mixdog 0.9.96 → 0.9.97

package/README.md

@@ -65,23 +65,6 @@ measured cache writes; the archived OpenAI runs did not retain
 artifacts, the exact run commands, and the metric scripts that recompute
 every number above live under `benchmarks/terminal-bench-2.1/`.
 
-## Boot overhead — measured, not estimated
-
-Fixed cost of the default system prompt + tool schemas, measured with a
-minimal one-turn ping ("hi"). Every number below is what the provider's own
-usage accounting reported for the first API call — same tokenizer on both
-sides of each row, no offline estimates (2026-08).
-
-| Tokenizer | Baseline harness | First-call prompt | mixdog Lead | mixdog worker agent |
-|-----------|------------------|------------------:|------------:|--------------------:|
-| Anthropic — pristine containers, TB2.1 harness | Claude Code 2.1.220 | 19,149 tok (median, n=89) | **7,295 (−62%)** | 4,856 (−75%) |
-| OpenAI — same host, same model (`gpt-5.6-sol`) | Codex CLI 0.145.0 | 17,706 tok | **7,488 (−58%)** | 4,616 (−74%) |
-
-The Lead surface carries the full default rule set, skills manifest, and
-per-user profile; spawning a sub-agent costs a flat ~4.6–4.9k tokens. Low
-boot overhead compounds: it is re-read on every request, so it is the
-baseline of every cache write, compaction, and long-session turn.
-
 ## Why mixdog
 
