mixdog 1.2.1 → 1.2.3

package/src/runtime/agent/orchestrator/session/store-summary-reader.mjs

@@ -250,6 +250,14 @@ function storedSessionMetadata(sessionId, session) {
   };
 }
 
+/** A record that is gone may be a reaped agent child: its parent is resolved
+ *  from metadata only (worker link, summary-index row), never by a scan. */
+function readVanishedSessionTranscript(sessionId) {
+  return readArchivedAgentResult(sessionId, {
+    catalogRow: (id) => ordinaryCatalog.loadIndex().rowsById.get(id) || null,
+  });
+}
+
 /** The two files a stored transcript projection is built from. */
 function storedTranscriptInputPaths(sessionId) {
   return {
@@ -375,7 +383,7 @@ export async function readStoredSessionTranscript(id, options = {}) {
   // Phase durations of the parse this call ran (absent on a cache hit).
   const timing = {};
   const recordStat = probePath(recordPath);
-  if (recordStat.state === PROBE_ABSENT) return readArchivedAgentResult(sessionId);
+  if (recordStat.state === PROBE_ABSENT) return readVanishedSessionTranscript(sessionId);
   if (recordStat.state !== PROBE_PRESENT) return null;
   const checkpoint = probePath(checkpointPath);
   const archive = probePath(archivePath);
@@ -441,7 +449,7 @@ export async function readStoredSessionTranscript(id, options = {}) {
     produce: (text) => produceStoredTranscript(text, readStamp, produceContext),
   });
   // The record vanished between stat and read: same answer as an absent probe.
-  if (readState === PROBE_ABSENT) return readArchivedAgentResult(sessionId);
+  if (readState === PROBE_ABSENT) return readVanishedSessionTranscript(sessionId);
   if (typeof options.trace === 'function') {
     options.trace({
       sessionId,

package/src/runtime/agent/orchestrator/session/store.mjs

@@ -3,7 +3,7 @@
  * Sessions are saved to disk so CLI and MCP server can share state,
  * and sessions survive server restarts (resume).
  */
-import { writeFileSync } from 'node:fs';
+import { closeSync, fsyncSync, openSync, writeFileSync } from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import { randomBytes } from 'node:crypto';
 import { sessionPath } from './store/paths-heartbeat.mjs';
@@ -354,7 +354,15 @@ function _doSaveSync(payload) {
       attempted = JSON.stringify(disk);
       // The lifecycle these exact bytes carry, recorded with the commit stamp.
       const lifecycle = _lifecycleOfSessionDocument(disk);
-      writeFileSync(tmp, attempted, 'utf-8');
+      // fsync before the rename: without it an OS crash can publish the
+      // renamed file with its data blocks never written (all-NUL record).
+      const fd = openSync(tmp, 'w');
+      try {
+        writeFileSync(fd, attempted, 'utf-8');
+        fsyncSync(fd);
+      } finally {
+        closeSync(fd);
+      }
       if (_shouldDrop(id, opts, attempt)) {
         _discardSaveTmp(tmp);
         if (mayMutate()) _recordSaveDrop(id, epoch);
@@ -636,7 +644,14 @@ async function _doSave(payload) {
     attempted = JSON.stringify(disk);
     // Captured before the await: the lifecycle of exactly these bytes.
     const lifecycle = _lifecycleOfSessionDocument(disk);
-    await fsp.writeFile(tmp, attempted, 'utf-8');
+    // fsync before the rename (see _doSaveSync).
+    const handle = await fsp.open(tmp, 'w');
+    try {
+      await handle.writeFile(attempted, 'utf-8');
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
     // Second check: between the temp write and the rename, closeSession()
     // may have planted a tombstone. Re-check on disk; if a newer tombstone
     // now exists, discard our temp file rather than let rename clobber it.
@@ -706,6 +721,7 @@ export { loadSession } from './store/load-session.mjs';
 // Hard delete + owned-agent enumeration live in store/session-delete.mjs;
 // re-exported here so prior importers of store.mjs stay unchanged.
 export { deleteSession, listOwnedAgentSessionIds } from './store/session-delete.mjs';
+export { fenceSessionWrites } from './store/live-state.mjs';
 
