mixdog 1.2.6 → 1.3.1

package/src/runtime/shared/model-route-fallback.mjs

@@ -1,10 +1,84 @@
-import { providerErrorKind } from '../agent/orchestrator/providers/provider-error-kind.mjs';
+import {
+  boundedCauseChain,
+  providerErrorKind,
+  typedCodeKind,
+} from '../agent/orchestrator/providers/provider-error-kind.mjs';
 import { readStreamOutcome } from '../agent/orchestrator/providers/lib/stream-outcome.mjs';
+import { namesUnavailableModel } from './error-presentation.mjs';
 
-const ELIGIBLE = new Set(['rate_limited', 'quota_exhausted', 'overloaded', 'transient']);
+// When a route's model fails, does the next model in its fallback chain get
+// the request? Only for a refusal scoped to THIS provider, account or model —
+// another provider may serve the identical request:
+//   quota_exhausted / entitlement / billing — the plan or account is spent;
+//   rate_limited / overloaded / service_tier_unavailable — this provider is
+//     saturated once its own retries are spent;
+//   auth / permission — the provider's own sign-in refresh already failed, or
+//     the account, region or tier is refused;
+//   transient — only when the server answered (a typed status or code): its
+//     retry ladder is spent. A bare network failure would fail on every
+//     provider, so it stays with the transport recovery;
+//   invalid_request on 404/410, a typed model code, or provider wording with
+//     the model as the refused subject (namesUnavailableModel) — the model is
+//     unknown, retired or not offered to this account.
+// A request that fails the same way on any model never hops: request too
+// large, a refused tool schema or other invalid request, a policy refusal,
+// a cancel, a stall and any untyped failure. A context overflow hops only to
+// a model with a larger window (`contextGrows`); compaction runs first.
+// Whatever the kind, nothing may have been produced: no visible or buffered
+// output, no tool call started or dispatched.
+const PROVIDER_SCOPED_KINDS = new Set([
+  'quota_exhausted',
+  'entitlement',
+  'billing',
+  'rate_limited',
+  'overloaded',
+  'service_tier_unavailable',
+  'auth',
+  'permission',
+]);
+const MODEL_UNAVAILABLE_CODES = new Set(['model_not_found', 'model_not_supported']);
 
-export function canFallbackRoute(error, { signal, outcome = readStreamOutcome(error), committed = false } = {}) {
-  if (signal?.aborted || committed || outcome.userAbort || outcome.stallObserved) return false;
+/** 'hop', 'context' (a context overflow: hop only to a larger window) or 'stay'. */
+// A recovery layer may wrap the provider failure (a context overflow it could
+// not compact away): what the original request exposed lives on the cause.
+// Every node of the chain counts, so a wrapper never launders exposure.
+function chainOutcome(error) {
+  return readStreamOutcome(...(error && typeof error === 'object' ? boundedCauseChain(error) : [error]));
+}
+
+export function routeFallbackVerdict(error, { signal, outcome = chainOutcome(error), committed = false } = {}) {
+  if (signal?.aborted || committed || outcome.userAbort || outcome.stallObserved) return 'stay';
+  if (!outcome.replaySafe || outcome.observedOutput || outcome.toolCallsStarted || outcome.pendingToolInput) {
+    return 'stay';
+  }
+  const { kind, status, code } = providerErrorKind(error);
+  if (PROVIDER_SCOPED_KINDS.has(kind)) return 'hop';
+  if (kind === 'transient') return status >= 408 || typedCodeKind(error) === 'transient' ? 'hop' : 'stay';
+  if (kind === 'invalid_request') {
+    return status === 404 || status === 410 || MODEL_UNAVAILABLE_CODES.has(code) || namesUnavailableModel(error)
+      ? 'hop'
+      : 'stay';
+  }
+  return kind === 'context_overflow' ? 'context' : 'stay';
+}
+
+export function canFallbackRoute(error, { contextGrows = false, ...options } = {}) {
+  const verdict = routeFallbackVerdict(error, options);
+  return verdict === 'hop' || (verdict === 'context' && contextGrows === true);
+}
+
+const CAPACITY_KINDS = new Set(['rate_limited', 'quota_exhausted', 'overloaded', 'transient']);
+
+/**
+ * The narrower rule a stateless tool route (native web search) keeps: only a
+ * capacity refusal the server stated (429 / 503, or an account-pool quota
+ * refusal) moves to the next provider; a denied or failed credential
+ * surfaces so the user fixes that route.
+ */
+// It also keeps its stricter stream guards: any started or terminal stream
+// stays on its route, since a tool call cannot prove nothing was generated.
+export function canFallbackCapacityRoute(error, { signal, outcome = readStreamOutcome(error) } = {}) {
+  if (signal?.aborted || outcome.userAbort || outcome.stallObserved) return false;
   if (
     !outcome.replaySafe ||
     outcome.observedOutput ||
@@ -15,8 +89,6 @@ export function canFallbackRoute(error, { signal, outcome = readStreamOutcome(er
   )
     return false;
   const { kind, status } = providerErrorKind(error);
-  if (!ELIGIBLE.has(kind)) return false;
-  // A rejected HTTP request or a provider account-pool refusal proves no
-  // generation started. A transport disconnect alone does not.
+  if (!CAPACITY_KINDS.has(kind)) return false;
   return status === 429 || status === 503 || (kind === 'quota_exhausted' && error?.quotaExhausted != null);
 }

