mixdog 0.9.84 → 0.9.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.84",
+  "version": "0.9.85",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/channel-daemon-stub.mjs

@@ -10,6 +10,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { claimSingletonOwner, releaseSingletonOwner } from '../src/runtime/shared/singleton-owner.mjs';
+import { safeIpcSend } from '../src/runtime/shared/safe-ipc-send.mjs';
 import { createChannelDaemonTransport } from '../src/standalone/channel-daemon-transport.mjs';
 
 function runtimeRoot() {
@@ -69,7 +70,7 @@ async function main() {
     onClientsEmpty: () => { void shutdown('no live clients'); },
   });
   const { port, token } = await transport.start();
-  if (process.send) { try { process.send({ type: 'ready', port, token }); } catch {} }
+  safeIpcSend(process, { type: 'ready', port, token });
   log(`ready port=${port} pid=${process.pid}`);
 }
 

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -230,19 +230,46 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         }
         let totalCount = 0;
         let totalTextLen = 0;
+        let maxQueueWaitMs = 0;
         for (const merged of mergedMessages) {
+            const submissionIds = Array.isArray(merged.ids) ? merged.ids : [];
+            const submittedAt = Number(merged.submittedAt);
+            const injectedAt = Date.now();
+            if (Number.isFinite(submittedAt) && submittedAt > 0) {
+                maxQueueWaitMs = Math.max(maxQueueWaitMs, injectedAt - submittedAt);
+            }
             // Tag steering-origin user messages so provider lowering keeps them
             // distinct from preceding tool results. Keep each queued command as
             // its own user turn, matching Claude Code queued_command attachment
             // semantics instead of collapsing priority/mode buckets together.
-            messages.push({ role: 'user', content: merged.content, meta: { source: 'steering' } });
+            messages.push({
+                role: 'user',
+                content: merged.content,
+                meta: {
+                    source: 'steering',
+                    ...(submissionIds.length ? { submissionIds } : {}),
+                },
+            });
             const text = merged.text || steeringContentText(merged.content);
             totalCount += Number(merged.count) || 1;
             totalTextLen += String(text || '').length;
-            try { opts.onSteerMessage?.(text); } catch {}
+            try {
+                opts.onSteerMessage?.(text, {
+                    ids: submissionIds,
+                    submittedAt: Number.isFinite(submittedAt) && submittedAt > 0 ? submittedAt : undefined,
+                    injectedAt,
+                    stage,
+                    ...(Array.isArray(merged.images) && merged.images.length ? { images: merged.images } : {}),
+                });
+            } catch {}
         }
         if (sessionId) {
-            try { process.stderr.write(`[steer] sess=${sessionId} injected ${stage} user message(s) (merged=${totalCount} len=${totalTextLen})\n`); } catch {}
+            try {
+                process.stderr.write(
+                    `[steer] sess=${sessionId} injected ${stage} user message(s)`
+                    + ` (merged=${totalCount} len=${totalTextLen} waitMs=${Math.max(0, maxQueueWaitMs)})\n`,
+                );
+            } catch {}
         }
         return true;
     };

package/src/runtime/agent/orchestrator/session/loop/steering.mjs

@@ -14,21 +14,48 @@ export function steeringContentText(content) {
     return String(content ?? '');
 }
 
