mixdog 1.2.2 → 1.2.4

package/src/runtime/shared/provider-timeout-phase.mjs

@@ -0,0 +1,17 @@
+// The phase a provider timeout names on its `timeoutPhase` field. A provider
+// stamps it where the timer that fired is known; retry policy and error
+// presentation read it instead of matching the timeout's message text.
+export const TIMEOUT_PHASE = Object.freeze({
+  // The response headers did not arrive in the first-byte window.
+  HEADERS: 'headers',
+  // The headers arrived, the first chunk did not.
+  FIRST_CHUNK: 'first-chunk',
+  // A stream that already produced output went silent.
+  IDLE: 'idle',
+});
+
+/** A timeout before the model produced anything: headers or first chunk. */
+export function isFirstByteTimeout(err) {
+  const phase = err?.timeoutPhase;
+  return phase === TIMEOUT_PHASE.HEADERS || phase === TIMEOUT_PHASE.FIRST_CHUNK;
+}

package/src/runtime/shared/quiet-progress.d.mts

@@ -0,0 +1,35 @@
+export type QuietWaitKind = 'provider' | 'thinking' | 'model' | 'tool' | 'slot' | 'cancel' | '';
+
+export const MODEL_THINKING_STAGE: 'model_thinking';
+export function awaitingModelResponse(liveness: unknown): boolean;
+export function displayProgressStage(liveness: unknown): string | null;
+
+export interface QuietProgress {
+  since: number;
+  wait: QuietWaitKind;
+  tool?: string;
+}
+
+export interface QuietProgressParts {
+  quietMs: number;
+  minutes: number;
+  wait: QuietWaitKind;
+  tool: string;
+  escalated: boolean;
+}
+
+export const QUIET_PROGRESS_CUE_MS: number;
+export function lastProgressAt(liveness: unknown): number;
+export function quietWaitKind(stage: unknown): QuietWaitKind;
+export function quietProgress(options: {
+  progressAt: unknown;
+  stage: unknown;
+  tool?: unknown;
+  now?: number;
+}): QuietProgress | null;
+export function quietProgressParts(
+  quiet: { since?: unknown; wait?: unknown; tool?: unknown } | null | undefined,
+  now: number,
+  warnMs?: unknown
+): QuietProgressParts | null;
+export function quietProgressLabel(parts: QuietProgressParts | null): string;

