mixdog 0.9.83 → 0.9.85

package/src/runtime/channels/lib/owned-runtime.mjs

@@ -3,6 +3,7 @@ import { loadConfig, createBackend } from "./config.mjs";
 import { WebhookServer } from "./webhook.mjs";
 import { EventPipeline } from "./event-pipeline.mjs";
 import { startSnapshotWriter, stopSnapshotWriter } from "./status-snapshot.mjs";
+import { safeIpcSend } from "../../shared/safe-ipc-send.mjs";
 import { initProviders } from "../../agent/orchestrator/providers/registry.mjs";
 import { loadConfig as loadAgentConfig } from "../../agent/orchestrator/config.mjs";
 import {
@@ -423,14 +424,11 @@ function armBridgeOwnershipTimer() {}
 // error-callback path of ERR_IPC_CHANNEL_CLOSED (channel closing between the
 // connected check and delivery). Log-and-continue — never crash the worker.
 function sendToParent(message) {
-  if (!process.send || process.connected === false) return;
-  try {
-    process.send(message, undefined, undefined, err => {
-      if (err) process.stderr.write(`[channels] parent IPC send failed: ${err?.message || err}\n`);
-    });
-  } catch (err) {
-    process.stderr.write(`[channels] parent IPC send threw: ${err?.message || err}\n`);
-  }
+  safeIpcSend(process, message, {
+    onError: (err) => {
+      try { process.stderr.write(`[channels] parent IPC send failed: ${err?.message || err}\n`); } catch {}
+    },
+  });
 }
 // Tell the parent session this worker ACQUIRED the bridge so it flips remote
 // mode ON (badge/transcript writer). Callers fire this only on a genuine

package/src/runtime/channels/lib/parent-bridge.mjs

@@ -2,6 +2,8 @@
 // (behavior-preserving). Groups the notify-to-parent path and the
 // worker → parent → memory call bridge. Bound to live getters
 // (getInstanceId) so runtime identity stays consistent.
+import { safeIpcSend } from '../../shared/safe-ipc-send.mjs';
+
 function normalizeChannelNotifyParams(method, params) {
   if (method === 'notifications/claude/channel' && params && params.meta) {
     const m = {};
@@ -24,7 +26,7 @@ function setChannelNotifySink(fn) {
   _notifySink = typeof fn === 'function' ? fn : null;
 }
 
-function createParentBridge({ getInstanceId }) {
+function createParentBridge({ getInstanceId, ipcProcess = process }) {
   function sendNotifyToParent(method, params) {
     // CC channel schema requires meta: Record<string,string> (channelNotification.ts).
     // Coerce every meta value to string so a non-string (e.g. a Discord
@@ -37,15 +39,15 @@ function createParentBridge({ getInstanceId }) {
       catch (err) { try { process.stderr.write(`mixdog channels: notify sink failed: ${err && err.message || err}\n`); } catch {} }
       return;
     }
-    if (!process.send) {
+    if (!ipcProcess?.send || ipcProcess.connected !== true) {
       try { process.stderr.write(`mixdog channels: notify dropped (no IPC channel): ${method}\n`); } catch {}
       return;
     }
-    try {
-      process.send({ type: 'notify', method, params: outParams });
-    } catch (err) {
-      try { process.stderr.write(`mixdog channels: notify IPC send failed: ${err && err.message || err}\n`); } catch {}
-    }
+    safeIpcSend(ipcProcess, { type: 'notify', method, params: outParams }, {
+      onError: (err) => {
+        try { process.stderr.write(`mixdog channels: notify IPC send failed: ${err && err.message || err}\n`); } catch {}
+      },
+    });
   }
 
   // ── Memory worker bridge (worker → parent → memory) ─────────────────
@@ -56,10 +58,24 @@ function createParentBridge({ getInstanceId }) {
   // integrated into the main IPC handler below (not a second listener).
   const _memoryCallPending = new Map();
   let _memoryCallSeq = 0;
+  const failMemoryCall = (callId, error) => {
+    const pending = _memoryCallPending.get(callId);
+    if (!pending) return;
+    _memoryCallPending.delete(callId);
+    pending.reject(error instanceof Error ? error : new Error(String(error || 'memory_call IPC failed')));
+  };
+  const rejectAllMemoryCalls = (error) => {
+    for (const callId of Array.from(_memoryCallPending.keys())) failMemoryCall(callId, error);
+  };
+  ipcProcess?.once?.('disconnect', () => {
+    rejectAllMemoryCalls(new Error('memory_call parent IPC disconnected'));
+  });
 
