mixdog 1.2.3 → 1.2.5

package/src/defaults/skills/image/SKILL.md

@@ -12,27 +12,25 @@ dependencies:
 
 # Image generation and editing (media tool · Media Studio)
 
-Use `media` for still-image generation and editing. Read this guide before
-the first image-generation or editing call.
+Use `media` for still-image generation and editing; read this guide before the first call.
 
-This file owns the judgement around one tool for still images: how a picture is asked for, checked, and saved. It is not tied to any deliverable — a deck, a document, or a page that needs a picture loads this skill and keeps only its own placement rules. The lane catalog (providers, models, controls, sign-in state) lives in the runtime and is read with `list`; nothing here names a lane or a model, so this file stays true when providers change.
+This file owns the judgement around one tool for still images: how a picture is asked for, checked, and saved. Any deliverable that needs a picture loads it and keeps only its own placement rules. The lane catalog (providers, models, controls, sign-in state) lives in the runtime and is read with `list`, so this file stays true when providers change.
 
 ## 1. Which kind of job
 **Hard rule — generate or edit, decided first**:
-- *Generate* — the user wants a new image (product shot, hero, social card, illustration, icon, texture, concept) or a deliverable needs one. Images the user attaches only as style, mood, or composition guidance still make this a generate with references.
+- *Generate* — the user wants a new image (product shot, hero, social card, illustration, icon, texture, concept) or a deliverable needs one. Images attached only as style, mood, or composition guidance still make this a generate with references.
 - *Edit* — the user wants an existing image kept and part of it changed: background swap, object removal, lighting or weather, text replacement, style transfer, compositing, cutout. The source image goes in `references` as the edit target; §3 edit brief applies.
-**Hard rule — not this tool**: extending a repository's own SVG, icon, or logo system; simple shapes, wireframes, and diagrams that are better drawn in SVG, HTML/CSS, or a chart library; charts, tables, and the user's own photographs, which a generated picture never replaces.
+**Hard rule — not this tool**: a repository's own SVG, icon, or logo system; simple shapes, wireframes, and diagrams better drawn in SVG, HTML/CSS, or a chart library; charts, tables, and the user's own photographs.
 **Hard rule — no signed-in lane, no picture**: when `list` (or a failed `generate`) reports no image lane, continue without and say so; never substitute a placeholder, a stock-photo URL, or an emoji.
-**Default — one generation per job, one corrected retry**: a result that misses the brief is retried once with a single targeted change (§2 step 3); a second miss is reported as "not achieved", not a third attempt. Several candidates only when the user asks for choices.
-
+**Default — one generation per job, one corrected retry**: a result that misses the brief is retried once with a single targeted change (§2 step 3); a second miss is reported as "not achieved".
 ## 2. Call order
-1. `media action:'list' kind:'image'` once per session before the first generate: signed-in lanes, their models, and `remembered` — the lane/model a generate runs on when none is passed (the user's current Studio selection, else the last generation of this kind). Add `model:` for that model's controls (`aspectRatio` / `size`, `resolution`, `quality`, `maxReferences`).
-2. `media action:'generate' kind:'image', prompt, path, + controls` — **lane and model are omitted by default** so the picture comes from what the user chose; controls only from the remembered model's list. Pass `lane`/`model` only when the job needs a capability that model lacks (reference count, exact in-image text, a listed resolution), chosen from `list`. The result reports the lane, model, `laneSource` (`requested` / `remembered` / `first`), and options actually used, and those go into the report.
-3. **Hard rule — look before using**: open the file with `read` and check subject, style, composition, the exclusions, any in-image text, and — for an edit — every item in the preserve list. A miss is fixed by changing one variable in the prompt and restating every invariant; never rewrite the whole prompt, never use an unseen result.
+1. `media action:'list' kind:'image'` once per session before the first generate: signed-in lanes, their models, and `remembered` — the lane/model a generate runs on when none is passed (Studio selection, else last generation of this kind). Add `model:` for that model's controls (`aspectRatio` / `size`, `resolution`, `quality`, `background`, `maxReferences`).
+2. `media action:'generate' kind:'image', prompt, path, + controls` — **lane and model are omitted by default** (the user's remembered choice, else the signed-in ChatGPT lane); controls only from that model's list — one listing none gets none. **Hard rule — a named source is passed**: GPT / ChatGPT / Codex / OpenAI → the OpenAI lane; Grok, Gemini, Antigravity → theirs, from `list`; if it is not signed in, say so rather than swap. Otherwise pass `lane`/`model` only when the job needs a capability the model lacks (reference count, exact text, a listed resolution). The result reports lane, model, `laneSource` (`requested` / `remembered` / `first`), and options used.
