mixdog 1.3.1 → 1.3.2

package/src/tui/session/tool-approval.mjs

@@ -5,26 +5,65 @@
  * active one into store state (state.toolApproval). They need live session
  * state, so the closure identifiers (state/set/nextId/disposed/timeout) are
  * threaded through the factory argument via getters — never stale snapshots.
+ *
+ * Delegation (`surfaceOf`, human-gate/gate.mjs approvalSurface): a sub-agent's
+ * approval is also offered to the top-level conversation the user watches
+ * (runtime/shared/delegated-approval-host.mjs), labelled with the agent chain.
+ * That session's queue holds a copy (`mirror`): it never times out, survives
+ * that session's own turn ending, and its answer is forwarded to the owning
+ * queue, so either place settles the one request once.
  */
 import {
   humanRequestFields,
   normalizeHumanResponse,
 } from '../../runtime/agent/orchestrator/session/human-gate/requests.mjs';
+import {
+  delegateApproval,
+  delegatedApprovalsFor,
+  registerApprovalQueue,
+  withdrawDelegatedApproval,
+} from '../../runtime/shared/delegated-approval-host.mjs';
+
+/** Approvals a sub-agent shows in the top-level chat too; a question, a secret
+ *  or a takeover stays in its own session (its answer or window is there). */
+const DELEGATED_KINDS = new Set(['', 'approval', 'outbound', 'permission']);
 
-export function createToolApproval({ getState, set, nextId, getDisposed, timeoutMs }) {
+/** The wait limit an approval has when its request names none, from
+ *  MIXDOG_TOOL_APPROVAL_TIMEOUT_MS (milliseconds, one second at least): null —
+ *  no limit — unless the variable sets one, which tests and ops use. An
+ *  approval waits until the user answers, Stop/turn abort denies it, or its
+ *  runtime closes. */
+export function resolveToolApprovalTimeoutMs(env = process.env) {
+  const value = Number(env.MIXDOG_TOOL_APPROVAL_TIMEOUT_MS);
+  return Number.isFinite(value) && value > 0 ? Math.max(1000, Math.round(value)) : null;
+}
+
+export function createToolApproval({ getState, set, nextId, getDisposed, timeoutMs = null, surfaceOf = null }) {
+  const defaultTimeoutMs = Number.isFinite(Number(timeoutMs)) && Number(timeoutMs) > 0 ? Number(timeoutMs) : null;
   const toolApprovalQueue = [];
   let activeToolApproval = null;
+  const ownSessionId = () => String(getState()?.sessionId || '');
+  const unregister =
+    typeof surfaceOf === 'function'
+      ? registerApprovalQueue({
+          sessionId: ownSessionId,
+          disposed: () => getDisposed(),
+          offer: offerDelegatedApproval,
+          withdraw: withdrawDelegatedCopy,
+        })
+      : () => {};
 
