mixdog 0.9.91 → 0.9.93

package/src/runtime/agent/orchestrator/session/manager.mjs

@@ -126,7 +126,7 @@ export {
     updateSessionManualTitle,
     flushSessionMetrics,
 } from './manager/session-crud.mjs';
-export { deleteSession } from './store.mjs';
+export { deleteSession, listOwnedAgentSessionIds } from './store.mjs';
 // Read-only parsed-session access (desktop pane peek): no resume, no
 // ownership, no liveness side effects.
 export { loadSession } from './store.mjs';

package/src/runtime/agent/orchestrator/session/result-classification.mjs

@@ -68,3 +68,31 @@ export function classifyResultKind(result, explicitSuccess = false) {
     }
     return 'normal';
 }
+
+/**
+ * Informational shell exit-1: `Error: [shell-run-failed] [exit code: 1]`
+ * with a non-empty stdout body and NO stderr evidence (neither an inline
+ * `[stderr]` block nor a `[stderr: path]` spill). grep-family "no match"
+ * semantics inside compound probes (loops, `;`-chains, substitutions) land
+ * exactly here: the run produced useful output, wrote nothing to stderr,
+ * and exited 1 only because the final stage matched nothing. The static
+ * single-pipeline gate (bash-tool _isBenignSearchExitOne) deliberately
+ * refuses these ambiguous shapes, so the result stays toolKind 'error' —
+ * consumers that must not overreact to an informational failure (the turn
+ * stop hook) test this signature instead of reclassifying the result.
+ * Signals, timeouts, and other exit codes carry different status markers
+ * and never match; a destructive-warning prefix also disqualifies.
+ *
+ * @param {unknown} result
+ * @returns {boolean}
+ */
+export function isInformationalShellExitOne(result) {
+    if (typeof result !== 'string') return false;
+    const trimmed = result.trimStart();
+    const header = /^error:\s*\[shell-run-failed\]\s*\[exit code: 1\]\s*\n/i.exec(trimmed);
+    if (!header) return false;
+    const payload = trimmed.slice(header[0].length).trim();
+    if (!payload || payload === '(no output)') return false;
+    if (payload.startsWith('[stderr') || payload.includes('\n[stderr')) return false;
+    return true;
+}

