mixdog 0.9.96 → 0.9.99

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -9,6 +9,8 @@ import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../.
 import { makeToolEnvelope, normalizeToolEnvelope } from '../session/tool-envelope.mjs';
 import { classifyResultKind } from '../session/result-classification.mjs';
 import { createKeyedSingleflight } from './reconnect-singleflight.mjs';
+import { createOwnerFairGate } from '../../../shared/owner-fair-gate.mjs';
+import { currentToolExecutionOwner } from '../../../shared/tool-execution-owner.mjs';
 // --- Types ---
 /** Known auto-detect targets: port file path relative to tmpdir.
  *  Note: `mixdog` used to self-loopback via active-instance.json's
@@ -17,7 +19,7 @@ import { createKeyedSingleflight } from './reconnect-singleflight.mjs';
  *  in-process through agent's toolExecutor (see orchestrator/internal-tools),
  *  so this registry is for genuinely external port-based MCP targets only. */
 const AUTO_DETECT_PORTS = {
-    'mixdog-memory': { discovery: 'memory', dir: 'mixdog', file: 'active-instance.json', portField: 'memory_port', endpoint: '/mcp' },
+    'mixdog-memory': { discovery: 'memory', endpoint: '/mcp' },
 };
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 120000;
 // Per-server STARTUP handshake budget (connect + listTools): 10s.
@@ -25,6 +27,7 @@ const DEFAULT_MCP_STARTUP_TIMEOUT_MS = 10000;
 // --- State ---
 const servers = new Map();
 const reconnects = createKeyedSingleflight();
+const callAdmissions = new Map();
 let mcpSdkPromise = null;
 // Memo for mcpToolHasField(name, field) — keyed by `${toolName}|${field}`.
 // The lookup (regex parse + servers Map get + tools.find + schema property
@@ -165,6 +168,45 @@ export function getMcpServerStatus() {
         })(),
     }));
 }
+function positiveInt(value, fallback) {
+    const parsed = Math.floor(Number(value));
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : fallback;
+}
+function callAdmissionFor(server) {
+    let gate = callAdmissions.get(server.name);
+    if (gate) return gate;
+    const cfg = server?.cfg || {};
+    gate = createOwnerFairGate({
+        name: `MCP ${server.name}`,
+        activeMax: positiveInt(
+            cfg.maxConcurrency ?? cfg.max_concurrency ?? process.env.MIXDOG_MCP_MAX_INFLIGHT,
+            8,
+        ),
+        queueMax: positiveInt(
+            cfg.maxQueue ?? cfg.max_queue ?? process.env.MIXDOG_MCP_MAX_QUEUE,
+            256,
+        ),
+        minOwnerQueue: 8,
+        waitTimeoutMs: positiveInt(
+            cfg.waitTimeoutMs ?? cfg.wait_timeout_ms ?? process.env.MIXDOG_MCP_WAIT_TIMEOUT_MS,
+            30_000,
+        ),
+    });
+    callAdmissions.set(server.name, gate);
+    return gate;
+}
+function closeCallAdmission(name, reason) {
+    const gate = callAdmissions.get(name);
+    if (!gate) return;
+    callAdmissions.delete(name);
+    gate.close(reason || `MCP ${name} disconnected`);
+}
+export function getMcpAdmissionSnapshot() {
+    return [...callAdmissions.entries()].map(([name, gate]) => ({
+        name,
+        ...gate.snapshot(),
+    }));
+}
 
