mixdog 0.9.94 → 0.9.95

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -4,7 +4,7 @@ import { join } from 'path';
 import { readFileSync, statSync } from 'fs';
 import { createHash, randomBytes } from 'crypto';
 import { resolvePluginData } from '../../../../shared/plugin-paths.mjs';
-import { updateJsonAtomicSync, updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
+import { updateJsonAtomic } from '../../../../shared/atomic-file.mjs';
 import { promptContentText, isInternalRuntimeNotificationText } from './prompt-utils.mjs';
 import { loadSession, readSessionLifecycleStateFromDisk, saveSessionAsync } from '../store.mjs';
 import { isDeliveredCompletion, logDuplicateSkip } from './delivered-completions.mjs';
@@ -942,11 +942,11 @@ function shouldEvictPendingSession(sessionId, ttlMs, entryTouchedAt, now = Date.
     return entryTouch > 0 && (now - entryTouch) > PENDING_ORPHAN_GRACE_MS;
 }
 
-export function sweepOrphanedPendingMessages({ ttlMs = PENDING_ORPHAN_TTL_MS } = {}) {
+export async function sweepOrphanedPendingMessages({ ttlMs = PENDING_ORPHAN_TTL_MS } = {}) {
     const now = Date.now();
     const removed = [];
     try {
-        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
+        await updateJsonAtomic(pendingMessagesPath(), (raw) => {
             const next = normalizePendingStore(raw);
             const ids = Object.keys(next.sessions);
             if (ids.length === 0) return undefined;
@@ -988,9 +988,9 @@ function modelVisiblePendingMessages(messages) {
 }
 
 export function _mergePendingMessageEntries(entries) {
-    // CC-parity delivery priority (reference messageQueueManager.ts: user
-    // input enqueues at 'next', task notifications at 'later', and dequeue
-    // always serves 'next' first). Our single merged turn message is the
+    // Delivery priority: user input enqueues at 'next', task notifications at
+    // 'later', and dequeue always serves 'next' first. Our single merged turn
+    // message is the
     // analogue of that dequeue order: genuine user/steering entries are
     // merged BEFORE deferred completion notifications so queued user input
     // is never buried under system notification text. FIFO is preserved
@@ -1074,7 +1074,16 @@ export function enqueueRemotePendingMessage(sessionId, message) {
     // spool lock (see persistPendingMessages).
     runPendingTestHook('enqueue:beforePublish', { sessionId });
     if (pendingLifecycleInvalidated(sessionId, token)) return 0;
-    const remoteEntry = stampLifecycleToken({ ...normalized, id: newPendingMessageId() }, token);
+    // Preserve the viewer's submission id end-to-end. Minting a fresh id here
+    // made pipe-delivered + spool-fallback twins look like two messages
+    // (owner accepted the pipe copy, then re-took the spool copy).
+    const preservedId = pendingMessageId(normalized) || pendingMessageId(message);
+    const remoteEntry = stampLifecycleToken({
+        ...normalized,
+        id: (typeof preservedId === 'string' && preservedId.trim())
+            ? preservedId.trim()
+            : newPendingMessageId(),
+    }, token);
     return persistPendingMessages(sessionId, [remoteEntry]);
 }
 