package/src/runtime/shared/quiet-progress.mjs

@@ -0,0 +1,101 @@
+// Quiet-time cue for a running turn: how long it has gone without progress
+// the stall watchdog counts, and what it is waiting on. Display only — the
+// watchdog's abort policy lives in stall-policy.mjs and is never read or
+// changed here. Shared by the TUI spinner, the desktop live status line and
+// the desktop agent rows, so every surface says the same thing.
+
+/** A running turn with no counted progress for this long reads "quiet".
+ *  Lenient on purpose: effort-mode models can think for minutes without a
+ *  single semantic delta (stall-policy.mjs, the semantic-idle notes), so the
+ *  cue stays neutral text; only the watchdog's own warn point escalates it. */
+export const QUIET_PROGRESS_CUE_MS = 120_000;
+
+/** The newest progress stamp of a runtime liveness entry or progress
+ *  snapshot: the same signals the stall watchdog counts (stage changes,
+ *  semantic stream deltas, tool starts and tool heartbeats, the turn start). */
+export function lastProgressAt(liveness) {
+  if (!liveness || typeof liveness !== 'object') return 0;
+  return Math.max(
+    Number(liveness.lastProgressAt) || 0,
+    Number(liveness.lastStreamDeltaAt) || 0,
+    Number(liveness.toolStartedAt) || 0,
+    Number(liveness.askStartedAt) || 0
+  );
+}
+
+/** The stage a provider reports once its request is on the wire and the
+ *  response headers are still pending. The runtime keeps the turn in
+ *  `requesting` and records the send time (`requestSentAt`); the display stage
+ *  below reads "model thinking" from that record. */
+export const MODEL_THINKING_STAGE = 'model_thinking';
+
+/** Request sent, response headers (transport) not yet received — read from
+ *  a runtime liveness entry or progress snapshot. */
+export function awaitingModelResponse(liveness) {
+  if (!liveness || typeof liveness !== 'object' || liveness.stage !== 'requesting') return false;
+  const sentAt = Number(liveness.requestSentAt) || 0;
+  return sentAt > 0 && !((Number(liveness.lastTransportAt) || 0) >= sentAt);
+}
+
+/** The stage a surface shows: `model_thinking` while the request waits for
+ *  its headers, otherwise the runtime stage. */
+export function displayProgressStage(liveness) {
+  if (awaitingModelResponse(liveness)) return MODEL_THINKING_STAGE;
+  return typeof liveness?.stage === 'string' ? liveness.stage : null;
+}
+
+const WAIT_BY_STAGE = {
+  connecting: 'provider',
+  requesting: 'provider',
+  [MODEL_THINKING_STAGE]: 'thinking',
+  streaming: 'model',
+  tool_running: 'tool',
+  resource_wait: 'slot',
+  cancelling: 'cancel',
+};
+
+/** What a quiet turn waits on, from its runtime stage ('' when unknown). */
+export function quietWaitKind(stage) {
+  return WAIT_BY_STAGE[String(stage || '')] || '';
+}
+
+/** The quiet state of a running turn at `now`, or null while it is not
+ *  quiet. `since` is the frozen progress stamp, so the value stays identical
+ *  for the whole silence and publishing it costs one update per silence. */
+export function quietProgress({ progressAt, stage, tool = null, now = Date.now() }) {
+  const since = Number(progressAt) || 0;
+  if (!since || now - since < QUIET_PROGRESS_CUE_MS) return null;
+  const wait = quietWaitKind(stage);
+  return { since, wait, ...(wait === 'tool' && tool ? { tool: String(tool) } : {}) };
+}
+
+/** Display parts of a quiet state at `now`: whole quiet minutes, and whether
+ *  the silence reached the watchdog's warn point (`warnMs`, 0 = none). */
+export function quietProgressParts(quiet, now, warnMs = 0) {
+  const since = Number(quiet?.since) || 0;
+  if (!since) return null;
+  const quietMs = Math.max(0, now - since);
+  if (quietMs < QUIET_PROGRESS_CUE_MS) return null;
+  return {
+    quietMs,
+    minutes: Math.floor(quietMs / 60_000),
+    wait: String(quiet.wait || ''),
+    tool: typeof quiet.tool === 'string' ? quiet.tool : '',
+    escalated: Number(warnMs) > 0 && quietMs >= Number(warnMs),
+  };
+}
+
+const WAIT_TEXT = {
+  provider: 'waiting on provider',
+  thinking: 'model thinking',
+  model: 'waiting on model',
+  slot: 'waiting for a slot',
+  cancel: 'stopping',
+};
+
+/** The TUI's lowercase English cue: `quiet for 2m · waiting on provider`. */
+export function quietProgressLabel(parts) {
+  if (!parts) return '';
+  const wait = parts.wait === 'tool' ? `running ${parts.tool || 'a tool'}` : WAIT_TEXT[parts.wait] || '';
+  return [`quiet for ${parts.minutes}m`, wait].filter(Boolean).join(' · ');
+}

package/src/runtime/shared/quota-resume-store.mjs

@@ -131,6 +131,32 @@ export function listQuotaResumeEntries() {
   return [...load().entries.values()];
 }
 
+/** Rekey a proven legacy execution and its Goal together; invalidate old fires. */
+export function rekeyQuotaResumeTurn(sessionId, fromTurnKey, toTurnKey) {
+  const current = load();
+  const id = text(sessionId);
+  const from = text(fromTurnKey);
+  const to = text(toTurnKey);
+  if (!id || !from || !to || from === to) return false;
+  const entry = current.entries.get(id);
+  const suspension = current.suspensions.get(id);
+  const moveEntry = entry?.turnKey === from;
+  const moveGoal = suspension?.turnKey === from;
+  if (!moveEntry && !moveGoal) return false;
+  const next = {
+    ...current,
+    generation: current.generation + Number(moveEntry),
+    entries: new Map(current.entries),
+    suspensions: new Map(current.suspensions),
+  };
+  if (moveEntry) next.entries.set(id, normalizeEntry({ ...entry, turnKey: to, generation: next.generation }));
+  if (moveGoal) next.suspensions.set(id, normalizeSuspension({ ...suspension, turnKey: to }));
+  persist(next);
+  state = next;
+  notify(id);
+  return true;
+}
+
 /** The session snapshot's `quotaResume` value for an entry (or null). */
 export function publicQuotaResume(entry) {
   if (!entry) return null;
@@ -244,7 +270,12 @@ export function isAgentOnlySession(session) {
   const lower = (value) => text(value).toLowerCase();
   if (lower(session.visibility) === 'agent-only') return true;
   const parentId = text(session.parentSessionId || session.ownerSessionId);
-  return lower(session.owner) === 'agent' && lower(session.agent) !== 'lead' && parentId !== '' && parentId !== text(session.id);
+  return (
+    lower(session.owner) === 'agent' &&
+    lower(session.agent) !== 'lead' &&
+    parentId !== '' &&
+    parentId !== text(session.id)
+  );
 }
 
