mixdog 0.9.90 → 0.9.92

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -128,6 +128,12 @@ export {
 // this catches tight deterministic-failure loops (e.g. a command that errors
 // the same way every time) far earlier than 100 iterations.
 const REPEAT_FAIL_LIMIT = 3;
+// Structured provider continuations (endTurn=false / pause_turn) are honored,
+// but must not sustain an unbounded text-only loop: a lead session was
+// observed burning a 30-minute agent budget (26K output tokens, zero tool
+// calls) on back-to-back continuations. After this many continuations with no
+// intervening tool batch, the current text is accepted as the final answer.
+const PROVIDER_CONTINUATION_NO_TOOL_LIMIT = Math.max(1, Number(process.env.MIXDOG_PROVIDER_CONTINUATION_NO_TOOL_LIMIT) || 8);
 // A provider max-output stop is not a completed assistant turn, even when it
 // contains useful text. Preserve each partial in the provider transcript and
 // grant at most three direct continuations before surfacing a hard truncation.
@@ -384,6 +390,12 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
     // hard iteration cap remains the sole bound on how long a provider may
     // keep declaring "not done" inside one user turn.
     let _providerContinuationCount = 0;
+    // Continuations since the last executed tool batch — bounds the text-only
+    // continuation runaway (see PROVIDER_CONTINUATION_NO_TOOL_LIMIT).
+    let _continuationsSinceToolBatch = 0;
+    // Loop-level transport replays consumed this ask (see send-with-recovery
+    // TRANSPORT_RETRY_MAX): bounded per turn, reset only with a fresh ask.
+    let _transportRetriesUsed = 0;
     // Claude Code parity: queued prompt/task notifications are attached after a
     // tool batch, before the continuation provider send. Normal batches drain
     // up to 'next'; a Sleep-like tool grants a 'later' flush.
@@ -432,6 +444,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             Math.floor(maxLoopIterations * 0.9),
         ];
     while (true) {
+        const _iterT0 = Date.now();
         throwIfAborted();
         if (iterations >= maxLoopIterations) {
             // Final-answer turn: instead of breaking mid-transcript (which
@@ -627,14 +640,21 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             () => sendWithRecovery({
                 provider, messages, model, sendTools, tools: sendTools, opts,
                 sessionId, sessionRef, nextIteration, contextOverflowRetryUsed,
+                transportRetriesUsed: _transportRetriesUsed, signal,
             }),
         );
+        const _sendEndedAt = Date.now();
         if (_sendResult.action === 'retry') {
             delete opts.cacheBreakIntent;
             contextOverflowRetryUsed = true;
             reactiveOverflowRetryPending = true;
             continue;
         }
+        if (_sendResult.action === 'retry_transport') {
+            _transportRetriesUsed += 1;
+            delete opts.cacheBreakIntent;
+            continue;
+        }
         response = _sendResult.response;
         opts.onToolCall = undefined;
         delete opts.cacheBreakIntent;
@@ -821,11 +841,26 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             const continuationSignal = !isOutputLimitStop && stopReason !== 'refusal'
                 ? providerContinuationSignal(response)
                 : null;
-            if (continuationSignal && pushIntermediateAssistantResponse(response)) {
+            if (continuationSignal && _continuationsSinceToolBatch >= PROVIDER_CONTINUATION_NO_TOOL_LIMIT) {
+                // Text-only continuation runaway: stop honoring the signal and
+                // fall through to the terminal handling below, which accepts
+                // the current content as the final answer (or ends the loop).
+                process.stderr.write(`[loop] provider continuation cap ${PROVIDER_CONTINUATION_NO_TOOL_LIMIT} reached without tool calls (sess=${sessionId || 'unknown'}); accepting current text as final.\n`);
+                try {
+                    appendAgentTrace({
+                        sessionId,
+                        iteration: iterations,
+                        kind: 'steer',
+                        payload: { tag: 'provider_continuation_no_tool_cap', count: _continuationsSinceToolBatch },
+                        agent: sessionAgent || null,
+                    });
+                } catch { /* best-effort */ }
+            } else if (continuationSignal && pushIntermediateAssistantResponse(response)) {
                 if (hasContent && !suppressMidTurnText) {
                     try { opts.onAssistantText?.(response.content); } catch { /* best-effort */ }
                 }
                 _providerContinuationCount += 1;
+                _continuationsSinceToolBatch += 1;
                 _emptyNudgeStreak = 0;
                 try {
                     appendAgentTrace({
@@ -1005,6 +1040,7 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             continue;
         }
         try { opts.onToolPhaseStarted?.(); } catch {}
+        const _toolsT0 = Date.now();
         ({ dedupStubTotal: _dedupStubTotal, editCount: _editCount } = await processToolBatch({
             calls: _callsToExecute, messages, tools, cwd, sessionId, sessionRef, signal, opts,
             iterations, assistantTurnMsg: _assistantTurnMsg,
@@ -1017,7 +1053,17 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         }));
         // Settle the stop hook on the batch that actually executed.
         _toolFailureStopHook.endBatch(_callsToExecute);
+        // Loop-phase timing (diagnostics): where non-model time goes per
+        // iteration — presend (repair/compact/snapshot), send (provider
+        // round-trip incl. streaming), tools (batch execution). Gated by the
+        // same env as [turn-timing] so bench runs opt in via -AgentEnv.
+        if (process.env.MIXDOG_TURN_TIMING === '1') {
+            try {
+                process.stderr.write(`[loop-timing] iter=${nextIteration} presend=${sendStartedAt - _iterT0}ms send=${_sendEndedAt - sendStartedAt}ms tools=${Date.now() - _toolsT0}ms calls=${_callsToExecute.length}\n`);
+            } catch { /* diagnostics only */ }
+        }
         _toolBatchJustCompleted = true;
+        _continuationsSinceToolBatch = 0;
         _lastToolBatchHadSleep = _callsToExecute.some(isSleepLikeToolCall);
     }
     // Classify WHY the loop ended so agent-tool can promote an empty/abnormal

