mixdog 1.3.0 → 1.3.2

package/src/runtime/agent/orchestrator/agent-runtime/room-supervisor-completion.mjs

@@ -20,7 +20,8 @@ export function createRoomSupervisorCompletion(deps = {}) {
   const log = deps.log || ((line) => process.stderr.write(line));
 
   /** The decision for one step (parseRoomDecision), null for an unusable
-   *  reply; throws when the route or provider is unavailable. */
+   *  reply, `{ action: 'unmanaged' }` when no Maintainer model is configured;
+   *  throws when the configured provider is unavailable. */
   return async function decideRoomTurn(input = {}) {
     const members = (Array.isArray(input?.members) ? input.members : [])
       .filter((member) => member && typeof member.id === 'string' && member.id)
@@ -32,12 +33,12 @@ export function createRoomSupervisorCompletion(deps = {}) {
     if (!members.length) return null;
     const config = load();
     // The Maintainer's own route only: a step runs after every turn, so it
-    // never falls back to the default (Lead) model the user pays most for;
-    // without one the room keeps its rule-based picks.
+    // never falls back to the default (Lead) model the user pays most for.
+    // Without one the room is unmoderated: the members called answer once.
     const route = resolveRoute({ agent: 'cycle1-agent', config, includeDefault: false });
     const providerName = String(route?.provider || '').trim();
     const model = String(route?.model || '').trim();
-    if (!providerName || !model) throw new Error('The room supervisor has no Maintainer route.');
+    if (!providerName || !model) return { action: 'unmanaged' };
     const signal = AbortSignal.timeout(TIMEOUT_MS);
     await initialize(config.providers || {}, { signal });
     const provider = providerFor(providerName);

package/src/runtime/agent/orchestrator/agent-trace.mjs

@@ -237,6 +237,8 @@ function traceAgentUsage({
   chainContinuous,
   continuationResetReason,
   inputTokensInclusive,
+  // Anthropic: per-block prefix hashes of the request (providers/lib/anthropic-prefix-trace.mjs).
+  prefixBlocks,
 }) {
   const identity = currentUsageContext();
   provider = identity?.provider || provider;
@@ -291,6 +293,7 @@ function traceAgentUsage({
       service_tier: resolvedServiceTier,
       raw_usage: rawUsage || null,
       ...chainFields,
+      ...(prefixBlocks ? { prefix_blocks: prefixBlocks } : {}),
     },
   });
 }

package/src/runtime/agent/orchestrator/cache-break-trace.mjs

@@ -51,6 +51,8 @@ export function buildCacheBreakPayload(record = {}) {
     input_prefix_mismatch_expected_hash: cleanHash(record.inputPrefixMismatchExpectedHash),
     input_prefix_mismatch_actual_type: cleanText(record.inputPrefixMismatchActualType),
     input_prefix_mismatch_actual_hash: cleanHash(record.inputPrefixMismatchActualHash),
+    changed_blocks: cleanText(record.changedBlocks),
+    system_markers_changed: typeof record.markersChanged === 'boolean' ? record.markersChanged : null,
   };
   return Object.fromEntries(Object.entries(payload).filter(([, value]) => value !== null));
 }
@@ -77,6 +79,8 @@ function formatCacheBreakLine(record = {}) {
     ['previousCachedPrefixTokens', payload.previous_cached_prefix_tokens],
     ['idleMs', payload.idle_ms],
     ['noGuardBaseline', payload.missing_prefix_guard_baseline],
+    ['changedBlocks', payload.changed_blocks],
+    ['systemMarkersChanged', payload.system_markers_changed],
   ].filter(([, value]) => value !== null && value !== undefined);
   return `[cache-break] ${fields.map(([key, value]) => (typeof value === 'string' ? `${key}=${JSON.stringify(value)}` : `${key}=${value}`)).join(' ')}`;
 }

