mixdog 1.3.0 → 1.3.2

package/src/session-runtime/services/agent-tool/spawn-flow/job-start.mjs

@@ -4,6 +4,7 @@
  * agent work, and status publication at start and after terminal settlement.
  */
 import { sanitizeTaskMeta, startBackgroundTask } from '../../../../runtime/shared/background-tasks.mjs';
+import { recordAgentTaskStart } from '../../../../runtime/shared/agent-task-starts.mjs';
 import { resourceAdmission } from '../../../../runtime/shared/resource-admission.mjs';
 import { clean, terminalPidForContext } from '../helpers.mjs';
 import { renderResult } from '../render.mjs';
@@ -82,6 +83,9 @@ export function createJobStarter({ mgr, notifyStatusChange, notifySessionComplet
         }
       },
     });
+    // The model's tool call that started this job owns it (its result message
+    // carries the id: agent-task-starts.mjs).
+    recordAgentTaskStart(notifyContext?.toolCallId, task.taskId);
     notifyStatusChange();
     return task;
   };

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-prep.mjs

@@ -9,6 +9,7 @@ import { resolveAgentWatchdogPolicy } from '../../../../runtime/agent/orchestrat
 import { prepareAgentSession } from '../../../../runtime/agent/orchestrator/agent-runtime/session-builder.mjs';
 import { getProvider } from '../../../../runtime/agent/orchestrator/providers/registry.mjs';
 import { resolveRouteContextState } from '../../../route-state.mjs';
+import { contextSelectionFromState } from '../../../../runtime/agent/orchestrator/runtime-core/route-context-state.mjs';
 import { createSpawnPlanner } from './spawn-plan.mjs';
 import { enterWorkerSpawn } from '../../../workspace/admission-gate.mjs';
 
@@ -97,11 +98,13 @@ export function createSpawnPreparer({
 
   async function createSpawnedSession(plan, spec, prepState) {
     // A sub-100 context share needs the window it selects; a percent alone
-    // keeps the full served window.
+    // keeps the full served window. A model whose window is not known yet
+    // resolves to nothing: the agent's own choice then travels as stored (the
+    // session sizes it from the provider's window) instead of being dropped
+    // for the model's default.
     const sessionSpec = { ...spec };
     if (plan.preset.contextPercent || plan.preset.contextTokens) {
-      const { contextPercent, selectedContextWindow, contextTokens } = resolveRouteContextState(plan.preset, null);
-      Object.assign(sessionSpec, { contextPercent, selectedContextWindow }, contextTokens ? { contextTokens } : {});
+      Object.assign(sessionSpec, contextSelectionFromState(resolveRouteContextState(plan.preset, null), plan.preset));
     }
     if (sessionSurface?.canonical === true && typeof sessionSurface.createChild === 'function') {
       return sessionSurface.createChild({ spec: sessionSpec, prompt: plan.prompt, tag: plan.tag });

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-run.mjs

@@ -25,6 +25,8 @@ import { settledWorkerStatus } from '../worker-index/row-liveness.mjs';
 import { saveSessionAsync } from '../../../../runtime/agent/orchestrator/session/store.mjs';
 import { presetDescriptor } from './spawn-prep.mjs';
 import { workerStageForStatus } from '../worker-rows.mjs';
+import { handoffContent } from '../../../handoff-attachments.mjs';
+import { whileTurnDispatched } from '../../../../runtime/agent/orchestrator/session/manager/runtime-state.mjs';
 