 /** Global setting, default on. */

package/src/runtime/shared/read-row-numbers.mjs

@@ -61,3 +61,47 @@ export function readRowsForDisplay(text) {
   }
   return out.join('\n');
 }
+
+/** Decode one contiguous model-facing read window, never display metadata.
+ * Unknown or disjoint views are not safe substitutes for file text. Per-line
+ * clipping is not visible in the text: the read executor reports it
+ * structurally, never inferred from row content.
+ * The display format does not preserve original byte size or final newline.
+ */
+export function readSourceWindow(text) {
+  if (typeof text !== 'string') return null;
+  if (/^<system-reminder>File exists but has empty contents: [^\n]*<\/system-reminder>$/.test(text))
+    return { content: '', totalLines: 0, startLine: 1, endLine: 0, truncated: false };
+  const emptyRange = /^\(no lines in range; file has (\d+) lines\)$/.exec(text);
+  if (emptyRange)
+    return { content: '', totalLines: Number(emptyRange[1]), startLine: null, endLine: null, truncated: false };
+  if (!RUN_MARKER_RE.test(text.split('\n', 1)[0])) return null;
+  const rows = [];
+  let totalLines;
+  let footer = null;
+  for (const line of readRowsForDisplay(text).split('\n')) {
+    const row = /^(\d+)→([\s\S]*)$/.exec(line);
+    if (row) {
+      if (footer) return null;
+      const number = Number(row[1]);
+      if (rows.length && number !== rows.at(-1).number + 1) return null;
+      rows.push({ number, content: row[2] });
+      continue;
+    }
+    const metadata = /^\[lines (\d+)-(\d+) of (\d+)(?:; pass offset:\d+ to continue)?\]$/.exec(line);
+    if (!metadata || footer) return null;
+    footer = metadata;
+    totalLines = Number(metadata[3]);
+  }
+  if (!rows.length) return null;
+  const startLine = rows[0].number;
+  const endLine = rows.at(-1).number;
+  if (footer && (Number(footer[1]) !== startLine || Number(footer[2]) !== endLine || totalLines < endLine)) return null;
+  return {
+    content: rows.map((row) => row.content).join('\n'),
+    ...(totalLines === undefined ? {} : { totalLines }),
+    startLine,
+    endLine,
+    truncated: totalLines === undefined || endLine < totalLines,
+  };
+}

package/src/runtime/shared/remote-intent.mjs

@@ -1,47 +1,7 @@
-// Durable channel-link record (channel-remote-intent.json), read-side.
-//
-// The daemon's channel transport OWNS this file (writes/clears it); everything
-// else only asks one question: "which session is pinned to the channel?".
-// That session reclaims its link on boot
-// instead of waiting for a manual toggle — the reconnect path that used to
-// look like the channel had silently unlinked itself.
-import { readFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+// Path of the durable channel-link record (channel-remote-intent.json).
+import { join } from 'node:path';
 import { resolveRuntimeRoot } from './runtime-root.mjs';
 
 export function remoteIntentPath(root = resolveRuntimeRoot()) {
   return join(root, 'channel-remote-intent.json');
 }
-
-export function readRemoteIntent(path = remoteIntentPath()) {
-  try {
-    const value = JSON.parse(readFileSync(path, 'utf8'));
-    const sessionId = String(value?.sessionId || '').trim();
-    const transcriptPath = String(value?.transcriptPath || '').trim();
-    if (!/^[A-Za-z0-9_-]+$/.test(sessionId) || !transcriptPath) return null;
-    return {
-      sessionId,
-      transcriptPath,
-      cwd: value?.cwd == null ? null : String(value.cwd),
-    };
-  } catch {
-    return null;
-  }
-}
-
-// cwd is compared only when the record carries one: the intent is session
-// pinned, and a resumed session keeps its id across restarts.
-export function remoteIntentMatchesSession(sessionId, cwd = null, path = undefined) {
-  const id = String(sessionId || '').trim();
-  if (!id) return false;
-  const intent = readRemoteIntent(path);
-  if (!intent || intent.sessionId !== id) return false;
-  if (intent.cwd && cwd) {
-    try {
-      if (resolve(intent.cwd) !== resolve(cwd)) return false;
-    } catch {
-      return false;
-    }
-  }
-  return true;
-}

