mixdog 1.3.1 → 1.3.2

package/src/session-runtime/services/agent-tool/restart-notify.mjs

@@ -28,6 +28,16 @@ export function restartNotificationId(row) {
   return `restart:${clean(row.task_id) || `${clean(row.sessionId)}:${clean(row.finishedAt)}`}`;
 }
 
+/** The agent task id an execution id names: a task's own id, or the task a
+ *  restart notification (restartNotificationId) reports; null for one keyed
+ *  by session because its row recorded no task id. */
+export function agentTaskIdOfExecution(executionId) {
+  const id = clean(executionId);
+  if (!id.startsWith('restart:')) return id || null;
+  const rest = id.slice('restart:'.length);
+  return rest && !rest.includes(':') ? rest : null;
+}
+
 /** `pendingRestartFailures()` lists rows whose owner is not yet told;
  *  `markRestartNotified(rows)` stamps them. `mgr` supplies the persisted
  *  pending queue (enqueuePendingMessage / markCompletionEntry /

package/src/session-runtime/services/agent-tool/send-flow.mjs

@@ -17,7 +17,13 @@ import {
 } from './job-task-reconcile.mjs';
 import { createTurnReviewCollector } from './turn-review.mjs';
 import { handoffContent } from '../../handoff-attachments.mjs';
+import { rebindDelegation } from '../../../runtime/agent/orchestrator/session/human-gate/delegation.mjs';
 import { settledWorkerStatus } from './worker-index/row-liveness.mjs';
+import { whileTurnDispatched } from '../../../runtime/agent/orchestrator/session/manager/runtime-state.mjs';
+
+function workerResultIdentity({ session, tag, sessionId }) {
+  return { tag, sessionId, agent: session.agent || null, provider: session.provider, model: session.model };
+}
 
 // `send` to an existing worker: resolve the live session, run one follow-up
 // turn under the progress watchdog, and reconcile the job/worker row. Busy
@@ -42,11 +48,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return (result) => {
       const abnormalError = abnormalEmptyFinishError(result, session.agent || sendAgent);
       return {
-        tag,
-        sessionId,
-        agent: session.agent || null,
-        provider: session.provider,
-        model: session.model,
+        ...workerResultIdentity({ session, tag, sessionId }),
         content: result?.content || '',
         ...(sessionSurface?.canonical === true ? { handoffOnly: true } : {}),
         ...(abnormalError ? { error: abnormalError } : {}),
@@ -74,10 +76,12 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     const cwd = session.cwd || defaultCwd;
     // The caller's forwarded files ride along as attachment parts.
     const prompt = handoffContent(text, args.attachmentParts);
-    if (canUseSessionSurface(session)) {
-      return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd, ...turnHooks });
-    }
-    return mgr.askSession(sessionId, prompt, args.context || null, null, cwd, null, turnHooks);
+    return whileTurnDispatched(sessionId, () => {
+      if (canUseSessionSurface(session)) {
+        return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd, ...turnHooks });
+      }
+      return mgr.askSession(sessionId, prompt, args.context || null, null, cwd, null, turnHooks);
+    });
   }
 
   async function runSend(prepared, notifyContext = null, job = null) {
@@ -110,11 +114,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     const settleCancelled = (error, result = null) => {
       finalStatus = 'cancelled';
       reconcileJobCancelled(job, {
-        tag,
-        sessionId,
-        agent: session.agent || null,
-        provider: session.provider,
-        model: session.model,
+        ...workerResultIdentity({ session, tag, sessionId }),
         content: turnPartialHandoff(error, mgr.getSession(sessionId), handoffMsgStart) || result?.content || '',
       });
     };
@@ -145,11 +145,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       if (partial) {
         finalStatus = 'idle';
         const value = {
-          tag,
-          sessionId,
-          agent: session.agent || null,
-          provider: session.provider,
-          model: session.model,
+          ...workerResultIdentity({ session, tag, sessionId }),
           content: watchdogStoppedHandoff(error, partial),
           stallAbort: true,
         };
@@ -164,7 +160,7 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
       turnReview.complete();
       watchdog?.stop?.();
       registry.upsertWorkerSessionDeferred(session, tag, {
-        ...settledWorkerStatus(finalStatus, stalled),
+        ...settledWorkerStatus(finalStatus, stalled, job),
         finishedAt: new Date().toISOString(),
       });
       reconcileJobFinally(job, finalStatus);
@@ -188,6 +184,14 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return { ...prepared, session: mgr.getSession(sessionId) || session };
   }
 
