mixdog 1.2.2 → 1.2.3

package/src/session-runtime/services/agent-tool/lead-worker-index.mjs

@@ -15,10 +15,12 @@ import { ACTIVE_LEAD_STATUS, isActiveLeadRow } from './lead-worker-index/lead-ro
 import { createLeadIndexFile } from './lead-worker-index/index-file.mjs';
 import { createRowSettlement } from './lead-worker-index/row-settlement.mjs';
 import { createLeadReapTimers } from './lead-worker-index/reap-timers.mjs';
+import { createForgottenLeads } from './lead-worker-index/forgotten-leads.mjs';
 
 export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession }) {
   const activeLeadSessions = new Set();
   const index = createLeadIndexFile({ dataDir });
+  const forgotten = createForgottenLeads(dataDir);
   const settlement = createRowSettlement({ dataDir, cfgMod });
   const reaps = createLeadReapTimers({ removeRow: (sessionId, reapAt) => removeLeadWorkerRow(sessionId, reapAt) });
 
@@ -36,8 +38,25 @@ export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession })
     return true;
   }
 
+  /** A deleted Lead leaves the pool now, running or not, and never returns. A
+   *  turn still unwinding after the delete settles by upserting its idle row —
+   *  possibly through another index instance of this process — so the guard is
+   *  process-wide (forgotten-leads.mjs). */
+  function forgetLeadSession(sessionId) {
+    const id = clean(sessionId);
+    if (!id) return false;
+    forgotten.forget(id);
+    reaps.cancel(id);
+    activeLeadSessions.delete(id);
+    index.write((byKey) => {
+      byKey.delete(id);
+    });
+    return true;
+  }
+
   function upsertLeadSession(session, extra = {}) {
     if (!session?.id || typeof workerRowFromSession !== 'function') return false;
+    if (forgotten.isForgotten(session.id)) return false;
     const owner = clean(session.owner).toLowerCase();
     const agent = clean(session.agent).toLowerCase();
     if (owner === 'agent' || (agent && agent !== 'lead')) return false;
@@ -61,7 +80,15 @@ export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession })
       runtimePid: process.pid,
       reapAt: reapMs == null ? null : new Date(now + reapMs).toISOString(),
     };
-    index.write((byKey) => byKey.set(session.id, normalized));
+    // Re-run against the locked fresh document at persist time: a delete that
+    // lands (here or in another instance) between this call and the write must
+    // still win over the queued row.
+    index.write(
+      (byKey) => {
+        if (!forgotten.isForgotten(session.id)) byKey.set(session.id, normalized);
+      },
+      { rerun: true }
+    );
     if (ACTIVE_LEAD_STATUS.test(status) || ACTIVE_LEAD_STATUS.test(stage)) {
       activeLeadSessions.add(session.id);
       reaps.cancel(session.id);
@@ -95,6 +122,7 @@ export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession })
     const now = Date.now();
     index.write((byKey) => {
       for (const id of ids) {
+        if (forgotten.isForgotten(id)) continue;
         const current = byKey.get(id);
         if (!current || !isActiveLeadRow(current)) continue;
         byKey.set(id, settlement.idleLeadRow(current, now, true));
@@ -133,29 +161,66 @@ export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession })
   recoverStaleLeadRows();
   function flushLeadIndexOnExit() {
     flushActiveLeadRows();
-    // Writes are persisted by an async queue; the loop is gone at exit.
+    // Writes are persisted by an async queue; the loop is gone at exit. This
+    // is the best-effort last resort: a persist still running is left alone
+    // (the graceful shutdown path drains before exit).
     index.flushSync();
   }
   const unregisterExitFlush = registerExitFlush(flushLeadIndexOnExit);
   let disposed = false;
+  let disposePromise = null;
+
+  function teardown() {
+    reaps.cancelAll();
+    unregisterExitFlush();
+  }
+
+  async function drainThenTeardown() {
+    await index.flush();
+    teardown();
+  }
 