 /** Snapshot of MCP initialize `instructions` per connected server (handshake time). */
 export function getMcpServerInstructionsMap() {
@@ -199,7 +241,7 @@ async function reconnectMcpServer(serverName, failedServer) {
  * Execute an MCP tool call.
  * Name format: `mcp__{serverName}__{toolName}`
  */
-export async function executeMcpTool(name, args) {
+export async function executeMcpTool(name, args, options = {}) {
     // Parse: mcp__{server}__{tool}
     const match = name.match(/^mcp__(.+?)__(.+)$/);
     if (!match)
@@ -208,35 +250,40 @@ export async function executeMcpTool(name, args) {
     const server = servers.get(serverName);
     if (!server)
         throw new Error(`MCP server "${serverName}" not connected`);
-    let result;
-    try {
-        result = await _callToolWithTimeout(server, toolName, args);
-    } catch (firstErr) {
-        const firstMsg = firstErr instanceof Error ? firstErr.message : String(firstErr);
-        if (isMcpToolCallTimeoutError(firstErr)) {
-            mcpLog(`[mcp-client] Tool call timed out; skipping reconnect retry for "${serverName}/${toolName}".\n`);
-            throw firstErr;
-        }
-        mcpLog(`[mcp-client] Tool call failed, attempting shared reconnect...\n`);
-        let retryServer;
+    const gate = callAdmissionFor(server);
+    return gate.run(options?.ownerKey || currentToolExecutionOwner(), async () => {
+        let result;
         try {
-            retryServer = await reconnectMcpServer(serverName, server);
-        } catch (reconnectErr) {
-            const reconnectMsg = reconnectErr instanceof Error ? reconnectErr.message : String(reconnectErr);
-            throw new Error(`Tool call failed: ${firstMsg}; reconnect also failed: ${reconnectMsg}`);
-        }
-        try {
-            result = await _callToolWithTimeout(retryServer, toolName, args);
-        } catch (retryErr) {
-            const retryMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
-            throw new Error(`Tool call failed: ${firstMsg}; retry after reconnect also failed: ${retryMsg}`);
+            result = await _callToolWithTimeout(server, toolName, args);
+        } catch (firstErr) {
+            const firstMsg = firstErr instanceof Error ? firstErr.message : String(firstErr);
+            if (isMcpToolCallTimeoutError(firstErr)) {
+                mcpLog(`[mcp-client] Tool call timed out; skipping reconnect retry for "${serverName}/${toolName}".\n`);
+                throw firstErr;
+            }
+            mcpLog(`[mcp-client] Tool call failed, attempting shared reconnect...\n`);
+            let retryServer;
+            try {
+                retryServer = await reconnectMcpServer(serverName, server);
+            } catch (reconnectErr) {
+                const reconnectMsg = reconnectErr instanceof Error ? reconnectErr.message : String(reconnectErr);
+                throw new Error(`Tool call failed: ${firstMsg}; reconnect also failed: ${reconnectMsg}`);
+            }
+            try {
+                result = await _callToolWithTimeout(retryServer, toolName, args);
+            } catch (retryErr) {
+                const retryMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
+                throw new Error(`Tool call failed: ${firstMsg}; retry after reconnect also failed: ${retryMsg}`);
+            }
         }
-    }
-    const normalized = normalizeToolEnvelope(normalizeMcpToolResult(result));
-    const text = capMcpOutput(normalized.result);
-    return normalized.explicitSuccess
-        ? makeToolEnvelope(text, [], { explicitSuccess: true })
-        : text;
+        const normalized = normalizeToolEnvelope(normalizeMcpToolResult(result));
+        const text = capMcpOutput(normalized.result);
+        return normalized.explicitSuccess
+            ? makeToolEnvelope(text, [], { explicitSuccess: true })
+            : text;
+    }, {
+        signal: options?.signal || null,
+    });
 }
 
 // Preserve MCP failure metadata across the object→string boundary. The
@@ -425,6 +472,7 @@ export async function disconnectAll() {
         }
         catch { /* ignore */ }
         servers.delete(name);
+        closeCallAdmission(name, `MCP ${name} disconnected`);
     }
     _invalidateMcpToolFieldMemo();
 }
@@ -442,6 +490,7 @@ export async function disconnectMcpServer(name) {
     }
     catch { /* ignore */ }
     servers.delete(name);
+    closeCallAdmission(name, `MCP ${name} disconnected`);
     _invalidateMcpToolFieldMemo();
     return true;
 }
@@ -494,13 +543,11 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
         const spec = AUTO_DETECT_PORTS[cfg.autoDetect];
         if (!spec)
             throw new Error(`Unknown autoDetect target: "${cfg.autoDetect}"`);
-        // Prefer the single-writer discovery advert (discovery/<service>.json),
-        // pid-validated. Fall back to the legacy active-instance.json portField
-        // when no live advert is present (cross-version compat).
+        // Read the pid-validated single-writer discovery advert.
         let port = spec.discovery ? readServicePort(spec.discovery, { requirePid: false }) : null;
         if (port && spec.discovery) _autoDetectAdvert = { service: spec.discovery, port };
         let portFile = null;
-        if (!port) {
+        if (!port && spec.file) {
           portFile = spec.dir === 'mixdog' && process.env.MIXDOG_RUNTIME_ROOT
             ? join(process.env.MIXDOG_RUNTIME_ROOT, spec.file)
             : join(tmpdir(), spec.dir, spec.file);
@@ -525,6 +572,7 @@ async function connectServer(name, cfg, genAtStart = _connectAbortGeneration) {
             port = parseInt(raw, 10);
           }
         }
+        if (!port) throw new Error(`autoDetect server "${name}": live service advert missing`);
         if (!Number.isFinite(port) || port < 1 || port > 65535) {
             throw new Error(`autoDetect server "${name}": invalid port value${portFile ? ` in ${portFile}` : ''}`);
         }