+  // The calling session hands this worker new work (a `send`, or a spawn of its
+  // tag): from now on the worker acts as that caller does, so a run's worker
+  // asks when the attended chat reuses it and the other way round. Not for a
+  // completion wake, which is the worker's own continuation.
+  function adoptCaller({ sessionId }, notifyContext) {
+    return rebindDelegation(sessionId, notifyContext?.callerSessionId);
+  }
+
   // Shared send dispatch for an already-resolved live session. Used by the
   // `send` branch AND by the `spawn` branch when an explicit tag maps to a
   // live session (reuse path). Busy sessions queue the prompt; idle ones run a
@@ -255,5 +259,5 @@ export function createSendFlow({ mgr, defaultCwd, sessionSurface, canUseSessionS
     return true;
   }
 
-  return { prepareSend, dispatchToExistingSession, wakeIdleWorker };
+  return { prepareSend, adoptCaller, dispatchToExistingSession, wakeIdleWorker };
 }

package/src/session-runtime/services/agent-tool/spawn-flow/job-start.mjs

@@ -4,6 +4,7 @@
  * agent work, and status publication at start and after terminal settlement.
  */
 import { sanitizeTaskMeta, startBackgroundTask } from '../../../../runtime/shared/background-tasks.mjs';
+import { recordAgentTaskStart } from '../../../../runtime/shared/agent-task-starts.mjs';
 import { resourceAdmission } from '../../../../runtime/shared/resource-admission.mjs';
 import { clean, terminalPidForContext } from '../helpers.mjs';
 import { renderResult } from '../render.mjs';
@@ -82,6 +83,9 @@ export function createJobStarter({ mgr, notifyStatusChange, notifySessionComplet
         }
       },
     });
+    // The model's tool call that started this job owns it (its result message
+    // carries the id: agent-task-starts.mjs).
+    recordAgentTaskStart(notifyContext?.toolCallId, task.taskId);
     notifyStatusChange();
     return task;
   };

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-prep.mjs

@@ -9,6 +9,7 @@ import { resolveAgentWatchdogPolicy } from '../../../../runtime/agent/orchestrat
 import { prepareAgentSession } from '../../../../runtime/agent/orchestrator/agent-runtime/session-builder.mjs';
 import { getProvider } from '../../../../runtime/agent/orchestrator/providers/registry.mjs';
 import { resolveRouteContextState } from '../../../route-state.mjs';
+import { contextSelectionFromState } from '../../../../runtime/agent/orchestrator/runtime-core/route-context-state.mjs';
 import { createSpawnPlanner } from './spawn-plan.mjs';
 import { enterWorkerSpawn } from '../../../workspace/admission-gate.mjs';
 
@@ -97,11 +98,13 @@ export function createSpawnPreparer({
 
   async function createSpawnedSession(plan, spec, prepState) {
     // A sub-100 context share needs the window it selects; a percent alone
-    // keeps the full served window.
+    // keeps the full served window. A model whose window is not known yet
+    // resolves to nothing: the agent's own choice then travels as stored (the
+    // session sizes it from the provider's window) instead of being dropped
+    // for the model's default.
     const sessionSpec = { ...spec };
     if (plan.preset.contextPercent || plan.preset.contextTokens) {
-      const { contextPercent, selectedContextWindow, contextTokens } = resolveRouteContextState(plan.preset, null);
-      Object.assign(sessionSpec, { contextPercent, selectedContextWindow }, contextTokens ? { contextTokens } : {});
+      Object.assign(sessionSpec, contextSelectionFromState(resolveRouteContextState(plan.preset, null), plan.preset));
     }
     if (sessionSurface?.canonical === true && typeof sessionSurface.createChild === 'function') {
       return sessionSurface.createChild({ spec: sessionSpec, prompt: plan.prompt, tag: plan.tag });