 **Maximum performance at minimum cost**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.96",
+  "version": "0.9.97",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",
@@ -71,18 +71,19 @@
     "test:agent-job-views": "node --test scripts/agent-job-terminal-view-test.mjs",
     "test:agent-fanout": "node scripts/agent-parallel-smoke.mjs && node --test scripts/agent-route-batch-test.mjs scripts/execution-completion-dedup-test.mjs",
     "test:toolcall": "node --test scripts/toolcall-args-test.mjs",
-    "test:tool-batching": "node --test scripts/eager-patch-shell-order-test.mjs scripts/session-bench-batching-test.mjs",
+    "test:tool-batching": "node --test scripts/eager-patch-shell-order-test.mjs scripts/session-bench-batching-test.mjs scripts/tool-cwd-rebind-test.mjs",
     "test:shipmode": "node --test scripts/ship-mode-test.mjs",
     "test:shellhardening": "node --test scripts/shell-hardening-test.mjs scripts/shell-failure-diagnostics-test.mjs scripts/windows-hide-spawn-options-test.mjs scripts/shell-job-session-scope-test.mjs",
     "test:placeholder": "node --test scripts/compacted-placeholder-scrub-test.mjs",
     "test:providers": "node --test scripts/provider-toolcall-test.mjs scripts/provider-contract-test.mjs scripts/provider-stream-stall-test.mjs scripts/provider-stream-outcome-test.mjs scripts/stream-frame-fault-matrix-test.mjs scripts/gemini-provider-test.mjs scripts/anthropic-transport-policy-test.mjs scripts/anthropic-native-block-replay-test.mjs scripts/openai-oauth-ws-1006-retry-test.mjs scripts/stream-close-retry-test.mjs scripts/openai-end-turn-signal-test.mjs",
     "test:provider-admission": "node --test scripts/provider-admission-scheduler-test.mjs scripts/provider-stream-json-test.mjs",
-    "test:resource-admission": "node --test scripts/resource-admission-test.mjs scripts/child-spawn-isolation-test.mjs",
+    "test:resource-admission": "node --test scripts/resource-admission-test.mjs scripts/child-spawn-isolation-test.mjs scripts/owner-fair-gate-test.mjs",
     "test:deferred-tools": "node --test scripts/deferred-tool-loading-test.mjs",
     "test:anthropic-oauth-race": "node --test scripts/anthropic-oauth-refresh-race-test.mjs",
     "test:grok-oauth-race": "node --test scripts/grok-oauth-refresh-race-test.mjs",
     "test:atomiclock": "node --test scripts/atomic-lock-tryonce-test.mjs",
     "test:keychain": "node --test scripts/keychain-prewarm-test.mjs",
+    "test:memory-leaks": "node --expose-gc --test scripts/memory-retention-test.mjs scripts/memory-worker-stability-test.mjs scripts/session-transport-test.mjs apps/desktop/src/renderer/memory-retention.test.mjs",
     "test:memory-routing": "node --test scripts/memory-cycle-routing-test.mjs scripts/maintenance-default-routes-test.mjs scripts/embedding-worker-exit-test.mjs scripts/embedding-runtime-prune-test.mjs",
     "test:embedding-runtime": "node --test scripts/embedding-runtime-prune-test.mjs scripts/memory-pg-recovery-test.mjs && node scripts/verify-embedding-runtime.mjs",
     "test:embedding-runtime:core": "node --test scripts/embedding-runtime-prune-test.mjs scripts/memory-pg-recovery-test.mjs && node scripts/verify-embedding-runtime.mjs --core",
@@ -98,9 +99,9 @@
     "test:patch-binary-cache": "node --test scripts/patch-binary-cache-test.mjs",
     "test:patch-parity": "node --test scripts/v4a-parity-test.mjs",
     "test:project-registry": "node --test scripts/project-registry-isolation-test.mjs",
-    "test:engine-daemon": "node --test scripts/fair-call-scheduler-test.mjs scripts/engine-daemon-test.mjs scripts/engine-daemon-tui-parity-test.mjs scripts/engine-daemon-recovery-test.mjs scripts/engine-daemon-submit-delivery-test.mjs scripts/engine-daemon-process-lifetime-test.mjs scripts/engine-daemon-multipane-stress-test.mjs && node --test scripts/runtime-isolation-stress-test.mjs",
-    "smoke:engine-daemon": "node scripts/engine-daemon-smoke.mjs",
-    "test:session": "node --test scripts/session-orphan-sweep-test.mjs scripts/interrupted-turn-history-test.mjs scripts/turn-checkpoint-crash-test.mjs scripts/turn-outcome-fault-matrix-test.mjs scripts/session-save-fault-store-test.mjs scripts/session-disk-authority-test.mjs scripts/session-load-cache-race-test.mjs scripts/agent-loop-complete-turn-test.mjs scripts/session-heartbeat-lifecycle-test.mjs scripts/remote-transition-order-test.mjs scripts/session-new-reset-test.mjs scripts/turn-ttft-critical-path-test.mjs",
+    "test:session-transport": "node --test scripts/fair-call-scheduler-test.mjs scripts/session-transport-test.mjs scripts/session-tui-parity-test.mjs scripts/session-recovery-test.mjs scripts/session-submit-delivery-test.mjs scripts/daemon-process-lifetime-test.mjs scripts/session-multipane-stress-test.mjs && node --test scripts/runtime-isolation-stress-test.mjs",
+    "smoke:session": "node scripts/session-smoke.mjs",
+    "test:session": "node --test scripts/runtime-turn-contract-test.mjs scripts/session-orphan-sweep-test.mjs scripts/interrupted-turn-history-test.mjs scripts/turn-checkpoint-crash-test.mjs scripts/turn-outcome-fault-matrix-test.mjs scripts/session-save-fault-store-test.mjs scripts/session-disk-authority-test.mjs scripts/session-load-cache-race-test.mjs scripts/agent-loop-complete-turn-test.mjs scripts/session-heartbeat-lifecycle-test.mjs scripts/remote-transition-order-test.mjs scripts/session-new-reset-test.mjs scripts/turn-ttft-critical-path-test.mjs",
     "test:live-canary": "node --test scripts/live-canary-test.mjs",
     "test:rebindtail": "node --test scripts/forwarder-rebind-tail-test.mjs scripts/channel-remote-format-test.mjs",
     "test:workflow-editor": "node --test scripts/workflow-id-test.mjs scripts/workflow-pack-editor-test.mjs",
@@ -122,7 +123,7 @@
     "bench:explore": "node scripts/explore-bench.mjs",
     "bench:output-style": "node scripts/output-style-bench.mjs",
     "bench:session-context": "node scripts/session-context-bench.mjs",
-    "bench:engine-daemon": "node scripts/engine-daemon-bench.mjs",
+    "bench:session-transport": "node scripts/session-transport-bench.mjs",
     "bench:tool-overhead": "node scripts/tool-overhead-microbench.mjs",
     "bench:internal-comms": "node scripts/internal-comms-bench.mjs",
     "audit:models": "node scripts/model-catalog-audit.mjs",

package/scripts/build-tui.mjs

@@ -41,13 +41,13 @@ const sharedRuntimeExternalPlugin = {
   },
 };
 