+function steeringEntryMetadata(entry) {
+    if (!entry || typeof entry !== 'object') return {};
+    const sourceIds = Array.isArray(entry.ids)
+        ? entry.ids
+        : (entry.id !== undefined && entry.id !== null ? [entry.id] : []);
+    const ids = [...new Set(sourceIds.filter((id) => id !== undefined && id !== null))];
+    const submittedAt = Number(entry.submittedAt);
+    return {
+        ...(ids.length ? { ids } : {}),
+        ...(Number.isFinite(submittedAt) && submittedAt > 0 ? { submittedAt } : {}),
+        ...(Array.isArray(entry.images) && entry.images.length ? { images: entry.images } : {}),
+    };
+}
+
 function normalizeSteeringEntry(entry) {
     if (typeof entry === 'string') {
         const text = entry.trim();
         return text ? { content: text, text } : null;
     }
     if (!entry || typeof entry !== 'object') return null;
+    const metadata = steeringEntryMetadata(entry);
     const content = Object.prototype.hasOwnProperty.call(entry, 'content') ? entry.content : entry;
     const text = typeof entry.text === 'string' ? entry.text.trim() : steeringContentText(content).trim();
-    if (Array.isArray(content)) return content.length > 0 ? { content, text } : null;
+    if (Array.isArray(content)) return content.length > 0 ? { content, text, ...metadata } : null;
     if (typeof content === 'string') {
         const value = content.trim();
-        return value ? { content: value, text: text || value } : null;
+        return value ? { content: value, text: text || value, ...metadata } : null;
     }
     const fallback = steeringContentText(content).trim();
-    return fallback ? { content: fallback, text: text || fallback } : null;
+    return fallback ? { content: fallback, text: text || fallback, ...metadata } : null;
+}
+
+function mergeSteeringMetadata(entries) {
+    const ids = [...new Set(entries.flatMap((entry) => Array.isArray(entry.ids) ? entry.ids : []))];
+    const submittedTimes = entries.map((entry) => Number(entry.submittedAt))
+        .filter((value) => Number.isFinite(value) && value > 0);
+    const images = entries.flatMap((entry) => Array.isArray(entry.images) ? entry.images : []);
+    return {
+        ...(ids.length ? { ids } : {}),
+        ...(submittedTimes.length ? { submittedAt: Math.min(...submittedTimes) } : {}),
+        ...(images.length ? { images } : {}),
+    };
 }
 
 export function mergeSteeringEntries(entries) {
@@ -36,6 +63,7 @@ export function mergeSteeringEntries(entries) {
         .map(normalizeSteeringEntry)
         .filter(Boolean);
     if (normalized.length === 0) return null;
+    const metadata = mergeSteeringMetadata(normalized);
     const displayText = normalized.map((entry) => entry.text || steeringContentText(entry.content))
         .filter((text) => String(text || '').trim())
         .join('\n');
@@ -44,6 +72,7 @@ export function mergeSteeringEntries(entries) {
             content: normalized.map((entry) => entry.content).filter(Boolean).join('\n'),
             text: displayText,
             count: normalized.length,
+            ...metadata,
         };
     }
     const parts = [];
@@ -59,5 +88,10 @@ export function mergeSteeringEntries(entries) {
         parts.push({ type: 'text', text: '\n' });
     }
     while (parts.length && parts[parts.length - 1]?.type === 'text' && parts[parts.length - 1]?.text === '\n') parts.pop();
-    return { content: parts, text: displayText || steeringContentText(parts), count: normalized.length };
+    return {
+        content: parts,
+        text: displayText || steeringContentText(parts),
+        count: normalized.length,
+        ...metadata,
+    };
 }