   function normalizeToolApprovalRequest(input = {}, id = nextId()) {
     const now = Date.now();
     // An explicit `timeoutMs: null` means no wait limit (no timer, no expiry);
-    // any other missing/invalid value falls back to the session default.
+    // any other missing/invalid value falls back to the session default,
+    // which is itself no limit unless the runtime configures one.
     const requestTimeoutMs =
       input?.timeoutMs === null
         ? null
         : Number.isFinite(Number(input?.timeoutMs)) && Number(input.timeoutMs) > 0
           ? Number(input.timeoutMs)
-          : timeoutMs;
+          : defaultTimeoutMs;
     return {
       id,
       name: String(input?.name || input?.tool_name || 'tool'),
@@ -41,12 +80,14 @@ export function createToolApproval({ getState, set, nextId, getDisposed, timeout
       ...humanRequestFields(input),
     };
   }
-  // Every request expires from ITS OWN requestedAt, queued or active. Arming
-  // the timer only on presentation let a queued request sit past expiresAt
-  // (retaining its promise and surfacing an obsolete approval later).
+  // A request that has a limit expires from ITS OWN requestedAt, queued or
+  // active. Arming the timer only on presentation let a queued request sit past
+  // expiresAt (retaining its promise and surfacing an obsolete approval later).
+  // One without a limit (expiresAt null — the default) arms nothing.
   function armToolApprovalTimeout(entry) {
-    if (!entry || entry.timer || entry.request?.expiresAt === null) return;
-    const remainingMs = Math.max(0, Number(entry.request?.expiresAt || 0) - Date.now());
+    // A copy expires with its owner, which withdraws it.
+    if (!entry || entry.mirror || entry.timer || !Number.isFinite(entry.request?.expiresAt)) return;
+    const remainingMs = Math.max(0, entry.request.expiresAt - Date.now());
     entry.timer = setTimeout(() => {
       finishToolApproval(entry.id, false, 'approval timed out', '', undefined, undefined, { timedOut: true });
     }, remainingMs);
@@ -55,21 +96,75 @@ export function createToolApproval({ getState, set, nextId, getDisposed, timeout
   // Settle one entry: drop its timeout, then hand the waiter its answer. The
   // resolve stays guarded — a waiter whose caller already went away must never
   // take the rest of the queue down with it.
-  function settleToolApproval(entry, approved, reason, answers, reply, extra, device = '') {
+  function settleToolApproval(entry, approved, reason, answers, reply, extra, device = '', forwarded = false) {
     if (entry?.timer) clearTimeout(entry.timer);
     const result = { approved, reason };
     if (answers !== undefined) result.answers = answers;
     if (reply !== undefined) result.reply = reply;
-    // A human-kind request answers with its canonical response (never a value).
-    if (entry?.request?.remember) {
-      Object.assign(result, normalizeHumanResponse(entry.request, approved, extra));
+    // A human-kind request answers with its canonical response (never a value),
+    // judged against what the answering place offered: this queue's own view,
+    // or — answered on its copy — the full request the copy already narrowed.
+    const answered = forwarded ? entry?.full || entry?.request : entry?.request;
+    if (answered?.remember) {
+      Object.assign(result, normalizeHumanResponse(answered, approved, extra));
       if (device) result.device = device;
     }
     if (extra?.timedOut === true) result.timedOut = true;
+    // Settled here: its copy in the top-level chat goes away.
+    if (entry?.delegated) withdrawDelegatedApproval(entry.id, { approved, device });
     try {
       entry.resolve(result);
     } catch {}
   }
+  /** Hand a copy's answer to the queue that owns the request; false when the
+   *  owner had already settled it. */
+  function forwardToOwner(entry, approved, reason, device, answers, reply, extra) {
+    try {
+      return entry.mirror.answer(approved, reason, device, answers, reply, onlyOffered(entry.request, extra)) === true;
+    } catch {
+      return false;
+    }
+  }
+  /** `request` as this session shows it: a remembering scope is offered only
+   *  in the one session the request names for it (`rememberAt`, the bot's own
+   *  chat); everywhere else — and when it names none — it asks once. */
+  function viewFor(request) {
+    if (!Array.isArray(request?.remember) || request.remember.length <= 1) return request;
+    const here = ownSessionId();
+    return here && request.rememberAt === here ? request : { ...request, remember: ['once'] };
+  }
+  /** `extra` without a remember scope `view` did not offer. */
+  function onlyOffered(view, extra) {
+    if (!extra || extra.remember === undefined) return extra;
+    return (view?.remember || ['once']).includes(extra.remember) ? extra : { ...extra, remember: 'once' };
+  }
+  function offerDelegatedApproval(delegated) {
+    if (getDisposed() || delegated.sessionId !== ownSessionId()) return;
+    if (activeToolApproval?.id === delegated.id || toolApprovalQueue.some((entry) => entry.id === delegated.id)) return;
+    toolApprovalQueue.push({ id: delegated.id, request: viewFor(delegated.request), mirror: delegated, timer: null });
+    presentNextToolApproval();
+  }
+  function withdrawDelegatedCopy(id, result) {
+    if (activeToolApproval?.mirror && activeToolApproval.id === id) {
+      activeToolApproval = null;
+      const device = String(result?.device || '');
+      set({
+        toolApproval: null,
+        toolApprovalResult: device ? { id, approved: result.approved === true, device, at: Date.now() } : null,
+      });
+      presentNextToolApproval();
+      return;
+    }