package/src/runtime/shared/plain-preview.d.mts

@@ -0,0 +1 @@
+export function plainPreviewText(text: unknown): string;

package/src/runtime/shared/plain-preview.mjs

@@ -0,0 +1,33 @@
+// A messenger preview line reads as plain text, as KakaoTalk shows it: the
+// markdown a reply was written in (bold, headings, list markers, quotes,
+// code fences and spans, links, images) is dropped, its words kept.
+
+/** `text` without markdown syntax, whitespace folded to single spaces. */
+export function plainPreviewText(text) {
+  // HTML comments never show in markdown (a greeting's suggestions ride one).
+  return (
+    String(text ?? '')
+      .replace(/<!--[\s\S]*?(?:-->|$)/g, ' ')
+      .replace(/^[ \t]*(`{3,}|~{3,})[^\n]*$/gm, ' ')
+      .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
+      .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+      .replace(/^[ \t]{0,3}#{1,6}[ \t]+/gm, '')
+      .replace(/^[ \t]*>[ \t]?/gm, '')
+      .replace(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/gm, '')
+      .replace(/^[ \t]*(?:[-*_][ \t]*){3,}$/gm, ' ')
+      .replace(/(\*\*|__)(?=\S)([\s\S]*?\S)\1/g, '$2')
+      .replace(/(^|[^\w*])\*(?=\S)([^*\n]*?\S)\*(?!\w)/g, '$1$2')
+      .replace(/(^|[^\w_])_(?=\S)([^_\n]*?\S)_(?!\w)/g, '$1$2')
+      .replace(/~~(?=\S)([\s\S]*?\S)~~/g, '$1')
+      .replace(/`+([^`\n]*)`+/g, '$1')
+      .replace(/\s+/g, ' ')
+      // A summary stored before newlines were kept already folded its list: a
+      // dash or bullet right after a sentence end is a marker, not a hyphen.
+      .replace(/([.!?。…:：])\s[-*+•]\s+(?=\S)/g, '$1 ')
+      .trim()
+      .slice(0, PREVIEW_CAP)
+  );
+}
+
+/** A safety cap only: the row clamps the shown text to two lines. */
+const PREVIEW_CAP = 200;

package/src/runtime/shared/routine-limits.d.mts

@@ -0,0 +1,11 @@
+export declare const ROUTINE_LIMITS: Readonly<{
+  backoffBaseMs: number;
+  pauseAfterFailures: number;
+  homeQueueLimit: number;
+}>;
+
+export declare function routineBackoffRemaining(
+  state: { consecutiveFailures?: unknown; lastFailedAt?: unknown } | null | undefined,
+  now?: number,
+  limits?: typeof ROUTINE_LIMITS
+): number;

