mixdog 1.0.8 → 1.0.10

package/src/runtime/agent/orchestrator/providers/openai-oauth-catalog.mjs

@@ -21,7 +21,7 @@ import { CODEX_OAUTH_ORIGINATOR, codexModelsUrl } from './openai-codex-endpoints
 import { _normalizeCodexModel, _markLatestCodex } from './openai-codex-model.mjs';
 
 const CODEX_MODEL_CACHE_TTL_MS = 24 * 60 * 60_000;
-const CODEX_MODEL_CACHE_SCHEMA_VERSION = 5;
+const CODEX_MODEL_CACHE_SCHEMA_VERSION = 6;
 const CATALOG_FETCH_TIMEOUT_MS = 10_000;
 
 // In-memory mirror of the on-disk catalog, same pattern as anthropic-oauth.
@@ -59,6 +59,12 @@ export function codexCatalogHas(id) {
   return _mirror.some((m) => m.id === id);
 }
 
+/** The catalog's own answer, or null when it has none for this model. */
+export function codexModelSupportsEffortUpdates(id) {
+  const supported = findCachedCodexModel(id)?.supportsReasoningEffortUpdates;
+  return typeof supported === 'boolean' ? supported : null;
+}
+
 export function codexModelSupportsServiceTier(id, serviceTier) {
   return modelSupportsServiceTier(findCachedCodexModel(id), serviceTier);
 }

package/src/runtime/agent/orchestrator/providers/provider-base-url.mjs

@@ -0,0 +1,24 @@
+// Keep saved custom endpoints and OpenAI-compatible clients under the same
+// transport policy: credentials may travel over HTTP only on loopback.
+export function assertSafeBaseURL(rawURL, providerName) {
+  let parsed;
+  try {
+    parsed = new URL(String(rawURL));
+  } catch {
+    throw new Error(`[provider:${providerName}] invalid baseURL`);
+  }
+  const scheme = parsed.protocol.toLowerCase();
+  if (scheme !== 'https:' && scheme !== 'http:') {
+    throw new Error(`[provider:${providerName}] baseURL scheme not allowed: ${parsed.protocol} (only http/https)`);
+  }
+  if (scheme === 'http:') {
+    const host = parsed.hostname.toLowerCase();
+    const isLocal = host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+    if (!isLocal) {
+      throw new Error(
+        `[provider:${providerName}] baseURL must use https for non-localhost host (got ${parsed.protocol}//${parsed.hostname})`
+      );
+    }
+  }
+  return rawURL;
+}

package/src/runtime/agent/orchestrator/providers/registry.mjs

@@ -150,7 +150,16 @@ const PROVIDER_MODULES = {
   'opencode-go': ['./opencode-go.mjs', 'OpenCodeGoProvider'],
 };
 
-async function loadProviderCtor(name, signal = null) {
+// User-defined providers (cfg.type === 'custom') are keyed by a generated
+// `custom-<uuid>` id and never collide with the built-in names.
+function isCustomProviderConfig(name, cfg) {
+  return cfg?.type === 'custom' && String(name).startsWith('custom-');
+}
+
+async function loadProviderCtor(name, signal = null, cfg = null) {
+  if (isCustomProviderConfig(name, cfg)) {
+    return loadProviderExport('custom-provider', './custom-provider.mjs', 'createCustomProvider', signal);
+  }
   if (Object.hasOwn(PROVIDER_MODULES, name)) {
     const [spec, exportName] = PROVIDER_MODULES[name];
     return loadProviderExport(name, spec, exportName, signal);
@@ -161,7 +170,8 @@ async function loadProviderCtor(name, signal = null) {
   throw new Error(`unknown enabled provider: ${name}`);
 }
 
-function instantiateProvider(name, Ctor, cfg) {
+async function instantiateProvider(name, Ctor, cfg) {
+  if (isCustomProviderConfig(name, cfg)) return wrapProviderAdmission(await Ctor(name, cfg), name);
   if (Object.hasOwn(OPENAI_COMPAT_PRESETS, name) && name !== 'opencode-go') {
     return wrapProviderAdmission(new Ctor(name, cfg), name);
   }
@@ -239,9 +249,9 @@ async function _initProvidersUnsynchronized(config, signal = null) {
         return { name, inst: providers.get(name), sig };
       }
       try {
-        const Ctor = await loadProviderCtor(name, signal);
+        const Ctor = await loadProviderCtor(name, signal, cfg);
         throwIfAborted(signal);
-        const inst = instantiateProvider(name, Ctor, cfg);
+        const inst = await instantiateProvider(name, Ctor, cfg);
         return { name, inst, sig };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/src/runtime/agent/orchestrator/providers/retry-classification.mjs