   /** Persist queued rows, drop owned reap timers, unregister. `settle` (a real
    *  teardown) also idles this runtime's own active Lead rows; a dispose that
-   *  keeps background work (idle eviction) leaves them for the next owner. */
+   *  keeps background work (idle eviction) leaves them for the next owner.
+   *  If the sync flush cannot run (our async writer holds the lock), the exit
+   *  hook stays until the async drain settles. */
   function dispose({ settle = false } = {}) {
     if (disposed) return;
     disposed = true;
+    let flushed = false;
     try {
       if (settle) flushActiveLeadRows();
-      index.flushSync();
-    } finally {
-      reaps.cancelAll();
-      unregisterExitFlush();
+      flushed = index.flushSync();
+    } catch {}
+    if (flushed) {
+      teardown();
+      return;
+    }
+    disposePromise = drainThenTeardown().catch(reopenAfterFailedDrain);
+  }
+
+  /** A failed drain tears nothing down; allow a later dispose to retry it. */
+  function reopenAfterFailedDrain() {
+    disposed = false;
+    disposePromise = null;
+  }
+
+  function disposeAsync({ settle = false } = {}) {
+    if (!disposePromise) {
+      disposed = true;
+      if (settle) flushActiveLeadRows();
+      disposePromise = drainThenTeardown().catch((error) => {
+        reopenAfterFailedDrain();
+        throw error;
+      });
     }
+    return disposePromise;
   }
 
   return {
     dispose,
+    disposeAsync,
     leadWorkerIndexPath: index.path,
     readLeadWorkerRows: index.read,
     /** Resolves once every queued Lead index write is on disk. */
@@ -163,6 +228,7 @@ export function createLeadWorkerIndex({ dataDir, cfgMod, workerRowFromSession })
     upsertLeadSession,
     updateLeadWorkerCwd,
     removeLeadWorkerRow,
+    forgetLeadSession,
     flushActiveLeadRows,
     recoverStaleLeadRows,
   };

package/src/session-runtime/services/agent-tool/tag-registry.mjs

@@ -29,7 +29,7 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     workerRowFromSession: index.workerRowFromSession,
   });
 
-  const { upsertLeadSession, updateLeadWorkerCwd } = leadIndex;
+  const { upsertLeadSession, updateLeadWorkerCwd, forgetLeadSession } = leadIndex;
 
   function dispose(options) {
     try {
@@ -39,6 +39,17 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     }
   }
 
+  /** Drain every queued index write (batches included) without disposing. */
+  async function flushIndexWrites() {
+    await Promise.all([index.flushWorkerIndexWrites(), leadIndex.flushLeadWorkerIndexWrites()]);
+  }
+
+  async function disposeAsync(options) {
+    const results = await Promise.allSettled([index.disposeAsync(), leadIndex.disposeAsync(options)]);
+    const failed = results.find((result) => result.status === 'rejected');
+    if (failed) throw failed.reason;
+  }
+
   function getLiveSession(sessionId) {
     if (!sessionId) return null;
     const session = mgr.getSession(sessionId);
@@ -95,6 +106,8 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
 
   return {
     dispose,
+    disposeAsync,
+    flushIndexWrites,
     readAllTagTombstones: index.readAllTagTombstones,
     readTagTombstones: index.readTagTombstones,
     readWorkerRows,
@@ -104,6 +117,7 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     upsertWorkerSessionDeferred,
     upsertLeadSession,
     updateLeadWorkerCwd,
+    forgetLeadSession,
     removeWorkerRow,
     refreshTagsFromIndex,
     tags,

package/src/session-runtime/services/agent-tool/worker-index/row-store.mjs

@@ -157,6 +157,7 @@ export function createWorkerRowStore(file) {
     flush: queue.flush,
     /** Exit path: persist what is still queued, synchronously. */
     flushSync: queue.flushSync,
+    hasUnpersisted: queue.hasUnpersisted,
     invalidate: () => {
       dirty = true;
     },
@@ -183,7 +184,15 @@ export function acquireWorkerRowStore(file) {
       if (released) return;
       released = true;
       entry.refs -= 1;
-      if (entry.refs === 0 && sharedStores.get(key) === entry) sharedStores.delete(key);
+      const dropIfIdle = () => {
+        if (entry.refs === 0 && !entry.store.hasUnpersisted() && sharedStores.get(key) === entry) {
+          sharedStores.delete(key);
+        }
+      };
+      // A store still holding unpersisted writes stays shared (a new holder
+      // must see them) until its queue drains.
+      if (entry.refs === 0 && entry.store.hasUnpersisted()) entry.store.flush().then(dropIfIdle, () => {});
+      else dropIfIdle();
     },
   };
 }