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -126,6 +126,36 @@ export async function sendWithRecovery(ctx) {
             // Every branch below consumes it instead of re-inferring safety
             // from provider-specific flags.
             const outcome = readStreamOutcome(sendErr, relayWitness);
+            // Text-only exposure retraction (cross-provider): a stream that
+            // died after relaying ONLY text — no dispatched or complete tool
+            // calls, no terminal — is replayable IF the ask owner retracts the
+            // exposed characters (onTextReset ack === true: the TUI truncates
+            // its live tail, the bench driver truncates its accumulator).
+            // This is the loop-level analogue of anthropic's
+            // recoverNonStreaming for providers WITHOUT a non-streaming
+            // fallback (gemini, openai-compat, openai WS) and for stalls that
+            // outlived the provider's in-place recovery. Observed live:
+            // make-mips-interpreter died with 31 exposed chars + a pending
+            // never-dispatched tool input and burned the whole trial.
+            const retractExposedTextForReplay = async () => {
+                if (outcome.terminalObserved === true) return false;
+                if (outcome.sideEffectDispatched === true) return false;
+                if (outcome.dispatchAmbiguous === true) return false;
+                if (Number(outcome.toolCallsDispatched) > 0) return false;
+                if (Number(outcome.toolCallsComplete) > 0) return false;
+                if (relayWitness.toolCallsDispatched > 0) return false;
+                if (typeof opts?.onTextReset !== 'function') return false;
+                const chars = Math.max(0, Number(outcome.textObservedChars) || 0)
+                    || (typeof sendErr.partialContent === 'string' ? sendErr.partialContent.length : 0);
+                if (chars <= 0) return false;
+                let acked = false;
+                try {
+                    acked = await opts.onTextReset({ chars, reason: 'loop-transport-retraction' }) === true;
+                } catch { acked = false; }
+                if (!acked) return false;
+                relayWitness.textEmitted = false;
+                return true;
+            };
             // Gemini REST/SDK reports MAX_TOKENS by throwing a typed
             // ProviderIncompleteError after preserving the streamed candidate.
             // Normalize only that exact, safe no-tool output-limit shape into a
@@ -177,6 +207,40 @@ export async function sendWithRecovery(ctx) {
                 && sendErr.partialContent.trim().length > 0
                 && outcome.toolCallsComplete === 0
             ) {
+                // Retractable shape: text-only exposure with the owner's
+                // acknowledgement replays on a fresh request instead of
+                // failing the turn. Non-acked (or tool-bearing) shapes keep
+                // the explicit-failure contract below unchanged.
+                // NOTE: no classifyError gate here — an exposed stall is
+                // stamped unsafeToRetry, which the general classifier reads as
+                // terminal, but that unsafety is exactly what the retraction
+                // removes (observed live: make-mips-interpreter failed twice
+                // because this guard demanded 'transient' and never fired).
+                if (
+                    transportRetriesUsed < TRANSPORT_RETRY_MAX
+                    && await retractExposedTextForReplay()
+                ) {
+                    const waitMs = TRANSPORT_RETRY_BACKOFF_MS[transportRetriesUsed];
+                    try {
+                        process.stderr.write(
+                            `[loop] exposed-text stall retracted (sess=${sessionId || 'unknown'} `
+                            + `iter=${nextIteration} len=${sendErr.partialContent.length}); `
+                            + `transport retry ${transportRetriesUsed + 1}/${TRANSPORT_RETRY_MAX} after ${waitMs}ms\n`,
+                        );
+                    } catch { /* best-effort */ }
+                    try {
+                        appendAgentTrace({
+                            kind: 'exposed_text_retraction_retry',
+                            sessionId: sessionId || null,
+                            iteration: nextIteration,
+                            attempt: transportRetriesUsed + 1,
+                            waitMs,
+                            partialContentLen: sendErr.partialContent.length,
+                        });
+                    } catch { /* best-effort */ }
+                    await sleepMs(waitMs, undefined, signal ? { signal } : undefined);
+                    return { action: 'retry_transport' };
+                }
                 try {
                     process.stderr.write(
                         `[loop] final stream stalled with partial text (sess=${sessionId || 'unknown'} `
@@ -265,8 +329,13 @@ export async function sendWithRecovery(ctx) {
             // send after a bounded wait instead of failing the turn.
             if (
                 transportRetriesUsed < TRANSPORT_RETRY_MAX
-                && outcome.replaySafe === true
-                && classifyError(sendErr) === 'transient'
+                && (
+                    (outcome.replaySafe === true && classifyError(sendErr) === 'transient')
+                    || (
+                        (classifyError(sendErr) === 'transient' || outcome.stallObserved === true)
+                        && await retractExposedTextForReplay()
+                    )
+                )
             ) {
                 const waitMs = TRANSPORT_RETRY_BACKOFF_MS[transportRetriesUsed];
                 try {

package/src/runtime/agent/orchestrator/session/store/listing.mjs

@@ -64,6 +64,16 @@ const RESUMABLE_OPEN_MAX_COUNT = 300;
 // idle this long — see the blank-scratch branch in sweepStaleSessions.
 const BLANK_SCRATCH_MAX_AGE_MS = 60 * 60 * 1000; // 1h
 
+/** Child-agent transcripts share their visible parent's retention boundary.
+ * Presence (including a tombstone or unreadable file) preserves the child;
+ * only proven parent absence releases it to ordinary cleanup. */
+function retainedLinkedAgent(session) {
+    if (!session || !isAgentOwner(session)) return false;
+    const parentId = String(session.ownerSessionId || session.parentSessionId || '').trim();
+    if (!/^[A-Za-z0-9_-]+$/.test(parentId) || parentId === session.id) return false;
+    return probePath(sessionPath(parentId)).state !== PROBE_ABSENT;
+}
+
 
 export function listStoredSessions(options = {}) {
     const dir = getStoreDir();
@@ -423,6 +433,13 @@ function* sweepStaleSessionSteps(ttlMs, options = {}) {
             // messages), so there is no second, divergent parse of this file.
             const actual = record.doc;
             const diskClosed = record.closed === true || actual.status === 'closed';
+            if (retainedLinkedAgent(actual)) {
+                // Parent-owned agent transcripts are task history, not
+                // ephemeral worker cache. This covers both new open sessions
+                // and tombstones created by older Mixdog versions.
+                remaining++;
+                continue;
+            }
             if (diskClosed) {
                 // A shared store can be tombstoned by another process while
                 // this process still owns an in-flight controller for the same

package/src/runtime/agent/orchestrator/session/store-summary-reader.mjs

@@ -59,6 +59,106 @@ function cleanValue(value) {
     return String(value || '').trim();
 }
 