package/src/runtime/shared/routine-limits.mjs

@@ -0,0 +1,21 @@
+// Safeguards of owned routines (schedules and webhook endpoints, see
+// session-runtime/owned-automation-run.mjs): after a failure the next
+// unattended fire waits `backoffBaseMs * 2^(n-1)` (n consecutive failures)
+// and the routine switches itself off at `pauseAfterFailures`; a home thread
+// holds at most `homeQueueLimit` routine turns waiting (and as many queued
+// rows posted from outside its turns). Runs themselves are
+// unlimited: no concurrency cap and no deadline.
+export const ROUTINE_LIMITS = Object.freeze({
+  backoffBaseMs: 60_000,
+  pauseAfterFailures: 5,
+  homeQueueLimit: 200,
+});
+
+/** How long (ms) an unattended fire still waits after the routine's
+ *  `consecutiveFailures`, the latest at `lastFailedAt`; 0 when it may run. */
+export function routineBackoffRemaining(state, now = Date.now(), limits = ROUTINE_LIMITS) {
+  const failures = Number(state?.consecutiveFailures) || 0;
+  const at = state?.lastFailedAt ? new Date(state.lastFailedAt).getTime() : Number.NaN;
+  if (failures < 1 || !Number.isFinite(at)) return 0;
+  return Math.max(0, at + limits.backoffBaseMs * 2 ** (failures - 1) - now);
+}

package/src/runtime/shared/routine-trigger.d.mts

@@ -0,0 +1,10 @@
+export interface RoutineTrigger {
+  kind: 'schedule' | 'webhook';
+  name: string;
+  event?: string;
+}
+
+export declare function routineTriggerHeader(input: { kind: string; name: string; project?: string }): string;
+export declare function stripRoutineTriggerHeader(text: unknown): string;
+export declare function normalizeRoutineTrigger(value: unknown): RoutineTrigger | null;
+export declare function routineTriggerField(value: unknown): { routineTrigger?: RoutineTrigger };

package/src/runtime/shared/routine-trigger.mjs

@@ -0,0 +1,44 @@
+// A routine fire delivered into its bot's home thread as a turn
+// (session-runtime/routine-home-turn.mjs): the model-visible header line that
+// opens the turn's prompt, and the `routineTrigger` marker its user row
+// carries (live, persisted in meta.transcript, restored) so a chat paints it
+// as a routine marker instead of a user bubble.
+
+const HEADER_PREFIX = '[Routine trigger]';
+const KINDS = new Set(['schedule', 'webhook']);
+
+/** The first line of a routine turn's prompt: which routine fired and how to
+ *  treat the turn. Only the turn's content carries it, never the system
+ *  prompt, so the thread's prompt cache is untouched. */
+export function routineTriggerHeader({ kind, name, project = '' }) {
+  const what = kind === 'webhook' ? 'webhook' : 'schedule';
+  return [
+    `${HEADER_PREFIX} Your ${what} "${String(name)}" fired.`,
+    'Carry out its instructions below now, yourself or by delegating; nobody is watching this turn, so approvals wait for the user.',
+    'Reply in this chat with the result.',
+    ...(project ? [`Project folder: ${project}`] : []),
+  ].join(' ');
+}
+
+/** `text` without the header line a routine turn opens with. */
+export function stripRoutineTriggerHeader(text) {
+  const value = String(text ?? '');
+  if (!value.startsWith(HEADER_PREFIX)) return value;
+  const end = value.indexOf('\n');
+  return end < 0 ? '' : value.slice(end + 1).replace(/^\n+/, '');
+}
+
+/** A well-formed `{ kind, name, event? }` marker, or null. */
+export function normalizeRoutineTrigger(value) {
+  if (!value || typeof value !== 'object') return null;
+  const name = typeof value.name === 'string' ? value.name.trim().slice(0, 200) : '';
+  if (!name || !KINDS.has(value.kind)) return null;
+  const event = typeof value.event === 'string' ? value.event.trim().slice(0, 200) : '';
+  return { kind: value.kind, name, ...(event ? { event } : {}) };
+}
+
+/** The `routineTrigger` field of a transcript row (absent when none). */
+export function routineTriggerField(value) {
+  const trigger = normalizeRoutineTrigger(value?.routineTrigger);
+  return trigger ? { routineTrigger: trigger } : {};
+}