package/src/session-runtime/services/agent-tool/spawn-flow/spawn-run.mjs

@@ -26,6 +26,7 @@ import { saveSessionAsync } from '../../../../runtime/agent/orchestrator/session
 import { presetDescriptor } from './spawn-prep.mjs';
 import { workerStageForStatus } from '../worker-rows.mjs';
 import { handoffContent } from '../../../handoff-attachments.mjs';
+import { whileTurnDispatched } from '../../../../runtime/agent/orchestrator/session/manager/runtime-state.mjs';
 
 // Mid-turn worker persistence cadence. The watchdog sweep runs every second;
 // a transcript save is far more expensive than a bookkeeping stamp, so the
@@ -121,10 +122,12 @@ export function createSpawnRunner({
     const { args, session, workerCwd } = prepared;
     // The caller's forwarded files ride along as attachment parts.
     const prompt = handoffContent(prepared.prompt, args.attachmentParts);
-    if (typeof sessionSurface?.runTurn === 'function' && sessionSurface.canRun?.(session) !== false) {
-      return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd: workerCwd, ...turnHooks });
-    }
-    return mgr.askSession(session.id, prompt, args.context || null, null, workerCwd, null, turnHooks);
+    return whileTurnDispatched(session.id, () => {
+      if (typeof sessionSurface?.runTurn === 'function' && sessionSurface.canRun?.(session) !== false) {
+        return sessionSurface.runTurn({ session, prompt, context: args.context || null, cwd: workerCwd, ...turnHooks });
+      }
+      return mgr.askSession(session.id, prompt, args.context || null, null, workerCwd, null, turnHooks);
+    });
   }
 
   async function runSpawn(prepared, notifyContext = null, job = null) {
@@ -221,7 +224,7 @@ export function createSpawnRunner({
       watchdog?.stop?.();
       upsertWorkerSessionDeferred(session, tag, {
         ...presetDescriptor(agent, preset, presetName),
-        ...settledWorkerStatus(finalStatus, stalled),
+        ...settledWorkerStatus(finalStatus, stalled, job),
         finishedAt: new Date().toISOString(),
       });
       setImmediate(notifyStatusChange);

package/src/session-runtime/services/agent-tool/worker-index/row-liveness.mjs

@@ -31,10 +31,30 @@ export const PROCESS_RESTART_FAILURE = 'process-restart';
 /** The row's turn was stopped by the progress (stall) watchdog. */
 export const WATCHDOG_STALL_FAILURE = 'stalled';
 
+/** A failed row whose turn a process restart ended and whose owner has not
+ *  been told yet (restart-notify). It is the only record of that owed result,
+ *  so closing the worker never drops it. */
+export const isUnnotifiedRestartFailure = (row) =>
+  row?.status === 'failed' &&
+  row.failureReason === PROCESS_RESTART_FAILURE &&
+  Boolean(clean(row.ownerSessionId)) &&
+  !row.restartNotified;
+
 /** A turn's settled row status and failure reason: a watchdog stop is a
  *  failure whatever partial output it handed back (`finalStatus` may still
- *  read `idle` for the job's sake); everything else keeps `finalStatus`. */
-export function settledWorkerStatus(finalStatus, stalled) {
+ *  read `idle` for the job's sake); a turn the process exit cut off (its `job`
+ *  cancelled with terminalReason PROCESS_RESTART_FAILURE, lifecycle/teardown)
+ *  fails as a restart failure under its task id, which the next process tells
+ *  its owner; everything else keeps `finalStatus`. */
+export function settledWorkerStatus(finalStatus, stalled, job = null) {
+  if (job?.status === 'cancelled' && job.terminalReason === PROCESS_RESTART_FAILURE) {
+    return {
+      status: 'failed',
+      stage: 'failed',
+      failureReason: PROCESS_RESTART_FAILURE,
+      ...(job.taskId ? { task_id: job.taskId } : {}),
+    };
+  }
   return stalled
     ? { status: 'failed', stage: 'failed', failureReason: WATCHDOG_STALL_FAILURE }
     : { status: finalStatus, stage: finalStatus };