-const engineDaemonClientExternalPlugin = {
-  name: 'mixdog-engine-daemon-client-external',
+const sessionClientExternalPlugin = {
+  name: 'mixdog-session-client-external',
   setup(build) {
-    build.onResolve({ filter: /^\.\.\/standalone\/engine-daemon-client\.mjs$/ }, () => ({
+    build.onResolve({ filter: /^\.\.\/standalone\/session-client\.mjs$/ }, () => ({
       // Keep this module outside the TUI bundle so its import.meta.url stays
-      // anchored in src/standalone, where backend-daemon.mjs actually lives.
-      path: '../../standalone/engine-daemon-client.mjs',
+      // anchored in src/standalone, where daemon.mjs actually lives.
+      path: '../../standalone/session-client.mjs',
       external: true,
     }));
   },
@@ -90,7 +90,7 @@ await build({
   plugins: [
     mixdogInkAliasPlugin,
     sharedRuntimeExternalPlugin,
-    engineDaemonClientExternalPlugin,
+    sessionClientExternalPlugin,
   ],
   logLevel: 'info',
 });

package/scripts/{channel-daemon-stub.mjs → daemon-stub.mjs}

@@ -1,17 +1,18 @@
-// Stub channels daemon for the flip smoke: same lifecycle contract as
-// src/standalone/channel-daemon.mjs (pid-verified singleton claim, HTTP+SSE
+// Stub channel service for the flip smoke: same lifecycle contract as
+// src/standalone/daemon.mjs (pid-verified singleton claim, HTTP+SSE
 // transport, discovery file, ready handshake, client-grace self-shutdown) but
 // with a STUB runtime instead of worker-main — no Discord token needed. The
 // real channel-worker.mjs spawn-or-attach path forks THIS via
-// MIXDOG_CHANNEL_DAEMON_ENTRY, so the flip is exercised end to end.
+// MIXDOG_DAEMON_ENTRY, so the flip is exercised end to end.
 process.env.MIXDOG_WORKER_MODE = process.env.MIXDOG_WORKER_MODE || '1';
 
 import os from 'node:os';
 import path from 'node:path';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { writeJsonAtomicSync } from '../src/runtime/shared/atomic-file.mjs';
 import { claimSingletonOwner, releaseSingletonOwner } from '../src/runtime/shared/singleton-owner.mjs';
 import { safeIpcSend } from '../src/runtime/shared/safe-ipc-send.mjs';
-import { createChannelDaemonTransport } from '../src/standalone/channel-daemon-transport.mjs';
+import { createChannelTransport } from '../src/standalone/channel-transport.mjs';
 
 function runtimeRoot() {
   return process.env.MIXDOG_RUNTIME_ROOT
@@ -20,8 +21,8 @@ function runtimeRoot() {
 }
 const RUNTIME_ROOT = runtimeRoot();
 const DATA_DIR = process.env.MIXDOG_DATA_DIR ? path.resolve(process.env.MIXDOG_DATA_DIR) : RUNTIME_ROOT;
-const DISCOVERY_PATH = path.join(RUNTIME_ROOT, 'channel-daemon.json');
-const OWNER_PATH = path.join(DATA_DIR, 'channel-daemon-owner.json');
+const DISCOVERY_PATH = path.join(RUNTIME_ROOT, 'daemon.json');
+const OWNER_PATH = path.join(DATA_DIR, 'daemon-owner.json');
 
 function log(line) { if (process.env.DAEMON_SMOKE_VERBOSE) process.stderr.write(`[stub-daemon] ${line}\n`); }
 
@@ -31,23 +32,24 @@ async function shutdown(reason, code = 0) {
   if (shuttingDown) return;
   shuttingDown = true;
   try { await transport?.stop?.(); } catch {}
+  try { rmSync(DISCOVERY_PATH, { force: true }); } catch {}
   try { releaseSingletonOwner(OWNER_PATH, process.pid); } catch {}
   process.exit(code);
 }
 
 async function main() {
   try { mkdirSync(RUNTIME_ROOT, { recursive: true }); } catch {}
-  const claim = claimSingletonOwner(OWNER_PATH, { kind: 'channel-runtime-daemon', pid: process.pid, meta: { cwd: process.cwd() } });
+  const claim = claimSingletonOwner(OWNER_PATH, { kind: 'mixdog-daemon', pid: process.pid, meta: { cwd: process.cwd() } });
   if (!claim.owned) { process.exit(0); } // race loser → spawner attaches to winner
   process.on('exit', () => { try { releaseSingletonOwner(OWNER_PATH, process.pid); } catch {} });
 