package/src/runtime/agent/orchestrator/session/loop/stop-hooks.mjs

@@ -14,6 +14,8 @@
 
 export const STOP_HOOK_SOURCE = 'tool-failure-stop-hook';
 
+import { isInformationalShellExitOne } from '../result-classification.mjs';
+
 // Only a genuinely EXECUTED result resolves a failure, i.e. kind 'normal'.
 // Cache hits ('cache-hit' / 'scoped-cache-hit') replay an earlier result
 // without running anything, and dedup/guard skips ('skipped') execute nothing
@@ -59,6 +61,13 @@ export function createToolFailureStopHook() {
             // nothing was dispatched — they must not arm the hook.
             if (message.guardSkip === true) return;
             if (message.toolKind === 'error') {
+                // Informational exit-1 probes (grep-family no-match inside a
+                // compound command: useful stdout, blank stderr) stay 'error'
+                // for display/history, but blocking the terminal message over
+                // them forces a pointless re-verify turn — observed live
+                // (kv-store-grpc: /proc PID scan exit 1 → hook misfire, +2
+                // turns). Neutral here: neither arms nor clears.
+                if (isInformationalShellExitOne(message.content)) return;
                 batchFailure = true;
                 if (message.toolCallId) failedCallIds.add(message.toolCallId);
             } else if (EXECUTED_SUCCESS_TOOL_KINDS.has(message.toolKind)) {

package/src/runtime/agent/orchestrator/session/loop/stored-tool-args.mjs

@@ -28,6 +28,30 @@ const STORED_TOOL_ARG_LIMIT = 10_000;
 const STORED_TOOL_ARG_PREVIEW_HEAD = 360;
 const STORED_TOOL_ARG_PREVIEW_TAIL = 160;
 
+// File paths a compacted patch touched, so the marker itself tells the model
+// WHICH files to re-read instead of replaying the marker as patch input
+// (measured: the compacted-placeholder resubmission was 39% of apply_patch
+// failures). Marker contract: the returned text may not contain ']' or a
+// newline, so bracket characters are stripped from paths.
+function _compactedPatchTargets(value) {
+    const seen = new Set();
+    const add = (raw) => {
+        const p = String(raw || '').trim().replace(/[\[\]\r\n]/g, '');
+        if (p && p !== '/dev/null' && !seen.has(p)) seen.add(p);
+    };
+    const v4a = /^\*\*\*\s*(?:Update|Add|Delete) File:\s*(.+)$/gim;
+    for (let m; seen.size < 12 && (m = v4a.exec(value));) add(m[1]);
+    if (!seen.size) {
+        const uni = /^(?:\+\+\+|---)\s+(?:[ab]\/)?(\S+)/gm;
+        for (let m; seen.size < 12 && (m = uni.exec(value));) add(m[1]);
+    }
+    const all = [...seen];
+    const shown = all.slice(0, 4).map((p) => (p.length > 70 ? `…${p.slice(-70)}` : p));
+    if (!shown.length) return '';
+    const more = all.length > shown.length ? ` +${all.length - shown.length} more` : '';
+    return `${shown.join(', ')}${more}`;
+}
+
 function compactStoredToolArgString(value, key = '', opts = {}) {
     if (typeof value !== 'string') return value;
     const isBody = STORED_TOOL_ARG_BODY_KEY_RE.test(key);
@@ -39,8 +63,11 @@ function compactStoredToolArgString(value, key = '', opts = {}) {
     // Body markers carry the recovery instruction inline: the compaction
     // detectors only require the `[mixdog compacted ...]` shape (no ']' or
     // newline inside), so the longer text stays fully compatible.
+    const targets = /^patch$/i.test(key) ? _compactedPatchTargets(value) : '';
     const marker = isBody
-        ? `[mixdog compacted ${key}: ${value.length} chars, sha256:${hash}; already applied - do not copy; re-read the file and write a fresh patch]`
+        ? (targets
+            ? `[mixdog compacted ${key}: ${value.length} chars, sha256:${hash}; already applied to ${targets} - do not copy; re-read those files and write a fresh patch]`
+            : `[mixdog compacted ${key}: ${value.length} chars, sha256:${hash}; already applied - do not copy; re-read the file and write a fresh patch]`)
         : `[mixdog compacted ${key || 'string'}: ${value.length} chars, sha256:${hash}; do not copy]`;
     // Body args (patch / old_string / new_string / content / rewrite) are
     // apply_patch / edit inputs. Keeping a head/tail preview leaves real patch