 // Listing / summaries live in store/listing.mjs and the stale sweep in
 // store/sweep/stale-sweep.mjs; re-exported here so importers keep one

package/src/runtime/agent/orchestrator/session/tool-batch/execute-call.mjs

@@ -208,6 +208,7 @@ function invocationOptions(batch, call, exec) {
     iteration: batch.iterations,
     localSearchTelemetry: exec.localSearchTelemetry || {},
     resultTelemetry: exec.resultTelemetry,
+    ...(call.wireCall ? { bridgeWireCall: call.wireCall } : {}),
   };
 }
 

package/src/runtime/agent/orchestrator/session/tool-batch/finalize.mjs

@@ -319,7 +319,7 @@ function stagePostProcessingFailure(batch, completed, postErr, postprocessStarte
   if (sessionRef?._scopedCacheOutcomeByCallId instanceof Map && call?.id) {
     sessionRef._scopedCacheOutcomeByCallId.delete(call.id);
   }
-  if (call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.calls, call.id);
+  if (call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.wireCalls, call.id);
   const message = `Error: tool result post-processing failed for "${call.name}": ${postErr instanceof Error ? postErr.message : String(postErr)}`;
   traceAgentToolFailure({
     sessionId: batch.sessionId,

package/src/runtime/agent/orchestrator/session/tool-batch/record-outcome.mjs

@@ -46,7 +46,7 @@ export async function recordCallOutcome(batch, call, exec, sigs, ctSig) {
   // otherwise hide behind a `[mixdog compacted …]` placeholder). Restored
   // immediately so an abort or post-processing throw cannot leave it
   // compacted; early-skipped calls stay compacted.
-  if (executed && failed && call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.calls, call.id);
+  if (executed && failed && call?.id) restoreToolCallBodyForId(batch.assistantTurnMsg, batch.wireCalls, call.id);
   if (sessionId && _stripMcpPrefix(call.name) === 'apply_patch') {
     if (exec.executeOk && exec.resultKind === 'normal') invalidateAfterPatch(sessionId, call, cwd);
     // Mutation tools invalidate even on returned-error/partial-fail — the

package/src/runtime/agent/orchestrator/session/tool-batch/state.mjs

@@ -4,11 +4,17 @@
 // live here so processToolBatch can hand them back.
 import { executeTool } from '../loop/tool-exec.mjs';
 import { planToolBatch } from './plan.mjs';
+import { bridgeClassificationTools, resolveExecutionToolCalls } from '../loop/tool-call-resolution.mjs';
 
 export function createBatchState(ctx) {
-  const { calls, tools, assistantTurnMsg, sessionRef } = ctx;
+  const { assistantTurnMsg, sessionRef } = ctx;
+  // Bridged call_tool requests run as their targets from here on; the wire
+  // calls stay authoritative for the transcript and failed-argument restore.
+  const calls = resolveExecutionToolCalls(ctx.calls, sessionRef);
+  const tools = bridgeClassificationTools(ctx.tools, calls);
   return {
     calls,
+    wireCalls: ctx.calls,
     messages: ctx.messages,
     tools,
     cwd: ctx.cwd,

package/src/runtime/agent/orchestrator/session/tool-result-offload.mjs

@@ -19,8 +19,10 @@ import { getPluginData } from '../config.mjs';
 import { countSplitLines, normalizeOutputPath } from '../tools/builtin/path-utils.mjs';
 import { classifyResultKind } from './result-classification.mjs';
 import { registerSessionPurgeHook } from './store.mjs';
+import { SETUP_OUTPUT_MAX_BYTES } from '../../../shared/tool-output-limit.mjs';
 
 const TOOL_RESULT_OFFLOAD_THRESHOLD_CHARS = 50_000;
+const TOOL_RESULT_SETUP_THRESHOLD_CHARS = SETUP_OUTPUT_MAX_BYTES;
 const TOOL_RESULT_PREVIEW_CHARS = 512;
 const TOOL_RESULT_SHELL_THRESHOLD_CHARS = 30_000;
 const TOOL_RESULT_SEARCH_THRESHOLD_CHARS = 50_000;
@@ -61,6 +63,7 @@ const INLINE_THRESHOLD_BY_TOOL = new Map([
   ['bash_session', TOOL_RESULT_SHELL_THRESHOLD_CHARS],
   ['terminal', TOOL_RESULT_SHELL_THRESHOLD_CHARS],
   ['task', TOOL_RESULT_SHELL_THRESHOLD_CHARS],
+  ['setup', TOOL_RESULT_SETUP_THRESHOLD_CHARS],
 ]);
 