+3. **Hard rule — look before using**: open the file with `read` and check subject, style, composition, the exclusions, any in-image text, and — for an edit — every item in the preserve list. A miss is fixed by changing one variable in the prompt and restating every invariant; never rewrite the whole prompt.
 4. The result is also a Studio asset (`assetId`); the file at `path` is the copy the work uses.
 
 ## 3. Prompt form
-**Hard rule — labeled lines, in priority order**: the model reads order as priority; scene first by default, subject first when identity or product fidelity dominates. Use only the lines that change pixels; add a short labeled line when it materially helps. Never wrap the prompt in JSON.
+**Hard rule — labeled lines, in priority order**: the model reads order as priority; scene first by default, subject first when identity or product fidelity dominates. Use only the lines that change pixels. Never wrap the prompt in JSON.
 ```
 Use: photorealistic | product-mockup | ui-mockup | infographic | logo-brand | illustration | stylized-concept | historical-scene   (edit: text-replace | identity-preserve | object-edit | lighting-weather | cutout | style-transfer | compositing | sketch-to-render)
 Asset: where it will be used — hero, OG card, figure, avatar, sprite, texture, cover
@@ -45,8 +43,8 @@ Text: "exact words" · script · font style · size · placement            (onl
 Keep: invariants that must not change                                   (edits; see the edit brief)
 Avoid: no logos, no watermarks; plus no text / no faces when the use calls for it
 ```
-**Default — specificity policy**: a detailed user prompt is normalized into this form and nothing is added; a generic one gets composition, intended use, and scene concreteness — never extra characters, props, brand names, palettes, story beats, or a left/right placement the layout does not call for.
-**Default — exclusions follow the use**: a field for copy (hero, cover, OG, background) excludes text, logos, watermarks, and faces unless asked; an illustration or a scene with people excludes only logos and watermarks; a portrait keeps its face. "No text" is not a universal default.
+**Default — specificity policy**: a detailed user prompt is normalized into this form and nothing is added; a generic one gets composition, intended use, and scene concreteness — never extra characters, props, brands, palettes, story beats, or placement the layout does not call for.
+**Default — exclusions follow the use**: a field for copy (hero, cover, OG, background) excludes text, logos, watermarks, and faces unless asked; an illustration or a scene with people excludes only logos and watermarks; a portrait keeps its face.
 **Hard rule — anti-patterns**:
 | Pattern | Why it fails | Instead |
 |---|---|---|
@@ -62,13 +60,13 @@ Change only: the specific modification
 Preserve exactly: named locks — face structure, pose, product silhouette, logo geometry, text spelling, framing, perspective, palette, lighting, shadows
 Do not add or remove: protected elements
 ```
-"Keep everything else the same" alone is weak: name the fragile properties, and repeat the same lock list on every retry. A removal is written as what replaces it ("show the continuous desk grain where the note was, matching lighting and perspective — no residue or outline"), never as "remove X" alone. A source carrying drawn markup (arrows, boxes, notes) is sent clean, with the markup translated into instructions — the model reproduces marks it sees.
+"Keep everything else the same" alone is weak: name the fragile properties, and repeat the same lock list on every retry. A removal is written as what replaces it ("show the continuous desk grain where the note was, no residue or outline"), never as "remove X" alone. A source carrying drawn markup (arrows, boxes, notes) is sent clean, with the markup translated into instructions — the model reproduces marks it sees.
 
 ## 4. Text inside the image
 **Default — text only when wanted**: a field for copy gets no text; the deliverable or the page sets its own type over it.
 **Hard rule — when text is wanted, it is exact**: the words in quotes, the language and script, the font style, the approximate size, the placement, and "once, with no other readable text". Uncommon words are spelled letter by letter. Korean: write the prompt in English and quote only the Hangul string; start with short label-length strings.
 **Hard rule — copy that must be exact is composited, not generated**: packaging, UI, legal, or brand copy is generated as an empty reserved area (`no text` in that region) and set afterwards with a real font by the deliverable or an image tool.
-**Default — always inspect rendered text** (§2 step 3); garbled or substituted glyphs are common. One targeted text-only edit pass may follow; if spelling still drifts, stop and composite.
+**Default — always inspect rendered text** (§2 step 3); garbled glyphs are common. One targeted text-only edit pass may follow; if spelling still drifts, stop and composite.
 
 ## 5. Reference images
 `references:` takes file paths; the model's `maxReferences` caps them. A reference is the user's own file or one this session generated — never a downloaded third-party image.