   // Optional env dump for the tool smoke: proves daemonEnv() spawned us with
-  // the daemon-mode flags (MIXDOG_CHANNEL_DAEMON=1, MIXDOG_CLI_OWNED=0).
+  // the host-mode flags (MIXDOG_DAEMON_HOST=1, MIXDOG_CLI_OWNED=0).
   if (process.env.SMOKE_CHANNEL_ENV_OUT) {
     try {
       writeFileSync(process.env.SMOKE_CHANNEL_ENV_OUT, JSON.stringify({
         cliOwned: process.env.MIXDOG_CLI_OWNED,
-        daemon: process.env.MIXDOG_CHANNEL_DAEMON,
+        host: process.env.MIXDOG_DAEMON_HOST,
       }));
     } catch { /* smoke-only, best-effort */ }
   }
@@ -61,15 +63,19 @@ async function main() {
     return { ok: true, name, args, leadPid: ctx.leadPid };
   };
 
-  transport = createChannelDaemonTransport({
+  transport = createChannelTransport({
     handleCall,
-    discoveryPath: DISCOVERY_PATH,
     clientGraceMs: 250,
     sweepMs: 1000,
     log,
     onClientsEmpty: () => { void shutdown('no live clients'); },
   });
   const { port, token } = await transport.start();
+  writeJsonAtomicSync(DISCOVERY_PATH, {
+    pid: process.pid,
+    startedAt: Date.now(),
+    endpoints: { channel: { port, token } },
+  }, { compact: true });
   safeIpcSend(process, { type: 'ready', port, token });
   log(`ready port=${port} pid=${process.pid}`);
 }

package/src/defaults/skills/setup/SKILL.md

@@ -132,7 +132,7 @@ apply it, and verify the result.
 ### Discord / Telegram / voice channels
 
 1. Check `/channels` (or `/setting` → Channel) and runtime channel status.
-2. Update the requested backend, credential, or main channel/chat setting.
+2. Update the requested provider, credential, or main channel/chat setting.
 3. Restart/reconnect only when the channel implementation requires it.
 4. Verify channel presence and a non-secret status signal.
 

package/src/lib/keychain-cjs.cjs

@@ -6,7 +6,7 @@ const fs = require('fs');
 const { resolvePluginData } = require('./plugin-paths.cjs');
 
 const SERVICE = 'mixdog';
-// Shared bound for every synchronous keychain backend (DPAPI/PowerShell on
+// Shared bound for every synchronous keychain provider (DPAPI/PowerShell on
 // Windows, security(1) on macOS). A single env override keeps them consistent.
 const KEYCHAIN_TIMEOUT_MS = Number(process.env.MIXDOG_KEYCHAIN_TIMEOUT_MS || 15000);
 const POWERSHELL_TIMEOUT_MS = KEYCHAIN_TIMEOUT_MS;

package/src/lib/mixdog-debug.cjs

@@ -102,8 +102,7 @@ const CANONICAL_PLUGIN_LOG_NAMES = new Set([
   'webhook.log',
   'perf.log',
   'tool-events.log',
-  'memory-runtime-proxy.log',
-  'channels-worker-standalone.log',
+  'daemon.log',
   'mixdog-tui.stderr.log',
 ]);
 
@@ -183,7 +182,7 @@ function rotateBoundedLog(filePath, maxBytes, keepBytes) {
 }
 
 // Shared bound for unbounded per-writer plugin logs (tool-events,
-// memory-runtime-proxy, channels-worker-standalone). Keep a tail so recent
+// memory runtime and daemon logs). Keep a tail so recent
 // context survives rotation while the file stays under the 10 MB cap.
 const PLUGIN_LOG_MAX_BYTES = 10 * 1024 * 1024;
 const PLUGIN_LOG_KEEP_BYTES = 2 * 1024 * 1024;

package/src/rules/lead/01-general.md

@@ -7,12 +7,11 @@
 - Destructive/hard-to-reverse action needs explicit confirmation and explicit
   validated target paths — never `~`, a root, or unresolved variables/globs;
   report material deletions with recoverability.
-- Act proactively; ask only for decisions.
+- Ask only for decisions.
 - Build only what the task requires; trust internal and framework guarantees.
 - Mid-task input: a replacement supersedes current work, an addition folds
   into it, a status question gets a brief answer while work continues; after
   context compaction continue from the summary — never restart or redo
   finished work.
-- When blocked, exhaust safe in-scope checks once and report the blocker.
 - Your final message ends the turn: answer only when the work is done. After a
   failed tool call, fix and re-run it, or state plainly that it is unresolved.