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -318,7 +318,11 @@ export function createSession(opts) {
     const hasCallerAllow = Array.isArray(opts.schemaAllowedTools);
     const tools = finalizeSessionToolList(toolsForRouting, {
         schemaAllowedTools: hasCallerAllow ? opts.schemaAllowedTools : null,
-        disallowedTools: hiddenAgent ? [...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []), 'Skill'] : opts.disallowedTools,
+        disallowedTools: [
+            ...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []),
+            ...(hiddenAgent ? ['Skill'] : []),
+            ...(!ownerIsAgent && workflowDisallowsAgentTool(opts.workflow) ? ['agent'] : []),
+        ],
         ownerIsAgent,
         resolvedAgent,
     });
@@ -499,6 +503,17 @@ const ACTIVE_OWNER_HB_FRESH_MS = 2 * 60 * 1000; // heartbeat freshness window
 const PREPARED_RESUME_LIMIT = 8;
 const _preparedResumes = new Map();
 
+// A workflow that delegates to NOBODY (agents: declared empty — e.g. Solo)
+// must not put the `agent` tool in the session tool list: policy rejects
+// every call, so a schema-visible tool is a guaranteed error turn plus dead
+// schema weight. Field source: workflowSummary() carries agentsConfigured /
+// agents; older persisted sessions lack them and keep the tool (safe).
+function workflowDisallowsAgentTool(workflow) {
+    return Boolean(workflow && typeof workflow === 'object'
+        && workflow.agentsConfigured === true
+        && Array.isArray(workflow.agents) && workflow.agents.length === 0);
+}
+
 function _prepareResumeTools(session, preset) {
     const ownerIsAgent = isAgentOwner(session);
     const skills = ownerIsAgent ? [] : collectPromptSkillsCached(session.cwd);
@@ -521,7 +536,10 @@ function _prepareResumeTools(session, preset) {
         ownerIsAgent,
         tools: finalizeSessionToolList(toolsForRouting, {
             schemaAllowedTools: Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null,
-            disallowedTools: getHiddenAgent(session.agent || null) ? ['Skill'] : null,
+            disallowedTools: [
+                ...(getHiddenAgent(session.agent || null) ? ['Skill'] : []),
+                ...(!isAgentOwner(session) && workflowDisallowsAgentTool(session.workflow) ? ['agent'] : []),
+            ],
             ownerIsAgent,
             resolvedAgent: session.agent || null,
         }),

package/src/runtime/agent/orchestrator/session/result-classification.mjs

@@ -68,3 +68,31 @@ export function classifyResultKind(result, explicitSuccess = false) {
     }
     return 'normal';
 }
+
+/**
+ * Informational shell exit-1: `Error: [shell-run-failed] [exit code: 1]`
+ * with a non-empty stdout body and NO stderr evidence (neither an inline
+ * `[stderr]` block nor a `[stderr: path]` spill). grep-family "no match"
+ * semantics inside compound probes (loops, `;`-chains, substitutions) land
+ * exactly here: the run produced useful output, wrote nothing to stderr,
+ * and exited 1 only because the final stage matched nothing. The static
+ * single-pipeline gate (bash-tool _isBenignSearchExitOne) deliberately
+ * refuses these ambiguous shapes, so the result stays toolKind 'error' —
+ * consumers that must not overreact to an informational failure (the turn
+ * stop hook) test this signature instead of reclassifying the result.
+ * Signals, timeouts, and other exit codes carry different status markers
+ * and never match; a destructive-warning prefix also disqualifies.
+ *
+ * @param {unknown} result
+ * @returns {boolean}
+ */
+export function isInformationalShellExitOne(result) {
+    if (typeof result !== 'string') return false;
+    const trimmed = result.trimStart();
+    const header = /^error:\s*\[shell-run-failed\]\s*\[exit code: 1\]\s*\n/i.exec(trimmed);
+    if (!header) return false;
+    const payload = trimmed.slice(header[0].length).trim();
+    if (!payload || payload === '(no output)') return false;
+    if (payload.startsWith('[stderr') || payload.includes('\n[stderr')) return false;
+    return true;
+}

