mixdog 0.9.90 → 0.9.92

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.90",
+  "version": "0.9.92",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -100,6 +100,7 @@
     "test:route-scope": "node --test scripts/route-scope-isolation-test.mjs",
     "test:schedule-reload": "node --test scripts/schedule-reload-arm-test.mjs",
     "test:media": "node --test src/runtime/media/store.test.mjs src/runtime/media/renditions.test.mjs",
+    "test:shell-harness": "node --test scripts/shell-harness-regression-test.mjs",
     "failures": "node scripts/tool-failures.mjs",
     "trace:llm": "node scripts/llm-trace-summary.mjs",
     "diag:sessions": "node scripts/session-diag.mjs",
@@ -163,5 +164,8 @@
     "acorn": "^8.17.0",
     "esbuild": "^0.28.1",
     "eslint-scope": "^9.1.2"
+  },
+  "optionalDependencies": {
+    "@vscode/ripgrep": "^1.18.0"
   }
 }

package/scripts/tool-overhead-microbench.mjs

@@ -0,0 +1,60 @@
+// Micro-bench: fixed per-call overhead of the shell tool path vs raw spawn.
+// Usage: node scripts/tool-overhead-microbench.mjs [bash|powershell] [N]
+// Prints per-call ms for executeBashTool('echo hi') and raw child spawn,
+// so (tool - raw) isolates our tool-layer overhead (policy, wrappers, I/O).
+import { spawn } from 'node:child_process';
+import { executeBashTool } from '../src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs';
+
+const shell = process.argv[2] || (process.platform === 'win32' ? 'powershell' : 'bash');
+const N = Number(process.argv[3] || 15);
+
+const stats = (arr) => {
+  const s = [...arr].sort((a, b) => a - b);
+  const sum = s.reduce((t, v) => t + v, 0);
+  return {
+    mean: (sum / s.length).toFixed(1),
+    p50: s[Math.floor(s.length / 2)].toFixed(1),
+    min: s[0].toFixed(1),
+    max: s[s.length - 1].toFixed(1),
+  };
+};
+
+const rawOnce = () => new Promise((resolveDone, reject) => {
+  const child = shell === 'powershell'
+    ? spawn('pwsh', ['-NoProfile', '-NonInteractive', '-Command', 'echo hi'])
+    : spawn('bash', ['-c', 'echo hi']);
+  let out = '';
+  child.stdout.on('data', (c) => { out += c; });
+  child.on('error', reject);
+  child.on('close', () => resolveDone(out));
+});
+
+const toolOnce = async () => {
+  const out = await executeBashTool({ command: 'echo hi', shell }, process.cwd(), {});
+  return String(out);
+};
+
+// Warm-up both paths (module init, shell resolution cache, standbys).
+await toolOnce(); await toolOnce();
+await rawOnce(); await rawOnce();
+
+const toolMs = [];
+for (let i = 0; i < N; i++) {
+  const t0 = performance.now();
+  await toolOnce();
+  toolMs.push(performance.now() - t0);
+}
+const rawMs = [];
+for (let i = 0; i < N; i++) {
+  const t0 = performance.now();
+  await rawOnce();
+  rawMs.push(performance.now() - t0);
+}
+
+const t = stats(toolMs);
+const r = stats(rawMs);
+console.log(`shell=${shell} n=${N}`);
+console.log(`tool  mean=${t.mean}ms p50=${t.p50}ms min=${t.min}ms max=${t.max}ms`);
+console.log(`raw   mean=${r.mean}ms p50=${r.p50}ms min=${r.min}ms max=${r.max}ms`);
+console.log(`overhead(mean tool-raw)=${(Number(t.mean) - Number(r.mean)).toFixed(1)}ms`);
+process.exit(0);

package/src/agents/debugger/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "debugger",
   "name": "Debugger",
-  "description": "Failure reproduction and root-cause analysis.",
+  "description": "Use for deep root-cause analysis or a bug surviving 2+ fix cycles.",
   "entry": "AGENT.md"
 }

package/src/agents/explore/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "explore",
   "name": "Explore",
-  "description": "Broad codebase exploration and target narrowing.",
+  "description": "Use when targets are unknown: broad codebase exploration and narrowing.",
   "entry": "AGENT.md"
 }