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -173,7 +173,9 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   function flushWorkerIndexOnExit() {
     batch.flush();
     flushActiveWorkerRows();
-    // Writes are persisted by an async queue; the loop is gone at exit.
+    // Writes are persisted by an async queue; the loop is gone at exit. This
+    // is the best-effort last resort: a persist still running is left alone
+    // (the graceful shutdown path drains before exit).
     store.flushSync();
   }
 
@@ -181,25 +183,62 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   const unregisterExitFlush = registerExitFlush(flushWorkerIndexOnExit);
   const unregisterApprovalWaits = registerApprovalWaitWriter(file, setAwaitingUser);
   let disposed = false;
+  let disposePromise = null;
+
+  function teardown() {
+    unregisterExitFlush();
+    unregisterApprovalWaits();
+    releaseStore();
+  }
+
+  async function drainThenTeardown() {
+    batch.flush();
+    await store.flush();
+    teardown();
+  }
 
   /** Persist queued rows, then release the exit registration. Active rows are
    *  NOT settled: they are keyed by process pid, which every inline runtime in
-   *  the daemon shares, so settling here would idle other runtimes' workers. */
+   *  the daemon shares, so settling here would idle other runtimes' workers.
+   *  When the sync flush cannot run (this process's async writer holds the
+   *  lock) the exit hook and store ref stay until the async drain settles. */
   function dispose() {
     if (disposed) return;
     disposed = true;
+    let flushed = false;
     try {
       batch.flush();
-      store.flushSync();
-    } finally {
-      unregisterExitFlush();
-      unregisterApprovalWaits();
-      releaseStore();
+      flushed = store.flushSync();
+    } catch {}
+    if (flushed) {
+      teardown();
+      return;
+    }
+    disposePromise = drainThenTeardown().catch(reopenAfterFailedDrain);
+  }
+
+  /** A failed drain tears nothing down; allow a later dispose to retry it. */
+  function reopenAfterFailedDrain() {
+    disposed = false;
+    disposePromise = null;
+  }
+
+  /** Awaitable dispose: drain everything, then tear down. A failed drain
+   *  rejects and leaves the registrations in place. */
+  function disposeAsync() {
+    if (!disposePromise) {
+      disposed = true;
+      disposePromise = drainThenTeardown().catch((error) => {
+        reopenAfterFailedDrain();
+        throw error;
+      });
     }
+    return disposePromise;
   }
 
   return {
     dispose,
+    disposeAsync,
     workerIndexPath: () => file,
     invalidateWorkerRowsCache: store.invalidate,
     readAllWorkerRows: store.readAll,

package/src/session-runtime/services/agent-tool.mjs

@@ -147,7 +147,10 @@ export function createStandaloneAgent({
     recoverWorkers,
     upsertLeadSession: registry.upsertLeadSession,
     updateLeadWorkerCwd: registry.updateLeadWorkerCwd,
+    forgetLeadSession: registry.forgetLeadSession,
     closeAll: closeFlow.closeAll,
     dispose: (options) => registry.dispose(options),
+    disposeAsync: (options) => registry.disposeAsync(options),
+    flushIndexWrites: () => registry.flushIndexWrites(),
   };
 }

package/src/session-runtime/services/channel-admin.mjs

@@ -26,6 +26,8 @@ import { normalizeAutomationAttachments } from '../../runtime/shared/automation-
 import { migrateCodexModelRef } from '../../runtime/agent/orchestrator/providers/openai-oauth-catalog-store.mjs';
 import { hasEnabledAutomation } from '../../runtime/shared/automation-presence.mjs';
 import { resolveScheduleTimezone, validateScheduleCron } from '../../runtime/shared/schedule-time.mjs';
+import { pgClusterExists } from '../../runtime/memory/lib/pg/adapter.mjs';
+import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { readHookPublicBase } from '../../runtime/channels/lib/webhook/relay-tunnel.mjs';
 import { WEBHOOK_TEST_FIELD, WEBHOOK_TEST_HEADER } from '../../runtime/channels/lib/webhook/request-handler.mjs';
 
@@ -463,10 +465,20 @@ export async function testWebhook(name) {
 // and webhooks run sessions, so they must not require Discord/Telegram
 // tokens or an explicit remote toggle.
 async function checkActiveAutomation() {
-  const [schedules, webhooks] = await Promise.all([listSchedules(), listWebhooks()]);
+  const { schedules, webhooks } = await readAutomationRows();
   return hasEnabledAutomation({ schedules, webhooks });
 }
 