@@ -87,15 +85,15 @@ Do not add or remove: protected elements
 | icon, avatar, texture, tile | `1:1` |
 | a still for a video clip | the clip's aspect |
 
-The value must be one the model lists; when a model lists sizes instead of ratios, pick the closest size.
-**Default — resolution**: the highest the model lists for a hero, print, or full-bleed frame; the default for drafts, thumbnails, and icons. Use the `quality` setting only when the model lists it.
-**Default — cutouts**: models do not produce real alpha; generate on a stated solid background (`pure solid white #FFFFFF`, or black for reflective subjects; "no gradient, no floor, no shadow, no vignette") and remove it afterwards. Never ask for "transparent background" — it burns a fake checkerboard into the image.
+Pass only a listed value (closest size when sizes are listed); a model listing none gets none, so put the ratio in the prompt's Composition line.
+**Default — resolution**: the highest the model lists for a hero, print, or full-bleed frame; the default for drafts, thumbnails, and icons.
+**Default — cutouts and transparency**: when the model lists `background`, pass `background: transparent` for cutouts, stickers, icons, logos, background removal, and edits of an image that must stay transparent (`auto` drops alpha on edits). Otherwise generate on a stated solid background (`pure solid white #FFFFFF`, or black for reflective subjects; "no gradient, no floor, no shadow, no vignette") and remove it afterwards; never put "transparent background" in the prompt — it burns a fake checkerboard into the image.
 
 ## 7. Saving, reporting, provenance
 **Hard rule — never overwrite**: an existing file gets a sibling (`hero-v2.png`, `photo-edited.png`) unless the user asked for replacement. Output goes beside the work that uses it or where the user named; nothing lives only in a temp folder.
-**Hard rule — the report names what was made**: final path, lane/model, options, and the final prompt (for an edit, the change and the locks).
-**Hard rule — generated media is declared where it lands**: the deliverable that places it records it as generated with lane/model and prompt (speaker notes, figure caption, alt text, or the message). A generated picture is never presented as a photograph of a real event, place, or person.
+**Hard rule — the report names what was made**: final path, the lane/model that produced it (said to the user in plain words), options, and the final prompt (edit: the change and locks).
+**Hard rule — generated media is declared where it lands**: the deliverable that places it records it as generated with lane/model and prompt (notes, caption, alt text, or message). A generated picture is never presented as a photograph of a real event, place, or person.
 ## 8. Failure and cost
-- A `generate` error carries `lanes` (what is signed in for images) or `available` (models); choose from it and call again, or continue without.
-- Generation costs the user credits or quota on that provider: one call per job, no speculative variants, no regeneration "to see another option" unless asked.
-- When a retry is needed, first try re-editing only the residual region with the same locks rather than enlarging the prompt.
+- A `generate` error carries `lanes` (what is signed in for images) or `available` (models); choose from it and call again, or continue without. `MEDIA_USAGE_LIMIT`: limit reached — tell the user the reset time. `MEDIA_PARTIAL_ONLY`: no final image, nothing saved.
+- Generation costs the user credits or quota: one call per job, no speculative variants or "another option" regenerations unless asked.
+- On a retry, re-edit only the residual region with the same locks rather than enlarging the prompt.

package/src/lib/keychain-cjs.cjs

@@ -353,7 +353,9 @@ function secretToolCheck(r) {
   }
   if (r.error) {
     keychainDebug('secret-tool failed to start', r.error.message);
-    throw new Error('[keychain] secret-tool could not be started — check that libsecret-tools is installed and a Secret Service is running');
+    throw new Error(
+      '[keychain] secret-tool could not be started — check that libsecret-tools is installed and a Secret Service is running'
+    );
   }
   return r;
 }
@@ -495,7 +497,10 @@ function onKeychainRecovered(listener) {
 // secret-tool cannot fix itself and is not retried.