+    const index = toolApprovalQueue.findIndex((entry) => entry.mirror && entry.id === id);
+    if (index >= 0) toolApprovalQueue.splice(index, 1);
+  }
+  /** Show the delegated approvals waiting for this session (it loaded, or its
+   *  session id became the top-level one after the request was made). */
+  function adoptDelegatedApprovals() {
+    const sessionId = ownSessionId();
+    if (!sessionId || typeof surfaceOf !== 'function') return;
+    for (const delegated of delegatedApprovalsFor(sessionId)) offerDelegatedApproval(delegated);
+  }
   function presentNextToolApproval() {
     if (activeToolApproval || getDisposed()) return;
     const entry = toolApprovalQueue.shift();
@@ -88,7 +183,8 @@ export function createToolApproval({ getState, set, nextId, getDisposed, timeout
     device = '',
     answers = undefined,
     reply = undefined,
-    extra = undefined
+    extra = undefined,
+    { forwarded = false } = {}
   ) {
     const targetId = String(id || '');
     if (activeToolApproval && activeToolApproval.id === targetId) {
@@ -100,44 +196,113 @@ export function createToolApproval({ getState, set, nextId, getDisposed, timeout
         ? { id: targetId, approved: approved === true, device: String(device), at: Date.now() }
         : null;
       set({ toolApproval: null, toolApprovalResult });
-      settleToolApproval(entry, approved === true, String(reason || ''), answers, reply, extra, String(device || ''));
+      let accepted = true;
+      if (entry.mirror) {
+        accepted = forwardToOwner(entry, approved, reason, device, answers, reply, extra);
+      } else {
+        settleToolApproval(
+          entry,
+          approved === true,
+          String(reason || ''),
+          answers,
+          reply,
+          extra,
+          String(device || ''),
+          forwarded
+        );
+      }
       presentNextToolApproval();
-      return true;
+      return accepted;
     }
     const index = toolApprovalQueue.findIndex((entry) => entry.id === targetId);
     if (index >= 0) {
       const [entry] = toolApprovalQueue.splice(index, 1);
-      settleToolApproval(entry, approved === true, String(reason || ''), answers, reply, extra, String(device || ''));
+      if (entry.mirror) return forwardToOwner(entry, approved, reason, device, answers, reply, extra);
+      settleToolApproval(
+        entry,
+        approved === true,
+        String(reason || ''),
+        answers,
+        reply,
+        extra,
+        String(device || ''),
+        forwarded
+      );
       return true;
     }
     return false;
   }
+  /** Deny this session's own requests. A copy of a sub-agent's request stays
+   *  (that agent still waits) until this runtime closes, which drops it
+   *  unanswered: the next runtime of this session adopts it again. */
   function denyAllToolApprovals(reason = 'approval cancelled') {
-    if (activeToolApproval) {
+    const closing = getDisposed();
+    if (closing) unregister();
+    if (activeToolApproval && !(activeToolApproval.mirror && !closing)) {
       const entry = activeToolApproval;
       activeToolApproval = null;
-      settleToolApproval(entry, false, reason);
+      if (!entry.mirror) settleToolApproval(entry, false, reason);
     }
+    const kept = [];
     while (toolApprovalQueue.length > 0) {
-      settleToolApproval(toolApprovalQueue.shift(), false, reason);
+      const entry = toolApprovalQueue.shift();
+      if (!entry.mirror) settleToolApproval(entry, false, reason);
+      else if (!closing) kept.push(entry);
     }
+    toolApprovalQueue.push(...kept);
+    if (activeToolApproval) return;
     if (getState().toolApproval) set({ toolApproval: null });
+    presentNextToolApproval();
   }
   function requestToolApproval(input = {}) {
     if (getDisposed()) return Promise.resolve({ approved: false, reason: 'runtime disposed' });
     return new Promise((resolve) => {
       const id = nextId();
-      const entry = { id, request: normalizeToolApprovalRequest(input, id), resolve, timer: null };
+      const full = normalizeToolApprovalRequest(input, id);
+      const surface = delegationSurface(full);
+      if (surface) {
+        // Who asks, from the top-level chat down ("사무관 › Worker"), and where the copy is.
+        full.chain = surface.chain;
+        full.surfaceSessionId = surface.sessionId;
+      }
+      // `request` is what this session shows (and accepts answers against);
+      // `full` what the copy in the top-level chat is made from.
+      const entry = { id, request: viewFor(full), full, resolve, timer: null, delegated: Boolean(surface) };
       toolApprovalQueue.push(entry);
       armToolApprovalTimeout(entry);
       presentNextToolApproval();
+      if (surface) {
+        delegateApproval({
+          id,
+          sessionId: surface.sessionId,
+          request: full,
+          answer: (approved, reason, device, answers, reply, extra) =>
+            finishToolApproval(id, approved, reason, device, answers, reply, extra, { forwarded: true }),
+        });
+      }
     });
   }
+  /** `{ sessionId, chain }` of the top-level chat a sub-agent's request also
+   *  shows in, or null (no delegation, another kind, or this is the top). */
+  function delegationSurface(request) {
+    if (typeof surfaceOf !== 'function' || !DELEGATED_KINDS.has(request.kind)) return null;
+    const own = String(request.sessionId || ownSessionId());
+    let surface = null;
+    try {
+      surface = surfaceOf(own);
+    } catch {
+      return null;
+    }
+    const sessionId = String(surface?.sessionId || '');
+    if (!sessionId || sessionId === own || sessionId === ownSessionId()) return null;
+    return { sessionId, chain: Array.isArray(surface.chain) ? surface.chain.map(String) : [] };
+  }
 