+function archivedAgentNotification(content, sessionId) {
+    const text = typeof content === 'string' ? content : '';
+    const marker = '\n\nResult:\n';
+    const markerAt = text.indexOf(marker);
+    if (markerAt < 0 || !/The async agent task .* has finished \(/.test(text.slice(0, markerAt))) return null;
+    const lines = text.slice(markerAt + marker.length)
+        .split(/\r?\n/)
+        .map((line) => line.replace(/^>\s?/, ''));
+    const divider = lines.findIndex((line) => line.trim() === '');
+    if (divider < 0) return null;
+    const headers = new Map();
+    for (const line of lines.slice(0, divider)) {
+        const match = /^([A-Za-z][A-Za-z0-9_]*):\s*(.*?)\s*$/.exec(line);
+        if (match) headers.set(match[1], match[2]);
+    }
+    if (headers.get('surface') !== 'agent' || headers.get('sessionId') !== sessionId) return null;
+    const status = cleanValue(headers.get('status')).toLowerCase();
+    if (!/^(?:completed|failed|cancelled)$/.test(status)) return null;
+    const body = lines.slice(divider + 1).join('\n').trim();
+    if (!body) return null;
+    return {
+        body,
+        status,
+        tag: cleanValue(headers.get('tag') || headers.get('label')),
+        agent: cleanValue(headers.get('agent')),
+        provider: cleanValue(headers.get('provider')),
+        model: cleanValue(headers.get('model')),
+        effort: cleanValue(headers.get('effort')),
+        fast: cleanValue(headers.get('fast')).toLowerCase() === 'true',
+        finishedAt: Date.parse(cleanValue(headers.get('finished'))) || 0,
+    };
+}
+
+/** Legacy recovery for child transcripts already unlinked by terminal reaping.
+ * The parent owns one canonical body-carrying completion notification, so scan
+ * only files containing the exact child id and project the newest valid body. */
+function readArchivedAgentResult(sessionId) {
+    const dir = join(dataDir(), 'sessions');
+    if (probePath(dir).state !== PROBE_PRESENT) return null;
+    let files;
+    try { files = readdirSync(dir).filter((file) => file.endsWith('.json')); }
+    catch { return null; }
+    let best = null;
+    for (const file of files) {
+        let raw;
+        try { raw = readFileSync(join(dir, file), 'utf8'); } catch { continue; }
+        if (!raw.includes(sessionId)) continue;
+        const record = readTopLevelLifecycleRecord(raw);
+        if (isLifecycleUnreadable(record) || record.id === sessionId) continue;
+        const parent = record.doc;
+        const messages = Array.isArray(parent.messages) ? parent.messages : [];
+        for (let index = messages.length - 1; index >= 0; index--) {
+            const message = messages[index];
+            if (message?.role !== 'user') continue;
+            const archived = archivedAgentNotification(message.content, sessionId);
+            if (!archived) continue;
+            const at = positiveNumber(
+                message?.meta?.transcript?.at,
+                archived.finishedAt || positiveNumber(parent.updatedAt),
+            );
+            if (best && best.at > at) continue;
+            best = { ...archived, at, parent };
+            break;
+        }
+    }
+    if (!best) return null;
+    const text = `# Archived agent result\n\n${best.body}`;
+    return {
+        sessionId,
+        items: [{
+            id: `archived-agent-result:${sessionId}`,
+            kind: 'assistant',
+            text,
+            status: best.status,
+            ...(best.at ? { at: best.at } : {}),
+            ...(best.model ? { model: best.model } : {}),
+            ...(best.provider ? { provider: best.provider } : {}),
+            ...(best.agent ? { agent: best.agent } : {}),
+        }],
+        provider: best.provider,
+        model: best.model,
+        effort: best.effort,
+        fast: best.fast,
+        cwd: cleanValue(best.parent.cwd),
+        desktopSession: desktopSession(best.parent.desktopSession, best.parent.cwd),
+        workflow: null,
+        stats: {
+            currentContextTokens: 0,
+            currentEstimatedContextTokens: 0,
+            currentContextSource: null,
+        },
+        contextWindow: null,
+        rawContextWindow: null,
+        displayContextWindow: null,
+        autoCompactTokenLimit: null,
+        archivedAgentResult: true,
+        readOnlyDetachedAgent: false,
+    };
+}
+
 function activeAgentWorker(row) {
     const statuses = [row?.stage, row?.status]
         .map(cleanValue)
@@ -421,6 +521,7 @@ export async function readStoredSessionTranscript(id, options = {}) {
     // Same strict authority as the store, and the same fail-closed rule: an
     // absent, unreadable, ambiguous or foreign record yields no transcript.
     const read = readTextFile(join(dataDir(), 'sessions', `${sessionId}.json`));
+    if (read.state === PROBE_ABSENT) return readArchivedAgentResult(sessionId);
     if (read.state !== PROBE_PRESENT) return null;
     const record = readTopLevelLifecycleRecord(read.text);
     if (isLifecycleUnreadable(record) || record.id !== sessionId) return null;