 function _scheduleLinuxBackgroundRetry() {
   if (_linuxBgTimer || _keychainStatus.state === 'missing' || _gdbusMissing) return;
-  const delay = Math.min(LINUX_PREWARM_RETRY_MS * 2, LINUX_PREWARM_RETRY_MS + _linuxBgAttempt * (LINUX_PREWARM_RETRY_MS / 2));
+  const delay = Math.min(
+    LINUX_PREWARM_RETRY_MS * 2,
+    LINUX_PREWARM_RETRY_MS + _linuxBgAttempt * (LINUX_PREWARM_RETRY_MS / 2)
+  );
   _linuxBgAttempt++;
   _linuxBgTimer = setTimeout(async () => {
     _linuxBgTimer = null;
@@ -592,14 +597,10 @@ const LINUX_UNREACHABLE_MESSAGE =
   '[keychain] the keyring is not reachable — make sure it is running, then use Unlock keyring / Retry';
 function _noteKeychainFailure(error) {
   const message = String(error?.message || error);
-  const state =
-    error?.code === 'KEYRING_UNREACHABLE'
-      ? 'unreachable'
-      : /not installed/.test(message)
-        ? 'missing'
-        : /locked|timed out/.test(message)
-          ? 'locked'
-          : 'error';
+  let state = 'error';
+  if (error?.code === 'KEYRING_UNREACHABLE') state = 'unreachable';
+  else if (/not installed/.test(message)) state = 'missing';
+  else if (/locked|timed out/.test(message)) state = 'locked';
   _keychainStatus = { state, message };
 }
 
@@ -718,7 +719,8 @@ async function _prewarmLinuxOnce() {
     for (const account of accounts) {
       const value = await linuxGetAsync(account, remaining());
       if (value !== null) values.push([account, value]);
-    }    if (_cacheEpoch !== epoch) return;
+    }
+    if (_cacheEpoch !== epoch) return;
     // Replace, not merge: values the keyring now holds overwrite the cache and
     // cached accounts the keyring no longer has are dropped, so external CLI /
     // other-process add, replace and delete are picked up. A same-process

package/src/output-styles/common.md

@@ -15,6 +15,7 @@ partial: true
 - Distinguish facts, inference, and uncertainty; keep exact literals and
   material risks. Caveats only when they change the reader's next step.
 - Never pad: no tangents, unsolicited offers, raw dumps, or process recaps.
-  Explicit depth requests win; depth applies to substantive answers only.
+  Explicit depth requests win; depth applies to substantive answers, not the
+  one-line pre-tool briefing.
 - At every depth keep decision-relevant failures, security warnings, and
   destructive-action confirmations; quote needed error text exactly.

package/src/rules/agent/AGENT.md

@@ -6,8 +6,10 @@
   unapproved destructive action, or a blocker.
 - Communicate in English. Call tools immediately, with no preamble or
   progress text.
-- Reporting: report once, when done, per your role's output contract;
-  otherwise done, partial, or blocked with the outcome, then only applicable
-  items: changed files with key symbols, checks run (passes in one line,
-  failures with decisive error text), material risks or blockers. No raw
-  logs, narration, or restated brief. Lead owns the independent review.
+- Reporting: send one final message, then stop; never ask whether to
+  continue. Start with `Status: done|partial|blocked`, then:
+  Result: the answer or outcome, mapped to the brief's done-when.
+  Evidence: path+symbol and checks run (failures: decisive error only).
+  Open: risks, gaps, or the blocker. Omit empty fields; no logs, narration,
+  or restated brief. Role contracts only add fields.
+  Lead owns the independent review.

package/src/rules/lead/LEAD.md

@@ -4,10 +4,12 @@
 - The user's latest explicit request overrides any internal rule; drive it to
   completion.
 - The user sees your text, and tool calls only as activity cards, never your
-  thinking. Before the first tool call, state in one line what you are about
-  to do; afterwards bring the user only material findings, direction or scope
-  changes, unapproved destructive actions, blockers or meaningful delays —
-  never per-call narration or plan repeats.
+  thinking. Before your first tool call, briefly state what you are about to
+  do. While working, give short updates at key moments: when you find
+  something, change direction, or make progress without an update for a
+  while. Otherwise bring the user only material findings, direction or scope
+  changes, unapproved destructive actions, blockers or meaningful delays — never per-call
+  narration or plan repeats.
 - Mid-task: a replacement supersedes, an addition folds in, a status question
   gets a brief answer while work continues.
 - Context is managed automatically: never stop or propose stopping because of
@@ -15,15 +17,13 @@
 - Be a grounded, candid, and attentive collaborator: natural and respectful,
   without flattery, forced humor, mimicry, or stereotyping.
 <!-- tools: agent -->
-- Briefing an agent: it sees only the brief, never this conversation. The
-  brief is written in English whatever language the user writes in, and
-  holds only the task in the user's terms and its use; owned scope and
-  exclusions; changes located by path plus symbol or quoted line, not line
-  numbers; completion criteria; any return need beyond the role. No
-  background, rediscoverable detail, or known rules; large evidence by path.
-  A fresh or respawned agent gets the whole brief; a
-  continuing agent gets only what changed. Never assign the same work twice;
-  interrupt only to cancel.