package/src/runtime/shared/schedule-model-ref.mjs

@@ -1,13 +1,12 @@
-// schedule.model wire format shared by the channels-worker scheduler and the
-// engine-side run-now dispatch: either a config.presets id/name (legacy) or a
-// direct "provider/model[@effort][+fast][+noauto][?parameter=value]" route string
-// written by the desktop schedule editor (`+noauto`: Auto effort off for the
-// route; absent means on). Slash-form values become direct route
-// objects, which agent-dispatch consumes without a presets lookup.
-// The optional route fields an automation run carries, from a preset, a
-// maintenance slot or a parsed route ref. One shape so schedule and webhook
-// runs cannot drift when a field is added. modelParameters is copied so a
-// stored preset can never be mutated through the run.
+// Model route-ref wire format (task sessions, provider model caches): either a
+// config.presets id/name (legacy) or a direct
+// "provider/model[@effort][+fast][+noauto][?parameter=value]" route string
+// (`+noauto`: Auto effort off for the route; absent means on). Slash-form
+// values become direct route objects, which agent-dispatch consumes without a
+// presets lookup.
+// The optional route fields a run carries, from a preset, a maintenance slot
+// or a parsed route ref. modelParameters is copied so a stored preset can
+// never be mutated through the run.
 export function modelRouteFields(slot = {}) {
   return {
     provider: slot.provider,

package/src/runtime/shared/sensitive-path-rules.d.mts

@@ -0,0 +1,15 @@
+export interface SensitiveScope {
+  root: string[];
+  /** Subfolders of the root that stay reachable. */
+  except: readonly string[];
+  /** Whole tree (a registered private root) or Mixdog's secret subset. */
+  whole: boolean;
+}
+export function sensitivePathSegments(path: string): string[];
+export function matchesSensitivePath(
+  path: string,
+  within?: readonly SensitiveScope[],
+  options?: { envTemplates?: boolean }
+): boolean;
+export function mixdogSensitiveScopes(extraData?: readonly string[]): SensitiveScope[];
+export function isSensitiveLocalPath(path: string, options?: { extraData?: readonly string[] }): boolean;

