mixdog 1.2.2 → 1.2.3

package/src/defaults/skills/setup/references/actions.md

@@ -4,11 +4,17 @@ Read this when choosing a `setup` mutation.
 
 ## Read and navigate
 
-- `status` reads one domain: summary, model, agents, workflow, websearch,
-  output-style, profile, autoclear, compaction, memory, features, local-provider, shell,
-  providers, mcp, skills, plugins, update, onboarding, worktree, capabilities, developer,
-  desktop, appearance, projects, connection, schedules, webhooks, hooks, or
-  media.
+- `status` reads one domain from the schema enum; pick the narrowest.
+- Results are compact JSON. `status providers` lists configured providers
+  only (`id`, `kind`, `authenticated`, `status`, `accounts` count); add
+  `detail: true` for every provider with key URLs, expiry and account ids.
+- `list_models` narrows in steps: no `catalog` returns the provider index
+  (`provider`, `count`, `defaultModel?`); `catalog.provider` returns compact
+  rows (`id`, `display`, `context`, `efforts`, `fast?`, `vision?`) with
+  `total`/`page`/`pages`/`nextPage` (`page`, `limit` ≤ 100, default 25);
+  `catalog.model` (plus `provider` if several offer the id) returns that
+  model's full options. `webSearch` limits to native-search models; `refresh`
+  reloads the catalog.
 - `open` navigates to a supported UI surface. Read `surfaces.md` for targets and
   UI-only settings.
 
@@ -28,7 +34,7 @@ Read this when choosing a `setup` mutation.
 | Background memory cycles | `set_recap_enabled` |
 | Web Search tool exposure | `set_web_search_enabled` |
 | Which user instruction files (AGENTS.md / CLAUDE.md) new sessions load: all, agents, claude, or off | `set_instruction_files` |
-| Git, Office, Code Tidy, Local Provider, Auto Effort, Browser, Computer, or voice enabled state | `set_builtin_enabled` |
+| Git, Office, Code Tidy, Local Provider, Auto Effort, Browser, Computer, voice, or Visualize enabled state | `set_builtin_enabled` |
 | Git, Memory, Office, Code Tidy, Local Provider, Auto Effort, Browser, Computer, or voice preparation | `install_builtin` |
 | Managed local model installation | `install_local_model` |
 | Start or resume a background runtime/model download | `start_local_installation` |
@@ -44,7 +50,7 @@ Read this when choosing a `setup` mutation.
 | Automatic updates | `set_auto_update` |
 | Worktree defaults: new tasks on the current branch or a new worktree, branch prefix, large-repository warning size, automatic cleanup | `set_worktree_settings` |
 | Remove stored provider authentication (one OAuth account at a time) | `forget_provider_auth` |
-| Select, rename, reorder, or auto-switch OAuth accounts, or allow paid credits | `set_provider_account` |
+| Select, rename, or reorder OAuth accounts, set the switching policy, or allow paid credits | `set_provider_account` |
 | Developer options such as risk-gated OAuth providers | `set_developer_option` |
 | Add an MCP server | `add_mcp_server` |
 | Edit or rename an MCP server | `save_mcp_server` |
@@ -58,7 +64,7 @@ Read this when choosing a `setup` mutation.
 | Enable or disable a plugin | `set_plugin_enabled` |
 | Remove a plugin | `remove_plugin` |
 | Turn back on and reconnect every MCP server a plugin declares | `enable_plugin_mcp` |
-| Available hosted models and their options; optionally one provider, native-search capable only, or a refreshed catalog | `list_models` |
+| Hosted model catalog: provider index, one provider's paged model rows, or one model's full options | `list_models` |
 | Agent orchestration, independent of workflow instructions | `set_orchestration_mode` |
 | Safe MCP edit metadata, excluding raw connection/credential values | `get_mcp_server` |
 | Read a workflow, agent, or skill definition | `read_definition` |
@@ -69,7 +75,7 @@ Read this when choosing a `setup` mutation.
 | Delete an existing schedule/webhook | `delete_automation` |
 | Enable/disable a schedule/webhook | `set_automation_enabled` |
 | Webhook listener enabled state, port, or domain | `set_webhook_config` |
-| Desktop keep-awake, run in background after window close, turn-completion notifications, notification volume (Windows), usage pin, or Computer observe-only state | `set_desktop_settings` |
+| Desktop keep-awake, run in background after window close, turn-completion notifications, notification volume (Windows), usage pin, usage rail short + long bars, or Computer observe-only state | `set_desktop_settings` |
 | Desktop theme, display language, side panels, markdown default view, link previews, or tool activity expansion | `set_appearance` |
 | Add a before-tool hook rule | `add_hook_rule` |
 | Enable or disable a hook rule by its `status hooks` index | `set_hook_rule_enabled` |
@@ -88,8 +94,14 @@ workflow` before changing the corresponding domain.
 