package/src/runtime/agent/orchestrator/config-presets.mjs

@@ -144,6 +144,8 @@ export function normalizePreset(preset) {
   // Auto effort is on unless the preset opts out; only the off state is kept.
   if (preset.autoEffort === false) out.autoEffort = false;
   out.tools = ['full', 'readonly', 'mcp'].includes(preset.tools) ? preset.tools : 'full';
+  // The Lead preset's fallback models (validated when written, by the route normalizer).
+  if (Array.isArray(preset.fallbacks) && preset.fallbacks.length) out.fallbacks = preset.fallbacks;
   return out;
 }
 

package/src/runtime/agent/orchestrator/config-storage.mjs

@@ -127,9 +127,16 @@ function canonicalizeAutoClearStorage(value) {
     const provider = String(key || '')
       .trim()
       .toLowerCase();
-    const duration = Number(candidate);
-    if (!provider || !Number.isFinite(duration) || duration <= 0) continue;
-    providerIdleMs[provider] = Math.max(60_000, Math.round(duration));
+    // 0 (also 'unlimited' / 'never') is the stored "never auto-clear" value
+    // (runtime-core/config-helpers.mjs AUTO_CLEAR_UNLIMITED).
+    const text = typeof candidate === 'string' ? candidate.trim().toLowerCase() : null;
+    let duration;
+    if (text === 'unlimited' || text === 'never') duration = 0;
+    else if (text === '') duration = Number.NaN;
+    else duration = Number(candidate);
+    if (!provider || candidate === null || typeof candidate === 'boolean' || !Number.isFinite(duration) || duration < 0)
+      continue;
+    providerIdleMs[provider] = duration === 0 ? 0 : Math.max(60_000, Math.round(duration));
   }
   delete next.thresholdMs;
   delete next.idleMillis;

package/src/runtime/agent/orchestrator/config.mjs

@@ -4,6 +4,7 @@ import { mergeStoredProviders } from './config-providers-merge.mjs';
 import { normalizeExtensionScopes } from '../../shared/extension-scopes.mjs';
 import { applyConfigPatch, diffConfig } from '../../shared/config-patch.mjs';
 import { normalizeWorkflowSelection } from '../../shared/orchestration.mjs';
+import { AUTO_EFFORT_BASE, autoEffortBase } from './providers/auto-effort.mjs';
 import { DEFAULT_INSTRUCTION_FILES_MODE, normalizeInstructionFilesMode } from '../../shared/instruction-files-mode.mjs';
 import {
   DEFAULT_DISABLED_AGENT_ROSTER,
@@ -205,6 +206,13 @@ function storedInstructionFiles(agent) {
   return mode === DEFAULT_INSTRUCTION_FILES_MODE ? {} : { instructionFiles: mode };
 }
 
+// `autoEffortBase` (providers/auto-effort.mjs): only a valid non-default level
+// is kept; absent means medium.
+function storedAutoEffortBase(agent) {
+  const base = autoEffortBase(agent?.autoEffortBase);
+  return base === AUTO_EFFORT_BASE ? {} : { autoEffortBase: base };
+}
+
 export function loadConfig(options = {}) {
   const includeSecrets = options.secrets !== false;
   // `secrets: 'presence'`: credentials are detected (env, OAuth files, which
@@ -269,6 +277,7 @@ export function loadConfig(options = {}) {
         disabledAgents: legacyDisabledAgents ? disabledAgentIds(raw) : effectiveDisabledAgents(raw),
         ...(raw.memoryTools && typeof raw.memoryTools === 'object' ? { memoryTools: { ...raw.memoryTools } } : {}),
         ...storedInstructionFiles(raw),
+        ...storedAutoEffortBase(raw),
         ...normalizeWorkflowSelection(raw),
         profile: normalizeProfileConfig(raw.profile),
         skills: normalizeSkillsConfig(raw.skills),
@@ -463,6 +472,8 @@ function buildAgentSaveBuilder(config) {
     else delete next.aiSessionTitles;
     delete next.instructionFiles;
     Object.assign(next, storedInstructionFiles(config));
+    delete next.autoEffortBase;
+    Object.assign(next, storedAutoEffortBase(config));
     delete next.workflowRoutes;
     // Defaults live in code: values equal to the current default are not stored.
     return storedAgentForm(removeRetiredAgentFields(next));