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -307,6 +307,40 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         let _turnOutgoing = null;
         const _turnInterruption = createTurnInterruptionTracker();
         const _sessionStartMetaInjectedBeforeTurn = preSession.sessionStartMetaInjected === true;
+        let _interruptionSnapshot = null;
+        const _prepareCloseSnapshot = (abortReason) => {
+            if (_interruptionSnapshot) return _interruptionSnapshot;
+            if (!activeSession) return null;
+            activeSession.liveTurnMessages = null;
+            _turnInterruption.restoreTombstonedText();
+            const finalized = _turnInterruption.finalize({
+                turnOutgoing: _turnOutgoing || activeSession.messages,
+                currentUserContent: cancelledUserTurnContent,
+                abortReason,
+            });
+            activeSession.messages = finalized.messages;
+            if (!finalized.responsePreserved) {
+                if (finalized.userTurnPreserved) {
+                    // A non-user detach keeps the provisional prompt but makes
+                    // the opaque provider continuation unsafe to reuse.
+                    activeSession.providerState = undefined;
+                } else {
+                    activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
+                }
+            } else {
+                activeSession.providerState = undefined;
+            }
+            activeSession.updatedAt = Date.now();
+            activeSession.lastUsedAt = Date.now();
+            runtime.session = activeSession;
+            _interruptionSnapshot = finalized;
+            return finalized;
+        };
+        // closeSession is synchronous and generation-first by design. Expose a
+        // turn-local hook so it can canonicalize the in-flight transcript
+        // before bumpSessionGeneration()/markSessionClosed() writes the disk
+        // snapshot and invalidates the ordinary cancellation cleanup save.
+        runtime.prepareCloseSnapshot = _prepareCloseSnapshot;
         try {
             const session = activeSession;
             const provider = getProvider(session.provider);
@@ -672,6 +706,12 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     process.stderr.write(`[session] empty-final persisted sessionId=${sessionId} stopReason=${_emptyStop ?? 'unknown'} iterations=${result?.iterations ?? 0} toolCallsTotal=${result?.toolCallsTotal ?? 0} outTokens=${_emptyUsage?.outputTokens ?? 0} hasThinking=${_thinkingStr} blockTypes=${_blockTypesStr}\n`);
                 } catch {}
             }
+            // The terminal assistant message is now canonical. A close racing
+            // any later await should persist this committed session as-is,
+            // never re-finalize the pre-terminal outgoing array.
+            if (runtime.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                runtime.prepareCloseSnapshot = null;
+            }
             session.updatedAt = Date.now();
             session.lastUsedAt = Date.now();
             applyAskTerminalUsageTotals(session, result, {
@@ -840,34 +880,15 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 const currentRuntime = _getRuntimeEntry(sessionId);
                 if (!currentRuntime?.closed) {
                     if (activeSession) {
-                        const finalized = _turnInterruption.finalize({
-                            turnOutgoing: _turnOutgoing || activeSession.messages,
-                            currentUserContent: cancelledUserTurnContent,
-                            abortReason: err.reason,
-                        });
-                        activeSession.messages = finalized.messages;
+                        const finalized = _prepareCloseSnapshot(err.reason);
+                        if (currentRuntime?.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                            currentRuntime.prepareCloseSnapshot = null;
+                        }
                         if (!finalized.responsePreserved) {
                             releasePendingMessages(sessionId, _turnPendingEntries);
-                            if (finalized.userTurnPreserved) {
-                                // Non-user abort (app quit / engine dispose /
-                                // watchdog): the just-sent user turn stays in
-                                // history, so the session-start meta it carries
-                                // remains consumed, and the opaque provider
-                                // continuation no longer matches — force full
-                                // transcript replay on the next send.
-                                activeSession.providerState = undefined;
-                            } else {
-                                activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
-                            }
                         } else {
                             recordPendingMessageDelivery(activeSession, _turnPendingEntries);
-                            // The opaque provider continuation now points at a
-                            // request that ended mid-turn. Force full transcript
-                            // replay on the next send instead of reusing it.
-                            activeSession.providerState = undefined;
                         }
-                        activeSession.updatedAt = Date.now();
-                        activeSession.lastUsedAt = Date.now();
                         try {
                             const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
                             if (finalized.responsePreserved) {
@@ -887,6 +908,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 // can render it as "cancelled" rather than a red failure.
                 throw err;
             }
+            if (runtime.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                runtime.prepareCloseSnapshot = null;
+            }
             // A reset acknowledgement removes the live partial before the
             // non-streaming request starts. If that restart fails, restore the
             // tombstone and persist the one exposed partial as interruption
@@ -895,17 +919,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 || err?.liveTextEmitted === true
                 || err?.unsafeToRetry === true;
             if (preserveProviderPartial && activeSession && _turnInterruption.hasResponseStarted()) {
-                const finalized = _turnInterruption.finalize({
-                    turnOutgoing: _turnOutgoing || activeSession.messages,
-                    currentUserContent: cancelledUserTurnContent,
-                    abortReason: 'provider-error',
-                });
-                activeSession.messages = finalized.messages;
+                const finalized = _prepareCloseSnapshot('provider-error');
                 if (finalized.responsePreserved) recordPendingMessageDelivery(activeSession, _turnPendingEntries);
                 else releasePendingMessages(sessionId, _turnPendingEntries);
-                activeSession.providerState = undefined;
-                activeSession.updatedAt = Date.now();
-                activeSession.lastUsedAt = Date.now();
                 try {
                     const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
                     if (finalized.responsePreserved) {

