mixdog 0.9.87 → 0.9.89

package/src/runtime/agent/orchestrator/agent-trace-format.mjs

@@ -262,6 +262,44 @@ export function parseGrepCoverage(resultText, toolName, toolArgs, resultKind) {
     return out.length ? out : null;
 }
 
+// Codex-style patch failures all arrive as "apply_patch … failed" prose, but
+// a malformed envelope, a rejected hunk, a preflight veto and a size/lock
+// guard need different operator responses. Returning null means "nothing
+// patch-specific here" and lets the generic rules (path/enoent, schema/args,
+// runtime/failure) finish the classification.
+// Emitted by the sequence/wave reporters whenever section writes reached disk
+// and were NOT rolled back cleanly (committed-by-design, partial mode, or a
+// rollback that itself failed). Any of these means the working tree state is
+// committed or uncertain, which outranks every other failure detail.
+const PATCH_COMMITTED_WRITES_RE = /already applied to disk \(writes committed\)|applied to disk \(committed\) and left in place|applied \(committed to disk\)|rollback was incomplete|--- rollback incomplete ---|patch partially (?:applied|created|updated|written)/;
+
+function classifyPatchFailure(text) {
+    // Writes already committed outranks every other patch detail: the tree is
+    // no longer in its pre-patch state and needs inspection before a retry.
+    if (PATCH_COMMITTED_WRITES_RE.test(text)) return 'patch/partial-apply';
+    // Resource guards (byte cap) are deliberate rejections, not tool defects.
+    if (/patch too large|byte cap/.test(text)) return 'patch/limit';
+    if (/parse failed|invalid patch|malformed patch|missing \*\*\* (?:begin|end) patch|patch body is empty|unsupported patch format/.test(text)
+        // `patch contained no file sections` / `contains an empty file path`:
+        // the envelope parsed but produced nothing applicable — a patch-text
+        // defect, not a context miss.
+        || /contained no file sections|contains an empty file path/.test(text)) return 'patch/parse';
+    if (/hunk rejected|context not found|context mismatch|anchor not found|expected first old(?:\/context| line)/.test(text)) {
+        // Stale context requires REAL evidence that the region exists but has
+        // moved/changed (nearest line, divergent line, rejected hunk). The
+        // `expected first old line: …` fragment is printed for every context
+        // miss, so on its own it means only "the context is not there".
+        return /nearest line|first divergent line|hunk rejected/.test(text)
+            ? 'patch/stale-context'
+            : 'patch/context';
+    }
+    // Missing/unreadable targets are path problems even when a preflight
+    // wrapper reports them; fall through to the generic path rules.
+    if (/enoent|no such file|target unreadable|source (?:missing or )?unreadable|destination unreadable|cannot find/.test(text)) return null;
+    if (/preflight rejected|does not support|cannot be combined|only one v4a rename|missing parsed entry|internal js dispatch|rollback snapshot target/.test(text)) return 'patch/verification';
+    return null;
+}
+
 function classifyToolFailure(resultText, toolName) {
     const raw = String(resultText ?? '');
     const text = raw.toLowerCase();
@@ -281,16 +319,31 @@ function classifyToolFailure(resultText, toolName) {
         if (/\[signal:\s*[^\]]+/i.test(leading)) return 'process/signal';
         return 'command-exit';
     }
-    if (/\[tool-input-validation\]|compacted-history placeholder/.test(text)) return 'schema/args';
-    if (/hunk rejected|patch failed|context mismatch|context not found/.test(text)
-        || /expected first old(?:\/context| line)/.test(text)) return 'patch/context';
+    if (/compacted-history placeholder/.test(text)) return 'expected-preflight';
+    if (/\[tool-input-validation\]/.test(text)) return 'schema/args';
+    // `shell` results quote git/patch output verbatim (e.g. `git apply`
+    // rejects); only real patch surfaces may claim the patch taxonomy, so an
+    // ordinary command exit is never rewritten into a patch failure.
+    const patchSurface = String(toolName || '') === 'apply_patch'
+        || (String(toolName || '') !== 'shell'
+            && /apply_patch|native patch|v4a|\*\*\* begin patch|hunk rejected|context not found/.test(text));
+    // Committed/uncertain on-disk state outranks the lock or permission detail
+    // that triggered it: the operator must inspect the tree before retrying,
+    // and a "denied"/"lock held" word further down must not hide that.
+    if (patchSurface && PATCH_COMMITTED_WRITES_RE.test(text)) return 'patch/partial-apply';
+    // Write-lock contention is a resource guard, not a timeout or a patch bug.
+    if (/advisory lock (?:timeout|busy)|lock held by pid|\.mixdog-lock/.test(text)) return 'resource/lock';
+    if (/eacces|eperm|permission|denied|forbidden|operation not permitted/.test(text)) return 'path/permission';
+    if (patchSurface) {
+        const patchCategory = classifyPatchFailure(text);
+        if (patchCategory) return patchCategory;
+    }
     if (/requires either|invalid arguments|unknown parameter|unknown memory action/.test(text)
         || /must be|schema|required|old_string is .*>?=/.test(text)) return 'schema/args';
     if (/not in allow-list|not allowed/.test(text)) return 'permission';
     if (String(toolName || '') === 'shell' || /^\s*\[exit code:\s*\d+\]/i.test(raw)) return 'command-exit';
     if (/enoent|cannot find|not found at this path|path does not exist|no such file|file not found in graph|unreadable/.test(text)) return 'path/enoent';
     if (/timed out|timeout|interrupted|aborted/.test(text)) return 'timeout/abort';
-    if (/permission|denied|forbidden/.test(text)) return 'permission';
     if (/unknown tool|tool.*not.*available|missing.*tool/.test(text)) return 'tool-surface';
     return 'runtime/failure';
 }