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -1188,6 +1188,36 @@ export function loadSession(id) {
     return stored ? _ensureLifecycleFields(stored) : null;
 }
 
+/** Strictly enumerate child-agent session files linked to one visible parent.
+ * Used only by explicit parent deletion; ordinary close/context switches keep
+ * the relationship intact. */
+export function listOwnedAgentSessionIds(ownerSessionId) {
+    const ownerId = String(ownerSessionId || '').trim();
+    if (!/^[A-Za-z0-9_-]+$/.test(ownerId)) return [];
+    const dir = getStoreDir();
+    if (probePath(dir).state !== PROBE_PRESENT) return [];
+    let files;
+    try {
+        files = readdirSync(dir).filter((file) => file.endsWith('.json'));
+    } catch {
+        return [];
+    }
+    const ids = [];
+    for (const file of files) {
+        const candidateId = file.slice(0, -5);
+        if (!candidateId || candidateId === ownerId || !/^[A-Za-z0-9_-]+$/.test(candidateId)) continue;
+        try {
+            const record = readTopLevelLifecycleRecord(readFileSync(join(dir, file), 'utf8'));
+            if (isLifecycleUnreadable(record) || record.id !== candidateId) continue;
+            const session = record.doc;
+            if (!isAgentOwner(session)) continue;
+            const linkedOwner = String(session.ownerSessionId || session.parentSessionId || '').trim();
+            if (linkedOwner === ownerId) ids.push(candidateId);
+        } catch { /* unreadable/vanished records are never deletion targets */ }
+    }
+    return ids;
+}
+
 
 export function deleteSession(id, options = {}) {
     // Keep caller probes and all vetoes ahead of the non-reentrant lock and

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -37,6 +37,7 @@ import {
     parseNativeToolSearchPayload,
 } from './loop/tool-helpers.mjs';
 import { restoreToolCallBodyForId } from './loop/stored-tool-args.mjs';
+import { commitSessionCwdProbe } from '../tools/shell-state.mjs';
 