+// Read-only views (channel setup, the automation probe) never bring
+// PostgreSQL up for the first time: before initdb ran no schedule or webhook
+// can exist, and that first start — runtime download/extract plus initdb — is
+// seconds of work no catalog read should wait on. Writes still start it.
+async function readAutomationRows() {
+  if (!pgClusterExists(resolvePluginData())) return { schedules: [], webhooks: [] };
+  const [schedules, webhooks] = await Promise.all([listSchedules(), listWebhooks()]);
+  return { schedules, webhooks };
+}
+
 // Every session runtime in the process asks this at boot. Concurrent callers
 // join one in-flight check and a settled answer is reused for ttlMs, so N
 // runtimes booting together cost one PG query (and at most one PG boot)
@@ -519,8 +531,12 @@ export function hasActiveAutomation() {
   return automationProbe.probe();
 }
 
+// The daemon opens both stores in the background once ready (it settles
+// hasActiveAutomation), so on an existing cluster this read joins a
+// PostgreSQL start already under way instead of being the one that starts it.
 export async function channelSetup(config = null) {
   const cfg = normalizeChannelsConfig(config || readSection('channels'));
+  const { schedules, webhooks } = await readAutomationRows();
   return {
     webhook: {
       ...(cfg.webhook || {}),
@@ -528,7 +544,7 @@ export async function channelSetup(config = null) {
       // connects and mints its hook identity).
       publicUrl: readHookPublicBase(),
     },
-    schedules: await listSchedules(),
-    webhooks: await listWebhooks(),
+    schedules,
+    webhooks,
   };
 }

package/src/session-runtime/services/memory-runtime-proxy/calls.mjs

@@ -41,6 +41,9 @@ export function createMemoryCalls({ state, cwd, start, discovery, registry }) {
       ...(transcriptCwd ? { cwd: transcriptCwd } : {}),
     });
   }
+  async function forgetTranscripts(filePaths = []) {
+    return await requestMemoryPath('/transcript/forget', { filePaths }, { timeoutMs: 10_000 });
+  }
   async function recordTraceEvents(events = []) {
     return await requestMemoryPath('/admin/trace-record', { events }, { timeoutMs: 5_000 });
   }
@@ -120,6 +123,7 @@ export function createMemoryCalls({ state, cwd, start, discovery, registry }) {
     retain,
     appendEntry,
     ingestTranscript,
+    forgetTranscripts,
     recordTraceEvents,
     handleToolCall,
     buildSessionCoreMemoryPayload,

package/src/session-runtime/services/memory-runtime-proxy.mjs

@@ -91,6 +91,7 @@ function createStandaloneMemoryRuntime({ entry, dataDir, cwd = process.cwd() } =
     warmupEmbedding: calls.warmupEmbedding,
     appendEntry: calls.appendEntry,
     ingestTranscript: calls.ingestTranscript,
+    forgetTranscripts: calls.forgetTranscripts,
     recordTraceEvents: calls.recordTraceEvents,
     moduleUrl: pathToFileURL(entry).href,
   };