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -305,8 +305,8 @@ function _scheduleFlush(immediate = false) {
         // Never let the periodic trace flush keep the event loop alive: a
         // ref'd 5s timer prevented short-lived processes (smoke scripts, agent
         // tasks) from exiting naturally after their work was done — they hung
-        // until an external timeout/kill. exit/beforeExit drains still flush
-        // the buffer, so unref loses no data.
+        // until an external timeout/kill. The synchronous exit/beforeExit drain
+        // still flushes the local spool; explicit shutdown awaits remote drain.
         _flushTimer.unref?.();
     }
 }
@@ -331,7 +331,6 @@ async function drainAgentTrace() {
         await _flush();
     }
 }
-process.on('exit', drainAgentTrace);
 
 function appendAgentTrace(record = {}) {
     // Test isolation — when run-all-tests.mjs sets this env, skip entirely.

package/src/runtime/agent/orchestrator/config.mjs

@@ -366,6 +366,26 @@ export function loadConfig(options = {}) {
                 .map(p => normalizePreset(p))
                 .filter(Boolean)
                 .filter(p => p.id !== 'workflow-search');
+            // `fastModels` was the pre-modelSettings Fast preference map.
+            // Fold any still-meaningful true entries into the canonical map,
+            // without overriding an explicit modelSettings.fast value. Keep
+            // the compatibility read here, but never expose/persist the
+            // legacy container again.
+            const modelSettings = raw.modelSettings && typeof raw.modelSettings === 'object'
+                ? { ...raw.modelSettings }
+                : {};
+            const legacyFastModels = raw.fastModels && typeof raw.fastModels === 'object'
+                ? raw.fastModels
+                : {};
+            for (const [key, enabled] of Object.entries(legacyFastModels)) {
+                if (enabled !== true) continue;
+                const current = modelSettings[key];
+                if (!current || typeof current !== 'object' || Array.isArray(current)) {
+                    modelSettings[key] = { fast: true };
+                } else if (!Object.prototype.hasOwnProperty.call(current, 'fast')) {
+                    modelSettings[key] = { ...current, fast: true };
+                }
+            }
             const workflowRoutes = raw.workflowRoutes && typeof raw.workflowRoutes === 'object' ? { ...raw.workflowRoutes } : {};
             delete workflowRoutes.search;
             // Normalize maintenance slots to routes, then overlay onto the
@@ -382,12 +402,10 @@ export function loadConfig(options = {}) {
                 maintenance: { ...DEFAULT_MAINTENANCE, ...normalizedMaint },
                 workflowRoutes,
                 searchRoute: normalizeSearchRoute(raw.searchRoute),
-                fastModels: raw.fastModels && typeof raw.fastModels === 'object' ? raw.fastModels : {},
-                modelSettings: raw.modelSettings && typeof raw.modelSettings === 'object' ? raw.modelSettings : {},
+                modelSettings,
                 onboarding: raw.onboarding && typeof raw.onboarding === 'object' ? raw.onboarding : {},
                 agents: raw.agents && typeof raw.agents === 'object' ? raw.agents : {},
                 workflow: raw.workflow && typeof raw.workflow === 'object' ? { active: String(raw.workflow.active || 'default') } : { active: 'default' },
-                agentMaintenance: { enabled: true, interval: '1h', ...raw.agentMaintenance },
                 profile: normalizeProfileConfig(raw.profile),
                 skills: normalizeSkillsConfig(raw.skills),
                 // No idleMs default here: absent idleMs means "provider default"
@@ -396,7 +414,6 @@ export function loadConfig(options = {}) {
                 // bypass the per-provider auto-clear table.
                 autoClear: { enabled: true, ...raw.autoClear },
                 compaction: raw.compaction && typeof raw.compaction === 'object' ? { ...raw.compaction } : {},