   function callMemoryAction(action, args, timeoutMs) {
     return new Promise((resolve, reject) => {
-      if (!process.send) return reject(new Error('not a worker process'));
+      if (!ipcProcess?.send || ipcProcess.connected !== true) {
+        return reject(new Error('not a connected worker process'));
+      }
       const callId = `mc_${getInstanceId()}_${++_memoryCallSeq}_${Math.random().toString(36).slice(2, 8)}`;
       const timer = setTimeout(() => {
         _memoryCallPending.delete(callId);
@@ -69,13 +85,9 @@ function createParentBridge({ getInstanceId }) {
         resolve: (v) => { clearTimeout(timer); resolve(v); },
         reject: (e) => { clearTimeout(timer); reject(e); },
       });
-      try {
-        process.send({ type: 'memory_call_request', callId, action, args: args || {} });
-      } catch (e) {
-        _memoryCallPending.delete(callId);
-        clearTimeout(timer);
-        reject(e);
-      }
+      safeIpcSend(ipcProcess, { type: 'memory_call_request', callId, action, args: args || {} }, {
+        onError: (error) => failMemoryCall(callId, error),
+      });
     });
   }
 

package/src/runtime/channels/lib/worker-ipc.mjs

@@ -1,4 +1,5 @@
 import { performance } from "perf_hooks";
+import { safeIpcSend } from "../../shared/safe-ipc-send.mjs";
 // IPC worker-mode message loop extracted from channels/index.mjs
 // (behavior-preserving). Installs shutdown handlers, the parent->worker message
 // router, and the retrying start() bootstrap. Call once from the worker entry
@@ -19,6 +20,11 @@ export function runWorkerIpc({
   handleToolCallWithBridgeRetry,
   bootProfile,
 }) {
+  const sendToParent = (message) => safeIpcSend(process, message, {
+    onError: (error) => {
+      try { process.stderr.write(`[channels-worker] parent IPC send failed: ${error?.message || error}\n`); } catch {}
+    },
+  });
   // SIGTERM/SIGINT/IPC shutdown handler — mirrors src/memory/index.mjs pattern.
   // Cleans up in-progress webhook/scheduler state, removes runtime files, then exits.
   let _channelsStopInFlight = false
@@ -29,6 +35,10 @@ export function runWorkerIpc({
       return
     }
     _channelsStopInFlight = true
+    for (const controller of _inFlightChannelCalls.values()) {
+      try { controller.abort() } catch {}
+    }
+    _inFlightChannelCalls.clear()
     process.stderr.write(`[channels-worker] received ${sig} — shutting down cleanly\n`)
     _channelsForceExitTimer = setTimeout(() => {
       process.stderr.write(`[channels-worker] stop() timed out after 6000ms — forcing exit(2)\n`)
@@ -47,6 +57,7 @@ export function runWorkerIpc({
   }
   process.on('SIGTERM', () => _channelsShutdownHandler('SIGTERM'))
   process.on('SIGINT',  () => _channelsShutdownHandler('SIGINT'))
+  process.once('disconnect', () => _channelsShutdownHandler('IPC:disconnect'))
 
   // Map of callId → AbortController for in-flight IPC calls.
   const _inFlightChannelCalls = new Map()
@@ -144,7 +155,7 @@ export function runWorkerIpc({
         entry.abort()
         _inFlightChannelCalls.delete(msg.callId)
       }
-      process.send({ type: 'result', callId: msg.callId, error: 'cancelled' })
+      sendToParent({ type: 'result', callId: msg.callId, error: 'cancelled' })
       return
     }
     if (msg.type !== 'call' || !msg.callId) return
@@ -157,9 +168,9 @@ export function runWorkerIpc({
       } finally {
         _inFlightChannelCalls.delete(msg.callId)
       }
-      process.send({ type: 'result', callId: msg.callId, result })
+      sendToParent({ type: 'result', callId: msg.callId, result })
     } catch (e) {
-      process.send({ type: 'result', callId: msg.callId, error: e.message })
+      sendToParent({ type: 'result', callId: msg.callId, error: e.message })
     }
   })
   void (async () => {
@@ -174,7 +185,9 @@ export function runWorkerIpc({
       try {
         await start()
         bootProfile("worker:ready", { ms: (performance.now() - startedAt).toFixed(1), attempt })
-        process.send({ type: 'ready' })
+        if (!sendToParent({ type: 'ready' })) {
+          void _channelsShutdownHandler('IPC:ready-send-failed')
+        }
         return
       } catch (e) {
         lastErr = e