   return {
     presentNextToolApproval,
     finishToolApproval,
     denyAllToolApprovals,
     requestToolApproval,
+    adoptDelegatedApprovals,
   };
 }

package/src/tui/session/transcript-intake.mjs

@@ -123,6 +123,8 @@ export function createTranscriptIntake({ getState, flags, pushItem, patchItem, t
       ...routineTriggerField(extra),
       ...(extra && typeof extra.sender === 'string' && extra.sender ? { sender: extra.sender } : {}),
       ...(extra && typeof extra.device === 'string' && extra.device ? { device: extra.device } : {}),
+      // The bot that sent this message (a bot's `session send`).
+      ...(extra && typeof extra.fromAgent === 'string' && extra.fromAgent ? { fromAgent: extra.fromAgent } : {}),
       // Delivered into the running turn (steering): the desktop row's read mark.
       ...(extra?.steered === true ? { steered: true } : {}),
       // Byte-free attachment metadata (name/mime/size) from the queue entry —

package/src/tui/session/turn.mjs

@@ -10,8 +10,9 @@ import { applyUsageDelta } from './session-stats.mjs';
 import {
   createTranscriptRouteMetadata,
   transcriptRouteMetadataFields,
+  transcriptSourceFields,
 } from '../../runtime/shared/transcript-metadata.mjs';
-import { publishModelSwitch } from './session-api/routes.mjs';
+import { publishModelSwitch, publishSessionSwitches } from './session-api/routes.mjs';
 import { compactEventLabel } from '../../runtime/shared/compact-event-label.mjs';
 import { pickVerb, pickDoneVerb, compactEventDetail } from './labels.mjs';
 import { isCancelLikeError } from '../../runtime/shared/err-text.mjs';
@@ -172,6 +173,7 @@ function promptRestoreFor(displayText, options, submittedIds, content = null) {
     pastedImages: options.pastedImages && typeof options.pastedImages === 'object' ? options.pastedImages : null,
     pastedTexts: options.pastedTexts && typeof options.pastedTexts === 'object' ? options.pastedTexts : null,
     onCommitted: typeof options.onCommitted === 'function' ? options.onCommitted : null,
+    onAborted: typeof options.onAborted === 'function' ? options.onAborted : null,
     restorable: options.restorable !== false,
     submittedIds,
     // Which device submitted the prompt: only that device may get it back.
@@ -202,7 +204,7 @@ export function commitPromptRestore(flags, turn) {
   restore.content = null;
 }
 
-function steeringItemExtras(steeringMeta) {
+export function steeringItemExtras(steeringMeta) {
   return {
     // The steered message's stable id, so a compaction that drops it greys
     // this row.
@@ -217,12 +219,7 @@ function steeringItemExtras(steeringMeta) {
       ? { execution: steeringMeta.execution }
       : {}),
     ...(Array.isArray(steeringMeta?.images) && steeringMeta.images.length ? { images: steeringMeta.images } : {}),
-    ...(typeof steeringMeta?.transcriptMeta?.sender === 'string' && steeringMeta.transcriptMeta.sender
-      ? { sender: steeringMeta.transcriptMeta.sender }
-      : {}),
-    ...(typeof steeringMeta?.transcriptMeta?.device === 'string' && steeringMeta.transcriptMeta.device
-      ? { device: steeringMeta.transcriptMeta.device }
-      : {}),
+    ...transcriptSourceFields(steeringMeta?.transcriptMeta),
   };
 }
 