package/src/runtime/shared/sensitive-path-rules.mjs

@@ -0,0 +1,256 @@
+// The credential / secret file deny list, shared by every lane that hands a
+// local file to someone else: the desktop's remote (paired-device) file lanes
+// (apps/desktop/src/main/remote-sensitive-paths.ts adds its registered private
+// roots and async canonicalization) and the runtime's attachment hand-offs
+// between bots and agents (session-runtime/handoff-attachments.mjs).
+//
+// Matching is on SEGMENTS of a path, lower-cased on every platform, so a
+// denied name cannot hide behind letter case, trailing dots/spaces or an NTFS
+// stream suffix. Callers pass the canonical (realpath) form as well as the
+// lexical one, so a link cannot reach a denied place under an innocent name.
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+
+/** A directory with this name anywhere on the path holds credentials. `.git`
+ *  is one of them: its config carries remotes with embedded tokens and
+ *  credential helpers, and its objects hold every secret ever committed. */
+const SECRET_DIRECTORIES = new Set([
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.kube',
+  '.mozilla',
+  '.password-store',
+  '.git',
+]);
+
+/** Consecutive segments anywhere on the path that name a credential store:
+ *  CLI configs, browser profiles and OS credential stores. */
+const SECRET_SEQUENCES = [
+  // Tool credentials in the user's home.
+  ['.docker', 'config.json'],
+  ['.config', 'gcloud'],
+  ['appdata', 'roaming', 'gcloud'],
+  ['.config', 'gh'],
+  ['appdata', 'roaming', 'github cli'],
+  ['.config', 'git', 'credentials'],
+  ['.cargo', 'credentials'],
+  ['.cargo', 'credentials.toml'],
+  ['.terraform.d', 'credentials.tfrc.json'],
+  ['.claude', '.credentials.json'],
+  ['.codex', 'auth.json'],
+  ['.gemini', 'oauth_creds.json'],
+  // Browser profiles: cookies, saved logins, session tokens.
+  ['google', 'chrome', 'user data'],
+  ['microsoft', 'edge', 'user data'],
+  ['bravesoftware', 'brave-browser'],
+  ['chromium', 'user data'],
+  ['vivaldi', 'user data'],
+  ['opera software'],
+  ['mozilla', 'firefox'],
+  ['application support', 'google', 'chrome'],
+  ['application support', 'microsoft edge'],
+  ['application support', 'firefox'],
+  ['application support', 'chromium'],
+  ['application support', 'bravesoftware'],
+  ['application support', 'vivaldi'],
+  ['library', 'safari'],
+  ['library', 'cookies'],
+  ['.config', 'google-chrome'],
+  ['.config', 'chromium'],
+  ['.config', 'microsoft-edge'],
+  ['.config', 'bravesoftware'],
+  ['.config', 'vivaldi'],
+  ['snap', 'firefox'],
+  ['snap', 'chromium'],
+  ['.var', 'app', 'org.mozilla.firefox'],
+  ['.var', 'app', 'com.google.chrome'],
+  // OS credential stores.
+  ['microsoft', 'credentials'],
+  ['microsoft', 'protect'],
+  ['microsoft', 'vault'],
+  ['windows', 'system32', 'config'],
+  ['library', 'keychains'],
+  ['.local', 'share', 'keyrings'],
+  ['.local', 'share', 'kwalletd'],
+  ['etc', 'shadow'],
+  ['etc', 'gshadow'],
+  ['etc', 'ssh'],
+  ['etc', 'ssl', 'private'],
+];
+
+const KEY_EXTENSIONS = new Set([
+  '.pem',
+  '.key',
+  '.p12',
+  '.pfx',
+  '.p8',
+  '.ppk',
+  '.jks',
+  '.keystore',
+  '.kdbx',
+  '.keychain',
+  '.keychain-db',
+]);
+const CREDENTIAL_FILES = new Set([
+  '.netrc',
+  '_netrc',
+  '.npmrc',
+  '.pypirc',
+  '.git-credentials',
+  '.pgpass',
+  '.vault-token',
+  '.htpasswd',
+  '.dockercfg',
+  '.envrc',
+  '.s3cfg',
+  'kubeconfig',
+]);
+/** Environment files: every `.env*` name (`.env`, `.env.local`, `.envrc`,
+ *  `.environment`, and the `.env.example` templates too — a template is
+ *  checked in often enough with real values that no name is exempt) and
+ *  `<stage>.env`. */
+const ENV_FILE = /^(?:\.env.*|[^.]{1,64}(?:\.[^.]{1,64}){0,3}\.env)$/;
+/** The dotenv templates a person may still open on purpose from a paired
+ *  device (the desktop's remote file lanes, `envTemplates: true`); automatic
+ *  transfers between bots and agents never get this allowance. */
+const ENV_TEMPLATES = new Set(['.env.example', '.env.sample', '.env.template', '.env.dist']);
+/** Credential JSON a cloud or OAuth client writes or downloads:
+ *  `credentials.json`, `*credentials*.json`, `service-account*.json`,
+ *  `client_secret*.json`. */
+const CREDENTIAL_JSON = /^(?:.*credential.*|service[-_ ]?account.*|client[-_]?secret.*)\.json$/;
+/** OpenSSH private keys (`id_ed25519`, `id_rsa_work`, `id_ecdsa_sk`, any
+ *  `id_<type>`): no extension, so the public `.pub` half and documents named
+ *  after a key type (`id_rsa_notes.md`) are not keys. */
+const SSH_PRIVATE_KEY = /^id_[a-z0-9]{2,16}(?:[_-][^._-]{1,32}){0,3}$/;
+/** A copy an editor or tool leaves beside a file (`x.bak`, `x.old`, `x~`,
+ *  `x.1`): it holds what the original holds. */
+const BACKUP_SUFFIX = /(?:\.(?:bak|backup|old|orig|prev|save|sav|swp|swo|tmp|copy|\d{1,3})|~)$/;
+const MAX_BACKUP_SUFFIXES = 3;
+
+/** The name a backup copy was made of (`.npmrc.bak.1` → `.npmrc`). */
+function backupOriginal(name) {
+  let original = name;
+  for (let strip = 0; strip < MAX_BACKUP_SUFFIXES; strip += 1) {