 function classifyToolReturn(value) {
     const normalized = normalizeToolEnvelope(value);
@@ -50,6 +51,7 @@ export async function processToolBatch(ctx) {
         crossTurnCalls, crossTurnCap, sessionAgent, steeringLadder,
         pushToolResultMessage, throwIfAborted, repeatFailLimit,
     } = ctx;
+    const executeToolFn = typeof ctx.executeToolFn === 'function' ? ctx.executeToolFn : executeTool;
     let dedupStubTotal = ctx.dedupStubTotal;
     let editCount = ctx.editCount;
         // Execute each tool and append results.
@@ -91,16 +93,11 @@ export async function processToolBatch(ctx) {
         // between two tool results of the same multi-tool turn (which would put a
         // user message between tool(A) and tool(B) and break provider pairing).
         const _batchNewMessages = [];
-        // Ordered-mutation batch gate. apply_patch is a mutation tool (never
-        // eager-dispatchable), so multiple apply_patch calls in ONE assistant
-        // turn already execute serially in call-index order via this loop.
-        // This flag records the FIRST ordered mutation whose execution failed
-        // in this batch; every LATER apply_patch in the same batch is then
-        // skipped (not executed) because its edits may depend on the failed
-        // one and applying them against unchanged/partially-changed files
-        // risks corrupt or misplaced writes. Only apply_patch is gated —
-        // non-mutation tools (reads/grep/shell/...) keep their normal
-        // parallelism and behavior. Reset per batch (per assistant turn).
+        // Ordered-mutation batch gate. Each apply_patch is an eager-dispatch
+        // barrier: side effects overlap within the current segment, but no
+        // later segment starts before the loop crosses the patch in model
+        // order. A failed patch prevents every unstarted later side effect;
+        // known read-only calls may still complete for diagnostics.
         let _orderedMutationFailed = null;
         for (let callIndex = 0; callIndex < calls.length; callIndex += 1) {
             const call = calls[callIndex];
@@ -196,22 +193,18 @@ export async function processToolBatch(ctx) {
                 }
             }
             // Ordered-mutation skip: an earlier apply_patch in THIS batch failed,
-            // so this later apply_patch is skipped rather than executed. Restore
-            // its full patch body first (this call never ran) so the model can
-            // re-issue it cleanly in a new turn instead of copying back a
-            // `[mixdog compacted …]` placeholder. Emits a matching is_error
-            // tool_result so the assistant tool_use is not orphaned.
-            // Full-parallel caveat: a call that ALREADY started (pending eager
-            // promise) cannot be "skipped" — its side effects are running, so
-            // its real result must be consumed below. The gate only skips
-            // calls that have not started (apply_patch never starts eagerly).
+            // so this later side-effect call is skipped rather than executed.
+            // Restore a later patch's full body first so it can be re-issued.
+            // `skipped` is deliberate: the call never started, so it is neither
+            // a tool failure nor a cancellation. The earlier patch remains the
+            // structural failure that drives retry/stop-hook behavior.
             if (_orderedMutationFailed && _isOrderedGateSkippable(call.name) && !pending.has(call.id)) {
                 if (call?.id) restoreToolCallBodyForId(assistantTurnMsg, calls, call.id);
                 pushToolResultMessage({
                     role: 'tool',
-                    content: `Error: [ordered-mutation-skip] an earlier apply_patch in this same tool batch (call index ${_orderedMutationFailed.index + 1}) failed; ordered mutations in one batch are all-or-nothing after a failure, so this later \`${call.name}\` was NOT executed — it may depend on the failed mutation and running it now against unchanged/partially-changed state could corrupt files. Re-issue it in a new turn after resolving the earlier failure.`,
+                    content: `[prerequisite-failed] an earlier apply_patch in this same tool batch (call index ${_orderedMutationFailed.index + 1}) failed, so this later \`${call.name}\` was skipped without starting. Re-issue it after resolving the patch failure.`,
                     toolCallId: call.id,
-                    toolKind: 'error',
+                    toolKind: 'skipped',
                 });
                 continue;
             }
@@ -320,7 +313,7 @@ export async function processToolBatch(ctx) {
                         toolEndedAt = Date.now();
                         _resultKind = 'error';
                     } else {
-                        result = await executeTool(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: iterations });
+                        result = await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: iterations, deferShellCwdCommit: true });
                         toolEndedAt = Date.now();
                         // Boundary: tool-return string convention → structural kind.
                         // The only prefix check in this codebase; downstream layers
@@ -342,6 +335,9 @@ export async function processToolBatch(ctx) {
                 result = `Error: ${err instanceof Error ? err.message : String(err)}`;
                 _resultKind = 'error';
             }
+            if (_isShellTool(call.name)) {
+                commitSessionCwdProbe(sessionId, call.id);
+            }
             // CENTRAL ENVELOPE NORMALIZE (general newMessages channel).
             // executeTool (serial + eager) and cache/error paths above all
             // funnel into `result`. Split ONCE here: downstream post-processing
@@ -506,7 +502,7 @@ export async function processToolBatch(ctx) {
             if (_isMutationTool(call.name)) {
                 epoch.mutation += 1;
                 // Record the first failed ordered mutation in this batch so any
-                // LATER apply_patch is skipped by the gate at the top of the
+                // later side effect is skipped by the gate at the top of the
                 // loop. Keyed on exec outcome (not post-processing): a mutation
                 // whose write succeeded but post-processing threw still landed
                 // on disk, so it must NOT block subsequent ordered patches.