+- Briefing an agent: it starts blank and sees only the brief. Write it in
+  English, self-contained: goal and its use; owned scope and non-goals;
+  targets by path plus symbol or quoted line; done-when as an observable,
+  checkable end state; any return need beyond the role. Pass only what
+  cannot be rediscovered; large evidence by path. A fresh agent gets the
+  whole brief, a continuing one only what changed. Never assign the same
+  work twice.
 <!-- tools: agent -->
 - Receiving an agent's report: it arrives as a `<task-notification>` block, a
   runtime message rather than the user speaking. Do not wait for it in-turn —

package/src/rules/shared/45-destructive.md

@@ -3,6 +3,10 @@
 - Commit, push, release, deployment and any irreversible action only on the
   user's explicit request. Validate exact targets first: never roots, `~` or
   unresolved variables/globs.
+- Never stash, reset, checkout, restore or clean the working tree, or delete
+  files you did not create: it may hold other agents' or the user's
+  uncommitted work. Use a separate worktree or copy for before/after
+  comparisons.
 - Back up only when changes risk irreversible loss, not for routine code edits;
   keep backups unless the user requests removal. Report what is recoverable.
 - Temp workspaces come from a unique-directory allocator, never by clearing

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch/preset.mjs

@@ -30,6 +30,7 @@ function maintenanceRouteToPreset(routeOrName, agent) {
     type: 'agent',
     provider,
     model,
+    ...(routeOrName.fallbacks?.length ? { fallbacks: routeOrName.fallbacks } : {}),
     tools: 'full',
   };
   const effort = String(routeOrName.effort || '').trim();

package/src/runtime/agent/orchestrator/agent-runtime/agent-progress-watchdog.mjs

@@ -11,6 +11,7 @@ import { appendAgentTrace } from '../agent-trace-io.mjs';
 import { getHiddenAgent } from '../internal-agents.mjs';
 import { envNonNegativeInt, envPresent } from '../../../shared/env.mjs';
 import {
+  PROVIDER_FIRST_BYTE_TIMEOUT_MS,
   PROVIDER_SEMANTIC_IDLE_TIMEOUT_MS,
   PROVIDER_WS_SEMANTIC_IDLE_TIMEOUT_MS,
   STALL_TICK_MS,
@@ -45,7 +46,7 @@ export class AgentStallAbortError extends Error {
   }
 }
 
-function isAgentProgressWatchdogAbortError(err) {
+export function isAgentProgressWatchdogAbortError(err) {
   const msg = err?.message;
   return typeof msg === 'string' && WATCHDOG_ABORT_RE.test(msg);
 }
@@ -203,14 +204,34 @@ function resolveExplicitMs(value, fallback) {
   return fallback;
 }
 
+// One deadline floored one watchdog tick above the provider's own budget for
+// that phase (none when the provider names none); 0 stays disabled.
+function aboveProviderBudget(requestedMs, providerBudgetMs) {
+  if (!(requestedMs > 0) || !(providerBudgetMs > 0)) return requestedMs;
+  return Math.max(requestedMs, providerBudgetMs + STALL_TICK_MS);
+}
+
+// `providerFirstByteTimeoutMs` is how long the session's provider itself may
+// wait for response headers, and `providerFirstOutputTimeoutMs` for its first
+// output (headers plus first chunk), its own retries included
+// (providerFirstResponseBudget). Provider retries keep the request clock
+// running, so each first-response deadline sits one watchdog tick above that
+// budget: the provider's timeout and retry decide first, and a provider that
+// gives up is reported as the provider's failure.
 export function resolveAgentWatchdogPolicy(agent, overrides = {}) {
-  const firstTransportMs = resolveExplicitMs(
-    overrides.firstTransportTimeoutMs ?? overrides.firstResponseTimeoutMs,
-    DEFAULT_FIRST_RESPONSE_TIMEOUT_MS
+  const firstTransportMs = aboveProviderBudget(
+    resolveExplicitMs(
+      overrides.firstTransportTimeoutMs ?? overrides.firstResponseTimeoutMs,
+      DEFAULT_FIRST_RESPONSE_TIMEOUT_MS
+    ),
+    resolveExplicitMs(overrides.providerFirstByteTimeoutMs, PROVIDER_FIRST_BYTE_TIMEOUT_MS)
   );
-  const firstSemanticMs = resolveExplicitMs(
-    overrides.firstSemanticTimeoutMs ?? overrides.firstVisibleTimeoutMs,
-    DEFAULT_FIRST_VISIBLE_CEILING_MS
+  const firstSemanticMs = aboveProviderBudget(
+    resolveExplicitMs(
+      overrides.firstSemanticTimeoutMs ?? overrides.firstVisibleTimeoutMs,
+      DEFAULT_FIRST_VISIBLE_CEILING_MS
+    ),
+    resolveExplicitMs(overrides.providerFirstOutputTimeoutMs, 0)
   );
 
   let idleStaleMs;

package/src/runtime/agent/orchestrator/agent-runtime/cache-strategy.mjs

@@ -493,19 +493,10 @@ export function buildProviderCacheOpts(provider, _sessionId, agent, options = {}
   const ttls = resolveCacheStrategy(agent, options);
   const capability = cacheCapabilityForProvider(provider);
   if (capability === 'explicit-breakpoint') {
-    // 2026-03-06 Anthropic dropped default TTL 1h→5m. We send
-    // extended-cache-ttl-2025-04-11 header to retain 1h.