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -5,7 +5,8 @@
 // pass), and unrecoverable errors throw. Behavior identical to the inline
 // try/catch it replaced.
 import { appendAgentTrace } from '../agent-trace.mjs';
-import { isContextOverflowError } from '../providers/retry-classifier.mjs';
+import { classifyError, isContextOverflowError } from '../providers/retry-classifier.mjs';
+import { setTimeout as sleepMs } from 'timers/promises';
 import { readStreamOutcome } from '../providers/lib/stream-outcome.mjs';
 import { resolveWorkerCompactPolicy } from './loop/compact-policy.mjs';
 import { agentContextOverflowError } from './loop/context-overflow.mjs';
@@ -35,21 +36,126 @@ function normalizedIncompleteUsage(raw) {
     };
 }
 
+// Loop-level transport replay (codex retry_transport parity). The provider
+// layer already retries transient failures with a ~15s total envelope
+// (PROVIDER_RETRY_BACKOFF_MS); a real network blip (router/VPN flap — the
+// 2026-08-02 17:37 incident also dropped the Discord gateway) outlasts it and
+// used to surface as a failed turn. When the stream exposed NOTHING
+// (replaySafe: no relayed text/reasoning, no dispatched tool call), re-sending
+// the identical request is side-effect-free, so wait out the blip and retry
+// the send at the loop level. Two attempts, 5s/15s — combined with the
+// provider envelope this covers ~50s outages before failing honestly.
+const TRANSPORT_RETRY_BACKOFF_MS = Object.freeze([5_000, 15_000]);
+export const TRANSPORT_RETRY_MAX = TRANSPORT_RETRY_BACKOFF_MS.length;
+
 export async function sendWithRecovery(ctx) {
     const {
         provider, messages, model, sendTools, tools, opts,
         sessionId, sessionRef, nextIteration, contextOverflowRetryUsed,
+        transportRetriesUsed = 0, signal,
     } = ctx;
     let response;
+    // Bench-only turn timing (MIXDOG_TURN_TIMING=1): one stderr line per
+    // provider request — TTFT (first stream delta) and total stream time.
+    // Inert unless the env flag is set; used to profile harness vs model
+    // latency in Terminal-Bench runs.
+    const turnT0 = process.env.MIXDOG_TURN_TIMING === '1' ? Date.now() : 0;
+    let turnFirstDelta = 0;
+    let timedOpts = opts;
+    if (turnT0) {
+        const prevDelta = typeof opts?.onStreamDelta === 'function' ? opts.onStreamDelta : null;
+        timedOpts = {
+            ...(opts || {}),
+            onStreamDelta: (kind) => {
+                if (!turnFirstDelta) turnFirstDelta = Date.now();
+                if (prevDelta) prevDelta(kind);
+            },
+        };
+    }
+    const logTurnTiming = (status) => {
+        if (!turnT0) return;
+        const now = Date.now();
+        const ttft = turnFirstDelta ? turnFirstDelta - turnT0 : -1;
+        try {
+            console.error(`[turn-timing] status=${status} ttft=${ttft}ms total=${now - turnT0}ms model=${model}`);
+        } catch { /* logging must never break the send path */ }
+    };
+    // Loop-side exposure witness. Some providers throw truncation/stall
+    // errors that carry only partialContent — neither liveTextEmitted nor
+    // unsafeToRetry — so an outcome read from the ERROR alone can report
+    // replaySafe even though this very send already relayed text to the
+    // client through opts.onTextDelta, or dispatched a tool call through
+    // opts.onToolCall. Replaying such a send would duplicate output the user
+    // already saw (or re-run a side effect), so record what THIS send
+    // actually exposed and merge it into every outcome read below. The
+    // callbacks are wrapped in place and restored conditionally: the
+    // overflow-retry branch intentionally clears opts.onToolCall, and that
+    // clear must survive the restore.
+    const relayWitness = { textEmitted: false, toolCallsDispatched: 0 };
+    const prevOnTextDelta = typeof opts?.onTextDelta === 'function' ? opts.onTextDelta : null;
+    const prevOnToolCall = typeof opts?.onToolCall === 'function' ? opts.onToolCall : null;
+    const witnessedOnTextDelta = prevOnTextDelta
+        ? (...args) => {
+            if (typeof args[0] === 'string' && args[0].length > 0) relayWitness.textEmitted = true;
+            return prevOnTextDelta(...args);
+        }
+        : null;
+    const witnessedOnToolCall = prevOnToolCall
+        ? (...args) => {
+            relayWitness.toolCallsDispatched += 1;
+            return prevOnToolCall(...args);
+        }
+        : null;
+    if (opts) {
+        if (witnessedOnTextDelta) opts.onTextDelta = witnessedOnTextDelta;
+        if (witnessedOnToolCall) opts.onToolCall = witnessedOnToolCall;
+    }
+    if (timedOpts !== opts && timedOpts) {