package/src/runtime/memory/index.mjs

@@ -73,6 +73,7 @@ import { listCore, addCore, editCore, deleteCore, compactCoreIds, listCoreCandid
 import { resolveProjectId, resolveProjectScope } from './lib/project-id-resolver.mjs'
 import { openTraceDatabase, closeTraceDatabase, insertTraceEvents, enqueueTraceEvents, insertAgentCalls, registerTraceExitDrain } from './lib/trace-store.mjs'
 import { updateJsonAtomicSync, writeJsonAtomicSync } from '../shared/atomic-file.mjs'
+import { safeIpcSend } from '../shared/safe-ipc-send.mjs'
 import { resolvePluginData, mixdogHome } from '../shared/plugin-paths.mjs'
 import { parsePeriod, formatTs, coreRecallTerms, normalizeRecallProjectScope, sessionRecallTerms, interleaveRawRows, renderEntryLines, renderSessionGroupedLines } from './lib/recall-format.mjs'
 import { readBody, sendJson, sendError, isLocalOrigin, normalizeCoreProjectId } from './lib/http-wire.mjs'
@@ -646,6 +647,14 @@ export { TOOL_DEFS, handleToolCall, buildSessionCoreMemoryPayload }
 export { MEMORY_INSTRUCTIONS_TEXT as instructions }
 export { acquireLock, releaseLock }
 export { cwdFromTranscriptPath }
+function sendMemoryWorkerMessage(message) {
+  return safeIpcSend(process, message, {
+    onError: (error) => {
+      const code = error?.code ? ` code=${error.code}` : ''
+      __mixdogMemoryLog(`[memory-worker] IPC send failed${code}: ${error?.message || error}\n`)
+    },
+  })
+}
 export async function init() {
   if (_initialized) return
   __mixdogMemoryLog(`[boot-time] tag=memory-init-start tMs=${Date.now()}\n`)
@@ -683,7 +692,7 @@ export async function init() {
   }
   if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
     __mixdogMemoryLog(`[boot-time] tag=memory-ready tMs=${Date.now()}\n`)
-    process.send({ type: 'ready', port: boundPort })
+    sendMemoryWorkerMessage({ type: 'ready', port: boundPort })
   }
   __mixdogMemoryLog(`[memory-service] init() complete (entries unified mode, version=${PLUGIN_VERSION})\n`)
   touchDaemonIdleTimer('init')
@@ -888,7 +897,7 @@ if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
         entry.cancelled = true
         entry.ac.abort()
         _inFlightCalls.delete(msg.callId)
-        process.send({ type: 'result', callId: msg.callId, error: 'cancelled' })
+        sendMemoryWorkerMessage({ type: 'result', callId: msg.callId, error: 'cancelled' })
       }
       return
     }
@@ -902,9 +911,9 @@ if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
       } finally {
         _inFlightCalls.delete(msg.callId)
       }
-      if (!entry.cancelled) process.send({ type: 'result', callId: msg.callId, result })
+      if (!entry.cancelled) sendMemoryWorkerMessage({ type: 'result', callId: msg.callId, result })
     } catch (e) {
-      if (!entry.cancelled) process.send({ type: 'result', callId: msg.callId, error: e.message })
+      if (!entry.cancelled) sendMemoryWorkerMessage({ type: 'result', callId: msg.callId, error: e.message })
     }
   })
   init().catch(e => {
@@ -929,7 +938,7 @@ if (process.env.MIXDOG_WORKER_MODE === '1' && process.send) {
     __mixdogMemoryLog(`[memory-worker] init failed: ${detail}\n`)
     // Signal degraded state to parent before exiting so it records the failure
     // rather than treating this as a normal pre-ready crash.
-    try { process.send({ type: 'ready', degraded: true, error: detail.slice(0, 800) }) } catch {}
+    sendMemoryWorkerMessage({ type: 'ready', degraded: true, error: detail.slice(0, 800) })
     process.exit(1)
   })
 }

package/src/runtime/memory/lib/agent-ipc.mjs

@@ -12,6 +12,7 @@
  * Uses a module-level pending map keyed by callId. Parent-side handler
  * lives in server.mjs spawnWorker's message listener.
  */
+import { safeIpcSend } from '../../shared/safe-ipc-send.mjs'
 