 // Mid-turn worker persistence cadence. The watchdog sweep runs every second;
 // a transcript save is far more expensive than a bookkeeping stamp, so the
@@ -117,11 +119,15 @@ export function createSpawnRunner({
   };
 
   async function runTurn(prepared, turnHooks) {
-    const { args, session, prompt, workerCwd } = prepared;
-    if (typeof sessionSurface?.runTurn === 'function' && sessionSurface.canRun?.(session) !== false) {
-      return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd: workerCwd, ...turnHooks });
-    }
-    return mgr.askSession(session.id, prompt, args.context || null, null, workerCwd, null, turnHooks);
+    const { args, session, workerCwd } = prepared;
+    // The caller's forwarded files ride along as attachment parts.
+    const prompt = handoffContent(prepared.prompt, args.attachmentParts);
+    return whileTurnDispatched(session.id, () => {
+      if (typeof sessionSurface?.runTurn === 'function' && sessionSurface.canRun?.(session) !== false) {
+        return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd: workerCwd, ...turnHooks });
+      }
+      return mgr.askSession(session.id, prompt, args.context || null, null, workerCwd, null, turnHooks);
+    });
   }
 
   async function runSpawn(prepared, notifyContext = null, job = null) {
@@ -218,7 +224,7 @@ export function createSpawnRunner({
       watchdog?.stop?.();
       upsertWorkerSessionDeferred(session, tag, {
         ...presetDescriptor(agent, preset, presetName),
-        ...settledWorkerStatus(finalStatus, stalled),
+        ...settledWorkerStatus(finalStatus, stalled, job),
         finishedAt: new Date().toISOString(),
       });
       setImmediate(notifyStatusChange);

package/src/session-runtime/services/agent-tool/spawn-preset.mjs

@@ -27,11 +27,10 @@ export function resolveAgentSpawnPreset(config, args = {}) {
   }
 
   const agentName = normalizeAgentName(args.agent);
-  const agentRoute = !clean(args.preset)
-    ? configuredAgentRouteCandidates(config, agentName)
-        .map((candidate) => normalizeAgentRoute(candidate))
-        .find(Boolean) || null
-    : null;
+  // The agent's stored route: config.agents, or a store bot's own folder.
+  const candidates = !clean(args.preset) ? configuredAgentRouteCandidates(config, agentName) : [];
+  const agentRoute = candidates.map((candidate) => normalizeAgentRoute(candidate)).find(Boolean) || null;
+  const storedFallbacks = candidates.find((candidate) => normalizeAgentRoute(candidate))?.fallbacks;
   if (agentRoute) {
     return {
       presetName: agentPresetName(agentName),
@@ -41,9 +40,7 @@ export function resolveAgentSpawnPreset(config, args = {}) {
         type: 'agent',
         provider: agentRoute.provider,
         model: agentRoute.model,
-        ...(config.agents?.[agentName]?.fallbacks?.length
-          ? { fallbacks: config.agents[agentName].fallbacks.map(normalizeAgentRoute) }
-          : {}),
+        ...(storedFallbacks?.length ? { fallbacks: storedFallbacks.map(normalizeAgentRoute) } : {}),
         effort: agentRoute.effort,
         fast: agentRoute.fast === true,
         ...(agentRoute.autoEffort === false ? { autoEffort: false } : {}),

package/src/session-runtime/services/agent-tool/tool-def.mjs

@@ -53,6 +53,13 @@ export const AGENT_TOOL = {
       file: { type: 'string', description: 'Path to task text; alternative to prompt/message for spawn/send.' },
       cwd: { type: 'string', description: 'Project directory for a new or respawned agent.' },
       context: { type: 'string', description: 'Extra context for the spawn/send turn.' },
+      attachments: {
+        type: 'array',
+        items: { type: 'string' },
+        maxItems: 8,
+        description:
+          "spawn/send: files to attach (images, PDF/Office, text): a conversation attachment's file name or [attachment:id], or a path inside your folders. Produced files come back as paths; forward them by path.",
+      },
       model: {
         type: 'string',
         description:

package/src/session-runtime/services/agent-tool/worker-index/row-liveness.mjs

@@ -31,10 +31,30 @@ export const PROCESS_RESTART_FAILURE = 'process-restart';
 /** The row's turn was stopped by the progress (stall) watchdog. */
 export const WATCHDOG_STALL_FAILURE = 'stalled';
 