 function getOffloadThreshold(toolName) {
@@ -554,6 +557,7 @@ export const _internals = {
   TOOL_RESULT_SHELL_THRESHOLD_CHARS,
   TOOL_RESULT_SEARCH_THRESHOLD_CHARS,
   TOOL_RESULT_GREP_THRESHOLD_CHARS,
+  TOOL_RESULT_SETUP_THRESHOLD_CHARS,
   getOffloadThreshold,
   TOOL_RESULT_PREVIEW_CHARS,
   TOOL_RESULT_MESSAGE_MAX_CHARS,

package/src/runtime/agent/orchestrator/session/tool-schema-rejection.mjs

@@ -0,0 +1,77 @@
+// A provider 400 that names one tool's input schema (Anthropic
+// `tools.3.custom.input_schema`, OpenAI `Invalid schema for function 'x'` /
+// `tools[3].parameters`, Gemini `function_declarations[3]`): which tool of the
+// request it is, so the session can drop it instead of failing every turn.
+import { providerToolExclusionReason } from './loop/provider-tool-exclusions.mjs';
+import { providerNativeToolPrefixCount } from '../runtime-core/provider-request-tools.mjs';
+
+const MAX_REASON_CHARS = 240;
+
+const text = (value) => (typeof value === 'string' ? value : '');
+
+// Provider-structured places a rejection names its field, best evidence first:
+// OpenAI `param` (also nested under `error`), Anthropic / OpenAI `error.message`,
+// Google `details[].fieldViolations[].field`, then a JSON body, then the
+// error's own message.
+function evidence(error) {
+  const nested = [error?.error, error?.providerError, error?.response?.data?.error, error?.response?.data];
+  const violations = [error?.details, error?.error?.details, error?.errorDetails]
+    .flatMap((details) => (Array.isArray(details) ? details : []))
+    .flatMap((detail) => (Array.isArray(detail?.fieldViolations) ? detail.fieldViolations : []))
+    .flatMap((violation) => [text(violation?.field), text(violation?.description)]);
+  const bodies = [error?.body, error?.responseBody].map((body) => {
+    if (typeof body !== 'string') return [];
+    try {
+      const parsed = JSON.parse(body);
+      return [text(parsed?.error?.param), text(parsed?.error?.message), text(parsed?.message)];
+    } catch {
+      return [body];
+    }
+  });
+  return [
+    error?.param,
+    ...nested.map((entry) => entry?.param),
+    ...nested.map((entry) => entry?.message),
+    ...violations,
+    ...bodies.flat(),
+    error?.message,
+    error?.cause?.message,
+  ].filter((entry) => typeof entry === 'string' && entry);
+}
+
+// One piece of evidence -> which tool: a wire index (`byIndex`, with the
+// OpenAI Responses hosted-tool offset when `shifted`) or a function name.
+function target(entry) {
+  let match = /\btools\.(\d+)\.(?:custom\.)?input_schema/.exec(entry);
+  if (match) return { index: Number(match[1]) };
+  match = /\btools(?:\[(\d+)\]|\.(\d+))\.(?:function\.)?parameters/.exec(entry);
+  if (match) return { index: Number(match[1] ?? match[2]), shifted: true };
+  match = /\b(?:function_declarations|functionDeclarations)(?:\[(\d+)\]|\.(\d+))/.exec(entry);
+  if (match) return { index: Number(match[1] ?? match[2]) };
+  match = /Invalid schema for function ['"`]([^'"`]+)['"`]/.exec(entry);
+  if (match) return { name: match[1] };
+  return null;
+}
+
+/** `{ name, pointer, reason }` of the tool a schema 400 points at, or null (any
+ *  other error, or a tool that is not part of the request's own tools). */
+export function rejectedToolSchema(error, { sendTools, sessionRef, opts }) {
+  if ((error?.httpStatus ?? error?.status ?? error?.statusCode) !== 400) return null;
+  const tools = Array.isArray(sendTools) ? sendTools : [];
+  const nativeCount = providerNativeToolPrefixCount(tools);
+  // The wire list: the request's tools minus those the wire left out.
+  const wire = tools.filter((tool) => !providerToolExclusionReason(sessionRef, tool?.name));
+  const hosted = sessionRef?.wireRoute?.wire !== 'chat' && Array.isArray(opts?.nativeTools) ? opts.nativeTools.length : 0;
+  const entries = evidence(error);
+  let name = '';
+  for (const entry of entries) {
+    const found = target(entry);
+    if (!found) continue;
+    const tool = found.name ? wire.find((t) => t?.name === found.name) : wire[found.index - (found.shifted ? hosted : 0)];
+    name = typeof tool?.name === 'string' ? tool.name : '';
+    if (name) break;
+  }
+  if (!name || tools.findIndex((t) => t?.name === name) < nativeCount) return null;
+  const detail = entries.join(' ').replace(/\s+/g, ' ').trim().slice(0, MAX_REASON_CHARS);
+  return { name, pointer: '/', reason: `the provider rejected it with HTTP 400: ${detail}` };
+}