 const pending = new Map()
 let listenerInstalled = false
@@ -28,6 +29,11 @@ function installListener() {
     if (msg.ok) entry.resolve(msg.result)
     else entry.reject(new Error(msg.error || 'agent_ipc_response error'))
   })
+  process.once('disconnect', () => {
+    const error = new Error('agent-ipc: parent IPC disconnected')
+    for (const [, entry] of pending) entry.reject(error)
+    pending.clear()
+  })
 }
 
 function nextCallId() {
@@ -61,9 +67,7 @@ export function callAgentDispatch(opts = {}, prompt) {
       if (!pending.has(callId)) return
       pending.delete(callId)
       if (process.connected) {
-        try {
-          process.send({ type: 'agent_ipc_cancel', callId }, undefined, {}, () => {})
-        } catch {}
+        safeIpcSend(process, { type: 'agent_ipc_cancel', callId })
       }
       reject(new Error(`agent-ipc: timed out after ${timeoutMs}ms`))
     }, timeoutMs)
@@ -80,8 +84,7 @@ export function callAgentDispatch(opts = {}, prompt) {
     // Pass a write callback so a closed-channel write surfaces as an async
     // error here (rejecting this Promise) instead of bubbling to the process
     // 'error' event and crashing the daemon with ERR_IPC_CHANNEL_CLOSED.
-    try {
-      process.send({
+    safeIpcSend(process, {
         type: 'agent_ipc_request',
         callId,
         tool: 'agent_dispatch',
@@ -94,17 +97,13 @@ export function callAgentDispatch(opts = {}, prompt) {
           prompt: String(prompt ?? ''),
           timeout: timeoutMs,
         },
-      }, undefined, {}, (err) => {
-        if (!err) return
+      }, {
+        onError: (err) => {
         if (!pending.has(callId)) return
         pending.delete(callId)
         clearTimeout(timer)
         reject(err)
+        },
       })
-    } catch (e) {
-      pending.delete(callId)
-      clearTimeout(timer)
-      reject(e)
-    }
   })
 }

package/src/runtime/shared/atomic-file.mjs

@@ -11,6 +11,15 @@ import {
   unlinkSync,
   writeFileSync,
 } from 'fs';
+import {
+  link as linkAsync,
+  mkdir as mkdirAsync,
+  open as openAsync,
+  readFile as readFileAsync,
+  rename as renameAsync,
+  unlink as unlinkAsync,
+  writeFile as writeFileAsync,
+} from 'node:fs/promises';
 import { dirname, basename, join } from 'path';
 import { randomBytes } from 'crypto';
 import { execFile, execFileSync } from 'child_process';
@@ -76,6 +85,25 @@ export function renameWithRetrySync(src, dst, opts = {}) {
   throw lastErr;
 }
 
+export async function renameWithRetry(src, dst, opts = {}) {
+  const backoffs = Array.isArray(opts.backoffs) && opts.backoffs.length > 0
+    ? opts.backoffs
+    : DEFAULT_BACKOFFS_MS;
+  let lastErr = null;
+  for (let attempt = 0; attempt <= backoffs.length; attempt++) {
+    try {
+      await renameAsync(src, dst);
+      return true;
+    } catch (err) {
+      lastErr = err;
+      if (!RETRY_CODES.has(err?.code) || attempt >= backoffs.length) break;
+      const jitter = Math.floor(Math.random() * Math.min(50, Math.max(1, backoffs[attempt])));
+      await _asyncSleep(backoffs[attempt] + jitter);
+    }
+  }
+  throw lastErr;
+}
+
 export function withFileLockSync(lockPath, fn, opts = {}) {
   const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_LOCK_TIMEOUT_MS;
   const staleMs = Number.isFinite(opts.staleMs) ? opts.staleMs : 30000;
@@ -585,62 +613,60 @@ export function updateJsonAtomicSync(filePath, mutator, opts = {}) {
   }, opts);
 }
 