+/** A failed row whose turn a process restart ended and whose owner has not
+ *  been told yet (restart-notify). It is the only record of that owed result,
+ *  so closing the worker never drops it. */
+export const isUnnotifiedRestartFailure = (row) =>
+  row?.status === 'failed' &&
+  row.failureReason === PROCESS_RESTART_FAILURE &&
+  Boolean(clean(row.ownerSessionId)) &&
+  !row.restartNotified;
+
 /** A turn's settled row status and failure reason: a watchdog stop is a
  *  failure whatever partial output it handed back (`finalStatus` may still
- *  read `idle` for the job's sake); everything else keeps `finalStatus`. */
-export function settledWorkerStatus(finalStatus, stalled) {
+ *  read `idle` for the job's sake); a turn the process exit cut off (its `job`
+ *  cancelled with terminalReason PROCESS_RESTART_FAILURE, lifecycle/teardown)
+ *  fails as a restart failure under its task id, which the next process tells
+ *  its owner; everything else keeps `finalStatus`. */
+export function settledWorkerStatus(finalStatus, stalled, job = null) {
+  if (job?.status === 'cancelled' && job.terminalReason === PROCESS_RESTART_FAILURE) {
+    return {
+      status: 'failed',
+      stage: 'failed',
+      failureReason: PROCESS_RESTART_FAILURE,
+      ...(job.taskId ? { task_id: job.taskId } : {}),
+    };
+  }
   return stalled
     ? { status: 'failed', stage: 'failed', failureReason: WATCHDOG_STALL_FAILURE }
     : { status: finalStatus, stage: finalStatus };

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -22,6 +22,7 @@ import {
   createRowLiveness,
   isActiveWorkerRow,
   isStaleApprovalWait,
+  isUnnotifiedRestartFailure,
   PROCESS_RESTART_FAILURE,
   runtimeDied,
 } from './worker-index/row-liveness.mjs';
@@ -101,12 +102,15 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   const rowFromSession = (session, fallbackTag = '', extra = {}) =>
     workerRowFromSession(session, fallbackTag, extra, (sessionId) => mgr.getSessionRuntime?.(sessionId));
 
+  // A row whose owner is still owed its restart failure stays: closing the
+  // worker (a process exit closes every one) must not lose that result.
   function removeWorkerRow({ tag = '', sessionId = '' } = {}) {
     const targetTag = clean(tag);
     const targetSessionId = clean(sessionId);
     batch.flush();
     store.write((byKey) => {
       for (const [key, row] of [...byKey.entries()]) {
+        if (isUnnotifiedRestartFailure(row)) continue;
         if ((targetSessionId && row.sessionId === targetSessionId) || (targetTag && row.tag === targetTag)) {
           byKey.delete(key);
         }
@@ -194,12 +198,6 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     return true;
   }
 
-  const isUnnotifiedRestartFailure = (row) =>
-    row.status === 'failed' &&
-    row.failureReason === PROCESS_RESTART_FAILURE &&
-    Boolean(clean(row.ownerSessionId)) &&
-    !row.restartNotified;
-
   /** Rows whose turn a process restart ended and whose owner has not been told
    *  yet — whoever settled the row (this process at startup, or the
    *  predecessor's exit flush). Read-only: the caller enqueues the owner's

package/src/session-runtime/services/agent-tool.mjs

@@ -169,6 +169,12 @@ export function createStandaloneAgent({
     },
     getStatus,
     recoverWorkers,
+    // Daemon start: settle the rows the previous process left running and
+    // queue each owner's failure result; resolves once they are queued.
+    settleRestartFailures: () => {
+      registry.recoverStaleWorkerRows({ deadOnly: true });
+      return notifyRestartFailures();
+    },
     upsertLeadSession: registry.upsertLeadSession,
     updateLeadWorkerCwd: registry.updateLeadWorkerCwd,
     forgetLeadSession: registry.forgetLeadSession,