package/src/runtime/agent/orchestrator/providers/grok-oauth.mjs

@@ -112,6 +112,13 @@ function _sanitizeGrokModels(models) {
         const display = _displayGrokModel(m);
         const family = _normalizeGrokFamily(m?.id);
         const reasoningLevels = _grokModelSupportsEffort(m?.id) ? ['none', 'low', 'medium', 'high'] : [];
+        // api.x.ai /models does not expose a max-output field. Historical
+        // enrichment could persist contextWindow as outputTokens (for example
+        // 500k/500k); clear it rather than advertise an invented request cap.
+        if (out?.outputTokens != null) {
+            changed = true;
+            out = { ...out, outputTokens: null };
+        }
         if (display && display !== out?.display) {
             changed = true;
             out = { ...out, display, name: out?.name || out?.id };

package/src/runtime/agent/orchestrator/providers/media-normalization.mjs

@@ -1,4 +1,9 @@
 import { createHash } from 'node:crypto';
+import {
+    attachmentTextForPart,
+    isAttachmentReference,
+    readAttachmentBase64,
+} from '../../../attachments/store.mjs';
 
 const DEFAULT_IMAGE_MIME = 'image/png';
 
@@ -9,6 +14,9 @@ function cleanMimeType(value) {
 
 function imageInfo(block) {
     if (!block || typeof block !== 'object' || block.type !== 'image') return null;
+    if (isAttachmentReference(block)) {
+        return { data: readAttachmentBase64(block), mimeType: cleanMimeType(block.mimeType || block.mediaType) };
+    }
     if (typeof block.data === 'string' && block.data) {
         return { data: block.data, mimeType: cleanMimeType(block.mimeType || block.mediaType) };
     }
@@ -32,10 +40,13 @@ function geminiInlineInfo(block) {
 // as their native document shape; estimators must never serialize its base64.
 function fileInfo(block) {
     if (!block || typeof block !== 'object' || block.type !== 'file') return null;
-    if (typeof block.data !== 'string' || !block.data) return null;
+    const data = isAttachmentReference(block)
+        ? readAttachmentBase64(block)
+        : (typeof block.data === 'string' ? block.data : '');
+    if (!data) return null;
     const mimeType = String(block.mimeType || block.mediaType || 'application/pdf').trim().toLowerCase() || 'application/pdf';
     const filename = typeof block.filename === 'string' && block.filename ? block.filename : '';
-    return { data: block.data, mimeType, filename };
+    return { data, mimeType, filename };
 }
 
 function imageUrlFromPart(block) {
@@ -95,6 +106,7 @@ function imageMimeFromDataUrl(url) {
 function textFromPart(block) {
     if (typeof block === 'string') return block;
     if (!block || typeof block !== 'object') return '';
+    if (block.type === 'text' && isAttachmentReference(block)) return attachmentTextForPart(block);
     if (typeof block.text === 'string') return block.text;
     if (typeof block.content === 'string') return block.content;
     return '';
@@ -112,7 +124,7 @@ function contentParts(content) {
     if (content && typeof content === 'object'
         && (imageUrlFromPart(content) || imageFileIdFromPart(content)
             || imageFileUriFromPart(content) || geminiInlineInfo(content)
-            || fileInfo(content))) return [content];
+            || fileInfo(content) || isAttachmentReference(content))) return [content];
     return null;
 }
 