+        if (witnessedOnTextDelta) timedOpts.onTextDelta = witnessedOnTextDelta;
+        if (witnessedOnToolCall) timedOpts.onToolCall = witnessedOnToolCall;
+    }
+    try {
         try {
-            response = await provider.send(messages, model, sendTools.length ? sendTools : undefined, opts);
+            response = await provider.send(messages, model, sendTools.length ? sendTools : undefined, timedOpts);
+            logTurnTiming('ok');
         } catch (sendErr) {
+            logTurnTiming(`err:${sendErr?.code || sendErr?.name || 'unknown'}`);
             // Canonical stream outcome: ONE fail-closed read of what the
             // provider stream actually produced (terminal vs continuation,
             // observed text/reasoning, partial/complete/dispatched tool calls).
             // Every branch below consumes it instead of re-inferring safety
             // from provider-specific flags.
-            const outcome = readStreamOutcome(sendErr);
+            const outcome = readStreamOutcome(sendErr, relayWitness);
+            // Text-only exposure retraction (cross-provider): a stream that
+            // died after relaying ONLY text — no dispatched or complete tool
+            // calls, no terminal — is replayable IF the ask owner retracts the
+            // exposed characters (onTextReset ack === true: the TUI truncates
+            // its live tail, the bench driver truncates its accumulator).
+            // This is the loop-level analogue of anthropic's
+            // recoverNonStreaming for providers WITHOUT a non-streaming
+            // fallback (gemini, openai-compat, openai WS) and for stalls that
+            // outlived the provider's in-place recovery. Observed live:
+            // make-mips-interpreter died with 31 exposed chars + a pending
+            // never-dispatched tool input and burned the whole trial.
+            const retractExposedTextForReplay = async () => {
+                if (outcome.terminalObserved === true) return false;
+                if (outcome.sideEffectDispatched === true) return false;
+                if (outcome.dispatchAmbiguous === true) return false;
+                if (Number(outcome.toolCallsDispatched) > 0) return false;
+                if (Number(outcome.toolCallsComplete) > 0) return false;
+                if (relayWitness.toolCallsDispatched > 0) return false;
+                if (typeof opts?.onTextReset !== 'function') return false;
+                const chars = Math.max(0, Number(outcome.textObservedChars) || 0)
+                    || (typeof sendErr.partialContent === 'string' ? sendErr.partialContent.length : 0);
+                if (chars <= 0) return false;
+                let acked = false;
+                try {
+                    acked = await opts.onTextReset({ chars, reason: 'loop-transport-retraction' }) === true;
+                } catch { acked = false; }
+                if (!acked) return false;
+                relayWitness.textEmitted = false;
+                return true;
+            };
             // Gemini REST/SDK reports MAX_TOKENS by throwing a typed
             // ProviderIncompleteError after preserving the streamed candidate.
             // Normalize only that exact, safe no-tool output-limit shape into a
@@ -101,6 +207,36 @@ export async function sendWithRecovery(ctx) {
                 && sendErr.partialContent.trim().length > 0
                 && outcome.toolCallsComplete === 0
             ) {
+                // Retractable shape: text-only exposure with the owner's
+                // acknowledgement replays on a fresh request instead of
+                // failing the turn. Non-acked (or tool-bearing) shapes keep
+                // the explicit-failure contract below unchanged.
+                if (
+                    transportRetriesUsed < TRANSPORT_RETRY_MAX
+                    && classifyError(sendErr) === 'transient'
+                    && await retractExposedTextForReplay()
+                ) {
+                    const waitMs = TRANSPORT_RETRY_BACKOFF_MS[transportRetriesUsed];
+                    try {
+                        process.stderr.write(
+                            `[loop] exposed-text stall retracted (sess=${sessionId || 'unknown'} `
+                            + `iter=${nextIteration} len=${sendErr.partialContent.length}); `
+                            + `transport retry ${transportRetriesUsed + 1}/${TRANSPORT_RETRY_MAX} after ${waitMs}ms\n`,
+                        );
+                    } catch { /* best-effort */ }
+                    try {
+                        appendAgentTrace({
+                            kind: 'exposed_text_retraction_retry',
+                            sessionId: sessionId || null,