package/src/session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs

@@ -165,7 +165,7 @@ export function reconcileLostDaemonCaptures({
   for (const name of names) {
     const file = path.join(dir, name);
     const record = readRecord(file);
-    if (!record || record.kind !== 'mixdog-daemon-crash-capture') continue;
+    if (record?.kind !== 'mixdog-daemon-crash-capture') continue;
     if (!record.pid || record.pid === selfPid || record.exitedAt || record.daemonExit || record.exitReason) continue;
     if (pidAlive(record.pid)) continue;
     try {

package/src/session-runtime/services/daemon-crash-capture/retention.mjs

@@ -21,9 +21,10 @@ import { daemonCrashCaptureDir } from './paths.mjs';
 // Prune only files this module creates: `daemon-<yyyymmdd>-<hhmmss>-<pid>-<rand>`.
 const CAPTURE_STEM_RE = /^daemon-\d{8}-\d{6}-\d+-[0-9a-f]{4}$/;
 const CAPTURE_SUFFIXES = ['.err.log', '.json'];
-// Debris from this module's own atomic sidecar writes (writeFileAtomicSync
-// names its temp `.<basename>.<hex>.tmp`), never anyone else's file.
-const CAPTURE_TEMP_RE = /^\.daemon-\d{8}-\d{6}-(\d+)-[0-9a-f]{4}\.json\.[0-9a-f]+\.tmp$/;
+// Debris from this module's own atomic sidecar writes (the atomic writer names
+// its temp `<basename>.mixdog-tmp-<hex>`; older builds `.<basename>.<hex>.tmp`),
+// never anyone else's file.
+const CAPTURE_TEMP_RE = /^\.?daemon-\d{8}-\d{6}-(\d+)-[0-9a-f]{4}\.json\.(?:[0-9a-f]+\.tmp|mixdog-tmp-[0-9a-f]+)$/;
 export const CRASH_CAPTURE_KEEP_BOOTS = 8;
 const CRASH_CAPTURE_KEEP_BYTES = 2 * 1024 * 1024;
 const CRASH_CAPTURE_TAIL_BYTES = 256 * 1024;

package/src/session-runtime/services/hook-bus/config-loader.mjs

@@ -4,8 +4,7 @@
  * file-stamp set, standard events merged, legacy rules collected, and the
  * parse errors both reported and recorded on the result.
  */
-import { readFileSync } from 'node:fs';
-import { applyHookRulePatches, hookFileStamp } from './rule-file.mjs';
+import { applyHookRulePatches, hookFileStamp, readHookDocument } from './rule-file.mjs';
 import {
   hookConfigEntries,
   mergeEvents,
@@ -61,14 +60,24 @@ export function createConfigLoader({ dataDir, rulesPath, emit, pendingPatches })
     for (const entry of entries) {
       const filePath = entry.path;
       let parsed = null;
+      let damaged = false;
       try {
-        parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+        // The rules file is this module's own (written with a `.bak`): a
+        // damaged copy is restored from it. Other hooks files are only read.
+        parsed = readHookDocument(filePath, {
+          restore: filePath === rulesPath,
+          onDamaged: (error) => {
+            damaged = true;
+            errors.push({ file: filePath, error: error?.message || String(error) });
+          },
+        });
       } catch (error) {
-        if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') continue;
-        if (!(error instanceof SyntaxError)) cacheable = false;
+        cacheable = false;
         errors.push({ file: filePath, error: error?.message || String(error) });
         continue;
       }
+      // Missing, or damaged without a good copy (reported above): no hooks.
+      if (damaged || parsed === null) continue;
       sources.push(filePath);
       sourceEntries.push({
         path: filePath,

package/src/session-runtime/services/hook-bus/rule-file.mjs

@@ -1,7 +1,11 @@
 import { readFileSync, statSync } from 'node:fs';
 import { isDeepStrictEqual } from 'node:util';
-import { writeJsonAtomicSync } from '../../../runtime/shared/atomic-file.mjs';
-import { withFileLockSync } from '../../../runtime/shared/file-lock.mjs';
+import {
+  holdsNoData,
+  parseJsonText,
+  readJsonStateSync,
+  updateJsonAtomicSync,
+} from '../../../runtime/shared/atomic-file.mjs';
 import { normalizeRules } from './config.mjs';
 
 export function hookFileStamp(path) {
@@ -14,13 +18,41 @@ export function hookFileStamp(path) {
   }
 }
 