@@ -149,6 +161,14 @@ function imageIdentity(kind, value, mimeType = '') {
 
 function imageDescriptor(part) {
     if (!part || typeof part !== 'object') return null;
+    if (part.type === 'image' && isAttachmentReference(part)) {
+        return {
+            identity: imageIdentity('attachment-ref', part.attachmentRef, part.mimeType || part.mediaType),
+            width: positiveDimension(part.width, part.dimensions?.width),
+            height: positiveDimension(part.height, part.dimensions?.height),
+            detail: String(part.detail || 'auto').toLowerCase(),
+        };
+    }
     const info = imageInfo(part);
     const inline = geminiInlineInfo(part);
     const url = imageUrlFromPart(part);
@@ -187,6 +207,9 @@ export function contentFileDescriptors(content) {
     const parts = contentParts(content);
     if (!parts) return [];
     return parts.flatMap((part) => {
+        if (part?.type === 'file' && isAttachmentReference(part)) {
+            return [{ mimeType: String(part.mimeType || part.mediaType || 'application/pdf'), sizeBytes: Number(part.sizeBytes) || 0 }];
+        }
         const file = fileInfo(part);
         if (!file) return [];
         return [{ mimeType: file.mimeType, sizeBytes: Math.floor((file.data.length * 3) / 4) }];
@@ -215,6 +238,7 @@ function storedHistoryImagePlaceholder(part) {
 function sanitizePartForStoredHistory(part) {
     if (typeof part === 'string') return part;
     if (!part || typeof part !== 'object') return part;
+    if (isAttachmentReference(part)) return part;
     if (part.type === 'image' || part.type === 'image_url' || part.type === 'input_image' || imageUrlFromPart(part) || imageFileIdFromPart(part) || imageFileUriFromPart(part) || geminiInlineInfo(part)) {
         return { type: 'text', text: storedHistoryImagePlaceholder(part) };
     }
@@ -307,6 +331,9 @@ export function normalizeContentForAnthropic(content) {
         if (part?.type === 'input_text' || part?.type === 'output_text') {
             return { type: 'text', text: part.text || '' };
         }
+        if (part?.type === 'text' && isAttachmentReference(part)) {
+            return { type: 'text', text: attachmentTextForPart(part) };
+        }
         return part;
     });
 }

package/src/runtime/agent/orchestrator/providers/model-catalog.mjs

@@ -360,7 +360,7 @@ function _modelsDevMetadataSync(id, provider) {
     if (!pid) return null;
     if (!_mdCache) {
         warmModelsDevFromDiskSync();
-        if (!_mdCache) { void loadModelsDevCatalog(); return null; }
+        if (!_mdCache) return null;
     }
     const row = _mdCache?.[pid]?.models?.[id];
     if (!row || !row.cost) return null;
@@ -372,10 +372,12 @@ function _modelsDevMetadataSync(id, provider) {
 // require a `cost` field (staleness only needs family/release_date) and
 // returns the raw row untouched. Warms from disk one-shot if memory is cold;
 // returns null when the catalog is unavailable so callers can skip filtering.
+// Sync reads never start network work: session warmup owns remote catalog I/O,
+// and injected/provider-local transports must remain request-hermetic.
 // `_test` (tests only) injects a fake catalog map without touching disk.
 export function getModelsDevRowSync(id, provider, _test) {
     const cat = _test || _mdCache || (warmModelsDevFromDiskSync(), _mdCache);
-    if (!cat) { void loadModelsDevCatalog(); return null; }
+    if (!cat) return null;
     const pid = _modelsDevProviderId(provider);
     if (!pid) return null;
     const row = cat?.[pid]?.models?.[id];
@@ -387,7 +389,7 @@ export function getModelsDevRowSync(id, provider, _test) {
 // provider's whole catalog. Returns null when the catalog is cold/unavailable.
 export function getModelsDevProviderModelsSync(provider, _test) {
     const cat = _test || _mdCache || (warmModelsDevFromDiskSync(), _mdCache);
-    if (!cat) { void loadModelsDevCatalog(); return null; }
+    if (!cat) return null;
     const pid = _modelsDevProviderId(provider);
     if (!pid) return null;
     const models = cat?.[pid]?.models;