package/src/runtime/shared/review-diff.mjs

@@ -1,5 +1,57 @@
 const TRUNCATED = '… [diff truncated for display]';
 
+// Review replies always list every changed file with its counts. Patch text
+// is carried per file within these caps (UTF-8 bytes); a file past either one
+// is listed `patchOmitted` with reason PATCH_TOO_LARGE and is read on its own,
+// up to the larger "show anyway" cap, when it is opened.
+/** Largest single-file patch a review reply carries inline. */
+export const REVIEW_FILE_PATCH_MAX_BYTES = 1024 * 1024;
+/** Largest total patch text a review reply carries. */
+export const REVIEW_PATCH_MAX_BYTES = 2 * 1024 * 1024;
+/** Largest single-file patch a file-patch read returns. */
+export const REVIEW_FILE_PATCH_SHOW_MAX_BYTES = 8 * 1024 * 1024;
+export const PATCH_TOO_LARGE = 'too_large';
+
+/** A reply file listed with its counts but without its patch, for size. */
+export function patchOmittedFile(file) {
+  return { ...file, patchOmitted: true, reason: PATCH_TOO_LARGE };
+}
+
+/** A `diff --git` section (string or Buffer) whose hunks boundReviewPatch cut. */
+export function reviewSectionTruncated(section) {
+  return section.includes(TRUNCATED);
+}
+
+/** Nothing of the reply's patch fit: no patch text, a file omitted for size. */
+export function reviewDiffTooLarge(files, patch) {
+  return !patch && (files || []).some((file) => file?.patchOmitted === true && file.reason === PATCH_TOO_LARGE);
+}
+
+/** The per-file and total caps of one reply. `admit(bytes)` takes a patch of
+ *  that size from the remaining total, or refuses it. */
+export function createReviewPatchBudget(total = REVIEW_PATCH_MAX_BYTES) {
+  let remaining = total;
+  return {
+    get remaining() {
+      return remaining;
+    },
+    admit(bytes) {
+      if (bytes > REVIEW_FILE_PATCH_MAX_BYTES || bytes > remaining) return false;
+      remaining -= bytes;
+      return true;
+    },
+  };
+}
+
+/** One file-patch read's reply: its patch, or none when past `maxBytes`. */
+export function filePatchReply(path, patch, maxBytes = REVIEW_FILE_PATCH_SHOW_MAX_BYTES) {
+  const text = typeof patch === 'string' ? patch : '';
+  if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+    return { supported: true, path, patch: '', patchOmitted: true, reason: PATCH_TOO_LARGE };
+  }
+  return { supported: true, path, patch: text };
+}
+
 /** Bound hunk bodies, never the inventory of changed files. Headers are kept
  * even when the inventory itself exceeds the display budget. */
 export function boundReviewPatch(patch, maxChars) {

package/src/runtime/shared/session-sidebar-host.d.mts

@@ -0,0 +1,4 @@
+export type SessionSidebarChange = { favorite: boolean } | { archived: boolean };
+export type SessionSidebarHost = (sessionId: unknown, change: unknown) => unknown;
+export function registerSessionSidebarHost(host: SessionSidebarHost): () => void;
+export function applySessionSidebarChange(sessionId: string, change: SessionSidebarChange): Promise<void>;