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -22,6 +22,7 @@ import {
   createRowLiveness,
   isActiveWorkerRow,
   isStaleApprovalWait,
+  isUnnotifiedRestartFailure,
   PROCESS_RESTART_FAILURE,
   runtimeDied,
 } from './worker-index/row-liveness.mjs';
@@ -101,12 +102,15 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   const rowFromSession = (session, fallbackTag = '', extra = {}) =>
     workerRowFromSession(session, fallbackTag, extra, (sessionId) => mgr.getSessionRuntime?.(sessionId));
 
+  // A row whose owner is still owed its restart failure stays: closing the
+  // worker (a process exit closes every one) must not lose that result.
   function removeWorkerRow({ tag = '', sessionId = '' } = {}) {
     const targetTag = clean(tag);
     const targetSessionId = clean(sessionId);
     batch.flush();
     store.write((byKey) => {
       for (const [key, row] of [...byKey.entries()]) {
+        if (isUnnotifiedRestartFailure(row)) continue;
         if ((targetSessionId && row.sessionId === targetSessionId) || (targetTag && row.tag === targetTag)) {
           byKey.delete(key);
         }
@@ -194,12 +198,6 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     return true;
   }
 
-  const isUnnotifiedRestartFailure = (row) =>
-    row.status === 'failed' &&
-    row.failureReason === PROCESS_RESTART_FAILURE &&
-    Boolean(clean(row.ownerSessionId)) &&
-    !row.restartNotified;
-
   /** Rows whose turn a process restart ended and whose owner has not been told
    *  yet — whoever settled the row (this process at startup, or the
    *  predecessor's exit flush). Read-only: the caller enqueues the owner's

package/src/session-runtime/services/agent-tool.mjs

@@ -169,6 +169,12 @@ export function createStandaloneAgent({
     },
     getStatus,
     recoverWorkers,
+    // Daemon start: settle the rows the previous process left running and
+    // queue each owner's failure result; resolves once they are queued.
+    settleRestartFailures: () => {
+      registry.recoverStaleWorkerRows({ deadOnly: true });
+      return notifyRestartFailures();
+    },
     upsertLeadSession: registry.upsertLeadSession,
     updateLeadWorkerCwd: registry.updateLeadWorkerCwd,
     forgetLeadSession: registry.forgetLeadSession,

package/src/session-runtime/services/daemon-crash-capture/daemon-exit-record.mjs

@@ -165,7 +165,7 @@ export function reconcileLostDaemonCaptures({
   for (const name of names) {
     const file = path.join(dir, name);
     const record = readRecord(file);
-    if (!record || record.kind !== 'mixdog-daemon-crash-capture') continue;
+    if (record?.kind !== 'mixdog-daemon-crash-capture') continue;
     if (!record.pid || record.pid === selfPid || record.exitedAt || record.daemonExit || record.exitReason) continue;
     if (pidAlive(record.pid)) continue;
     try {

package/src/session-runtime/services/daemon-crash-capture/retention.mjs

@@ -21,9 +21,10 @@ import { daemonCrashCaptureDir } from './paths.mjs';
 // Prune only files this module creates: `daemon-<yyyymmdd>-<hhmmss>-<pid>-<rand>`.
 const CAPTURE_STEM_RE = /^daemon-\d{8}-\d{6}-\d+-[0-9a-f]{4}$/;
 const CAPTURE_SUFFIXES = ['.err.log', '.json'];
-// Debris from this module's own atomic sidecar writes (writeFileAtomicSync
-// names its temp `.<basename>.<hex>.tmp`), never anyone else's file.
-const CAPTURE_TEMP_RE = /^\.daemon-\d{8}-\d{6}-(\d+)-[0-9a-f]{4}\.json\.[0-9a-f]+\.tmp$/;
+// Debris from this module's own atomic sidecar writes (the atomic writer names
+// its temp `<basename>.mixdog-tmp-<hex>`; older builds `.<basename>.<hex>.tmp`),
+// never anyone else's file.
+const CAPTURE_TEMP_RE = /^\.?daemon-\d{8}-\d{6}-(\d+)-[0-9a-f]{4}\.json\.(?:[0-9a-f]+\.tmp|mixdog-tmp-[0-9a-f]+)$/;
 export const CRASH_CAPTURE_KEEP_BOOTS = 8;
 const CRASH_CAPTURE_KEEP_BYTES = 2 * 1024 * 1024;
 const CRASH_CAPTURE_TAIL_BYTES = 256 * 1024;