package/src/agents/heavy-worker/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "heavy-worker",
   "name": "Heavy Worker",
-  "description": "Broad or multi-file implementation.",
+  "description": "Use for complex, high-difficulty tasks.",
   "entry": "AGENT.md"
 }

package/src/agents/maintainer/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "maintainer",
   "name": "Maintainer",
-  "description": "Maintenance, upkeep, and long-running health work.",
+  "description": "Use for memory upkeep and long-running maintenance work.",
   "entry": "AGENT.md"
 }

package/src/agents/reviewer/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "reviewer",
   "name": "Reviewer",
-  "description": "Change review and risk finding.",
+  "description": "Use when an implementation finishes: cross-verify the change for correctness and risk before reporting.",
   "entry": "AGENT.md"
 }

package/src/agents/worker/agent.json

@@ -1,6 +1,6 @@
 {
   "id": "worker",
   "name": "Worker",
-  "description": "Scoped implementation.",
+  "description": "Use for simple, well-scoped tasks.",
   "entry": "AGENT.md"
 }

package/src/lib/rules-builder.cjs

@@ -156,8 +156,8 @@ function stripFrontmatter(markdown) {
 }
 
 function normalizeOutputStyleName(value) {
-  const name = String(value || 'default').trim();
-  return /^[A-Za-z0-9_.-]+$/.test(name) ? name : 'default';
+  const name = String(value || 'simple').trim();
+  return /^[A-Za-z0-9_.-]+$/.test(name) ? name : 'simple';
 }
 
 function loadOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
@@ -172,10 +172,10 @@ function loadOutputStyle({ PLUGIN_ROOT, DATA_DIR }) {
     const body = stripFrontmatter(readOptional(candidate));
     if (body) return body;
   }
-  if (styleName !== 'default') {
+  if (styleName !== 'simple') {
     const fallback = [
-      path.join(DATA_DIR, 'output-styles', 'default.md'),
-      path.join(PLUGIN_ROOT, 'output-styles', 'default.md'),
+      path.join(DATA_DIR, 'output-styles', 'simple.md'),
+      path.join(PLUGIN_ROOT, 'output-styles', 'simple.md'),
     ];
     for (const candidate of fallback) {
       const body = stripFrontmatter(readOptional(candidate));

package/src/output-styles/detailed.md

@@ -0,0 +1,27 @@
+---
+name: detailed
+title: Detailed
+description: Detailed engineering summaries
+aliases: verbose, full
+keep-coding-instructions: true
+---
+
+# Output Style
+
+Detailed — the fullest style, yet still summary-form, never essay-form.
+Depth comes from picking the right facts, not explaining more.
+
+- Lead with the outcome in one short sentence, then only the detail that
+  matters: what changed and the key facts (paths, commands, errors).
+  Conclusions, not reasoning; cite a symbol/path only as an anchor. Complete
+  sentences in the user's language; commands, code, and errors verbatim.
+- Say each point once. Size budget: roughly TWICE Simple — ~2 rendered lines
+  per point, whole report ~10–15 lines.
+- Short labels such as `Changes` or `Risks / next steps` in final reports
+  only; none on interim progress; collapse trivial tasks to a couple of
+  sentences. Never dump raw tool output.
+- Do not hide blockers or failures; one short clause each.
+- One bullet = one idea, at most 2 rendered lines, opened with a short
+  **bold key point**; blank line between multi-line items; nest one
+  sub-level at most.
+- Never name this style unless asked.

package/src/output-styles/extreme-minimal.md

@@ -11,12 +11,12 @@ keep-coding-instructions: true
 Extreme minimal — the most compressed style: exactly one sentence, under 100
 characters.
 
-- Reply with a SINGLE sentence, always under 100 characters. Never a second
-  sentence, clause pile-up, or run-on that smuggles in extra facts.
-- State only the net result. Drop file lists, how-it-was-done, verification
-  detail, and follow-ups unless one is the single most decisive fact.
-- No headings, bullets, numbered lists, labels, or sections — one plain sentence
-  only, even when the request says "report" or "summary".
+- A SINGLE sentence, always under 100 characters — never a second sentence or
+  a run-on that smuggles in extra facts.
+- Net result only: drop file lists, methods, and follow-ups unless one is
+  the single decisive fact.
+- No headings, bullets, labels, or sections — one plain sentence, even when
+  the request says "report".
 - Preferred pattern: `<target> changed.`
-- Preserve only the single decisive path, command, symbol, or error verbatim,
-  and only if it fits the limit.
+- Preserve one decisive path, command, symbol, or error verbatim, only if it
+  fits the limit.

package/src/output-styles/minimal.md

@@ -9,15 +9,12 @@ keep-coding-instructions: true
 
 Minimal — a very short summary: one or two sentences, nothing more.
 