@@ -469,6 +469,22 @@ const CONTEXT_OVERFLOW_PATTERNS = [
   /context[_ ]length[_ ]exceeded/i,
   /prompt is too long/i,
   /reduce the length of (?:the )?(?:messages|input|prompt)/i,
+  // Wordings other backends use for the same refusal, each tied to a context
+  // or input-length noun so a tokens-per-minute rate limit never matches.
+  /prompt too long/i, // z.ai, Ollama
+  /prompt exceeds max length/i, // z.ai CN endpoint
+  /input is too long for requested model/i, // Amazon Bedrock
+  /input token count.*exceeds the maximum/i, // Google
+  /maximum prompt length is \d+/i, // xAI
+  /exceeds (?:the )?maximum allowed input length/i, // OpenRouter relays
+  /is longer than the model'?s context length/i, // Together AI
+  /exceeds the available context size/i, // llama.cpp server
+  /greater than the context length/i, // LM Studio
+  /context window exceeds limit/i, // MiniMax
+  /exceeded model token limit/i, // Kimi
+  /too large for model with \d+ maximum context length/i, // Mistral
+  /range of input length should be/i, // DashScope / Qwen
+  /model_context_window_exceeded/i, // z.ai finish reason surfaced as text
 ];
 
 /**

package/src/runtime/agent/orchestrator/runtime-core/builtin-features.mjs

@@ -148,26 +148,6 @@ export function localGitToolsActive(configLike, { gitAvailable } = {}) {
   );
 }
 
-/** Capabilities that ask the user once per session before their first live
- *  call: the desktop and the browser are the user's, and one approval at the
- *  moment of first use is how the user learns the model reached for them. */
-export const BRIDGE_FIRST_USE_IDS = Object.freeze(['browser', 'computer']);
-
-/** On unless the profile turns it off for that capability;
- *  MIXDOG_BRIDGE_FIRST_USE_APPROVAL overrides per process (headless, bench). */
-export function builtinFirstUseApproval(configLike, id) {
-  return (
-    featureEnvOverride('MIXDOG_BRIDGE_FIRST_USE_APPROVAL') ?? configLike?.builtins?.[id]?.firstUseApproval !== false
-  );
-}
-
-export function setBuiltinFirstUseApprovalInConfig(configLike, id, enabled) {
-  const next = { ...(configLike || {}) };
-  next.builtins = { ...(next.builtins || {}) };
-  next.builtins[id] = { ...(next.builtins[id] || {}), firstUseApproval: enabled !== false };
-  return next;
-}
-
 export function setBuiltinInstalledInConfig(configLike, id, installed = true) {
   const next = { ...(configLike || {}) };
   next.builtins = { ...(next.builtins || {}) };

package/src/runtime/agent/orchestrator/runtime-core/config-helpers.mjs

@@ -14,7 +14,7 @@ export function makeResolveDefaultProvider(isKnownProvider) {
   return function resolveDefaultProvider(config) {
     const selectedMain = findPreset(config, config?.default);
     const configured = clean(selectedMain?.provider);
-    if (configured && isKnownProvider(configured)) return configured;
+    if (configured && isKnownProvider(configured, config)) return configured;
     return DEFAULT_PROVIDER;
   };
 }
@@ -124,7 +124,8 @@ export function isLikelyRawModelId(value) {
   const model = clean(value);
   if (!model || model.length > 160) return false;
   if (/\s/.test(model)) return false;
-  return /^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$/.test(model);
+  // OpenRouter's rolling model aliases start with a literal "~".
+  return /^~?[A-Za-z0-9][A-Za-z0-9._:/@+-]*$/.test(model);
 }
 
 export function validateRequestedModelSelector(config, requested = {}) {

package/src/runtime/agent/orchestrator/runtime-core/model-capabilities.mjs

@@ -5,6 +5,7 @@
 import { clean, hasOwn } from './session-text.mjs';
 import { modelSupportsServiceTier } from '../providers/model-service-tiers.mjs';
 import { openAiDirectSupportsFast } from '../providers/openai-direct-request.mjs';
+import { supportsAnthropicFastMode } from '../../../shared/llm/anthropic-betas.mjs';
 