package/src/session-runtime/services/hook-bus/config-loader.mjs

@@ -4,8 +4,7 @@
  * file-stamp set, standard events merged, legacy rules collected, and the
  * parse errors both reported and recorded on the result.
  */
-import { readFileSync } from 'node:fs';
-import { applyHookRulePatches, hookFileStamp } from './rule-file.mjs';
+import { applyHookRulePatches, hookFileStamp, readHookDocument } from './rule-file.mjs';
 import {
   hookConfigEntries,
   mergeEvents,
@@ -61,14 +60,24 @@ export function createConfigLoader({ dataDir, rulesPath, emit, pendingPatches })
     for (const entry of entries) {
       const filePath = entry.path;
       let parsed = null;
+      let damaged = false;
       try {
-        parsed = JSON.parse(readFileSync(filePath, 'utf8'));
+        // The rules file is this module's own (written with a `.bak`): a
+        // damaged copy is restored from it. Other hooks files are only read.
+        parsed = readHookDocument(filePath, {
+          restore: filePath === rulesPath,
+          onDamaged: (error) => {
+            damaged = true;
+            errors.push({ file: filePath, error: error?.message || String(error) });
+          },
+        });
       } catch (error) {
-        if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') continue;
-        if (!(error instanceof SyntaxError)) cacheable = false;
+        cacheable = false;
         errors.push({ file: filePath, error: error?.message || String(error) });
         continue;
       }
+      // Missing, or damaged without a good copy (reported above): no hooks.
+      if (damaged || parsed === null) continue;
       sources.push(filePath);
       sourceEntries.push({
         path: filePath,

package/src/session-runtime/services/hook-bus/rule-file.mjs

@@ -1,7 +1,11 @@
 import { readFileSync, statSync } from 'node:fs';
 import { isDeepStrictEqual } from 'node:util';
-import { writeJsonAtomicSync } from '../../../runtime/shared/atomic-file.mjs';
-import { withFileLockSync } from '../../../runtime/shared/file-lock.mjs';
+import {
+  holdsNoData,
+  parseJsonText,
+  readJsonStateSync,
+  updateJsonAtomicSync,
+} from '../../../runtime/shared/atomic-file.mjs';
 import { normalizeRules } from './config.mjs';
 
 export function hookFileStamp(path) {
@@ -14,13 +18,41 @@ export function hookFileStamp(path) {
   }
 }
 
-export function readHookDocument(path) {
+// The hooks document at `path`, or null when it is missing or damaged (empty,
+// NUL-filled after a crash, or not JSON). A damaged file must not turn every
+// tool call into a policy-check failure, and must not silently drop the deny
+// rules of a good copy: with `restore` (the rules file this module writes with
+// a `.bak`), a valid `<path>.bak` is restored and read — the damaged bytes are
+// kept aside as `<path>.corrupt-<ts>`. Without a good copy the file stays in
+// place (a hand-edit can still fix it) and `onDamaged(error)` reports it; the
+// caller then has no rules from it. Hooks files the user or a plugin owns are
+// read with `restore: false`: never moved, locked or replaced. Real I/O errors
+// still throw.
+export function readHookDocument(path, { restore = true, onDamaged } = {}) {
+  let text;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    text = readFileSync(path, 'utf8');
   } catch (error) {
     if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null;
     throw error;
   }
+  let damage;
+  if (holdsNoData(text)) {
+    damage = new SyntaxError('the file holds no data (empty or NUL-filled)');
+  } else {
+    try {
+      return parseJsonText(text);
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw error;
+      damage = error;
+    }
+  }
+  if (restore) {
+    const restored = readJsonStateSync(path, { fallback: null, keepWithoutBackup: true });
+    if (restored !== null) return restored;
+  }
+  onDamaged?.(damage);
+  return null;
 }
 