+                            iteration: nextIteration,
+                            attempt: transportRetriesUsed + 1,
+                            waitMs,
+                            partialContentLen: sendErr.partialContent.length,
+                        });
+                    } catch { /* best-effort */ }
+                    await sleepMs(waitMs, undefined, signal ? { signal } : undefined);
+                    return { action: 'retry_transport' };
+                }
                 try {
                     process.stderr.write(
                         `[loop] final stream stalled with partial text (sess=${sessionId || 'unknown'} `
@@ -185,6 +321,35 @@ export async function sendWithRecovery(ctx) {
                 };
                 return { action: 'proceed', response };
             } else
+            // Clean transient transport failure with zero exposure: replay the
+            // send after a bounded wait instead of failing the turn.
+            if (
+                transportRetriesUsed < TRANSPORT_RETRY_MAX
+                && classifyError(sendErr) === 'transient'
+                && (outcome.replaySafe === true || await retractExposedTextForReplay())
+            ) {
+                const waitMs = TRANSPORT_RETRY_BACKOFF_MS[transportRetriesUsed];
+                try {
+                    process.stderr.write(
+                        `[loop] transient send failure with no observed output (sess=${sessionId || 'unknown'} `
+                        + `iter=${nextIteration} code=${sendErr?.code ?? sendErr?.status ?? 'n/a'}); `
+                        + `transport retry ${transportRetriesUsed + 1}/${TRANSPORT_RETRY_MAX} after ${waitMs}ms\n`,
+                    );
+                } catch { /* best-effort */ }
+                try {
+                    appendAgentTrace({
+                        kind: 'transport_retry',
+                        sessionId: sessionId || null,
+                        iteration: nextIteration,
+                        attempt: transportRetriesUsed + 1,
+                        waitMs,
+                        code: sendErr?.code ?? null,
+                        status: sendErr?.status ?? null,
+                    });
+                } catch { /* best-effort */ }
+                await sleepMs(waitMs, undefined, signal ? { signal } : undefined);
+                return { action: 'retry_transport' };
+            } else
             // Context-window-exceeded is a deterministic refusal from the API.
             // Recover context overflow reactively by compacting and retrying
             // in the same active turn. MixDog's proactive estimator can miss a
@@ -236,5 +401,13 @@ export async function sendWithRecovery(ctx) {
                 messageTokensEst: estimateMessagesTokensSafe(messages),
             }, sendErr);
         }
+    } finally {
+        // Conditional restore: only unwind our own wrappers. An intentional
+        // opts.onToolCall = undefined (overflow-retry branch) stays cleared.
+        if (opts) {
+            if (witnessedOnTextDelta && opts.onTextDelta === witnessedOnTextDelta) opts.onTextDelta = prevOnTextDelta;
+            if (witnessedOnToolCall && opts.onToolCall === witnessedOnToolCall) opts.onToolCall = prevOnToolCall;
+        }
+    }
     return { action: 'proceed', response };
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -1,5 +1,5 @@
 import { getAbortSignalForSession } from '../../session/abort-lookup.mjs';
-import { execShellCommand, stripAnsi } from '../shell-command.mjs';
+import { acquireShellLeaseBounded, execShellCommand, stripAnsi } from '../shell-command.mjs';
 import { wrapCommandWithSnapshot } from '../shell-snapshot.mjs';
 import { getDestructiveCommandWarning } from '../destructive-warning.mjs';
 import { maybeRewriteWmicProcessCommand } from '../shell-policy.mjs';
@@ -21,6 +21,11 @@ import {
 } from './shell-jobs.mjs';
 import {
     analyzeShellCommandEffects,
+    buildPowerShellFilterTeePlan,
+    consumeFilterTeeCapture,
+    detectBlockedSleepPattern,
+    detectLongForegroundReason,
+    extractShellApplyPatchInvocation,
     foregroundLongCommandHint,
     isAutobackgroundingAllowed,
     preflightPowerShellHygiene,
@@ -241,7 +246,7 @@ export async function executeBashTool(args, workDir, options = {}) {
     const bashWorkDir = resolveSessionCwd(_sessionCwdKey, _hasExplicitCwd ? cwdResult.cwd : null, cwdResult.cwd);
     const _readStateScope = options?.readStateScope ?? options?.sessionId ?? null;
     const executionMode = resolveExecutionMode(args || {}, args?.run_in_background === true ? 'async' : 'sync');
-    const runInBackground = executionMode === 'async';
+    let runInBackground = executionMode === 'async';
 