-export function readHookDocument(path) {
+// The hooks document at `path`, or null when it is missing or damaged (empty,
+// NUL-filled after a crash, or not JSON). A damaged file must not turn every
+// tool call into a policy-check failure, and must not silently drop the deny
+// rules of a good copy: with `restore` (the rules file this module writes with
+// a `.bak`), a valid `<path>.bak` is restored and read — the damaged bytes are
+// kept aside as `<path>.corrupt-<ts>`. Without a good copy the file stays in
+// place (a hand-edit can still fix it) and `onDamaged(error)` reports it; the
+// caller then has no rules from it. Hooks files the user or a plugin owns are
+// read with `restore: false`: never moved, locked or replaced. Real I/O errors
+// still throw.
+export function readHookDocument(path, { restore = true, onDamaged } = {}) {
+  let text;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    text = readFileSync(path, 'utf8');
   } catch (error) {
     if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null;
     throw error;
   }
+  let damage;
+  if (holdsNoData(text)) {
+    damage = new SyntaxError('the file holds no data (empty or NUL-filled)');
+  } else {
+    try {
+      return parseJsonText(text);
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw error;
+      damage = error;
+    }
+  }
+  if (restore) {
+    const restored = readJsonStateSync(path, { fallback: null, keepWithoutBackup: true });
+    if (restored !== null) return restored;
+  }
+  onDamaged?.(damage);
+  return null;
 }
 
 function replaceRules(document, rules) {
@@ -36,13 +68,19 @@ function replaceRules(document, rules) {
 }
 
 export function updateHookRules(path, update) {
-  return withFileLockSync(`${path}.lock`, () => {
-    const document = readHookDocument(path);
-    const rules = normalizeRules(document).filter((rule) => rule && typeof rule === 'object');
-    const next = update(rules);
-    writeJsonAtomicSync(path, replaceRules(document, next), { lock: false });
-    return { stamp: hookFileStamp(path), rules: next };
-  });
+  let next;
+  // A damaged file is kept aside as <path>.corrupt-<ts> (its last good copy
+  // <path>.bak restored) before the update, never overwritten.
+  updateJsonAtomicSync(
+    path,
+    (document) => {
+      const rules = normalizeRules(document).filter((rule) => rule && typeof rule === 'object');
+      next = update(rules);
+      return replaceRules(document, next);
+    },
+    { backup: true }
+  );
+  return { stamp: hookFileStamp(path), rules: next };
 }
 
 export function applyHookRulePatches(rules, patches, { strict = true } = {}) {

package/src/session-runtime/services/plugin-admin.mjs

@@ -3,12 +3,11 @@ import { existsSync, mkdirSync, readdirSync, renameSync, rmSync } from 'node:fs'
 import { basename, dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
-import { withFileLockSync, writeJsonAtomicSync } from '../../runtime/shared/atomic-file.mjs';
+import { readJsonStateSync, updateJsonAtomicSync, withFileLockSync } from '../../runtime/shared/atomic-file.mjs';
 import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { pluginManifest } from '../../runtime/shared/plugin-manifest.mjs';
 import { pluginMetadata } from '../../runtime/shared/plugin-metadata.mjs';
 import { clean } from '../../runtime/shared/clean.mjs';
-import { readJsonSafe } from '../../runtime/shared/json-file.mjs';
 
 const REGISTRY_VERSION = 1;
 
@@ -28,38 +27,39 @@ function installRoot(dataDir = resolvePluginData()) {
   return join(pluginBaseDir(dataDir), 'installed');
 }
 