package/src/runtime/agent/orchestrator/session/transcript-restore/restore.mjs

@@ -286,7 +286,9 @@ function mergeRestoredToolItems(items) {
 }
 
 function restoredMessageItemUpperBound(message) {
-  const boundaries = Array.isArray(message?.meta?.sessionInheritances) ? message.meta.sessionInheritances.length : 0;
+  const boundaries =
+    (Array.isArray(message?.meta?.sessionInheritances) ? message.meta.sessionInheritances.length : 0) +
+    (Array.isArray(message?.meta?.modelSwitches) ? message.meta.modelSwitches.length : 0);
   if (message?.role === 'user') return 1 + boundaries;
   if (message?.role !== 'assistant') return boundaries;
   const calls = restoredMessageToolCalls(message);
@@ -377,6 +379,19 @@ function restoredUserTranscriptItems(message, nextId) {
   return [restoredNotificationToolItem(synthetic, text, message, nextId, /^(failed|error|killed|cancelled)$/i)];
 }
 
+/** The transcript row of an in-place model switch (live and restored). */
+export function modelSwitchItem(id, boundary) {
+  return {
+    kind: 'statusdone',
+    id,
+    status: 'model-switched',
+    label: 'Model switched',
+    provider: boundary.provider,
+    modelId: boundary.modelId,
+    at: boundary.at,
+  };
+}
+
 function restoreTranscriptRange(messages, start, sessionId) {
   const items = [];
   const pendingToolCalls = new Map();
@@ -408,6 +423,10 @@ function restoreTranscriptRange(messages, start, sessionId) {
         at: boundary.at,
       });
     }
+    for (const boundary of Array.isArray(message?.meta?.modelSwitches) ? message.meta.modelSwitches : []) {
+      if (!boundary?.provider || !boundary?.modelId) continue;
+      items.push(modelSwitchItem(restoredId(), boundary));
+    }
   }
   return mergeRestoredToolItems(items);
 }

package/src/runtime/agent/orchestrator/tools/bash-policy-scan.mjs

@@ -68,6 +68,12 @@ export function buildBashPolicyScanTargets(command) {
   return out;
 }
 
-export function checkExecPolicyMessage(command) {
-  return formatExecPolicyBlockMessage(evaluateExecPolicyFromTargets(buildBashPolicyScanTargets(command)));
+export function evaluateExecPolicy(command) {
+  return evaluateExecPolicyFromTargets(buildBashPolicyScanTargets(command));
+}
+
+// `elevationApproved` is runtime-supplied: the user approved this call's
+// 'ask' (elevation) decision. It never lifts a deny.
+export function checkExecPolicyMessage(command, { elevationApproved = false } = {}) {
+  return formatExecPolicyBlockMessage(evaluateExecPolicy(command), { elevationApproved });
 }