     // Run hard-block policy BEFORE branching into the persistent-shell tool.
     // The persistent path used to bypass the one-shot block scan because the
@@ -251,6 +256,21 @@ export async function executeBashTool(args, workDir, options = {}) {
     // decode + rm token guard; calling it here applies the same allowlist
     // to both persistent and stateless paths.
     const _rawCmd = String(args && args.command != null ? args.command : '');
+    // Codex-parity: `apply_patch` typed into the shell (heredoc/argument/bare
+    // patch forms) routes to the internal patch engine instead of failing as
+    // an unknown binary. Runs BEFORE the exec-policy scan so patch BODY lines
+    // (e.g. `+ rm -rf …`) are never misread as shell commands. Dynamic import
+    // avoids a bash-tool <-> patch/orchestrator module cycle.
+    if (_rawCmd) {
+        const _apCall = extractShellApplyPatchInvocation(_rawCmd);
+        if (_apCall?.error) {
+            return formatShellToolFailure(`${_apCall.error}. Call the apply_patch tool with the patch string instead of the shell.`);
+        }
+        if (_apCall?.patch) {
+            const { executePatchTool } = await import('../patch/orchestrator.mjs');
+            return executePatchTool('apply_patch', { patch: _apCall.patch }, bashWorkDir, options);
+        }
+    }
     if (_rawCmd) {
         // R5-③: persistent:true used to route into bash_session BEFORE the
         // stripQuotedAndHeredoc / extractShellCInner / unquote sweep ran
@@ -339,6 +359,29 @@ export async function executeBashTool(args, workDir, options = {}) {
         return formatShellToolFailure(_execPolicyBlock);
     }
 