-- Summarize only the net result in one short sentence; add a second short
-  sentence only for a fact (verification, blocker) that genuinely needs it —
-  never a run-on that crams extra facts in.
-- Size budget: roughly HALF the Simple style — 1–2 plain, complete sentences
-  (~2–3 rendered lines) however large the task was, concept-level only.
-- Summarize, never itemize: no headings, bullets, labels, or sections and no
-  file-by-file detail — state only what the change accomplishes, even when
-  the request says "report" or "summary".
-- Preferred pattern: `<target> changed. <verification> passed.` If
-  verification was not run, say so.
+- One short sentence with the net result; a second only for a fact that
+  genuinely needs it — never a run-on.
+- Roughly HALF Simple: 1–2 plain sentences (~2–3 rendered lines) however
+  large the task, concept-level only.
+- Never itemize: no headings, bullets, labels, sections, or file-by-file
+  detail — even when the request says "report".
+- Preferred pattern: `<target> changed.`
 - Preserve only the single decisive path, command, symbol, API name, code, or
   error verbatim.

package/src/output-styles/simple.md

@@ -8,26 +8,18 @@ keep-coding-instructions: true
 
 # Output Style
 
-Practical concise — outcome-first handoffs for coding work: summarize the
-result, do not narrate or explain the change.
+Practical concise — outcome-first handoffs: summarize the result, do not
+narrate the work.
 
 - Open with the outcome in one sentence: done, blocked, or awaiting a decision.
-- Summarize at the concept level — what the change accomplishes, not a
-  per-file changelog or code path; cite a path (`file_path:line_number`) only
-  as a navigation anchor, never as the explanation.
-- Compress by cutting content (filler, acknowledgments, hedging, restated
-  facts), not grammar: natural, complete sentences in the user's language;
-  paths, commands, symbols, code, and exact errors stay verbatim.
-- Controlled detail: 1–3 short bullets or 2–3 sentences; state each point
-  once. Size budget: roughly HALF the Default style and TWICE Minimal —
-  whole reply ~5–7 lines.
-- Layout: one idea per bullet, ONE line each, led with a short bold key
-  phrase; blank line between multi-line list items — never a dense wall of
-  text.
-- Final handoffs may use labels like `Changes`, `Verification`, and
-  `Risks / next steps`; do not label interim progress.
-- Synthesize agent or retrieval results; never forward raw reports, long file
-  lists, tool traces, or session metadata.
-- Do not hide blockers, failed verification, or required follow-up — state
-  them in one short clause; if verification was not run, say so once.
+- Concept-level summary of what changed, not a per-file changelog; cite a
+  path (`file:line`) only as an anchor. Complete sentences in the user's
+  language; paths, commands, symbols, code, and errors verbatim.
+- 1–3 short bullets or 2–3 sentences, each point once; whole reply ~5–7
+  lines (HALF Detailed, TWICE Minimal).
+- One idea per bullet, ONE line each, led by a short bold key phrase; blank
+  line between multi-line items.
+- Final handoffs may use short labels like `Changes` or `Risks / next
+  steps`; none on interim progress. Never dump raw tool output.
+- Do not hide blockers or failures; one short clause each.
 - Never name this style unless asked.

package/src/rules/lead/01-general.md

@@ -4,7 +4,15 @@
   multi-provider agent workflows. Never identify as generic OpenAI/ChatGPT.
 - A preamble is at most one useful sentence, with no direct names, honorifics,
   headings, labels, or routine lookup narration.
-- Destructive/hard-to-reverse action needs explicit confirmation.
+- Destructive/hard-to-reverse action needs explicit confirmation and explicit
+  validated target paths — never `~`, a root, or unresolved variables/globs;
+  report material deletions with recoverability.
 - Act proactively; ask only for decisions.
+- Mid-task input: a replacement supersedes current work, an addition folds
+  into it, a status question gets a brief answer while work continues; after
+  context compaction continue from the summary — never restart or redo
+  finished work.
+- When blocked, exhaust safe in-scope checks once and report the blocker;
+  never spend turns without a tool call or new evidence.
 - Your final message ends the turn: answer only when the work is done. After a
   failed tool call, fix and re-run it, or state plainly that it is unresolved.