package/src/runtime/agent/orchestrator/context/role-instructions.mjs

@@ -2,8 +2,9 @@
 
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { compareCodePoints } from '../../../shared/code-point-order.mjs';
+import { BOTS_DIR, MIXY_BOT_ID, botStoreActive, isStoreBot, mixyIdentityDir } from '../../../shared/agent-store.mjs';
 import { mixdogRoot } from '../../../shared/plugin-paths.mjs';
 import { readMarkdownDocument } from '../../../shared/markdown-frontmatter.mjs';
 import { listHiddenAgentsByKind, getAgentCatalogShareAgents } from '../internal-agents.mjs';
@@ -89,9 +90,35 @@ function agentSectionDirs(pluginRoot) {
   } catch {
     /* unresolvable data dir — built-in roles still load */
   }
+  // Bots of the store (agent-store.mjs), last: a bot's own folder wins over
+  // the agents/ original the split left behind.
+  const root = userDataRoot();
+  if (root && botStoreActive(root)) dirs.push(join(root, BOTS_DIR));
   return dirs;
 }
 
+// The user data dir (parent of agents/), or '' when it cannot be resolved.
+function userDataRoot() {
+  try {
+    const userDir = mixdogGlobalDir('agents');
+    return userDir ? dirname(userDir) : '';
+  } catch {
+    return '';
+  }
+}
+
+// A store bot's own folder, or ''.
+function storeBotDir(agent) {
+  const root = userDataRoot();
+  return root && isStoreBot(root, agent) ? join(root, BOTS_DIR, agent) : '';
+}
+
+// Mixy's identity folder: bots/mixy with the store, agents/lead before.
+function mixyDir() {
+  const root = userDataRoot();
+  return root ? mixyIdentityDir(root) : '';
+}
+
 function loadAgentSections(pluginRoot) {
   // agents/ accepts both the compatibility flat layout and the current
   // nested agents/<agent>/AGENT.md layout.
@@ -117,6 +144,7 @@ function loadAgentSections(pluginRoot) {
       // Mixy's own AGENT.md (agents/lead/) rides only Mixy's agent-mode
       // prompt (loadMixyRoleSection), never another role catalog.
       if (!name || !raw || name === 'lead') continue;
+      if (name === MIXY_BOT_ID && basename(agentsDir) === BOTS_DIR) continue;
       const { body } = readMarkdownDocument(raw);
       if (!body) continue;
       byName.set(name, roleSection(name, body));
@@ -255,6 +283,12 @@ export function truncatePersona(text, max = PERSONA_MAX_CHARS) {
 export function loadAgentPersonaSection(agent) {
   if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return '';
   const isLead = agent === 'lead';
+  // Mixy's persona is in its own folder; a store bot's in its bots/ folder.
+  const own = isLead ? mixyDir() : storeBotDir(agent);
+  if (own) {
+    const persona = truncatePersona(readSafe(join(own, 'PERSONA.md')) || '');
+    return persona ? personaSection(persona) : '';
+  }
   const pluginRoot = mixdogRoot();
   const roots = [];
   try {
@@ -272,17 +306,21 @@ export function loadAgentPersonaSection(agent) {
       if (isLead) continue;
       return '';
     }
-    return [
-      '## Persona',
-      '',
-      'Tone and style guide for how you speak, address the user and carry yourself. It never overrides tool, safety or role rules; those always win.',
-      '',
-      persona,
-    ].join('\n');
+    return personaSection(persona);
   }
   return '';
 }
 