@@ -1104,7 +1113,7 @@ function _rememberForeignSpoolScan(sessionId, mtime) {
  * internal-notification entries are left untouched for the normal
  * askSession hydrate path.
  */
-export function drainForeignUserInjections(sessionId) {
+export async function drainForeignUserInjections(sessionId) {
     if (!isValidPendingSessionId(sessionId)) return [];
     // DELIVERY path, not cleanup: this takes rows out of the spool and hands
     // them to a live turn. A tombstoned (or otherwise invalidated) session may
@@ -1147,7 +1156,13 @@ export function drainForeignUserInjections(sessionId) {
     // spool immediately pollable again.
     let lifecycleDecided = false;
     try {
-        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
+        // ASYNC spool lock. The sync variant parked the owning process's event
+        // loop in Atomics.wait for the whole timeout: in the daemon (PTYs,
+        // engines, IPC and SSE fan-out share one loop) every poll that lost the
+        // race froze the entire app, and it could never win against an async
+        // holder in the SAME process. Waiting off the loop also lets the
+        // in-process lock queue serialize sibling sessions for free.
+        await updateJsonAtomic(pendingMessagesPath(), (raw) => {
             // Same authority re-read INSIDE the spool lock: a close/detach
             // landing in this window must neither deliver to the old owner nor
             // remove the reopened owner's rows.
@@ -1172,8 +1187,10 @@ export function drainForeignUserInjections(sessionId) {
                 // late-delivery header instead of being silently removed
                 // (user report: remote sends silently discarded around owner
                 // restarts).
-                if (foreignUser && isStaleUserInjection(entry)) taken.push(lateDeliveryText(text, entry));
-                else if (foreignUser) taken.push(text);
+                if (foreignUser && isStaleUserInjection(entry)) {
+                    taken.push({ text: lateDeliveryText(text, entry), id });
+                }
+                else if (foreignUser) taken.push({ text, id });
                 else kept.push(entry);
             }
             if (taken.length === 0) return undefined;
@@ -1184,8 +1201,18 @@ export function drainForeignUserInjections(sessionId) {
             }
             next.updatedAt = Date.now();
             return next;
-        }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
+        }, {
+            compact: true,
+            lock: true,
+            mode: PENDING_MESSAGES_MODE,
+            fsync: false,
+            // Delivery polling must never wait on an async spool writer in the
+            // same daemon process: waiting synchronously prevents that writer
+            // from ever reaching its finally/release path.
+            timeoutMs: 0,
+        });
     } catch (err) {
+        if (err?.code === 'ELOCKCONTENDED') return [];
         try { process.stderr.write(`[session] foreign-injection drain failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
         return [];
     }
@@ -1422,5 +1449,5 @@ setImmediate(() => {
     // the cross-process lock against the lead's writes for zero
     // benefit — the lead already sweeps.
     if (process.env.MIXDOG_WORKER_MODE === '1') return;
-    try { sweepOrphanedPendingMessages(); } catch { /* ignore */ }
+    void sweepOrphanedPendingMessages().catch(() => {});
 });

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -12,6 +12,7 @@ import { _dropPendingMessageState } from './pending-messages.mjs';
 import { _stopToolActivityHeartbeat, _getRuntimeEntry, _clearSessionRuntime } from './runtime-liveness.mjs';
 import { _closeBashSessionLazy } from './runtime-loaders.mjs';
 import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
+import { releaseReadSnapshotScope } from '../../tools/builtin/snapshot-store.mjs';
 
 /**
  * Close a session. Plants a `closed=true` tombstone on disk with a bumped
@@ -137,6 +138,7 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     // Drop session-scoped read dedup cache so the Map doesn't accumulate
     // entries across mcp-server lifetime.
     try { clearReadDedupSession(id); } catch { /* ignore */ }
+    try { releaseReadSnapshotScope(id); } catch { /* ignore */ }
     // Drop offload sidecars + module-level counter for this session so a
     // long-running mcp-server doesn't leak disk (tool-results/<id>/*.txt)
     // or Map entries across session lifetime. Fire-and-forget — close path
@@ -226,6 +228,7 @@ export function unloadSessionRuntime(id, reason = 'runtime-unload') {
     try { globalThis.__mixdogCloseProviderConnectionsForSession?.(id, `runtime-unload:${reason}`); } catch { /* ignore */ }
     // Pure caches — a resumed turn rebuilds them from the transcript/disk.
     try { clearReadDedupSession(id); } catch { /* ignore */ }
+    try { releaseReadSnapshotScope(id); } catch { /* ignore */ }
     _clearSessionRuntime(id);
     if (process.env.MIXDOG_DEBUG_SESSION_LOG) {
         try { process.stderr.write(`[agent-unload] session=${id} reason=${reason} shells=${allBashIds.length}\n`); } catch { /* best-effort */ }