+    const next = original.replace(BACKUP_SUFFIX, '');
+    if (next === original || !next) break;
+    original = next;
+  }
+  return original;
+}
+
+/** A file whose own name says it holds a secret, wherever it lives: a
+ *  credential file, a dotenv file, a key or keystore, or a backup of one. */
+function secretFileName(name, { envTemplates = false } = {}) {
+  const original = backupOriginal(name);
+  if (CREDENTIAL_FILES.has(original) || CREDENTIAL_JSON.test(original)) return true;
+  if (ENV_FILE.test(original)) return !(envTemplates && ENV_TEMPLATES.has(original));
+  const dot = original.lastIndexOf('.');
+  if (dot >= 0 && KEY_EXTENSIONS.has(original.slice(dot))) return true;
+  return SSH_PRIVATE_KEY.test(original);
+}
+
+// Mixdog's own state. Its home and data folders also hold what tools write
+// (tool results, shell output, media), which stay reachable; only the files
+// and folders that carry provider tokens, API keys, pairing and bridge secrets
+// are denied.
+const MIXDOG_SECRET_DIRECTORIES = new Set([
+  'secrets',
+  'mcp-oauth',
+  'provider-accounts',
+  'telegram',
+  'relay-data',
+  'dev-profile',
+]);
+const MIXDOG_SECRET_FILE =
+  /^\.?(mixdog-config|provider-accounts|relay-hook-device|auth\.json|[a-z0-9-]+-oauth(-credentials)?\.json|[a-z0-9-]+-bridge\.json)/;
+const MIXDOG_SECRET_EXTENSIONS = new Set(['.dpapi', '.token']);
+
+function mixdogSecret(rest) {
+  if (rest.some((segment) => MIXDOG_SECRET_DIRECTORIES.has(segment))) return true;
+  const name = rest[rest.length - 1] ?? '';
+  const dot = name.lastIndexOf('.');
+  return MIXDOG_SECRET_FILE.test(name) || MIXDOG_SECRET_EXTENSIONS.has(dot >= 0 ? name.slice(dot) : '');
+}
+
+/** The segments of a path as the rules compare them: no extended-path prefix,
+ *  no NTFS stream suffix, no trailing dots or spaces, lower case. */
+export function sensitivePathSegments(path) {
+  return String(path)
+    .replace(/^[\\/]{2}[?.][\\/]/, '')
+    .split(/[\\/]+/)
+    .map((segment) =>
+      segment
+        .split(':')[0]
+        .replace(/[. ]+$/, '')
+        .toLowerCase()
+    )
+    .filter(Boolean);
+}
+
+function hasRun(segments, run) {
+  for (let start = 0; start + run.length <= segments.length; start += 1) {
+    if (run.every((segment, offset) => segments[start + offset] === segment)) return true;
+  }
+  return false;
+}
+
+/**
+ * Whether `path` is denied under `within`: scopes `{ root: segments, except:
+ * subfolder names, whole }` — Mixdog's home and data folders (`whole: false`,
+ * only their secret subset is denied) and registered private roots (`whole:
+ * true`, everything but `except`). Pass both the lexical and canonical form.
+ * `envTemplates`: a user-initiated remote open may read the dotenv
+ * templates; nothing else gets that allowance.
+ */
+export function matchesSensitivePath(path, within = [], { envTemplates = false } = {}) {
+  const segments = sensitivePathSegments(resolve(path));
+  const name = segments[segments.length - 1] ?? '';
+  if (segments.some((segment) => SECRET_DIRECTORIES.has(segment))) return true;
+  if (secretFileName(name, { envTemplates }) || SECRET_SEQUENCES.some((run) => hasRun(segments, run))) return true;
+  const containing = within.filter(
+    ({ root }) => root.length > 0 && root.every((segment, index) => segments[index] === segment)
+  );
+  // Mixdog's home and data folders follow Mixdog's own rule even inside a
+  // registered private root: a dev or isolated profile keeps them in the app
+  // profile, and the tool output and media there stay reachable.
+  const own = containing.filter(({ whole }) => !whole);
+  if (own.length) return own.some(({ root }) => mixdogSecret(segments.slice(root.length)));
+  return containing.some(({ root, except }) => {
+    const rest = segments.slice(root.length);
+    return rest.length > 0 && !except.includes(rest[0]);
+  });
+}
+
+function realOrSelf(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    const parent = dirname(path);
+    return parent === path ? path : join(realOrSelf(parent), path.slice(parent.length).replace(/^[\\/]+/, ''));
+  }
+}
+
+/** Mixdog's home and data folders (MIXDOG_HOME / MIXDOG_DATA_DIR, plus any
+ *  extra data folder the caller names) as `matchesSensitivePath` scopes. */
+export function mixdogSensitiveScopes(extraData = []) {
+  const home = process.env.MIXDOG_HOME || join(homedir(), '.mixdog');
+  const roots = [home, process.env.MIXDOG_DATA_DIR || join(home, 'data'), ...extraData].filter(Boolean);
+  const scopes = [];
+  for (const root of roots) {
+    for (const form of new Set([resolve(root), realOrSelf(resolve(root))])) {
+      scopes.push({ root: sensitivePathSegments(form), except: [], whole: false });
+    }
+  }
+  return scopes;
+}
+
+/** Whether `path` — its own name or what its links lead to — is a
+ *  credential/secret file under the shared deny list and Mixdog's own scopes. */
+export function isSensitiveLocalPath(path, { extraData = [] } = {}) {
+  const within = mixdogSensitiveScopes(extraData);
+  const absolute = resolve(path);
+  return matchesSensitivePath(absolute, within) || matchesSensitivePath(realOrSelf(absolute), within);
+}