-// ── Async atomic file write (non-blocking secret ACL) ───────────────
-// Mirror of writeFileAtomicSync, but the owner-only ACL enforcement on the
-// temp and final path runs through the async icacls variant so a debounced
-// timer flush never blocks the event loop on a subprocess. The tiny
-// writeFileSync/renameSync of a small JSON payload stay synchronous (they are
-// not the hitch); only the icacls calls — the actual blockers — are awaited.
+// ── Async atomic file write ─────────────────────────────────────────
+// Mirror of writeFileAtomicSync using promise-based filesystem calls and async
+// ACL enforcement. Large summary/pending-message JSON writes therefore never
+// block the host event loop on read/write/fsync/rename.
 // The truncate renameFallback branch is intentionally omitted: it only ever
 // applied to non-secret writes (opts.secret !== true), and every async caller
 // here is a secret config write, so behavior is identical.
 export async function writeFileAtomicAsync(filePath, data, opts = {}) {
   const run = async () => {
     const dir = dirname(filePath);
-    mkdirSync(dir, { recursive: true });
+    await mkdirAsync(dir, { recursive: true });
     const tmp = join(dir, `.${basename(filePath)}.${randomBytes(12).toString('hex')}.tmp`);
     try {
       const writeOpts = { encoding: opts.encoding || 'utf8', flag: 'wx', mode: opts.mode !== undefined ? opts.mode : 0o600 };
-      writeFileSync(tmp, data, writeOpts);
+      await writeFileAsync(tmp, data, writeOpts);
       if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(tmp);
       if (opts.fsync !== false) {
         let fd = null;
         try {
-          fd = openSync(tmp, 'r');
-          fsyncSync(fd);
+          fd = await openAsync(tmp, 'r');
+          await fd.sync();
         } catch (err) {
           if (!['EPERM', 'ENOTSUP', 'EINVAL'].includes(err?.code)) throw err;
         } finally {
-          try { if (fd !== null) closeSync(fd); } catch {}
+          try { if (fd !== null) await fd.close(); } catch {}
         }
       }
       if (opts.createOnly === true) {
         try {
-          linkSync(tmp, filePath);
+          await linkAsync(tmp, filePath);
         } catch (err) {
-          try { unlinkSync(tmp); } catch {}
+          try { await unlinkAsync(tmp); } catch {}
           if (err?.code === 'EEXIST') return false;
           throw err;
         }
-        try { unlinkSync(tmp); } catch {}
+        try { await unlinkAsync(tmp); } catch {}
       } else {
-        renameWithRetrySync(tmp, filePath, opts);
+        await renameWithRetry(tmp, filePath, opts);
       }
       if (opts.secret === true) await _enforceOwnerOnlyAclWin32Async(filePath);
       if (opts.fsyncDir === true) {
         let dfd = null;
         try {
-          dfd = openSync(dir, 'r');
-          fsyncSync(dfd);
+          dfd = await openAsync(dir, 'r');
+          await dfd.sync();
         } catch (err) {
           if (!['EPERM', 'ENOTSUP', 'EINVAL', 'EACCES'].includes(err?.code)) throw err;
         } finally {
-          try { if (dfd !== null) closeSync(dfd); } catch {}
+          try { if (dfd !== null) await dfd.close(); } catch {}
         }
       }
       return true;
     } catch (err) {
-      try { if (existsSync(tmp)) unlinkSync(tmp); } catch {}
+      try { await unlinkAsync(tmp); } catch {}
       throw err;
     }
   };
@@ -656,20 +682,21 @@ export function writeJsonAtomicAsync(filePath, value, opts = {}) {
 
 // Async read-modify-write. Same lock path (`${filePath}.lock`) and protocol
 // as updateJsonAtomicSync, so it is mutually exclusive with the sync variant.
-// The critical section itself is synchronous (readFileSync + writeJsonAtomicSync);
-// only the lock WAIT is async, so the event loop is never blocked on contention.
+// The lock wait and filesystem critical section are both asynchronous. JSON
+// parse/mutation/stringify remain synchronous CPU work, but no disk operation
+// or rename retry sleeps on the host event loop.
 export async function updateJsonAtomic(filePath, mutator, opts = {}) {
   const { lock: _lock, ...writeOpts } = opts;
-  return withFileLock(`${filePath}.lock`, () => {
+  return withFileLock(`${filePath}.lock`, async () => {
     let cur = null;
     try {
-      cur = JSON.parse(readFileSync(filePath, 'utf8'));
+      cur = JSON.parse(await readFileAsync(filePath, 'utf8'));
     } catch {
       cur = null;
     }
     const next = mutator(cur);
     if (next === undefined) return cur;
-    writeJsonAtomicSync(filePath, next, { ...writeOpts, lock: false });
+    await writeJsonAtomicAsync(filePath, next, { ...writeOpts, lock: false });
     return next;
   }, opts);
 }