package/src/runtime/agent/orchestrator/tools/builtin/arg-guard.mjs

@@ -786,9 +786,9 @@ function guardShell(a) {
   }
   // Over-max is an unambiguous "wait as long as allowed"; clamp like the other
   // saturating integer args instead of failing the call.
-  if (hasOwn(a, 'wait_ms') && Number.isInteger(a.wait_ms) && a.wait_ms > 120000) a.wait_ms = 120000;
+  if (hasOwn(a, 'wait_ms') && Number.isInteger(a.wait_ms) && a.wait_ms > 30000) a.wait_ms = 30000;
   if (hasOwn(a, 'wait_ms') && (!Number.isInteger(a.wait_ms) || a.wait_ms < 1000)) {
-    return `Error: shell arg "wait_ms" must be an integer from 15000 to 120000, e.g. wait_ms:30000 (got ${JSON.stringify(a.wait_ms)})`;
+    return `Error: shell arg "wait_ms" must be an integer from 10000 to 30000, e.g. wait_ms:20000 (got ${JSON.stringify(a.wait_ms)})`;
   }
   if (!hasOwn(a, 'command')) {
     return 'Error: shell requires "command"';

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/command-preflight.mjs

@@ -8,11 +8,11 @@ import { formatShellToolFailure } from './result-format.mjs';
 // Policy + shell-specific rewrites before any shell dispatch. Returns either
 // `{ failure }` (a formatted tool failure) or the command to run with the
 // resolved shell spec and the wmic rewrite (if any).
-export function prepareShellCommand(args) {
+export function prepareShellCommand(args, { elevationApproved = false } = {}) {
   // Run hard-block policy before any shell dispatch.
   const rawCmd = String(args && args.command != null ? args.command : '');
   if (rawCmd) {
-    const policyBlock = checkExecPolicyMessage(rawCmd);
+    const policyBlock = checkExecPolicyMessage(rawCmd, { elevationApproved });
     if (policyBlock) return { failure: formatShellToolFailure(policyBlock) };
   }
   let command = args.command;
@@ -52,7 +52,7 @@ export function prepareShellCommand(args) {
       : null;
   if (bashismRewrite) command = bashismRewrite.command;
 
-  const execPolicyBlock = checkExecPolicyMessage(command);
+  const execPolicyBlock = checkExecPolicyMessage(command, { elevationApproved });
   if (execPolicyBlock) return { failure: formatShellToolFailure(execPolicyBlock) };
   return { command, analysisCommand, resolvedSpec, wmicRewrite, bashismRewrite };
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool/deadline-plan.mjs

@@ -1,12 +1,12 @@
 // Commands start in the foreground. Only work still running after the
-// 15 s coordination budget is promoted to a tracked background task.
+// 10 s coordination budget is promoted to a tracked background task.
 // Short commands therefore complete in the original tool turn, while longer
 // work returns partial output plus task_id and finishes by notification.
-// 15 s because a command promoted moments before it ends costs a whole
-// follow-up request on `task wait`. Session logs (2026-09-30..10-05), the 260
-// promoted commands with a recorded duration: 108 had ended within 10 s, 144
-// within 15 s and only 152 within 20 s.
-export const DEFAULT_SHELL_AUTO_BACKGROUND_MS = 15_000;
+// A per-call wait_ms may stretch the window for a command whose result should
+// return in the same call, never past 30 s, so the conversation is never held
+// open long; anything longer finishes by notification.
+export const DEFAULT_SHELL_AUTO_BACKGROUND_MS = 10_000;
+export const MAX_SHELL_WAIT_MS = 30_000;
 
 // JS timers (setTimeout) and PS WaitForExit(ms) are 32-bit: a delay above
 // 2^31-1 wraps to a tiny/negative value and fires immediately. Clamp the
@@ -17,17 +17,14 @@ const TIMER_MAX_MS = 2_147_483_647;
 
