs';
-import { scrubLoaderVars, scrubProviderSecrets } from './env-scrub.mjs';
+import { scrubLoaderVars, scrubProviderSecrets, scrubRuntimeRootVars } from './env-scrub.mjs';
 import { checkExecPolicyMessage } from './bash-policy-scan.mjs';
 import { startChildGuardian } from '../../../shared/child-guardian.mjs';
 import { resourceAdmission } from '../../../shared/resource-admission.mjs';
@@ -342,6 +342,8 @@ function buildBashEnv() {
     scrubProviderSecrets(env);
     // R11 loader/execution scrub (NODE_OPTIONS, LD_PRELOAD, DYLD_*, …).
     scrubLoaderVars(env);
+    // Runtime-root isolation — see env-scrub.mjs scrubRuntimeRootVars.
+    scrubRuntimeRootVars(env);
     return env;
 }
 

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -44,7 +44,7 @@ import { normalizeOutputPath } from './path-utils.mjs';
 import { normalizeErrorMessage } from './path-diagnostics.mjs';
 import { invalidateBuiltinResultCache } from './cache-layers.mjs';
 import { resolveOptionalCwd } from './cwd-utils.mjs';
-import { scrubLoaderVars, scrubProviderSecrets } from '../env-scrub.mjs';
+import { scrubLoaderVars, scrubProviderSecrets, scrubRuntimeRootVars } from '../env-scrub.mjs';
 import { resolveSessionCwd, stateFilePath, wrapPowerShellWithCwdProbe, wrapBashWithCwdProbe } from '../shell-state.mjs';
 import { resourceAdmission } from '../../../../shared/resource-admission.mjs';
 
@@ -407,6 +407,7 @@ export async function executeBashTool(args, workDir, options = {}) {
         // R5/R11: same scrub as background/persistent spawn sites (env-scrub.mjs).
         scrubProviderSecrets(spawnEnv);
         scrubLoaderVars(spawnEnv);
+        scrubRuntimeRootVars(spawnEnv);
         let wrappedCommand;
         // PowerShell UTF-8 prefix is PS-only: the Windows Git Bash path
         // (shellType==='posix') must NOT receive it. Snapshot wrapper stays

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-spawn.mjs

@@ -2,7 +2,7 @@
 import { spawn } from 'child_process';
 import { existsSync, readFileSync, statSync, unlinkSync, watch as fsWatch, writeFileSync } from 'fs';
 import { basename } from 'path';
-import { scrubLoaderVars, scrubProviderSecrets } from '../env-scrub.mjs';
+import { scrubLoaderVars, scrubProviderSecrets, scrubRuntimeRootVars } from '../env-scrub.mjs';
 import {
     normalizeToolNotifyContext,
     notifyToolCompletion,
@@ -169,7 +169,7 @@ export async function _startBackgroundShellJobImpl({
     try {
         child = spawnFn(shell, [wrappedTempPath], {
             cwd: workDir,
-            env: scrubLoaderVars(scrubProviderSecrets({ ...spawnEnv })),
+            env: scrubRuntimeRootVars(scrubLoaderVars(scrubProviderSecrets({ ...spawnEnv }))),
             stdio: 'ignore',
             ...detachedSpawnOpts,
         });
@@ -398,7 +398,7 @@ async function startBackgroundPowerShellJob({
     try {
         child = spawnFn(shell, wrapperArgs, {
             cwd: workDir,
-            env: scrubLoaderVars(scrubProviderSecrets({ ...spawnEnv })),
+            env: scrubRuntimeRootVars(scrubLoaderVars(scrubProviderSecrets({ ...spawnEnv }))),
             detached: false,
             stdio: 'ignore',
             windowsHide: true,

package/src/runtime/agent/orchestrator/tools/env-scrub.mjs

@@ -98,3 +98,17 @@ export function scrubProviderSecrets(env) {
     }
     return env;
 }
+
+// Runtime-root isolation: MIXDOG_ROOT is a runtime-internal alias for THIS
+// process's install/resource root (a packaged desktop host points it at
+// resources/runtime.asar/...). Model-spawned shells must never inherit it —
+// a dev-tree test run inside such a shell would resolve defaults/agents.json
+// and friends from the INSTALLED app instead of the repo under test (plain
+// node can't even read asar paths → ENOENT). Internal worker spawns that need
+// the root re-set it explicitly and are unaffected: only shell spawn sites
+// call this.
+export function scrubRuntimeRootVars(env) {
+    if (!env || typeof env !== 'object') return env;
+    delete env.MIXDOG_ROOT;
+    return env;
+}

package/src/runtime/agent/orchestrator/tools/shell-snapshot.mjs

@@ -18,7 +18,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { randomUUID } from 'node:crypto';
 import { getPluginData } from '../config.mjs';
-import { scrubLoaderVars, scrubProviderSecrets } from './env-scrub.mjs';
+import { scrubLoaderVars, scrubProviderSecrets, scrubRuntimeRootVars } from './env-scrub.mjs';
 
 const SNAPSHOT_TIMEOUT_MS = 10_000;
 
@@ -191,6 +191,8 @@ function _runSnapshot(shellPath, snapshotPath, configFileExists) {
         // provider/cloud tokens before exposing the env to that script.
         // Shared with bash-session and shell-jobs via env-scrub.mjs.
         scrubProviderSecrets(e);
+        // Runtime-root isolation — see env-scrub.mjs scrubRuntimeRootVars.
+        scrubRuntimeRootVars(e);
         return e;
       })(),
       windowsHide: true,