 - Main and agent routes also accept `modelParameters`, `contextPercent`, and
   `contextTokens` (an exact window in tokens that overrides `contextPercent`);
-  agent routes accept `disabled`.
-  Use the model catalog for actual available options, not remembered model ids.
+  agent routes accept `disabled`. Route `autoEffort` (Main and agent only)
+  turns Auto reasoning on/off for that route; the Auto Effort built-in toggle
+  is the machine-wide switch and must also be on and `ready`.
+  Before `set_route`, read `list_models` with `catalog.model` (and `provider`)
+  for the model's `effortOptions`, `defaultEffort`, `fastCapable`,
+  `serviceTiers`, `modelParameterOptions` and `parameterVariants`; take
+  `effort`, `fast` and `modelParameters` values only from it, never from
+  remembered model ids.
 - A Web Search route must support native web search; tool exposure is changed
   separately.
 - Definition actions use `definitionKind` (workflow, agent, skill).
@@ -102,12 +114,13 @@ workflow` before changing the corresponding domain.
 
 ## Providers and authentication
 
-Use `status providers` for authenticated state and source.
+Use `status providers` for authenticated state; `detail: true` adds each API
+key's source.
 
 - API-key and OAuth providers: `open providers`, then the user completes
   authentication in the visible UI.
 - Custom providers are registered, tested, and removed in the Providers UI;
-  `status providers` lists them as API rows with `custom: true`.
+  `status providers` with `detail: true` lists them as API rows with `custom: true`.
 - Local Provider is installed and enabled as a Built-in. Its endpoint is
   Mixdog-managed and is never configured by the user.
   Use the `local-provider` skill for hardware checks, model selection, downloads,
@@ -115,10 +128,14 @@ Use `status providers` for authenticated state and source.
   the detail dialog lists installed models rather than the download catalog.
 - Forgetting authentication is destructive and requires explicit approval.
   It removes one OAuth account; a provider with several accounts requires
-  `accountId` from the account list in `status providers`.
-- `set_provider_account` changes the selected account, automatic switching,
-  paid-credit use after plan limits (`useCredits`), account order (every account id exactly once), or an account label. Sign-in
-  for a new account still happens in the Providers UI.
+  `accountId` from the account list in `status providers` with `detail: true`.
+- `set_provider_account` changes the selected account, paid-credit use after
+  plan limits (`useCredits`), account order (every account id exactly once),
+  an account label, or the switching `policy`: `manual` stays on the selected
+  account, `limit` switches when it hits a limit, `headroom` starts each new
+  session on the account with the most headroom. `status providers` with
+  `detail: true` returns the current `policy` when one is set. Sign-in for a new account still
+  happens in the Providers UI.
 - `status developer` lists developer options. An option with a `warning` is
   enabled only after the user explicitly accepts that warning, passed as
   `riskAccepted:true`; never assume acceptance.
@@ -159,7 +176,12 @@ markers are read with `status desktop`.
   reasoning effort with a local judge model downloaded in the background.
   Enabling or installing it fails on unsupported machines; `status features`
   reports `supported`, `installing` (judge download running) and `ready`.
+- Visualize is toggle-only through `set_builtin_enabled` (on by default);
+  `install_builtin` does not accept it.
 - Terminal follows the live Desktop terminal bridge and has no toggle.
+- Environment feature overrides (`MIXDOG_FEATURE_*`) win over these toggles;
+  they are diagnostics for headless or benchmark environments, not user
+  settings.
 - Browser Use and Computer Use installation/toggles use the same
   `install_builtin` and `set_builtin_enabled` actions through a live Desktop
   receipt. Computer Use runs on Windows, macOS, and Linux desktops. These
@@ -177,16 +199,12 @@ markers are read with `status desktop`.
   only as `hasArgumentEdit`; their contents are never returned. Indexes shift
   after a delete;
   re-read status before addressing another rule.
-- `add_hook_rule` takes `action` (allow, deny, block, modify, rewrite, ask)
-  and optional `tool`, `match`, `cwd`, `reason`. modify/rewrite need exactly
-  one of `patch` (merged into the arguments) or `args` (replaces them).
+- `add_hook_rule` with modify/rewrite needs exactly one of `patch` or `args`.
 - `delete_hook_rule` is destructive and requires explicit approval for the
   named rule; disabling with `set_hook_rule_enabled` preserves it.
 - `status media` shows the remembered lane/model per kind. `set_media_default`
   accepts only a signed-in lane that offers the kind (and the model, when
   given) in the live media catalog; the media tool's `list` reads that catalog.
-- Environment feature overrides are diagnostics for headless or benchmark
-  environments, not ordinary user settings.
 