package/src/runtime/shared/session-sidebar-host.mjs

@@ -0,0 +1,38 @@
+// Runtime → desktop request channel for a session's sidebar metadata
+// (favorite, archive). That metadata belongs to the desktop
+// service hosted in this daemon: it registers a host here, and the Lead's
+// `session` tool applies a change through it, so the sidebar republishes live.
+//
+// Deliberately dependency-free: the desktop service bundle imports this file
+// too, and both copies share one registry through a global symbol.
+
+const HOSTS_KEY = Symbol.for('mixdog.sessionSidebarHosts.v1');
+
+function hosts() {
+  globalThis[HOSTS_KEY] ??= [];
+  return globalThis[HOSTS_KEY];
+}
+
+/**
+ * Register a desktop host. `host(sessionId, change)` applies one change:
+ * `{ favorite: boolean }` or `{ archived: boolean }`.
+ * @returns {() => void} Unregister.
+ */
+export function registerSessionSidebarHost(host) {
+  const entry = { host };
+  hosts().push(entry);
+  return () => {
+    const list = hosts();
+    const index = list.indexOf(entry);
+    if (index >= 0) list.splice(index, 1);
+  };
+}
+
+/** Apply one change through exactly one host: the most recently registered
+ *  (active) desktop service. Never broadcast — each service writes the shared
+ *  metadata file, so a second write would be redundant at best. */
+export async function applySessionSidebarChange(sessionId, change) {
+  const active = hosts().at(-1);
+  if (!active) throw new Error('no desktop app is attached to this runtime');
+  await active.host(sessionId, change);
+}

package/src/runtime/shared/slow-span.mjs

@@ -0,0 +1,121 @@
+// slow-span.mjs
+// Passive per-request timing spans. Every traced call is timed on the same
+// monotonic clock the owner heartbeat uses (performance.now), completed spans
+// over `minMs` land in a bounded ring, and spans over `slowMs` are logged as
+// `[slow-op] <label> <ms>`. When the event loop stalls, `describe(from, to)`
+// names the spans that overlapped the stall window. Spans carry labels, phase
+// durations and sizes only — never payloads.
+
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { performance } from 'node:perf_hooks';
+
+export const SPAN_RING_MIN_MS = 25;
+export const SPAN_SLOW_MS = 1000;
+export const SPAN_RING_CAPACITY = 64;
+
+const current = new AsyncLocalStorage();
+
+/** Short, log-safe id of a session id. */
+export function shortId(id) {
+  const text = String(id ?? '');
+  return text ? text.slice(0, 8) : '';
+}
+
+/** Appends detail (e.g. the action name) to the label of the span the caller runs in. */
+export function annotateSpan(detail) {
+  const span = current.getStore();
+  if (span && detail) span.label += `:${detail}`;
+}
+
+/** Closes the running phase of the caller's span at `now`, under `name`. */
+export function markPhase(name) {
+  const span = current.getStore();
+  if (!span) return;
+  const t = span.now();
+  span.phases.push([name, t - span.mark]);
+  span.mark = t;
+}
+
+/** Records a size (count/bytes) on the caller's span. */
+export function noteSpanSize(size) {
+  const span = current.getStore();
+  if (span && Number.isFinite(size)) span.size = size;
+}
+
+const round = (ms) => Math.round(ms);
+
+function formatSpan(span) {
+  const phases = span.phases.map(([name, ms]) => `${name}=${round(ms)}`).join(' ');
+  const size = span.size === undefined ? '' : ` size=${span.size}`;
+  return `${span.label} ${round(span.ms)}ms${phases ? ` ${phases}` : ''}${size}`;
+}
+
+export function createSlowSpans({
+  now = () => performance.now(),
+  capacity = SPAN_RING_CAPACITY,
+  minMs = SPAN_RING_MIN_MS,
+  slowMs = SPAN_SLOW_MS,
+  log = () => {},
+} = {}) {
+  const ring = [];
+  let sink = log;
+
+  function complete(span) {
+    span.end = now();
+    span.ms = span.end - span.start;
+    if (span.ms >= minMs) {
+      ring.push({
+        label: span.label,
+        start: span.start,
+        end: span.end,
+        ms: span.ms,
+        phases: span.phases,
+        size: span.size,
+      });
+      if (ring.length > capacity) ring.shift();
+    }
+    if (span.ms >= slowMs) {
+      try {
+        sink(`[slow-op] ${formatSpan(span)}`);
+      } catch {
+        /* logging must not fail the call */
+      }
+    }
+  }
+
+  return {
+    setLog(next) {
+      sink = typeof next === 'function' ? next : () => {};
+    },
+    /** Runs `fn` inside a span; markPhase/annotateSpan inside it attach to this span. */
+    async trace(label, fn) {
+      const start = now();
+      const span = { label: String(label), start, mark: start, now, phases: [], size: undefined };
+      try {
+        return await current.run(span, fn);
+      } finally {
+        complete(span);
+      }
+    },
+    /** Completed spans overlapping [from, to], longest overlap first. */
+    overlapping(from, to, limit = 3) {
+      return ring
+        .map((span) => ({ span, overlap: Math.min(span.end, to) - Math.max(span.start, from) }))
+        .filter((row) => row.overlap > 0)
+        .sort((a, b) => b.overlap - a.overlap || b.span.end - a.span.end)
+        .slice(0, limit)
+        .map((row) => row.span);
+    },
+    /** One-line description of the spans overlapping a stall window ('' when none). */
+    describe(from, to, limit = 3) {
+      const spans = this.overlapping(from, to, limit);
+      return spans.length ? `spans: ${spans.map((span) => formatSpan({ ...span })).join('; ')}` : '';
+    },
+    get recent() {
+      return ring.slice();
+    },
+  };
+}
+
+/** Process-wide recorder; the daemon points its log at daemon.log. */
+export const slowSpans = createSlowSpans();