package/src/session-runtime/services/provider-admin.mjs

@@ -94,6 +94,7 @@ import {
 } from '../../runtime/shared/provider-accounts.mjs';
 import { currentProviderAccountId, withProviderAccount } from '../../runtime/shared/provider-auth-binding.mjs';
 import {
+  CUSTOM_API_KEY_ENV_RE,
   effectiveCustomModelRows,
   normalizeCustomProviderConfig as normalizeStoredCustomConfig,
 } from '../../runtime/agent/orchestrator/providers/custom-provider-config.mjs';
@@ -439,14 +440,22 @@ function customProviderRow(id, entry, checkSecrets = true) {
   const { config, error: configError } = inspectStoredCustomConfig(entry);
   const configuredEnabled = entry.enabled !== false;
   const keyless = (config?.auth ?? entry.auth) === 'none';
+  const apiKeyEnv = keyless ? '' : config?.apiKeyEnv || '';
+  const envSet = Boolean(apiKeyEnv && process.env[apiKeyEnv]);
   const stored = checkSecrets ? hasStoredSecret(SECRET_ACCOUNTS.agentApiKey(id)) : false;
   const unstoredStatus = configuredEnabled ? 'No Key' : 'Off';
   let status = stored ? 'Set' : unstoredStatus;
   let detail = stored ? 'stored in keychain' : 'custom endpoint';
+  if (apiKeyEnv) {
+    status = envSet ? 'Env' : unstoredStatus;
+    detail = apiKeyEnv;
+  }
   if (keyless) {
     status = configuredEnabled ? 'Keyless' : 'Off';
     detail = 'no API key required';
   }
+  let keyAuthenticated = checkSecrets ? stored : configuredEnabled;
+  if (apiKeyEnv) keyAuthenticated = envSet;
   const row = {
     id,
     name: entry.name,
@@ -457,17 +466,20 @@ function customProviderRow(id, entry, checkSecrets = true) {
     group: 'api',
     type: 'api-key',
     enabled: configuredEnabled,
-    authenticated: keyless || (checkSecrets ? stored : configuredEnabled),
+    authenticated: keyless || keyAuthenticated,
     stored,
-    env: false,
-    envName: null,
+    env: envSet,
+    envName: apiKeyEnv || null,
     status,
     detail,
   };
+  if (apiKeyEnv) row.apiKeyEnv = apiKeyEnv;
   row.schemaVersion = config?.schemaVersion ?? entry.schemaVersion;
   row.auth = keyless ? 'none' : 'key';
   row.discovery = structuredClone(config?.discovery ?? entry.discovery ?? { newModelsHidden: false });
   row.modelOverrides = structuredClone(config?.modelOverrides ?? entry.modelOverrides ?? {});
+  if (config?.wires) row.wires = [...config.wires];
+  if (config?.modelWires) row.modelWires = { ...config.modelWires };
   // A stored config that does not normalize cannot run (the registry skips
   // it): say so explicitly instead of listing it as connected.
   // Every readiness flag consumers read says "not ready" (`stored` stays the
@@ -547,8 +559,8 @@ export function providerStatus(config = {}) {
       enabled: row.enabled,
       authenticated: row.authenticated,
       stored: row.stored,
-      env: false,
-      envName: null,
+      env: row.env,
+      envName: row.envName,
       label: row.name,
     })),
     ...availableOAuthProviders().map((p) => oauthProviderStatusRow(p, config)),
@@ -867,6 +879,20 @@ function validateCustomTransportFields(input) {
     throw new TypeError('custom provider id is invalid');
   if (input.apiKey !== undefined && (typeof input.apiKey !== 'string' || input.apiKey.length > CUSTOM_API_KEY_MAX))
     throw new TypeError('custom provider apiKey is invalid');
+  if (input.apiKeyEnv !== undefined && input.apiKeyEnv !== null) {
+    if (typeof input.apiKeyEnv !== 'string' || !CUSTOM_API_KEY_ENV_RE.test(input.apiKeyEnv))
+      throw new TypeError('custom provider apiKeyEnv is invalid');
+    if (input.auth === 'none') throw new TypeError('custom provider apiKeyEnv requires key auth');
+    if (typeof input.apiKey === 'string' && input.apiKey !== '')
+      throw new TypeError('custom provider apiKey and apiKeyEnv are mutually exclusive');
+  }
+}
+
+/** Whether the named environment variable is set to a non-empty value. */
+export function checkCustomProviderKeyEnv(name) {
+  if (typeof name !== 'string' || !CUSTOM_API_KEY_ENV_RE.test(name))
+    throw new TypeError('environment variable name is invalid');
+  return { found: Boolean(process.env[name]) };
 }
 
 function inputObject(input) {
@@ -886,9 +912,16 @@ function withStoredSettings(input, entry) {
   }
   const out = { ...input };
   if (out.auth === undefined) out.auth = stored.auth;
+  if (out.apiKeyEnv === undefined && stored.apiKeyEnv) out.apiKeyEnv = stored.apiKeyEnv;
   if (out.schemaVersion === stored.schemaVersion) {
     if (out.discovery === undefined) out.discovery = stored.discovery;
     if (out.modelOverrides === undefined) out.modelOverrides = stored.modelOverrides;
+    // Served wires and per-model wires have no setup field yet: an edit on
+    // the same protocol keeps them (another protocol serves other wires).
+    if ((out.protocol ?? stored.protocol) === stored.protocol) {
+      if (out.wires === undefined && stored.wires) out.wires = stored.wires;
+      if (out.modelWires === undefined && stored.modelWires) out.modelWires = stored.modelWires;
+    }
   }
   return out;
 }
@@ -904,9 +937,11 @@ async function resolveCustomInput(cfgMod, rawInput, options) {
   const config = normalizeCustomProviderConfig(input, options);
   const typed = typeof input.apiKey === 'string' ? input.apiKey.trim() : '';
   const keyless = config.auth === 'none';
+  const envName = keyless ? '' : config.apiKeyEnv || '';
   let apiKey = '';
-  if (!keyless) apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
-  return { id, config, typed: keyless ? '' : typed, apiKey, keyless };
+  if (envName) apiKey = process.env[envName] || '';
+  else if (!keyless) apiKey = typed || (id ? getAgentApiKey(id) || '' : '');
+  return { id, config, typed: keyless || envName ? '' : typed, apiKey, keyless, envName };
 }
 