package/src/runtime/agent/orchestrator/providers/openai-ws-stream.mjs

@@ -535,12 +535,9 @@ export async function _streamResponse({
     // only) trips a short, named terminal StreamStalledError instead of coasting
     // to the 300s inter-chunk cap / 30-min agent watchdog.
     let semanticIdleTimer = null;
-    // WS gets its own shorter semantic-idle window. The shared SSE semantic
-    // timeout is intentionally near the 300s stall warning to protect Anthropic
-    // effort-mode "silent thinking"; using that value here lets a wedged WS
-    // request race the TUI 300s watchdog. Keep websocket stalls provider-owned:
-    // fail/retry/fallback here first, then let the TUI watchdog remain a final
-    // safety net only.
+    // WS owns its semantic-idle window. The TUI backstop is deliberately much
+    // longer, so this timeout can fail/retry/fallback at the provider boundary
+    // without racing an outer turn abort (Claude Code/Codex parity).
     const semanticIdleMs = PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS;
     const semanticIdleEnabled = PROVIDER_SSE_IDLE_WATCHDOG_ENABLED && semanticIdleMs > 0;
     // First-meaningful-frame watchdog timer + one-shot latch. Armed alongside

package/src/runtime/agent/orchestrator/providers/provider-catalog-cache.mjs

@@ -31,6 +31,22 @@ function readModelsFromCacheFile(fileName) {
   }
 }
 
+export function providerCachedModelsSync(provider) {
+  const p = String(provider || '').toLowerCase();
+  const files = PROVIDER_CACHE_FILES[p] || [];
+  const rows = [];
+  const seen = new Set();
+  for (const fileName of files) {
+    for (const row of readModelsFromCacheFile(fileName)) {
+      const id = rowId(row);
+      if (!id || seen.has(id)) continue;
+      seen.add(id);
+      rows.push({ ...row, id });
+    }
+  }
+  return rows;
+}
+
 function modelAliases(id) {
   const text = String(id || '').trim();
   if (!text) return [];
@@ -60,11 +76,17 @@ function getProviderCachedModelSync(provider, model) {
 }
 
 export function providerCachedModelMetadataSync(provider, model) {
+  const p = String(provider || '').toLowerCase();
   const row = getProviderCachedModelSync(provider, model);
   if (!row) return null;
   return {
     contextWindow: num(row.contextWindow ?? row.context_window ?? row.maxContextWindow ?? row.max_context_window ?? row.max_input_tokens),
-    outputTokens: num(row.outputTokens ?? row.maxOutputTokens ?? row.max_output_tokens ?? row.output_token_limit),
+    // Grok's /models response currently publishes a context window but no
+    // output ceiling. Older enriched cache rows copied contextWindow into
+    // outputTokens; never feed that derived value back as provider-native.
+    outputTokens: p === 'grok-oauth'
+      ? null
+      : num(row.outputTokens ?? row.maxOutputTokens ?? row.max_output_tokens ?? row.output_token_limit),
     supportsVision: row.supportsVision === true,
     supportsFunctionCalling: row.supportsFunctionCalling === true,
     supportsWebSearch: row.supportsWebSearch === true,

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -35,7 +35,7 @@ let _initChain = Promise.resolve();
 let _inFlightPromise = null;
 let _inFlightSig = null;
 let _lastAppliedSig = null;
-// Provider instances are process-global inside the backend daemon. Catalog
+// Provider instances are process-global inside the daemon. Catalog
 // readers use this revision to share one raw model snapshot while still
 // rebuilding their cheap route/config projection after auth/config changes.
 let _providerCatalogRevision = 0;
@@ -367,7 +367,7 @@ function warmupCatalogs() {
     }
 }
 
-// Force-refresh each provider's /models catalog ONCE per backend-daemon
+// Force-refresh each provider's /models catalog once per daemon.
 // lifetime. Every session runtime joins this process-global promise and then
 // reads the same provider-instance caches. Unlike
 // warmupCatalogs (which calls listModels() and so respects the 24h provider

package/src/runtime/agent/orchestrator/session/agent-loop.mjs

@@ -30,7 +30,7 @@ import {
 } from './loop/tool-classify.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { runRecallFastTrackCompact } from './loop/recall-fasttrack.mjs';
-import { executeTool, _scopedCacheOutcomeForCall } from './loop/tool-exec.mjs';
+import { executeTool, _scopedCacheOutcomeForCall, resolveLiveToolCwd } from './loop/tool-exec.mjs';
 