+function personaSection(persona) {
+  return [
+    '## Persona',
+    '',
+    'Tone and style guide for how you speak, address the user and carry yourself. It never overrides tool, safety or role rules; those always win.',
+    '',
+    persona,
+  ].join('\n');
+}
+
 // --- Mixy's working style (agents/lead/AGENT.md, user data dir) ---
 // The user-editable 일하는 방식 of Mixy, framed like any agent's role section.
 // Agent mode only; empty or missing means no section. Re-read per
@@ -290,8 +328,8 @@ export function loadAgentPersonaSection(agent) {
 export function loadMixyRoleSection() {
   let raw = '';
   try {
-    const userDir = mixdogGlobalDir('agents');
-    raw = userDir ? readSafe(join(userDir, 'lead', 'AGENT.md')) || '' : '';
+    const dir = mixyDir();
+    raw = dir ? readSafe(join(dir, 'AGENT.md')) || '' : '';
   } catch {
     return '';
   }
@@ -306,6 +344,15 @@ export function loadMixyRoleSection() {
 // (the Lead configuration, id `lead`) has its own line, under the display name
 // the user gave it (session/mixy-name.mjs), Mixy by default.
 function agentManifest(agent) {
+  const own = storeBotDir(agent);
+  if (own) {
+    try {
+      const value = JSON.parse(readSafe(join(own, 'agent.json')) || '{}');
+      return value && typeof value === 'object' ? value : {};
+    } catch {
+      return {};
+    }
+  }
   const roots = [];
   try {
     const userDir = mixdogGlobalDir('agents');
@@ -328,6 +375,14 @@ function agentManifest(agent) {
   return {};
 }
 
+/** The name a bot goes by (its manifest name, Mixy's display name), else its id. */
+export function agentDisplayName(agent) {
+  if (agent === 'lead') return mixyDisplayName();
+  if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return String(agent || '');
+  const name = agentManifest(agent).name;
+  return (typeof name === 'string' ? name.replace(/\s+/g, ' ').trim() : '') || agent;
+}
+
 export function agentModeIdentityLine(agent) {
   if (agent === 'lead') return `You are ${mixyDisplayName()}, the user's assistant in Mixdog.`;
   if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return '';
@@ -344,9 +399,13 @@ export function agentModeIdentityLine(agent) {
 // the shipped tree — as one hash. A session stamps it when its prompt is
 // composed; another value means the profile was edited since
 // (session-runtime/tool-policy-refresh.mjs refreshAgentProfile). '' for an
-// invalid id.
-export function agentProfileRevision(agent) {
+// invalid id. A coding Lead (`lead` outside Mixy's own thread) embeds no
+// profile file at all, so its stamp is a constant: editing Mixy never
+// rebuilds a coding session's prompt.
+export const CODING_LEAD_PROFILE_REVISION = 'coding-lead';
+export function agentProfileRevision(agent, { mixy = true } = {}) {
   if (typeof agent !== 'string' || !PERSONA_AGENT_ID.test(agent) || agent.includes('..')) return '';
+  if (agent === 'lead' && !mixy) return CODING_LEAD_PROFILE_REVISION;
   const roots = [mixdogGlobalDir('agents')];
   const pluginRoot = mixdogRoot();
   if (pluginRoot) roots.push(join(pluginRoot, 'agents'));
@@ -356,6 +415,13 @@ export function agentProfileRevision(agent) {
       hash.update(`${root}\0${file}\0${readSafe(join(root, agent, file)) ?? '\u0001'}\0`);
     }
   }
+  // Mixy's or a store bot's own folder, when it has one.
+  const own = agent === 'lead' ? mixyDir() : storeBotDir(agent);
+  if (own && own !== join(roots[0] || '', agent)) {
+    for (const file of ['agent.json', 'AGENT.md', 'PERSONA.md']) {
+      hash.update(`${own}\0${file}\0${readSafe(join(own, file)) ?? '\u0001'}\0`);
+    }
+  }
   return hash.digest('hex').slice(0, 24);
 }
 