+    // Sleep-chain auto-promotion: a leading `sleep N && …` / `Start-Sleep N; …`
+    // used to be DENIED preflight (CC detectBlockedSleepPattern parity).
+    // Measured over 10 days the deny fired 46× and every hit was a wasted
+    // turn, so the command is promoted to a background task instead — the
+    // exact remedy the deny message pointed at, without the failure. Only
+    // possible while background tasks are enabled; with them disabled the
+    // command runs foreground as before (the deny never fired there either).
+    const _bgTasksDisabled = /^(1|true|yes|on)$/i.test(
+        String(process.env.MIXDOG_SHELL_DISABLE_BACKGROUND_TASKS || '').trim(),
+    );
+    let autoAsyncReason = '';
+    if (!runInBackground && !_bgTasksDisabled) {
+        // Long-foreground shapes (watch-like dev servers/watchers, 30s+ sleeps
+        // anywhere in the chain) used to hard-fail via foregroundLongCommandHint
+        // (~22 wasted turns/14d measured). Promote them to a background task —
+        // the exact remedy the deny message pointed at — same as sleep chains.
+        const _blockedSleep = detectBlockedSleepPattern(command) || detectLongForegroundReason(command);
+        if (_blockedSleep) {
+            runInBackground = true;
+            autoAsyncReason = _blockedSleep;
+        }
+    }
+
     let shellEffects;
     let combinedBashAbort = null;
     try {
@@ -372,9 +415,6 @@ export async function executeBashTool(args, workDir, options = {}) {
         : DEFAULT_BASH_TIMEOUT_MS;
     const hasExplicitTimeout = typeof args.timeout === 'number' && args.timeout > 0;
     const timeoutMs = hasExplicitTimeout ? args.timeout : defaultTimeoutMs;
-    const _bgTasksDisabled = /^(1|true|yes|on)$/i.test(
-        String(process.env.MIXDOG_SHELL_DISABLE_BACKGROUND_TASKS || '').trim(),
-    );
     const backgroundOnTimeout = !runInBackground
         && !_bgTasksDisabled
         && isAutobackgroundingAllowed(command, resolvedSpec.shellType);
@@ -429,11 +469,20 @@ export async function executeBashTool(args, workDir, options = {}) {
         scrubLoaderVars(spawnEnv);
         scrubRuntimeRootVars(spawnEnv);
         let wrappedCommand;
+        let _teePlan = null;
         // PowerShell UTF-8 prefix is PS-only: the Windows Git Bash path
         // (shellType==='posix') must NOT receive it. Snapshot wrapper stays
         // POSIX-host-only for now — no snapshot for Windows Git Bash initially.
         if (process.platform === 'win32' && shellType === 'powershell') {
-            wrappedCommand = _prefixPowerShellUtf8(command);
+            // Filter-swallow rescue (sync path only): tee the unfiltered
+            // producer stream of an exactly-recognized filter pipeline so a
+            // failing run can attach the original output tail in THIS call
+            // instead of returning `[exit code: N]` + `(no output)`. Any
+            // ambiguity yields a null plan and the command runs untouched.
+            if (!runInBackground) {
+                try { _teePlan = buildPowerShellFilterTeePlan(command); } catch { _teePlan = null; }
+            }
+            wrappedCommand = _prefixPowerShellUtf8(_teePlan ? _teePlan.command : command);
         } else if (process.platform !== 'win32' && (shell.includes('bash') || shell.includes('zsh'))) {
             try {
                 wrappedCommand = await wrapCommandWithSnapshot(shell, command);
@@ -451,8 +500,8 @@ export async function executeBashTool(args, workDir, options = {}) {
             let asyncLease = null;
             let job;
             try {
-                asyncLease = await (options?.resourceAdmission || resourceAdmission).acquire('shell', {
-                    signal: combinedAsyncAbort.signal,
+                asyncLease = await acquireShellLeaseBounded(options?.resourceAdmission || resourceAdmission, {
+                    abortSignal: combinedAsyncAbort.signal,
                     label: String(command).replace(/\s+/g, ' ').slice(0, 120),
                     dependency: 'detached',
                 });
@@ -525,7 +574,10 @@ export async function executeBashTool(args, workDir, options = {}) {
                         clientHostPid: options?.clientHostPid,
                     });
                 } catch { /* watcher arm is best-effort; never blocks the spawn */ }
-                return _prependDestructiveWarning(command, renderBackgroundTask(task));
+                const _autoAsyncNote = autoAsyncReason
+                    ? `[auto-async] ${autoAsyncReason} — promoted to a background task; act on its completion notification instead of blocking (do not poll).\n`
+                    : '';
+                return _prependDestructiveWarning(command, _autoAsyncNote + renderBackgroundTask(task));
             } catch (error) {
                 if (job?.jobId && !job.error) {
                     try { killShellJob(job.jobId); } catch {}
@@ -643,6 +695,17 @@ export async function executeBashTool(args, workDir, options = {}) {
         const benignExitOne = _isBenignSearchExitOne(command, exitCode, signal, stderr);
         const shellRunFailed = !shellToolFailed && (!!signal || (exitCode !== 0 && exitCode !== null && !benignExitOne));
         const isReallyErrored = shellToolFailed || shellRunFailed;
+        // Filter-swallow rescue: the tee file is ALWAYS consumed (deleted)
+        // here; its tail is attached only when the run failed with an empty
+        // visible capture — the exact `(no output)` shape that previously
+        // cost the model extra diagnostic turns.
+        let _rescueNote = '';
+        if (_teePlan) {
+            const _rescueTail = consumeFilterTeeCapture(_teePlan.teePath);
+            if (isReallyErrored && _rescueTail && !stdout.trim() && !stderr.trim()) {
+                _rescueNote = `\n\n[filter-swallowed output rescue] the command failed but its trailing filter(s) matched nothing, so the visible output was empty. Unfiltered pipeline output (tail):\n${smartMiddleTruncate(_rescueTail)}`;
+            }
+        }
         const _driftNote = '';
         // Distinct timeout marker so callers see "killed by timeout after Nms"
         // vs an external signal (e.g. user Ctrl-C, OOM kill). result.timedOut
@@ -666,7 +729,7 @@ export async function executeBashTool(args, workDir, options = {}) {
             // cross-stream interleaving. Acceptable for most diagnostic
             // outputs; flag in shell-command if exact interleaving is required.
             const merged = stdout + stderr;
-            if (statusMarker) return _prependDestructiveWarning(command, errorPrefix + smartMiddleTruncate(`${statusMarker}\n\n${merged || '(no output)'}`) + _driftNote);
+            if (statusMarker) return _prependDestructiveWarning(command, errorPrefix + smartMiddleTruncate(`${statusMarker}\n\n${merged || '(no output)'}`) + _rescueNote + _driftNote);
             return _prependDestructiveWarning(command, smartMiddleTruncate(merged || '(no output)') + _driftNote);
         }
         const truncatedStdout = smartMiddleTruncate(stdout);
@@ -688,7 +751,7 @@ export async function executeBashTool(args, workDir, options = {}) {
         const warningBlock = [
             wmicRewrite?.note || '',
         ].filter(Boolean).join('\n');
-        const payload = `${body}${stderrBlock}${spillBlock}${_driftNote}`;
+        const payload = `${body}${stderrBlock}${spillBlock}${_rescueNote}${_driftNote}`;
         if (statusMarker) return _prependDestructiveWarning(command, _composeShellFailure(statusMarker, errorPrefix, warningBlock, payload));
         return _prependDestructiveWarning(command, warningBlock ? `${warningBlock}\n${payload}` : payload);
     }