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -169,7 +169,14 @@ export function createSession(opts) {
     const provider = getProvider(providerName);
     if (!provider)
         throw new Error(`Provider "${providerName}" not found or not enabled`);
-    const id = mintSessionId();
+    const requestedId = String(opts.id || '').trim();
+    if (requestedId && !/^[A-Za-z0-9_-]+$/.test(requestedId)) {
+        throw new Error('createSession: id is invalid');
+    }
+    // The daemon may reserve the durable address before provider/session
+    // materialization. Supplying that reservation here keeps the address
+    // stable across intake -> queued turn -> provider execution.
+    const id = requestedId || mintSessionId();
     // Provider cache strategy — agentRuntime.resolveSync() above is a
     // best-effort injection point (setAgentRuntime() has no live caller
     // today, so that branch never fires); build it directly here so every

package/src/runtime/agent/orchestrator/session/manager/turn-interruption.mjs

@@ -7,10 +7,10 @@ import { filterModelVisibleSessionMessages } from './message-sanitize.mjs';
 
 const INTERRUPT_MESSAGE = '[Request interrupted by user]';
 const INTERRUPT_MESSAGE_FOR_TOOL_USE = '[Request interrupted by user for tool use]';
-const STREAMING_INTERRUPTED_TOOL_RESULT = 'Interrupted by user';
 const PROCESS_RESTART_INTERRUPT_MESSAGE = '[Request interrupted by process restart]';
-const PROCESS_RESTART_TOOL_RESULT = 'Interrupted by process restart';
-const TOOL_USE_REJECT_RESULT = "The user doesn't want to proceed with this tool use. The tool use was rejected (eg. if it was a file edit, the new_string was NOT written to the file). STOP what you are doing and wait for the user to tell you how to proceed.";
+// Short tool_result body for any unfinished call closed by
+// cancel/crash. UI maps this (and legacy long reject bodies) to Cancelled.
+const INTERRUPTED_TOOL_RESULT = 'Cancelled';
 
 // Abort reasons that represent an EXPLICIT user cancellation of this turn.
 // Only these rewind a not-yet-answered user turn out of history — the TUI/
@@ -136,11 +136,7 @@ function finalizeInterruptedTurn({
         const executionStarted = phase === 'tools' || observed?.eagerStarted === true;
         messages.push({
             role: 'tool',
-            content: abortReason === 'process-crash'
-                ? PROCESS_RESTART_TOOL_RESULT
-                : (executionStarted
-                    ? TOOL_USE_REJECT_RESULT
-                    : STREAMING_INTERRUPTED_TOOL_RESULT),
+            content: INTERRUPTED_TOOL_RESULT,
             toolCallId: callId,
             toolKind: 'error',
         });
@@ -148,7 +144,7 @@ function finalizeInterruptedTurn({
     }
 
     const pairedMessages = sanitizeToolPairs(messages);
-    // Claude Code omits the synthetic marker when a queued user submission
+    // The synthetic marker is omitted when a queued user submission
     // interrupted the active request; that queued message is the boundary.
     if (abortReason !== 'interrupt' && abortReason !== 'provider-error') {
         pairedMessages.push({

package/src/runtime/agent/orchestrator/session/send-with-recovery.mjs

@@ -36,7 +36,7 @@ function normalizedIncompleteUsage(raw) {
     };
 }
 
-// Loop-level transport replay (codex retry_transport parity). The provider
+// Loop-level transport replay. The provider
 // layer already retries transient failures with a ~15s total envelope
 // (PROVIDER_RETRY_BACKOFF_MS); a real network blip (router/VPN flap — the
 // 2026-08-02 17:37 incident also dropped the Discord gateway) outlasts it and
@@ -192,8 +192,8 @@ export async function sendWithRecovery(ctx) {
             // have been mid-sentence, and there is no completion signal that
             // says the work is done. Promoting it to a normal terminal response
             // silently reported truncated/aborted turns as finished. Keep it an
-            // explicit failure (like codex's no-completed stream handling and
-            // opencode's persisted partial-failure): the already-streamed text
+            // explicit failure (no completion signal means no completed turn,
+            // and the partial is persisted): the already-streamed text
             // is preserved by the interruption/error persistence path
             // (turn-interruption.mjs records the deltas and commits them as the
             // partial assistant message alongside the error), so nothing visible