+const emptyRegistry = () => ({ version: REGISTRY_VERSION, plugins: [] });
+const hasPluginList = (raw) => Boolean(raw && Array.isArray(raw.plugins));
+
+// A damaged registry (empty, NUL-filled after a crash, malformed, or not a
+// plugin list) never blocks the plugin features: its bytes are kept aside as
+// registry.json.corrupt-<ts>, the last good copy registry.json.bak is
+// restored when there is one, else the registry starts empty. I/O errors
+// still throw.
 function loadRegistry(dataDir = resolvePluginData()) {
-  const path = registryPath(dataDir);
-  if (!existsSync(path)) return { version: REGISTRY_VERSION, plugins: [] };
-  const raw = readJsonSafe(path);
-  if (raw && Array.isArray(raw.plugins)) return raw;
-  throw new Error(`plugin registry is corrupt: ${path}`);
+  return readJsonStateSync(registryPath(dataDir), {
+    validate(raw) {
+      if (!hasPluginList(raw)) throw new Error('plugin registry has no plugin list');
+      return raw;
+    },
+    fallback: emptyRegistry(),
+    secret: true,
+  });
 }
 
 function mutateRegistry(dataDir, mutator) {
   const path = registryPath(dataDir);
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  return withFileLockSync(
-    `${path}.lock`,
-    () => {
-      const registry = loadRegistry(dataDir);
-      const result = mutator(registry);
-      writeJsonAtomicSync(
-        path,
-        {
-          version: REGISTRY_VERSION,
-          plugins: Array.isArray(registry.plugins) ? registry.plugins : [],
-        },
-        {
-          lock: false,
-          secret: true,
-          fsyncDir: true,
-        }
-      );
-      return result;
+  let result;
+  updateJsonAtomicSync(
+    path,
+    (raw) => {
+      const registry = hasPluginList(raw) ? raw : emptyRegistry();
+      result = mutator(registry);
+      return { version: REGISTRY_VERSION, plugins: registry.plugins };
     },
-    { secret: true }
+    { secret: true, fsyncDir: true, backup: true }
   );
+  return result;
 }
 
 function displayNameFromUrl(url) {

package/src/session-runtime/services/provider-admin.mjs

@@ -394,7 +394,10 @@ function oauthProviderSetup(p, providers, checkSecrets) {
 
 const CUSTOM_ID_RE = /^custom-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const CUSTOM_TEST_TIMEOUT_MS = 20_000;
-const CUSTOM_DISCOVERY_TIMEOUT_MS = 15_000;
+// A catalog host can sit behind a slow gateway: api.nano-gpt.com's /models
+// answered 503 only after ~44 s, so the wait must outlast that to surface the
+// service's own answer instead of a local timeout.
+const CUSTOM_DISCOVERY_TIMEOUT_MS = 60_000;
 
 export function isCustomProviderConfig(entry) {
   return Boolean(entry) && typeof entry === 'object' && entry.type === 'custom';
@@ -949,7 +952,9 @@ async function withTimeout(run, ms, label) {
   const timeout = new Promise((_, reject) => {
     timer = setTimeout(() => {
       controller.abort();
-      reject(new Error(`${label} timed out after ${Math.round(ms / 1000)}s`));
+      reject(
+        Object.assign(new Error(`${label} timed out after ${Math.round(ms / 1000)}s`), { code: 'EPROVIDERTIMEOUT' })
+      );
     }, ms);
   });
   try {
@@ -1330,7 +1335,11 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
   try {
     const { createCustomProvider } = await loadCustomProviderModule();
     const provider = await createCustomProvider(id || 'custom-discovery', { ...config, apiKey });
-    const listed = await withTimeout(() => provider.listModels(), CUSTOM_DISCOVERY_TIMEOUT_MS, 'model discovery');
+    const listed = await withTimeout(
+      (signal) => provider.listModels({ signal, timeoutMs: CUSTOM_DISCOVERY_TIMEOUT_MS }),
+      CUSTOM_DISCOVERY_TIMEOUT_MS,
+      'model discovery'
+    );
     const models = publicCustomModelRows(listed);
     // A failed discovery that still left manual rows reports its error too.
     const failure = provider.customDiscoveryError;
@@ -1343,8 +1352,9 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
 function discoveryErrorView(error, secrets) {
   const status = Number.isInteger(error?.status) ? error.status : undefined;
   const authKind = status === 401 || status === 403 ? 'authentication' : 'request';
+  const kind = status === 404 || status === 405 ? 'unavailable' : authKind;
   return {
-    kind: status === 404 || status === 405 ? 'unavailable' : authKind,
+    kind: error?.code === 'EPROVIDERTIMEOUT' ? 'timeout' : kind,
     ...(status === undefined ? {} : { status }),
     message: sanitizeCustomError(error, secrets).message,
   };