@@ -417,8 +483,8 @@ export function composeSystemPrompt(opts) {
         ? loadMixyRoleSection()
         : loadScopedRoleInstructions(opts.agent || null, opts.provider || null);
   }
-  // Persona follows the role; the Lead has no role section but may own a
-  // persona through agents/lead/PERSONA.md.
+  // Persona follows the role; Mixy's own thread carries Mixy's persona
+  // (bots/mixy/PERSONA.md) — a coding Lead's prompt never does (skipPersona).
   const personaContext = opts.agent && !opts.skipPersona ? loadAgentPersonaSection(opts.agent) : '';
   const coreMemory = skip.memory ? '' : trimmedPromptSlice(opts.coreMemoryContext);
   // User AGENTS.md / CLAUDE.md block (context/instruction-files.mjs), already
@@ -431,7 +497,7 @@ export function composeSystemPrompt(opts) {
   //    variants, AGENT_MODE.md, the sub-agent catalog (the same for every
   //    agent other than Mixy);
   // 3. Mixy only — MIXY.md and its contact-agent catalog;
-  // 4. per session or agent, last — routine line, identity, caller prompt,
+  // 4. per session or agent, last — identity, caller prompt,
   //    role, persona, instruction files and core memory (changes most).
   const sessionMarkerCore = joinPromptSlices([
     trimmedPromptSlice(opts.workflowContext),
@@ -442,7 +508,6 @@ export function composeSystemPrompt(opts) {
     trimmedPromptSlice(opts.agentCatalogContext),
     opts.mixyRules || '',
     trimmedPromptSlice(opts.contactCatalogContext),
-    opts.routineRules || '',
     opts.identityContext || '',
     opts.userPrompt || '',
     roleInstructionContext,

package/src/runtime/agent/orchestrator/mcp/agent-connectors.mjs

@@ -2,6 +2,7 @@
 // or a project may use. Every installed connector is on by default for every
 // agent and project, existing and future ones; a policy only switches some off:
 //   agents/<id>/agent.json   connectors: { off: [serverId…], tools?: { [serverId]: { [tool]: permission } } }
+//                            (bots/<id>/ for a store bot; Mixy — runtime id `lead` — in her identity folder)
 //   <data>/project-connectors.json   { projects: { [projectRoot]: { off: [serverId…] } } }
 // `tools` keeps per-tool overrides (auto | needs_approval | disabled); a tool
 // without one is auto, except a catalog connector's high-risk tools, which
@@ -12,10 +13,16 @@
 // connected tool, so the schema and the BP2 manifest stay shared.
 import { readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { holdsNoData, parseJsonText, readJsonStateSync } from '../../../shared/atomic-file.mjs';
+
+const NO_DATA = new Error('the file holds no data');
 import { cwdWithinProjects } from '../../../shared/extension-scopes.mjs';
 import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { mixyIdentityDir, userDefinitionDir } from '../../../shared/agent-store.mjs';
 import { isSelfMcpToolName, parseMcpToolName } from '../../../shared/tool-primitives.mjs';
 import { connectorToolDefault } from '../../../shared/connector-catalog.mjs';
+import { MIXY_AGENT_ID } from '../session/agent-home.mjs';
+import { AGENT_MODE, sessionModeOf } from '../session/agent-mode.mjs';
 import { serverConnector } from './server-connectors.mjs';
 
 export const CONNECTOR_PERMISSIONS = Object.freeze(['auto', 'needs_approval', 'disabled']);
@@ -126,9 +133,25 @@ function readJson(path, parse) {
     return error?.code === 'ENOENT' || error?.code === 'ENOTDIR' ? null : unreadable(path, error);
   }
   try {
-    return parse(JSON.parse(text));
+    if (holdsNoData(text)) throw NO_DATA;
+    return parse(parseJsonText(text));
   } catch (error) {
-    return unreadable(path, error);
+    return recoverDamaged(path, parse, error);
+  }
+}
+
+// A damaged policy (empty, NUL-filled, torn, invalid) must never fail open.
+// With a valid last good copy `<file>.bak` the damaged file is kept aside and
+// the copy restored, so the user's deny list survives. Without one the file
+// stays where it is (`keepWithoutBackup`) and every connector stays off until
+// the policy is saved again — moving it aside would make the next read "no
+// policy" (all on). A busy recovery lock also answers deny-all.
+function recoverDamaged(path, parse, error) {
+  try {
+    const value = readJsonStateSync(path, { validate: parse, fallback: DENY_ALL_CONNECTORS, keepWithoutBackup: true });
+    return value === DENY_ALL_CONNECTORS ? unreadable(path, error) : value;
+  } catch (recoveryError) {
+    return unreadable(path, recoveryError);
   }
 }
 