package/src/runtime/agent/orchestrator/session/tool-batch.mjs

@@ -48,7 +48,7 @@ export async function processToolBatch(ctx) {
     const {
         calls, messages, tools, cwd, sessionId, sessionRef, signal, opts,
         iterations, assistantTurnMsg, pending, epoch, startEagerRun,
-        crossTurnCalls, crossTurnCap, sessionAgent, steeringLadder,
+        crossTurnCalls, crossTurnCap, sessionAgent,
         pushToolResultMessage, throwIfAborted, repeatFailLimit,
     } = ctx;
     const executeToolFn = typeof ctx.executeToolFn === 'function' ? ctx.executeToolFn : executeTool;
@@ -323,6 +323,7 @@ export async function processToolBatch(ctx) {
                         toolEndedAt = Date.now();
                         _resultKind = 'error';
                     } else {
+                        await opts.beforeToolExecution?.();
                         result = await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: iterations, deferShellCwdCommit: true });
                         toolEndedAt = Date.now();
                         // Boundary: tool-return string convention → structural kind.
@@ -632,7 +633,7 @@ export async function processToolBatch(ctx) {
                     toolCallId: call.id,
                     toolKind: _resultKind,
                     ...(_nativeToolSearch ? { nativeToolSearch: _nativeToolSearch } : {}),
-                    ...(_applyPatchUiDiff ? { uiDiff: _applyPatchUiDiff } : {}),
+                    ...(_applyPatchUiDiff !== null ? { uiDiff: _applyPatchUiDiff } : {}),
                 });
                 if (_executeOk) {
                     const _isEager = isEagerDispatchable(call.name, tools);
@@ -730,10 +731,6 @@ export async function processToolBatch(ctx) {
                 } catch { /* best-effort: PostToolBatch hook must never break the loop */ }
             }
         }
-        // Completion-first steering hints (missed-parallelism / all-read-only /
-        // serial-rewording). At most ONE hint per turn. The ladder controller
-        // owns the cumulative counters and streaks.
-        steeringLadder.emitPostBatchSteering(calls, false);
         // Mid-turn steering is drained at the next loop's pre-send point,
         // AFTER any auto-compact pass. Draining here would put the steering
         // user turn after the fresh tool results before compaction runs; then

package/src/runtime/agent/orchestrator/session/tool-result-offload.mjs

@@ -202,7 +202,7 @@ export async function maybeOffloadToolResult(sessionId, toolCallId, toolName, re
     return `${header}\n\n${preview}${suffix}`;
 }
 
-// Apply per-tool persistence first, then enforce the Claude Code message-level
+// Apply per-tool persistence first, then enforce the message-level
 // budget across the remaining non-Read text results. Selection is
 // largest-first; ties prefer the latest result in the assistant tool batch.
 export async function maybeOffloadToolResultBatch(sessionId, entries, options = {}) {

package/src/runtime/agent/orchestrator/stall-policy.mjs

@@ -144,9 +144,8 @@ export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs(
 // to 300s silently collapsed it to 135s, which deterministically beheaded
 // live long-thinking turns (regex-chess / circuit-fibsqrt: ttft ~1.5s, then
 // killed at exactly 135s of silent thinking, 4 attempts ≈ 552s per turn).
-// Reference parity: Codex aborts only after a 300s single-gap silence
-// (DEFAULT_STREAM_IDLE_TIMEOUT_MS); Claude Code ships its watchdog OFF by
-// default and falls back to non-streaming when it does abort. The default is
+// Reference behavior: abort only after a 300s single-gap silence, and fall
+// back to non-streaming instead of killing the turn. The default is
 // therefore a FIXED 300s, decoupled from the warn math. The only remaining
 // coupling is the ordering guarantee: cap at (abort − tick) so the provider
 // layer — which can retry or fall back non-streaming — always fires strictly

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -726,7 +726,19 @@ function guardFind(a) {
     if (!queryOk) {
         return `Error: find requires non-empty string (or string[]) "query" (got ${describeType(a.query)})`;
     }
+    if (hasOwn(a, 'path')) {
+        // Absorb: a JSON-stringified array ('["apps/desktop"]') or a
+        // single-entry batch (['apps/desktop']). find takes ONE base
+        // directory, and a lone entry IS that directory — no ambiguity.
+        const coerced = coerceShapeFlex(a.path);
+        a.path = (Array.isArray(coerced) && coerced.length === 1 && isString(coerced[0]))
+            ? coerced[0]
+            : coerced;
+    }
     if (hasOwn(a, 'path') && !isString(a.path)) {
+        if (Array.isArray(a.path)) {
+            return `Error: find arg "path" must be a single base directory (got ${a.path.length}) — run find once per base, or widen "query".`;
+        }
         return `Error: find arg "path" must be a string (got ${describeType(a.path)})`;
     }
     if (hasOwn(a, 'head_limit') && a.head_limit !== undefined && a.head_limit !== null) {
@@ -832,6 +844,15 @@ const GUARDS = {
     code_graph: guardCodeGraph,
 };
 