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -37,10 +37,17 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     // resuming. Only truly-empty scratch sessions should still tombstone.
     const tombstone = opts.tombstone !== false;
     if (!id) return false;
+    const entry = _getRuntimeEntry(id);
+    // askSession owns the interruption tracker that can merge committed
+    // iterations, the current partial response, and observed tool results into
+    // one canonical transcript. Finalize that in-memory snapshot synchronously
+    // BEFORE the lifecycle generation changes; once generation is bumped, the
+    // normal cancellation cleanup save is intentionally rejected as stale.
+    try { entry?.prepareCloseSnapshot?.(reason); } catch { /* best-effort */ }
     _stopToolActivityHeartbeat(id);
     // Prefer in-memory runtime session — allBashSessionIds may not be persisted
     // yet for shells opened in the current turn (BL-bash-disk-sync).
-    const inMemory = _getRuntimeEntry(id)?.session;
+    const inMemory = entry?.session;
     const persisted = inMemory || loadSession(id);
     const bashSessionId = persisted?.implicitBashSessionId || null;
     // Collect all persistent bash shells created during this session.
@@ -63,7 +70,6 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     //    it back (BL: burned-session late-save clobber).
     const newGen = tombstone ? markSessionClosed(id, reason) : bumpSessionGeneration(id, reason);
     // 2. Mark runtime as closed so post-await validation in askSession fires.
-    const entry = _getRuntimeEntry(id);
     if (entry) {
         entry.closed = true;
         entry.closedReason = reason;

package/src/runtime/agent/orchestrator/tools/builtin/shell-runtime.mjs

@@ -1,15 +1,14 @@
-import { spawnSync } from 'child_process';
 import { existsSync } from 'fs';
-import { basename, dirname, join } from 'path';
+import { basename, delimiter, dirname, join } from 'path';
 
 let _resolvedShell = null;
 let _configuredShell = null;
 // Per-kind cache for resolveShellFor(). 'default' aliases resolveShell()'s
-// singleton; 'bash'/'powershell' get their own memoized slots. ONLY a
-// successful (non-null) resolution is cached — a resolution MISS is
-// deliberately not memoized so the next call re-probes (Git Bash / pwsh may
-// be installed mid-session, and PATH can change for a long-lived host).
+// singleton; 'bash'/'powershell' get their own memoized slots. Misses receive
+// a short TTL so a missing optional shell cannot rescan PATH for every tool
+// call while a long-lived host can still discover a later installation.
 const _resolvedShellByKind = new Map();
+const SHELL_RESOLUTION_MISS_TTL_MS = 30_000;
 
 export function setConfiguredShell(value = '') {
     const next = String(value || '').trim();
@@ -43,30 +42,39 @@ function shellSpec(shell, shellType = shellTypeFor(shell)) {
     return { shell, shellArg: '-c', shellArgs: ['-c'], shellType };
 }
 
-function firstExistingPathFromWhere(commandName) {
-    try {
-        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-            timeout: 1000,
-        });
-        if (r.status !== 0 || !r.stdout) return null;
-        const lines = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).filter(Boolean);
-        return lines.find(p => existsSync(p)) || null;
-    } catch {
-        return null;
+function allExistingPathsFromPath(commandName) {
+    const rawPath = String(process.env.PATH || '');
+    let cwd = '';
+    try { cwd = process.cwd(); } catch {}
+    const entries = [cwd, ...rawPath.split(delimiter)]
+        .map((entry) => entry.trim().replace(/^"(.*)"$/, '$1'))
+        .filter(Boolean);
+    const seen = new Set();
+    const matches = [];
+    for (const entry of entries) {
+        const candidate = join(entry, commandName);
+        const key = process.platform === 'win32' ? candidate.toLowerCase() : candidate;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        if (existsSync(candidate)) matches.push(candidate);
     }
+    return matches;
+}
+
+function firstExistingPathFromPath(commandName, excludeRe = null) {
+    return allExistingPathsFromPath(commandName)
+        .find((candidate) => !excludeRe || !excludeRe.test(candidate)) || null;
 }
 