package/src/runtime/shared/statusline/statusline-segments.mjs

@@ -15,6 +15,11 @@ import { join } from 'node:path';
 import { formatElapsed } from './statusline-format.mjs';
 import { positiveInt } from '../numbers.mjs';
 import { isPidAlive } from '../pid-liveness.mjs';
+import { workspaceSees } from '../worktrees/workspace-visibility.mjs';
+
+/** Whether an orphaned held shell (`status.orphaned`) belongs in the list of a
+ *  session working in `sessionCwd`. */
+export const shellJobVisibleFrom = (job, sessionCwd) => workspaceSees(job?.cwd, sessionCwd);
 
 const DEFAULT_MIXDOG_HOME = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
 const DEFAULT_STANDALONE_DATA_DIR = join(DEFAULT_MIXDOG_HOME, 'data');
@@ -76,9 +81,38 @@ export function shellJobsStatus({ clientHostPid, sessionId } = {}) {
       _shellJobsRefreshInFlight.delete(ownerPid);
     });
   }
-  const value = cached?.value || EMPTY_SHELL_JOBS;
-  if (!scoped) return value;
-  return (scope && value.sessions?.[scope]) || EMPTY_SHELL_JOBS_SESSION;
+  const own = cached?.value || EMPTY_SHELL_JOBS;
+  // Session buckets are not pid-scoped, so they come from the freshest scan of
+  // ANY owner. Reading them from this owner's own slot made the list follow
+  // that slot's age: an owner polled again after its entry was evicted (or
+  // went stale) answered with "no sessions", and the finished shells vanished
+  // until the next poll brought them back.
+  const sessions = freshestShellJobsSessions() ?? own.sessions;
+  if (!scoped) return sessions === own.sessions ? own : { ...own, sessions };
+  return (scope && sessions?.[scope]) || EMPTY_SHELL_JOBS_SESSION;
+}
+
+/** Listed jobs held only because their termination is unconfirmed. */
+export function unconfirmedShellCount(status) {
+  const jobs = Array.isArray(status?.jobs) ? status.jobs : [];
+  return jobs.filter((job) => job?.terminationUnconfirmed === true).length;
+}
+
+// Awaited fresh scan for pollers that own their cadence (desktop): the result
+// reflects the disk at call time instead of the previous poll. The CLI render
+// path keeps using the cache-only shellJobsStatus.
+export async function shellJobsStatusFresh({ clientHostPid } = {}) {
+  const ownerPid = positiveInt(clientHostPid);
+  if (!ownerPid) return EMPTY_SHELL_JOBS;
+  return refreshShellJobsStatus(ownerPid);
+}
+
+function freshestShellJobsSessions() {
+  let freshest = null;
+  for (const entry of _shellJobsSegmentCache.values()) {
+    if (!freshest || entry.at >= freshest.at) freshest = entry;
+  }
+  return freshest?.value.sessions;
 }
 