 ## Skills, MCP, and plugins
 
@@ -201,6 +219,10 @@ markers are read with `status desktop`.
   transport. Raw credential fields are not accepted; `env_vars`,
   `bearer_token_env_var`, and `env_http_headers` reference existing environment
   variables without exposing their values.
+- `startupTimeoutSec` (connect/handshake, default 30) and `toolTimeoutSec`
+  (per tool call, default 120) are positive seconds. Raise them for slow
+  servers instead of reconnecting repeatedly; a timed-out call is never
+  replayed.
 - Environment/header maps are partial patches. Omitted keys are preserved;
   `null` explicitly removes one key, including a stored credential.
 - Plugin enablement moves its contributed skills and MCP integrations together.

package/src/defaults/skills/setup/references/surfaces.md

@@ -18,7 +18,7 @@ or requests a setting with no mutation action.
 | `profile` | User profile |
 | `autoclear` | Session lifecycle controls |
 | `memory` | Memory capability surface |
-| `mcp` | Extensions → Skill → MCP |
+| `mcp` | Extensions → Skill → MCP, including OAuth Connect/Reconnect/Disconnect |
 | `skills` | Extensions → Skill → Skills |
 | `plugins` | Extensions → Plugin |
 | `update` | Update surface |
@@ -56,15 +56,15 @@ the user to Desktop.
 
 ## Desktop-backed settings
 
-Setup can read and change Desktop appearance (including markdown default
-view, link previews, and tool activity expansion), keep-awake, run in
-background, turn-completion notifications, notification volume (Windows),
-usage pin, activity rail pins, Computer observe-only, Browser/Computer
-installation and toggles, Projects, and linked-device revocation through the
-attached Desktop. A receipt identifies `scope:desktop-host`.
+`set_desktop_settings`, `set_appearance`, `set_activity_rail_pins`,
+`save_project`, `remove_project`, `revoke_linked_device`, and Browser/Computer
+install or toggles run through the attached Desktop; the receipt identifies
+`scope:desktop-host`.
 
 Computer observe-only and background Memory cycles (`set_recap_enabled`)
-have no settings control in either app; setup is their only supported route. Usage pin is the pin toggle on the activity rail usage card.
+have no settings control in either app; setup is their only supported route.
+Usage pin and the short + long rail bars live in the usage card's flyout menu
+on the activity rail.
 
 Schedules/webhooks and workflow/agent/skill definitions use their runtime
 actions directly. These do not require clicking their Desktop rails.
@@ -74,6 +74,8 @@ actions directly. These do not require clicking their Desktop rails.
 The setup tool does not mutate:
 
 - API keys, OAuth, usage sign-in, and GitHub CLI connection;
+- MCP server OAuth sign-in and sign-out (Desktop MCP list/editor, TUI
+  `/mcp login` and `/mcp logout`; remote windows paste the redirect address);
 - notification permission and subscription on the receiving device;
 - web-app pairing credentials and OS permission dialogs;
 - TUI-local theme palettes (use `/theme`; Desktop themes are separate).