 const FAST_CAPABLE_PROVIDERS = new Set([
   'anthropic',
@@ -52,16 +53,11 @@ function geminiModelSupportsHostedWebSearch(model) {
 function anthropicModelSupportsHostedWebSearch(model) {
   const id = clean(model?.id || model).toLowerCase();
   if (!id) return false;
-  const match = id.match(/^claude-(opus|sonnet|haiku)-(\d+)(?:[-.](\d+))?/);
+  const match = id.match(/^claude-(opus|sonnet|haiku|fable|mythos)-(\d+)(?:[-.](\d+))?/);
   if (!match) return false;
   return (Number(match[2]) || 0) >= 4;
 }
 
-function anthropicModelMetaSupportsFast(model) {
-  const id = clean(model?.id || model).toLowerCase();
-  return /^claude-(opus|sonnet)/.test(id);
-}
-
 export function fastCapableFor(provider, model, effort = null, modelParameters = {}) {
   const p = clean(provider);
   if (!FAST_CAPABLE_PROVIDERS.has(p)) return false;
@@ -82,7 +78,7 @@ export function fastCapableFor(provider, model, effort = null, modelParameters =
   }
   if (p === 'openai') return openAiDirectSupportsFast(model);
   if (p === 'openai-oauth') return modelSupportsServiceTier(model, 'priority');
-  if (p === 'anthropic' || p === 'anthropic-oauth') return anthropicModelMetaSupportsFast(model);
+  if (p === 'anthropic' || p === 'anthropic-oauth') return supportsAnthropicFastMode(clean(model?.id || model));
   return false;
 }
 
@@ -127,9 +123,15 @@ export function saveModelSettings(cfgMod, route, { fastCapable = true, baseConfi
   } else {
     delete nextSetting.modelParameters;
   }
-  const contextPercent = Number(route.contextPercent);
-  if (Number.isFinite(contextPercent) && contextPercent >= 10 && contextPercent <= 100) {
-    nextSetting.contextPercent = Math.round(contextPercent / 10) * 10;
+  // Only a window the user moved off the model's default is a setting. The
+  // pickers send the default stop with every selection; storing it froze each
+  // model at whatever its default was that day, so a later default never
+  // reached anyone who had already selected the model.
+  const requestedPercent = Number(route.contextPercent);
+  const contextPercent = Math.round(requestedPercent / 10) * 10;
+  const isDefault = contextPercent === Number(route.contextDefaultPercent);
+  if (requestedPercent >= 10 && requestedPercent <= 100 && !isDefault) {
+    nextSetting.contextPercent = contextPercent;
   } else {
     delete nextSetting.contextPercent;
   }

package/src/runtime/agent/orchestrator/session/compact/runner.mjs

@@ -119,7 +119,9 @@ function summarySendOpts(opts) {
     effort: 'low',
     effortConfiguration: undefined,
     effortConfigurationEnabled: false,
-    fast: opts.fast ?? opts.sendOpts?.fast ?? true,
+    // Fast mode is opt-in (it needs separate account credits); the summary
+    // follows the route/session choice and never enables it on its own.
+    fast: opts.fast ?? opts.sendOpts?.fast ?? false,
     maxOutputTokens: opts.maxOutputTokens || SUMMARY_OUTPUT_TOKENS,
     providerState: undefined,
     onToolCall: undefined,

package/src/runtime/agent/orchestrator/session/loop/fresh-context.mjs

@@ -54,7 +54,7 @@ export async function resolveCompactionRoute({
   const contextWindow =
     sameModel && positiveInt(sessionRef?.contextWindow)
       ? positiveInt(sessionRef.contextWindow)
-      : resolveSessionContextMeta(selectedProvider, selectedModel).contextWindow;
+      : resolveSessionContextMeta(selectedProvider, selectedModel, {}, { wholeWindow: true }).contextWindow;
   return {
     provider: selectedProvider,
     providerName,

package/src/runtime/agent/orchestrator/session/manager/context-meta.mjs

@@ -2,6 +2,7 @@
 // resolution.
 
 import { getModelMetadataSync } from '../../providers/model-catalog.mjs';
+import { contextWindowRange } from '../../../../shared/llm/default-context-window.mjs';
 import { positiveInt } from '../../../../shared/numbers.mjs';
 