+// A bridge/provider can materialize an optional schema field as an explicit
+// `undefined`. JSON cannot carry undefined, so it means "not sent" — drop the
+// key instead of failing the call on a field the caller never set.
+function dropUndefinedArgs(args) {
+    for (const key of Object.keys(args)) {
+        if (args[key] === undefined) delete args[key];
+    }
+}
+
 export function validateBuiltinArgs(toolName, args) {
     const guard = GUARDS[toolName];
     if (!guard) return null;
@@ -841,6 +862,7 @@ export function validateBuiltinArgs(toolName, args) {
     if (typeof args !== 'object' || Array.isArray(args)) {
         return `Error: ${toolName} arguments must be an object (got ${describeType(args)})`;
     }
+    dropUndefinedArgs(args);
     if (toolName === 'grep') applyGrepContextLeadPolicy(args);
     try {
         return guard(args) || null;

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -256,7 +256,7 @@ export async function executeBashTool(args, workDir, options = {}) {
     // decode + rm token guard; calling it here applies the same allowlist
     // to both persistent and stateless paths.
     const _rawCmd = String(args && args.command != null ? args.command : '');
-    // Codex-parity: `apply_patch` typed into the shell (heredoc/argument/bare
+    // `apply_patch` typed into the shell (heredoc/argument/bare
     // patch forms) routes to the internal patch engine instead of failing as
     // an unknown binary. Runs BEFORE the exec-policy scan so patch BODY lines
     // (e.g. `+ rm -rf …`) are never misread as shell commands. Dynamic import
@@ -524,6 +524,9 @@ export async function executeBashTool(args, workDir, options = {}) {
                     // Per-terminal session stamp: the dispatching terminal's
                     // claude.exe pid (server-main threads callerSession.clientHostPid).
                     clientHostPid: options?.clientHostPid,
+                    // Dispatching session: hosts that pool many sessions in one
+                    // process (desktop) scope the job to its own pane with this.
+                    ownerSessionId: options?.callerSessionId || options?.sessionId || null,
                     ...(options?.shellJobRuntime || {}),
                 });
                 if (job && job.error) {
@@ -634,6 +637,8 @@ export async function executeBashTool(args, workDir, options = {}) {
             // Threaded so an auto-backgrounded foreground job is stamped with
             // the dispatching terminal's claude.exe pid (per-terminal scope).
             clientHostPid: options?.clientHostPid,
+            // …and with the dispatching session, for per-pane scoping.
+            ownerSessionId: options?.callerSessionId || options?.sessionId || null,
             // MCP live-progress reporter (null unless the client subscribed via
             // callTool onprogress). execShellCommand emits throttled "running
             // Ns" frames while the foreground command runs.

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -104,7 +104,7 @@ export const BUILTIN_TOOLS = [
             type: 'object',
             properties: {
                 task_id: { type: 'string', description: 'shell async task_id.' },
-                action: { type: 'string', enum: ['list', 'status', 'read', 'wait', 'cancel'], description: 'Action; avoid polling loops.' },
+                action: { type: 'string', enum: ['list', 'status', 'read', 'wait', 'cancel'], description: 'Defaults to list, or wait when task_id is set; avoid polling loops.' },
                 timeout_ms: { type: 'number', description: 'Wait timeout ms.' },
             },
             required: [],

package/src/runtime/agent/orchestrator/tools/builtin/lib/grep-context-expander.mjs