package/src/rules/lead/lead-tool.md

@@ -1,6 +1,3 @@
 # Lead Tools
 
-- Write-role agents self-verify with `shell`. Lead uses `shell` only for git,
-  benches, and cross-scope verification no retrieval tool can produce;
-  inspection stays on `read`/`grep`/`glob`/`list`/`find`/`code_graph`.
 - Use the current project/workspace unless the request or tool requires another.

package/src/rules/shared/01-tool.md

@@ -7,16 +7,17 @@
   `read`; symbol/relation→`code_graph`; web/current→`search`; returned URL body→
   `web_fetch`; prior work→`recall`; durable compact English memory→`memory`;
   explicit project change→`cwd`; explicit user-requested conversation reset→
-  `session_manage`; process/env, git, build/run/test→`shell`. Never use shell
-  equivalents for file discovery or content retrieval.
-- Use verified paths (cwd, project root, user-provided, or tool-returned);
-  guessed fragments use `find`. Merge independent calls per tool in one
-  message and fetch all information needed in that batch. Follow up only after
-  zero/error or a newly revealed dependency; never re-fetch an unchanged span.
-- Once every final edit is fully determined, send one assistant tool batch
-  containing one `apply_patch` for all files/hunks and one `shell` chain for
-  verification. The runtime supports this mixed batch. On failure fix and
-  rerun only what failed; report verified versus assumed.
+  `session_manage`; process/env, git, build/run/test→`shell`. Call `shell` only
+  when the task actually requires one of those operations; do not treat it as
+  a routine investigation or completion step. Never use shell equivalents for
+  file discovery or content retrieval.
+- Use verified paths (cwd/project/user/tool); explicit paths may be outside cwd;
+  guessed fragments use `find`. Maximize fan-out across routed retrieval tools
+  and fetch all information needed in one batch; never re-fetch an unchanged
+  span.
+- Once the edit is determined, finish in one assistant turn with one
+  `apply_patch` for all edits. If final verification actually requires `shell`,
+  use one verification chain after the edit; otherwise finish without it.
 - After a call returns a background `task_id`, end the turn; its completion
   notification resumes work. Never poll; use task control only for recovery or
   a required blocking result.

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -9,7 +9,8 @@ import { isDiagnosticIOEnabled } from '../../../lib/mixdog-debug.cjs';
 const WARNED_KEYS = new Set();
 
 // ---------------------------------------------------------------------------
-// In-memory buffer + HTTP flush to memory-service /admin/trace-record
+// In-memory buffer. Product sessions flush directly into the daemon-hosted
+// memory module; the standalone path can still use its local HTTP service.
 // ---------------------------------------------------------------------------
 let _buffer = [];
 const _BUFFER_MAX = 2000;
@@ -225,21 +226,11 @@ try {
 function _resolveServiceUrl() {
     if (_serviceUrl) return _serviceUrl;
     try {
-        // Prefer the single-writer discovery advert (discovery/memory.json),
-        // pid-validated; fall back to legacy active-instance.json memory_port.
+        // Standalone memory HTTP uses its pid-validated discovery advert.
         const advertPort = readServicePort('memory', { requirePid: false });
         if (advertPort) { _serviceAdvertPort = advertPort; _serviceUrl = `http://127.0.0.1:${advertPort}`; return _serviceUrl; }
         _serviceAdvertPort = null;
-        const runtimeRoot = process.env.MIXDOG_RUNTIME_ROOT
-            ? join(process.env.MIXDOG_RUNTIME_ROOT)
-            : join(os.tmpdir(), 'mixdog');
-        const activeFile = join(runtimeRoot, 'active-instance.json');
-        if (!existsSync(activeFile)) return null;
-        const active = JSON.parse(readFileSync(activeFile, 'utf-8'));
-        const port = Number(active && active.memory_port);
-        if (!Number.isFinite(port) || port <= 0) return null;
-        _serviceUrl = `http://127.0.0.1:${port}`;
-        return _serviceUrl;
+        return null;
     } catch {
         return null;
     }