 // Family-pattern fallback used only when the provider and external catalogs
@@ -96,11 +97,12 @@ function providerRawContextWindow(info, catalogInfo) {
   if (catalogWindow && fromCache !== catalogWindow) return catalogWindow;
   return fromCache || null;
 }
-export function resolveSessionContextMeta(provider, model, seed = {}) {
+// `wholeWindow` asks for everything the model can take in (the summary route
+// budgets its own input that way) instead of the window a session starts with.
+export function resolveSessionContextMeta(provider, model, seed = {}, { wholeWindow = false } = {}) {
   const info = typeof provider?.getCachedModelInfo === 'function' ? provider.getCachedModelInfo(model) : null;
   const catalogInfo = getModelMetadataSync(model, providerNameOf(provider));
-  const requestedContextWindow =
-    positiveInt(seed.selectedContextWindow) ||
+  const servedContextWindow =
     providerRawContextWindow(info, catalogInfo) ||
     positiveInt(catalogInfo?.contextWindow) ||
     positiveInt(catalogInfo?.maxContextWindow) ||
@@ -110,6 +112,16 @@ export function resolveSessionContextMeta(provider, model, seed = {}) {
     positiveInt(seed.raw_context_window) ||
     positiveInt(seed.contextWindow) ||
     guessContextWindow(model, providerNameOf(provider));
+  // A session that records no selection starts from the model's default
+  // window, the one the picker shows. A recorded percentage without its window
+  // (a session older than selectedContextWindow, a route saved before the
+  // catalog warmed) is still the user's choice and keeps the served window.
+  const recordsSelection = wholeWindow || boundedPercent(seed.contextPercent) !== null;
+  const requestedContextWindow =
+    positiveInt(seed.selectedContextWindow) ||
+    (recordsSelection
+      ? servedContextWindow
+      : contextWindowRange({ provider: providerNameOf(provider), contextWindow: servedContextWindow }).defaultWindow);
   // A managed runtime's allocated capacity also bounds restored selections
   // and catalog metadata; raising a slider cannot allocate server memory.
   const runtimeContextWindow = positiveInt(info?.runtimeContextWindow);

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -13,7 +13,12 @@ import { buildProviderCacheOpts, cacheCapabilityForProvider } from '../../agent-
 import { normalizeAutoClearConfig, resolveAutoClearIdleMs } from '../../runtime-core/config-helpers.mjs';
 import { _buildBaseRules } from './rules-cache.mjs';
 import { composeSessionSystem, seedSessionMessages } from './session-prompt-composition.mjs';
-import { _prepareResumeTools, delegationDisabled, resolveSessionToolSurface } from './session-tool-surface.mjs';
+import {
+  _prepareResumeTools,
+  delegationDisabled,
+  honoredSchemaAllowlist,
+  resolveSessionToolSurface,
+} from './session-tool-surface.mjs';
 import { _forgetPreparedResume, _preparedResumeMatches, _readPreparedResume } from './prepared-resume-cache.mjs';
 import {
   filterModelEditToolNames,
@@ -175,6 +180,7 @@ export function createSession(opts) {
   logSessionSurface(surface);
   const contextMeta = resolveSessionContextMeta(provider, modelName, {
     selectedContextWindow: opts.selectedContextWindow,
+    contextPercent: route.contextPercent,
   });
   const session = buildSessionRecord({
     opts,
@@ -215,7 +221,10 @@ export function _refreshSessionRuleVariantsForModel(session, previousModel, prev
     ...(getHiddenAgent(session?.agent || null) ? ['Skill'] : []),
     ...(delegationDisabled(session, isAgentOwner(session)) ? ['agent'] : []),
   ];
-  const allowTools = isAgentOwner(session) ? null : session?.schemaAllowedTools;
+  const allowTools = honoredSchemaAllowlist(session?.schemaAllowedTools, {
+    ownerIsAgent: isAgentOwner(session),
+    agent: session?.agent || null,
+  });
   const previousRules = _buildBaseRules({
     omitTools: [...deny, unusedModelEditToolName(previousModel)],
     allowTools,

package/src/runtime/agent/orchestrator/session/manager/session-prompt-composition.mjs