package/src/runtime/shared/slow-span.mjs

@@ -3,8 +3,8 @@
 // monotonic clock the owner heartbeat uses (performance.now), completed spans
 // over `minMs` land in a bounded ring, and spans over `slowMs` are logged as
 // `[slow-op] <label> <ms>`. When the event loop stalls, `describe(from, to)`
-// names the spans that overlapped the stall window. Spans carry labels, phase
-// durations and sizes only — never payloads.
+// names the spans that overlapped the stall window. Spans carry labels and
+// phase durations only — never payloads.
 
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { performance } from 'node:perf_hooks';
@@ -36,18 +36,11 @@ export function markPhase(name) {
   span.mark = t;
 }
 
-/** Records a size (count/bytes) on the caller's span. */
-export function noteSpanSize(size) {
-  const span = current.getStore();
-  if (span && Number.isFinite(size)) span.size = size;
-}
-
 const round = (ms) => Math.round(ms);
 
 function formatSpan(span) {
   const phases = span.phases.map(([name, ms]) => `${name}=${round(ms)}`).join(' ');
-  const size = span.size === undefined ? '' : ` size=${span.size}`;
-  return `${span.label} ${round(span.ms)}ms${phases ? ` ${phases}` : ''}${size}`;
+  return `${span.label} ${round(span.ms)}ms${phases ? ` ${phases}` : ''}`;
 }
 
 export function createSlowSpans({
@@ -70,7 +63,6 @@ export function createSlowSpans({
         end: span.end,
         ms: span.ms,
         phases: span.phases,
-        size: span.size,
       });
       if (ring.length > capacity) ring.shift();
     }
@@ -90,7 +82,7 @@ export function createSlowSpans({
     /** Runs `fn` inside a span; markPhase/annotateSpan inside it attach to this span. */
     async trace(label, fn) {
       const start = now();
-      const span = { label: String(label), start, mark: start, now, phases: [], size: undefined };
+      const span = { label: String(label), start, mark: start, now, phases: [] };
       try {
         return await current.run(span, fn);
       } finally {