 // classifyResultKind is imported from result-classification.mjs at the top of
 // this file; import it from there directly rather than via this module.
@@ -420,11 +420,9 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
         const name = String(call?.name || call?.toolName || call?.function?.name || '').toLowerCase();
         return name === 'sleep' || name.endsWith('/sleep') || name.endsWith('.sleep');
     };
-    // Tool execution must use the session cwd even when the caller omitted the
-    // legacy positional cwd argument. Agent workers always carry their cwd on
-    // sessionRef; falling through to pwd()/process.cwd() resolves relatives
-    // against the host/plugin root instead of the worker workspace.
-    cwd = cwd || sessionRef?.cwd || undefined;
+    // sessionRef.cwd is the live SSOT. The legacy positional cwd is only the
+    // turn-start snapshot and becomes stale after an in-turn cwd tool call.
+    cwd = resolveLiveToolCwd(cwd, sessionRef);
     // Staged pre-cap warnings + one true hard stop. The ONLY count-based
     // forced termination is the hard cap at maxLoopIterations (default 200):
     // a genuine runaway guard. Before it, staged warnings fire at 50%/75%/90%
@@ -445,6 +443,10 @@ export async function agentLoop(provider, messages, model, tools, onToolCall, cw
             Math.floor(maxLoopIterations * 0.9),
         ];
     while (true) {
+        // A cwd tool call updates sessionRef in place. Refresh before building
+        // this iteration's eager dispatcher and cache keys so every following
+        // tool family, including apply_patch, observes the new write root.
+        cwd = resolveLiveToolCwd(cwd, sessionRef);
         const _iterT0 = Date.now();
         throwIfAborted();
         if (iterations >= maxLoopIterations) {

package/src/runtime/agent/orchestrator/session/compact.mjs

@@ -53,4 +53,4 @@ export {
 export {
     semanticCompactMessages,
     recallFastTrackCompactMessages,
-} from './compact/engine.mjs';
+} from './compact/runner.mjs';

package/src/runtime/agent/orchestrator/session/eager-dispatch.mjs

@@ -1,11 +1,19 @@
 // Eager tool-dispatch controller, extracted from agent-loop.mjs. Owns the
 // per-turn pending promise map, the intra-turn in-flight signature set, and
-// the mutation epoch. Every valid call may start while the provider is still
-// streaming, including apply_patch and shell in the same batch. Tool-local
-// conflict guards own safety; results are collected later in call order.
+// the mutation epoch. Every valid call dispatches while the provider is still
+// streaming. Calls execute in parallel except that shell after apply_patch
+// waits for every earlier patch in the turn; results are collected later in
+// call order.
 import { normalizeToolEnvelope } from './tool-envelope.mjs';
 import { isInvalidToolArgsMarker } from '../providers/openai-compat-stream.mjs';
-import { _intraTurnSig, _isReadTool, _isScopedCacheableTool, _stripMcpPrefix } from './loop/tool-classify.mjs';
+import {
+    _intraTurnSig,
+    _isMutationTool,
+    _isReadTool,
+    _isScopedCacheableTool,
+    _isShellTool,
+    _stripMcpPrefix,
+} from './loop/tool-classify.mjs';
 import { tryReadCached, tryScopedToolCached } from './read-dedup.mjs';
 import { preDispatchDenyForSession } from './loop/pre-dispatch-deny.mjs';
 import { executeTool } from './loop/tool-exec.mjs';
@@ -18,6 +26,10 @@ export function createEagerDispatcher({
     executeToolFn = executeTool,
 }) {
         const pending = new Map();
+        // Cumulative settlement barrier for patches already emitted in this
+        // assistant turn. Patches remain path-parallel with each other; only a
+        // later shell waits, so validation cannot observe pre-patch files.
+        let patchBarrier = Promise.resolve();
         // Streaming-time intra-turn dedup. When the LLM emits two
         // tool_use blocks with identical (name, args) signatures in
         // sequence, the provider's onToolCall fires for both BEFORE
@@ -90,9 +102,11 @@ export function createEagerDispatcher({
             // this call there, never start it eagerly here.
             if (preDispatchDenyForSession(sessionRef, call, toolKind) !== null) return null;
             const entry = { startedAt: Date.now(), endedAt: null, mutationEpoch: epoch.mutation };
+            const precedingPatches = _isShellTool(call.name) ? patchBarrier : null;
             if (_dedupEligible) _eagerInFlightSigs.set(_sig, call.id);
             entry.promise = (async () => {
                 try {
+                    if (precedingPatches) await precedingPatches;
                     await opts.beforeToolExecution?.();
                     return { ok: true, value: await executeToolFn(call.name, call.arguments, cwd, sessionId, sessionRef, { toolCallId: call.id, signal, notifyFn: opts.notifyFn, toolApprovalHook: opts.onToolApproval, iteration: getNextIteration(), deferShellCwdCommit: true }) };
                 } catch (error) {
@@ -152,6 +166,10 @@ export function createEagerDispatcher({
                     return settled;
                 });
             pending.set(call.id, entry);
+            if (_isMutationTool(call.name)) {
+                const currentPatch = entry.promise;
+                patchBarrier = Promise.allSettled([patchBarrier, currentPatch]).then(() => undefined);
+            }
             return entry;
         };
         const startEagerRun = (calls, startIndex, dupSet) => {