package/src/headless-exec.mjs

@@ -437,19 +437,26 @@ async function createHeadlessSessionRuntime(boundary, { provider, model, cwd, we
 // hundred bytes and the write is atomic, so the cost is negligible and a
 // live run stays readable from outside.
 function headlessAskOptions({ stats, lifecycle, observedModels, writeUsage }) {
+  const recordUsage = (delta) => {
+    const observedModel = clean(delta?.model);
+    if (observedModel) observedModels.add(observedModel);
+    applyUsageDelta(stats, delta);
+    try {
+      writeUsage();
+    } catch {
+      // Telemetry must never break the session; the exit path reports.
+    }
+  };
   return {
     onTextReset: () => true,
     onUsageDelta: (delta) => {
-      const observedModel = clean(delta?.model);
-      if (observedModel) observedModels.add(observedModel);
-      applyUsageDelta(stats, delta);
+      recordUsage(delta);
       lifecycle?.onUsageDelta(delta);
-      try {
-        writeUsage();
-      } catch {
-        // Telemetry must never break the session; the exit path reports.
-      }
     },
+    // Native web search runs its own provider send; fold its spend into the
+    // run's totals. It is not a main-stream request, so the lifecycle's
+    // model-request events stay untouched.
+    onNativeWebSearchUsage: recordUsage,
     ...(lifecycle
       ? {
           onProviderSendStarted: () => lifecycle.onProviderSendStarted(),

package/src/lib/keychain-cjs.cjs

@@ -282,7 +282,8 @@ function darwinSet(account, value) {
 
 function darwinDelete(account) {
   const r = darwinRun(['delete-generic-password', '-a', account, '-s', SERVICE]);
-  if (r.status !== 0) throw new Error(`[keychain] security delete failed: ${r.stderr || r.stdout}`);
+  // Exit 44 is errSecItemNotFound: nothing stored, so nothing to delete.
+  if (r.status !== 0 && r.status !== 44) throw new Error(`[keychain] security delete failed: ${r.stderr || r.stdout}`);
 }
 
 // ---------------------------------------------------------------------------
@@ -983,9 +984,11 @@ function win32Set(account, value) {
 }
 
 function win32Delete(account) {
-  const file = dpApiFile(account);
-  if (!fs.existsSync(file)) throw new Error(`[keychain] secret not found: ${account}`);
-  fs.unlinkSync(file);
+  try {
+    fs.unlinkSync(dpApiFile(account));
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
 }
 
 // ---------------------------------------------------------------------------

package/src/output-styles/common.md

@@ -7,13 +7,14 @@ partial: true
 
 ## Shared Output Format
 
-- Lead with the answer or action. Use natural, complete sentences and the
-  reader's vocabulary; state each point once.
-- Choose structure for clarity, not a fixed template. Use GitHub-flavored
-  Markdown, `$$…$$` for display math, and tables or code when alignment helps.
-- Distinguish facts, inference, and uncertainty. Preserve exact technical
-  literals, useful links, and material risks, limitations, and scope.
-- Follow explicit requests for depth; never pad. Omit tangents, unsolicited
-  advice or offers, raw dumps, and process recaps.
-- Apply the selected depth to substantive answers, not preambles or progress
-  updates.
+- Lead with the answer; no restated request or closing recap. Natural,
+  complete sentences in the reader's vocabulary, each point once; no arrow
+  chains or unexplained shorthand.
+- Plain prose for simple questions; headings, lists, or tables only for real
+  structure. GitHub-flavored Markdown, `$$…$$` for display math.
+- Distinguish facts, inference, and uncertainty; keep exact literals and
+  material risks. Caveats only when they change the reader's next step.
+- Never pad: no tangents, unsolicited offers, raw dumps, or process recaps.
+  Explicit depth requests win; depth applies to substantive answers only.
+- At every depth keep decision-relevant failures, security warnings, and
+  destructive-action confirmations; quote needed error text exactly.

package/src/rules/agent/AGENT.md

@@ -6,8 +6,8 @@
   unapproved destructive action, or a blocker.
 - Communicate in English. Call tools immediately, with no preamble or
   progress text.
-- Reporting: report once, when the work is done, as the handoff — outcome;
-  changed files with the key functions or symbols; the tests and checks you ran for your
-  own changes and their result; material risks, blockers, or unresolved tool
-  failures. Never raw logs, process narration, or a restatement of the brief.
-  Lead owns the independent review.
+- Reporting: report once, when done, per your role's output contract;
+  otherwise done, partial, or blocked with the outcome, then only applicable
+  items: changed files with key symbols, checks run (passes in one line,
+  failures with decisive error text), material risks or blockers. No raw
+  logs, narration, or restated brief. Lead owns the independent review.