@@ -63,7 +63,11 @@ function buildShellEnvironmentContext(opts, ownerIsAgent, toolsForRouting) {
 // four system blocks; environmentTailContext is the persisted env tail.
 export function composeSessionSystem(opts, { profile, providerName, modelName, surface }) {
   const { ownerIsAgent, resolvedAgent, skills } = surface;
-  const skipAgentRules = opts.skipAgentRules === true;
+  // A tool-free hidden role (a one-shot classifier or title writer) carries
+  // only its own role rules: the shared tool policy and the worker conduct
+  // rules describe work it is offered no tool for.
+  const toolFreeRole = ownerIsAgent && surface.schemaAllowedTools?.length === 0;
+  const skipAgentRules = opts.skipAgentRules === true || toolFreeRole;
   const injectedRules = skipAgentRules
     ? ''
     : _buildBaseRules({

package/src/runtime/agent/orchestrator/session/manager/session-tool-surface.mjs

@@ -29,6 +29,19 @@ function resolveToolSpec(toolPreset, profile, ownerIsAgent) {
   return Array.isArray(profile?.tools) ? profile.tools : toolPreset;
 }
 
+// The schema allowlist a session honours. Agent-owned sessions share one
+// schema, so an allowlist handed down by a caller never narrows them — except
+// the profile the session's own hidden role declares (agents.json
+// toolSchemaProfile). Without that exception a tool-free maintenance role was
+// sent the whole Agent schema on every one-shot call while the dispatch gate
+// refused each of those tools (usage ledger 2026-09-30..10-05: 4104 cycle1
+// calls at ~8.5K prompt tokens, about two thirds of it the 12-tool schema).
+export function honoredSchemaAllowlist(schemaAllowedTools, { ownerIsAgent = false, agent = null } = {}) {
+  if (!Array.isArray(schemaAllowedTools)) return null;
+  if (ownerIsAgent && !getHiddenAgent(agent)) return null;
+  return schemaAllowedTools;
+}
+
 // Every tool omitted by a caller schema allowlist is omitted from BP1 too.
 // The model never receives guidance for a tool it cannot call, and a new
 // process-wide built-in cannot leak into a narrow profile's prompt.
@@ -48,13 +61,17 @@ export function resolveSessionToolSurface(opts, { profile, toolPreset, modelName
   const resolvedAgent = opts.agent || opts.role || profile?.taskType || null;
   const hiddenAgent = getHiddenAgent(resolvedAgent);
   const isRetrievalAgent = hiddenAgent?.kind === 'retrieval';
-  // Lead and Agent share the same cwd-scoped Skill inventory.
-  const skills = opts.skipSkills ? [] : collectPromptSkillsCached(opts.cwd);
-  // BP1 shared tool policy ships to EVERY role (Lead, workers, retrieval,
-  // maintenance): its anti-spiral clauses (one anchor is enough, never
+  const hasCallerAllow = Array.isArray(opts.schemaAllowedTools);
+  const schemaAllowedTools = honoredSchemaAllowlist(opts.schemaAllowedTools, { ownerIsAgent, agent: resolvedAgent });
+  // Lead and Agent share the same cwd-scoped Skill inventory. A session that
+  // is offered no tool cannot load a skill, so it is not sent the manifest.
+  const skills = opts.skipSkills || schemaAllowedTools?.length === 0 ? [] : collectPromptSkillsCached(opts.cwd);
+  // BP1 shared tool policy ships to every role that is offered tools (Lead,
+  // workers, retrieval): its anti-spiral clauses (one anchor is enough, never
   // repeat equivalent patterns/scopes, plausible hit → stop) are exactly
   // what narrow retrieval roles need. Role docs
-  // override role-inapplicable entries.
+  // override role-inapplicable entries. A tool-free role is sent none of it
+  // (session-prompt-composition.mjs).
   const sessionDeny = [
     ...(Array.isArray(opts.disallowedTools) ? opts.disallowedTools : []),
     ...(delegationDisabled(opts, ownerIsAgent) ? ['agent'] : []),
@@ -70,8 +87,6 @@ export function resolveSessionToolSurface(opts, { profile, toolPreset, modelName
     cwd: opts.cwd || null,
   });
 