package/src/runtime/shared/statusline/statusline-segments.mjs

@@ -200,7 +200,8 @@ async function refreshShellJobsStatus(ownerPid) {
       // its owner retires the record. Its root pid may be gone while a
       // descendant lives, so the owner's liveness decides, not the root's.
       const unconfirmed = detail?.terminationUnconfirmed === true;
-      if (unconfirmed ? !isPidAlive(ownerByJob.get(id) || 0) : !(await isShellJobAlive(detail, p, dir, id))) continue;
+      if (unconfirmed ? !isHeldShellJobAlive(detail, ownerByJob.get(id)) : !(await isShellJobAlive(detail, p, dir, id)))
+        continue;
       // A foreground command is awaited in its own tool card; listing it here
       // made every short command flash in and out of the shell list. Only
       // backgrounded jobs (including promoted ones) are background work.
@@ -326,6 +327,17 @@ function summarizeShellJobs({ count, oldestMs, jobs, bySession }) {
   return { count, elapsedLabel, jobs, sessions };
 }
 
+// A held record lives while its owner process does. Once its owner session
+// has closed, it also needs a process left to hold: the root or a survivor
+// its termination watch last reported. Without one it is an orphan whose
+// processes are gone, and it resolves instead of staying unconfirmed.
+function isHeldShellJobAlive(detail, ownerPid) {
+  if (!isPidAlive(ownerPid || 0)) return false;
+  if (detail?.ownerSessionClosed !== true) return true;
+  const survivors = Array.isArray(detail?.survivorPids) ? detail.survivorPids : [];
+  return [detail?.pid, ...survivors].some((pid) => isPidAlive(positiveInt(pid)));
+}
+
 async function isShellJobAlive(detail, detailPath, dir, id) {
   const pid = positiveInt(detail?.pid);
   if (!pid) return false;

package/src/runtime/shared/transcript-metadata.mjs

@@ -2,6 +2,7 @@
 // These pure helpers keep live rows, persisted messages and restored rows on
 // the same field contract without rewriting older display-only transcripts.
 import { displayModelName } from './model-display.mjs';
+import { routineTriggerField } from './routine-trigger.mjs';
 
 export function transcriptRouteMetadataFields(value) {
   if (!value || typeof value !== 'object') return {};
@@ -76,10 +77,19 @@ export function persistedUserTranscriptMetadata(value) {
     // The turn's change-record key (the outer prompt id), so a restored user
     // row still addresses its turn's Undo/Reapply.
     ...(typeof value.checkpointId === 'string' && value.checkpointId ? { checkpointId: value.checkpointId } : {}),
+    // Every submission a merged queued batch delivered as this turn.
+    ...submissionIdsField(value.submissionIds),
     ...attachmentsField(value.attachments),
+    // A routine fire delivered as this turn (routine-trigger.mjs).
+    ...routineTriggerField(value),
   };
 }
 
+function submissionIdsField(value) {
+  const ids = Array.isArray(value) ? value.filter((id) => typeof id === 'string' && id) : [];
+  return ids.length ? { submissionIds: ids } : {};
+}
+
 function attachmentsField(value) {
   const attachments = normalizeMessageAttachments(value);
   return attachments.length ? { attachments } : {};

package/src/runtime/shared/turn-changes.mjs

@@ -27,7 +27,6 @@ import {
 export const TURN_CHANGE_FILE_PATCH_MAX_BYTES = 8 * 1024 * 1024;
 const APPLY_TIMEOUT_MS = 60_000;
 const APPLY_OUTPUT_MAX_BYTES = 4 * 1024 * 1024;
-const STATUSES = new Set(['A', 'M', 'D', 'R']);
 // Characters a patch header cannot carry unquoted; such a path is recorded but
 // never replayed.
 const UNSAFE_PATH_CHARACTERS = /[\t\n\r"\0]/;
@@ -37,13 +36,6 @@ export function changePathKey(value) {
   return process.platform === 'win32' ? text.toLowerCase() : text;
 }
 
-/** git status letter → record status (copies create a new file). */
-export function normalizeChangeStatus(code) {
-  const letter = String(code || 'M').charAt(0);
-  if (STATUSES.has(letter)) return letter;
-  return letter === 'C' ? 'A' : 'M';
-}
-
 /** A root-relative forward-slash path that a patch may name, or ''. */
 function safeChangePath(value) {
   const text = clean(value).replace(/\\/g, '/');