 function replaceRules(document, rules) {
@@ -36,13 +68,19 @@ function replaceRules(document, rules) {
 }
 
 export function updateHookRules(path, update) {
-  return withFileLockSync(`${path}.lock`, () => {
-    const document = readHookDocument(path);
-    const rules = normalizeRules(document).filter((rule) => rule && typeof rule === 'object');
-    const next = update(rules);
-    writeJsonAtomicSync(path, replaceRules(document, next), { lock: false });
-    return { stamp: hookFileStamp(path), rules: next };
-  });
+  let next;
+  // A damaged file is kept aside as <path>.corrupt-<ts> (its last good copy
+  // <path>.bak restored) before the update, never overwritten.
+  updateJsonAtomicSync(
+    path,
+    (document) => {
+      const rules = normalizeRules(document).filter((rule) => rule && typeof rule === 'object');
+      next = update(rules);
+      return replaceRules(document, next);
+    },
+    { backup: true }
+  );
+  return { stamp: hookFileStamp(path), rules: next };
 }
 
 export function applyHookRulePatches(rules, patches, { strict = true } = {}) {

package/src/session-runtime/services/plugin-admin.mjs

@@ -3,12 +3,11 @@ import { existsSync, mkdirSync, readdirSync, renameSync, rmSync } from 'node:fs'
 import { basename, dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
-import { withFileLockSync, writeJsonAtomicSync } from '../../runtime/shared/atomic-file.mjs';
+import { readJsonStateSync, updateJsonAtomicSync, withFileLockSync } from '../../runtime/shared/atomic-file.mjs';
 import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { pluginManifest } from '../../runtime/shared/plugin-manifest.mjs';
 import { pluginMetadata } from '../../runtime/shared/plugin-metadata.mjs';
 import { clean } from '../../runtime/shared/clean.mjs';
-import { readJsonSafe } from '../../runtime/shared/json-file.mjs';
 
 const REGISTRY_VERSION = 1;
 
@@ -28,38 +27,39 @@ function installRoot(dataDir = resolvePluginData()) {
   return join(pluginBaseDir(dataDir), 'installed');
 }
 
+const emptyRegistry = () => ({ version: REGISTRY_VERSION, plugins: [] });
+const hasPluginList = (raw) => Boolean(raw && Array.isArray(raw.plugins));
+
+// A damaged registry (empty, NUL-filled after a crash, malformed, or not a
+// plugin list) never blocks the plugin features: its bytes are kept aside as
+// registry.json.corrupt-<ts>, the last good copy registry.json.bak is
+// restored when there is one, else the registry starts empty. I/O errors
+// still throw.
 function loadRegistry(dataDir = resolvePluginData()) {
-  const path = registryPath(dataDir);
-  if (!existsSync(path)) return { version: REGISTRY_VERSION, plugins: [] };
-  const raw = readJsonSafe(path);
-  if (raw && Array.isArray(raw.plugins)) return raw;
-  throw new Error(`plugin registry is corrupt: ${path}`);
+  return readJsonStateSync(registryPath(dataDir), {
+    validate(raw) {
+      if (!hasPluginList(raw)) throw new Error('plugin registry has no plugin list');
+      return raw;
+    },
+    fallback: emptyRegistry(),
+    secret: true,
+  });
 }
 
 function mutateRegistry(dataDir, mutator) {
   const path = registryPath(dataDir);
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  return withFileLockSync(
-    `${path}.lock`,
-    () => {
-      const registry = loadRegistry(dataDir);
-      const result = mutator(registry);
-      writeJsonAtomicSync(
-        path,
-        {
-          version: REGISTRY_VERSION,
-          plugins: Array.isArray(registry.plugins) ? registry.plugins : [],
-        },
-        {
-          lock: false,
-          secret: true,
-          fsyncDir: true,
-        }
-      );
-      return result;
+  let result;
+  updateJsonAtomicSync(
+    path,
+    (raw) => {
+      const registry = hasPluginList(raw) ? raw : emptyRegistry();
+      result = mutator(registry);
+      return { version: REGISTRY_VERSION, plugins: registry.plugins };
     },
-    { secret: true }
+    { secret: true, fsyncDir: true, backup: true }
   );
+  return result;
 }
 