-  const hasCallerAllow = Array.isArray(opts.schemaAllowedTools);
-  const schemaAllowedTools = ownerIsAgent || !hasCallerAllow ? null : opts.schemaAllowedTools;
   const tools = finalizeSessionToolList(toolsForRouting, {
     schemaAllowedTools,
     disallowedTools: sessionDeny,
@@ -121,8 +136,7 @@ export function _prepareResumeTools(session, preset) {
     toolSpec,
     ownerIsAgent,
     tools: finalizeSessionToolList(toolsForRouting, {
-      schemaAllowedTools:
-        !ownerIsAgent && Array.isArray(session.schemaAllowedTools) ? session.schemaAllowedTools : null,
+      schemaAllowedTools: honoredSchemaAllowlist(session.schemaAllowedTools, { ownerIsAgent, agent: session.agent }),
       disallowedTools: [
         ...(Array.isArray(session.disallowedTools) ? session.disallowedTools : []),
         ...(delegationDisabled(session, ownerIsAgent) ? ['agent'] : []),

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/deadline-plan.mjs

@@ -1,8 +1,12 @@
 // Commands start in the foreground. Only work still running after the
-// 10 s coordination budget is promoted to a tracked background task.
+// 15 s coordination budget is promoted to a tracked background task.
 // Short commands therefore complete in the original tool turn, while longer
 // work returns partial output plus task_id and finishes by notification.
-export const DEFAULT_SHELL_AUTO_BACKGROUND_MS = 10_000;
+// 15 s because a command promoted moments before it ends costs a whole
+// follow-up request on `task wait`. Session logs (2026-09-30..10-05), the 260
+// promoted commands with a recorded duration: 108 had ended within 10 s, 144
+// within 15 s and only 152 within 20 s.
+export const DEFAULT_SHELL_AUTO_BACKGROUND_MS = 15_000;
 
 // JS timers (setTimeout) and PS WaitForExit(ms) are 32-bit: a delay above
 // 2^31-1 wraps to a tiny/negative value and fires immediately. Clamp the
@@ -13,12 +17,17 @@ const TIMER_MAX_MS = 2_147_483_647;
 
 // Main-agent blocking budget. A timeout is the command's total deadline, not
 // permission to hold the conversation open for that whole duration: after
-// 10 s a still-running command becomes a tracked background task and
+// 15 s a still-running command becomes a tracked background task and
 // completion is pushed to the owner. MIXDOG_SHELL_AUTO_BACKGROUND_MS
 // overrides; an explicit 0 disables. Gated on backgroundOnTimeout so
 // disabled background tasks remain foreground.
-// A per-call wait_ms replaces that default for the call, capped by the
-// foreground maximum.
+// A per-call wait_ms extends that default for the call, capped by the
+// foreground maximum; it never shortens it. A shorter window promotes a
+// command that would have returned its result in the starting call and spends
+// a whole follow-up request on `task wait`. Session logs (2026-09-30..10-05,
+// 3062 shell calls): 329 passed a wait_ms under the default (53% of one model
+// family's calls), 256 of those were promoted, and 108 of the 192 with a
+// recorded duration had finished inside the default window (10 s then).
 function autoBackgroundBudget(backgroundOnTimeout, timeout, waitMs, maxForegroundMs) {
   const raw = process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS;
   const parsed = Number(raw);
@@ -26,7 +35,7 @@ function autoBackgroundBudget(backgroundOnTimeout, timeout, waitMs, maxForegroun
     raw != null && String(raw).trim() !== '' && Number.isFinite(parsed) && parsed >= 0
       ? Math.floor(parsed)
       : DEFAULT_SHELL_AUTO_BACKGROUND_MS;
-  if (waitMs > 0) defaultMs = Math.min(waitMs, maxForegroundMs);
+  if (waitMs > 0) defaultMs = Math.max(defaultMs, Math.min(waitMs, maxForegroundMs));
   if (!backgroundOnTimeout || defaultMs <= 0) return 0;
   return timeout > 0 ? Math.min(defaultMs, timeout) : defaultMs;
 }