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -130,22 +130,31 @@ export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs(
 // SEMANTIC progress (message/content/tool deltas) rather than raw keepalive
 // bytes (Anthropic `:ping`, comment frames). A truly silent stream — one that
 // emits no semantic event for this window — trips it; a live extended-thinking
-// stream (which emits thinking deltas) stays alive. Default 120s, floor 10s,
-// env-overridable and disablable via MIXDOG_ENABLE_STREAM_WATCHDOG=0.
+// stream (which emits thinking deltas) stays alive. Floor 10s, env-overridable
+// and disablable via MIXDOG_ENABLE_STREAM_WATCHDOG=0.
+//
+// 2026-07-05 trace audit: effort-mode (output_config.effort) claude streams
+// can deliver NO deltas during the thinking phase — the whole thinking+text
+// body flushes at the end (44/47 slow turns had stream_total-ttft < 2s;
+// silent-window token rate a steady ~92 tok/s, i.e. live generation, not a
+// wedge). So a "semantic-silent" stream is NOT necessarily dead.
+//
+// 2026-08-03 v3 postmortem: this window used to be DERIVED from the agent
+// stall budget (warn − tick ≈ 285s). A harness that tightened STALL_TIMEOUT_S
+// to 300s silently collapsed it to 135s, which deterministically beheaded
+// live long-thinking turns (regex-chess / circuit-fibsqrt: ttft ~1.5s, then
+// killed at exactly 135s of silent thinking, 4 attempts ≈ 552s per turn).
+// Reference parity: Codex aborts only after a 300s single-gap silence
+// (DEFAULT_STREAM_IDLE_TIMEOUT_MS); Claude Code ships its watchdog OFF by
+// default and falls back to non-streaming when it does abort. The default is
+// therefore a FIXED 300s, decoupled from the warn math. The only remaining
+// coupling is the ordering guarantee: cap at (abort − tick) so the provider
+// layer — which can retry or fall back non-streaming — always fires strictly
+// before the agent stall watchdog's terminal abort.
 export const PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS = resolveTimeoutMs(
     ['MIXDOG_PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS', 'MIXDOG_PROVIDER_SSE_IDLE_TIMEOUT_MS'],
-    // 2026-07-05 trace audit: effort-mode (output_config.effort) sonnet-5
-    // streams deliver NO deltas during the thinking phase — the whole
-    // thinking+text body flushes at the end (44/47 slow turns had
-    // stream_total-ttft < 2s; silent-window token rate a steady ~92 tok/s,
-    // i.e. live generation, not a wedge). Successful turns topped out at
-    // ttft 171s while 13 kills sat at exactly ~183s fetch→fetch — the old
-    // 180s window was beheading every turn whose silent thinking ran past
-    // it, then retrying the whole thinking run from zero. Raised to the
-    // policy ceiling (STALL_WARN - tick ≈ 285s); the agent stall watchdog
-    // (worker 300s) remains the true-wedge backstop just above it.
-    PROVIDER_MAX_BEFORE_WARN_MS,
-    { minMs: 10_000, maxMs: STALL_WARN_MS },
+    300_000,
+    { minMs: 10_000, maxMs: Math.max(10_000, STALL_ABORT_MS - STALL_TICK_MS) },
 );
 
 // Named terminal error for a mid-stream SEMANTIC idle abort. Distinct from a
@@ -246,15 +255,16 @@ export const PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS = resolveTimeoutMs(
     { minMs: 10_000, maxMs: STALL_WARN_MS },
 );
 