 function displayNameFromUrl(url) {

package/src/session-runtime/services/provider-admin.mjs

@@ -394,7 +394,10 @@ function oauthProviderSetup(p, providers, checkSecrets) {
 
 const CUSTOM_ID_RE = /^custom-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const CUSTOM_TEST_TIMEOUT_MS = 20_000;
-const CUSTOM_DISCOVERY_TIMEOUT_MS = 15_000;
+// A catalog host can sit behind a slow gateway: api.nano-gpt.com's /models
+// answered 503 only after ~44 s, so the wait must outlast that to surface the
+// service's own answer instead of a local timeout.
+const CUSTOM_DISCOVERY_TIMEOUT_MS = 60_000;
 
 export function isCustomProviderConfig(entry) {
   return Boolean(entry) && typeof entry === 'object' && entry.type === 'custom';
@@ -949,7 +952,9 @@ async function withTimeout(run, ms, label) {
   const timeout = new Promise((_, reject) => {
     timer = setTimeout(() => {
       controller.abort();
-      reject(new Error(`${label} timed out after ${Math.round(ms / 1000)}s`));
+      reject(
+        Object.assign(new Error(`${label} timed out after ${Math.round(ms / 1000)}s`), { code: 'EPROVIDERTIMEOUT' })
+      );
     }, ms);
   });
   try {
@@ -1330,7 +1335,11 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
   try {
     const { createCustomProvider } = await loadCustomProviderModule();
     const provider = await createCustomProvider(id || 'custom-discovery', { ...config, apiKey });
-    const listed = await withTimeout(() => provider.listModels(), CUSTOM_DISCOVERY_TIMEOUT_MS, 'model discovery');
+    const listed = await withTimeout(
+      (signal) => provider.listModels({ signal, timeoutMs: CUSTOM_DISCOVERY_TIMEOUT_MS }),
+      CUSTOM_DISCOVERY_TIMEOUT_MS,
+      'model discovery'
+    );
     const models = publicCustomModelRows(listed);
     // A failed discovery that still left manual rows reports its error too.
     const failure = provider.customDiscoveryError;
@@ -1343,8 +1352,9 @@ export async function discoverCustomProviderModels(cfgMod, rawInput) {
 function discoveryErrorView(error, secrets) {
   const status = Number.isInteger(error?.status) ? error.status : undefined;
   const authKind = status === 401 || status === 403 ? 'authentication' : 'request';
+  const kind = status === 404 || status === 405 ? 'unavailable' : authKind;
   return {
-    kind: status === 404 || status === 405 ? 'unavailable' : authKind,
+    kind: error?.code === 'EPROVIDERTIMEOUT' ? 'timeout' : kind,
     ...(status === undefined ? {} : { status }),
     message: sanitizeCustomError(error, secrets).message,
   };

package/src/session-runtime/services/schedule-access.mjs

@@ -11,17 +11,31 @@
 // - a group-room member session is no background run, but it speaks for the
 //   room, not for the user: it creates or changes no agent, automation or
 //   other setting either.
+// - an unattended run — a routine turn in a bot's home chat (Mixy's too), or
+//   work it or a room started (held-requests.mjs unattendedRunOf) — is checked
+//   first and only ever narrows: at most its own bot's agent scope
+//   (`unattended: true`), which manages that bot's own automations and route
+//   and changes no other setting.
 // The app's own panels call channel-admin directly and act for the human.
 import { MIXY_AGENT_ID, agentIdOfHomeSession } from '../../runtime/agent/orchestrator/session/agent-home.mjs';
 import { roomMemberOfSession } from '../../runtime/agent/orchestrator/session/agent-room.mjs';
 import { mixyDisplayName } from '../../runtime/agent/orchestrator/session/mixy-name.mjs';
 import { isAgentOwner } from '../../runtime/agent/orchestrator/agent-owner.mjs';
+import { unattendedRunOf } from '../held-requests.mjs';
 