package/src/runtime/shared/err-text.mjs

@@ -146,6 +146,7 @@ export function presentErrorText(error, options = {}) {
     return 'Context too large.';
   }
   if (/\bcompact(?:ion)?\b.*\b(?:failed|error|overflow)\b|\b(?:failed|error)\b.*\bcompact(?:ion)?\b/i.test(text)) {
+    if (String(surface).toLowerCase().includes('compact')) return capText(text, max);
     return 'Compact failed.';
   }
 

package/src/runtime/shared/safe-ipc-send.mjs

@@ -0,0 +1,34 @@
+function ipcUnavailableError() {
+  return Object.assign(new Error('IPC channel unavailable'), {
+    code: 'ERR_IPC_CHANNEL_CLOSED',
+  });
+}
+
+export function safeIpcSend(proc, message, { onError, onComplete } = {}) {
+  const report = (error) => {
+    if (!error) return;
+    try { onError?.(error); } catch {}
+  };
+  const complete = (error = null) => {
+    try { onComplete?.(error); } catch {}
+  };
+
+  if (!proc || typeof proc.send !== 'function' || proc.connected !== true) {
+    const error = ipcUnavailableError();
+    report(error);
+    complete(error);
+    return false;
+  }
+
+  try {
+    proc.send(message, undefined, {}, (error) => {
+      report(error);
+      complete(error || null);
+    });
+    return true;
+  } catch (error) {
+    report(error);
+    complete(error);
+    return false;
+  }
+}

package/src/session-runtime/lifecycle-api.mjs

@@ -158,6 +158,12 @@ export function createLifecycleApi(deps) {
   return {
     async close(reason = 'cli-exit', options = {}) {
       const detach = options?.detach === true || options?.wait === false || options?.waitForExit === false;
+      // Desktop multi-engine hosts dispose idle engines while other sessions
+      // keep working in the SAME process. The background-work registries
+      // (shared background tasks, shell jobs, bash sessions) are
+      // process-global, so a non-exit dispose must leave them running instead
+      // of reaping every session's jobs. CLI exit paths never set this.
+      const keepBackgroundWork = options?.keepBackgroundWork === true;
       setCloseRequested(true);
       // Self-update now stages in the background and swaps on the next clean
       // launch (see staged-update.mjs) — nothing installs at shutdown. On a
@@ -218,7 +224,7 @@ export function createLifecycleApi(deps) {
           warmupTimers[timerKey] = null;
         }
       }
-      try { cancelBackgroundTasks({ reason, notify: false }); } catch {}
+      try { if (!keepBackgroundWork) cancelBackgroundTasks({ reason, notify: false }); } catch {}
       const channelStop = channels.stop(reason, detach ? { waitForExit: false } : undefined);
       try { agentTool.closeAll(reason); } catch {}
       let mcpStop = null;
@@ -260,12 +266,12 @@ export function createLifecycleApi(deps) {
       invalidateContextStatusCache();
       notificationListeners?.clear?.();
       remoteStateListeners?.clear?.();
-      const shellJobsStop = globalThis.__mixdogShellJobsRuntimeLoaded === true
+      const shellJobsStop = !keepBackgroundWork && globalThis.__mixdogShellJobsRuntimeLoaded === true
         ? import('../runtime/agent/orchestrator/tools/builtin/shell-jobs.mjs')
           .then((mod) => mod?.shutdownShellJobs?.(reason, { sync: !detach }))
           .catch(() => {})
         : null;
-      const bashSessionsStop = globalThis.__mixdogBashSessionRuntimeLoaded === true
+      const bashSessionsStop = !keepBackgroundWork && globalThis.__mixdogBashSessionRuntimeLoaded === true
         ? import('../runtime/agent/orchestrator/tools/bash-session.mjs')
           .then((mod) => mod?.shutdownBashSessions?.(reason))
           .catch(() => {})

package/src/session-runtime/runtime-core.mjs

@@ -845,7 +845,11 @@ export async function createMixdogSessionRuntime({
       if (name === 'recall' || name === 'memory' || name === 'search_memories') {
         const memoryMod = await getMemoryModule();
         if (!memoryMod?.handleToolCall) throw new Error('memory runtime is not available');
-        return await memoryMod.handleToolCall(name, memoryToolArgsForCaller(args, callerCwd));
+        return await memoryMod.handleToolCall(
+          name,
+          memoryToolArgsForCaller(args, callerCwd),
+          callerCtx?.signal || session?.controller?.signal || null,
+        );
       }
       if (name === 'code_graph') {
         const codeGraphMod = await getCodeGraphModule();