@@ -145,11 +168,22 @@ export function readConnectorsFile(path) {
   return readJson(path, (manifest) => parseConnectorPolicy(manifest?.connectors));
 }
 
-/** The agent's saved policy under `dataDir`, or null when it has none. */
+/** The agent's saved policy under `dataDir`, or null when it has none. Mixy's
+ *  runtime id is `lead`: her policy is in her identity folder (bots/mixy once
+ *  the bot store is active, agents/lead before), the file her profile writes. */
 export function agentConnectors(agentId, dataDir = resolvePluginData()) {
   const id = clean(agentId);
   if (!id || !AGENT_DIR_ID.test(id)) return null;
-  return cachedRead(join(dataDir, 'agents', id, 'agent.json'), readConnectorsFile);
+  const dir = id === MIXY_AGENT_ID ? mixyIdentityDir(dataDir) : userDefinitionDir(dataDir, id);
+  return cachedRead(join(dir, 'agent.json'), readConnectorsFile);
+}
+
+/** The agent whose connector policy `session` runs under. A coding Lead shares
+ *  Mixy's runtime id `lead` but is not her: the policy her profile edits is
+ *  hers alone, so a coding Lead has none ('') and only its Project's applies. */
+export function connectorPolicyAgentOf(session) {
+  const agent = clean(session?.agent);
+  return agent === MIXY_AGENT_ID && sessionModeOf(session) !== AGENT_MODE ? '' : agent;
 }
 
 /** Uncached: the project policy file → `[{ root, off }]`, null without one,
@@ -185,6 +219,65 @@ export function connectorToolPermission(policy, toolOrName) {
   return policy?.tools?.[mcp.server]?.[mcp.tool] || connectorToolDefault(serverConnector(mcp.server), mcp.tool);
 }
 
+const PERMISSION_RANK = Object.freeze({ disabled: 0, needs_approval: 1, auto: 2 });
+export const NO_WIDEN_MESSAGE = 'This change would widen what the bot may do without asking; make it on the desktop.';
+
+/** Whether replacing the stored policy `before` (a stored value, a parsed
+ *  policy or null) with `after` (`{ off, tools }` or null) could give any
+ *  tool more authority, judged on EFFECTIVE permissions: a connector switched
+ *  back on, a tool allowed, or an override removed (the tool then runs on its
+ *  default, which is `needs_approval` for a catalog connector's high-risk
+ *  tools and `auto` otherwise). A legacy allow list or an unreadable policy is
+ *  not compared: it counts as widening. */
+export function connectorPolicyWidens(before, after) {
+  let old;
+  try {
+    old = before == null ? { off: [], tools: {} } : parseConnectorPolicy(before);
+  } catch {
+    return true;
+  }
+  if (old.allow) return true;
+  const next = after == null ? { off: [], tools: {} } : after;
+  const offBefore = new Set(old.off);
+  const offAfter = new Set(next.off || []);
+  for (const server of offBefore) if (!offAfter.has(server)) return true;
+  const toolsBefore = old.tools || {};
+  const toolsAfter = next.tools || {};
+  for (const server of new Set([...Object.keys(toolsBefore), ...Object.keys(toolsAfter)])) {
+    const tools = new Set([...Object.keys(toolsBefore[server] || {}), ...Object.keys(toolsAfter[server] || {})]);
+    for (const tool of tools) {
+      // No override: at least asks / at most runs freely.
+      const was = offBefore.has(server) ? 0 : (PERMISSION_RANK[toolsBefore[server]?.[tool]] ?? 1);
+      const now = offAfter.has(server) ? 0 : (PERMISSION_RANK[toolsAfter[server]?.[tool]] ?? 2);
+      if (now > was) return true;
+    }
+  }
+  return false;
+}
+
+/** Throws NO_WIDEN_MESSAGE when `after` could widen `before` (see connectorPolicyWidens). */
+export function assertConnectorPolicyNotWidened(before, after) {
+  if (connectorPolicyWidens(before, after)) throw new Error(NO_WIDEN_MESSAGE);
+}
+
+let toolPermissionWriter = null;
+/** The host attaches the one writer of an agent's per-tool permission (the
+ *  agent editor keeps every other agent.json key). */
+export function setConnectorToolPermissionWriter(write) {
+  toolPermissionWriter = typeof write === 'function' ? write : null;
+}
+
+/** Save `permission` for the connector tool `toolOrName` under `agentId`'s own
+ *  policy. False when it is no connector tool or no writer is attached. */
+export async function writeAgentMcpToolPermission(agentId, toolOrName, permission) {
+  const mcp = parseMcpToolName(toolOrName);
+  if (!toolPermissionWriter || !mcp || isSelfMcpToolName(toolOrName) || !CONNECTOR_PERMISSIONS.includes(permission)) {
+    return false;
+  }
+  await toolPermissionWriter(agentId, mcp.server, mcp.tool, permission);
+  return true;
+}
+
 /** The permission `agentId` has for the MCP tool `toolOrName`. */
 export function agentMcpToolPermission(agentId, toolOrName) {
   if (!parseMcpToolName(toolOrName)) return 'auto';