 const INTERACTIVE_SOURCE_TYPES = new Set(['', 'lead', 'cli']);
+// What an unattended run may still change: its own bot's automations (each
+// checked by assertAutomationAccess) and its own route (assertOwnAgentSettings).
+const UNATTENDED_OWN_ACTIONS = new Set([
+  'save_automation',
+  'set_automation_enabled',
+  'delete_automation',
+  'run_automation',
+  'set_agent_route',
+]);
 
-/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId? }` of a session record. */
-export function scheduleCallerScope(session) {
-  const id = String(session?.id || '');
+/** The scope by the session's id and record alone. */
+function provenanceScope(session, id) {
   const member = roomMemberOfSession(id);
   if (member) return { kind: 'room-member', agentId: member.agentId };
   const homeAgent = agentIdOfHomeSession(id);
@@ -35,6 +49,17 @@ export function scheduleCallerScope(session) {
   return headless ? { kind: 'headless' } : { kind: 'human' };
 }
 
+/** `{ kind: 'human' | 'agent' | 'room-member' | 'headless', agentId?, unattended? }` of a session record. */
+export function scheduleCallerScope(session) {
+  const id = String(session?.id || '');
+  const scope = provenanceScope(session, id);
+  const run = id ? unattendedRunOf(id) : null;
+  if (!run || scope.kind === 'headless' || scope.kind === 'room-member') return scope;
+  if (run.kind === 'room') return { kind: 'room-member', agentId: run.agentId };
+  if (!run.agentId || (scope.kind === 'agent' && scope.agentId !== run.agentId)) return { kind: 'headless' };
+  return { kind: 'agent', agentId: run.agentId, unattended: true };
+}
+
 /** Throws unless `scope` may `action` the `kind` ('schedule' | 'webhook')
  *  automation `current` (null when creating) with `owner` the requested owner
  *  ('' keeps the saved one). `agentIds` are the agents a transfer may name;
@@ -83,8 +108,12 @@ export function assertOwnAgentSettings(scope, agentId, action) {
   }
 }
 
-/** Throws when `scope` is a headless run: it reads settings, never changes them. */
+/** Throws when `scope` is a headless run: it reads settings, never changes
+ *  them; an unattended run changes only its own bot's automations and route. */
 export function assertInteractiveCaller(scope, action) {
+  if (scope?.unattended && !UNATTENDED_OWN_ACTIONS.has(action)) {
+    throw new Error(`An unattended run cannot change settings (setup ${action})`);
+  }
   if (scope?.kind === 'human' || scope?.kind === 'agent') return;
   if (scope?.kind === 'room-member') throw new Error(`A group-room member cannot change settings (setup ${action})`);
   throw new Error(`A background run cannot change settings (setup ${action})`);

package/src/session-runtime/services/seeds.mjs

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { writeFileAtomicSync } from '../../runtime/shared/atomic-file.mjs';
 import { pluginSkillsRoots } from '../../runtime/shared/plugin-manifest.mjs';
 import {
   EMPTY_HISTORY,
@@ -43,7 +44,7 @@ export function ensureStandaloneEnvironment({ rootDir, dataDir }) {
   retireSeededPackCopies({ rootDir, dataDir, backup, includeHistory });
   if (includeHistory && !backup.failures) {
     try {
-      writeFileSync(markerFile, `${stamp}\n`);
+      writeFileAtomicSync(markerFile, `${stamp}\n`);
     } catch {
       /* marker only; the sweep simply repeats */
     }
@@ -68,7 +69,7 @@ function cleanupRetiredChannelSecrets(dataDir) {
         }
       }
       try {
-        writeFileSync(marker, `${new Date().toISOString()}\n`);
+        writeFileAtomicSync(marker, `${new Date().toISOString()}\n`);
       } catch {
         /* marker only */
       }