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -146,7 +146,7 @@ export const BUILTIN_TOOLS = [
       openWorldHint: true,
       compressible: true,
     },
-    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 10s foreground window (not a timeout; wait_ms extends it up to 120s for one call, e.g. a test suite), unfinished work continues under task_id; use task wait, not read polling. If no execution slot frees within the admission wait, the command is queued as a background task with a task_id.'}`,
+    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 15s foreground window (not a timeout; wait_ms extends it up to 120s for one call, e.g. a test suite), unfinished work continues under task_id; use task wait, not read polling. If no execution slot frees within the admission wait, the command is queued as a background task with a task_id.'}`,
     inputSchema: {
       type: 'object',
       properties: {
@@ -155,14 +155,14 @@ export const BUILTIN_TOOLS = [
           type: 'integer',
           minimum: 0,
           description:
-            'Hard kill deadline in ms (omit or 0 = none), separate from the 10s foreground window; set one for throwaway probes so a slow check fails fast.',
+            'Hard kill deadline in ms (omit or 0 = none), separate from the 15s foreground window; set one for throwaway probes so a slow check fails fast.',
         },
         wait_ms: {
           type: 'integer',
-          minimum: 1000,
+          minimum: 15000,
           maximum: 120000,
           description:
-            'Foreground wait in ms before unfinished work continues as a background task (default 10000); raise it for a command that should return its result in this call.',
+            'Foreground wait in ms before unfinished work continues as a background task (default 15000); raise it for a command that should return its result in this call.',
         },
       },
       required: ['command'],

package/src/runtime/agent/orchestrator/tools/patch/native-server.mjs

@@ -439,6 +439,8 @@ class NativePatchServer {
 
   #contractPromise = null;
 
+  #contractPending = false;
+
   constructor(binPath) {
     this.binPath = binPath;
     // windowsHide: mixdog-patch.exe is a console binary; without this each spawn
@@ -484,6 +486,13 @@ class NativePatchServer {
     this.#child.stdin.on('error', (err) => {
       this.failTransport(err);
     });
+    // A spawn that fails outright (an artifact without the execute bit, or one
+    // removed between the gate's read and the spawn) reports only through the
+    // child's own 'error' event; unheard, it crashed the host instead of
+    // failing the handshake closed.
+    this.#child.on('error', (err) => {
+      this.failTransport(err);
+    });
     this.#child.on('exit', (code, signal) => {
       this.exited = true;
       const err = new Error(`native patch server exited code=${code} signal=${signal} stderr=${this.stderr}`);
@@ -537,15 +546,23 @@ class NativePatchServer {
   // the caller may respawn and retry without any risk of double-applying.
   // Contract handshake on THIS session, memoized per instance: N concurrent
   // callers await one exchange, and a respawned session proves itself again.
+  /** True while the handshake runs: between its exchanges no waiter is queued, yet the handles must stay referenced. */
+  get contractPending() {
+    return this.#contractPending;
+  }
+
   contract() {
     if (!this.#contractPromise) {
+      this.#contractPending = true;
       this.#contractPromise = verifyContractOverSession(this.#handshakeView()).then(
         (ok) => {
+          this.#contractPending = false;
           this.#contractVerified = ok === true;
           if (!ok) this.markContractFailed();
           return ok;
         },
         () => {
+          this.#contractPending = false;
           this.#contractVerified = false;
           this.markContractFailed();
           return false;
@@ -877,7 +894,11 @@ export function scheduleNativePatchPrewarm() {
           }
         }
         await getNativePatchServer().ping();
-        if (!nativePatchPersistent() && (_nativePatchServer?.waiters?.length || 0) === 0) {
+        if (
+          !nativePatchPersistent() &&
+          (_nativePatchServer?.waiters?.length || 0) === 0 &&
+          !_nativePatchServer?.contractPending
+        ) {
           _nativePatchServer?.unref();
         }
         if (nativePatchTraceEnabled()) {