package/src/standalone/channel-daemon.mjs

@@ -23,6 +23,7 @@ import { performance } from 'node:perf_hooks';
 import { claimSingletonOwner, releaseSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
 import { setChannelNotifySink } from '../runtime/channels/lib/parent-bridge.mjs';
 import { setOwnerContext } from '../runtime/channels/lib/runtime-paths.mjs';
+import { safeIpcSend } from '../runtime/shared/safe-ipc-send.mjs';
 import { createChannelDaemonTransport } from './channel-daemon-transport.mjs';
 import { createStandaloneMemoryRuntime } from './memory-runtime-proxy.mjs';
 
@@ -183,7 +184,7 @@ async function main() {
   // forever. process.connected gates the obvious-dead case; the send callback
   // swallows the async delivery error so it never reaches uncaughtException.
   if (process.connected && process.send) {
-    try { process.send({ type: 'ready', port, token }, undefined, () => {}); } catch {}
+    safeIpcSend(process, { type: 'ready', port, token });
   }
   log(`ready port=${port} pid=${process.pid} in ${(performance.now() - startedAt).toFixed(0)}ms`);
 

package/src/standalone/channel-worker.mjs

@@ -10,6 +10,7 @@ import { scrubLoaderVars } from '../runtime/agent/orchestrator/tools/env-scrub.m
 import { rotateBoundedLog, PLUGIN_LOG_MAX_BYTES, PLUGIN_LOG_KEEP_BYTES } from '../lib/mixdog-debug.cjs';
 import { attachToDaemon, readDaemonDiscovery, probeDaemonHealth } from './channel-daemon-client.mjs';
 import { claimSingletonOwner, releaseSingletonOwner } from '../runtime/shared/singleton-owner.mjs';
+import { safeIpcSend } from '../runtime/shared/safe-ipc-send.mjs';
 import { randomUUID } from 'node:crypto';
 
 const CHANNEL_TOOLS = new Set([
@@ -244,7 +245,9 @@ export function createStandaloneChannelWorker({
     // stuck send can't wedge the queue forever.
     inFlightWatchdog = setTimeout(() => finish(new Error('channels worker send timed out')), SEND_FLUSH_TIMEOUT_MS);
     inFlightWatchdog.unref?.();
-    child.send(item.msg, (error) => finish(error));
+    safeIpcSend(child, item.msg, {
+      onComplete: (error) => finish(error),
+    });
   }
 
   function sendToChild(msg, cb) {
@@ -804,19 +807,20 @@ export function createStandaloneChannelWorker({
         const sendTimer = setTimeout(() => settle(true), 250);
         sendTimer.unref?.();
         target.once('exit', () => settle(true));
-        try {
-          target.send?.({ type: 'shutdown', reason }, () => {
+        safeIpcSend(target, { type: 'shutdown', reason }, {
+          onComplete: (error) => {
             try { target.disconnect?.(); } catch {}
-            settle(true);
-          });
-        } catch {
-          try { target.disconnect?.(); } catch {}
-          // IPC unavailable: skip the grace window and escalate now.
-          try {
-            if (target.exitCode == null && !target.killed) target.kill('SIGTERM');
-          } catch {}
-          settle(false);
-        }
+            if (!error) {
+              settle(true);
+              return;
+            }
+            // IPC unavailable: skip the grace window and escalate now.
+            try {
+              if (target.exitCode == null && !target.killed) target.kill('SIGTERM');
+            } catch {}
+            settle(false);
+          },
+        });
       });
       return stopPromise;
     }
@@ -847,13 +851,11 @@ export function createStandaloneChannelWorker({
       }, 5000);
       target.once('exit', () => finish(true));
       target.once('error', () => finish(false));
-      try {
-        target.send?.({ type: 'shutdown', reason }, () => {
+      safeIpcSend(target, { type: 'shutdown', reason }, {
+        onComplete: () => {
           try { target.disconnect?.(); } catch {}
-        });
-      } catch {
-        try { target.disconnect?.(); } catch {}
-      }
+        },
+      });
     });
     return stopPromise;
   }