package/src/rules/lead/lead-brief.md

@@ -1,18 +1,19 @@
 # Lead Brief
 
-- Use one-line fragments. `Task:` is mandatory and lossless: preserve intent,
-  required and forbidden outcomes, completion/stop boundary, user-supplied
-  exact targets, and exact replacements/outputs. Never infer exactness from
-  task name, file count, or difficulty.
-- Each role constructs its own `Task:` from the original request and official
-  spec/test acceptance criteria, preserving every requirement and boundary.
+- Minimum chars, maximum info: one-line fragments. `Task:` is mandatory and
+  lossless: each role
+  constructs it from the original request and official spec/test acceptance
+  criteria, preserving intent, required and forbidden outcomes,
+  completion/stop boundary, user-supplied exact targets, and exact
+  replacements/outputs. Never infer exactness from task name, file count, or
+  difficulty.
 - Omit role-known rules, repeated context/facts, and padding; split scope
   without discarding requirements.
-- Other fields are task-specific deltas: `Anchors:`, `Allow/Forbid:`,
-  `Deliver:`. Omit empty fields. Anchors are `file:line` plus a one-line
-  conclusion, never log/code bodies. State outcomes, not methods, unless the
-  method is required. `Deliver:` sets handoff shape/size.
-- Send a full brief only for a fresh spawn or `respawned: true`; live follow-ups
-  contain only the delta. A dead-tag send is cold and must re-supply anchors.
-- Never `send` mid-run; batch one follow-up after completion; interrupt only to
-  cancel. Agent communication is English.
+- Other fields are task-specific deltas — `Anchors:` (`file:line` plus a
+  one-line conclusion, never log/code bodies), `Allow/Forbid:`, `Deliver:`
+  (sets handoff shape/size); omit empty fields. State outcomes, not methods,
+  unless the method is required.
+- Full brief only for a fresh spawn or `respawned: true`; live follow-ups
+  carry only the delta; a dead-tag send is cold and must re-supply anchors.
+- Never `send` mid-run; batch one follow-up after completion; interrupt only
+  to cancel. Agent communication is English.