 function resolveWindowsPowerShell() {
-    const pwsh = firstExistingPathFromWhere('pwsh.exe');
+    const pwsh = firstExistingPathFromPath('pwsh.exe');
     if (pwsh) return shellSpec(pwsh, 'powershell');
 
     const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
     const bundled = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
     if (existsSync(bundled)) return shellSpec(bundled, 'powershell');
 
-    const powershell = firstExistingPathFromWhere('powershell.exe');
+    const powershell = firstExistingPathFromPath('powershell.exe');
     if (powershell) return shellSpec(powershell, 'powershell');
 
     return shellSpec('powershell.exe', 'powershell');
@@ -109,12 +117,12 @@ function _isWindows() {
 //     not Git-for-Windows bash).
 // Returns a posix shellSpec, or null when Git Bash is genuinely not installed.
 function resolveWindowsGitBash() {
-    for (const git of allExistingPathsFromWhere('git.exe')) {
+    for (const git of allExistingPathsFromPath('git.exe')) {
         const bash = probeGitBashFromGitExe(git);
         if (bash) return shellSpec(bash, 'posix');
     }
     // Fallback: a bare `bash.exe` on PATH, but never the System32 WSL launcher.
-    const bash = firstExistingPathFromWhereExcluding('bash.exe', /\\system32\\/i);
+    const bash = firstExistingPathFromPath('bash.exe', /\\system32\\/i);
     if (bash) return shellSpec(bash, 'posix');
     // Final fallback: probe well-known Git-for-Windows install roots on the
     // filesystem directly. PATH-independent and spawn-free, so it still resolves
@@ -164,36 +172,6 @@ function probeGitBashFromGitExe(gitExe) {
     return null;
 }
 
-function allExistingPathsFromWhere(commandName) {
-    try {
-        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-            timeout: 1000,
-        });
-        if (r.status !== 0 || !r.stdout) return [];
-        return r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim())
-            .filter(Boolean).filter(p => existsSync(p));
-    } catch {
-        return [];
-    }
-}
-
-function firstExistingPathFromWhereExcluding(commandName, excludeRe) {
-    try {
-        const r = spawnSync('cmd.exe', ['/d', '/s', '/c', `where ${commandName}`], {
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-            timeout: 1000,
-        });
-        if (r.status !== 0 || !r.stdout) return null;
-        const lines = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).filter(Boolean);
-        return lines.find(p => existsSync(p) && !excludeRe.test(p)) || null;
-    } catch {
-        return null;
-    }
-}
-
 // Kind-aware shell resolution. kind:
 //
 // Resolve a real bash on macOS/Linux. When 'bash' is explicitly requested we
@@ -204,13 +182,8 @@ function resolvePosixBash() {
     for (const p of ['/bin/bash', '/usr/bin/bash', '/usr/local/bin/bash', '/opt/homebrew/bin/bash']) {
         if (existsSync(p)) return shellSpec(p, 'posix');
     }
-    try {
-        const r = spawnSync('which', ['bash'], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 1000 });
-        if (r.status === 0 && r.stdout) {
-            const p = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).find(Boolean);
-            if (p && existsSync(p)) return shellSpec(p, 'posix');
-        }
-    } catch { /* fall through to /bin/sh */ }
+    const fromPath = firstExistingPathFromPath('bash');
+    if (fromPath) return shellSpec(fromPath, 'posix');
     return shellSpec('/bin/sh', 'posix');
 }
 