package/src/rules/lead/LEAD.md

@@ -17,11 +17,11 @@
 <!-- tools: agent -->
 - Briefing an agent: it sees only the brief, never this conversation. The
   brief is written in English whatever language the user writes in, and
-  holds exactly the task in the user's terms, the scope it owns (files or
-  modules), the exact changes located by path plus function or symbol name
-  or a quoted line, not line numbers, and the completion criteria — nothing
-  else: no rationale, measurements, history, or rules the
-  agent already has. A fresh or respawned agent gets the whole brief; a
+  holds only the task in the user's terms and its use; owned scope and
+  exclusions; changes located by path plus symbol or quoted line, not line
+  numbers; completion criteria; any return need beyond the role. No
+  background, rediscoverable detail, or known rules; large evidence by path.
+  A fresh or respawned agent gets the whole brief; a
   continuing agent gets only what changed. Never assign the same work twice;
   interrupt only to cancel.
 <!-- tools: agent -->

package/src/runtime/agent/orchestrator/agent-trace-io.mjs

@@ -21,7 +21,8 @@ let _serviceUrl = null;
 // came from legacy active-instance.json). Lets a flush connect-failure distrust
 // a recycled-pid corpse advert so the next resolve falls back to legacy/buffer.
 let _serviceAdvertPort = null;
-let _flushInFlight = false;
+let _flushPromise = null;
+let _flushImmediate = null;
 let _localTracePath = null;
 let _localTraceIsExplicit = false;
 let _localTraceBuffer = [];
@@ -180,6 +181,8 @@ function _flushLocalTrace() {
       _localTraceFlushInFlight = false;
       _localTraceFlushPromise = null;
       if (_localTraceBuffer.length > 0) {
+        // An append during the write may already have armed a timer.
+        if (_localTraceTimer) clearTimeout(_localTraceTimer);
         _localTraceTimer = setTimeout(_flushLocalTrace, 0);
         _localTraceTimer.unref?.();
       }
@@ -220,11 +223,13 @@ try {
   // Ignore lifecycle hook failures in embedded runtimes.
 }
 
+const _deps = { readServicePort };
+
 function _resolveServiceUrl() {
   if (_serviceUrl) return _serviceUrl;
   try {
     // Standalone memory HTTP uses its pid-validated discovery advert.
-    const advertPort = readServicePort('memory', { requirePid: false });
+    const advertPort = _deps.readServicePort('memory', { requirePid: false });
     if (advertPort) {
       _serviceAdvertPort = advertPort;
       _serviceUrl = `http://127.0.0.1:${advertPort}`;
@@ -237,71 +242,78 @@ function _resolveServiceUrl() {
   }
 }
 