package/src/rules/shared/01-tool.md

@@ -1,40 +1,35 @@
 # Tool Use
 
-- Before the first call, gather every known facet in one tool message; for
-  each facet choose exactly one shortest locator route:
-  broad/uncertain→`explore` (roles without it: `find`); partial path/name→
-  `find`; verified root+wildcard→
-  `glob`; quoted/non-identifier literal or regex→`grep`; exact code
-  identifier/relation→`code_graph` before grep; known file/span→`read`
-  directly without `grep`; verified directory→`list`; known edit→
-  `apply_patch` directly, with no preparatory `read`;
-  program/state change→`shell`; web/current external info→`search`.
-- Shortest total calls, maximum batching — every turn. Combine variants,
-  symbols, scopes, paths, and queries into one call; put all independent
-  calls (probes, reads, hypotheses, commands) in one message — concurrent
-  regardless of tool, shell included. Sequential singles only for a
-  genuinely dependent next step. Distinct facets, not alternative routes.
-  Only apply_patch executes in order.
-- Batch compatible reads — same-file regions as real `{path,offset,limit}`
-  arrays covering the whole logical unit — in one `path[]` call, and graph
-  targets in arrays. Don't reread returned spans. Put all new edits in one
-  patch.
+- Before the first call, gather every known facet in one tool message; one
+  shortest route per facet: broad/uncertain→`explore` (roles without it:
+  `find`); partial path/name→`find`; verified root+wildcard→`glob`;
+  quoted/non-identifier literal or regex→`grep`; exact code identifier/
+  relation→`code_graph` before grep; known file/span→`read` directly without
+  `grep`; verified directory→`list`; known edit→`apply_patch` (span already
+  seen; else `read`/`grep` first); program/state change→`shell`; web/current
+  external info→`search`.
+- Shortest total calls, maximum batching — every turn: all independent calls
+  in one concurrent message (shell included); combine variants/symbols/
+  scopes/paths/queries per call; same-file regions as one real
+  `{path,offset,limit}` array; graph targets as arrays; `explore` facets in
+  one `query[]` (max 8, no rephrased duplicates); all new edits in one patch.
+  Distinct facets, not alternative routes; sequential singles only for a
+  step whose arguments require the previous result — fixed follow-ups
+  (pinned installs, known writes) go in the same batch; only apply_patch
+  executes in order.
 - Verified paths: project root, session cwd, user-provided, tool-returned.
-  `find` first for guessed path/name fragments (same turn as other probes);
-  on ENOENT, find the basename.
-- At task start, batch all `explore` facets in one `query[]` call, maximum 8,
-  without rephrased duplicates. Retry `EXPLORATION_FAILED` once with changed
-  tokens.
-- Stop when evidence covers the deliverable; don't re-locate or re-verify a
-  sufficient anchor. A returned `path:line` freezes the location; inspecting
-  its content with read/code_graph is valid.
-- A nonzero `content_with_context` result resolves that concept — act on it;
-  only zero/error results justify changed tokens or scope.
-- `apply_patch` is the primary edit tool: send the patch as soon as the target
-  path and new content are known. `read` is for discovery or for recovery
-  after a patch failed on insufficient context.
-- A shell placed after `apply_patch` in the same turn runs after the patch
-  lands — batch edits and their verification freely.
-- A command promoted to background is a decision point: continue only if
-  observed progress fits the budget, otherwise switch routes. Waiting is an
-  explicit choice.
+  `find` first for guessed path/name fragments; on ENOENT, find the basename.
+  Retry `EXPLORATION_FAILED` once with changed tokens.
+- Stop when evidence covers the deliverable: a returned `path:line` or
+  nonzero `content_with_context` result is final — act on it (inspecting it
+  via read/code_graph is valid); only zero/error results justify changed
+  tokens or scope. Don't re-locate, re-verify, or reread returned spans.
+- `apply_patch` is the primary edit tool: send the patch as soon as target
+  path and new content are known. Hunk context comes verbatim from the newest
+  tool output of that span (`read`/`grep`/your own patch — post-patch content
+  after edits), never retyped from memory; one look-up beats a failed patch.
+  A same-turn shell after `apply_patch` runs once the patch lands.
+- After starting or receiving a background task, end the turn — its
+  completion notification resumes the work. Never poll, sleep-loop, or block;
+  explicit wait only for a result the current turn cannot proceed without.
+  Long commands whose output the next step does not need go async.

package/src/runtime/agent/orchestrator/agent-runtime/commit-message-completion.mjs

@@ -0,0 +1,67 @@
+import { loadConfig } from '../config.mjs';
+import { getProvider, initProviders } from '../providers/registry.mjs';
+import { resolveMaintenanceRoute } from './maintenance-route.mjs';
+
+export const COMMIT_MESSAGE_SYSTEM_PROMPT = 'You are generating one git commit message from the provided diff. First line: imperative mood, at most 72 characters, no trailing period. Optionally add a blank line and a short body (wrapped at 72 characters) explaining WHY. Output ONLY the commit message - no preamble, no code fences, no quotes.';
+
+export function commitMessageSystemPrompt(style = '') {
+    const hint = String(style || '').trim();
+    return hint ? `${COMMIT_MESSAGE_SYSTEM_PROMPT}\n${hint}` : COMMIT_MESSAGE_SYSTEM_PROMPT;
+}
+
+function resultText(result) {
+    if (typeof result === 'string') return result;
+    if (typeof result?.content === 'string') return result.content;
+    if (Array.isArray(result?.content)) {
+        return result.content
+            .map((part) => part?.type === 'text' ? String(part.text || '') : '')
+            .filter(Boolean)
+            .join('\n');
+    }
+    return '';
+}
+
+export function createCommitMessageCompletion(deps = {}) {
+    const load = deps.loadConfig || loadConfig;
+    const resolveRoute = deps.resolveMaintenanceRoute || resolveMaintenanceRoute;
+    const initialize = deps.initProviders || initProviders;
+    const providerFor = deps.getProvider || getProvider;
+
+    return async function generateCommitMessage(source, options = {}) {
+        const text = String(source || '').trim();
+        if (!text) return '';
+        const signal = options.signal || null;
+        const config = load();
+        // Commit messages are maintenance-class work: they ride the same
+        // route as session titles instead of the main conversation model.
+        const route = resolveRoute({
+            agent: 'title-agent',
+            config,
+        });
+        if (!route || typeof route !== 'object') {
+            throw new Error('Commit message maintenance route is unresolved.');
+        }
+        const providerName = String(route.provider || '').trim();
+        const model = String(route.model || '').trim();
+        if (!providerName || !model) {
+            throw new Error('Commit message maintenance route requires provider and model.');
+        }
+        await initialize(config.providers || {}, { signal });
+        const provider = providerFor(providerName);
+        if (!provider || typeof provider.send !== 'function') {
+            throw new Error(`Commit message provider is unavailable: ${providerName}`);
+        }
+        const response = await provider.send([
+            { role: 'system', content: commitMessageSystemPrompt(options.style) },
+            { role: 'user', content: text },
+        ], model, undefined, {
+            signal,
+            effort: String(route.effort || '').trim() || 'low',
+            fast: route.fast === true,
+            maxOutputTokens: 400,
+        });
+        return resultText(response).trim();
+    };
+}
+
+export const generateCommitMessage = createCommitMessageCompletion();