@@ -334,7 +334,7 @@ function renderAtRadius(selected, sources, radius, _budget, notice) {
     )).join('\n');
     const sourceComplete = blocks.every((block) => block.sourceComplete);
     // Header is a format cue only — internal radius/char-budget numbers are
-    // harness noise (neither Claude Code nor Codex surface theirs).
+    // harness noise and stay out of the model-visible text.
     const text = `[Raw source spans; apply_patch context may be copied verbatim]\n${body}${notice}`;
     return { text, sourceComplete, blockCount: blocks.length };
 }

package/src/runtime/agent/orchestrator/tools/builtin/path-utils.mjs

@@ -289,6 +289,20 @@ export function coerceReadFamilyPathArg(path, workDir = null) {
             } catch { /* not a literal bracket path — allow JSON coercion */ }
         }
     }
+    // Absorb: a truncated JSON path array ('["C:\\a\\b.mjs' — a streamed
+    // argument cut mid-emit). Repaired only when exactly ONE path survives,
+    // so a real batch can never be silently narrowed to its first entry.
+    if (typeof path === 'string') {
+        const trimmed = path.trim();
+        if (trimmed.startsWith('["') && !trimmed.endsWith(']')) {
+            try {
+                const repaired = JSON.parse(`${trimmed}"]`);
+                if (Array.isArray(repaired) && repaired.length === 1 && typeof repaired[0] === 'string') {
+                    return repaired[0];
+                }
+            } catch { /* not a repairable truncation — fall through */ }
+        }
+    }
     const coerced = coerceShapeFlex(path);
     if (!Array.isArray(coerced)) return coerced;
     const list = coerced

package/src/runtime/agent/orchestrator/tools/builtin/read-constants.mjs

@@ -18,11 +18,11 @@ import { TOOL_OUTPUT_MAX_BYTES } from './tool-output-limit.mjs';
 // truncation (proceed with cap) rather than refusing. Hard in-memory cap
 // for loading a full file remains READ_MAX_SIZE_BYTES (10 MiB).
 //
-// READ_MAX_OUTPUT_BYTES (30 KB) — output-truncation cap. Lead-facing default tightened from 50k. Mirrors CC's
-// MAX_OUTPUT_SIZE intent (utils/file.ts:48) and the throw-vs-truncate
+// READ_MAX_OUTPUT_BYTES (30 KB) — output-truncation cap. Lead-facing default tightened from 50k. Follows the
+// common max-output-size intent and the throw-vs-truncate
 // trade-off Anthropic chose in #21841 (throw is more token-efficient).
-// NOTE: CC's parallel output budget is maxTokens = 25,000 tokens
-// (limits.ts:18), enforced post-read via a tokenizer throw. mixdog
+// NOTE: the usual alternative is a ~25,000-token output budget
+// enforced post-read via a tokenizer throw. mixdog
 // caps on BYTES at read time instead (no tokenizer in the hot path);
 // 30 KB ≈ well under a 25k-token budget, so the byte cap is left as-is
 // rather than converted to a token count that can't be expressed

package/src/runtime/agent/orchestrator/tools/builtin/read-image-resize.mjs

@@ -15,8 +15,8 @@ export const API_IMAGE_MAX_BASE64_SIZE = 5 * 1024 * 1024; // 5 MB
 export const IMAGE_TARGET_RAW_SIZE = (API_IMAGE_MAX_BASE64_SIZE * 3) / 4; // 3.75 MB
 const IMAGE_MAX_WIDTH = 2000;
 const IMAGE_MAX_HEIGHT = 2000;
-// Token budget for a single image. est tokens = base64.length * 0.125 (CC's
-// per-image heuristic). Default aligns to the 5MB base64 API ceiling so the
+// Token budget for a single image. est tokens = base64.length * 0.125 (the
+// common per-image heuristic). Default aligns to the 5MB base64 API ceiling so the
 // dimension/raw-size resize governs the common case and the token gate only
 // fires on pathologically dense images.
 const DEFAULT_IMAGE_MAX_TOKENS = Math.ceil(API_IMAGE_MAX_BASE64_SIZE * 0.125);

package/src/runtime/agent/orchestrator/tools/builtin/read-snapshot-runtime.mjs

@@ -12,6 +12,7 @@ import {
     rawContentCacheSet,
 } from './cache-layers.mjs';
 import {
+    rememberReadSnapshot,
     readFilesForScope,
     readScopeKey,
     scheduleScopePersist,
@@ -146,7 +147,7 @@ export function recordReadSnapshot(fullPath, st, scope = null, meta = {}) {
     } else if (!batchSliced && sameFile && Number.isFinite(existing?.fileLineCount) && existing.fileLineCount >= 0) {
         next.fileLineCount = Math.trunc(existing.fileLineCount);
     }
-    readFiles.set(fullPath, next);
+    rememberReadSnapshot(fullPath, next, scope, readFiles);
     scheduleScopePersist(readScopeKey(scope));
 }
 

package/src/runtime/agent/orchestrator/tools/builtin/read-special-files.mjs

@@ -8,8 +8,8 @@ const requireCjs = createRequire(import.meta.url);
 const DEFAULT_READ_MAX_OUTPUT_BYTES = 100 * 1024;
 