package/src/session-runtime/services/schedule-access.mjs

@@ -11,17 +11,31 @@
 // - a group-room member session is no background run, but it speaks for the
 //   room, not for the user: it creates or changes no agent, automation or
 //   other setting either.
+// - an unattended run — a routine turn in a bot's home chat (Mixy's too), or
+//   work it or a room started (held-requests.mjs unattendedRunOf) — is checked
+//   first and only ever narrows: at most its own bot's agent scope
+//   (`unattended: true`), which manages that bot's own automations and route
+//   and changes no other setting.
 // The app's own panels call channel-admin directly and act for the human.
 import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 import { roomMemberOfSession } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
 import { mixyDisplayName } from '../../runtime/agent/orchestrator/session/mixy-name.mjs';
 import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+import { unattendedRunOf } from '../held-requests.mjs';
 
 const INTERACTIVE_SOURCE_TYPES = new Set(['', 'lead', 'cli']);
+// What an unattended run may still change: its own bot's automations (each
+// checked by assertAutomationAccess) and its own route (assertOwnAgentSettings).
+const UNATTENDED_OWN_ACTIONS = new Set([
+  'save_automation',
+  'set_automation_enabled',
+  'delete_automation',
+  'run_automation',
+  'set_agent_route',
+]);
 
-/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId? }` of a session record. */
-export function scheduleCallerScope(session) {
-  const id = String(session?.id || '');
+/** The scope by the session's id and record alone. */
+function provenanceScope(session, id) {
   const member = roomMemberOfSession(id);
   if (member) return { kind: 'room-member', agentId: member.agentId };
   const homeAgent = agentIdOfHomeSession(id);
@@ -35,6 +49,17 @@ export function scheduleCallerScope(session) {
   return headless ? { kind: 'headless' } : { kind: 'human' };
 }
 
+/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId?, unattended? }` of a session record. */
+export function scheduleCallerScope(session) {
+  const id = String(session?.id || '');
+  const scope = provenanceScope(session, id);
+  const run = id ? unattendedRunOf(id) : null;
+  if (!run || scope.kind === 'headless' || scope.kind === 'room-member') return scope;
+  if (run.kind === 'room') return { kind: 'room-member', agentId: run.agentId };
+  if (!run.agentId || (scope.kind === 'agent' && scope.agentId !== run.agentId)) return { kind: 'headless' };
+  return { kind: 'agent', agentId: run.agentId, unattended: true };
+}
+
 /** Throws unless `scope` may `action` the `kind` ('schedule' | 'webhook')
  *  automation `current` (null when creating) with `owner` the requested owner
  *  ('' keeps the saved one). `agentIds` are the agents a transfer may name;
@@ -83,8 +108,12 @@ export function assertOwnAgentSettings(scope, agentId, action) {
   }
 }
 