package/src/runtime/agent/orchestrator/session/loop/tool-exec.mjs

@@ -23,6 +23,7 @@ import {
 } from './tool-helpers.mjs';
 import { isOnDeferredToolSurface, prepareDeferredToolCallThrough } from './deferred-call-through.mjs';
 import { preDispatchDenyForSession, routeWebFetchCall } from './pre-dispatch-deny.mjs';
+import { runWithToolExecutionOwner } from '../../../../shared/tool-execution-owner.mjs';
 
 let codeGraphRuntimePromise = null;
 async function executeCodeGraphToolLazy(name, args, cwd, signal = null, options = {}) {
@@ -32,6 +33,11 @@ async function executeCodeGraphToolLazy(name, args, cwd, signal = null, options
     return mod.executeCodeGraphTool(name, args, cwd, signal, options);
 }
 
+export function resolveLiveToolCwd(cwd, sessionRef) {
+    const liveCwd = typeof sessionRef?.cwd === 'string' ? sessionRef.cwd : '';
+    return liveCwd || cwd;
+}
+
 export function _scopedCacheOutcomeForCall(sessionRef, toolCallId, toolName, callerSessionId, executeOpts = {}) {
     if (executeOpts.scopedCacheOutcome) {
         if (sessionRef && toolCallId) {
@@ -51,7 +57,16 @@ export function _scopedCacheOutcomeForCall(sessionRef, toolCallId, toolName, cal
     return outcome;
 }
 
-export async function executeTool(name, args, cwd, callerSessionId, sessionRef, executeOpts = {}) {
+export function executeTool(name, args, cwd, callerSessionId, sessionRef, executeOpts = {}) {
+    return runWithToolExecutionOwner(callerSessionId, () =>
+        executeToolOwned(name, args, cwd, callerSessionId, sessionRef, executeOpts));
+}
+
+async function executeToolOwned(name, args, cwd, callerSessionId, sessionRef, executeOpts = {}) {
+    // cwd is captured when the turn starts. The deferred cwd tool updates
+    // sessionRef.cwd in place, so every later tool call must re-read that live
+    // value instead of continuing to use the stale turn snapshot.
+    cwd = resolveLiveToolCwd(cwd, sessionRef);
     const scopedCacheOutcome = _scopedCacheOutcomeForCall(
         sessionRef,
         executeOpts.toolCallId,
@@ -174,7 +189,10 @@ export async function executeTool(name, args, cwd, callerSessionId, sessionRef,
             && mcpToolHasField(name, 'cwd')
             && (args == null || args.cwd == null);
         const finalArgs = needsCwdInjection ? { ...(args || {}), cwd } : args;
-        return executeMcpTool(name, finalArgs);
+        return executeMcpTool(name, finalArgs, {
+            signal: executeOpts.signal || null,
+            ownerKey: callerSessionId,
+        });
     }
     if (name === 'code_graph') {
         // cwd chain: args.cwd (caller-explicit) → session cwd → undefined (handler throws)

package/src/runtime/agent/orchestrator/session/loop/tool-helpers.mjs

@@ -40,9 +40,10 @@ export function isEagerDispatchable(name, tools) {
     return set.has(name);
 }
 
-// Full-parallel dispatch policy: EVERY valid tool call in an assistant turn
-// starts immediately. Mutations rely on their own conflict scope (apply_patch
-// uses per-path locks), so disjoint writes never wait behind a global barrier.
+// Full dispatch policy: EVERY valid tool call in an assistant turn is queued
+// immediately. Mutations rely on their own conflict scope (apply_patch uses
+// per-path locks); the eager dispatcher adds only the apply_patch -> shell
+// execution barrier required for same-turn validation.
 // isEagerDispatchable above remains the READ-ONLY classifier used for dedup
 // eligibility, steering, and post-mutation result invalidation.
 export function isParallelDispatchable(name) {