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -9,6 +9,8 @@ import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../.
 import { makeToolEnvelope, normalizeToolEnvelope } from '../session/tool-envelope.mjs';
 import { classifyResultKind } from '../session/result-classification.mjs';
 import { createKeyedSingleflight } from './reconnect-singleflight.mjs';
+import { createOwnerFairGate } from '../../../shared/owner-fair-gate.mjs';
+import { currentToolExecutionOwner } from '../../../shared/tool-execution-owner.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -17,7 +19,7 @@ import { createKeyedSingleflight } from './reconnect-singleflight.mjs';
  *  in-process through agent's toolExecutor (see orchestrator/internal-tools),
  *  so this registry is for genuinely external port-based MCP targets only. */
 const AUTO_DETECT_PORTS = {
-    'mixdog-memory': { discovery: 'memory', dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
+    'mixdog-memory': { discovery: 'memory', endpoint: '/mcp' },
 };
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 120000;
 // Per-server STARTUP handshake budget (connect + listTools): 10s.
@@ -25,6 +27,7 @@ const DEFAULT_MCP_STARTUP_TIMEOUT_MS = 10000;
 // --- State ---
 const servers = new Map();
 const reconnects = createKeyedSingleflight();
+const callAdmissions = new Map();
 let mcpSdkPromise = null;
 // Memo for mcpToolHasField(name, field) — keyed by `${toolName}|${field}`.
 // The lookup (regex parse + servers Map get + tools.find + schema property
@@ -165,6 +168,45 @@ export function getMcpServerStatus() {
         })(),
     }));
 }
+function positiveInt(value, fallback) {
+    const parsed = Math.floor(Number(value));
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : fallback;
+}
+function callAdmissionFor(server) {
+    let gate = callAdmissions.get(server.name);
+    if (gate) return gate;
+    const cfg = server?.cfg || {};
+    gate = createOwnerFairGate({
+        name: `MCP ${server.name}`,
+        activeMax: positiveInt(
+            cfg.maxConcurrency ?? cfg.max_concurrency ?? process.env.MIXDOG_MCP_MAX_INFLIGHT,
+            8,
+        ),
+        queueMax: positiveInt(
+            cfg.maxQueue ?? cfg.max_queue ?? process.env.MIXDOG_MCP_MAX_QUEUE,
+            256,
+        ),
+        minOwnerQueue: 8,
+        waitTimeoutMs: positiveInt(
+            cfg.waitTimeoutMs ?? cfg.wait_timeout_ms ?? process.env.MIXDOG_MCP_WAIT_TIMEOUT_MS,
+            30_000,
+        ),
+    });
+    callAdmissions.set(server.name, gate);
+    return gate;
+}
+function closeCallAdmission(name, reason) {
+    const gate = callAdmissions.get(name);
+    if (!gate) return;
+    callAdmissions.delete(name);
+    gate.close(reason || `MCP ${name} disconnected`);
+}
+export function getMcpAdmissionSnapshot() {
+    return [...callAdmissions.entries()].map(([name, gate]) => ({
+        name,
+        ...gate.snapshot(),
+    }));
+}
 