@@ -220,12 +193,15 @@ function resolvePosixBash() {
 //                 binary (/bin/bash, /usr/bin/bash, or `bash` on PATH), falling back to
 //                 /bin/sh only when no bash exists (dash/ash distros break on bash syntax).
 //  'powershell' → on Windows, resolveShell(); elsewhere pwsh if present, else null.
-// Each kind is memoized independently, but ONLY on success: a resolution miss
-// (null) is not cached, so the caller's clear-error path is re-probed on the
-// next call rather than pinned for the life of the process.
+// Each kind is memoized independently. Successes remain stable for the process;
+// misses expire quickly so installs/PATH changes remain discoverable.
 export function resolveShellFor(kind = 'default') {
     if (kind == null || kind === 'default') return resolveShell();
-    if (_resolvedShellByKind.has(kind)) return _resolvedShellByKind.get(kind);
+    const cached = _resolvedShellByKind.get(kind);
+    if (cached) {
+        if (cached.spec || cached.expiresAt > Date.now()) return cached.spec;
+        _resolvedShellByKind.delete(kind);
+    }
 
     let spec = null;
     if (kind === 'bash') {
@@ -234,21 +210,16 @@ export function resolveShellFor(kind = 'default') {
         if (_isWindows()) {
             spec = resolveShell();
         } else {
-            const pwsh = (() => {
-                try {
-                    const r = spawnSync('which', ['pwsh'], { stdio: ['ignore', 'pipe', 'ignore'], timeout: 1000 });
-                    if (r.status !== 0 || !r.stdout) return null;
-                    const p = r.stdout.toString('utf8').split(/\r?\n/).map(s => s.trim()).find(Boolean);
-                    return p && existsSync(p) ? p : null;
-                } catch { return null; }
-            })();
+            const pwsh = firstExistingPathFromPath('pwsh');
             spec = pwsh ? shellSpec(pwsh, 'powershell') : null;
         }
     } else {
         spec = resolveShell();
     }
 
-    // Cache positively only — see the _resolvedShellByKind / doc comments above.
-    if (spec) _resolvedShellByKind.set(kind, spec);
+    _resolvedShellByKind.set(kind, {
+        spec,
+        expiresAt: spec ? Number.POSITIVE_INFINITY : Date.now() + SHELL_RESOLUTION_MISS_TTL_MS,
+    });
     return spec;
 }

package/src/runtime/channels/lib/owned-runtime.mjs

@@ -3,6 +3,7 @@ import { loadConfig, createBackend } from "./config.mjs";
 import { WebhookServer } from "./webhook.mjs";
 import { EventPipeline } from "./event-pipeline.mjs";
 import { startSnapshotWriter, stopSnapshotWriter } from "./status-snapshot.mjs";
+import { safeIpcSend } from "../../shared/safe-ipc-send.mjs";
 import { initProviders } from "../../agent/orchestrator/providers/registry.mjs";
 import { loadConfig as loadAgentConfig } from "../../agent/orchestrator/config.mjs";
 import {
@@ -423,14 +424,11 @@ function armBridgeOwnershipTimer() {}
 // error-callback path of ERR_IPC_CHANNEL_CLOSED (channel closing between the
 // connected check and delivery). Log-and-continue — never crash the worker.
 function sendToParent(message) {
-  if (!process.send || process.connected === false) return;
-  try {
-    process.send(message, undefined, undefined, err => {
-      if (err) process.stderr.write(`[channels] parent IPC send failed: ${err?.message || err}\n`);
-    });
-  } catch (err) {
-    process.stderr.write(`[channels] parent IPC send threw: ${err?.message || err}\n`);
-  }
+  safeIpcSend(process, message, {
+    onError: (err) => {
+      try { process.stderr.write(`[channels] parent IPC send failed: ${err?.message || err}\n`); } catch {}
+    },
+  });
 }
 // Tell the parent session this worker ACQUIRED the bridge so it flips remote
 // mode ON (badge/transcript writer). Callers fire this only on a genuine