 export async function saveCustomProvider(cfgMod, rawInput) {
@@ -916,8 +951,9 @@ export async function saveCustomProvider(cfgMod, rawInput) {
     typed,
     apiKey,
     keyless,
+    envName,
   } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
-  if (!keyless && !apiKey) throw new Error('API key is required');
+  if (!keyless && !envName && !apiKey) throw new Error('API key is required');
   const id = existingId || `custom-${randomUUID()}`;
   const entry = { ...config, type: 'custom', enabled: config.enabled !== false };
   const account = SECRET_ACCOUNTS.agentApiKey(id);
@@ -1021,13 +1057,37 @@ export async function updateCustomProviderModel(cfgMod, rawId, rawModelId, patch
   return customProviderRow(id, saved);
 }
 
+// Drops every stored model setting and route that names the provider.
+function withoutProviderReferences(config, id) {
+  const next = { ...config };
+  const names = (route) => route?.provider === id;
+  if (next.modelSettings) {
+    next.modelSettings = Object.fromEntries(
+      Object.entries(next.modelSettings).filter(([key]) => !key.startsWith(`${id}/`))
+    );
+  }
+  if (next.agents) {
+    next.agents = Object.fromEntries(Object.entries(next.agents).filter(([, route]) => !names(route)));
+  }
+  if (names(next.webSearchRoute)) delete next.webSearchRoute;
+  if (Array.isArray(next.presets)) {
+    const dropped = new Set(next.presets.filter(names).map((preset) => preset.id));
+    next.presets = next.presets.filter((preset) => !names(preset));
+    if (dropped.has(next.default)) delete next.default;
+  }
+  return next;
+}
+
 export async function removeCustomProvider(cfgMod, rawId) {
   const id = String(rawId || '').trim();
   existingCustomEntry(cfgMod, id);
+  // Secret first: a real keychain failure (locked, permission) leaves the
+  // provider registered so the removal can be retried. A missing secret
+  // (keyless provider) is not an error.
+  await deleteSecretAsync(SECRET_ACCOUNTS.agentApiKey(id));
   const current = cfgMod.loadConfig();
   const { [id]: _removed, ...providers } = current.providers || {};
-  cfgMod.saveConfig({ ...current, providers }, { baseConfig: current });
-  await deleteSecretAsync(SECRET_ACCOUNTS.agentApiKey(id));
+  cfgMod.saveConfig(withoutProviderReferences({ ...current, providers }, id), { baseConfig: current });
   return { provider: id, type: 'custom', removed: true };
 }
 
@@ -1057,10 +1117,16 @@ export async function testCustomProvider(cfgMod, rawInput) {
     );
     return { ok: true };
   } catch (error) {
-    throw sanitizeCustomError(error, [apiKey]);
+    throw sanitizeCustomError(error, customSecrets(apiKey, config));
   }
 }
 
+// Every key the operation may have sent: env mode re-reads the variable on an
+// auth retry, so its current value is redacted alongside the initial key.
+function customSecrets(apiKey, config) {
+  return [apiKey, config.apiKeyEnv ? process.env[config.apiKeyEnv] : ''];
+}
+
 export async function discoverCustomProviderModels(cfgMod, rawInput) {
   const { id, config, apiKey } = await resolveCustomInput(cfgMod, rawInput, { requireModels: false });
   try {
@@ -1070,19 +1136,19 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
     const models = publicCustomModelRows(listed);
     // A failed discovery that still left manual rows reports its error too.
     const failure = provider.customDiscoveryError;
-    return failure ? { models, error: discoveryErrorView(failure, apiKey) } : { models };
+    return failure ? { models, error: discoveryErrorView(failure, customSecrets(apiKey, config)) } : { models };
   } catch (error) {
-    return { models: [], error: discoveryErrorView(error, apiKey) };
+    return { models: [], error: discoveryErrorView(error, customSecrets(apiKey, config)) };
   }
 }
 