package/src/runtime/channels/lib/voice-transcription.mjs

@@ -98,6 +98,35 @@ async function probeAudioDurationSec(filePath) {
   }
 }
 
+// Leading silence so a clipped onset still decodes as the first word. The
+// bundled ffmpeg carries only aformat/anull/aresample
+// (scripts/build-ffmpeg-runtime.sh), so the pad is spliced into the converted
+// wav here: zero samples in front of its PCM data.
+const ONSET_SILENCE_SECONDS = 0.3;
+
+export function prependWavSilence(wavPath, seconds = ONSET_SILENCE_SECONDS) {
+  const wav = fs.readFileSync(wavPath);
+  let sampleRate = 0;
+  let blockAlign = 0;
+  for (let offset = 12; offset + 8 <= wav.length; ) {
+    const id = wav.toString('ascii', offset, offset + 4);
+    const size = wav.readUInt32LE(offset + 4);
+    if (id === 'fmt ') {
+      sampleRate = wav.readUInt32LE(offset + 12);
+      blockAlign = wav.readUInt16LE(offset + 20);
+    } else if (id === 'data') {
+      const silence = Buffer.alloc(Math.round(sampleRate * seconds) * blockAlign);
+      const out = Buffer.concat([wav.subarray(0, offset + 8), silence, wav.subarray(offset + 8)]);
+      out.writeUInt32LE(size + silence.length, offset + 4);
+      out.writeUInt32LE(out.length - 8, 4);
+      fs.writeFileSync(wavPath, out);
+      return;
+    }
+    offset += 8 + size + (size % 2);
+  }
+  throw new Error(`no PCM data chunk in ${wavPath}`);
+}
+
 // One whisper-ready wav per attachment: a cached conversion is reused while its
 // file still exists, and parallel callers for the same key share a single
 // ffmpeg spawn instead of racing two conversions onto the same output path.
@@ -126,9 +155,6 @@ function createVoiceWavCache() {
           const _ffmpegPromise = runCmd(ffmpegPath, [
             '-i',
             audioPath,
-            // Leading silence so a clipped onset still decodes as the first word.
-            '-af',
-            'adelay=300:all=1',
             '-ar',
             String(sampleRate),
             '-ac',
@@ -137,7 +163,7 @@ function createVoiceWavCache() {
             String(threadCount),
             '-y',
             wavPath,
-          ]);
+          ]).then(() => prependWavSilence(wavPath));
           ffmpegInflight.set(_ffmpegKey, _ffmpegPromise);
           try {
             await _ffmpegPromise;

package/src/runtime/computer-bridge/action-schema.mjs

@@ -118,11 +118,11 @@ const captureProperties = {
   include_ocr: {
     type: 'boolean',
     description:
-      'State/SOM automatically use offline Windows OCR when semantic targets are absent; true always runs OCR even when semantic targets exist. OCR shares max_elements. Zoom recognizes the crop itself, which is how enlarged text becomes readable.',
+      'State/SOM automatically use offline OS OCR when semantic targets are absent; true always runs OCR even when semantic targets exist. OCR shares max_elements. Zoom recognizes the crop itself, which is how enlarged text becomes readable.',
   },
   ocr_language: {
     ...ocrLanguage,
-    description: 'Installed Windows OCR language tag, e.g. ko or en-US.',
+    description: 'Installed OS OCR language tag, e.g. ko or en-US.',
   },
   // Image encoding (JPEG quality, downscale width) and the OCR word cap are
   // host defaults: the element budget already bounds OCR, and a frame the
@@ -213,7 +213,7 @@ export const COMPUTER_INPUT_SCHEMA = {
         ...windowTarget,
         ocr_language: {
           ...ocrLanguage,
-          description: 'Optional Windows OCR language tag to verify, e.g. ko or en-US.',
+          description: 'Optional OS OCR language tag to verify, e.g. ko or en-US.',
         },
       }),
       false

package/src/runtime/computer-bridge/actions.mjs

@@ -31,6 +31,10 @@ action('ocr_image', nativeRead);
 action('ocr_status', nativeRead);
 action('release_session', { retainNativeRefs: true });
 action('release_cursor_theme', { retainNativeRefs: true });
+// Handing held input, focus and pointer back changes no target's content, so a
+// turn's end keeps the refs of its last observation for a follow-up turn.
+action('release_held_input', { retainNativeRefs: true });
+action('restore_input_state', { retainNativeRefs: true });
 action('list_apps', { ...hostRead, ...replay, policy: 'list' });
 action('list_installed_apps', { ...nativeRead, ...replay, policy: 'list' });
 action('list_history', { ...hostRead, ...replay, policy: 'list' });

package/src/runtime/computer-bridge/bridge-env.test-support.mjs

@@ -0,0 +1,22 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// Creates a temp directory and points the env var `name` at it until `cleanup()`.
+export async function makeTempEnvDir(name, prefix) {
+  const directory = await mkdtemp(join(tmpdir(), prefix));
+  const previous = process.env[name];
+  process.env[name] = directory;
+  return {
+    directory,
+    async cleanup() {
+      if (previous === undefined) delete process.env[name];
+      else process.env[name] = previous;
+      await rm(directory, { recursive: true, force: true });
+    },
+  };
+}
+
+export function writeBridgeDiscovery(directory, fields) {
+  return writeFile(join(directory, 'computer-bridge.json'), JSON.stringify({ version: 1, ...fields }));
+}