-                runtime: raw.runtime && typeof raw.runtime === 'object' ? raw.runtime : {},
                 shell: raw.shell && typeof raw.shell === 'object' ? raw.shell : {},
                 update: raw.update && typeof raw.update === 'object' ? { ...raw.update } : {},
                 recap: recapConfig,
@@ -415,17 +432,14 @@ export function loadConfig(options = {}) {
         maintenance: { ...DEFAULT_MAINTENANCE },
         workflowRoutes: {},
         searchRoute: null,
-        fastModels: {},
         modelSettings: {},
         onboarding: {},
         agents: {},
         workflow: { active: 'default' },
-        agentMaintenance: { enabled: true, interval: '1h' },
         profile: normalizeProfileConfig(null),
         skills: normalizeSkillsConfig(null),
                 autoClear: { enabled: true },
         compaction: {},
-        runtime: {},
         shell: {},
         update: {},
         recap: { enabled: true },
@@ -543,7 +557,7 @@ function buildAgentSaveBuilder(config, appliedDirty) {
             }
             if (Object.keys(mergedProject).length > 0) mcpProjectOverrides[projectKey] = mergedProject;
         }
-        return {
+        const next = {
             ...existingRaw,
             guide: config.guide || existingRaw.guide || undefined,
             providers: persistedProviders,
@@ -554,22 +568,26 @@ function buildAgentSaveBuilder(config, appliedDirty) {
             maintenance: config.maintenance || {},
             workflowRoutes,
             searchRoute: normalizeSearchRoute(config.searchRoute),
-            fastModels: config.fastModels || {},
             modelSettings: config.modelSettings || {},
             onboarding: config.onboarding || {},
             agents: config.agents || {},
             workflow: config.workflow || { active: 'default' },
-            agentMaintenance: config.agentMaintenance || {},
             profile: normalizeProfileConfig(config.profile),
             skills: normalizeSkillsConfig(config.skills),
             autoClear: config.autoClear || {},
             compaction: config.compaction || {},
-            runtime: config.runtime || {},
             shell: config.shell || {},
             update: config.update || {},
             recap: config.recap || {},
             modules: config.modules || existingRaw.modules || {},
         };
+        // These keys were previously round-tripped despite having no runtime
+        // consumer. Explicitly remove them from the in-lock baseline so a
+        // normal settings save also finishes migration of older installs.
+        delete next.fastModels;
+        delete next.agentMaintenance;
+        delete next.runtime;
+        return next;
     };
 }
 export function saveConfig(config) {

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -714,7 +714,7 @@ export function loadScopedRoleInstructions(agent, provider = null) {
         if (useUnified) {
             // Explicit-cache providers — every agent sees the same all-in-one
             // instruction surface. Cross-agent calls hit the same provider-side prefix
-            // shard, eliminating the agent-shard miss seen on Pool C
+            // prefix, eliminating the cross-agent cache miss seen on Pool C
             // transitions for openai-oauth/openai. This branch is disabled by the
             // empty provider set above; BP2 remains the active agent surface.
             agentRuleSectionsToEmit = hiddenPairs.map(p => `## ${p.name}\n\n${p.body}`);

package/src/runtime/agent/orchestrator/internal-agents.mjs

@@ -191,7 +191,7 @@ export function listHiddenAgentNames() {
 
 /**
  * List hidden agent names matching a given kind ('retrieval' | 'maintenance').
- * Consumed by collect.mjs to drive BP2 agent-shard classification dynamically
+ * Consumed by collect.mjs to drive BP2 agent classification dynamically
  * instead of hard-coding agent-name sets.
  */
 export function listHiddenAgentsByKind(kind) {