 // Main-agent blocking budget. A timeout is the command's total deadline, not
 // permission to hold the conversation open for that whole duration: after
-// 15 s a still-running command becomes a tracked background task and
+// 10 s a still-running command becomes a tracked background task and
 // completion is pushed to the owner. MIXDOG_SHELL_AUTO_BACKGROUND_MS
 // overrides; an explicit 0 disables. Gated on backgroundOnTimeout so
 // disabled background tasks remain foreground.
-// A per-call wait_ms extends that default for the call, capped by the
-// foreground maximum; it never shortens it. A shorter window promotes a
-// command that would have returned its result in the starting call and spends
-// a whole follow-up request on `task wait`. Session logs (2026-09-30..10-05,
-// 3062 shell calls): 329 passed a wait_ms under the default (53% of one model
-// family's calls), 256 of those were promoted, and 108 of the 192 with a
-// recorded duration had finished inside the default window (10 s then).
+// A per-call wait_ms extends that default for the call, capped by
+// MAX_SHELL_WAIT_MS and the foreground maximum; it never shortens it. A
+// shorter window promotes a command that would have returned its result in
+// the starting call and spends a whole follow-up request on `task wait`.
 function autoBackgroundBudget(backgroundOnTimeout, timeout, waitMs, maxForegroundMs) {
   const raw = process.env.MIXDOG_SHELL_AUTO_BACKGROUND_MS;
   const parsed = Number(raw);
@@ -35,7 +32,7 @@ function autoBackgroundBudget(backgroundOnTimeout, timeout, waitMs, maxForegroun
     raw != null && String(raw).trim() !== '' && Number.isFinite(parsed) && parsed >= 0
       ? Math.floor(parsed)
       : DEFAULT_SHELL_AUTO_BACKGROUND_MS;
-  if (waitMs > 0) defaultMs = Math.max(defaultMs, Math.min(waitMs, maxForegroundMs));
+  if (waitMs > 0) defaultMs = Math.max(defaultMs, Math.min(waitMs, MAX_SHELL_WAIT_MS, maxForegroundMs));
   if (!backgroundOnTimeout || defaultMs <= 0) return 0;
   return timeout > 0 ? Math.min(defaultMs, timeout) : defaultMs;
 }

package/src/runtime/agent/orchestrator/tools/builtin/bash-tool.mjs

@@ -61,7 +61,9 @@ export async function executeBashTool(args, workDir, options = {}) {
   // Every call starts from the current Project root. A command-local `cd`
   // never creates a second session cwd authority beside the dedicated cwd tool.
   const bashWorkDir = workDir;
-  const prepared = prepareShellCommand(args);
+  // Approval comes from the runtime's options, never from model-supplied args.
+  const elevationApproved = options?.elevationApproved === true;
+  const prepared = prepareShellCommand(args, { elevationApproved });
   if (prepared.failure) return prepared.failure;
   const { resolvedSpec, wmicRewrite, bashismRewrite } = prepared;
   // Effects are analyzed on the command as the caller meant it, before the
@@ -97,6 +99,7 @@ export async function executeBashTool(args, workDir, options = {}) {
       command: invocation.wrappedCommand,
       execScript: invocation.execScript,
       directArgv: invocation.directArgv,
+      elevationApproved,
       env: invocation.spawnEnv,
       cwd: bashWorkDir,
       timeoutMs: deadlines.timeout,

package/src/runtime/agent/orchestrator/tools/builtin/builtin-tools.mjs

@@ -146,7 +146,7 @@ export const BUILTIN_TOOLS = [
       openWorldHint: true,
       compressible: true,
     },
-    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 15s foreground window (not a timeout; wait_ms extends it up to 120s for one call, e.g. a test suite), unfinished work continues under task_id; use task wait, not read polling. If no execution slot frees within the admission wait, the command is queued as a background task with a task_id. Dev servers/watchers: pass timeout_ms or stop them with task cancel when done.'}`,
+    description: `Run programs, builds, tests and computation. Never use shell commands or scripts for work covered by dedicated tools: cat/head/tail→read, ls→list, find→glob, filename lookup→find, grep/rg→grep, code structure→code_graph, file edits/writes (sed/awk/redirection)→edit/apply_patch, Git→git when that tool is on the surface. Tool names are not shell commands. ${_shellBackgroundDisabled ? 'Commands run in the foreground until completion.' : 'After a 10s foreground window (not a timeout; omit wait_ms by default, set it up to 30s only for a command you expect to finish in 10–30s, e.g. one test file), unfinished work continues under task_id; use task wait, not read polling. If no execution slot frees within the admission wait, the command is queued as a background task with a task_id. Dev servers/watchers: pass timeout_ms or stop them with task cancel when done.'}`,
     inputSchema: {
       type: 'object',
       properties: {
@@ -155,14 +155,14 @@ export const BUILTIN_TOOLS = [
           type: 'integer',
           minimum: 0,
           description:
-            'Hard kill deadline in ms (omit or 0 = none), separate from the 15s foreground window; set one for throwaway probes so a slow check fails fast.',
+            'Hard kill deadline in ms (omit or 0 = none), separate from the 10s foreground window; set one for throwaway probes so a slow check fails fast.',
         },
         wait_ms: {
           type: 'integer',
-          minimum: 15000,
-          maximum: 120000,
+          minimum: 10000,
+          maximum: 30000,
           description:
-            'Foreground wait in ms before unfinished work continues as a background task (default 15000); raise it for a command that should return its result in this call.',
+            'Foreground wait in ms before unfinished work continues as a background task (default 10000). Omit it by default. Set it only when you expect the command to finish within 10–30s (e.g. one test file or a small build step); never for work expected to take longer, which finishes by notification.',
         },
       },
       required: ['command'],