 /** Snapshot of MCP initialize `instructions` per connected server (handshake time). */
 export function getMcpServerInstructionsMap() {
@@ -199,7 +241,7 @@ async function reconnectMcpServer(serverName, failedServer) {
  * Execute an MCP tool call.
  * Name format: `mcp__{serverName}__{toolName}`
  */
-export async function executeMcpTool(name, args) {
+export async function executeMcpTool(name, args, options = {}) {
     // Parse: mcp__{server}__{tool}
     const match = name.match(/^mcp__(.+?)__(.+)$/);
     if (!match)
@@ -208,35 +250,40 @@ export async function executeMcpTool(name, args) {
     const server = servers.get(serverName);
     if (!server)
         throw new Error(`MCP server "${serverName}" not connected`);
-    let result;
-    try {
-        result = await _callToolWithTimeout(server, toolName, args);
-    } catch (firstErr) {
-        const firstMsg = firstErr instanceof Error ? firstErr.message : String(firstErr);
-        if (isMcpToolCallTimeoutError(firstErr)) {
-            mcpLog(`[mcp-client] Tool call timed out; skipping reconnect retry for "${serverName}/${toolName}".\n`);
-            throw firstErr;
-        }
-        mcpLog(`[mcp-client] Tool call failed, attempting shared reconnect...\n`);
-        let retryServer;
+    const gate = callAdmissionFor(server);
+    return gate.run(options?.ownerKey || currentToolExecutionOwner(), async () => {
+        let result;
         try {
-            retryServer = await reconnectMcpServer(serverName, server);
-        } catch (reconnectErr) {
-            const reconnectMsg = reconnectErr instanceof Error ? reconnectErr.message : String(reconnectErr);
-            throw new Error(`Tool call failed: ${firstMsg}; reconnect also failed: ${reconnectMsg}`);
-        }
-        try {
-            result = await _callToolWithTimeout(retryServer, toolName, args);
-        } catch (retryErr) {
-            const retryMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
-            throw new Error(`Tool call failed: ${firstMsg}; retry after reconnect also failed: ${retryMsg}`);
+            result = await _callToolWithTimeout(server, toolName, args);
+        } catch (firstErr) {
+            const firstMsg = firstErr instanceof Error ? firstErr.message : String(firstErr);
+            if (isMcpToolCallTimeoutError(firstErr)) {
+                mcpLog(`[mcp-client] Tool call timed out; skipping reconnect retry for "${serverName}/${toolName}".\n`);
+                throw firstErr;
+            }
+            mcpLog(`[mcp-client] Tool call failed, attempting shared reconnect...\n`);
+            let retryServer;
+            try {
+                retryServer = await reconnectMcpServer(serverName, server);
+            } catch (reconnectErr) {
+                const reconnectMsg = reconnectErr instanceof Error ? reconnectErr.message : String(reconnectErr);
+                throw new Error(`Tool call failed: ${firstMsg}; reconnect also failed: ${reconnectMsg}`);
+            }
+            try {
+                result = await _callToolWithTimeout(retryServer, toolName, args);
+            } catch (retryErr) {
+                const retryMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
+                throw new Error(`Tool call failed: ${firstMsg}; retry after reconnect also failed: ${retryMsg}`);
+            }
         }
-    }
-    const normalized = normalizeToolEnvelope(normalizeMcpToolResult(result));
-    const text = capMcpOutput(normalized.result);
-    return normalized.explicitSuccess
-        ? makeToolEnvelope(text, [], { explicitSuccess: true })
-        : text;
+        const normalized = normalizeToolEnvelope(normalizeMcpToolResult(result));
+        const text = capMcpOutput(normalized.result);
+        return normalized.explicitSuccess
+            ? makeToolEnvelope(text, [], { explicitSuccess: true })
+            : text;
+    }, {
+        signal: options?.signal || null,
+    });
 }
 
 // Preserve MCP failure metadata across the object→string boundary. The
@@ -425,6 +472,7 @@ export async function disconnectAll() {
         }
         catch { /* ignore */ }
         servers.delete(name);
+        closeCallAdmission(name, `MCP ${name} disconnected`);
     }
     _invalidateMcpToolFieldMemo();
 }
@@ -442,6 +490,7 @@ export async function disconnectMcpServer(name) {
     }
     catch { /* ignore */ }
     servers.delete(name);
+    closeCallAdmission(name, `MCP ${name} disconnected`);
     _invalidateMcpToolFieldMemo();
     return true;
 }
@@ -494,13 +543,11 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
         const spec = AUTO_DETECT_PORTS[cfg.autoDetect];
         if (!spec)
             throw new Error(`Unknown autoDetect target: "${cfg.autoDetect}"`);
-        // Prefer the single-writer discovery advert (discovery/<service>.json),
-        // pid-validated. Fall back to the legacy active-instance.json portField
-        // when no live advert is present (cross-version compat).
+        // Read the pid-validated single-writer discovery advert.
         let port = spec.discovery ? readServicePort(spec.discovery, { requirePid: false }) : null;
         if (port && spec.discovery) _autoDetectAdvert = { service: spec.discovery, port };
         let portFile = null;
-        if (!port) {
+        if (!port && spec.file) {
           portFile = spec.dir === 'mixdog' && process.env.MIXDOG_RUNTIME_ROOT
             ? join(process.env.MIXDOG_RUNTIME_ROOT, spec.file)
             : join(tmpdir(), spec.dir, spec.file);
@@ -525,6 +572,7 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
             port = parseInt(raw, 10);
           }
         }
+        if (!port) throw new Error(`autoDetect server "${name}": live service advert missing`);
         if (!Number.isFinite(port) || port < 1 || port > 65535) {
             throw new Error(`autoDetect server "${name}": invalid port value${portFile ? ` in ${portFile}` : ''}`);
         }