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -24,18 +24,6 @@ const DEFAULT_MCP_STARTUP_TIMEOUT_MS = 10000;
 // --- State ---
 const servers = new Map();
 let mcpSdkPromise = null;
-// Agent-shard proxy mode (P2, docs/agent-shard-design.md): a shard child has
-// no MCP connections of its own — the lead process owns the singleton server
-// registry. When a proxy is installed, tool DEFINITIONS come from the
-// lead-supplied snapshot and every call is forwarded over IPC; the local
-// `servers` map stays empty and untouched.
-let _mcpToolProxy = null;
-export function setMcpToolProxy(proxy) {
-    _mcpToolProxy = proxy && typeof proxy.call === 'function'
-        ? { tools: Array.isArray(proxy.tools) ? proxy.tools : [], call: proxy.call }
-        : null;
-    _invalidateMcpToolFieldMemo();
-}
 // Memo for mcpToolHasField(name, field) — keyed by `${toolName}|${field}`.
 // The lookup (regex parse + servers Map get + tools.find + schema property
 // inspection) runs on every MCP tool invocation but its result only changes
@@ -151,7 +139,6 @@ export async function connectMcpServers(config) {
  * Tool names are prefixed: `mcp__{serverName}__{toolName}`
  */
 export function getMcpTools() {
-    if (_mcpToolProxy) return _mcpToolProxy.tools;
     const tools = [];
     for (const server of servers.values()) {
         tools.push(...server.tools);
@@ -195,9 +182,6 @@ export async function executeMcpTool(name, args) {
     const match = name.match(/^mcp__(.+?)__(.+)$/);
     if (!match)
         throw new Error(`Not an MCP tool name: ${name}`);
-    // Proxy mode: the lead executes (including its own reconnect/timeout/cap
-    // handling) and returns the final model-visible result/envelope.
-    if (_mcpToolProxy) return _mcpToolProxy.call(name, args);
     const [, serverName, toolName] = match;
     const server = servers.get(serverName);
     if (!server)
@@ -371,7 +355,6 @@ export function isMcpTool(name) {
 /** True when the prefixed name exists on a connected MCP server. */
 export function isRegisteredMcpTool(name) {
     if (!isMcpTool(name)) return false;
-    if (_mcpToolProxy) return _mcpToolProxy.tools.some((t) => t?.name === name);
     const match = name.match(/^mcp__(.+?)__(.+)$/);
     if (!match) return false;
     const [, serverName] = match;
@@ -389,13 +372,6 @@ export function mcpToolHasField(name, field) {
     const memoKey = `${name}|${field}`;
     const memoized = _mcpToolFieldMemo.get(memoKey);
     if (memoized !== undefined) return memoized;
-    if (_mcpToolProxy) {
-        const proxyTool = _mcpToolProxy.tools.find((t) => t?.name === name);
-        const proxyProps = proxyTool?.inputSchema?.properties;
-        const proxyResult = Boolean(proxyProps && Object.prototype.hasOwnProperty.call(proxyProps, field));
-        _mcpToolFieldMemo.set(memoKey, proxyResult);
-        return proxyResult;
-    }
     const match = name.match(/^mcp__(.+?)__(.+)$/);
     if (!match) { _mcpToolFieldMemo.set(memoKey, false); return false; }
     const [, serverName] = match;

package/src/runtime/agent/orchestrator/providers/admission-scheduler.mjs

@@ -123,9 +123,9 @@ export class ProviderAdmissionScheduler {
         this.reportedRateLimits = new WeakSet();
         this.closedReason = null;
         this.context = currentAdmission;
-        // Cross-process cooldown fan-out (agent shard pool): listeners observe
-        // locally-recorded 429 cooldowns and credential-driven resets so one
-        // account's quota window parks every shard process.
+        // Cooldown listeners observe locally-recorded 429 cooldowns and
+        // credential-driven resets so every runtime using one account sees
+        // the same quota window.
         this.cooldownListeners = new Set();
     }
 