package/src/runtime/channels/lib/parent-bridge.mjs

@@ -2,6 +2,8 @@
 // (behavior-preserving). Groups the notify-to-parent path and the
 // worker → parent → memory call bridge. Bound to live getters
 // (getInstanceId) so runtime identity stays consistent.
+import { safeIpcSend } from '../../shared/safe-ipc-send.mjs';
+
 function normalizeChannelNotifyParams(method, params) {
   if (method === 'notifications/claude/channel' && params && params.meta) {
     const m = {};
@@ -24,7 +26,7 @@ function setChannelNotifySink(fn) {
   _notifySink = typeof fn === 'function' ? fn : null;
 }
 
-function createParentBridge({ getInstanceId }) {
+function createParentBridge({ getInstanceId, ipcProcess = process }) {
   function sendNotifyToParent(method, params) {
     // CC channel schema requires meta: Record<string,string> (channelNotification.ts).
     // Coerce every meta value to string so a non-string (e.g. a Discord
@@ -37,15 +39,15 @@ function createParentBridge({ getInstanceId }) {
       catch (err) { try { process.stderr.write(`mixdog channels: notify sink failed: ${err && err.message || err}\n`); } catch {} }
       return;
     }
-    if (!process.send) {
+    if (!ipcProcess?.send || ipcProcess.connected !== true) {
       try { process.stderr.write(`mixdog channels: notify dropped (no IPC channel): ${method}\n`); } catch {}
       return;
     }
-    try {
-      process.send({ type: 'notify', method, params: outParams });
-    } catch (err) {
-      try { process.stderr.write(`mixdog channels: notify IPC send failed: ${err && err.message || err}\n`); } catch {}
-    }
+    safeIpcSend(ipcProcess, { type: 'notify', method, params: outParams }, {
+      onError: (err) => {
+        try { process.stderr.write(`mixdog channels: notify IPC send failed: ${err && err.message || err}\n`); } catch {}
+      },
+    });
   }
 
   // ── Memory worker bridge (worker → parent → memory) ─────────────────
@@ -56,10 +58,24 @@ function createParentBridge({ getInstanceId }) {
   // integrated into the main IPC handler below (not a second listener).
   const _memoryCallPending = new Map();
   let _memoryCallSeq = 0;
+  const failMemoryCall = (callId, error) => {
+    const pending = _memoryCallPending.get(callId);
+    if (!pending) return;
+    _memoryCallPending.delete(callId);
+    pending.reject(error instanceof Error ? error : new Error(String(error || 'memory_call IPC failed')));
+  };
+  const rejectAllMemoryCalls = (error) => {
+    for (const callId of Array.from(_memoryCallPending.keys())) failMemoryCall(callId, error);
+  };
+  ipcProcess?.once?.('disconnect', () => {
+    rejectAllMemoryCalls(new Error('memory_call parent IPC disconnected'));
+  });
 
   function callMemoryAction(action, args, timeoutMs) {
     return new Promise((resolve, reject) => {
-      if (!process.send) return reject(new Error('not a worker process'));
+      if (!ipcProcess?.send || ipcProcess.connected !== true) {
+        return reject(new Error('not a connected worker process'));
+      }
       const callId = `mc_${getInstanceId()}_${++_memoryCallSeq}_${Math.random().toString(36).slice(2, 8)}`;
       const timer = setTimeout(() => {
         _memoryCallPending.delete(callId);
@@ -69,13 +85,9 @@ function createParentBridge({ getInstanceId }) {
         resolve: (v) => { clearTimeout(timer); resolve(v); },
         reject: (e) => { clearTimeout(timer); reject(e); },
       });
-      try {
-        process.send({ type: 'memory_call_request', callId, action, args: args || {} });
-      } catch (e) {
-        _memoryCallPending.delete(callId);
-        clearTimeout(timer);
-        reject(e);
-      }
+      safeIpcSend(ipcProcess, { type: 'memory_call_request', callId, action, args: args || {} }, {
+        onError: (error) => failMemoryCall(callId, error),
+      });
     });
   }