package/src/runtime/agent/orchestrator/mcp/child-tree.mjs

@@ -117,14 +117,11 @@ async function enumerate({ strict = false } = {}) {
  *  names and (POSIX) process groups. Rejects instead of returning a partial
  *  table, so callers can tell "nothing found" from "could not look".
  *
- *  `shared: true` (pre-kill captures) joins a read already in flight, so many
- *  jobs promoted together do not each spawn an enumerator; a capture taken
- *  while its root runs is valid whenever that read began. An observation after
- *  a kill or exit must see a table taken AFTER it asked: a read that began
- *  before the kill would report the killed tree alive and defer the
- *  confirmation by a whole re-check. Such a caller starts a read when none
- *  runs, else joins the one queued to begin when the running read settles —
- *  every observer asking meanwhile shares it. At most one enumerator runs at
+ *  Every caller sees a table from a read begun after it asked: an earlier
+ *  read may miss newly spawned descendants before a kill, or report a killed
+ *  tree alive afterwards. A caller starts a read when none runs, else joins
+ *  the one queued to begin when the running read settles — every caller
+ *  asking meanwhile shares it. At most one enumerator runs at
  *  a time, however many shells settle or watch at once (each one is a
  *  PowerShell process on Windows; one per settle and watch pass compounded
  *  machine load into multi-second daemon stalls). */
@@ -137,8 +134,7 @@ function startTableRead() {
   tableInFlight = read;
   return read;
 }
-export function readProcessTable({ shared = false } = {}) {
-  if (shared && tableInFlight) return tableInFlight;
+export function readProcessTable() {
   if (nextTable) return nextTable;
   if (!tableInFlight) return startTableRead();
   const settled = () => {};

package/src/runtime/agent/orchestrator/mcp/client.mjs

@@ -1,5 +1,6 @@
 import { setMaxListeners } from 'node:events';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync } from 'node:fs';
+import { writeFileAtomicSync } from '../../../shared/atomic-file.mjs';
 import { writeFile } from 'node:fs/promises';
 import {
   MAX_ATTACHMENT_BLOB_BYTES,
@@ -772,9 +773,11 @@ function spillMcpBinary(buffer, extension) {
   const path = join(dir, `mcp-${hash}.${extension}`);
   try {
     mkdirSync(dir, { recursive: true });
-    writeFileSync(path, buffer, { flag: 'wx' });
-  } catch (err) {
-    if (err?.code !== 'EEXIST') return null;
+    // Named by its content hash: whole-file create-if-absent (a crash never
+    // leaves a torn file under the name that would be trusted as the content).
+    writeFileAtomicSync(path, buffer, { createOnly: true });
+  } catch {
+    return null;
   }
   return path;
 }