+    // 2026-03-06 Anthropic dropped default TTL 1h→5m. We request 1h via
+    // cache_control ttl:"1h"; no beta header is required.
     // Verified 2026-04-17 (ephemeral_1h_input_tokens=4722).
     return { cacheStrategy: ttls, ...oneShotPromptCacheOpts(agent) };
   }
-  // NOTE: createSession's direct-call site (manager.mjs) only invokes this
-  // for explicit-breakpoint (Anthropic-family) providers, so this branch
-  // stays reachable only from other callers (none in-tree today) — keeping
-  // it here preserves the documented public API/behavior of this function.
-  if (provider === 'openai') {
-    // Public OpenAI API: prompt_cache_retention extends prefix retention.
-    // openai-oauth rejects the header — falls through to default.
-    return { cacheRetention: '24h' };
-  }
   return {};
 }

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -35,52 +35,124 @@ function transportPid(transport) {
   return (typeof transport?.pid === 'number' ? transport.pid : null) ?? transport?._process?.pid ?? null;
 }
 
+/** Deadline of one process-table enumeration subprocess. A healthy CIM query
+ *  takes ~1-3 s but exceeds 8 s under heavy load, and a timed-out strict read
+ *  leaves the finished command's workspace held, so the deadline only cuts
+ *  off a query that is genuinely stuck. A query that has not answered by then
+ *  is killed and its snapshot rejected (strict) or empty (best-effort). A
+ *  termination watch schedules its next pass only after the previous read
+ *  settled, so enumerators never pile up whatever this value is. */
+export const ENUMERATION_DEADLINE_MS = 20_000;
+
 // Spawn a helper command and resolve its stdout (empty string on any error).
-function run(cmd, args) {
-  return new Promise((resolve) => {
+// `timeoutMs` > 0: past the deadline the helper is killed (Node reaps it on
+// exit) and the call settles at once instead of waiting for it.
+function run(cmd, args, { strict = false, timeoutMs = 0 } = {}) {
+  return new Promise((resolve, reject) => {
     let out = '';
     let cp;
+    let timer = null;
+    let settled = false;
+    const settle = (finish) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      finish();
+    };
     try {
       cp = spawn(cmd, args, { windowsHide: true });
-    } catch {
+    } catch (error) {
+      if (strict) {
+        reject(error);
+        return;
+      }
       resolve('');
       return;
     }
     cp.stdout?.on('data', (d) => {
       out += String(d);
     });
-    cp.on('error', () => resolve(out));
-    cp.on('close', () => resolve(out));
+    cp.on('error', (error) => settle(() => (strict ? reject(error) : resolve(out))));
+    cp.on('close', (code) =>
+      settle(() => (strict && code !== 0 ? reject(new Error(`Process enumeration failed (${code}).`)) : resolve(out)))
+    );
+    if (timeoutMs > 0) {
+      timer = setTimeout(() => {
+        try {
+          cp.kill('SIGKILL');
+        } catch {
+          /* already gone */
+        }
+        cp.stdout?.destroy?.();
+        cp.stderr?.destroy?.();
+        settle(() =>
+          strict ? reject(new Error(`Process enumeration timed out after ${timeoutMs} ms.`)) : resolve('')
+        );
+      }, timeoutMs);
+      timer.unref?.();
+    }
   });
 }
 
 // Snapshot the whole process table once: parent map + a per-pid identity
 // token (Windows CreationDate, POSIX lstart) so a later kill can prove a pid
 // number was not recycled onto a different process before signalling it.
-async function enumerate() {
+// POSIX rows also carry the process group id (Windows has none).