-// WS semantic idle uses the same default ceiling as OpenAI HTTP/SSE semantic
-// idle. This is semantic progress only (not the WS inter-chunk byte timer), so
-// reasoning/text/tool deltas reset it while metadata cannot. Keep the default
-// at PROVIDER_MAX_BEFORE_WARN_MS (~285s), strictly below the 300s worker
-// watchdog, rather than rounding it to 300s.
+// WS semantic idle uses the same default as the SSE semantic idle above
+// (fixed 300s, decoupled from the agent stall-budget warn math — see that
+// comment for the 135s-collapse regression). This is semantic progress only
+// (not the WS inter-chunk byte timer), so reasoning/text/tool deltas reset it
+// while metadata cannot. Capped at (abort − tick) so the provider layer fires
+// strictly below the agent stall watchdog.
 export const PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS = resolveTimeoutMs(
     ['MIXDOG_PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS', 'MIXDOG_PROVIDER_WS_OUTPUT_IDLE_TIMEOUT_MS'],
-    PROVIDER_MAX_BEFORE_WARN_MS,
-    { minMs: 10_000, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
+    300_000,
+    { minMs: 10_000, maxMs: Math.max(10_000, STALL_ABORT_MS - STALL_TICK_MS) },
 );
 
 // First retry has a small floor (250ms) instead of 0ms: an immediate reissue on

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -600,7 +600,10 @@ export async function executeBashTool(args, workDir, options = {}) {
         // so the exit code the model sees is unchanged.
         let syncCommand = wrappedCommand;
         try {
-            const _stateFile = stateFilePath(_sessionCwdKey);
+            const _stateFile = stateFilePath(
+                _sessionCwdKey,
+                options?.deferShellCwdCommit === true ? options?.toolCallId : null,
+            );
             if (_stateFile) {
                 syncCommand = (process.platform === 'win32' && shellType === 'powershell')
                     ? wrapPowerShellWithCwdProbe(wrappedCommand, _stateFile)

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -23,9 +23,9 @@ function _shellMaxTimeoutMs() {
     return Math.max(parsed > 0 ? parsed : 600_000, _shellDefaultTimeoutMs());
 }
 
-// PowerShell-only syntax cheat, injected into the shell tool description when
-// the host default shell is PowerShell (win32). process.platform is fixed for
-// the process lifetime, so this is evaluated once at module load.
+// PowerShell-only syntax cheat, kept next to the command argument when the host
+// default shell is PowerShell (win32). process.platform is fixed for the
+// process lifetime, so this is evaluated once at module load.
 const _shellSyntaxCheat =
     process.platform === 'win32'
         ? ' PowerShell: grep→Select-String, tail→Get-Content -Tail, head→Get-Content -TotalCount, /c/→C:\\, if && is unsupported use ;, $PID is reserved.'
@@ -68,18 +68,18 @@ export const BUILTIN_TOOLS = [
                 limit: { type: 'number', minimum: 1, description: 'Max lines after offset. Defaults to 2000.' },
             },
             required: ['path'],
+            additionalProperties: false,
         },
     },
     {
         name: 'shell',
         title: 'Mixdog Shell',
         annotations: { title: 'Mixdog Shell', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true, compressible: true },
-        description: 'Runs a shell command and returns its output. Use async for sleep/watch/dev loops.'
-            + `${_shellSyntaxCheat} ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
+        description: `Run a shell command. ${TOOL_ASYNC_EXECUTION_CONTRACT}`,
         inputSchema: {
             type: 'object',
             properties: {
-                command: { type: 'string', description: 'Command.' },
+                command: { type: 'string', description: `Command.${_shellSyntaxCheat}` },
                 cwd: { type: 'string', description: 'Working directory; persists across calls. Omit to reuse; absolute path changes it.' },
                 timeout: {
                     type: 'number',
@@ -92,6 +92,7 @@ export const BUILTIN_TOOLS = [
                 shell: { type: 'string', enum: ['bash', 'powershell'], description: 'Force shell. Windows defaults to PowerShell; bash = Git Bash/POSIX.' },
             },
             required: ['command'],
+            additionalProperties: false,
         },
     },
     {
@@ -107,6 +108,7 @@ export const BUILTIN_TOOLS = [
                 timeout_ms: { type: 'number', description: 'Wait timeout ms.' },
             },
             required: [],
+            additionalProperties: false,
         },
     },
     {
@@ -147,6 +149,7 @@ export const BUILTIN_TOOLS = [
                 { required: ['pattern'] },
                 { required: ['glob'] },
             ],
+            additionalProperties: false,
         },
     },
     {
@@ -175,6 +178,7 @@ export const BUILTIN_TOOLS = [
                 offset: { type: 'number', description: 'Skip entries.' },
             },
             required: ['pattern'],
+            additionalProperties: false,
         },
     },
     {
@@ -196,6 +200,7 @@ export const BUILTIN_TOOLS = [
                 head_limit: { type: 'number', description: 'Max paths. Defaults to 25.' },
             },
             required: ['query'],
+            additionalProperties: false,
         },
     },
     {
@@ -217,6 +222,7 @@ export const BUILTIN_TOOLS = [
                 offset: { type: 'number', description: 'Skip N entries for paging.' },
             },
             required: [],
+            additionalProperties: false,
         },
     },
 ];