package/src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs

@@ -50,8 +50,10 @@ import {
     anthropicRequestTimeoutMs,
     classifyError,
     anthropicMaxAttempts,
+    createStallRetryBudget,
     midstreamBackoffFor,
     retryAfterMsFromError,
+    STREAM_STALL_RETRY_BUDGET_MS,
     withRetry,
 } from './retry-classifier.mjs';
 import {
@@ -774,6 +776,9 @@ export class AnthropicOAuthProvider {
         const MAX_MIDSTREAM_RETRIES = ANTHROPIC_MAX_MIDSTREAM_RETRIES;
         let firstAttemptError = null;
         let firstAttemptClassifier = null;
+        // Send-scoped stall window: in-place stall retries share one wall
+        // clock starting at the first stall (see createStallRetryBudget).
+        const stallRetryBudget = createStallRetryBudget();
 
         const recoverNonStreaming = async (midState, streamingError, controller) => {
             const exposedChars = Number(midState?.emittedTextChars) || 0;
@@ -1052,6 +1057,11 @@ export class AnthropicOAuthProvider {
                     continue;
                 }
                 const classifier = _classifyMidstreamError(err, midState);
+                if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
+                    try { process.stderr.write(`[anthropic-oauth] stall retry budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first stall) — surfacing for fresh-request retry\n`); } catch {}
+                    try { controller?.abort?.(err); } catch { /* best-effort teardown */ }
+                    throw err;
+                }
                 if (classifier && attemptIndex < MAX_MIDSTREAM_RETRIES) {
                     firstAttemptError = err;
                     firstAttemptClassifier = classifier;

package/src/runtime/agent/orchestrator/providers/anthropic.mjs

@@ -8,8 +8,10 @@ import {
     anthropicMaxAttempts,
     anthropicRequestTimeoutMs,
     classifyError,
+    createStallRetryBudget,
     midstreamBackoffFor,
     sleepWithAbort,
+    STREAM_STALL_RETRY_BUDGET_MS,
     withRetry,
     retryAfterMsFromError,
 } from './retry-classifier.mjs';
@@ -249,6 +251,9 @@ export class AnthropicProvider {
         const MAX_MIDSTREAM_RETRIES = ANTHROPIC_MAX_MIDSTREAM_RETRIES;
         let firstAttemptError = null;
         let firstAttemptClassifier = null;
+        // Send-scoped stall window: in-place stall retries share one wall
+        // clock starting at the first stall (see createStallRetryBudget).
+        const stallRetryBudget = createStallRetryBudget();
 
         const buildReturnFromParse = (parseResult) => {
             const usageRaw = parseResult.usage?.raw || null;
@@ -592,6 +597,15 @@ export class AnthropicProvider {
                         continue;
                     }
                     const classifier = _classifyMidstreamError(err, midState);
+                    if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
+                        try {
+                            process.stderr.write(
+                                `[${this.name}] stall retry budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first stall) — surfacing for fresh-request retry\n`,
+                            );
+                        } catch {}
+                        try { streamController.abort?.(err); } catch {}
+                        throw err;
+                    }
                     if (classifier && attemptIndex < MAX_MIDSTREAM_RETRIES) {
                         firstAttemptError = err;
                         firstAttemptClassifier = classifier;