-function discoveryErrorView(error, apiKey) {
+function discoveryErrorView(error, secrets) {
   const status = Number.isInteger(error?.status) ? error.status : undefined;
   const authKind = status === 401 || status === 403 ? 'authentication' : 'request';
   return {
     kind: status === 404 || status === 405 ? 'unavailable' : authKind,
     ...(status === undefined ? {} : { status }),
-    message: sanitizeCustomError(error, [apiKey]).message,
+    message: sanitizeCustomError(error, secrets).message,
   };
 }
 

package/src/session-runtime/session-transcript-purge.mjs

@@ -0,0 +1,32 @@
+// A hard-deleted session takes its conversation transcript
+// (`<home>/projects/<slug>/<id>.jsonl`) and the memory ingest read positions
+// keyed by that file with it. Registered once per process as a store purge hook:
+// the file removal is synchronous under the delete's commit lock, the offset
+// removal is a best-effort request to the memory service.
+import { registerSessionPurgeHook } from '../runtime/agent/orchestrator/session/store.mjs';
+import { mixdogHome } from '../runtime/shared/plugin-paths.mjs';
+import { purgeSessionTranscripts } from '../runtime/shared/transcript-writer/purge.mjs';
+
+const logError = (message) => {
+  try {
+    process.stderr.write(`mixdog: transcript-purge: ${message}\n`);
+  } catch {
+    /* logging is best effort */
+  }
+};
+
+/** @param {{ forgetOffsets?: (transcriptPaths: string[]) => Promise<unknown> }} options */
+export function registerTranscriptPurgeHook({ forgetOffsets } = {}) {
+  return registerSessionPurgeHook((sessionId, context) => {
+    const transcriptPaths = purgeSessionTranscripts({
+      mixdogHome: mixdogHome(),
+      sessionId,
+      cwds: context?.cwds,
+      onError: (target, error) => logError(`could not remove ${target}: ${error?.message || error}`),
+    });
+    if (!transcriptPaths.length || typeof forgetOffsets !== 'function') return;
+    Promise.resolve()
+      .then(() => forgetOffsets(transcriptPaths))
+      .catch((error) => logError(`could not drop ingest offsets of ${sessionId}: ${error?.message || error}`));
+  });
+}

package/src/session-runtime/session-turn-api.mjs

@@ -7,21 +7,30 @@
  */
 import { createTurnRunner } from './turn/turn-run.mjs';
 import { createSessionOps } from './turn/session-ops.mjs';
+import { createCompactionGate } from './turn/compaction-gate.mjs';
 import { createShareOps } from './turn/share-ops.mjs';
 import { createAgentOps } from './turn/agent-ops.mjs';
+import { createSideQuestionOps } from './turn/side-question-ops.mjs';
 
 export function createSessionTurnApi(deps) {
-  const runner = createTurnRunner(deps);
+  // A model-scheduled compaction runs chained after its turn; the next turn
+  // and any manual compact/clear/rewind wait on it so nothing races it.
+  const gate = createCompactionGate({ getSessionId: () => deps.getSession()?.id, compact: () => session.compact() });
+  const afterCompaction = gate.after;
+  const runner = createTurnRunner({ ...deps, runPendingCompact: gate.run });
   const session = createSessionOps(deps);
   const share = createShareOps(deps);
   const agent = createAgentOps(deps);
+  const side = createSideQuestionOps(deps);
   return {
+    askSide: side.askSide,
+    cancelSide: side.cancelSide,
     enqueueRemoteAttachedPrompt: runner.enqueueRemoteAttachedPrompt,
     getTurnLiveness: runner.getTurnLiveness,
-    ask: runner.ask,
-    clear: session.clear,
-    rewindMessages: session.rewindMessages,
-    compact: session.compact,
+    ask: afterCompaction(runner.ask),
+    clear: afterCompaction(session.clear),
+    rewindMessages: afterCompaction(session.rewindMessages),
+    compact: afterCompaction(session.compact),
     setToolMode: session.setToolMode,
     agentStatus: session.agentStatus,
     interruptTaskWait: session.interruptTaskWait,