@@ -231,7 +228,7 @@ function steeringItemExtras(steeringMeta) {
 // first (including a streamed tail that never got a trailing '\n') so the
 // steered user turn and the next assistant response do not merge into one
 // bubble and the tail is not dropped when the injection races finalization.
-function injectSteerMessage({ stream, cards, pushUserOrSyntheticItem }, text, steeringMeta = {}) {
+export function injectSteerMessage({ stream, cards, pushUserOrSyntheticItem }, text, steeringMeta = {}) {
   // A suppressed live-completion twin is model-visible only; its Response
   // card was already pushed at delivery time.
   if (text === STEERING_SUPPRESSED_DISPLAY) return;
@@ -294,7 +291,7 @@ async function approveToolRequest(ctx, request) {
 // contextStatus path instead of competing with its provider-aligned value.
 function publishContextPressure({ syncContextStats, getState, set }, info) {
   if (info?.willCompact !== true) return;
-  const used = Math.max(0, Number(info?.usedTokens) || 0);
+  const used = Math.max(0, Number(info.usedTokens) || 0);
   if (!used) return;
   syncContextStats({ allowEstimated: true });
   set({ stats: { ...getState().stats } });
@@ -424,10 +421,18 @@ export function toolHandlers(ctx) {
       // state parked on screen until the next model event arrives.
       set({ spinner: { ...spinner, mode: 'requesting' } });
     },
-    onToolApproval: async (request) => {
-      if (!isCurrentTurn()) return { approved: false, reason: 'turn no longer active' };
-      return approveToolRequest(ctx, request);
-    },
+    onToolApproval: Object.assign(
+      async (request) => {
+        if (!isCurrentTurn()) return { approved: false, reason: 'turn no longer active' };
+        return approveToolRequest(ctx, request);
+      },
+      {
+        // A word to the person after their answer (e.g. an always-allow that could not be saved).
+        // A transcript notice of THIS session: the desktop's toast region draws only the
+        // host-level snapshot's toasts, while the pane that asked reads its own session lane.
+        notice: (text, tone = 'warn') => ctx.pushNotice?.(text, tone, { transcript: true }),
+      }
+    ),
   };
 }
 
@@ -768,6 +773,10 @@ export function createRunTurn(bag) {
           if (!isCurrentTurn()) return;
           publishModelSwitch(bag, boundary);
         },
+        onSessionSwitches: (switches) => {
+          if (!isCurrentTurn()) return;
+          publishSessionSwitches(bag, switches);
+        },
       });
       if (!isCurrentTurn()) turn.cancelled = true;
       else completeTurn(ctx, result, session);

package/src/tui/transcript-tool-failures.mjs

@@ -8,11 +8,14 @@ import { parseToolArgs } from '../runtime/shared/tool-surface.mjs';
 // Anchor to the orchestrator's actual denial envelope:
 //   `Error: tool "<name>" denied by hook[: ...]`
 //   `Error: tool "<name>" denied by hook: approval required but no approval UI is available`
+//   `Error: tool "<name>" was not approved: <reason>. Do not retry it …` (a person said no)
 // Matching the bare phrase anywhere in the body produced FALSE POSITIVES when a
 // normal (successful) tool result merely CONTAINED the text — e.g. a read/grep
 // over this very file or the hook source. The denial is always an Error
 // envelope emitted at the START of the result, so anchor on that prefix.
-const HOOK_DENIAL_RE = /^Error:\s*tool\s*"[^"]*"\s*denied by hook\b/im;
+const HOOK_DENIAL_RE = /^Error:\s*tool\s*"[^"]*"\s*(?:denied by hook|was not approved)\b/im;
+// The not-approved denial's instruction to the model, not shown to the user.
+const NOT_APPROVED_INSTRUCTION_RE = /\s*Do not retry it or reach the same result another way; report it\.\s*$/;
 const APPROVAL_UNAVAILABLE_RE = /denied by hook:\s*approval required but no approval UI is available/i;
 
 export function toolItemResultText(item) {
@@ -44,7 +47,10 @@ export function isHookApprovalDenialToolItem(item) {
 export function formatHookDenialDetail(text) {
   const raw = String(text ?? '').trim();
   if (!raw) return '';
-  const stripped = raw.replace(/^Error:\s*tool\s*"[^"]*"\s*/i, '').trim();
+  const stripped = raw
+    .replace(/^Error:\s*tool\s*"[^"]*"\s*/i, '')
+    .replace(NOT_APPROVED_INSTRUCTION_RE, '')
+    .trim();
   return stripped || raw;
 }
 