-/** Throws when `scope` is a headless run: it reads settings, never changes them. */
+/** Throws when `scope` is a headless run: it reads settings, never changes
+ *  them; an unattended run changes only its own bot's automations and route. */
 export function assertInteractiveCaller(scope, action) {
+  if (scope?.unattended && !UNATTENDED_OWN_ACTIONS.has(action)) {
+    throw new Error(`An unattended run cannot change settings (setup ${action})`);
+  }
   if (scope?.kind === 'human' || scope?.kind === 'agent') return;
   if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot change settings (setup ${action})`);
   throw new Error(`A background run cannot change settings (setup ${action})`);

package/src/session-runtime/services/seeds.mjs

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { writeFileAtomicSync } from '../../runtime/shared/atomic-file.mjs';
 import { pluginSkillsRoots } from '../../runtime/shared/plugin-manifest.mjs';
 import {
   EMPTY_HISTORY,
@@ -43,7 +44,7 @@ export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
   retireSeededPackCopies({ rootDir, dataDir, backup, includeHistory });
   if (includeHistory && !backup.failures) {
     try {
-      writeFileSync(markerFile, `${stamp}\n`);
+      writeFileAtomicSync(markerFile, `${stamp}\n`);
     } catch {
       /* marker only; the sweep simply repeats */
     }
@@ -68,7 +69,7 @@ function cleanupRetiredChannelSecrets(dataDir) {
         }
       }
       try {
-        writeFileSync(marker, `${new Date().toISOString()}\n`);
+        writeFileAtomicSync(marker, `${new Date().toISOString()}\n`);
       } catch {
         /* marker only */
       }

package/src/session-runtime/services/usage-dashboard.mjs

@@ -92,7 +92,7 @@ function refreshScope(options) {
  *  then resolve whatever usage the provider — or a local budget fallback — can
  *  supply. The row is appended to `rows` before the first emit so every paint
  *  from here on includes it. */
-async function apiProviderRow(item, { config, providers, preview, refreshFor, snapshotOptions, rows, emit }) {
+async function apiProviderRow(item, { providers, preview, snapshotOptions, rows, emit }) {
   const providerCfg = providers[item.id] || {};
   const row = baseRow(item, 'api', providerCfg);
   row.status = row.authenticated ? 'checking' : 'missing';

package/src/session-runtime/services/usage-stats-model.mjs

@@ -535,7 +535,8 @@ function exportUnpricedModels(state) {
   const rows = [];
   for (const provider of state.providers.values()) {
     for (const model of provider.models.values()) {
-      if (model.turns > 0 && model.costKnownTurns < model.turns) rows.push({ provider: provider.provider, model: model.model });
+      if (model.turns > 0 && model.costKnownTurns < model.turns)
+        rows.push({ provider: provider.provider, model: model.model });
     }
   }
   return rows.sort((a, b) => a.provider.localeCompare(b.provider) || a.model.localeCompare(b.model));

package/src/session-runtime/session-create/materialize.mjs

@@ -3,7 +3,6 @@
 // event, and the optional WS transport prewarm.
 import { deferredSurfaceModeForLead } from '../../runtime/agent/orchestrator/runtime-core/effort.mjs';
 import { filterMcpToolsForSession } from '../../runtime/agent/orchestrator/runtime-core/extension-scopes.mjs';
-import { attachSessionHooks } from '../session-hooks.mjs';
 import { applyDeferredToolSurface } from '../../runtime/agent/orchestrator/runtime-core/tool-catalog.mjs';
 import { writeStatuslineRoute } from '../statusline-route.mjs';
 import { sessionOptions } from './session-options.mjs';
@@ -42,10 +41,10 @@ function seedToolSurface(deps, reason) {
 
 /** Adopt the provider session and publish it to hooks and statusline. */
 export function materializeSession(deps, reason, coreMemoryContext) {
-  const { rt, adoptSession, mgr, hooks, hookCommonPayload, statusRoutes } = deps;
+  const { rt, adoptSession, mgr, hooks, statusRoutes } = deps;
+  // adoptSession attaches the hook bridge (boot/infrastructure.mjs sessionAdopter).
   adoptSession(mgr.createSession(sessionOptions(deps, coreMemoryContext)));
   rt.reservedSessionId = null;
-  attachSessionHooks(rt.session, { hooks, hookCommonPayload, getCwd: () => rt.currentCwd });
   seedToolSurface(deps, reason);
   writeStatuslineRoute(statusRoutes, rt.session, rt.route);
   hooks.emit('session:create', {