 // Memory cycle L2 segment source. The daemon-hosted memory runtime writes
@@ -142,12 +176,13 @@ async function refreshShellJobsStatus(ownerPid) {
       names = await readdir(dir);
     } catch {
       rememberShellJobs(ownerPid, value);
-      return;
+      return value;
     }
     const { ids, ownerByJob, doneIds } = listOpenShellJobs(names);
     let count = 0;
     let oldestMs = Infinity;
     const jobs = [];
+    const orphaned = [];
     // sessionId -> { count, oldestMs, jobs }. Jobs with no session stamp (legacy
     // records, plain CLI runs) still count toward the owner total but belong to
     // no pane, so they never light up a session's indicator.
@@ -160,11 +195,16 @@ async function refreshShellJobsStatus(ownerPid) {
       } catch {
         continue;
       }
-      if (!(await isShellJobAlive(detail, p, dir, id))) continue;
+      // A killed command whose processes are not confirmed gone has already
+      // reported its result, so its tool card is closed: it is listed until
+      // its owner retires the record. Its root pid may be gone while a
+      // descendant lives, so the owner's liveness decides, not the root's.
+      const unconfirmed = detail?.terminationUnconfirmed === true;
+      if (unconfirmed ? !isPidAlive(ownerByJob.get(id) || 0) : !(await isShellJobAlive(detail, p, dir, id))) continue;
       // A foreground command is awaited in its own tool card; listing it here
       // made every short command flash in and out of the shell list. Only
       // backgrounded jobs (including promoted ones) are background work.
-      if (detail?.foreground === true) continue;
+      if (detail?.foreground === true && !unconfirmed) continue;
       // Owner-wide totals stay this process's own; session buckets take every
       // live job regardless of which host published it.
       const ownedByThisHost = ownerByJob.get(id) === ownerPid;
@@ -181,8 +221,12 @@ async function refreshShellJobsStatus(ownerPid) {
         command: String(detail?.command || '').trim(),
         cwd: String(detail?.cwd || '').trim(),
         startedAt: detail?.startedAt || (Number.isFinite(jobMs) ? jobMs : null),
+        ...(unconfirmed ? { terminationUnconfirmed: true } : {}),
       };
       if (ownedByThisHost) jobs.push(job);
+      // Held by a session that has closed: every session that sees its
+      // folder lists it (shellJobVisibleFrom), not only the closed owner.
+      if (unconfirmed && detail?.ownerSessionClosed === true) orphaned.push(job);
       if (!owner) continue;
       const bucket = bySession.get(owner) || { count: 0, oldestMs: Infinity, jobs: [], finished: [] };
       bucket.count += 1;
@@ -221,10 +265,12 @@ async function refreshShellJobsStatus(ownerPid) {
     // count stays 0 (its publisher is a shard, not this host), so an empty
     // aggregate must NOT discard the session buckets.
     if (count || bySession.size) value = summarizeShellJobs({ count, oldestMs, jobs, bySession });
+    if (orphaned.length) value = { ...value, orphaned };
   } catch {
     value = EMPTY_SHELL_JOBS;
   }
   rememberShellJobs(ownerPid, value);
+  return value;
 }
 
 // Newest-first, capped ids of job records with no `.done` marker, plus the

package/src/runtime/shared/tool-card-model/card-header.mjs

@@ -5,7 +5,8 @@
 import { formatToolActionHeader, toolLoadingTargets } from '../tool-surface.mjs';
 import { agentActionSummary, agentActionTitle, agentResponseTitle, isAgentTool } from './agent-surface.mjs';
 import { backgroundTaskActionTitle, backgroundTaskResultTitle, taskControlTitle } from './background-task.mjs';
-import { toolSearchLoadedSummary } from './generic-detail.mjs';
+import { bridgeDescribedToolNames, toolSearchLoadedSummary } from './generic-detail.mjs';
+import { displayToolSearchTarget } from '../tool-primitives.mjs';
 import { safeInlineText } from './inline-text.mjs';
 import { shellHeader } from './shell-surface.mjs';
 
@@ -20,6 +21,11 @@ function headerLabel(base, surface, display, status, detail) {
   }
   if (display.isBackgroundMetadataResult) return backgroundTaskActionTitle(normalizedName, display.backgroundMeta);
   if (isShellSurface) return shellHeader(status.shellStatus, groupCount, parsedArgs?.verifyShell === true);
+  // Bridge load_tool describes definitions; it never loads a tool.
+  const described =
+    normalizedName === 'load_tool' && !headerPending ? bridgeDescribedToolNames(display.displayedResultText) : null;
+  if (described)
+    return described.length ? `Described ${described.map(displayToolSearchTarget).join(', ')}` : 'Described';
   return (
     (isAgentTool(normalizedName) ? agentActionTitle(parsedArgs, display.displayedResultText) : '') ||
     formatToolActionHeader(name, args, {