package/src/vendor/statusline/src/gateway/route-meta.mjs

@@ -1,8 +1,9 @@
 import {
   appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync,
-  renameSync, statSync, fstatSync, writeFileSync,
+  renameSync, statSync, fstatSync,
 } from 'fs';
-import { appendFile, mkdir, readFile, rename, writeFile } from 'fs/promises';
+import { appendFile, mkdir, readFile } from 'fs/promises';
+import { writeFileAtomicAsync, writeFileAtomicSync } from '../../../../runtime/shared/atomic-file.mjs';
 import { dirname, join } from 'path';
 import { resolvePluginData } from '../../../../runtime/shared/plugin-paths.mjs';
 import { readSection } from '../../../../runtime/shared/config.mjs';
@@ -586,9 +587,9 @@ function ensureUsageStoreMigrated() {
         if (!existsSync(store)) {
           const raw = readJsonFile(legacy);
           const events = (Array.isArray(raw?.events) ? raw.events : []).slice(-MAX_USAGE_EVENTS);
-          const tmp = `${store}.migrating.${process.pid}`;
-          writeFileSync(tmp, events.map(e => JSON.stringify(e) + '\n').join(''));
-          renameSync(tmp, store);
+          // Flushed before it is published: the store would otherwise be NUL
+          // after a crash, losing the migrated history.
+          writeFileAtomicSync(store, events.map(e => JSON.stringify(e) + '\n').join(''));
         }
         let backup = legacy + LEGACY_BACKUP_SUFFIX;
         if (existsSync(backup)) backup = `${legacy}.${Date.now()}${LEGACY_BACKUP_SUFFIX}`;
@@ -645,9 +646,7 @@ async function compactUsageStore(store) {
     await withFileLock(usageLockPath(store), async () => {
       const lines = (await readFile(store, 'utf8')).split('\n').filter(l => l.trim());
       if (lines.length <= MAX_USAGE_EVENTS * 1.5) return;
-      const tmp = `${store}.compact.${process.pid}`;
-      await writeFile(tmp, lines.slice(-MAX_USAGE_EVENTS).join('\n') + '\n');
-      await rename(tmp, store);
+      await writeFileAtomicAsync(store, lines.slice(-MAX_USAGE_EVENTS).join('\n') + '\n');
     });
   } catch {
     // Compaction is best effort; the next flush retries.

package/src/vendor/statusline/src/gateway/session-routes.mjs

@@ -1,7 +1,6 @@
-import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { resolvePluginData } from '../../../../runtime/shared/plugin-paths.mjs';
-import { updateJsonAtomicSync } from '../../../../runtime/shared/atomic-file.mjs';
+import { readJsonStateSync, updateJsonAtomicSync } from '../../../../runtime/shared/atomic-file.mjs';
 import { CLAUDE_CURRENT_MODE } from './claude-current.mjs';
 
 const STORE_FILE = 'gateway-session-routes.json';
@@ -68,9 +67,9 @@ export function gatewaySessionRoutesPath() {
 
 function readStore() {
   try {
-    const file = gatewaySessionRoutesPath();
-    if (!existsSync(file)) return {};
-    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    // A damaged store (NUL, truncated) is kept aside as *.corrupt-<ts> and its
+    // last good copy restored, so a session never loses its route pin to it.
+    const parsed = readJsonStateSync(gatewaySessionRoutesPath(), { fallback: {} });
     return parsed && typeof parsed === 'object' ? parsed : {};
   } catch {
     return {};
@@ -187,7 +186,7 @@ export function writeGatewaySessionRoutes(entries = []) {
         sessions: pruneRouteMap(sessions, updatedAt, MAX_SESSION_ROUTES),
         sessionHosts: pruneRouteMap(sessionHosts, updatedAt, MAX_HOST_ROUTES),
       };
-    }, { compact: true, fsync: false, fsyncDir: false });
+    }, { compact: true, backup: true });
     return true;
   } catch {
     return false;
@@ -216,7 +215,7 @@ export function clearGatewaySessionRoute(sessionId, options = {}) {
         delete sessions[sid];
       }
       return { version: 2, updatedAt: Date.now(), sessions, sessionHosts };
-    }, { compact: true, fsync: false, fsyncDir: false });
+    }, { compact: true, backup: true });
     return true;
   } catch {
     return false;

package/src/rules/agent-mode/ROUTINE.md

@@ -1,6 +0,0 @@
-- No user is present in this run. Do not wait for clarification; when
-  approval is required, follow the approval-hold path. Hand the result to the
-  configured delivery and do not send a duplicate message.
-- Report the outcome in plain words for the user; never name internal tools,
-  actions or parameters. If a sign-in, code or CAPTCHA blocks the task, stop
-  and say which site needs the user to sign in.