-async function _flush() {
-  _flushTimer = null;
-  if (_buffer.length === 0) return;
-  if (_flushInFlight) {
-    _scheduleFlush();
-    return;
+// Single entry point for every flush trigger (timer, immediate, drain). While a
+// flush is in flight, callers share its promise; its completion schedules the
+// continuation for whatever remains.
+function _flush() {
+  if (_flushTimer) {
+    clearTimeout(_flushTimer);
+    _flushTimer = null;
+  }
+  // This flush takes over any queued immediate; its completion reschedules.
+  if (_flushImmediate) {
+    clearImmediate(_flushImmediate);
+    _flushImmediate = null;
   }
-  _flushInFlight = true;
+  if (_flushPromise) return _flushPromise;
+  if (_buffer.length === 0) return Promise.resolve();
+  _flushPromise = _flushOnce().finally(() => {
+    _flushPromise = null;
+    _scheduleContinuation();
+  });
+  return _flushPromise;
+}
+
+async function _flushOnce() {
+  // Discovery runs here only (timer / drain / full-batch continuation), never per append.
+  const url = _resolveServiceUrl();
+  if (!url) return;
+  const batch = _buffer.splice(0, _FLUSH_BATCH_SIZE);
   try {
-    const url = _resolveServiceUrl();
-    if (!url) {
-      // Service not up yet — keep buffer, retry next timer tick
-      _scheduleFlush();
-      return;
-    }
-    const batch = _buffer.splice(0, _FLUSH_BATCH_SIZE);
+    const resp = await fetch(`${url}/admin/trace-record`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ events: batch }),
+      signal: AbortSignal.timeout(5000),
+    });
+    // Always drain the body. An undrained response body keeps the
+    // underlying keep-alive socket referenced, which can hold the event
+    // loop open and make a short-lived process (smoke scripts / one-shot
+    // agent tasks) appear to hang for seconds after its work is done.
     try {
-      const resp = await fetch(`${url}/admin/trace-record`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ events: batch }),
-        signal: AbortSignal.timeout(5000),
-      });
-      // Always drain the body. An undrained response body keeps the
-      // underlying keep-alive socket referenced, which can hold the event
-      // loop open and make a short-lived process (smoke scripts / one-shot
-      // agent tasks) appear to hang for seconds after its work is done.
-      try {
-        await resp.arrayBuffer();
-      } catch {
-        /* body already gone */
-      }
-      if (!resp.ok) {
-        warnAgentOnce(
-          'agent-trace:flush-error',
-          `[agent-trace] /admin/trace-record returned ${resp.status} — dropping batch`
-        );
-      }
-    } catch (err) {
-      _serviceUrl = null;
-      // Discovery-first consumer with no health probe: a connect failure
-      // means the pid-validated advert points at a dead (recycled-pid)
-      // port. Distrust it (connection-level errors ONLY — a timeout is a
-      // slow-but-alive daemon, not a corpse) so the next resolve falls back
-      // to legacy/buffer instead of re-trusting the same advert.
-      if (_serviceAdvertPort && isConnRefuseError(err)) markServiceUnreachable('memory', _serviceAdvertPort);
-      _serviceAdvertPort = null;
-      warnAgentOnce('agent-trace:flush-fetch', `[agent-trace] flush fetch failed (${err?.message}) — dropping batch`);
+      await resp.arrayBuffer();
+    } catch {
+      /* body already gone */
     }
-    if (_buffer.length >= _FLUSH_BATCH_SIZE) {
-      // More pending — schedule another flush immediately
-      setImmediate(_flush);
+    if (!resp.ok) {
+      warnAgentOnce(
+        'agent-trace:flush-error',
+        `[agent-trace] /admin/trace-record returned ${resp.status} — dropping batch`
+      );
     }
-  } finally {
-    _flushInFlight = false;
+  } catch (err) {
+    _serviceUrl = null;
+    // Discovery-first consumer with no health probe: a connect failure
+    // means the pid-validated advert points at a dead (recycled-pid)
+    // port. Distrust it (connection-level errors ONLY — a timeout is a
+    // slow-but-alive daemon, not a corpse) so the next resolve falls back
+    // to legacy/buffer instead of re-trusting the same advert.
+    if (_serviceAdvertPort && isConnRefuseError(err)) markServiceUnreachable('memory', _serviceAdvertPort);
+    _serviceAdvertPort = null;
+    warnAgentOnce('agent-trace:flush-fetch', `[agent-trace] flush fetch failed (${err?.message}) — dropping batch`);
   }
 }
 
-function _scheduleFlush(immediate = false) {
-  if (immediate) {
+// Full batch pending and the service is usable → one immediate; everything else
+// → the single non-resetting retry timer.
+function _scheduleContinuation() {
+  if (_buffer.length === 0) return;
+  if (_serviceUrl && _buffer.length >= _FLUSH_BATCH_SIZE) {
     if (_flushTimer) {
       clearTimeout(_flushTimer);
       _flushTimer = null;
     }
-    setImmediate(_flush);
+    if (!_flushImmediate) _flushImmediate = setImmediate(_flush);
   } else if (!_flushTimer) {
     _flushTimer = setTimeout(_flush, _FLUSH_INTERVAL_MS);
     // Never let the periodic trace flush keep the event loop alive: a
@@ -328,11 +340,10 @@ async function _drainLocalTrace() {
 async function drainAgentTrace() {
   await _drainLocalTrace();
   if (!_resolveServiceUrl()) return;
-  if (_flushTimer) {
-    clearTimeout(_flushTimer);
-    _flushTimer = null;
-  }
-  for (let i = 0; i < 10 && _buffer.length > 0; i++) {
+  // Each iteration either awaits the in-flight flush or delivers a batch, so
+  // this terminates; it stops early only when the service is unresolvable.
+  while (_buffer.length > 0 || _flushPromise) {
+    if (!_flushPromise && !_resolveServiceUrl()) break;
     await _flush();
   }
 }
@@ -363,7 +374,8 @@ function appendAgentTrace(record = {}) {
     }
     _appendLocalTrace(row);
     _buffer.push(row);
-    _scheduleFlush(_buffer.length >= _FLUSH_BATCH_SIZE);
+    // An in-flight flush schedules its own continuation on completion.
+    if (!_flushPromise) _scheduleContinuation();
   } catch {
     // Never break agent execution for telemetry
   }
@@ -464,7 +476,26 @@ function _flushToolFailuresSync() {
   }
 }
 