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -535,12 +535,9 @@ export async function _streamResponse({
     // only) trips a short, named terminal StreamStalledError instead of coasting
     // to the 300s inter-chunk cap / 30-min agent watchdog.
     let semanticIdleTimer = null;
-    // WS gets its own shorter semantic-idle window. The shared SSE semantic
-    // timeout is intentionally near the 300s stall warning to protect Anthropic
-    // effort-mode "silent thinking"; using that value here lets a wedged WS
-    // request race the TUI 300s watchdog. Keep websocket stalls provider-owned:
-    // fail/retry/fallback here first, then let the TUI watchdog remain a final
-    // safety net only.
+    // WS owns its semantic-idle window. The TUI backstop is deliberately much
+    // longer, so this timeout can fail/retry/fallback at the provider boundary
+    // without racing an outer turn abort (Claude Code/Codex parity).
     const semanticIdleMs = PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS;
     const semanticIdleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED && semanticIdleMs > 0;
     // First-meaningful-frame watchdog timer + one-shot latch. Armed alongside

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -35,7 +35,7 @@ let _initChain = Promise.resolve();
 let _inFlightPromise = null;
 let _inFlightSig = null;
 let _lastAppliedSig = null;
-// Provider instances are process-global inside the backend daemon. Catalog
+// Provider instances are process-global inside the daemon. Catalog
 // readers use this revision to share one raw model snapshot while still
 // rebuilding their cheap route/config projection after auth/config changes.
 let _providerCatalogRevision = 0;
@@ -367,7 +367,7 @@ function warmupCatalogs() {
     }
 }
 
-// Force-refresh each provider's /models catalog ONCE per backend-daemon
+// Force-refresh each provider's /models catalog once per daemon.
 // lifetime. Every session runtime joins this process-global promise and then
 // reads the same provider-instance caches. Unlike
 // warmupCatalogs (which calls listModels() and so respects the 24h provider

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -30,7 +30,7 @@ import {
 } from './loop/tool-classify.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { runRecallFastTrackCompact } from './loop/recall-fasttrack.mjs';
-import { executeTool, _scopedCacheOutcomeForCall } from './loop/tool-exec.mjs';
+import { executeTool, _scopedCacheOutcomeForCall, resolveLiveToolCwd } from './loop/tool-exec.mjs';
 
 // classifyResultKind is imported from result-classification.mjs at the top of
 // this file; import it from there directly rather than via this module.
@@ -420,11 +420,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
         return name === 'sleep' || name.endsWith('/sleep') || name.endsWith('.sleep');
     };
-    // Tool execution must use the session cwd even when the caller omitted the
-    // legacy positional cwd argument. Agent workers always carry their cwd on
-    // sessionRef; falling through to pwd()/process.cwd() resolves relatives
-    // against the host/plugin root instead of the worker workspace.
-    cwd = cwd || sessionRef?.cwd || undefined;
+    // sessionRef.cwd is the live SSOT. The legacy positional cwd is only the
+    // turn-start snapshot and becomes stale after an in-turn cwd tool call.
+    cwd = resolveLiveToolCwd(cwd, sessionRef);
     // Staged pre-cap warnings + one true hard stop. The ONLY count-based
     // forced termination is the hard cap at maxLoopIterations (default 200):
     // a genuine runaway guard. Before it, staged warnings fire at 50%/75%/90%
@@ -445,6 +443,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             Math.floor(maxLoopIterations * 0.9),
         ];
     while (true) {
+        // A cwd tool call updates sessionRef in place. Refresh before building
+        // this iteration's eager dispatcher and cache keys so every following
+        // tool family, including apply_patch, observes the new write root.
+        cwd = resolveLiveToolCwd(cwd, sessionRef);
         const _iterT0 = Date.now();
         throwIfAborted();
         if (iterations >= maxLoopIterations) {

package/src/runtime/agent/orchestrator/session/compact.mjs

@@ -53,4 +53,4 @@ export {
 export {
     semanticCompactMessages,
     recallFastTrackCompactMessages,
-} from './compact/engine.mjs';
+} from './compact/runner.mjs';