 // PDFs at or under this size are emitted as an Anthropic base64 document
-// block (the model reads the rendered PDF directly). Mirrors CC's
-// PDF_TARGET_RAW_SIZE (20MB raw → ~27MB base64, under the 32MB request cap).
+// block (the model reads the rendered PDF directly): 20MB raw → ~27MB
+// base64, which stays under the 32MB request cap.
 // Larger PDFs fall back to pdf-parse TEXT extraction.
 const PDF_DOCUMENT_MAX_BYTES = 20 * 1024 * 1024;
 
@@ -19,7 +19,7 @@ const PDF_DOCUMENT_MAX_BYTES = 20 * 1024 * 1024;
 const PDF_MAGIC = Buffer.from('%PDF-', 'latin1');
 
 // Per-output text ceiling inside a notebook. A single cell output larger than
-// this is replaced with a jq hint (port of CC's large-notebook guidance) so a
+// this is replaced with a jq hint (large-notebook guidance) so a
 // runaway stdout / data dump can't blow the read budget.
 const IPYNB_OUTPUT_MAX_CHARS = 10_000;
 

package/src/runtime/agent/orchestrator/tools/builtin/rg-runner.mjs

@@ -302,7 +302,7 @@ export async function rgSupportsPcre2() {
 }
 
 // Cap rg stdout accumulation so a runaway producer (huge repo, accidental
-// match-all) cannot balloon the JS string heap. Mirrors CC's ripgrep.ts cap.
+// match-all) cannot balloon the JS string heap.
 const MAX_RG_STDOUT_BYTES = 20 * 1024 * 1024; // 20MB
 
 // SIGTERM → grace → force kill; hard Promise settle if 'close' never fires

package/src/runtime/agent/orchestrator/tools/builtin/search-tool.mjs

@@ -101,10 +101,9 @@ import {
 } from './lib/grep-context-expander.mjs';
 
 
-// Default grep result cap when head_limit is unspecified. 250 matches the
-// Claude Code default (GrepTool DEFAULT_HEAD_LIMIT); the tool-result offload
-// layer still bounds oversized results. MIXDOG_GREP_DEFAULT_HEAD_LIMIT
-// overrides for A/B runs.
+// Default grep result cap when head_limit is unspecified. 250 is the common
+// harness default; the tool-result offload layer still bounds oversized
+// results. MIXDOG_GREP_DEFAULT_HEAD_LIMIT overrides for A/B runs.
 function _grepDefaultHeadLimit() {
     const parsed = parseInt(process.env.MIXDOG_GREP_DEFAULT_HEAD_LIMIT ?? '', 10);
     return parsed > 0 ? parsed : 250;

package/src/runtime/agent/orchestrator/tools/builtin/shell-analysis.mjs

@@ -790,8 +790,8 @@ export function detectBlockedSleepPattern(command, minSecs = 2) {
     return rest ? `sleep ${secs} followed by: ${rest.slice(0, 80)}` : `standalone sleep ${secs}`;
 }
 
-// Codex-parity shell interception (core maybe_parse_apply_patch_verified):
-// codex-trained models type `apply_patch <<'EOF' … EOF` INTO THE SHELL. No
+// Shell interception: patch-trained models type `apply_patch <<'EOF' … EOF`
+// INTO THE SHELL. No
 // such binary exists here, so the invocation is extracted and routed to the
 // internal apply_patch engine instead of dying as "command not found".
 // Returns null when the command is not an apply_patch invocation, { patch }
@@ -802,7 +802,7 @@ export function extractShellApplyPatchInvocation(command) {
     // Unwrap one `bash|sh|zsh -lc '<script>'` / `-c "<script>"` layer.
     const wrap = /^(?:bash|sh|zsh)\s+-l?c\s+(['"])([\s\S]*)\1\s*$/.exec(cmd);
     if (wrap) cmd = wrap[2].trim();
-    // A bare patch pasted into the shell (codex ImplicitInvocation case) is
+    // A bare patch pasted into the shell (implicit invocation) is
     // unambiguous — route it to the engine directly.
     if (cmd.startsWith('*** Begin Patch')) return { patch: cmd };
     if (!/^apply_patch(?:\s|$)/.test(cmd)) return null;