+// Test-only seams: inject discovery and reset module state between cases.
+const _traceIoTest = {
+  setReadServicePort(fn) {
+    _deps.readServicePort = fn;
+  },
+  // Resolves once the in-flight local spool write and its completion handler have run.
+  localWrite: () => _localTraceFlushPromise,
+  reset() {
+    _deps.readServicePort = readServicePort;
+    _buffer.length = 0;
+    _flushTimer = null;
+    _flushImmediate = null;
+    _flushPromise = null;
+    _serviceUrl = null;
+    _serviceAdvertPort = null;
+  },
+};
+
 export {
+  _traceIoTest,
   appendAgentTrace,
   drainAgentTrace,
   normalizeSessionId,

package/src/runtime/agent/orchestrator/cache-mtime.mjs

@@ -31,9 +31,18 @@ export function maxMtimeRecursive(paths, depth = 3) {
  * @returns {string}
  */
 export function mtimeSignatureRecursive(paths, depth = 3) {
+  return createHash('sha1').update(mtimeSignatureText(paths, depth)).digest('hex');
+}
+
+/**
+ * The raw text mtimeSignatureRecursive hashes (`path:mtime` lines). Texts of
+ * consecutive path groups joined with '\n' hash to the same signature as one
+ * call over all of them, so a caller can reuse an unchanged group's text.
+ */
+export function mtimeSignatureText(paths, depth = 3) {
   const parts = [];
   walkMtimes(paths, depth, (p, m) => parts.push(`${p}:${m}`));
-  return createHash('sha1').update(parts.join('\n')).digest('hex');
+  return parts.join('\n');
 }
 
 function walkMtimes(paths, depth, visit) {

package/src/runtime/agent/orchestrator/config-providers-merge.mjs

@@ -67,6 +67,13 @@ export function mergeStoredProviders({ raw, defaults, includeSecrets, presenceOn
   if (includeSecrets) {
     for (const [name, val] of Object.entries(mergedProviders)) {
       if (val?.type !== 'custom' || !name.startsWith('custom-') || val.auth === 'none') continue;
+      if (val.apiKeyEnv) {
+        // Env mode: the named variable is the only key source (no keychain).
+        const { apiKey: _dropped, ...rest } = val;
+        const envKey = process.env[val.apiKeyEnv];
+        mergedProviders[name] = envKey && !presenceOnly ? { ...rest, apiKey: envKey } : rest;
+        continue;
+      }
       const kc = storedKey(name);
       if (kc) mergedProviders[name] = withKey(val, name, kc);
     }

package/src/runtime/agent/orchestrator/config.mjs

@@ -280,6 +280,8 @@ export function loadConfig(options = {}) {
         shell: raw.shell && typeof raw.shell === 'object' ? raw.shell : {},
         update: raw.update && typeof raw.update === 'object' ? { ...raw.update } : {},
         recap: recapConfig,
+        // The model may title the session (session tool, action=rename); default on.
+        aiSessionTitles: raw.aiSessionTitles !== false,
         worktree: normalizeWorktreeSettings(raw.worktree),
         developer: normalizeDeveloperConfig(raw.developer),
         modules: canonicalizeModulesStorage(raw.modules) || {},
@@ -450,6 +452,9 @@ function buildAgentSaveBuilder(config) {
     } else Object.assign(next, disabledAgentDelta(canonicalRoutes.disabledAgents));
     if (config.memoryTools && typeof config.memoryTools === 'object') next.memoryTools = { ...config.memoryTools };
     else delete next.memoryTools;
+    // Default true lives in code: only the opt-out is stored.
+    if (config.aiSessionTitles === false) next.aiSessionTitles = false;
+    else delete next.aiSessionTitles;
     delete next.instructionFiles;
     Object.assign(next, storedInstructionFiles(config));
     delete next.workflowRoutes;

package/src/runtime/agent/orchestrator/context/collect.mjs

@@ -18,6 +18,7 @@ export {
   skillBodyPresentInSession,
   skillMissingFeature,
   skillOutsideScope,
+  skillEnabledFlags,
   skillOutsideScopeError,
 } from './skill-catalog.mjs';
 export {