+async function enumerate({ strict = false } = {}) {
   const childrenOf = new Map();
   const tokenOf = new Map();
   const nameOf = new Map();
+  const pgidOf = new Map();
   const out = isWin
-    ? await run('powershell.exe', [
-        '-NoProfile',
-        '-NonInteractive',
-        '-Command',
-        `Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $($_.Name) $($_.CreationDate.ToString('o'))" }`,
-      ])
-    : await run('ps', ['-A', '-o', 'pid=,ppid=,comm=,lstart=']);
+    ? await run(
+        'powershell.exe',
+        [
+          '-NoProfile',
+          '-NonInteractive',
+          '-Command',
+          `${strict ? "$ErrorActionPreference = 'Stop'; " : ''}Get-CimInstance Win32_Process | ForEach-Object { $created = if ($_.CreationDate) { $_.CreationDate.ToString('o') } else { '' }; "$($_.ProcessId) $($_.ParentProcessId) $($_.Name) $created" }`,
+        ],
+        { strict, timeoutMs: ENUMERATION_DEADLINE_MS }
+      )
+    : await run('ps', ['-A', '-o', 'pid=,ppid=,pgid=,comm=,lstart='], {
+        strict,
+        timeoutMs: ENUMERATION_DEADLINE_MS,
+      });
+  const row = isWin ? /^(\d+)\s+(\d+)\s+()(\S+)(?:\s+(.+))?$/ : /^(\d+)\s+(\d+)\s+(\d+)\s+(\S+)(?:\s+(.+))?$/;
   for (const line of out.split(/\r?\n/)) {
-    const m = line.trim().match(/^(\d+)\s+(\d+)\s+(\S+)(?:\s+(.+))?$/);
+    const m = line.trim().match(row);
     if (!m) continue;
     const pid = Number(m[1]);
     const ppid = Number(m[2]);
-    const token = (m[4] || '').trim() || null;
+    const token = (m[5] || '').trim() || null;
     if (!childrenOf.has(ppid)) childrenOf.set(ppid, []);
     childrenOf.get(ppid).push(pid);
     tokenOf.set(pid, token);
-    nameOf.set(pid, m[3]);
+    nameOf.set(pid, m[4]);
+    if (m[3]) pgidOf.set(pid, Number(m[3]));
+  }
+  if (strict && !nameOf.has(process.pid)) throw new Error('The process snapshot could not be verified.');
+  return { childrenOf, tokenOf, nameOf, pgidOf };
+}
+
+/** One strict process-table snapshot: parent links, identity tokens, image
+ *  names and (POSIX) process groups. Rejects instead of returning a partial
+ *  table, so callers can tell "nothing found" from "could not look".
+ *
+ *  `shared: true` (pre-kill captures) joins a read already in flight, so many
+ *  jobs promoted together do not each spawn an enumerator; a capture taken
+ *  while its root runs is valid whenever that read began. An observation after
+ *  a kill never shares: a read that began before the kill would report the
+ *  killed tree alive and defer the confirmation by a whole re-check. */
+let tableInFlight = null;
+export function readProcessTable({ shared = false } = {}) {
+  if (!shared) return enumerate({ strict: true });
+  if (!tableInFlight) {
+    tableInFlight = enumerate({ strict: true }).finally(() => {
+      tableInFlight = null;
+    });
   }
-  return { childrenOf, tokenOf, nameOf };
+  return tableInFlight;
 }
 
 // Walk every descendant pid of rootPid (excludes rootPid).
@@ -106,12 +178,18 @@ async function collectDescendants(rootPid) {
   return descendantsOf(childrenOf, rootPid);
 }
 
-/** Descendant pids WITH their image names, from one batched process-table
- *  read. Shared with the shell runner's post-exit descendant observation so
- *  both use a single enumeration implementation. */
-export async function collectDescendantProcesses(rootPid) {
-  const { childrenOf, nameOf } = await enumerate().catch(() => ({ childrenOf: new Map(), nameOf: new Map() }));
-  return descendantsOf(childrenOf, rootPid).map((pid) => ({ pid, name: nameOf.get(pid) || '' }));
+/** Descendant pids WITH their image names and identity tokens (creation
+ *  time), from one batched process-table read. */
+export async function collectDescendantProcesses(rootPid, { strict = false } = {}) {
+  const snapshot = enumerate({ strict });
+  const { childrenOf, nameOf, tokenOf } = strict
+    ? await snapshot
+    : await snapshot.catch(() => ({ childrenOf: new Map(), nameOf: new Map(), tokenOf: new Map() }));
+  return descendantsOf(childrenOf, rootPid).map((pid) => ({
+    pid,
+    name: nameOf.get(pid) || '',
+    token: tokenOf.get(pid) ?? null,
+  }));
 }
 
 /** Force-kill whole process trees by pid. Windows batches one taskkill /T /F

package/src/runtime/agent/orchestrator/providers/account-pool.mjs

@@ -165,6 +165,8 @@ function boundAccountSend(providerName, row, messages, options) {
     };
   }
   if (options.sessionId) {
+    // An explicit empty executor (model-proxy host) must stay empty.