package/src/runtime/agent/orchestrator/tools/builtin/task-tool.mjs

@@ -206,6 +206,11 @@ export async function executeTaskTool(args, options = {}) {
             // consumed synchronously, so no re-arm. Drop the persisted ctx here
             // or it leaks (cleanup only runs on a real watcher settle, which
             // never happens for a never-re-armed entry).
+            // EXCEPT when this wait's tool call was aborted: its result was
+            // discarded, so nobody consumed the outcome — re-arm so the
+            // watcher delivers the completion notification instead of
+            // swallowing it.
+            else if (options?.signal?.aborted) watchBackgroundShellJob(taskId);
             else clearShellJobNotifyCtx(taskId);
         }
     }

package/src/runtime/agent/orchestrator/tools/code-graph-tool-defs.mjs

@@ -3,19 +3,20 @@ export const CODE_GRAPH_TOOL_DEFS = [
     name: 'code_graph',
     title: 'Code Graph',
     annotations: { title: 'Code Graph', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false, compressible: false, compressibleLossless: true },
-    description: 'Repo code structure/flow over source files only. File modes take files[]; symbol modes find_symbol/symbol_search/search/references/callers/callees take symbols[]. Exact identifiers use find_symbol/references/callers/callees and keywords use symbol_search/search. Unsupported target arrays are omitted, never silently mixed.',
+    description: 'Repo code structure/flow over source files. File modes take files[]; symbol modes take symbols[] — exact identifiers via find_symbol/references/callers/callees, keywords via symbol_search/search. Unsupported target arrays are omitted, never mixed.',
     inputSchema: {
       type: 'object',
       properties: {
-        mode: { type: 'string', enum: ['overview', 'imports', 'dependents', 'related', 'impact', 'symbols', 'find_symbol', 'symbol_search', 'search', 'references', 'callers', 'callees'], description: 'File modes={overview,imports,dependents,related,impact}; symbols with files→files[] file outline; symbol modes={find_symbol,symbol_search,search,references,callers,callees}; fileless symbols→symbol_search keywords.' },
+        mode: { type: 'string', enum: ['overview', 'imports', 'dependents', 'related', 'impact', 'symbols', 'find_symbol', 'symbol_search', 'search', 'references', 'callers', 'callees'], description: 'File modes={overview,imports,dependents,related,impact}; symbols with files[]=file outline; the rest are symbol modes.' },
         files: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Source file path(s); supported targets only.' },
-        symbols: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Exact identifiers (find_symbol/references/callers/callees) or keywords (symbol_search/search); multiple exact symbols use one symbols[] call.' },
+        symbols: { anyOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' }, minItems: 1 }], description: 'Exact identifiers or keywords; batch multiple in one symbols[].' },
         body: { type: 'boolean', description: 'Include body.' },
         limit: { type: 'number', minimum: 1, description: 'Max results.' },
         depth: { type: 'number', minimum: 1, maximum: 5, description: 'Caller depth.' },
         page: { type: 'number', minimum: 1, description: 'Caller page.' },
       },
       required: ['mode'],
+      additionalProperties: false,
     },
   },
 ];