package/src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs

@@ -36,9 +36,11 @@ import {
     classifyHandshakeError,
     classifyMidstreamError,
     createStreamSafetyStamps,
+    createStallRetryBudget,
     jitterDelayMs,
     MIDSTREAM_RETRY_POLICY,
     sleepWithAbort,
+    STREAM_STALL_RETRY_BUDGET_MS,
 } from './retry-classifier.mjs';
 import { stampStreamOutcome, STREAM_TRANSPORTS } from './lib/stream-outcome.mjs';
 import {
@@ -459,6 +461,9 @@ export async function sendViaWebSocket({
     const MAX_MIDSTREAM_RETRIES = MIDSTREAM_WS_TRANSIENT_RETRY_LIMIT;
     let firstAttemptError = null;
     let firstAttemptClassifier = null;
+    // Send-scoped stall window: in-place stall retries share one wall clock
+    // starting at the first stall (see createStallRetryBudget).
+    const stallRetryBudget = createStallRetryBudget();
     // A generate:false prewarm is billable even if its main request later
     // retries on a fresh socket or falls back to HTTP. Retain one completed
     // result across the whole logical send and attach it to terminal errors.
@@ -1006,6 +1011,11 @@ export async function sendViaWebSocket({
             const classifier = err?.unsafeToRetry === true
                 ? null
                 : _classifyMidstreamError(err, midState);
+            if (classifier === 'stream_stalled' && !stallRetryBudget.allowStallRetry()) {
+                try { process.stderr.write(`[openai-oauth] stall retry budget exhausted (${STREAM_STALL_RETRY_BUDGET_MS}ms since first stall) — surfacing for fresh-request retry\n`); } catch {}
+                emitSendSpan('error');
+                throw _stampTool(_stampLiveText(err));
+            }
             const retryLimit = classifier ? _midstreamRetryLimit(classifier) : 0;
             if (classifier && attemptIndex < retryLimit) {
                 // Retry-eligible: stash the first-attempt error, emit progress,

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -314,6 +314,41 @@ export function jitterDelayMs(ms, ratio = PROVIDER_RETRY_JITTER_RATIO, mode = 's
   return Math.max(0, Math.round(base + offset))
 }
 
+// ── Stall-retry wall-clock budget (send-scoped) ──────────────────────────────
+// Mid-stream 'stream_stalled' recoveries retry in place, which is right for a
+// one-off blip but lets a chronically dying stream burn a whole task budget
+// slowly (observed live: one send stretched 149s→298s→556s across stall
+// retries before the agent deadline killed the task). Reference stacks bound
+// this instead of retrying forever: Claude Code caps each request at ~300s
+// wall clock (API_TIMEOUT_MS) and Codex kills a stream after one 300s silent
+// gap (stream_idle_timeout). This guard is the equivalent for our in-place
+// recovery: the clock starts at the FIRST stall of a send, and stall-classified
+// retries are allowed only inside that window; past it the stall error
+// surfaces so loop-level transport retry issues a FRESH request. Healthy
+// streams never consult the clock (no stall → no budget reads), so long
+// thinking/output can never trip it.
+export const STREAM_STALL_RETRY_BUDGET_MS = (() => {
+  const v = Number(process.env.MIXDOG_STREAM_STALL_BUDGET_MS)
+  return Number.isFinite(v) && v > 0 ? Math.floor(v) : 300_000
+})()
+
+// One instance per provider send() call (NOT per attempt — the whole point is
+// bounding the cross-attempt stall window). `now` is injectable for tests.
+export function createStallRetryBudget(budgetMs = STREAM_STALL_RETRY_BUDGET_MS, now = Date.now) {
+  let firstStallAt = 0
+  return {
+    // Record a stall-classified retry candidate. Returns true while the
+    // send's stall window still has budget; false once exhausted (the caller
+    // surfaces the error instead of retrying in place).
+    allowStallRetry() {
+      const t = now()
+      if (!firstStallAt) firstStallAt = t
+      return (t - firstStallAt) <= budgetMs
+    },
+    get firstStallAt() { return firstStallAt },
+  }
+}
+
 // ── Shared network-resilience interface ──────────────────────────────────────
 // One home for the logic shared across providers: mid-stream classifier
 // (WS + SSE), transport fallback predicate, stream-safety stamp latches,