+    opts.toolExecutionSessionId = options.toolExecutionSessionId ?? options.sessionId;
     opts.sessionId = accountScopedSessionId(providerName, row.id, options.sessionId);
     // The spend still belongs to the visible session (usage-accounting.mjs).
     opts.usageSessionId = options.usageSessionId || options.sessionId;

package/src/runtime/agent/orchestrator/providers/anthropic-api-key-fetch.mjs

@@ -0,0 +1,36 @@
+// Custom `fetch` for the Anthropic SDK client (API-key path): gzips
+// /v1/messages bodies on the libuv threadpool, but ONLY when the effective
+// request origin is exactly https://api.anthropic.com. The decision is made on
+// the final request URL, so a custom baseURL, ANTHROPIC_BASE_URL, proxy or
+// gateway never gets a compressed body. Policy shared with the OAuth path.
+import { sendGzipCompressed } from './lib/request-compression.mjs';
+
+const OFFICIAL_ORIGIN = 'https://api.anthropic.com';
+
+function officialMessagesUrl(input) {
+  try {
+    const url = new URL(typeof input === 'string' || input instanceof URL ? input : input.url);
+    return url.origin === OFFICIAL_ORIGIN && url.pathname === '/v1/messages';
+  } catch {
+    return false;
+  }
+}
+
+function bodyBytes(body) {
+  if (typeof body === 'string') return Buffer.from(body);
+  if (ArrayBuffer.isView(body)) return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+  return null;
+}
+
+export function createAnthropicApiKeyFetch({ baseFetch = (...args) => globalThis.fetch(...args), compress } = {}) {
+  return async (input, init) => {
+    const raw = init?.method?.toUpperCase() === 'POST' && officialMessagesUrl(input) ? bodyBytes(init.body) : null;
+    if (!raw) return baseFetch(input, init);
+    return sendGzipCompressed({
+      raw,
+      headers: init.headers,
+      compress,
+      send: (body, headers) => baseFetch(input, { ...init, headers, body: body === raw ? init.body : body }),
+    });
+  };
+}

package/src/runtime/agent/orchestrator/providers/anthropic-error-contract.mjs

@@ -45,7 +45,7 @@ function lowered(value) {
 
 /** The lowercased error type named by an Anthropic error body (JSON text or parsed object). */
 export function anthropicErrorTypeFromBody(body) {
-  if (body && typeof body === 'object') return lowered((body.error && body.error.type) || body.type);
+  if (body && typeof body === 'object') return lowered(body.error?.type || body.type);
   const match = BODY_TYPE_RE.exec(String(body || ''));
   return match ? lowered(match[1]) : '';
 }

package/src/runtime/agent/orchestrator/providers/anthropic-messages.mjs

@@ -28,9 +28,8 @@ export function loadAnthropic() {
 
 // 4-BP cache policy aligned with anthropic-oauth — system + tier3 +
 // messages-tail. Tool schemas sit before system and are covered by the system
-// breakpoint, so they do not spend a separate cache_control slot. 1h TTL
-// requires the extended-cache-ttl beta header, which we set on the client via
-// defaultHeaders below.
+// breakpoint, so they do not spend a separate cache_control slot. The 1h TTL
+// is requested with cache_control ttl:"1h"; no beta header is needed.
 
 // BP3 (tier3) rides its own `system` role block (the 3rd system block, tagged
 // cacheTier:'tier3'). buildSystemBlocks applies the tier3 1h cache_control to

package/src/runtime/agent/orchestrator/providers/anthropic-oauth-client-version.mjs

@@ -10,7 +10,7 @@ import { createNpmVersionSource, maxSemver } from './npm-cli-version.mjs';
 // source release just to advance the user-agent version.
 // Claude Opus 5.5 requires 2.1.280 or newer. The release workflow raises this
 // to the published CLI version (scripts/sync-client-version-floors.mjs).
-export const DEFAULT_CLI_VERSION = '2.1.301';
+export const DEFAULT_CLI_VERSION = '2.1.302';
 export const CLAUDE_CLI_NPM_PACKAGE = '@anthropic-ai/claude-code';
 
 const CACHE_SCHEMA_VERSION = 1;