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-paths.mjs

@@ -236,6 +236,18 @@ export function resolveJobOwnerHostPid(clientHostPid) {
     return null;
 }
 
+// Resolve the SESSION that owns a freshly-spawned job. The owner pid alone is
+// not an ownership answer where one host process multiplexes many sessions
+// (the desktop pools every pane's engine in one process): without this stamp a
+// blank New task pane displayed another session's running shell. Agent
+// sub-sessions stamp their OWNER session id — tool-exec threads callerSessionId
+// as `notifySessionId || sessionRef.ownerSessionId` — because that is the
+// session a pane actually renders.
+export function resolveJobOwnerSessionId(sessionId) {
+    const value = String(sessionId ?? '').trim();
+    return value || null;
+}
+
 export function writeShellJobDetail(detail) {
     // Session scope stamp: every job record is tagged with the CC host pid
     // that owns it (the claude.exe pid). This is the SAME physical pid the

package/src/runtime/agent/orchestrator/tools/builtin/shell-job-spawn.mjs

@@ -29,6 +29,7 @@ import {
     shellJobEnforcedPath,
     shellJobGuardianReceiptPath,
     resolveJobOwnerHostPid,
+    resolveJobOwnerSessionId,
     trimShellJobSpill,
     writeShellJobDetail,
     readShellJobDetail,
@@ -82,7 +83,7 @@ import {
 
 export async function _startBackgroundShellJobImpl({
     command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, shellArg, shellArgs,
-    shellType, clientHostPid, spawnFn = spawn, writeDetailFn = writeShellJobDetail,
+    shellType, clientHostPid, ownerSessionId, spawnFn = spawn, writeDetailFn = writeShellJobDetail,
     rollbackTimeoutMs = 5000,
 }) {
     // Route ANY PowerShell shell to the PS wrapper, regardless of platform.
@@ -91,7 +92,7 @@ export async function _startBackgroundShellJobImpl({
     // bash script. isPowerShellShell already matches pwsh/powershell by stem.
     if (isPowerShellShell(shell, shellType)) {
         return startBackgroundPowerShellJob({
-            command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, clientHostPid,
+            command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, clientHostPid, ownerSessionId,
             spawnFn, writeDetailFn,
         });
     }
@@ -201,6 +202,9 @@ export async function _startBackgroundShellJobImpl({
         donePath,
         // Per-terminal session stamp (see resolveJobOwnerHostPid).
         ownerHostPid: resolveJobOwnerHostPid(clientHostPid),
+        // Dispatching session (see resolveJobOwnerSessionId): a pane counts
+        // only the jobs its own session started.
+        ownerSessionId: resolveJobOwnerSessionId(ownerSessionId),
         startedAt: new Date().toISOString(),
     };
     let terminal = false;
@@ -293,7 +297,7 @@ export async function _startBackgroundShellJobImpl({
 }
 
 async function startBackgroundPowerShellJob({
-    command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, clientHostPid,
+    command, timeoutMs, workDir, mergeStderr, spawnEnv, shell, clientHostPid, ownerSessionId,
     spawnFn = spawn, writeDetailFn = writeShellJobDetail, rollbackTimeoutMs = 5000,
 }) {
     const jobId = `job_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
@@ -447,6 +451,9 @@ async function startBackgroundPowerShellJob({
         timeoutEnforced: Number(timeoutMs) > 0,
         // Per-terminal session stamp (see resolveJobOwnerHostPid).
         ownerHostPid: resolveJobOwnerHostPid(clientHostPid),
+        // Dispatching session (see resolveJobOwnerSessionId): a pane counts
+        // only the jobs its own session started.
+        ownerSessionId: resolveJobOwnerSessionId(ownerSessionId),
         startedAt: new Date().toISOString(),
     };
     let terminal = false;