package/src/runtime/agent/orchestrator/tools/builtin/external-tool-adapters.mjs

@@ -37,6 +37,7 @@ import { decodeValidUtf8OrNull, detectPatchTargetCodec, nearestPatchLineMatch }
 import { hashText } from './hash-utils.mjs';
 import { invalidateBuiltinResultCache } from './cache-layers.mjs';
 import { markCodeGraphDirtyPaths } from '../code-graph-state.mjs';
+import { reviewFileContent } from '../../../../shared/bounded-file-read.mjs';
 
 const STR_REPLACE_NAMES = new Set(['edit', 'strreplace', 'str_replace', 'str_replace_editor', 'search_replace']);
 const WRITE_NAMES = new Set(['write', 'create_file', 'createfile']);
@@ -189,26 +190,27 @@ function recordEditSnapshot(fullPath, options, contentHash = null, preMutationSt
 // UI diff parity with apply_patch: register the before/after pair on the
 // shared per-call side channel so tool cards render edit results with the
 // same diff markup. Lazy import breaks the orchestrator→builtin→adapters
-// module cycle; failures never affect the edit result.
-async function recordEditUiDiff(options, workDir, fullPath, before, after, encoding) {
+// module cycle; failures never affect the edit result. `sides()` yields the
+// file's `{ before, after }` content (null = absent).
+async function recordToolUiDiff(options, workDir, fullPath, sides) {
   const callId = options?.toolCallId;
   const sessionId = options?.sessionId || options?.readStateScope;
   if (!callId || !sessionId) return;
   try {
     const { registerEditToolUiDiff } = await import('../patch/orchestrator.mjs');
-    registerEditToolUiDiff({
-      callId,
-      sessionId,
-      basePath: workDir,
-      fullPath,
-      before: before === null ? null : encodeEditContent(before, encoding),
-      after: after === null ? null : encodeEditContent(after, encoding),
-    });
+    registerEditToolUiDiff({ callId, sessionId, basePath: workDir, fullPath, ...sides() });
   } catch {
     /* best-effort display channel */
   }
 }
 
+async function recordEditUiDiff(options, workDir, fullPath, before, after, encoding) {
+  await recordToolUiDiff(options, workDir, fullPath, () => ({
+    before: before === null ? null : encodeEditContent(before, encoding),
+    after: after === null ? null : encodeEditContent(after, encoding),
+  }));
+}
+
 // The 0-based line the failure excerpt centres on, or -1: the engine's
 // "nearest match" hint, else the exact old_string, else its longest tokens,
 // else the fuzzy line scorer.
@@ -828,6 +830,7 @@ async function adaptWrite(args, workDir, options) {
   if (target.error) return target.error;
   const fullPath = target.full;
   const existed = existsSync(fullPath);
+  const before = existed ? reviewFileContent(fullPath) : null;
   try {
     mkdirSync(dirname(fullPath), { recursive: true });
   } catch {
@@ -835,6 +838,7 @@ async function adaptWrite(args, workDir, options) {
   }
   await atomicWrite(fullPath, contents, { sessionId: editScope(options) });
   invalidateAfterWrite(fullPath);
+  await recordToolUiDiff(options, workDir, fullPath, () => ({ before, after: contents }));
   return `${existed ? 'Updated' : 'Created'} ${fullPath} (${Buffer.byteLength(contents, 'utf8')} bytes)`;
 }