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -59,6 +59,7 @@ import {
     parseSSEStream,
     _classifyMidstreamError,
     _midstreamSleepWithAbort,
+    stampAnthropicStreamOutcome,
 } from './anthropic-sse.mjs';
 import { buildAnthropicBetaHeaders, supportsAnthropicFastMode } from './anthropic-betas.mjs';
 import {
@@ -718,13 +719,19 @@ export class AnthropicOAuthProvider {
                     const quotaText = await result.response.text().catch(() => '');
                     cleanupCancelHandler(result.cancelHandler);
                     try { result.controller?.abort?.(); } catch {}
-                    throw anthropicQuotaError(status, result?.response?.headers, this.scrubTokens(quotaText));
+                    // Initial-response failure: nothing was sampled, so the
+                    // typed retry rules upstream own the decision.
+                    throw Object.assign(
+                        anthropicQuotaError(status, result?.response?.headers, this.scrubTokens(quotaText)),
+                        { initialResponseError: true },
+                    );
                 }
                 const err = new Error(`Anthropic OAuth API ${status}`);
                 err.httpStatus = status;
                 err.status = status;
                 err.headers = result?.response?.headers;
                 err.response = { status, headers: result?.response?.headers };
+                err.initialResponseError = true;
                 const retryAfterMs = retryAfterMsFromError(err);
                 if (transientStatus || retryAfterMs != null) {
                     try { await result.response.text(); } catch {}
@@ -972,6 +979,15 @@ export class AnthropicOAuthProvider {
                 } catch { /* ignore non-extensible result */ }
                 return result;
             } catch (err) {
+                // Canonical stream-outcome contract: stamp before ANY safety
+                // decision below. The parser's stamped verdict (when present)
+                // is authoritative — coarse midState.partialToolCall must not
+                // overwrite an idempotent pending-input truncation — while
+                // genuinely new wrapper-observed exposure is still merged.
+                let _outcome = null;
+                try {
+                    _outcome = stampAnthropicStreamOutcome(err, midState, { provider: 'anthropic-oauth' });
+                } catch { /* stamping is best-effort */ }
                 // Acknowledged reset semantics let the owner tombstone this
                 // attempt before the full request is restarted non-streaming.
                 // Without that acknowledgement, recoverNonStreaming stamps
@@ -979,16 +995,12 @@ export class AnthropicOAuthProvider {
                 if (midState.emittedText) {
                     return await recoverNonStreaming(midState, err, controller);
                 }
-                // Completed/partial tools and thinking blocks are also replay
-                // boundaries. Stamp the current (latest) error so no upstream
-                // retry owner can reissue this turn.
-                if (midState.emittedToolCall || midState.partialToolCall || midState.emittedThinking) {
-                    try {
-                        err.emittedToolCall = !!midState.emittedToolCall;
-                        err.partialToolCall = !!midState.partialToolCall;
-                        err.emittedThinking = !!midState.emittedThinking;
-                        err.unsafeToRetry = true;
-                    } catch {}
+                // Dispatched tools and exposed thinking are replay boundaries;
+                // the canonical merge above already recorded them and wrote the
+                // aliases. Coarse midState flags are NOT written here: they
+                // would downgrade the parser's authoritative verdict that an
+                // incomplete, never dispatched tool input stays replay-safe.
+                if (_outcome?.replayUnsafe === true) {
                     try { controller?.abort?.(err); } catch {}
                     throw err;
                 }
@@ -1006,9 +1018,7 @@ export class AnthropicOAuthProvider {
                 }
                 if (classifyError(err) === 'transient'
                     && !midState.sawMessageStart
-                    && !midState.emittedToolCall
-                    && !midState.partialToolCall
-                    && !midState.emittedThinking
+                    && _outcome?.replayUnsafe !== true
                     && attemptIndex < MAX_MIDSTREAM_RETRIES) {
                     firstAttemptError = err;
                     firstAttemptClassifier = err?.providerErrorType || 'sse_transient';
@@ -1032,9 +1042,7 @@ export class AnthropicOAuthProvider {
                 // yet; otherwise let the error surface.
                 if ((err?.truncatedStream === true || err?.code === 'TRUNCATED_STREAM')
                     && classifyError(err) === 'transient'
-                    && !midState.emittedToolCall
-                    && !midState.partialToolCall
-                    && !midState.emittedThinking
+                    && _outcome?.replayUnsafe !== true
                     && attemptIndex < MAX_MIDSTREAM_RETRIES) {
                     firstAttemptError = err;
                     firstAttemptClassifier = 'truncated_stream';